@atproto/oauth-client 0.5.13 → 0.6.0

package/dist/session-getter.js

@@ -53,6 +53,7 @@ var __disposeResources = (this && this.__disposeResources) || (function (Suppres
 });
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SessionGetter = void 0;
+exports.isExpectedSessionError = isExpectedSessionError;
 const simple_store_1 = require("@atproto-labs/simple-store");
 const auth_method_unsatisfiable_error_js_1 = require("./errors/auth-method-unsatisfiable-error.js");
 const token_invalid_error_js_1 = require("./errors/token-invalid-error.js");
@@ -60,6 +61,15 @@ const token_refresh_error_js_1 = require("./errors/token-refresh-error.js");
 const token_revoked_error_js_1 = require("./errors/token-revoked-error.js");
 const oauth_response_error_js_1 = require("./oauth-response-error.js");
 const util_js_1 = require("./util.js");
+function isExpectedSessionError(err) {
+    return (err instanceof token_refresh_error_js_1.TokenRefreshError ||
+        err instanceof token_revoked_error_js_1.TokenRevokedError ||
+        err instanceof token_invalid_error_js_1.TokenInvalidError ||
+        err instanceof auth_method_unsatisfiable_error_js_1.AuthMethodUnsatisfiableError ||
+        // The stored session is invalid (e.g. missing properties) and cannot
+        // be used properly
+        err instanceof TypeError);
+}
 /**
  * There are several advantages to wrapping the sessionStore in a (single)
  * CachedGetter, the main of which is that the cached getter will ensure that at
@@ -68,8 +78,8 @@ const util_js_1 = require("./util.js");
  * localStorage/indexedDB, will sync across multiple tabs (for a given sub).
  */
 class SessionGetter extends simple_store_1.CachedGetter {
-    constructor(sessionStore, serverFactory, runtime) {
-        super(async (sub, options, storedSession) => {
+    constructor(sessionStore, serverFactory, runtime, hooks = {}) {
+        super(async (sub, { signal }, storedSession) => {
             // There needs to be a previous session to be able to refresh. If
             // storedSession is undefined, it means that the store does not contain
             // a session for the given sub.
@@ -81,15 +91,13 @@ class SessionGetter extends simple_store_1.CachedGetter {
                 // make sure an event is dispatched here if this occurs.
                 const msg = 'The session was deleted by another process';
                 const cause = new token_refresh_error_js_1.TokenRefreshError(sub, msg);
-                this.dispatchEvent('deleted', { sub, cause });
+                await hooks.onDelete?.call(null, sub, cause);
                 throw cause;
             }
-            // From this point forward, throwing a TokenRefreshError will result in
-            // this.delStored() being called, resulting in an event being
-            // dispatched, even if the session was removed from the store through a
-            // concurrent access (which, normally, should not happen if a proper
-            // runtime lock was provided).
-            const { dpopKey, authMethod = 'legacy', tokenSet } = storedSession;
+            // @NOTE Throwing a TokenRefreshError (or any other error class defined
+            // in the deleteOnError options) will result in this.delStored() being
+            // called.
+            const { dpopKey, authMethod, tokenSet } = storedSession;
             if (sub !== tokenSet.sub) {
                 // Fool-proofing (e.g. against invalid session storage)
                 throw new token_refresh_error_js_1.TokenRefreshError(sub, 'Stored session sub mismatch');
@@ -97,22 +105,13 @@ class SessionGetter extends simple_store_1.CachedGetter {
             if (!tokenSet.refresh_token) {
                 throw new token_refresh_error_js_1.TokenRefreshError(sub, 'No refresh token available');
             }
-            // Since refresh tokens can only be used once, we might run into
-            // concurrency issues if multiple instances (e.g. browser tabs) are
-            // trying to refresh the same token simultaneously. The chances of this
-            // happening when multiple instances are started simultaneously is
-            // reduced by randomizing the expiry time (see isStale() below). The
-            // best solution is to use a mutex/lock to ensure that only one instance
-            // is refreshing the token at a time (runtime.usingLock) but that is not
-            // always possible. If no lock implementation is provided, we will use
-            // the store to check if a concurrent refresh occurred.
             const server = await serverFactory.fromIssuer(tokenSet.iss, authMethod, dpopKey);
             // Because refresh tokens can only be used once, we must not use the
             // "signal" to abort the refresh, or throw any abort error beyond this
             // point. Any thrown error beyond this point will prevent the
             // TokenGetter from obtaining, and storing, the new token set,
             // effectively rendering the currently saved session unusable.
-            options?.signal?.throwIfAborted();
+            signal?.throwIfAborted();
             try {
                 const newTokenSet = await server.refresh(tokenSet);
                 if (sub !== newTokenSet.sub) {
@@ -126,9 +125,16 @@ class SessionGetter extends simple_store_1.CachedGetter {
                 };
             }
             catch (cause) {
-                // If the refresh token is invalid, let's try to recover from
-                // concurrency issues, or make sure the session is deleted by throwing
-                // a TokenRefreshError.
+                // Since refresh tokens can only be used once, we might run into
+                // concurrency issues if multiple instances (e.g. browser tabs) are
+                // trying to refresh the same token simultaneously. The chances of
+                // this happening when multiple instances are started simultaneously
+                // is reduced by randomizing the expiry time (see isStale() below).
+                // The best solution is to use a mutex/lock to ensure that only one
+                // instance is refreshing the token at a time (runtime.usingLock) but
+                // that is not always possible. Let's try to recover from concurrency
+                // issues, or force the session to be deleted by throwing a
+                // TokenRefreshError.
                 if (cause instanceof oauth_response_error_js_1.OAuthResponseError &&
                     cause.status === 400 &&
                     cause.error === 'invalid_grant') {
@@ -176,25 +182,26 @@ class SessionGetter extends simple_store_1.CachedGetter {
                             // instances trying to refresh the token at the same.
                             30e3 * Math.random());
             },
-            onStoreError: async (err, sub, { tokenSet, dpopKey, authMethod = 'legacy' }) => {
-                if (!(err instanceof auth_method_unsatisfiable_error_js_1.AuthMethodUnsatisfiableError)) {
-                    // If the error was an AuthMethodUnsatisfiableError, there is no
-                    // point in trying to call `fromIssuer`.
-                    try {
-                        // If the token data cannot be stored, let's revoke it
-                        const server = await serverFactory.fromIssuer(tokenSet.iss, authMethod, dpopKey);
-                        await server.revoke(tokenSet.refresh_token ?? tokenSet.access_token);
-                    }
-                    catch {
-                        // Let the original error propagate
-                    }
+            onStoreError: async (err, sub, { tokenSet, dpopKey, authMethod }) => {
+                // If the token data cannot be stored, let's revoke it
+                try {
+                    const server = await serverFactory.fromIssuer(tokenSet.iss, authMethod, dpopKey);
+                    await server.revoke(tokenSet.refresh_token ?? tokenSet.access_token);
+                }
+                catch {
+                    // At least we tried...
+                }
+                // Attempt to delete the session from the store. Note that this might
+                // fail if the store is not available, which is fine.
+                try {
+                    await this.delStored(sub, err);
+                }
+                catch {
+                    // Ignore (better to propagate the original storage error)
                 }
                 throw err;
             },
-            deleteOnError: async (err) => err instanceof token_refresh_error_js_1.TokenRefreshError ||
-                err instanceof token_revoked_error_js_1.TokenRevokedError ||
-                err instanceof token_invalid_error_js_1.TokenInvalidError ||
-                err instanceof auth_method_unsatisfiable_error_js_1.AuthMethodUnsatisfiableError,
+            deleteOnError: isExpectedSessionError,
         });
         Object.defineProperty(this, "runtime", {
             enumerable: true,
@@ -202,21 +209,15 @@ class SessionGetter extends simple_store_1.CachedGetter {
             writable: true,
             value: runtime
         });
-        Object.defineProperty(this, "eventTarget", {
+        Object.defineProperty(this, "hooks", {
             enumerable: true,
             configurable: true,
             writable: true,
-            value: new util_js_1.CustomEventTarget()
+            value: hooks
         });
     }
-    addEventListener(type, callback, options) {
-        this.eventTarget.addEventListener(type, callback, options);
-    }
-    removeEventListener(type, callback, options) {
-        this.eventTarget.removeEventListener(type, callback, options);
-    }
-    dispatchEvent(type, detail) {
-        return this.eventTarget.dispatchCustomEvent(type, detail);
+    async getStored(sub, options) {
+        return super.getStored(sub, options);
     }
     async setStored(sub, session) {
         // Prevent tampering with the stored value
@@ -224,24 +225,16 @@ class SessionGetter extends simple_store_1.CachedGetter {
             throw new TypeError('Token set does not match the expected sub');
         }
         await super.setStored(sub, session);
-        this.dispatchEvent('updated', { sub, ...session });
+        await this.hooks.onUpdate?.call(null, sub, session);
     }
     async delStored(sub, cause) {
         await super.delStored(sub, cause);
-        this.dispatchEvent('deleted', { sub, cause });
+        await this.hooks.onDelete?.call(null, sub, cause);
     }
     /**
-     * @param refresh When `true`, the credentials will be refreshed even if they
-     * are not expired. When `false`, the credentials will not be refreshed even
-     * if they are expired. When `undefined`, the credentials will be refreshed
-     * if, and only if, they are (about to be) expired. Defaults to `undefined`.
