@atproto/oauth-client 0.5.14 → 0.6.0

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @atproto/oauth-client
 
+## 0.6.0
+
+### Minor Changes
+
+- [#4642](https://github.com/bluesky-social/atproto/pull/4642) [`a23d132`](https://github.com/bluesky-social/atproto/commit/a23d13268ccfd51a54d21256469b8cb43f7b07df) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Remove support for legacy session data that does not contain `authMethod`.
+
+- [#4642](https://github.com/bluesky-social/atproto/pull/4642) [`a23d132`](https://github.com/bluesky-social/atproto/commit/a23d13268ccfd51a54d21256469b8cb43f7b07df) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Remove dependency on `EventTarget` (missing in some environments)
+
+### Patch Changes
+
+- [#4642](https://github.com/bluesky-social/atproto/pull/4642) [`a23d132`](https://github.com/bluesky-social/atproto/commit/a23d13268ccfd51a54d21256469b8cb43f7b07df) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Delete any pre-existing OAuth session when a new one is created (for a given `sub`)
+
+- [#4642](https://github.com/bluesky-social/atproto/pull/4642) [`a23d132`](https://github.com/bluesky-social/atproto/commit/a23d13268ccfd51a54d21256469b8cb43f7b07df) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Avoid throwing errors when trying to revoke a missing or invalid session
+
 ## 0.5.14
 
 ### Patch Changes

package/dist/oauth-client.d.ts

@@ -12,12 +12,12 @@ import { OAuthServerFactory } from './oauth-server-factory.js';
 import { OAuthSession } from './oauth-session.js';
 import { RuntimeImplementation } from './runtime-implementation.js';
 import { Runtime } from './runtime.js';
-import { SessionEventMap, SessionGetter, SessionStore } from './session-getter.js';
+import { SessionGetter, SessionHooks, SessionStore } from './session-getter.js';
 import { InternalStateData, StateStore } from './state-store.js';
 import { AuthorizeOptions, CallbackOptions, ClientMetadata } from './types.js';
-import { CustomEventTarget } from './util.js';
-export { type AuthorizationServerMetadataCache, type DidCache, type DpopNonceCache, type Fetch, type HandleCache, type HandleResolver, type InternalStateData, Key, Keyset, type OAuthClientMetadata, type OAuthClientMetadataInput, type OAuthResponseMode, type ProtectedResourceMetadataCache, type RuntimeImplementation, type SessionStore, type StateStore, };
-export type OAuthClientOptions = CreateIdentityResolverOptions & {
+export type { AuthorizationServerMetadataCache, CreateIdentityResolverOptions, DidCache, DpopNonceCache, Fetch, HandleCache, HandleResolver, InternalStateData, OAuthClientMetadata, OAuthClientMetadataInput, OAuthResponseMode, ProtectedResourceMetadataCache, RuntimeImplementation, SessionHooks, SessionStore, StateStore, };
+export { Key, Keyset };
+export type OAuthClientOptions = {
     responseMode: OAuthResponseMode;
     clientMetadata: Readonly<OAuthClientMetadataInput>;
     keyset?: Keyset | Iterable<Key | undefined | null | false>;
@@ -43,14 +43,13 @@ export type OAuthClientOptions = CreateIdentityResolverOptions & {
     dpopNonceCache?: DpopNonceCache;
     runtimeImplementation: RuntimeImplementation;
     fetch?: Fetch;
-};
-export type OAuthClientEventMap = SessionEventMap;
+} & CreateIdentityResolverOptions & SessionHooks;
 export type OAuthClientFetchMetadataOptions = {
     clientId: OAuthClientIdDiscoverable;
     fetch?: Fetch;
     signal?: AbortSignal;
 };
-export declare class OAuthClient extends CustomEventTarget<OAuthClientEventMap> {
+export declare class OAuthClient {
     static fetchMetadata({ clientId, fetch, signal, }: OAuthClientFetchMetadataOptions): Promise<{
         redirect_uris: [`http://[::1]${string}` | "http://127.0.0.1" | `http://127.0.0.1#${string}` | `http://127.0.0.1?${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}` | `https://${string}` | `${string}.${string}:/${string}`, ...(`http://[::1]${string}` | "http://127.0.0.1" | `http://127.0.0.1#${string}` | `http://127.0.0.1?${string}` | `http://127.0.0.1/${string}` | `http://127.0.0.1:${string}` | `https://${string}` | `${string}.${string}:/${string}`)[]];
         response_types: ["code" | "none" | "token" | "code id_token token" | "code id_token" | "code token" | "id_token token" | "id_token", ...("code" | "none" | "token" | "code id_token token" | "code id_token" | "code token" | "id_token token" | "id_token")[]];
@@ -330,7 +329,7 @@ export declare class OAuthClient extends CustomEventTarget<OAuthClientEventMap>
      * Load a stored session. This will refresh the token only if needed (about to
      * expire) by default.
      *
-     * @param refresh See {@link SessionGetter.getSession}
+     * @see {@link SessionGetter.restore}
      */
     restore(sub: string, refresh?: boolean | 'auto'): Promise<OAuthSession>;
     revoke(sub: string): Promise<void>;