+     * @deprecated Use {@link getSession} instead
+     * @internal (not really deprecated)
      */
-    async getSession(sub, refresh = 'auto') {
-        return this.get(sub, {
-            noCache: refresh === true,
-            allowStale: refresh === false,
-        });
-    }
     async get(sub, options) {
         const session = await this.runtime.usingLock(`@atproto-oauth-client-${sub}`, async () => {
             const env_1 = { stack: [], error: void 0, hasError: false };
@@ -269,6 +262,18 @@ class SessionGetter extends simple_store_1.CachedGetter {
         }
         return session;
     }
+    /**
+     * @param refresh When `true`, the credentials will be refreshed even if they
+     * are not expired. When `false`, the credentials will not be refreshed even
+     * if they are expired. When `undefined`, the credentials will be refreshed
+     * if, and only if, they are (about to be) expired. Defaults to `undefined`.
+     */
+    async getSession(sub, refresh = 'auto') {
+        return this.get(sub, {
+            noCache: refresh === true,
+            allowStale: refresh === false,
+        });
+    }
 }
 exports.SessionGetter = SessionGetter;
 //# sourceMappingURL=session-getter.js.map

package/dist/session-getter.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-getter.js","sourceRoot":"","sources":["../src/session-getter.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA,6DAImC;AACnC,oGAA0F;AAC1F,4EAAmE;AACnE,4EAAmE;AACnE,4EAAmE;AAEnE,uEAA8D;AAI9D,uCAA6D;AA2B7D;;;;;;GAMG;AACH,MAAa,aAAc,SAAQ,2BAAiC;IAGlE,YACE,YAA0B,EAC1B,aAAiC,EAChB,OAAgB;QAEjC,KAAK,CACH,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE;YACpC,iEAAiE;YACjE,uEAAuE;YACvE,+BAA+B;YAC/B,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAChC,mEAAmE;gBACnE,iEAAiE;gBACjE,iEAAiE;gBACjE,mEAAmE;gBACnE,wDAAwD;gBACxD,MAAM,GAAG,GAAG,4CAA4C,CAAA;gBACxD,MAAM,KAAK,GAAG,IAAI,0CAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;gBAC7C,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;gBAC7C,MAAM,KAAK,CAAA;YACb,CAAC;YAED,uEAAuE;YACvE,6DAA6D;YAC7D,uEAAuE;YACvE,oEAAoE;YACpE,8BAA8B;YAE9B,MAAM,EAAE,OAAO,EAAE,UAAU,GAAG,QAAQ,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAA;YAElE,IAAI,GAAG,KAAK,QAAQ,CAAC,GAAG,EAAE,CAAC;gBACzB,uDAAuD;gBACvD,MAAM,IAAI,0CAAiB,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAA;YACjE,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;gBAC5B,MAAM,IAAI,0CAAiB,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAA;YAChE,CAAC;YAED,gEAAgE;YAChE,mEAAmE;YACnE,uEAAuE;YACvE,kEAAkE;YAClE,oEAAoE;YACpE,wEAAwE;YACxE,wEAAwE;YACxE,sEAAsE;YACtE,uDAAuD;YAEvD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,UAAU,CAC3C,QAAQ,CAAC,GAAG,EACZ,UAAU,EACV,OAAO,CACR,CAAA;YAED,oEAAoE;YACpE,sEAAsE;YACtE,6DAA6D;YAC7D,8DAA8D;YAC9D,8DAA8D;YAC9D,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAA;YAEjC,IAAI,CAAC;gBACH,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;gBAElD,IAAI,GAAG,KAAK,WAAW,CAAC,GAAG,EAAE,CAAC;oBAC5B,iEAAiE;oBACjE,MAAM,IAAI,0CAAiB,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAA;gBAC5D,CAAC;gBAED,OAAO;oBACL,OAAO;oBACP,QAAQ,EAAE,WAAW;oBACrB,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B,CAAA;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,6DAA6D;gBAC7D,sEAAsE;gBACtE,uBAAuB;gBACvB,IACE,KAAK,YAAY,4CAAkB;oBACnC,KAAK,CAAC,MAAM,KAAK,GAAG;oBACpB,KAAK,CAAC,KAAK,KAAK,eAAe,EAC/B,CAAC;oBACD,kEAAkE;oBAClE,iEAAiE;oBACjE,kEAAkE;oBAClE,8DAA8D;oBAC9D,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC;wBACnC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAA;wBAE7C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;wBACxC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;4BACzB,6DAA6D;4BAC7D,sDAAsD;4BAEtD,sDAAsD;4BACtD,0DAA0D;4BAC1D,+CAA+C;4BAC/C,MAAM,GAAG,GAAG,4CAA4C,CAAA;4BACxD,MAAM,IAAI,0CAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;wBAClD,CAAC;6BAAM,IACL,MAAM,CAAC,QAAQ,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY;4BACtD,MAAM,CAAC,QAAQ,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa,EACxD,CAAC;4BACD,6DAA6D;4BAC7D,OAAO,MAAM,CAAA;wBACf,CAAC;6BAAM,CAAC;4BACN,0DAA0D;4BAC1D,0BAA0B;wBAC5B,CAAC;oBACH,CAAC;oBAED,oDAAoD;oBACpD,MAAM,GAAG,GAAG,KAAK,CAAC,gBAAgB,IAAI,yBAAyB,CAAA;oBAC/D,MAAM,IAAI,0CAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;gBAClD,CAAC;gBAED,MAAM,KAAK,CAAA;YACb,CAAC;QACH,CAAC,EACD,YAAY,EACZ;YACE,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;gBAC7B,OAAO,CACL,QAAQ,CAAC,UAAU,IAAI,IAAI;oBAC3B,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;wBACrC,IAAI,CAAC,GAAG,EAAE;4BACR,8DAA8D;4BAC9D,sBAAsB;4BACtB,IAAI;4BACJ,wDAAwD;4BACxD,qDAAqD;4BACrD,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,CACzB,CAAA;YACH,CAAC;YACD,YAAY,EAAE,KAAK,EACjB,GAAG,EACH,GAAG,EACH,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,GAAG,QAAiB,EAAE,EACrD,EAAE;gBACF,IAAI,CAAC,CAAC,GAAG,YAAY,iEAA4B,CAAC,EAAE,CAAC;oBACnD,gEAAgE;oBAChE,wCAAwC;oBACxC,IAAI,CAAC;wBACH,sDAAsD;wBACtD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,UAAU,CAC3C,QAAQ,CAAC,GAAG,EACZ,UAAU,EACV,OAAO,CACR,CAAA;wBACD,MAAM,MAAM,CAAC,MAAM,CACjB,QAAQ,CAAC,aAAa,IAAI,QAAQ,CAAC,YAAY,CAChD,CAAA;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,mCAAmC;oBACrC,CAAC;gBACH,CAAC;gBAED,MAAM,GAAG,CAAA;YACX,CAAC;YACD,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAC3B,GAAG,YAAY,0CAAiB;gBAChC,GAAG,YAAY,0CAAiB;gBAChC,GAAG,YAAY,0CAAiB;gBAChC,GAAG,YAAY,iEAA4B;SAC9C,CACF,CAAA;QApKD;;;;mBAAiB,OAAO;WAAS;QALlB;;;;mBAAc,IAAI,2BAAiB,EAAmB;WAAA;IA0KvE,CAAC;IAED,gBAAgB,CACd,IAAO,EACP,QAAiC,EACjC,OAA2C;QAE3C,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC5D,CAAC;IAED,mBAAmB,CACjB,IAAO,EACP,QAAiC,EACjC,OAAwC;QAExC,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC/D,CAAC;IAED,aAAa,CACX,IAAO,EACP,MAA0B;QAE1B,OAAO,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC3D,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAW,EAAE,OAAgB;QAC3C,0CAA0C;QAC1C,IAAI,GAAG,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjC,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAA;QAClE,CAAC;QACD,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QACnC,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC,CAAA;IACpD,CAAC;IAEQ,KAAK,CAAC,SAAS,CAAC,GAAe,EAAE,KAAe;QACvD,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACjC,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;IAC/C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,GAAe,EAAE,UAA4B,MAAM;QAClE,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE;YACnB,OAAO,EAAE,OAAO,KAAK,IAAI;YACzB,UAAU,EAAE,OAAO,KAAK,KAAK;SAC9B,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAe,EAAE,OAA0B;QACnD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAC1C,yBAAyB,GAAG,EAAE,EAC9B,KAAK,IAAI,EAAE;;;gBACT,iEAAiE;gBACjE,sDAAsD;gBACtD,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;gBAExC,MAAM,eAAe,kCAAG,IAAA,wBAAc,EAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,QAAA,CAAA;gBAEjE,OAAO,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;oBAC1B,GAAG,OAAO;oBACV,MAAM,EAAE,eAAe,CAAC,MAAM;iBAC/B,CAAC,CAAA;;;;;;;;;SACH,CACF,CAAA;QAED,IAAI,GAAG,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjC,uDAAuD;YACvD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;QAC9D,CAAC;QAED,OAAO,OAAO,CAAA;IAChB,CAAC;CACF;AAvPD,sCAuPC","sourcesContent":["import { AtprotoDid } from '@atproto/did'\nimport { Key } from '@atproto/jwk'\nimport {\n  CachedGetter,\n  GetCachedOptions,\n  SimpleStore,\n} from '@atproto-labs/simple-store'\nimport { AuthMethodUnsatisfiableError } from './errors/auth-method-unsatisfiable-error.js'\nimport { TokenInvalidError } from './errors/token-invalid-error.js'\nimport { TokenRefreshError } from './errors/token-refresh-error.js'\nimport { TokenRevokedError } from './errors/token-revoked-error.js'\nimport { ClientAuthMethod } from './oauth-client-auth.js'\nimport { OAuthResponseError } from './oauth-response-error.js'\nimport { TokenSet } from './oauth-server-agent.js'\nimport { OAuthServerFactory } from './oauth-server-factory.js'\nimport { Runtime } from './runtime.js'\nimport { CustomEventTarget, combineSignals } from './util.js'\n\nexport type Session = {\n  dpopKey: Key\n  /**\n   * Previous implementation of this lib did not define an `authMethod`\n   */\n  authMethod?: ClientAuthMethod\n  tokenSet: TokenSet\n}\n\nexport type SessionStore = SimpleStore<string, Session>\n\nexport type SessionEventMap = {\n  updated: {\n    sub: string\n  } & Session\n  deleted: {\n    sub: string\n    cause: TokenRefreshError | TokenRevokedError | TokenInvalidError | unknown\n  }\n}\n\nexport type SessionEventListener<\n  T extends keyof SessionEventMap = keyof SessionEventMap,\n> = (event: CustomEvent<SessionEventMap[T]>) => void\n\n/**\n * There are several advantages to wrapping the sessionStore in a (single)\n * CachedGetter, the main of which is that the cached getter will ensure that at\n * most one fresh call is ever being made. Another advantage, is that it\n * contains the logic for reading from the cache which, if the cache is based on\n * localStorage/indexedDB, will sync across multiple tabs (for a given sub).\n */\nexport class SessionGetter extends CachedGetter<AtprotoDid, Session> {\n  private readonly eventTarget = new CustomEventTarget<SessionEventMap>()\n\n  constructor(\n    sessionStore: SessionStore,\n    serverFactory: OAuthServerFactory,\n    private readonly runtime: Runtime,\n  ) {\n    super(\n      async (sub, options, storedSession) => {\n        // There needs to be a previous session to be able to refresh. If\n        // storedSession is undefined, it means that the store does not contain\n        // a session for the given sub.\n        if (storedSession === undefined) {\n          // Because the session is not in the store, this.delStored() method\n          // will not be called by the CachedGetter class (because there is\n          // nothing to delete). This would typically happen if there is no\n          // synchronization mechanism between instances of this class. Let's\n          // make sure an event is dispatched here if this occurs.\n          const msg = 'The session was deleted by another process'\n          const cause = new TokenRefreshError(sub, msg)\n          this.dispatchEvent('deleted', { sub, cause })\n          throw cause\n        }\n\n        // From this point forward, throwing a TokenRefreshError will result in\n        // this.delStored() being called, resulting in an event being\n        // dispatched, even if the session was removed from the store through a\n        // concurrent access (which, normally, should not happen if a proper\n        // runtime lock was provided).\n\n        const { dpopKey, authMethod = 'legacy', tokenSet } = storedSession\n\n        if (sub !== tokenSet.sub) {\n          // Fool-proofing (e.g. against invalid session storage)\n          throw new TokenRefreshError(sub, 'Stored session sub mismatch')\n        }\n\n        if (!tokenSet.refresh_token) {\n          throw new TokenRefreshError(sub, 'No refresh token available')\n        }\n\n        // Since refresh tokens can only be used once, we might run into\n        // concurrency issues if multiple instances (e.g. browser tabs) are\n        // trying to refresh the same token simultaneously. The chances of this\n        // happening when multiple instances are started simultaneously is\n        // reduced by randomizing the expiry time (see isStale() below). The\n        // best solution is to use a mutex/lock to ensure that only one instance\n        // is refreshing the token at a time (runtime.usingLock) but that is not\n        // always possible. If no lock implementation is provided, we will use\n        // the store to check if a concurrent refresh occurred.\n\n        const server = await serverFactory.fromIssuer(\n          tokenSet.iss,\n          authMethod,\n          dpopKey,\n        )\n\n        // Because refresh tokens can only be used once, we must not use the\n        // \"signal\" to abort the refresh, or throw any abort error beyond this\n        // point. Any thrown error beyond this point will prevent the\n        // TokenGetter from obtaining, and storing, the new token set,\n        // effectively rendering the currently saved session unusable.\n        options?.signal?.throwIfAborted()\n\n        try {\n          const newTokenSet = await server.refresh(tokenSet)\n\n          if (sub !== newTokenSet.sub) {\n            // The server returned another sub. Was the tokenSet manipulated?\n            throw new TokenRefreshError(sub, 'Token set sub mismatch')\n          }\n\n          return {\n            dpopKey,\n            tokenSet: newTokenSet,\n            authMethod: server.authMethod,\n          }\n        } catch (cause) {\n          // If the refresh token is invalid, let's try to recover from\n          // concurrency issues, or make sure the session is deleted by throwing\n          // a TokenRefreshError.\n          if (\n            cause instanceof OAuthResponseError &&\n            cause.status === 400 &&\n            cause.error === 'invalid_grant'\n          ) {\n            // In case there is no lock implementation in the runtime, we will\n            // wait for a short time to give the other concurrent instances a\n            // chance to finish their refreshing of the token. If a concurrent\n            // refresh did occur, we will pretend that this one succeeded.\n            if (!runtime.hasImplementationLock) {\n              await new Promise((r) => setTimeout(r, 1000))\n\n              const stored = await this.getStored(sub)\n              if (stored === undefined) {\n                // A concurrent refresh occurred and caused the session to be\n                // deleted (for a reason we can't know at this point).\n\n                // Using a distinct error message mainly for debugging\n                // purposes. Also, throwing a TokenRefreshError to trigger\n                // deletion through the deleteOnError callback.\n                const msg = 'The session was deleted by another process'\n                throw new TokenRefreshError(sub, msg, { cause })\n              } else if (\n                stored.tokenSet.access_token !== tokenSet.access_token ||\n                stored.tokenSet.refresh_token !== tokenSet.refresh_token\n              ) {\n                // A concurrent refresh occurred. Pretend this one succeeded.\n                return stored\n              } else {\n                // There were no concurrent refresh. The token is (likely)\n                // simply no longer valid.\n              }\n            }\n\n            // Make sure the session gets deleted from the store\n            const msg = cause.errorDescription ?? 'The session was revoked'\n            throw new TokenRefreshError(sub, msg, { cause })\n          }\n\n          throw cause\n        }\n      },\n      sessionStore,\n      {\n        isStale: (sub, { tokenSet }) => {\n          return (\n            tokenSet.expires_at != null &&\n            new Date(tokenSet.expires_at).getTime() <\n              Date.now() +\n                // Add some lee way to ensure the token is not expired when it\n                // reaches the server.\n                10e3 +\n                // Add some randomness to reduce the chances of multiple\n                // instances trying to refresh the token at the same.\n                30e3 * Math.random()\n          )\n        },\n        onStoreError: async (\n          err,\n          sub,\n          { tokenSet, dpopKey, authMethod = 'legacy' as const },\n        ) => {\n          if (!(err instanceof AuthMethodUnsatisfiableError)) {\n            // If the error was an AuthMethodUnsatisfiableError, there is no\n            // point in trying to call `fromIssuer`.