package/dist/oauth-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-client.d.ts","sourceRoot":"","sources":["../src/oauth-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,EAEL,yBAAyB,EACzB,mBAAmB,EACnB,wBAAwB,EACxB,iBAAiB,EAElB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,UAAU,EACV,QAAQ,EAIT,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AAC3C,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AAM3E,OAAO,EACL,6BAA6B,EAE9B,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,gCAAgC,EAEjC,MAAM,mDAAmD,CAAA;AAG1D,OAAO,EAEL,8BAA8B,EAC/B,MAAM,iDAAiD,CAAA;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AACnE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EACL,eAAe,EACf,aAAa,EACb,YAAY,EACb,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAChE,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAI7C,OAAO,EACL,KAAK,gCAAgC,EACrC,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,KAAK,EACV,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,GAAG,EACH,MAAM,EACN,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,KAAK,8BAA8B,EACnC,KAAK,qBAAqB,EAC1B,KAAK,YAAY,EACjB,KAAK,UAAU,GAChB,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG,6BAA6B,GAAG;IAE/D,YAAY,EAAE,iBAAiB,CAAA;IAC/B,cAAc,EAAE,QAAQ,CAAC,wBAAwB,CAAC,CAAA;IAClD,MAAM,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC,GAAG,GAAG,SAAS,GAAG,IAAI,GAAG,KAAK,CAAC,CAAA;IAC1D;;;;;;;;;;;;;OAaG;IACH,SAAS,CAAC,EAAE,OAAO,CAAA;IAGnB,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,EAAE,YAAY,CAAA;IAC1B,gCAAgC,CAAC,EAAE,gCAAgC,CAAA;IACnE,8BAA8B,CAAC,EAAE,8BAA8B,CAAA;IAC/D,cAAc,CAAC,EAAE,cAAc,CAAA;IAG/B,qBAAqB,EAAE,qBAAqB,CAAA;IAC5C,KAAK,CAAC,EAAE,KAAK,CAAA;CACd,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG,eAAe,CAAA;AAEjD,MAAM,MAAM,+BAA+B,GAAG;IAC5C,QAAQ,EAAE,yBAAyB,CAAA;IACnC,KAAK,CAAC,EAAE,KAAK,CAAA;IACb,MAAM,CAAC,EAAE,WAAW,CAAA;CACrB,CAAA;AAED,qBAAa,WAAY,SAAQ,iBAAiB,CAAC,mBAAmB,CAAC;WACxD,aAAa,CAAC,EACzB,QAAQ,EACR,KAAwB,EACxB,MAAM,GACP,EAAE,+BAA+B;;;;;;;;;;;;;;;;;;mBAyY7B,CAAC;mBAKK,CAAC;mBACqB,CAAC;uBAI5B,CAAC;mBACoD,CAAC;mBAEtD,CAAC;0BACkC,CAAC;mBAEpC,CAAN;mBAEI,CAAH;mBAC8B,CAAC;mBAE5B,CAAC;mBAAqC,CAAC;uBAI3C,CAAA;;0BAEK,CAAC;;iBAEqB,CAAC;iBAAmC,CAAC;iBAG5C,CAAC;kBAAoC,CAAC;kBAAoC,CAAC;kBAAoC,CAAC;mBAAqC,CAAC;qBAAqB,CAAC;qBAAuC,CAAC;qBAAuC,CAAC;;;;;;;;;mBAA0P,CAAC;mBAA0D,CAAC;mBAAqC,CAAC;uBAAgD,CAAC;mBAAmI,CAAC;mBAAuC,CAAC;0BAA4C,CAAC;mBAAqC,CAAC;mBAAqC,CAAC;mBAAsC,CAAC;mBAAqC,CAAC;mBAAqC,CAAC;uBAAyC,CAAC;;0BAA8D,CAAC;;iBAA8D,CAAC;;;;;;;;mBAA6M,CAAC;mBAAuC,CAAC;mBAAqC,CAAC;uBAAgD,CAAC;mBAAmI,CAAC;mBAAuC,CAAC;0BAA4C,CAAC;mBAAqC,CAAC;mBAAqC,CAAC;mBAAsC,CAAC;mBAAqC,CAAC;mBAAqC,CAAC;uBAAyC,CAAC;;0BAA8D,CAAC;;iBAA8D,CAAC;;;;;;;mBAA+L,CAAC;mBAAsC,CAAC;mBAAqC,CAAC;uBAAgD,CAAC;mBAAmI,CAAC;mBAAuC,CAAC;0BAA4C,CAAC;mBAAqC,CAAC;mBAAqC,CAAC;mBAAsC,CAAC;mBAAqC,CAAC;mBAAqC,CAAC;uBAAyC,CAAC;;0BAA8D,CAAC;;iBAA8D,CAAC;;;;iBAAwG,CAAC;;;;;;;;;;;;;;;;;;;;IA5YjlG,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAA;IACvC,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAA;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IAGxB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;IACrB,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAA;IACrC,QAAQ,CAAC,aAAa,EAAE,kBAAkB,CAAA;IAG1C,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAA;IAC/C,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;gBAE7B,OAAO,EAAE,kBAAkB;IAyEvC,IAAI,gBAAgB,+DAEnB;IAED,IAAI,IAAI;;;;;eAzME,CAAC;eACa,CAAC;eAC1B,CAAC;mBACF,CAAC;eAGe,CAAC;eAGb,CAAC;sBACe,CAAC;eAAqC,CAAC;eAC5B,CAAC;eAAsC,CAAC;eAC1C,CAAC;eACT,CAAC;mBAAyC,CAAC;;sBAEV,CAAC;;aAG/C,CAAC;aAEL,CAAC;aAEE,CAAA;cACa,CAAC;cAGP,CAAC;cACQ,CAAC;eAEtB,CAAC;iBAAqB,CAAC;iBACA,CAAC;iBAEZ,CAAC;;;;;aAMJ,CAAC;;;;;;eAG2C,CAAC;eACpB,CAAC;eAClC,CAAF;mBAAgD,CAAC;eAGoB,CAAC;eACvC,CAAC;sBAA4C,CAAC;eAEnE,CAAC;eACiB,CAAC;eAAsC,CAAC;eACtC,CAAC;eAAqC,CAAC;mBAClC,CAAC;;sBAKhC,CAAC;;aAEQ,CAAC;;;;aACgC,CAAC;;;;;;eAQlC,CAAC;eAEZ,CAAC;eAAqC,CAAC;mBAEtC,CAAC;eAKe,CAAC;eAEN,CAAC;sBAEE,CAAC;eACH,CAAC;eAEO,CAAC;eACN,CAAC;eAGhB,CAAA;eAEA,CADJ;mBAEM,CAAA;;sBAC+B,CAAA;;aAG1B,CAAC;;;;aACF,CAAC;;;;;eAEkB,CAAC;eACM,CAAC;eACjC,CAAJ;mBAEyC,CAAC;eAQd,CAAC;eACH,CAAC;sBAIzB,CADD;eACuB,CAAC;eAEd,CAAA;eACF,CAAC;eAGR,CADA;eACyB,CAAC;mBACT,CAAC;;sBAEiB,CAAC;;aAKhC,CAAD;;;;aAC+B,CAAC;;OAyElC;IAEK,SAAS,CACb,KAAK,EAAE,MAAM,EACb,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,GAAE,gBAAqB,GAC5C,OAAO,CAAC,GAAG,CAAC;IAwGf;;;OAGG;IACG,YAAY,CAAC,YAAY,EAAE,GAAG;IAY9B,QAAQ,CACZ,MAAM,EAAE,eAAe,EACvB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC;QACT,OAAO,EAAE,YAAY,CAAA;QACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KACrB,CAAC;IAkGF;;;;;OAKG;IACG,OAAO,CACX,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,OAAO,GAAG,MAAe,GACjC,OAAO,CAAC,YAAY,CAAC;IA+BlB,MAAM,CAAC,GAAG,EAAE,MAAM;IA2BxB,SAAS,CAAC,aAAa,CACrB,MAAM,EAAE,gBAAgB,EACxB,GAAG,EAAE,UAAU,GACd,YAAY;CAGhB"}
+{"version":3,"file":"oauth-client.d.ts","sourceRoot":"","sources":["../src/oauth-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,EAEL,yBAAyB,EACzB,mBAAmB,EACnB,wBAAwB,EACxB,iBAAiB,EAElB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,UAAU,EACV,QAAQ,EAIT,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AAC3C,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AAM3E,OAAO,EACL,6BAA6B,EAE9B,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,gCAAgC,EAEjC,MAAM,mDAAmD,CAAA;AAG1D,OAAO,EAEL,8BAA8B,EAC/B,MAAM,iDAAiD,CAAA;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AACnE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EACL,aAAa,EACb,YAAY,EACZ,YAAY,EAEb,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAChE,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAI9E,YAAY,EACV,gCAAgC,EAChC,6BAA6B,EAC7B,QAAQ,EACR,cAAc,EACd,KAAK,EACL,WAAW,EACX,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACnB,wBAAwB,EACxB,iBAAiB,EACjB,8BAA8B,EAC9B,qBAAqB,EACrB,YAAY,EACZ,YAAY,EACZ,UAAU,GACX,CAAA;AAED,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAA;AAEtB,MAAM,MAAM,kBAAkB,GAAG;IAE/B,YAAY,EAAE,iBAAiB,CAAA;IAC/B,cAAc,EAAE,QAAQ,CAAC,wBAAwB,CAAC,CAAA;IAClD,MAAM,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC,GAAG,GAAG,SAAS,GAAG,IAAI,GAAG,KAAK,CAAC,CAAA;IAC1D;;;;;;;;;;;;;OAaG;IACH,SAAS,CAAC,EAAE,OAAO,CAAA;IAGnB,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,EAAE,YAAY,CAAA;IAC1B,gCAAgC,CAAC,EAAE,gCAAgC,CAAA;IACnE,8BAA8B,CAAC,EAAE,8BAA8B,CAAA;IAC/D,cAAc,CAAC,EAAE,cAAc,CAAA;IAG/B,qBAAqB,EAAE,qBAAqB,CAAA;IAC5C,KAAK,CAAC,EAAE,KAAK,CAAA;CACd,GAAG,6BAA6B,GAC/B,YAAY,CAAA;AAEd,MAAM,MAAM,+BAA+B,GAAG;IAC5C,QAAQ,EAAE,yBAAyB,CAAA;IACnC,KAAK,CAAC,EAAE,KAAK,CAAA;IACb,MAAM,CAAC,EAAE,WAAW,CAAA;CACrB,CAAA;AAED,qBAAa,WAAW;WACT,aAAa,CAAC,EACzB,QAAQ,EACR,KAAwB,EACxB,MAAM,GACP,EAAE,+BAA+B;;;;;;;;;;;;;;;;;;mBAgZ/B,CAAC;mBAEF,CAAF;mBAC2B,CAAC;uBACV,CAAC;mBAMD,CAAC;mBAAuC,CAAC;0BAIzC,CAAC;mBAEjB,CAAF;mBACgB,CAAC;mBACkB,CAAC;mBACpC,CAAC;mBAE+B,CAAC;uBAAyC,CAAC;;0BAA8D,CAAC;;iBAA8D,CAAC;iBAAmC,CAAC;iBAAmC,CAAC;kBAAoC,CAAC;kBAAoC,CAAC;kBAAoC,CAAC;mBAAqC,CAAC;qBAAqB,CAAC;qBAAuC,CAAC;qBAAuC,CAAC;;;;;;;;;mBAA0P,CAAC;mBAA0D,CAAC;mBAAqC,CAAC;uBAAgD,CAAC;mBAAmI,CAAC;mBAAuC,CAAC;0BAA4C,CAAC;mBAAqC,CAAC;mBAAqC,CAAC;mBAAsC,CAAC;mBAAqC,CAAC;mBAAqC,CAAC;uBAAyC,CAAC;;0BAA8D,CAAC;;iBAA8D,CAAC;;;;;;;;mBAA6M,CAAC;mBAAuC,CAAC;mBAAqC,CAAC;uBAAgD,CAAC;mBAAmI,CAAC;mBAAuC,CAAC;0BAA4C,CAAC;mBAAqC,CAAC;mBAAqC,CAAC;mBAAsC,CAAC;mBAAqC,CAAC;mBAAqC,CAAC;uBAAyC,CAAC;;0BAA8D,CAAC;;iBAA8D,CAAC;;;;;;;mBAA+L,CAAC;mBAAsC,CAAC;mBAAqC,CAAC;uBAAgD,CAAC;mBAAmI,CAAC;mBAAuC,CAAC;0BAA4C,CAAC;mBAAqC,CAAC;mBAAqC,CAAC;mBAAsC,CAAC;mBAAqC,CAAC;mBAAqC,CAAC;uBAAyC,CAAC;;0BAA8D,CAAC;;iBAA8D,CAAC;;;;iBAAwG,CAAC;;;;;;;;;;;;;;;;;;;;IAxY70G,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAA;IACvC,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAA;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IAGxB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;IACrB,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAA;IACrC,QAAQ,CAAC,aAAa,EAAE,kBAAkB,CAAA;IAG1C,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAA;IAC/C,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;gBAE7B,OAAO,EAAE,kBAAkB;IA+DvC,IAAI,gBAAgB,+DAEnB;IAED,IAAI,IAAI;;;;;eAhME,CAAC;eACa,CAAC;eAC1B,CAAC;mBACF,CAAC;eAIC,CAAF;eAEO,CAAC;sBACkB,CAAC;eACQ,CAAC;eAC3B,CAAA;eAAsC,CAAC;eACzC,CAAA;eAAqC,CAAC;mBAE/B,CAAC;;sBAEX,CAAC;;aAC0B,CAAC;aAG5B,CAAC;aAEW,CAAC;cAEH,CAAC;cAEb,CAAD;cACe,CAAC;eACG,CAAC;iBAEnB,CAAA;iBAIO,CAAA;iBAEe,CAAC;;;;;aAIH,CAAC;;;;;;eAGkB,CAAC;eAChB,CAAC;eAAqC,CAAC;mBAG9D,CAAA;eACsD,CAAA;eACzC,CAAC;sBAEA,CAAC;eAAqC,CAAC;eACtC,CAAC;eAAsC,CAAC;eACtC,CAAC;eAEnB,CAAF;mBAGM,CAAC;;sBAEQ,CAAC;;aACR,CAAC;;;;aAGC,CAAC;;;;;;eAMkB,CAAC;eACT,CAAC;eAEjB,CAAC;mBAIJ,CAAA;eAKI,CAAC;eAES,CAAC;sBACA,CAAC;eAGd,CAAF;eAAqC,CAAC;eAGlC,CAAL;eACK,CAAC;eAAqC,CAAC;mBAIzC,CAFJ;;sBAC6D,CAAC;;aAC1C,CAAC;;;;aAEb,CAAC;;;;;eAImB,CAAC;eAEX,CAAC;eAEO,CAAC;mBAIlB,CAAC;eAKI,CAAC;eAEb,CAAC;sBACI,CAAC;eAGN,CADF;eACyB,CAAC;eACZ,CAAC;eAER,CAAC;eACJ,CAAH;mBAEW,CAAC;;sBAEyC,CAAC;;aACT,CAAC;;;;aAIV,CAAC;;OA2DnC;IAEK,SAAS,CACb,KAAK,EAAE,MAAM,EACb,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,GAAE,gBAAqB,GAC5C,OAAO,CAAC,GAAG,CAAC;IAwGf;;;OAGG;IACG,YAAY,CAAC,YAAY,EAAE,GAAG;IAY9B,QAAQ,CACZ,MAAM,EAAE,eAAe,EACvB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC;QACT,OAAO,EAAE,YAAY,CAAA;QACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KACrB,CAAC;IA0GF;;;;;OAKG;IACG,OAAO,CACX,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,OAAO,GAAG,MAAe,GACjC,OAAO,CAAC,YAAY,CAAC;IA4BlB,MAAM,CAAC,GAAG,EAAE,MAAM;IA4BxB,SAAS,CAAC,aAAa,CACrB,MAAM,EAAE,gBAAgB,EACxB,GAAG,EAAE,UAAU,GACd,YAAY;CAGhB"}