\n            try {\n              // If the token data cannot be stored, let's revoke it\n              const server = await serverFactory.fromIssuer(\n                tokenSet.iss,\n                authMethod,\n                dpopKey,\n              )\n              await server.revoke(\n                tokenSet.refresh_token ?? tokenSet.access_token,\n              )\n            } catch {\n              // Let the original error propagate\n            }\n          }\n\n          throw err\n        },\n        deleteOnError: async (err) =>\n          err instanceof TokenRefreshError ||\n          err instanceof TokenRevokedError ||\n          err instanceof TokenInvalidError ||\n          err instanceof AuthMethodUnsatisfiableError,\n      },\n    )\n  }\n\n  addEventListener<T extends keyof SessionEventMap>(\n    type: T,\n    callback: SessionEventListener<T>,\n    options?: AddEventListenerOptions | boolean,\n  ) {\n    this.eventTarget.addEventListener(type, callback, options)\n  }\n\n  removeEventListener<T extends keyof SessionEventMap>(\n    type: T,\n    callback: SessionEventListener<T>,\n    options?: EventListenerOptions | boolean,\n  ) {\n    this.eventTarget.removeEventListener(type, callback, options)\n  }\n\n  dispatchEvent<T extends keyof SessionEventMap>(\n    type: T,\n    detail: SessionEventMap[T],\n  ): boolean {\n    return this.eventTarget.dispatchCustomEvent(type, detail)\n  }\n\n  async setStored(sub: string, session: Session) {\n    // Prevent tampering with the stored value\n    if (sub !== session.tokenSet.sub) {\n      throw new TypeError('Token set does not match the expected sub')\n    }\n    await super.setStored(sub, session)\n    this.dispatchEvent('updated', { sub, ...session })\n  }\n\n  override async delStored(sub: AtprotoDid, cause?: unknown): Promise<void> {\n    await super.delStored(sub, cause)\n    this.dispatchEvent('deleted', { sub, cause })\n  }\n\n  /**\n   * @param refresh When `true`, the credentials will be refreshed even if they\n   * are not expired. When `false`, the credentials will not be refreshed even\n   * if they are expired. When `undefined`, the credentials will be refreshed\n   * if, and only if, they are (about to be) expired. Defaults to `undefined`.\n   */\n  async getSession(sub: AtprotoDid, refresh: boolean | 'auto' = 'auto') {\n    return this.get(sub, {\n      noCache: refresh === true,\n      allowStale: refresh === false,\n    })\n  }\n\n  async get(sub: AtprotoDid, options?: GetCachedOptions): Promise<Session> {\n    const session = await this.runtime.usingLock(\n      `@atproto-oauth-client-${sub}`,\n      async () => {\n        // Make sure, even if there is no signal in the options, that the\n        // request will be cancelled after at most 30 seconds.\n        const signal = AbortSignal.timeout(30e3)\n\n        using abortController = combineSignals([options?.signal, signal])\n\n        return await super.get(sub, {\n          ...options,\n          signal: abortController.signal,\n        })\n      },\n    )\n\n    if (sub !== session.tokenSet.sub) {\n      // Fool-proofing (e.g. against invalid session storage)\n      throw new Error('Token set does not match the expected sub')\n    }\n\n    return session\n  }\n}\n"]}
+{"version":3,"file":"session-getter.js","sourceRoot":"","sources":["../src/session-getter.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmCA,wDAUC;AA3CD,6DAKmC;AACnC,oGAA0F;AAC1F,4EAAmE;AACnE,4EAAmE;AACnE,4EAAmE;AAEnE,uEAA8D;AAI9D,uCAA0C;AAkB1C,SAAgB,sBAAsB,CAAC,GAAY;IACjD,OAAO,CACL,GAAG,YAAY,0CAAiB;QAChC,GAAG,YAAY,0CAAiB;QAChC,GAAG,YAAY,0CAAiB;QAChC,GAAG,YAAY,iEAA4B;QAC3C,qEAAqE;QACrE,mBAAmB;QACnB,GAAG,YAAY,SAAS,CACzB,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAa,aAAc,SAAQ,2BAAiC;IAClE,YACE,YAA0B,EAC1B,aAAiC,EAChB,OAAgB,EAChB,QAAsB,EAAE;QAEzC,KAAK,CACH,KAAK,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,EAAE;YACvC,iEAAiE;YACjE,uEAAuE;YACvE,+BAA+B;YAC/B,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAChC,mEAAmE;gBACnE,iEAAiE;gBACjE,iEAAiE;gBACjE,mEAAmE;gBACnE,wDAAwD;gBACxD,MAAM,GAAG,GAAG,4CAA4C,CAAA;gBACxD,MAAM,KAAK,GAAG,IAAI,0CAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;gBAC7C,MAAM,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;gBAC5C,MAAM,KAAK,CAAA;YACb,CAAC;YAED,uEAAuE;YACvE,sEAAsE;YACtE,UAAU;YAEV,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAA;YAEvD,IAAI,GAAG,KAAK,QAAQ,CAAC,GAAG,EAAE,CAAC;gBACzB,uDAAuD;gBACvD,MAAM,IAAI,0CAAiB,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAA;YACjE,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;gBAC5B,MAAM,IAAI,0CAAiB,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAA;YAChE,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,UAAU,CAC3C,QAAQ,CAAC,GAAG,EACZ,UAAU,EACV,OAAO,CACR,CAAA;YAED,oEAAoE;YACpE,sEAAsE;YACtE,6DAA6D;YAC7D,8DAA8D;YAC9D,8DAA8D;YAC9D,MAAM,EAAE,cAAc,EAAE,CAAA;YAExB,IAAI,CAAC;gBACH,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;gBAElD,IAAI,GAAG,KAAK,WAAW,CAAC,GAAG,EAAE,CAAC;oBAC5B,iEAAiE;oBACjE,MAAM,IAAI,0CAAiB,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAA;gBAC5D,CAAC;gBAED,OAAO;oBACL,OAAO;oBACP,QAAQ,EAAE,WAAW;oBACrB,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B,CAAA;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,gEAAgE;gBAChE,mEAAmE;gBACnE,kEAAkE;gBAClE,oEAAoE;gBACpE,mEAAmE;gBACnE,mEAAmE;gBACnE,qEAAqE;gBACrE,qEAAqE;gBACrE,2DAA2D;gBAC3D,qBAAqB;gBACrB,IACE,KAAK,YAAY,4CAAkB;oBACnC,KAAK,CAAC,MAAM,KAAK,GAAG;oBACpB,KAAK,CAAC,KAAK,KAAK,eAAe,EAC/B,CAAC;oBACD,kEAAkE;oBAClE,iEAAiE;oBACjE,kEAAkE;oBAClE,8DAA8D;oBAC9D,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC;wBACnC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAA;wBAE7C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;wBACxC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;4BACzB,6DAA6D;4BAC7D,sDAAsD;4BAEtD,sDAAsD;4BACtD,0DAA0D;4BAC1D,+CAA+C;4BAC/C,MAAM,GAAG,GAAG,4CAA4C,CAAA;4BACxD,MAAM,IAAI,0CAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;wBAClD,CAAC;6BAAM,IACL,MAAM,CAAC,QAAQ,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY;4BACtD,MAAM,CAAC,QAAQ,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa,EACxD,CAAC;4BACD,6DAA6D;4BAC7D,OAAO,MAAM,CAAA;wBACf,CAAC;6BAAM,CAAC;4BACN,0DAA0D;4BAC1D,0BAA0B;wBAC5B,CAAC;oBACH,CAAC;oBAED,oDAAoD;oBACpD,MAAM,GAAG,GAAG,KAAK,CAAC,gBAAgB,IAAI,yBAAyB,CAAA;oBAC/D,MAAM,IAAI,0CAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;gBAClD,CAAC;gBAED,MAAM,KAAK,CAAA;YACb,CAAC;QACH,CAAC,EACD,YAAY,EACZ;YACE,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;gBAC7B,OAAO,CACL,QAAQ,CAAC,UAAU,IAAI,IAAI;oBAC3B,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;wBACrC,IAAI,CAAC,GAAG,EAAE;4BACR,8DAA8D;4BAC9D,sBAAsB;4BACtB,IAAI;4BACJ,wDAAwD;4BACxD,qDAAqD;4BACrD,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,CACzB,CAAA;YACH,CAAC;YACD,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE;gBAClE,sDAAsD;gBACtD,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,UAAU,CAC3C,QAAQ,CAAC,GAAG,EACZ,UAAU,EACV,OAAO,CACR,CAAA;oBACD,MAAM,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,IAAI,QAAQ,CAAC,YAAY,CAAC,CAAA;gBACtE,CAAC;gBAAC,MAAM,CAAC;oBACP,uBAAuB;gBACzB,CAAC;gBAED,qEAAqE;gBACrE,qDAAqD;gBACrD,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;gBAChC,CAAC;gBAAC,MAAM,CAAC;oBACP,0DAA0D;gBAC5D,CAAC;gBAED,MAAM,GAAG,CAAA;YACX,CAAC;YACD,aAAa,EAAE,sBAAsB;SACtC,CACF,CAAA;QA1JD;;;;mBAAiB,OAAO;WAAS;QACjC;;;;mBAAiB,KAAK;WAAmB;IA0J3C,CAAC;IAEQ,KAAK,CAAC,SAAS,CACtB,GAAe,EACf,OAAoB;QAEpB,OAAO,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IACtC,CAAC;IAEQ,KAAK,CAAC,SAAS,CAAC,GAAe,EAAE,OAAgB;QACxD,0CAA0C;QAC1C,IAAI,GAAG,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjC,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAA;QAClE,CAAC;QACD,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QACnC,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;IACrD,CAAC;IAEQ,KAAK,CAAC,SAAS,CAAC,GAAe,EAAE,KAAe;QACvD,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACjC,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;IACnD,CAAC;IAED;;;OAGG;IACM,KAAK,CAAC,GAAG,CAChB,GAAe,EACf,OAA0B;QAE1B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAC1C,yBAAyB,GAAG,EAAE,EAC9B,KAAK,IAAI,EAAE;;;gBACT,iEAAiE;gBACjE,sDAAsD;gBACtD,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;gBAExC,MAAM,eAAe,kCAAG,IAAA,wBAAc,EAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,QAAA,CAAA;gBAEjE,OAAO,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;oBAC1B,GAAG,OAAO;oBACV,MAAM,EAAE,eAAe,CAAC,MAAM;iBAC/B,CAAC,CAAA;;;;;;;;;SACH,CACF,CAAA;QAED,IAAI,GAAG,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjC,uDAAuD;YACvD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;QAC9D,CAAC;QAED,OAAO,OAAO,CAAA;IAChB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,GAAe,EAAE,UAA4B,MAAM;QAClE,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE;YACnB,OAAO,EAAE,OAAO,KAAK,IAAI;YACzB,UAAU,EAAE,OAAO,KAAK,KAAK;SAC9B,CAAC,CAAA;IACJ,CAAC;CACF;AAlOD,sCAkOC","sourcesContent":["import { AtprotoDid } from '@atproto/did'\nimport { Key } from '@atproto/jwk'\nimport {\n  CachedGetter,\n  GetCachedOptions,\n  GetOptions,\n  SimpleStore,\n} from '@atproto-labs/simple-store'\nimport { AuthMethodUnsatisfiableError } from './errors/auth-method-unsatisfiable-error.js'\nimport { TokenInvalidError } from './errors/token-invalid-error.js'\nimport { TokenRefreshError } from './errors/token-refresh-error.js'\nimport { TokenRevokedError } from './errors/token-revoked-error.js'\nimport { ClientAuthMethod } from './oauth-client-auth.js'\nimport { OAuthResponseError } from './oauth-response-error.js'\nimport { TokenSet } from './oauth-server-agent.js'\nimport { OAuthServerFactory } from './oauth-server-factory.js'\nimport { Runtime } from './runtime.js'\nimport { combineSignals } from './util.js'\n\nexport type Session = {\n  dpopKey: Key\n  authMethod: ClientAuthMethod\n  tokenSet: TokenSet\n}\n\nexport type SessionStore = SimpleStore<string, Session>\n\nexport type SessionHooks = {\n  onUpdate?: (sub: AtprotoDid, session: Session) => void\n  onDelete?: (\n    sub: AtprotoDid,\n    cause: TokenRefreshError | TokenRevokedError | TokenInvalidError | unknown,\n  ) => void\n}\n\nexport function isExpectedSessionError(err: unknown) {\n  return (\n    err instanceof TokenRefreshError ||\n    err instanceof TokenRevokedError ||\n    err instanceof TokenInvalidError ||\n    err instanceof AuthMethodUnsatisfiableError ||\n    // The stored session is invalid (e.g. missing properties) and cannot\n    // be used properly\n    err instanceof TypeError\n  )\n}\n\n/**\n * There are several advantages to wrapping the sessionStore in a (single)\n * CachedGetter, the main of which is that the cached getter will ensure that at\n * most one fresh call is ever being made. Another advantage, is that it\n * contains the logic for reading from the cache which, if the cache is based on\n * localStorage/indexedDB, will sync across multiple tabs (for a given sub).\n */\nexport class SessionGetter extends CachedGetter<AtprotoDid, Session> {\n  constructor(\n    sessionStore: SessionStore,\n    serverFactory: OAuthServerFactory,\n    private readonly runtime: Runtime,\n    private readonly hooks: SessionHooks = {},\n  ) {\n    super(\n      async (sub, { signal }, storedSession) => {\n        // There needs to be a previous session to be able to refresh. If\n        // storedSession is undefined, it means that the store does not contain\n        // a session for the given sub.\n        if (storedSession === undefined) {\n          // Because the session is not in the store, this.delStored() method\n          // will not be called by the CachedGetter class (because there is\n          // nothing to delete). This would typically happen if there is no\n          // synchronization mechanism between instances of this class. Let's\n          // make sure an event is dispatched here if this occurs.\n          const msg = 'The session was deleted by another process'\n          const cause = new TokenRefreshError(sub, msg)\n          await hooks.onDelete?.call(null, sub, cause)\n          throw cause\n        }\n\n        // @NOTE Throwing a TokenRefreshError (or any other error class defined\n        // in the deleteOnError options) will result in this.delStored() being\n        // called.\n\n        const { dpopKey, authMethod, tokenSet } = storedSession\n\n        if (sub !== tokenSet.sub) {\n          // Fool-proofing (e.g. against invalid session storage)\n          throw new TokenRefreshError(sub, 'Stored session sub mismatch')\n        }\n\n        if (!tokenSet.refresh_token) {\n          throw new TokenRefreshError(sub, 'No refresh token available')\n        }\n\n        const server = await serverFactory.fromIssuer(\n          tokenSet.iss,\n          authMethod,\n          dpopKey,\n        )\n\n        // Because refresh tokens can only be used once, we must not use the\n        // \"signal\" to abort the refresh, or throw any abort error beyond this\n        // point. Any thrown error beyond this point will prevent the\n        // TokenGetter from obtaining, and storing, the new token set,\n        // effectively rendering the currently saved session unusable.\n        signal?.throwIfAborted()\n\n        try {\n          const newTokenSet = await server.refresh(tokenSet)\n\n          if (sub !== newTokenSet.sub) {\n            // The server returned another sub. Was the tokenSet manipulated?\n            throw new TokenRefreshError(sub, 'Token set sub mismatch')\n          }\n\n          return {\n            dpopKey,\n            tokenSet: newTokenSet,\n            authMethod: server.authMethod,\n          }\n        } catch (cause) {\n          // Since refresh tokens can only be used once, we might run into\n          // concurrency issues if multiple instances (e.g. browser tabs) are\n          // trying to refresh the same token simultaneously. The chances of\n          // this happening when multiple instances are started simultaneously\n          // is reduced by randomizing the expiry time (see isStale() below).\n          // The best solution is to use a mutex/lock to ensure that only one\n          // instance is refreshing the token at a time (runtime.usingLock) but\n          // that is not always possible. Let's try to recover from concurrency\n          // issues, or force the session to be deleted by throwing a\n          // TokenRefreshError.\n          if (\n            cause instanceof OAuthResponseError &&\n            cause.status === 400 &&\n            cause.error === 'invalid_grant'\n          ) {\n            // In case there is no lock implementation in the runtime, we will\n            // wait for a short time to give the other concurrent instances a\n            // chance to finish their refreshing of the token. If a concurrent\n            // refresh did occur, we will pretend that this one succeeded.\n            if (!runtime.hasImplementationLock) {\n              await new Promise((r) => setTimeout(r, 1000))\n\n              const stored = await this.getStored(sub)\n              if (stored === undefined) {\n                // A concurrent refresh occurred and caused the session to be\n                // deleted (for a reason we can't know at this point).\n\n                // Using a distinct error message mainly for debugging\n                // purposes. Also, throwing a TokenRefreshError to trigger\n                // deletion through the deleteOnError callback.\n                const msg = 'The session was deleted by another process'\n                throw new TokenRefreshError(sub, msg, { cause })\n              } else if (\n                stored.tokenSet.access_token !== tokenSet.access_token ||\n                stored.tokenSet.refresh_token !