package/dist/oauth-client.js

@@ -21,9 +21,8 @@ const oauth_server_factory_js_1 = require("./oauth-server-factory.js");
 const oauth_session_js_1 = require("./oauth-session.js");
 const runtime_js_1 = require("./runtime.js");
 const session_getter_js_1 = require("./session-getter.js");
-const util_js_1 = require("./util.js");
 const validate_client_metadata_js_1 = require("./validate-client-metadata.js");
-class OAuthClient extends util_js_1.CustomEventTarget {
+class OAuthClient {
     static async fetchMetadata({ clientId, fetch = globalThis.fetch, signal, }) {
         signal?.throwIfAborted();
         const request = new Request(clientId, {
@@ -46,14 +45,6 @@ class OAuthClient extends util_js_1.CustomEventTarget {
         return oauth_types_1.oauthClientMetadataSchema.parse(json);
     }
     constructor(options) {
-        const { stateStore, sessionStore, dpopNonceCache = new simple_store_memory_1.SimpleStoreMemory({ ttl: 60e3, max: 100 }), authorizationServerMetadataCache = new simple_store_memory_1.SimpleStoreMemory({
-            ttl: 60e3,
-            max: 100,
-        }), protectedResourceMetadataCache = new simple_store_memory_1.SimpleStoreMemory({
-            ttl: 60e3,
-            max: 100,
-        }), responseMode, clientMetadata, runtimeImplementation, keyset, } = options;
-        super();
         // Config
         Object.defineProperty(this, "clientMetadata", {
             enumerable: true,
@@ -111,6 +102,13 @@ class OAuthClient extends util_js_1.CustomEventTarget {
             writable: true,
             value: void 0
         });
+        const { stateStore, sessionStore, dpopNonceCache = new simple_store_memory_1.SimpleStoreMemory({ ttl: 60e3, max: 100 }), authorizationServerMetadataCache = new simple_store_memory_1.SimpleStoreMemory({
+            ttl: 60e3,
+            max: 100,
+        }), protectedResourceMetadataCache = new simple_store_memory_1.SimpleStoreMemory({
+            ttl: 60e3,
+            max: 100,
+        }), responseMode, clientMetadata, runtimeImplementation, keyset, } = options;
         this.keyset = keyset
             ? keyset instanceof jwk_1.Keyset
                 ? keyset
@@ -122,16 +120,8 @@ class OAuthClient extends util_js_1.CustomEventTarget {
         this.fetch = options.fetch ?? globalThis.fetch;
         this.oauthResolver = new oauth_resolver_js_1.OAuthResolver((0, identity_resolver_js_1.createIdentityResolver)(options), new oauth_protected_resource_metadata_resolver_js_1.OAuthProtectedResourceMetadataResolver(protectedResourceMetadataCache, this.fetch, { allowHttpResource: options.allowHttp }), new oauth_authorization_server_metadata_resolver_js_1.OAuthAuthorizationServerMetadataResolver(authorizationServerMetadataCache, this.fetch, { allowHttpIssuer: options.allowHttp }));
         this.serverFactory = new oauth_server_factory_js_1.OAuthServerFactory(this.clientMetadata, this.runtime, this.oauthResolver, this.fetch, this.keyset, dpopNonceCache);
-        this.sessionGetter = new session_getter_js_1.SessionGetter(sessionStore, this.serverFactory, this.runtime);
         this.stateStore = stateStore;
-        // Proxy sessionGetter events
-        for (const type of ['deleted', 'updated']) {
-            this.sessionGetter.addEventListener(type, (event) => {
-                if (!this.dispatchCustomEvent(type, event.detail)) {
-                    event.preventDefault();
-                }
-            });
-        }
+        this.sessionGetter = new session_getter_js_1.SessionGetter(sessionStore, this.serverFactory, this.runtime, options);
     }
     // Exposed as public API for convenience
     get identityResolver() {
@@ -251,9 +241,7 @@ class OAuthClient extends util_js_1.CustomEventTarget {
             if (!codeParam) {
                 throw new oauth_callback_error_js_1.OAuthCallbackError(params, 'Missing "code" query param', stateData.appState);
             }
-            const server = await this.serverFactory.fromIssuer(stateData.iss, 
-            // Using the literal 'legacy' if the authMethod is not defined (because stateData was created through an old version of this lib)
-            stateData.authMethod ?? 'legacy', stateData.dpopKey);
+            const server = await this.serverFactory.fromIssuer(stateData.iss, stateData.authMethod, stateData.dpopKey);
             if (issuerParam != null) {
                 if (!server.issuer) {
                     throw new oauth_callback_error_js_1.OAuthCallbackError(params, 'Issuer not found in metadata', stateData.appState);
@@ -266,6 +254,14 @@ class OAuthClient extends util_js_1.CustomEventTarget {
                 throw new oauth_callback_error_js_1.OAuthCallbackError(params, 'iss missing from the response', stateData.appState);
             }
             const tokenSet = await server.exchangeCode(codeParam, stateData.verifier, options?.redirect_uri ?? server.clientMetadata.redirect_uris[0]);
+            // We revoke any existing session first to avoid leaving orphaned sessions
+            // on the AS.
+            try {
+                await this.revoke(tokenSet.sub);
+            }
+            catch {
+                // No existing session, or failed to get it. This is fine.
+            }
             try {
                 await this.sessionGetter.setStored(tokenSet.sub, {
                     dpopKey: stateData.dpopKey,
@@ -290,12 +286,12 @@ class OAuthClient extends util_js_1.CustomEventTarget {
      * Load a stored session. This will refresh the token only if needed (about to
      * expire) by default.
      *
-     * @param refresh See {@link SessionGetter.getSession}
+     * @see {@link SessionGetter.restore}
      */
     async restore(sub, refresh = 'auto') {
         // sub arg is lightly typed for convenience of library user
         (0, did_resolver_1.assertAtprotoDid)(sub);
-        const { dpopKey, authMethod = 'legacy', tokenSet, } = await this.sessionGetter.getSession(sub, refresh);
+        const { dpopKey, authMethod, tokenSet } = await this.sessionGetter.getSession(sub, refresh);
         try {
             const server = await this.serverFactory.fromIssuer(tokenSet.iss, authMethod, dpopKey, {
                 noCache: refresh === true,
@@ -313,9 +309,14 @@ class OAuthClient extends util_js_1.CustomEventTarget {
     async revoke(sub) {
         // sub arg is lightly typed for convenience of library user
         (0, did_resolver_1.assertAtprotoDid)(sub);
-        const { dpopKey, authMethod = 'legacy', tokenSet, } = await this.sessionGetter.get(sub, {
-            allowStale: true,
+        const res = await this.sessionGetter.getSession(sub, false).catch((err) => {
+            if ((0, session_getter_js_1.isExpectedSessionError)(err))
+                return null;
+            throw err;
         });
+        if (!res)
+            return;
+        const { dpopKey, authMethod, tokenSet } = res;
         // NOT using `;(await this.restore(sub, false)).signOut()` because we want
         // the tokens to be deleted even if it was not possible to fetch the issuer
         // data.