== tokenSet.refresh_token\n              ) {\n                // A concurrent refresh occurred. Pretend this one succeeded.\n                return stored\n              } else {\n                // There were no concurrent refresh. The token is (likely)\n                // simply no longer valid.\n              }\n            }\n\n            // Make sure the session gets deleted from the store\n            const msg = cause.errorDescription ?? 'The session was revoked'\n            throw new TokenRefreshError(sub, msg, { cause })\n          }\n\n          throw cause\n        }\n      },\n      sessionStore,\n      {\n        isStale: (sub, { tokenSet }) => {\n          return (\n            tokenSet.expires_at != null &&\n            new Date(tokenSet.expires_at).getTime() <\n              Date.now() +\n                // Add some lee way to ensure the token is not expired when it\n                // reaches the server.\n                10e3 +\n                // Add some randomness to reduce the chances of multiple\n                // instances trying to refresh the token at the same.\n                30e3 * Math.random()\n          )\n        },\n        onStoreError: async (err, sub, { tokenSet, dpopKey, authMethod }) => {\n          // If the token data cannot be stored, let's revoke it\n          try {\n            const server = await serverFactory.fromIssuer(\n              tokenSet.iss,\n              authMethod,\n              dpopKey,\n            )\n            await server.revoke(tokenSet.refresh_token ?? tokenSet.access_token)\n          } catch {\n            // At least we tried...\n          }\n\n          // Attempt to delete the session from the store. Note that this might\n          // fail if the store is not available, which is fine.\n          try {\n            await this.delStored(sub, err)\n          } catch {\n            // Ignore (better to propagate the original storage error)\n          }\n\n          throw err\n        },\n        deleteOnError: isExpectedSessionError,\n      },\n    )\n  }\n\n  override async getStored(\n    sub: AtprotoDid,\n    options?: GetOptions,\n  ): Promise<Session | undefined> {\n    return super.getStored(sub, options)\n  }\n\n  override async setStored(sub: AtprotoDid, session: Session) {\n    // Prevent tampering with the stored value\n    if (sub !== session.tokenSet.sub) {\n      throw new TypeError('Token set does not match the expected sub')\n    }\n    await super.setStored(sub, session)\n    await this.hooks.onUpdate?.call(null, sub, session)\n  }\n\n  override async delStored(sub: AtprotoDid, cause?: unknown): Promise<void> {\n    await super.delStored(sub, cause)\n    await this.hooks.onDelete?.call(null, sub, cause)\n  }\n\n  /**\n   * @deprecated Use {@link getSession} instead\n   * @internal (not really deprecated)\n   */\n  override async get(\n    sub: AtprotoDid,\n    options?: GetCachedOptions,\n  ): Promise<Session> {\n    const session = await this.runtime.usingLock(\n      `@atproto-oauth-client-${sub}`,\n      async () => {\n        // Make sure, even if there is no signal in the options, that the\n        // request will be cancelled after at most 30 seconds.\n        const signal = AbortSignal.timeout(30e3)\n\n        using abortController = combineSignals([options?.signal, signal])\n\n        return await super.get(sub, {\n          ...options,\n          signal: abortController.signal,\n        })\n      },\n    )\n\n    if (sub !== session.tokenSet.sub) {\n      // Fool-proofing (e.g. against invalid session storage)\n      throw new Error('Token set does not match the expected sub')\n    }\n\n    return session\n  }\n\n  /**\n   * @param refresh When `true`, the credentials will be refreshed even if they\n   * are not expired. When `false`, the credentials will not be refreshed even\n   * if they are expired. When `undefined`, the credentials will be refreshed\n   * if, and only if, they are (about to be) expired. Defaults to `undefined`.\n   */\n  async getSession(sub: AtprotoDid, refresh: boolean | 'auto' = 'auto') {\n    return this.get(sub, {\n      noCache: refresh === true,\n      allowStale: refresh === false,\n    })\n  }\n}\n"]}

package/dist/state-store.d.ts

@@ -4,10 +4,20 @@ import { ClientAuthMethod } from './oauth-client-auth.js';
 export type InternalStateData = {
     iss: string;
     dpopKey: Key;
-    /** @note optional for legacy reasons */
-    authMethod?: ClientAuthMethod;
-    verifier?: string;
+    authMethod: ClientAuthMethod;
+    verifier: string;
     appState?: string;
 };
+/**
+ * A store pending oauth authorization flows. The key is the "state" parameter
+ * used in the authorization request, and the value is an object containing the
+ * necessary information to complete the flow once the user is redirected back
+ * to the client.
+ *
+ * @note The data stored in this store is typically short-lived. It should be
+ * automatically cleared after a certain period of time (e.g. 1 hour) to prevent
+ * the store from growing indefinitely. It is up to the implementation to
+ * implement this cleanup mechanism.
+ */
 export type StateStore = SimpleStore<string, InternalStateData>;
 //# sourceMappingURL=state-store.d.ts.map

package/dist/state-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"state-store.d.ts","sourceRoot":"","sources":["../src/state-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAEzD,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,EAAE,GAAG,CAAA;IACZ,wCAAwC;IACxC,UAAU,CAAC,EAAE,gBAAgB,CAAA;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAA"}
+{"version":3,"file":"state-store.d.ts","sourceRoot":"","sources":["../src/state-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAEzD,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,EAAE,GAAG,CAAA;IACZ,UAAU,EAAE,gBAAgB,CAAA;IAC5B,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAA"}

package/dist/state-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"state-store.js","sourceRoot":"","sources":["../src/state-store.ts"],"names":[],"mappings":"","sourcesContent":["import { Key } from '@atproto/jwk'\nimport { SimpleStore } from '@atproto-labs/simple-store'\nimport { ClientAuthMethod } from './oauth-client-auth.js'\n\nexport type InternalStateData = {\n  iss: string\n  dpopKey: Key\n  /** @note optional for legacy reasons */\n  authMethod?: ClientAuthMethod\n  verifier?: string\n  appState?: string\n}\n\nexport type StateStore = SimpleStore<string, InternalStateData>\n"]}
+{"version":3,"file":"state-store.js","sourceRoot":"","sources":["../src/state-store.ts"],"names":[],"mappings":"","sourcesContent":["import { Key } from '@atproto/jwk'\nimport { SimpleStore } from '@atproto-labs/simple-store'\nimport { ClientAuthMethod } from './oauth-client-auth.js'\n\nexport type InternalStateData = {\n  iss: string\n  dpopKey: Key\n  authMethod: ClientAuthMethod\n  verifier: string\n  appState?: string\n}\n\n/**\n * A store pending oauth authorization flows. The key is the \"state\" parameter\n * used in the authorization request, and the value is an object containing the\n * necessary information to complete the flow once the user is redirected back\n * to the client.\n *\n * @note The data stored in this store is typically short-lived. It should be\n * automatically cleared after a certain period of time (e.g. 1 hour) to prevent\n * the store from growing indefinitely. It is up to the implementation to\n * implement this cleanup mechanism.\n */\nexport type StateStore = SimpleStore<string, InternalStateData>\n"]}

package/dist/util.d.ts

@@ -4,15 +4,5 @@ export type Simplify<T> = {
 } & NonNullable<unknown>;
 export declare const ifString: <V>(v: V) => (V & string) | undefined;
 export declare function contentMime(headers: Headers): string | undefined;
-/**
- * Ponyfill for `CustomEvent` constructor.