package/dist/oauth-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-client.js","sourceRoot":"","sources":["../src/oauth-client.ts"],"names":[],"mappings":";;;AAAA,sCAA0C;AA8DxC,oFA9DO,SAAG,OA8DP;AACH,uFA/DY,YAAM,OA+DZ;AA9DR,sDAO6B;AAC7B,6DAMmC;AAGnC,uEAAgE;AAChE,2EAAqE;AACrE,iDAA6C;AAC7C,oGAA0F;AAC1F,4EAAmE;AACnE,iEAG+B;AAC/B,uHAG0D;AAC1D,uEAA8D;AAC9D,iEAAkE;AAClE,mHAGwD;AACxD,2DAAmD;AAEnD,uEAA8D;AAC9D,yDAAiD;AAEjD,6CAAsC;AACtC,2DAI4B;AAG5B,uCAA6C;AAC7C,+EAAsE;AA+DtE,MAAa,WAAY,SAAQ,2BAAsC;IACrE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,EACzB,QAAQ,EACR,KAAK,GAAG,UAAU,CAAC,KAAK,EACxB,MAAM,GAC0B;QAChC,MAAM,EAAE,cAAc,EAAE,CAAA;QAExB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,EAAE;YACpC,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,MAAM;SACf,CAAC,CAAA;QACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAA;QAErC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAA;YACzB,MAAM,IAAI,SAAS,CAAC,oCAAoC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;QAC5E,CAAC;QAED,mGAAmG;QACnG,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACvE,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;YAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAA;YACzB,MAAM,IAAI,SAAS,CAAC,yCAAyC,IAAI,EAAE,CAAC,CAAA;QACtE,CAAC;QAED,MAAM,IAAI,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QAE3C,MAAM,EAAE,cAAc,EAAE,CAAA;QAExB,OAAO,uCAAyB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC9C,CAAC;IAiBD,YAAY,OAA2B;QACrC,MAAM,EACJ,UAAU,EACV,YAAY,EAEZ,cAAc,GAAG,IAAI,uCAAiB,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAC/D,gCAAgC,GAAG,IAAI,uCAAiB,CAAC;YACvD,GAAG,EAAE,IAAI;YACT,GAAG,EAAE,GAAG;SACT,CAAC,EACF,8BAA8B,GAAG,IAAI,uCAAiB,CAAC;YACrD,GAAG,EAAE,IAAI;YACT,GAAG,EAAE,GAAG;SACT,CAAC,EAEF,YAAY,EACZ,cAAc,EACd,qBAAqB,EACrB,MAAM,GACP,GAAG,OAAO,CAAA;QAEX,KAAK,EAAE,CAAA;QApCT,SAAS;QACA;;;;;WAA8B;QAC9B;;;;;WAA+B;QAC/B;;;;;WAAe;QAExB,WAAW;QACF;;;;;WAAgB;QAChB;;;;;WAAY;QACZ;;;;;WAA4B;QAC5B;;;;;WAAiC;QAE1C,SAAS;QACU;;;;;WAA4B;QAC5B;;;;;WAAsB;QAyBvC,IAAI,CAAC,MAAM,GAAG,MAAM;YAClB,CAAC,CAAC,MAAM,YAAY,YAAM;gBACxB,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,IAAI,YAAM,CAAC,MAAM,CAAC;YACtB,CAAC,CAAC,SAAS,CAAA;QACb,IAAI,CAAC,cAAc,GAAG,IAAA,oDAAsB,EAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QACzE,IAAI,CAAC,YAAY,GAAG,YAAY,CAAA;QAEhC,IAAI,CAAC,OAAO,GAAG,IAAI,oBAAO,CAAC,qBAAqB,CAAC,CAAA;QACjD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAA;QAC9C,IAAI,CAAC,aAAa,GAAG,IAAI,iCAAa,CACpC,IAAA,6CAAsB,EAAC,OAAO,CAAC,EAC/B,IAAI,sFAAsC,CACxC,8BAA8B,EAC9B,IAAI,CAAC,KAAK,EACV,EAAE,iBAAiB,EAAE,OAAO,CAAC,SAAS,EAAE,CACzC,EACD,IAAI,0FAAwC,CAC1C,gCAAgC,EAChC,IAAI,CAAC,KAAK,EACV,EAAE,eAAe,EAAE,OAAO,CAAC,SAAS,EAAE,CACvC,CACF,CAAA;QACD,IAAI,CAAC,aAAa,GAAG,IAAI,4CAAkB,CACzC,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,MAAM,EACX,cAAc,CACf,CAAA;QAED,IAAI,CAAC,aAAa,GAAG,IAAI,iCAAa,CACpC,YAAY,EACZ,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,OAAO,CACb,CAAA;QACD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAE5B,6BAA6B;QAC7B,KAAK,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,SAAS,CAAU,EAAE,CAAC;YACnD,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE;gBAClD,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;oBAClD,KAAK,CAAC,cAAc,EAAE,CAAA;gBACxB,CAAC;YACH,CAAC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,wCAAwC;IACxC,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAA;IAC5C,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,MAAM,EAAE,UAAU,IAAK,EAAE,IAAI,EAAE,EAAW,EAAY,CAAA;IACpE,CAAC;IAED,KAAK,CAAC,SAAS,CACb,KAAa,EACb,EAAE,MAAM,EAAE,GAAG,OAAO,KAAuB,EAAE;QAE7C,MAAM,WAAW,GACf,OAAO,EAAE,YAAY,IAAI,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC,CAAA;QAC/D,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAC7D,yDAAyD;YACzD,MAAM,IAAI,SAAS,CAAC,sBAAsB,CAAC,CAAA;QAC7C,CAAC;QAED,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE;YACzE,MAAM;SACP,CAAC,CAAA;QAEF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAA;QAC9C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAC5C,QAAQ,CAAC,iCAAiC,IAAI,CAAC,2BAAY,CAAC,CAC7D,CAAA;QAED,MAAM,UAAU,GAAG,IAAA,gDAAyB,EAC1C,QAAQ,EACR,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,MAAM,CACZ,CAAA;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAA;QAEhD,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE;YAC/B,GAAG,EAAE,QAAQ,CAAC,MAAM;YACpB,OAAO;YACP,UAAU;YACV,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,OAAO,EAAE,KAAK;SACzB,CAAC,CAAA;QAEF,MAAM,UAAU,GAAwC;YACtD,GAAG,OAAO;YAEV,SAAS,EAAE,IAAI,CAAC,cAAc,CAAC,SAAS;YACxC,YAAY,EAAE,WAAW;YACzB,cAAc,EAAE,IAAI,CAAC,SAAS;YAC9B,qBAAqB,EAAE,IAAI,CAAC,MAAM;YAClC,KAAK;YACL,UAAU,EAAE,YAAY;gBACtB,CAAC,CAAC,YAAY,CAAC,MAAM,KAAK,kCAAc;oBACtC,CAAC,CAAC,YAAY,CAAC,MAAM;oBACrB,CAAC,CAAC,YAAY,CAAC,GAAG;gBACpB,CAAC,CAAC,SAAS;YACb,aAAa,EAAE,IAAI,CAAC,YAAY;YAChC,aAAa,EAAE,MAAe;YAC9B,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,KAAK;SACnD,CAAA;QAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAA;QAEjE,4EAA4E;QAC5E,yDAAyD;QACzD,IACE,gBAAgB,CAAC,QAAQ,KAAK,QAAQ;YACtC,gBAAgB,CAAC,QAAQ,KAAK,OAAO,EACrC,CAAC;YACD,MAAM,IAAI,SAAS,CACjB,4CAA4C,gBAAgB,CAAC,QAAQ,EAAE,CACxE,CAAA;QACH,CAAC;QAED,IAAI,QAAQ,CAAC,qCAAqC,EAAE,CAAC;YACnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAClD,QAAQ,EACR,UAAU,EACV,OAAO,CACR,CAAA;YACD,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,OAAO,CACtC,8BAA8B,EAC9B,UAAU,CACX,CAAA;YAED,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAC/B,WAAW,EACX,IAAI,CAAC,cAAc,CAAC,SAAS,CAC9B,CAAA;YACD,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,WAAW,CAAC,WAAW,CAAC,CAAA;YACzE,OAAO,gBAAgB,CAAA;QACzB,CAAC;aAAM,IAAI,QAAQ,CAAC,qCAAqC,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CACb,sFAAsF,CACvF,CAAA;QACH,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBACtD,IAAI,KAAK;oBAAE,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;YAClE,CAAC;YAED,oDAAoD;YACpD,MAAM,SAAS,GACb,gBAAgB,CAAC,QAAQ,CAAC,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAA;YACnE,IAAI,SAAS,GAAG,IAAI,EAAE,CAAC;gBACrB,OAAO,gBAAgB,CAAA;YACzB,CAAC;iBAAM,IAAI,CAAC,QAAQ,CAAC,qCAAqC,EAAE,CAAC;gBAC3D,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;YACvC,CAAC;QACH,CAAC;QAED,MAAM,IAAI,KAAK,CACb,6DAA6D,CAC9D,CAAA;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAAC,YAAiB;QAClC,MAAM,UAAU,GAAG,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;QAC/D,IAAI,CAAC,UAAU;YAAE,OAAM;QAEvB,2EAA2E;QAC3E,4EAA4E;QAC5E,uEAAuE;QACvE,8CAA8C;QAE9C,mEAAmE;IACrE,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,MAAuB,EACvB,UAA2B,EAAE;QAK7B,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAC1C,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;YACxB,8CAA8C;YAC9C,MAAM,IAAI,4CAAkB,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;QAC5D,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACrC,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACtC,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACtC,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAEpC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,4CAAkB,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAA;QACnE,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QACvD,IAAI,SAAS,EAAE,CAAC;YACd,6BAA6B;YAC7B,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QACvC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,4CAAkB,CAC1B,MAAM,EACN,kCAAkC,UAAU,GAAG,CAChD,CAAA;QACH,CAAC;QAED,IAAI,CAAC;YACH,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,IAAI,4CAAkB,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAA;YACrE,CAAC;YAED,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,4CAAkB,CAC1B,MAAM,EACN,4BAA4B,EAC5B,SAAS,CAAC,QAAQ,CACnB,CAAA;YACH,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAChD,SAAS,CAAC,GAAG;YACb,iIAAiI;YACjI,SAAS,CAAC,UAAU,IAAI,QAAQ,EAChC,SAAS,CAAC,OAAO,CAClB,CAAA;YAED,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;gBACxB,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;oBACnB,MAAM,IAAI,4CAAkB,CAC1B,MAAM,EACN,8BAA8B,EAC9B,SAAS,CAAC,QAAQ,CACnB,CAAA;gBACH,CAAC;gBACD,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;oBAClC,MAAM,IAAI,4CAAkB,CAC1B,MAAM,EACN,iBAAiB,EACjB,SAAS,CAAC,QAAQ,CACnB,CAAA;gBACH,CAAC;YACH,CAAC;iBAAM,IACL,MAAM,CAAC,cAAc,CAAC,8CAA8C,EACpE,CAAC;gBACD,MAAM,IAAI,4CAAkB,CAC1B,MAAM,EACN,+BAA+B,EAC/B,SAAS,CAAC,QAAQ,CACnB,CAAA;YACH,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,YAAY,CACxC,SAAS,EACT,SAAS,CAAC,QAAQ,EAClB,OAAO,EAAE,YAAY,IAAI,MAAM,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC,CAChE,CAAA;YACD,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE;oBAC/C,OAAO,EAAE,SAAS,CAAC,OAAO;oBAC1B,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,QAAQ;iBACT,CAAC,CAAA;gBAEF,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAA;gBAExD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAA;YACvD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,IAAI,QAAQ,CAAC,YAAY,CAAC,CAAA;gBAEpE,MAAM,GAAG,CAAA;YACX,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,iEAAiE;YACjE,gCAAgC;YAChC,MAAM,4CAAkB,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAA;QAChE,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CACX,GAAW,EACX,UAA4B,MAAM;QAElC,2DAA2D;QAC3D,IAAA,+BAAgB,EAAC,GAAG,CAAC,CAAA;QAErB,MAAM,EACJ,OAAO,EACP,UAAU,GAAG,QAAQ,EACrB,QAAQ,GACT,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QAErD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAChD,QAAQ,CAAC,GAAG,EACZ,UAAU,EACV,OAAO,EACP;gBACE,OAAO,EAAE,OAAO,KAAK,IAAI;gBACzB,UAAU,EAAE,OAAO,KAAK,KAAK;aAC9B,CACF,CAAA;YAED,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,iEAA4B,EAAE,CAAC;gBAChD,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YAC9C,CAAC;YAED,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,2DAA2D;QAC3D,IAAA,+BAAgB,EAAC,GAAG,CAAC,CAAA;QAErB,MAAM,EACJ,OAAO,EACP,UAAU,GAAG,QAAQ,EACrB,QAAQ,GACT,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE;YACpC,UAAU,EAAE,IAAI;SACjB,CAAC,CAAA;QAEF,0EAA0E;QAC1E,2EAA2E;QAC3E,QAAQ;QACR,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAChD,QAAQ,CAAC,GAAG,EACZ,UAAU,EACV,OAAO,CACR,CAAA;YACD,MAAM,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;QAC5C,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,0CAAiB,CAAC,GAAG,CAAC,CAAC,CAAA;QACrE,CAAC;IACH,CAAC;IAES,aAAa,CACrB,MAAwB,EACxB,GAAe;QAEf,OAAO,IAAI,+BAAY,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;IACtE,CAAC;CACF;AA7aD,kCA6aC","sourcesContent":["import { Key, Keyset } from '@atproto/jwk'\nimport {\n  OAuthAuthorizationRequestParameters,\n  OAuthClientIdDiscoverable,\n  OAuthClientMetadata,\n  OAuthClientMetadataInput,\n  OAuthResponseMode,\n  oauthClientMetadataSchema,\n} from '@atproto/oauth-types'\nimport {\n  AtprotoDid,\n  DidCache,\n  // eslint-disable-next-line @typescript-eslint/no-unused-vars\n  type DidResolverCommonOptions,\n  assertAtprotoDid,\n} from '@atproto-labs/did-resolver'\nimport { Fetch } from '@atproto-labs/fetch'\nimport { HandleCache, HandleResolver } from '@atproto-labs/handle-resolver'\nimport { HANDLE_INVALID } from '@atproto-labs/identity-resolver'\nimport { SimpleStoreMemory } from '@atproto-labs/simple-store-memory'\nimport { FALLBACK_ALG } from './constants.js'\nimport { AuthMethodUnsatisfiableError } from './errors/auth-method-unsatisfiable-error.js'\nimport { TokenRevokedError } from './errors/token-revoked-error.js'\nimport {\n  CreateIdentityResolverOptions,\n  createIdentityResolver,\n} from './identity-resolver.js'\nimport {\n  AuthorizationServerMetadataCache,\n  OAuthAuthorizationServerMetadataResolver,\n} from './oauth-authorization-server-metadata-resolver.js'\nimport { OAuthCallbackError } from './oauth-callback-error.js'\nimport { negotiateClientAuthMethod } from './oauth-client-auth.js'\nimport {\n  OAuthProtectedResourceMetadataResolver,\n  ProtectedResourceMetadataCache,\n} from './oauth-protected-resource-metadata-resolver.js'\nimport { OAuthResolver } from './oauth-resolver.js'\nimport { DpopNonceCache, OAuthServerAgent } from './oauth-server-agent.js'\nimport { OAuthServerFactory } from './oauth-server-factory.js'\nimport { OAuthSession } from './oauth-session.js'\nimport { RuntimeImplementation } from './runtime-implementation.js'\nimport { Runtime } from './runtime.js'\nimport {\n  SessionEventMap,\n  SessionGetter,\n  SessionStore,\n} from './session-getter.js'\nimport { InternalStateData, StateStore } from './state-store.js'\nimport { AuthorizeOptions, CallbackOptions, ClientMetadata } from './types.js'\nimport { CustomEventTarget } from './util.js'\nimport { validateClientMetadata } from './validate-client-metadata.js'\n\n// Export all types needed to construct OAuthClientOptions\nexport {\n  type AuthorizationServerMetadataCache,\n  type DidCache,\n  type DpopNonceCache,\n  type Fetch,\n  type HandleCache,\n  type HandleResolver,\n  type InternalStateData,\n  Key,\n  Keyset,\n  type OAuthClientMetadata,\n  type OAuthClientMetadataInput,\n  type OAuthResponseMode,\n  type ProtectedResourceMetadataCache,\n  type RuntimeImplementation,\n  type SessionStore,\n  type StateStore,\n}\n\nexport type OAuthClientOptions = CreateIdentityResolverOptions & {\n  // Config\n  responseMode: OAuthResponseMode\n  clientMetadata: Readonly<OAuthClientMetadataInput>\n  keyset?: Keyset | Iterable<Key | undefined | null | false>\n  /**\n   * Determines if the client will allow communicating with the OAuth Servers\n   * (Authorization & Resource), or to retrieve \"did:web\" documents, over\n   * unsafe HTTP connections. It is recommended to set this to `true` only for\n   * development purposes.\n   *\n   * @note This does not affect the identity resolution mechanism, which will\n   * allow HTTP connections to the PLC Directory (if the provided directory url\n   * is \"http:\" based).\n   * @default false\n   * @see {@link OAuthProtectedResourceMetadataResolver.allowHttpResource}\n   * @see {@link OAuthAuthorizationServerMetadataResolver.allowHttpIssuer}\n   * @see {@link DidResolverCommonOptions.allowHttp}\n   */\n  allowHttp?: boolean\n\n  // Stores\n  stateStore: StateStore\n  sessionStore: SessionStore\n  authorizationServerMetadataCache?: AuthorizationServerMetadataCache\n  protectedResourceMetadataCache?: ProtectedResourceMetadataCache\n  dpopNonceCache?: DpopNonceCache\n\n  // Services\n  runtimeImplementation: RuntimeImplementation\n  fetch?: Fetch\n}\n\nexport type OAuthClientEventMap = SessionEventMap\n\nexport type OAuthClientFetchMetadataOptions = {\n  clientId: OAuthClientIdDiscoverable\n  fetch?: Fetch\n  signal?: AbortSignal\n}\n\nexport class OAuthClient extends CustomEventTarget<OAuthClientEventMap> {\n  static async fetchMetadata({\n    clientId,\n    fetch = globalThis.fetch,\n    signal,\n  }: OAuthClientFetchMetadataOptions) {\n    signal?.throwIfAborted()\n\n    const request = new Request(clientId, {\n      redirect: 'error',\n      signal: signal,\n    })\n    const response = await fetch(request)\n\n    if (response.status !== 200) {\n      response.body?.cancel?.()\n      throw new TypeError(`Failed to fetch client metadata: ${response.status}`)\n    }\n\n    // https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-00.html#section-4.1\n    const mime = response.headers.get('content-type')?.split(';')[0].trim()\n    if (mime !== 'application/json') {\n      response.body?.cancel?.()\n      throw new TypeError(`Invalid client metadata content type: ${mime}`)\n    }\n\n    const json: unknown = await response.json()\n\n    signal?.throwIfAborted()\n\n    return oauthClientMetadataSchema.parse(json)\n  }\n\n  // Config\n  readonly clientMetadata: ClientMetadata\n  readonly responseMode: OAuthResponseMode\n  readonly keyset?: Keyset\n\n  // Services\n  readonly runtime: Runtime\n  readonly fetch: Fetch\n  readonly oauthResolver: OAuthResolver\n  readonly serverFactory: OAuthServerFactory\n\n  // Stores\n  protected readonly sessionGetter: SessionGetter\n  protected readonly stateStore: StateStore\n\n  constructor(options: OAuthClientOptions) {\n    const {\n      stateStore,\n      sessionStore,\n\n      dpopNonceCache = new SimpleStoreMemory({ ttl: 60e3, max: 100 }),\n      authorizationServerMetadataCache = new SimpleStoreMemory({\n        ttl: 60e3,\n        max: 100,\n      }),\n      protectedResourceMetadataCache = new SimpleStoreMemory({\n        ttl: 60e3,\n        max: 100,\n      }),\n\n      responseMode,\n      clientMetadata,\n      runtimeImplementation,\n      keyset,\n    } = options\n\n    super()\n\n    this.keyset = keyset\n      ? keyset instanceof Keyset\n        ? keyset\n        : new Keyset(keyset)\n      : undefined\n    this.clientMetadata = validateClientMetadata(clientMetadata, this.keyset)\n    this.responseMode = responseMode\n\n    this.runtime = new Runtime(runtimeImplementation)\n    this.fetch = options.fetch ?? globalThis.fetch\n    this.oauthResolver = new OAuthResolver(\n      createIdentityResolver(options),\n      new OAuthProtectedResourceMetadataResolver(\n        protectedResourceMetadataCache,\n        this.fetch,\n        { allowHttpResource: options.allowHttp },\n      ),\n      new OAuthAuthorizationServerMetadataResolver(\n        authorizationServerMetadataCache,\n        this.fetch,\n        { allowHttpIssuer: options.allowHttp },\n      ),\n    )\n    this.serverFactory = new OAuthServerFactory(\n      this.clientMetadata,\n      this.runtime,\n      this.oauthResolver,\n      this.fetch,\n      this.keyset,\n      dpopNonceCache,\n    )\n\n    this.sessionGetter = new SessionGetter(\n      sessionStore,\n      this.serverFactory,\n      this.runtime,\n    )\n    this.stateStore = stateStore\n\n    // Proxy sessionGetter events\n    for (const type of ['deleted', 'updated'] as const) {\n      this.sessionGetter.addEventListener(type, (event) => {\n        if (!this.dispatchCustomEvent(type, event.detail)) {\n          event.preventDefault()\n        }\n      })\n    }\n  }\n\n  // Exposed as public API for convenience\n  get identityResolver() {\n    return this.oauthResolver.identityResolver\n  }\n\n  get jwks() {\n    return this.keyset?.publicJwks ?? ({ keys: [] as const } as const)\n  }\n\n  async authorize(\n    input: string,\n    { signal, ...options }: AuthorizeOptions = {},\n  ): Promise<URL> {\n    const redirectUri =\n      options?.redirect_uri ?? this.clientMetadata.redirect_uris[0]\n    if (!this.clientMetadata.redirect_uris.includes(redirectUri)) {\n      // The server will enforce this, but let's catch it early\n      throw new TypeError('Invalid redirect_uri')\n    }\n\n    const { identityInfo, metadata } = await this.oauthResolver.resolve(input, {\n      signal,\n    })\n\n    const pkce = await this.runtime.generatePKCE()\n    const dpopKey = await this.runtime.generateKey(\n      metadata.dpop_signing_alg_values_supported || [FALLBACK_ALG],\n    )\n\n    const authMethod = negotiateClientAuthMethod(\n      metadata,\n      this.clientMetadata,\n      this.keyset,\n    )\n    const state = await this.runtime.generateNonce()\n\n    await this.stateStore.set(state, {\n      iss: metadata.issuer,\n      dpopKey,\n      authMethod,\n      verifier: pkce.verifier,\n      appState: options?.state,\n    })\n\n    const parameters: OAuthAuthorizationRequestParameters = {\n      ...options,\n\n      client_id: this.clientMetadata.client_id,\n      redirect_uri: redirectUri,\n      code_challenge: pkce.challenge,\n      code_challenge_method: pkce.method,\n      state,\n      login_hint: identityInfo\n        ? identityInfo.handle !== HANDLE_INVALID\n          ? identityInfo.handle\n          : identityInfo.did\n        : undefined,\n      response_mode: this.responseMode,\n      response_type: 'code' as const,\n      scope: options?.scope ?? this.clientMetadata.scope,\n    }\n\n    const authorizationUrl = new URL(metadata.authorization_endpoint)\n\n    // Since the user will be redirected to the authorization_endpoint url using\n    // a browser, we need to make sure that the url is valid.\n    if (\n      authorizationUrl.protocol !== 'https:' &&\n      authorizationUrl.protocol !== 'http:'\n    ) {\n      throw new TypeError(\n        `Invalid authorization endpoint protocol: ${authorizationUrl.protocol}`,\n      )\n    }\n\n    if (metadata.pushed_authorization_request_endpoint) {\n      const server = await this.serverFactory.fromMetadata(\n        metadata,\n        authMethod,\n        dpopKey,\n      )\n      const parResponse = await server.request(\n        'pushed_authorization_request',\n        parameters,\n      )\n\n      authorizationUrl.searchParams.set(\n        'client_id',\n        this.clientMetadata.client_id,\n      )\n      authorizationUrl.searchParams.set('request_uri', parResponse.request_uri)\n      return authorizationUrl\n    } else if (metadata.require_pushed_authorization_requests) {\n      throw new Error(\n        'Server requires pushed authorization requests (PAR) but no PAR endpoint is available',\n      )\n    } else {\n      for (const [key, value] of Object.entries(parameters)) {\n        if (value) authorizationUrl.searchParams.set(key, String(value))\n      }\n\n      // Length of the URL that will be sent to the server\n      const urlLength =\n        authorizationUrl.pathname.length + authorizationUrl.search.length\n      if (urlLength < 2048) {\n        return authorizationUrl\n      } else if (!metadata.pushed_authorization_request_endpoint) {\n        throw new Error('Login URL too long')\n      }\n    }\n\n    throw new Error(\n      'Server does not support pushed authorization requests (PAR)',\n    )\n  }\n\n  /**\n   * This method allows the client to proactively revoke the request_uri it\n   * created through PAR.\n   */\n  async abortRequest(authorizeUrl: URL) {\n    const requestUri = authorizeUrl.searchParams.get('request_uri')\n    if (!requestUri) return\n\n    // @NOTE This is not implemented here because, 1) the request server should\n    // invalidate the request_uri after some delay anyways, and 2) I am not sure\n    // that the revocation endpoint is even supposed to support this (and I\n    // don't want to spend the time checking now).\n\n    // @TODO investigate actual necessity & feasibility of this feature\n  }\n\n  async callback(\n    params: URLSearchParams,\n    options: CallbackOptions = {},\n  ): Promise<{\n    session: OAuthSession\n    state: string | null\n  }> {\n    const responseJwt = params.get('response')\n    if (responseJwt != null) {\n      // https://openid.net/specs/oauth-v2-jarm.html\n      throw new OAuthCallbackError(params, 'JARM not supported')\n    }\n\n    const issuerParam = params.get('iss')\n    const stateParam = params.get('state')\n    const errorParam = params.get('error')\n    const codeParam = params.get('code')\n\n    if (!stateParam) {\n      throw new OAuthCallbackError(params, 'Missing \"state\" parameter')\n    }\n    const stateData = await this.stateStore.get(stateParam)\n    if (stateData) {\n      // Prevent any kind of replay\n      await this.stateStore.del(stateParam)\n    } else {\n      throw new OAuthCallbackError(\n        params,\n        `Unknown authorization session \"${stateParam}\"`,\n      )\n    }\n\n    try {\n      if (errorParam != null) {\n        throw new OAuthCallbackError(params, undefined, stateData.appState)\n      }\n\n      if (!codeParam) {\n        throw new OAuthCallbackError(\n          params,\n          'Missing \"code\" query param',\n          stateData.appState,\n        )\n      }\n\n      const server = await this.serverFactory.fromIssuer(\n        stateData.iss,\n        // Using the literal 'legacy' if the authMethod is not defined (because stateData was created through an old version of this lib)\n        stateData.authMethod ?? 'legacy',\n        stateData.dpopKey,\n      )\n\n      if (issuerParam != null) {\n        if (!server.issuer) {\n          throw new OAuthCallbackError(\n            params,\n            'Issuer not found in metadata',\n            stateData.appState,\n          )\n        }\n        if (server.issuer !== issuerParam) {\n          throw new OAuthCallbackError(\n            params,\n            'Issuer mismatch',\n            stateData.appState,\n          )\n        }\n      } else if (\n        server.serverMetadata.authorization_response_iss_parameter_supported\n      ) {\n        throw new OAuthCallbackError(\n          params,\n          'iss missing from the response',\n          stateData.appState,\n        )\n      }\n\n      const tokenSet = await server.exchangeCode(\n        codeParam,\n        stateData.verifier,\n        options?.redirect_uri ?? server.clientMetadata.redirect_uris[0],\n      )\n      try {\n        await this.sessionGetter.setStored(tokenSet.sub, {\n          dpopKey: stateData.dpopKey,\n          authMethod: server.authMethod,\n          tokenSet,\n        })\n\n        const session = this.createSession(server, tokenSet.sub)\n\n        return { session, state: stateData.appState ?? null }\n      } catch (err) {\n        await server.revoke(tokenSet.refresh_token || tokenSet.access_token)\n\n        throw err\n      }\n    } catch (err) {\n      // Make sure, whatever the underlying error, that the appState is\n      // available in the calling code\n      throw OAuthCallbackError.from(err, params, stateData.appState)\n    }\n  }\n\n  /**\n   * Load a stored session. This will refresh the token only if needed (about to\n   * expire) by default.\n   *\n   * @param refresh See {@link SessionGetter.getSession}\n   */\n  async restore(\n    sub: string,\n    refresh: boolean | 'auto' = 'auto',\n  ): Promise<OAuthSession> {\n    // sub arg is lightly typed for convenience of library user\n    assertAtprotoDid(sub)\n\n    const {\n      dpopKey,\n      authMethod = 'legacy',\n      tokenSet,\n    } = await this.sessionGetter.getSession(sub, refresh)\n\n    try {\n      const server = await this.serverFactory.fromIssuer(\n        tokenSet.iss,\n        authMethod,\n        dpopKey,\n        {\n          noCache: refresh === true,\n          allowStale: refresh === false,\n        },\n      )\n\n      return this.createSession(server, sub)\n    } catch (err) {\n      if (err instanceof AuthMethodUnsatisfiableError) {\n        await this.sessionGetter.delStored(sub, err)\n      }\n\n      throw err\n    }\n  }\n\n  async revoke(sub: string) {\n    // sub arg is lightly typed for convenience of library user\n    assertAtprotoDid(sub)\n\n    const {\n      dpopKey,\n      authMethod = 'legacy',\n      tokenSet,\n    } = await this.sessionGetter.get(sub, {\n      allowStale: true,\n    })\n\n    // NOT using `;(await this.restore(sub, false)).signOut()` because we want\n    // the tokens to be deleted even if it was not possible to fetch the issuer\n    // data.\n    try {\n      const server = await this.serverFactory.fromIssuer(\n        tokenSet.iss,\n        authMethod,\n        dpopKey,\n      )\n      await server.revoke(tokenSet.access_token)\n    } finally {\n      await this.sessionGetter.delStored(sub, new TokenRevokedError(sub))\n    }\n  }\n\n  protected createSession(\n    server: OAuthServerAgent,\n    sub: AtprotoDid,\n  ): OAuthSession {\n    return new OAuthSession(server, sub, this.sessionGetter, this.fetch)\n  }\n}\n"]}