- */
-export declare const CustomEvent: typeof globalThis.CustomEvent;
-export declare class CustomEventTarget<EventDetailMap extends Record<string, unknown>> {
-    readonly eventTarget: EventTarget;
-    addEventListener<T extends Extract<keyof EventDetailMap, string>>(type: T, callback: (event: CustomEvent<EventDetailMap[T]>) => void, options?: AddEventListenerOptions | boolean): void;
-    removeEventListener<T extends Extract<keyof EventDetailMap, string>>(type: T, callback: (event: CustomEvent<EventDetailMap[T]>) => void, options?: EventListenerOptions | boolean): void;
-    dispatchCustomEvent<T extends Extract<keyof EventDetailMap, string>>(type: T, detail: EventDetailMap[T], init?: EventInit): boolean;
-}
 export declare function combineSignals(signals: readonly (AbortSignal | undefined)[]): AbortController & Disposable;
 //# sourceMappingURL=util.d.ts.map

package/dist/util.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"util.d.ts","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;AAC7C,MAAM,MAAM,QAAQ,CAAC,CAAC,IAAI;KAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CAAE,GAAG,WAAW,CAAC,OAAO,CAAC,CAAA;AAEzE,eAAO,MAAM,QAAQ,GAAI,CAAC,EAAE,GAAG,CAAC,6BAA4C,CAAA;AAE5E,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAEhE;AAED;;GAEG;AACH,eAAO,MAAM,WAAW,EAAE,OAAO,UAAU,CAAC,WA4BtC,CAAA;AAEN,qBAAa,iBAAiB,CAAC,cAAc,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC3E,QAAQ,CAAC,WAAW,cAAoB;IAExC,gBAAgB,CAAC,CAAC,SAAS,OAAO,CAAC,MAAM,cAAc,EAAE,MAAM,CAAC,EAC9D,IAAI,EAAE,CAAC,EACP,QAAQ,EAAE,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EACzD,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,GAC1C,IAAI;IAIP,mBAAmB,CAAC,CAAC,SAAS,OAAO,CAAC,MAAM,cAAc,EAAE,MAAM,CAAC,EACjE,IAAI,EAAE,CAAC,EACP,QAAQ,EAAE,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EACzD,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,GACvC,IAAI;IAQP,mBAAmB,CAAC,CAAC,SAAS,OAAO,CAAC,MAAM,cAAc,EAAE,MAAM,CAAC,EACjE,IAAI,EAAE,CAAC,EACP,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,EACzB,IAAI,CAAC,EAAE,SAAS,GACf,OAAO;CAKX;AAED,wBAAgB,cAAc,CAC5B,OAAO,EAAE,SAAS,CAAC,WAAW,GAAG,SAAS,CAAC,EAAE,GAC5C,eAAe,GAAG,UAAU,CAwB9B"}
+{"version":3,"file":"util.d.ts","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;AAC7C,MAAM,MAAM,QAAQ,CAAC,CAAC,IAAI;KAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CAAE,GAAG,WAAW,CAAC,OAAO,CAAC,CAAA;AAEzE,eAAO,MAAM,QAAQ,GAAI,CAAC,EAAE,GAAG,CAAC,6BAA4C,CAAA;AAE5E,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAEhE;AAED,wBAAgB,cAAc,CAC5B,OAAO,EAAE,SAAS,CAAC,WAAW,GAAG,SAAS,CAAC,EAAE,GAC5C,eAAe,GAAG,UAAU,CAwB9B"}

package/dist/util.js

@@ -1,17 +1,6 @@
 "use strict";
-var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
-    if (kind === "m") throw new TypeError("Private method is not writable");
-    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
-    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
-    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
-};
-var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
-    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
-    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
-    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
-};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CustomEventTarget = exports.CustomEvent = exports.ifString = void 0;
+exports.ifString = void 0;
 exports.contentMime = contentMime;
 exports.combineSignals = combineSignals;
 const ifString = (v) => (typeof v === 'string' ? v : undefined);
@@ -19,58 +8,6 @@ exports.ifString = ifString;
 function contentMime(headers) {
     return headers.get('content-type')?.split(';')[0].trim();
 }
-/**
- * Ponyfill for `CustomEvent` constructor.
- */
-exports.CustomEvent = globalThis.CustomEvent ??
-    (() => {
-        var _CustomEvent_detail;
-        class CustomEvent extends Event {
-            constructor(type, options) {
-                if (!arguments.length)
-                    throw new TypeError('type argument is required');
-                super(type, options);
-                _CustomEvent_detail.set(this, void 0);
-                __classPrivateFieldSet(this, _CustomEvent_detail, options?.detail ?? null, "f");
-            }
-            get detail() {
-                return __classPrivateFieldGet(this, _CustomEvent_detail, "f");
-            }
-        }
-        _CustomEvent_detail = new WeakMap();
-        Object.defineProperties(CustomEvent.prototype, {
-            [Symbol.toStringTag]: {
-                writable: false,
-                enumerable: false,
-                configurable: true,
-                value: 'CustomEvent',
-            },
-            detail: {
-                enumerable: true,
-            },
-        });
-        return CustomEvent;
-    })();
-class CustomEventTarget {
-    constructor() {
-        Object.defineProperty(this, "eventTarget", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: new EventTarget()
-        });
-    }
-    addEventListener(type, callback, options) {
-        this.eventTarget.addEventListener(type, callback, options);
-    }
-    removeEventListener(type, callback, options) {
-        this.eventTarget.removeEventListener(type, callback, options);
-    }
-    dispatchCustomEvent(type, detail, init) {
-        return this.eventTarget.dispatchEvent(new exports.CustomEvent(type, { ...init, detail }));
-    }
-}
-exports.CustomEventTarget = CustomEventTarget;
 function combineSignals(signals) {
     const controller = new DisposableAbortController();
     const onAbort = function (_event) {

package/dist/util.js.map

@@ -1 +1 @@
-{"version":3,"file":"util.js","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":";;;;;;;;;;;;;;AAKA,kCAEC;AAqED,wCA0BC;AAnGM,MAAM,QAAQ,GAAG,CAAI,CAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;AAA/D,QAAA,QAAQ,YAAuD;AAE5E,SAAgB,WAAW,CAAC,OAAgB;IAC1C,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAA;AAC3D,CAAC;AAED;;GAEG;AACU,QAAA,WAAW,GACtB,UAAU,CAAC,WAAW;IACtB,CAAC,GAAG,EAAE;;QACJ,MAAM,WAAe,SAAQ,KAAK;YAEhC,YAAY,IAAY,EAAE,OAA4B;gBACpD,IAAI,CAAC,SAAS,CAAC,MAAM;oBAAE,MAAM,IAAI,SAAS,CAAC,2BAA2B,CAAC,CAAA;gBACvE,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;gBAHtB,sCAAiB;gBAIf,uBAAA,IAAI,uBAAW,OAAO,EAAE,MAAM,IAAI,IAAI,MAAA,CAAA;YACxC,CAAC;YACD,IAAI,MAAM;gBACR,OAAO,uBAAA,IAAI,2BAAQ,CAAA;YACrB,CAAC;SACF;;QAED,MAAM,CAAC,gBAAgB,CAAC,WAAW,CAAC,SAAS,EAAE;YAC7C,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE;gBACpB,QAAQ,EAAE,KAAK;gBACf,UAAU,EAAE,KAAK;gBACjB,YAAY,EAAE,IAAI;gBAClB,KAAK,EAAE,aAAa;aACrB;YACD,MAAM,EAAE;gBACN,UAAU,EAAE,IAAI;aACjB;SACF,CAAC,CAAA;QAEF,OAAO,WAAW,CAAA;IACpB,CAAC,CAAC,EAAE,CAAA;AAEN,MAAa,iBAAiB;IAA9B;QACW;;;;mBAAc,IAAI,WAAW,EAAE;WAAA;IA+B1C,CAAC;IA7BC,gBAAgB,CACd,IAAO,EACP,QAAyD,EACzD,OAA2C;QAE3C,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAyB,EAAE,OAAO,CAAC,CAAA;IAC7E,CAAC;IAED,mBAAmB,CACjB,IAAO,EACP,QAAyD,EACzD,OAAwC;QAExC,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAClC,IAAI,EACJ,QAAyB,EACzB,OAAO,CACR,CAAA;IACH,CAAC;IAED,mBAAmB,CACjB,IAAO,EACP,MAAyB,EACzB,IAAgB;QAEhB,OAAO,IAAI,CAAC,WAAW,CAAC,aAAa,CACnC,IAAI,mBAAW,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,CAC3C,CAAA;IACH,CAAC;CACF;AAhCD,8CAgCC;AAED,SAAgB,cAAc,CAC5B,OAA6C;IAE7C,MAAM,UAAU,GAAG,IAAI,yBAAyB,EAAE,CAAA;IAElD,MAAM,OAAO,GAAG,UAA6B,MAAa;QACxD,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC,4BAA4B,EAAE;YACrD,KAAK,EAAE,IAAI,CAAC,MAAM;SACnB,CAAC,CAAA;QAEF,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAC1B,CAAC,CAAA;IAED,IAAI,CAAC;QACH,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,GAAG,EAAE,CAAC;gBACR,GAAG,CAAC,cAAc,EAAE,CAAA;gBACpB,GAAG,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;YACvE,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAA;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACrB,MAAM,GAAG,CAAA;IACX,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,yBAA0B,SAAQ,eAAe;IACrD,CAAC,MAAM,CAAC,OAAO,CAAC;QACd,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAA;IACvD,CAAC;CACF","sourcesContent":["export type Awaitable<T> = T | PromiseLike<T>\nexport type Simplify<T> = { [K in keyof T]: T[K] } & NonNullable<unknown>\n\nexport const ifString = <V>(v: V) => (typeof v === 'string' ? v : undefined)\n\nexport function contentMime(headers: Headers): string | undefined {\n  return headers.get('content-type')?.split(';')[0]!.trim()\n}\n\n/**\n * Ponyfill for `CustomEvent` constructor.\n */\nexport const CustomEvent: typeof globalThis.CustomEvent =\n  globalThis.CustomEvent ??\n  (() => {\n    class CustomEvent<T> extends Event {\n      #detail: T | null\n      constructor(type: string, options?: CustomEventInit<T>) {\n        if (!arguments.length) throw new TypeError('type argument is required')\n        super(type, options)\n        this.#detail = options?.detail ?? null\n      }\n      get detail() {\n        return this.#detail\n      }\n    }\n\n    Object.defineProperties(CustomEvent.prototype, {\n      [Symbol.toStringTag]: {\n        writable: false,\n        enumerable: false,\n        configurable: true,\n        value: 'CustomEvent',\n      },\n      detail: {\n        enumerable: true,\n      },\n    })\n\n    return CustomEvent\n  })()\n\nexport class CustomEventTarget<EventDetailMap extends Record<string, unknown>> {\n  readonly eventTarget = new EventTarget()\n\n  addEventListener<T extends Extract<keyof EventDetailMap, string>>(\n    type: T,\n    callback: (event: CustomEvent<EventDetailMap[T]>) => void,\n    options?: AddEventListenerOptions | boolean,\n  ): void {\n    this.eventTarget.addEventListener(type, callback as EventListener, options)\n  }\n\n  removeEventListener<T extends Extract<keyof EventDetailMap, string>>(\n    type: T,\n    callback: (event: CustomEvent<EventDetailMap[T]>) => void,\n    options?: EventListenerOptions | boolean,\n  ): void {\n    this.eventTarget.removeEventListener(\n      type,\n      callback as EventListener,\n      options,\n    )\n  }\n\n  dispatchCustomEvent<T extends Extract<keyof EventDetailMap, string>>(\n    type: T,\n    detail: EventDetailMap[T],\n    init?: EventInit,\n  ): boolean {\n    return this.eventTarget.dispatchEvent(\n      new CustomEvent(type, { ...init, detail }),\n    )\n  }\n}\n\nexport function combineSignals(\n  signals: readonly (AbortSignal | undefined)[],\n): AbortController & Disposable {\n  const controller = new DisposableAbortController()\n\n  const onAbort = function (this: AbortSignal, _event: Event) {\n    const reason = new Error('This operation was aborted', {\n      cause: this.reason,\n    })\n\n    controller.abort(reason)\n  }\n\n  try {\n    for (const sig of signals) {\n      if (sig) {\n        sig.throwIfAborted()\n        sig.addEventListener('abort', onAbort, { signal: controller.signal })\n      }\n    }\n\n    return controller\n  } catch (err) {\n    controller.abort(err)\n    throw err\n  }\n}\n\n/**\n * Allows using {@link AbortController} with the `using` keyword, in order to\n * automatically abort them once the execution block ends.\n */\nclass DisposableAbortController extends AbortController implements Disposable {\n  [Symbol.dispose]() {\n    this.abort(new Error('AbortController was disposed'))\n  }\n}\n"]}
+{"version":3,"file":"util.js","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":";;;AAKA,kCAEC;AAED,wCA0BC;AAhCM,MAAM,QAAQ,GAAG,CAAI,CAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;AAA/D,QAAA,QAAQ,YAAuD;AAE5E,SAAgB,WAAW,CAAC,OAAgB;IAC1C,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAA;AAC3D,CAAC;AAED,SAAgB,cAAc,CAC5B,OAA6C;IAE7C,MAAM,UAAU,GAAG,IAAI,yBAAyB,EAAE,CAAA;IAElD,MAAM,OAAO,GAAG,UAA6B,MAAa;QACxD,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC,4BAA4B,EAAE;YACrD,KAAK,EAAE,IAAI,CAAC,MAAM;SACnB,CAAC,CAAA;QAEF,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAC1B,CAAC,CAAA;IAED,IAAI,CAAC;QACH,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,GAAG,EAAE,CAAC;gBACR,GAAG,CAAC,cAAc,EAAE,CAAA;gBACpB,GAAG,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;YACvE,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAA;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACrB,MAAM,GAAG,CAAA;IACX,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,yBAA0B,SAAQ,eAAe;IACrD,CAAC,MAAM,CAAC,OAAO,CAAC;QACd,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAA;IACvD,CAAC;CACF","sourcesContent":["export type Awaitable<T> = T | PromiseLike<T>\nexport type Simplify<T> = { [K in keyof T]: T[K] } & NonNullable<unknown>\n\nexport const ifString = <V>(v: V) => (typeof v === 'string' ? v : undefined)\n\nexport function contentMime(headers: Headers): string | undefined {\n  return headers.get('content-type')?.split(';')[0]!.trim()\n}\n\nexport function combineSignals(\n  signals: readonly (AbortSignal | undefined)[],\n): AbortController & Disposable {\n  const controller = new DisposableAbortController()\n\n  const onAbort = function (this: AbortSignal, _event: Event) {\n    const reason = new Error('This operation was aborted', {\n      cause: this.reason,\n    })\n\n    controller.abort(reason)\n  }\n\n  try {\n    for (const sig of signals) {\n      if (sig) {\n        sig.throwIfAborted()\n        sig.addEventListener('abort', onAbort, { signal: controller.signal })\n      }\n    }\n\n    return controller\n  } catch (err) {\n    controller.abort(err)\n    throw err\n  }\n}\n\n/**\n * Allows using {@link AbortController} with the `using` keyword, in order to\n * automatically abort them once the execution block ends.\n */\nclass DisposableAbortController extends AbortController implements Disposable {\n  [Symbol.dispose]() {\n    this.abort(new Error('AbortController was disposed'))\n  }\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atproto/oauth-client",
-  "version": "0.5.13",
+  "version": "0.6.0",
   "license": "MIT",
   "description": "OAuth client for ATPROTO PDS. This package serves as common base for environment-specific implementations (NodeJS, Browser, React-Native).",
   "keywords": [
@@ -28,16 +28,16 @@
     "core-js": "^3",
     "multiformats": "^9.9.0",
     "zod": "^3.23.8",
-    "@atproto-labs/did-resolver": "0.2.5",
-    "@atproto-labs/fetch": "0.2.3",
-    "@atproto-labs/handle-resolver": "0.3.5",
-    "@atproto-labs/identity-resolver": "0.3.5",
-    "@atproto-labs/simple-store": "0.3.0",
-    "@atproto-labs/simple-store-memory": "0.1.4",
-    "@atproto/did": "0.2.4",
-    "@atproto/jwk": "0.6.0",
-    "@atproto/oauth-types": "0.6.1",
-    "@atproto/xrpc": "0.7.7"
+    "@atproto-labs/did-resolver": "^0.2.6",
+    "@atproto-labs/fetch": "^0.2.3",
+    "@atproto-labs/handle-resolver": "^0.3.6",
+    "@atproto-labs/identity-resolver": "^0.3.6",
+    "@atproto-labs/simple-store": "^0.3.0",
+    "@atproto-labs/simple-store-memory": "^0.1.4",
+    "@atproto/did": "^0.3.0",
+    "@atproto/jwk": "^0.6.0",
+    "@atproto/oauth-types": "^0.6.3",
+    "@atproto/xrpc": "^0.7.7"
   },
   "devDependencies": {
     "typescript": "^5.6.3"