+{"version":3,"file":"oauth-client.js","sourceRoot":"","sources":["../src/oauth-client.ts"],"names":[],"mappings":";;;AAAA,sCAA0C;AAyEjC,oFAzEA,SAAG,OAyEA;AAAE,uFAzEA,YAAM,OAyEA;AAxEpB,sDAO6B;AAC7B,6DAMmC;AAGnC,uEAAgE;AAChE,2EAAqE;AACrE,iDAA6C;AAC7C,oGAA0F;AAC1F,4EAAmE;AACnE,iEAG+B;AAC/B,uHAG0D;AAC1D,uEAA8D;AAC9D,iEAAkE;AAClE,mHAGwD;AACxD,2DAAmD;AAEnD,uEAA8D;AAC9D,yDAAiD;AAEjD,6CAAsC;AACtC,2DAK4B;AAG5B,+EAAsE;AAgEtE,MAAa,WAAW;IACtB,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,EACzB,QAAQ,EACR,KAAK,GAAG,UAAU,CAAC,KAAK,EACxB,MAAM,GAC0B;QAChC,MAAM,EAAE,cAAc,EAAE,CAAA;QAExB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,EAAE;YACpC,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,MAAM;SACf,CAAC,CAAA;QACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAA;QAErC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAA;YACzB,MAAM,IAAI,SAAS,CAAC,oCAAoC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;QAC5E,CAAC;QAED,mGAAmG;QACnG,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACvE,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;YAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAA;YACzB,MAAM,IAAI,SAAS,CAAC,yCAAyC,IAAI,EAAE,CAAC,CAAA;QACtE,CAAC;QAED,MAAM,IAAI,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QAE3C,MAAM,EAAE,cAAc,EAAE,CAAA;QAExB,OAAO,uCAAyB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC9C,CAAC;IAiBD,YAAY,OAA2B;QAfvC,SAAS;QACA;;;;;WAA8B;QAC9B;;;;;WAA+B;QAC/B;;;;;WAAe;QAExB,WAAW;QACF;;;;;WAAgB;QAChB;;;;;WAAY;QACZ;;;;;WAA4B;QAC5B;;;;;WAAiC;QAE1C,SAAS;QACU;;;;;WAA4B;QAC5B;;;;;WAAsB;QAGvC,MAAM,EACJ,UAAU,EACV,YAAY,EAEZ,cAAc,GAAG,IAAI,uCAAiB,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAC/D,gCAAgC,GAAG,IAAI,uCAAiB,CAAC;YACvD,GAAG,EAAE,IAAI;YACT,GAAG,EAAE,GAAG;SACT,CAAC,EACF,8BAA8B,GAAG,IAAI,uCAAiB,CAAC;YACrD,GAAG,EAAE,IAAI;YACT,GAAG,EAAE,GAAG;SACT,CAAC,EAEF,YAAY,EACZ,cAAc,EACd,qBAAqB,EACrB,MAAM,GACP,GAAG,OAAO,CAAA;QAEX,IAAI,CAAC,MAAM,GAAG,MAAM;YAClB,CAAC,CAAC,MAAM,YAAY,YAAM;gBACxB,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,IAAI,YAAM,CAAC,MAAM,CAAC;YACtB,CAAC,CAAC,SAAS,CAAA;QACb,IAAI,CAAC,cAAc,GAAG,IAAA,oDAAsB,EAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QACzE,IAAI,CAAC,YAAY,GAAG,YAAY,CAAA;QAEhC,IAAI,CAAC,OAAO,GAAG,IAAI,oBAAO,CAAC,qBAAqB,CAAC,CAAA;QACjD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAA;QAC9C,IAAI,CAAC,aAAa,GAAG,IAAI,iCAAa,CACpC,IAAA,6CAAsB,EAAC,OAAO,CAAC,EAC/B,IAAI,sFAAsC,CACxC,8BAA8B,EAC9B,IAAI,CAAC,KAAK,EACV,EAAE,iBAAiB,EAAE,OAAO,CAAC,SAAS,EAAE,CACzC,EACD,IAAI,0FAAwC,CAC1C,gCAAgC,EAChC,IAAI,CAAC,KAAK,EACV,EAAE,eAAe,EAAE,OAAO,CAAC,SAAS,EAAE,CACvC,CACF,CAAA;QACD,IAAI,CAAC,aAAa,GAAG,IAAI,4CAAkB,CACzC,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,MAAM,EACX,cAAc,CACf,CAAA;QAED,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,IAAI,CAAC,aAAa,GAAG,IAAI,iCAAa,CACpC,YAAY,EACZ,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,OAAO,EACZ,OAAO,CACR,CAAA;IACH,CAAC;IAED,wCAAwC;IACxC,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAA;IAC5C,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,MAAM,EAAE,UAAU,IAAK,EAAE,IAAI,EAAE,EAAW,EAAY,CAAA;IACpE,CAAC;IAED,KAAK,CAAC,SAAS,CACb,KAAa,EACb,EAAE,MAAM,EAAE,GAAG,OAAO,KAAuB,EAAE;QAE7C,MAAM,WAAW,GACf,OAAO,EAAE,YAAY,IAAI,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC,CAAA;QAC/D,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAC7D,yDAAyD;YACzD,MAAM,IAAI,SAAS,CAAC,sBAAsB,CAAC,CAAA;QAC7C,CAAC;QAED,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE;YACzE,MAAM;SACP,CAAC,CAAA;QAEF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAA;QAC9C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAC5C,QAAQ,CAAC,iCAAiC,IAAI,CAAC,2BAAY,CAAC,CAC7D,CAAA;QAED,MAAM,UAAU,GAAG,IAAA,gDAAyB,EAC1C,QAAQ,EACR,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,MAAM,CACZ,CAAA;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAA;QAEhD,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE;YAC/B,GAAG,EAAE,QAAQ,CAAC,MAAM;YACpB,OAAO;YACP,UAAU;YACV,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,OAAO,EAAE,KAAK;SACzB,CAAC,CAAA;QAEF,MAAM,UAAU,GAAwC;YACtD,GAAG,OAAO;YAEV,SAAS,EAAE,IAAI,CAAC,cAAc,CAAC,SAAS;YACxC,YAAY,EAAE,WAAW;YACzB,cAAc,EAAE,IAAI,CAAC,SAAS;YAC9B,qBAAqB,EAAE,IAAI,CAAC,MAAM;YAClC,KAAK;YACL,UAAU,EAAE,YAAY;gBACtB,CAAC,CAAC,YAAY,CAAC,MAAM,KAAK,kCAAc;oBACtC,CAAC,CAAC,YAAY,CAAC,MAAM;oBACrB,CAAC,CAAC,YAAY,CAAC,GAAG;gBACpB,CAAC,CAAC,SAAS;YACb,aAAa,EAAE,IAAI,CAAC,YAAY;YAChC,aAAa,EAAE,MAAe;YAC9B,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,KAAK;SACnD,CAAA;QAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAA;QAEjE,4EAA4E;QAC5E,yDAAyD;QACzD,IACE,gBAAgB,CAAC,QAAQ,KAAK,QAAQ;YACtC,gBAAgB,CAAC,QAAQ,KAAK,OAAO,EACrC,CAAC;YACD,MAAM,IAAI,SAAS,CACjB,4CAA4C,gBAAgB,CAAC,QAAQ,EAAE,CACxE,CAAA;QACH,CAAC;QAED,IAAI,QAAQ,CAAC,qCAAqC,EAAE,CAAC;YACnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAClD,QAAQ,EACR,UAAU,EACV,OAAO,CACR,CAAA;YACD,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,OAAO,CACtC,8BAA8B,EAC9B,UAAU,CACX,CAAA;YAED,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAC/B,WAAW,EACX,IAAI,CAAC,cAAc,CAAC,SAAS,CAC9B,CAAA;YACD,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,WAAW,CAAC,WAAW,CAAC,CAAA;YACzE,OAAO,gBAAgB,CAAA;QACzB,CAAC;aAAM,IAAI,QAAQ,CAAC,qCAAqC,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CACb,sFAAsF,CACvF,CAAA;QACH,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBACtD,IAAI,KAAK;oBAAE,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;YAClE,CAAC;YAED,oDAAoD;YACpD,MAAM,SAAS,GACb,gBAAgB,CAAC,QAAQ,CAAC,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAA;YACnE,IAAI,SAAS,GAAG,IAAI,EAAE,CAAC;gBACrB,OAAO,gBAAgB,CAAA;YACzB,CAAC;iBAAM,IAAI,CAAC,QAAQ,CAAC,qCAAqC,EAAE,CAAC;gBAC3D,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;YACvC,CAAC;QACH,CAAC;QAED,MAAM,IAAI,KAAK,CACb,6DAA6D,CAC9D,CAAA;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAAC,YAAiB;QAClC,MAAM,UAAU,GAAG,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;QAC/D,IAAI,CAAC,UAAU;YAAE,OAAM;QAEvB,2EAA2E;QAC3E,4EAA4E;QAC5E,uEAAuE;QACvE,8CAA8C;QAE9C,mEAAmE;IACrE,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,MAAuB,EACvB,UAA2B,EAAE;QAK7B,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAC1C,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;YACxB,8CAA8C;YAC9C,MAAM,IAAI,4CAAkB,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;QAC5D,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACrC,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACtC,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACtC,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAEpC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,4CAAkB,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAA;QACnE,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QACvD,IAAI,SAAS,EAAE,CAAC;YACd,6BAA6B;YAC7B,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QACvC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,4CAAkB,CAC1B,MAAM,EACN,kCAAkC,UAAU,GAAG,CAChD,CAAA;QACH,CAAC;QAED,IAAI,CAAC;YACH,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,IAAI,4CAAkB,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAA;YACrE,CAAC;YAED,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,4CAAkB,CAC1B,MAAM,EACN,4BAA4B,EAC5B,SAAS,CAAC,QAAQ,CACnB,CAAA;YACH,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAChD,SAAS,CAAC,GAAG,EACb,SAAS,CAAC,UAAU,EACpB,SAAS,CAAC,OAAO,CAClB,CAAA;YAED,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;gBACxB,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;oBACnB,MAAM,IAAI,4CAAkB,CAC1B,MAAM,EACN,8BAA8B,EAC9B,SAAS,CAAC,QAAQ,CACnB,CAAA;gBACH,CAAC;gBACD,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;oBAClC,MAAM,IAAI,4CAAkB,CAC1B,MAAM,EACN,iBAAiB,EACjB,SAAS,CAAC,QAAQ,CACnB,CAAA;gBACH,CAAC;YACH,CAAC;iBAAM,IACL,MAAM,CAAC,cAAc,CAAC,8CAA8C,EACpE,CAAC;gBACD,MAAM,IAAI,4CAAkB,CAC1B,MAAM,EACN,+BAA+B,EAC/B,SAAS,CAAC,QAAQ,CACnB,CAAA;YACH,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,YAAY,CACxC,SAAS,EACT,SAAS,CAAC,QAAQ,EAClB,OAAO,EAAE,YAAY,IAAI,MAAM,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC,CAChE,CAAA;YAED,0EAA0E;YAC1E,aAAa;YACb,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;YACjC,CAAC;YAAC,MAAM,CAAC;gBACP,0DAA0D;YAC5D,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE;oBAC/C,OAAO,EAAE,SAAS,CAAC,OAAO;oBAC1B,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,QAAQ;iBACT,CAAC,CAAA;gBAEF,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAA;gBAExD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAA;YACvD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,IAAI,QAAQ,CAAC,YAAY,CAAC,CAAA;gBAEpE,MAAM,GAAG,CAAA;YACX,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,iEAAiE;YACjE,gCAAgC;YAChC,MAAM,4CAAkB,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAA;QAChE,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CACX,GAAW,EACX,UAA4B,MAAM;QAElC,2DAA2D;QAC3D,IAAA,+BAAgB,EAAC,GAAG,CAAC,CAAA;QAErB,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,GACrC,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QAEnD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAChD,QAAQ,CAAC,GAAG,EACZ,UAAU,EACV,OAAO,EACP;gBACE,OAAO,EAAE,OAAO,KAAK,IAAI;gBACzB,UAAU,EAAE,OAAO,KAAK,KAAK;aAC9B,CACF,CAAA;YAED,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,iEAA4B,EAAE,CAAC;gBAChD,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YAC9C,CAAC;YAED,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,2DAA2D;QAC3D,IAAA,+BAAgB,EAAC,GAAG,CAAC,CAAA;QAErB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACxE,IAAI,IAAA,0CAAsB,EAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAA;YAC5C,MAAM,GAAG,CAAA;QACX,CAAC,CAAC,CAAA;QAEF,IAAI,CAAC,GAAG;YAAE,OAAM;QAEhB,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAA;QAE7C,0EAA0E;QAC1E,2EAA2E;QAC3E,QAAQ;QACR,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAChD,QAAQ,CAAC,GAAG,EACZ,UAAU,EACV,OAAO,CACR,CAAA;YACD,MAAM,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;QAC5C,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,0CAAiB,CAAC,GAAG,CAAC,CAAC,CAAA;QACrE,CAAC;IACH,CAAC;IAES,aAAa,CACrB,MAAwB,EACxB,GAAe;QAEf,OAAO,IAAI,+BAAY,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;IACtE,CAAC;CACF;AAzaD,kCAyaC","sourcesContent":["import { Key, Keyset } from '@atproto/jwk'\nimport {\n  OAuthAuthorizationRequestParameters,\n  OAuthClientIdDiscoverable,\n  OAuthClientMetadata,\n  OAuthClientMetadataInput,\n  OAuthResponseMode,\n  oauthClientMetadataSchema,\n} from '@atproto/oauth-types'\nimport {\n  AtprotoDid,\n  DidCache,\n  // eslint-disable-next-line @typescript-eslint/no-unused-vars\n  type DidResolverCommonOptions,\n  assertAtprotoDid,\n} from '@atproto-labs/did-resolver'\nimport { Fetch } from '@atproto-labs/fetch'\nimport { HandleCache, HandleResolver } from '@atproto-labs/handle-resolver'\nimport { HANDLE_INVALID } from '@atproto-labs/identity-resolver'\nimport { SimpleStoreMemory } from '@atproto-labs/simple-store-memory'\nimport { FALLBACK_ALG } from './constants.js'\nimport { AuthMethodUnsatisfiableError } from './errors/auth-method-unsatisfiable-error.js'\nimport { TokenRevokedError } from './errors/token-revoked-error.js'\nimport {\n  CreateIdentityResolverOptions,\n  createIdentityResolver,\n} from './identity-resolver.js'\nimport {\n  AuthorizationServerMetadataCache,\n  OAuthAuthorizationServerMetadataResolver,\n} from './oauth-authorization-server-metadata-resolver.js'\nimport { OAuthCallbackError } from './oauth-callback-error.js'\nimport { negotiateClientAuthMethod } from './oauth-client-auth.js'\nimport {\n  OAuthProtectedResourceMetadataResolver,\n  ProtectedResourceMetadataCache,\n} from './oauth-protected-resource-metadata-resolver.js'\nimport { OAuthResolver } from './oauth-resolver.js'\nimport { DpopNonceCache, OAuthServerAgent } from './oauth-server-agent.js'\nimport { OAuthServerFactory } from './oauth-server-factory.js'\nimport { OAuthSession } from './oauth-session.js'\nimport { RuntimeImplementation } from './runtime-implementation.js'\nimport { Runtime } from './runtime.js'\nimport {\n  SessionGetter,\n  SessionHooks,\n  SessionStore,\n  isExpectedSessionError,\n} from './session-getter.js'\nimport { InternalStateData, StateStore } from './state-store.js'\nimport { AuthorizeOptions, CallbackOptions, ClientMetadata } from './types.js'\nimport { validateClientMetadata } from './validate-client-metadata.js'\n\n// Export all types needed to construct OAuthClientOptions\nexport type {\n  AuthorizationServerMetadataCache,\n  CreateIdentityResolverOptions,\n  DidCache,\n  DpopNonceCache,\n  Fetch,\n  HandleCache,\n  HandleResolver,\n  InternalStateData,\n  OAuthClientMetadata,\n  OAuthClientMetadataInput,\n  OAuthResponseMode,\n  ProtectedResourceMetadataCache,\n  RuntimeImplementation,\n  SessionHooks,\n  SessionStore,\n  StateStore,\n}\n\nexport { Key, Keyset }\n\nexport type OAuthClientOptions = {\n  // Config\n  responseMode: OAuthResponseMode\n  clientMetadata: Readonly<OAuthClientMetadataInput>\n  keyset?: Keyset | Iterable<Key | undefined | null | false>\n  /**\n   * Determines if the client will allow communicating with the OAuth Servers\n   * (Authorization & Resource), or to retrieve \"did:web\" documents, over\n   * unsafe HTTP connections. It is recommended to set this to `true` only for\n   * development purposes.\n   *\n   * @note This does not affect the identity resolution mechanism, which will\n   * allow HTTP connections to the PLC Directory (if the provided directory url\n   * is \"http:\" based).\n   * @default false\n   * @see {@link OAuthProtectedResourceMetadataResolver.allowHttpResource}\n   * @see {@link OAuthAuthorizationServerMetadataResolver.allowHttpIssuer}\n   * @see {@link DidResolverCommonOptions.allowHttp}\n   */\n  allowHttp?: boolean\n\n  // Stores\n  stateStore: StateStore\n  sessionStore: SessionStore\n  authorizationServerMetadataCache?: AuthorizationServerMetadataCache\n  protectedResourceMetadataCache?: ProtectedResourceMetadataCache\n  dpopNonceCache?: DpopNonceCache\n\n  // Services\n  runtimeImplementation: RuntimeImplementation\n  fetch?: Fetch\n} & CreateIdentityResolverOptions &\n  SessionHooks\n\nexport type OAuthClientFetchMetadataOptions = {\n  clientId: OAuthClientIdDiscoverable\n  fetch?: Fetch\n  signal?: AbortSignal\n}\n\nexport class OAuthClient {\n  static async fetchMetadata({\n    clientId,\n    fetch = globalThis.fetch,\n    signal,\n  }: OAuthClientFetchMetadataOptions) {\n    signal?.throwIfAborted()\n\n    const request = new Request(clientId, {\n      redirect: 'error',\n      signal: signal,\n    })\n    const response = await fetch(request)\n\n    if (response.status !== 200) {\n      response.body?.cancel?.()\n      throw new TypeError(`Failed to fetch client metadata: ${response.status}`)\n    }\n\n    // https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-00.html#section-4.1\n    const mime = response.headers.get('content-type')?.split(';')[0].trim()\n    if (mime !== 'application/json') {\n      response.body?.cancel?.()\n      throw new TypeError(`Invalid client metadata content type: ${mime}`)\n    }\n\n    const json: unknown = await response.json()\n\n    signal?.throwIfAborted()\n\n    return oauthClientMetadataSchema.parse(json)\n  }\n\n  // Config\n  readonly clientMetadata: ClientMetadata\n  readonly responseMode: OAuthResponseMode\n  readonly keyset?: Keyset\n\n  // Services\n  readonly runtime: Runtime\n  readonly fetch: Fetch\n  readonly oauthResolver: OAuthResolver\n  readonly serverFactory: OAuthServerFactory\n\n  // Stores\n  protected readonly sessionGetter: SessionGetter\n  protected readonly stateStore: StateStore\n\n  constructor(options: OAuthClientOptions) {\n    const {\n      stateStore,\n      sessionStore,\n\n      dpopNonceCache = new SimpleStoreMemory({ ttl: 60e3, max: 100 }),\n      authorizationServerMetadataCache = new SimpleStoreMemory({\n        ttl: 60e3,\n        max: 100,\n      }),\n      protectedResourceMetadataCache = new SimpleStoreMemory({\n        ttl: 60e3,\n        max: 100,\n      }),\n\n      responseMode,\n      clientMetadata,\n      runtimeImplementation,\n      keyset,\n    } = options\n\n    this.keyset = keyset\n      ? keyset instanceof Keyset\n        ? keyset\n        : new Keyset(keyset)\n      : undefined\n    this.clientMetadata = validateClientMetadata(clientMetadata, this.keyset)\n    this.responseMode = responseMode\n\n    this.runtime = new Runtime(runtimeImplementation)\n    this.fetch = options.fetch ?? globalThis.fetch\n    this.oauthResolver = new OAuthResolver(\n      createIdentityResolver(options),\n      new OAuthProtectedResourceMetadataResolver(\n        protectedResourceMetadataCache,\n        this.fetch,\n        { allowHttpResource: options.allowHttp },\n      ),\n      new OAuthAuthorizationServerMetadataResolver(\n        authorizationServerMetadataCache,\n        this.fetch,\n        { allowHttpIssuer: options.allowHttp },\n      ),\n    )\n    this.serverFactory = new OAuthServerFactory(\n      this.clientMetadata,\n      this.runtime,\n      this.oauthResolver,\n      this.fetch,\n      this.keyset,\n      dpopNonceCache,\n    )\n\n    this.stateStore = stateStore\n    this.sessionGetter = new SessionGetter(\n      sessionStore,\n      this.serverFactory,\n      this.runtime,\n      options,\n    )\n  }\n\n  // Exposed as public API for convenience\n  get identityResolver() {\n    return this.oauthResolver.identityResolver\n  }\n\n  get jwks() {\n    return this.keyset?.publicJwks ?? ({ keys: [] as const } as const)\n  }\n\n  async authorize(\n    input: string,\n    { signal, ...options }: AuthorizeOptions = {},\n  ): Promise<URL> {\n    const redirectUri =\n      options?.redirect_uri ?? this.clientMetadata.redirect_uris[0]\n    if (!this.clientMetadata.redirect_uris.includes(redirectUri)) {\n      // The server will enforce this, but let's catch it early\n      throw new TypeError('Invalid redirect_uri')\n    }\n\n    const { identityInfo, metadata } = await this.oauthResolver.resolve(input, {\n      signal,\n    })\n\n    const pkce = await this.runtime.generatePKCE()\n    const dpopKey = await this.runtime.generateKey(\n      metadata.dpop_signing_alg_values_supported || [FALLBACK_ALG],\n    )\n\n    const authMethod = negotiateClientAuthMethod(\n      metadata,\n      this.clientMetadata,\n      this.keyset,\n    )\n    const state = await this.runtime.generateNonce()\n\n    await this.stateStore.set(state, {\n      iss: metadata.issuer,\n      dpopKey,\n      authMethod,\n      verifier: pkce.verifier,\n      appState: options?.state,\n    })\n\n    const parameters: OAuthAuthorizationRequestParameters = {\n      ...options,\n\n      client_id: this.clientMetadata.client_id,\n      redirect_uri: redirectUri,\n      code_challenge: pkce.challenge,\n      code_challenge_method: pkce.method,\n      state,\n      login_hint: identityInfo\n        ? identityInfo.handle !== HANDLE_INVALID\n          ? identityInfo.handle\n          : identityInfo.did\n        : undefined,\n      response_mode: this.responseMode,\n      response_type: 'code' as const,\n      scope: options?.scope ?? this.clientMetadata.scope,\n    }\n\n    const authorizationUrl = new URL(metadata.authorization_endpoint)\n\n    // Since the user will be redirected to the authorization_endpoint url using\n    // a browser, we need to make sure that the url is valid.\n    if (\n      authorizationUrl.protocol !== 'https:' &&\n      authorizationUrl.protocol !== 'http:'\n    ) {\n      throw new TypeError(\n        `Invalid authorization endpoint protocol: ${authorizationUrl.protocol}`,\n      )\n    }\n\n    if (metadata.pushed_authorization_request_endpoint) {\n      const server = await this.serverFactory.fromMetadata(\n        metadata,\n        authMethod,\n        dpopKey,\n      )\n      const parResponse = await server.request(\n        'pushed_authorization_request',\n        parameters,\n      )\n\n      authorizationUrl.searchParams.set(\n        'client_id',\n        this.clientMetadata.client_id,\n      )\n      authorizationUrl.searchParams.set('request_uri', parResponse.request_uri)\n      return authorizationUrl\n    } else if (metadata.require_pushed_authorization_requests) {\n      throw new Error(\n        'Server requires pushed authorization requests (PAR) but no PAR endpoint is available',\n      )\n    } else {\n      for (const [key, value] of Object.entries(parameters)) {\n        if (value) authorizationUrl.searchParams.set(key, String(value))\n      }\n\n      // Length of the URL that will be sent to the server\n      const urlLength =\n        authorizationUrl.pathname.length + authorizationUrl.search.length\n      if (urlLength < 2048) {\n        return authorizationUrl\n      } else if (!metadata.pushed_authorization_request_endpoint) {\n        throw new Error('Login URL too long')\n      }\n    }\n\n    throw new Error(\n      'Server does not support pushed authorization requests (PAR)',\n    )\n  }\n\n  /**\n   * This method allows the client to proactively revoke the request_uri it\n   * created through PAR.\n   */\n  async abortRequest(authorizeUrl: URL) {\n    const requestUri = authorizeUrl.searchParams.get('request_uri')\n    if (!requestUri) return\n\n    // @NOTE This is not implemented here because, 1) the request server should\n    // invalidate the request_uri after some delay anyways, and 2) I am not sure\n    // that the revocation endpoint is even supposed to support this (and I\n    // don't want to spend the time checking now).\n\n    // @TODO investigate actual necessity & feasibility of this feature\n  }\n\n  async callback(\n    params: URLSearchParams,\n    options: CallbackOptions = {},\n  ): Promise<{\n    session: OAuthSession\n    state: string | null\n  }> {\n    const responseJwt = params.get('response')\n    if (responseJwt != null) {\n      // https://openid.net/specs/oauth-v2-jarm.html\n      throw new OAuthCallbackError(params, 'JARM not supported')\n    }\n\n    const issuerParam = params.get('iss')\n    const stateParam = params.get('state')\n    const errorParam = params.get('error')\n    const codeParam = params.get('code')\n\n    if (!stateParam) {\n      throw new OAuthCallbackError(params, 'Missing \"state\" parameter')\n    }\n    const stateData = await this.stateStore.get(stateParam)\n    if (stateData) {\n      // Prevent any kind of replay\n      await this.stateStore.del(stateParam)\n    } else {\n      throw new OAuthCallbackError(\n        params,\n        `Unknown authorization session \"${stateParam}\"`,\n      )\n    }\n\n    try {\n      if (errorParam != null) {\n        throw new OAuthCallbackError(params, undefined, stateData.appState)\n      }\n\n      if (!codeParam) {\n        throw new OAuthCallbackError(\n          params,\n          'Missing \"code\" query param',\n          stateData.appState,\n        )\n      }\n\n      const server = await this.serverFactory.fromIssuer(\n        stateData.iss,\n        stateData.authMethod,\n        stateData.dpopKey,\n      )\n\n      if (issuerParam != null) {\n        if (!server.issuer) {\n          throw new OAuthCallbackError(\n            params,\n            'Issuer not found in metadata',\n            stateData.appState,\n          )\n        }\n        if (server.issuer !== issuerParam) {\n          throw new OAuthCallbackError(\n            params,\n            'Issuer mismatch',\n            stateData.appState,\n          )\n        }\n      } else if (\n        server.serverMetadata.authorization_response_iss_parameter_supported\n      ) {\n        throw new OAuthCallbackError(\n          params,\n          'iss missing from the response',\n          stateData.appState,\n        )\n      }\n\n      const tokenSet = await server.exchangeCode(\n        codeParam,\n        stateData.verifier,\n        options?.redirect_uri ?? server.clientMetadata.redirect_uris[0],\n      )\n\n      // We revoke any existing session first to avoid leaving orphaned sessions\n      // on the AS.\n      try {\n        await this.revoke(tokenSet.sub)\n      } catch {\n        // No existing session, or failed to get it. This is fine.\n      }\n\n      try {\n        await this.sessionGetter.setStored(tokenSet.sub, {\n          dpopKey: stateData.dpopKey,\n          authMethod: server.authMethod,\n          tokenSet,\n        })\n\n        const session = this.createSession(server, tokenSet.sub)\n\n        return { session, state: stateData.appState ?? null }\n      } catch (err) {\n        await server.revoke(tokenSet.refresh_token || tokenSet.access_token)\n\n        throw err\n      }\n    } catch (err) {\n      // Make sure, whatever the underlying error, that the appState is\n      // available in the calling code\n      throw OAuthCallbackError.from(err, params, stateData.appState)\n    }\n  }\n\n  /**\n   * Load a stored session. This will refresh the token only if needed (about to\n   * expire) by default.\n   *\n   * @see {@link SessionGetter.restore}\n   */\n  async restore(\n    sub: string,\n    refresh: boolean | 'auto' = 'auto',\n  ): Promise<OAuthSession> {\n    // sub arg is lightly typed for convenience of library user\n    assertAtprotoDid(sub)\n\n    const { dpopKey, authMethod, tokenSet } =\n      await this.sessionGetter.getSession(sub, refresh)\n\n    try {\n      const server = await this.serverFactory.fromIssuer(\n        tokenSet.iss,\n        authMethod,\n        dpopKey,\n        {\n          noCache: refresh === true,\n          allowStale: refresh === false,\n        },\n      )\n\n      return this.createSession(server, sub)\n    } catch (err) {\n      if (err instanceof AuthMethodUnsatisfiableError) {\n        await this.sessionGetter.delStored(sub, err)\n      }\n\n      throw err\n    }\n  }\n\n  async revoke(sub: string) {\n    // sub arg is lightly typed for convenience of library user\n    assertAtprotoDid(sub)\n\n    const res = await this.sessionGetter.getSession(sub, false).catch((err) => {\n      if (isExpectedSessionError(err)) return null\n      throw err\n    })\n\n    if (!res) return\n\n    const { dpopKey, authMethod, tokenSet } = res\n\n    // NOT using `;(await this.restore(sub, false)).signOut()` because we want\n    // the tokens to be deleted even if it was not possible to fetch the issuer\n    // data.\n    try {\n      const server = await this.serverFactory.fromIssuer(\n        tokenSet.iss,\n        authMethod,\n        dpopKey,\n      )\n      await server.revoke(tokenSet.access_token)\n    } finally {\n      await this.sessionGetter.delStored(sub, new TokenRevokedError(sub))\n    }\n  }\n\n  protected createSession(\n    server: OAuthServerAgent,\n    sub: AtprotoDid,\n  ): OAuthSession {\n    return new OAuthSession(server, sub, this.sessionGetter, this.fetch)\n  }\n}\n"]}

package/dist/oauth-server-factory.d.ts

@@ -24,7 +24,7 @@ export declare class OAuthServerFactory {
      *
      * @throws see {@link OAuthServerFactory.fromMetadata}
      */
-    fromIssuer(issuer: string, authMethod: 'legacy' | ClientAuthMethod, dpopKey: Key, options?: GetCachedOptions): Promise<OAuthServerAgent>;
+    fromIssuer(issuer: string, authMethod: ClientAuthMethod, dpopKey: Key, options?: GetCachedOptions): Promise<OAuthServerAgent>;
     /**
      * @throws see {@link OAuthServerAgent}
      */

package/dist/oauth-server-factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-server-factory.d.ts","sourceRoot":"","sources":["../src/oauth-server-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,EAAE,gCAAgC,EAAE,MAAM,sBAAsB,CAAA;AACvE,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,mDAAmD,CAAA;AACpF,OAAO,EACL,gBAAgB,EAEjB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAE3C,qBAAa,kBAAkB;IAE3B,QAAQ,CAAC,cAAc,EAAE,cAAc;IACvC,QAAQ,CAAC,OAAO,EAAE,OAAO;IACzB,QAAQ,CAAC,QAAQ,EAAE,aAAa;IAChC,QAAQ,CAAC,KAAK,EAAE,KAAK;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS;IACnC,QAAQ,CAAC,cAAc,EAAE,cAAc;gBAL9B,cAAc,EAAE,cAAc,EAC9B,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,aAAa,EACvB,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,cAAc,EAAE,cAAc;IAGzC;;;;;;;;OAQG;IACG,UAAU,CACd,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,QAAQ,GAAG,gBAAgB,EACvC,OAAO,EAAE,GAAG,EACZ,OAAO,CAAC,EAAE,gBAAgB;IAqB5B;;OAEG;IACG,YAAY,CAChB,cAAc,EAAE,gCAAgC,EAChD,UAAU,EAAE,gBAAgB,EAC5B,OAAO,EAAE,GAAG;CAcf"}
+{"version":3,"file":"oauth-server-factory.d.ts","sourceRoot":"","sources":["../src/oauth-server-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,EAAE,gCAAgC,EAAE,MAAM,sBAAsB,CAAA;AACvE,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,mDAAmD,CAAA;AACpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAE3C,qBAAa,kBAAkB;IAE3B,QAAQ,CAAC,cAAc,EAAE,cAAc;IACvC,QAAQ,CAAC,OAAO,EAAE,OAAO;IACzB,QAAQ,CAAC,QAAQ,EAAE,aAAa;IAChC,QAAQ,CAAC,KAAK,EAAE,KAAK;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS;IACnC,QAAQ,CAAC,cAAc,EAAE,cAAc;gBAL9B,cAAc,EAAE,cAAc,EAC9B,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,aAAa,EACvB,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,cAAc,EAAE,cAAc;IAGzC;;;;;;;;OAQG;IACG,UAAU,CACd,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,gBAAgB,EAC5B,OAAO,EAAE,GAAG,EACZ,OAAO,CAAC,EAAE,gBAAgB;IAU5B;;OAEG;IACG,YAAY,CAChB,cAAc,EAAE,gCAAgC,EAChD,UAAU,EAAE,gBAAgB,EAC5B,OAAO,EAAE,GAAG;CAcf"}

package/dist/oauth-server-factory.js

@@ -1,7 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OAuthServerFactory = void 0;
-const oauth_client_auth_js_1 = require("./oauth-client-auth.js");
 const oauth_server_agent_js_1 = require("./oauth-server-agent.js");
 class OAuthServerFactory {
     constructor(clientMetadata, runtime, resolver, fetch, keyset, dpopNonceCache) {
@@ -53,12 +52,6 @@ class OAuthServerFactory {
      */
     async fromIssuer(issuer, authMethod, dpopKey, options) {
         const serverMetadata = await this.resolver.getAuthorizationServerMetadata(issuer, options);
-        if (authMethod === 'legacy') {
-            // @NOTE Because we were previously not storing the authMethod in the
-            // session data, we provide a backwards compatible implementation by
-            // computing it here.
-            authMethod = (0, oauth_client_auth_js_1.negotiateClientAuthMethod)(serverMetadata, this.clientMetadata, this.keyset);
-        }
         return this.fromMetadata(serverMetadata, authMethod, dpopKey);
     }
     /**

package/dist/oauth-server-factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-server-factory.js","sourceRoot":"","sources":["../src/oauth-server-factory.ts"],"names":[],"mappings":";;;AAIA,iEAG+B;AAE/B,mEAA0E;AAI1E,MAAa,kBAAkB;IAC7B,YACW,cAA8B,EAC9B,OAAgB,EAChB,QAAuB,EACvB,KAAY,EACZ,MAA0B,EAC1B,cAA8B;QALvC;;;;mBAAS,cAAc;WAAgB;QACvC;;;;mBAAS,OAAO;WAAS;QACzB;;;;mBAAS,QAAQ;WAAe;QAChC;;;;mBAAS,KAAK;WAAO;QACrB;;;;mBAAS,MAAM;WAAoB;QACnC;;;;mBAAS,cAAc;WAAgB;IACtC,CAAC;IAEJ;;;;;;;;OAQG;IACH,KAAK,CAAC,UAAU,CACd,MAAc,EACd,UAAuC,EACvC,OAAY,EACZ,OAA0B;QAE1B,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,8BAA8B,CACvE,MAAM,EACN,OAAO,CACR,CAAA;QAED,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC5B,qEAAqE;YACrE,oEAAoE;YACpE,qBAAqB;YACrB,UAAU,GAAG,IAAA,gDAAyB,EACpC,cAAc,EACd,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,MAAM,CACZ,CAAA;QACH,CAAC;QAED,OAAO,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IAC/D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAChB,cAAgD,EAChD,UAA4B,EAC5B,OAAY;QAEZ,OAAO,IAAI,wCAAgB,CACzB,UAAU,EACV,OAAO,EACP,cAAc,EACd,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;CACF;AAhED,gDAgEC","sourcesContent":["import { Key, Keyset } from '@atproto/jwk'\nimport { OAuthAuthorizationServerMetadata } from '@atproto/oauth-types'\nimport { Fetch } from '@atproto-labs/fetch'\nimport { GetCachedOptions } from './oauth-authorization-server-metadata-resolver.js'\nimport {\n  ClientAuthMethod,\n  negotiateClientAuthMethod,\n} from './oauth-client-auth.js'\nimport { OAuthResolver } from './oauth-resolver.js'\nimport { DpopNonceCache, OAuthServerAgent } from './oauth-server-agent.js'\nimport { Runtime } from './runtime.js'\nimport { ClientMetadata } from './types.js'\n\nexport class OAuthServerFactory {\n  constructor(\n    readonly clientMetadata: ClientMetadata,\n    readonly runtime: Runtime,\n    readonly resolver: OAuthResolver,\n    readonly fetch: Fetch,\n    readonly keyset: Keyset | undefined,\n    readonly dpopNonceCache: DpopNonceCache,\n  ) {}\n\n  /**\n   * @param authMethod `undefined` means that we are restoring a session that\n   * was created before we started storing the `authMethod` in the session. In\n   * that case, we will use the first key from the keyset.\n   *\n   * Support for this might be removed in the future.\n   *\n   * @throws see {@link OAuthServerFactory.fromMetadata}\n   */\n  async fromIssuer(\n    issuer: string,\n    authMethod: 'legacy' | ClientAuthMethod,\n    dpopKey: Key,\n    options?: GetCachedOptions,\n  ) {\n    const serverMetadata = await this.resolver.getAuthorizationServerMetadata(\n      issuer,\n      options,\n    )\n\n    if (authMethod === 'legacy') {\n      // @NOTE Because we were previously not storing the authMethod in the\n      // session data, we provide a backwards compatible implementation by\n      // computing it here.\n      authMethod = negotiateClientAuthMethod(\n        serverMetadata,\n        this.clientMetadata,\n        this.keyset,\n      )\n    }\n\n    return this.fromMetadata(serverMetadata, authMethod, dpopKey)\n  }\n\n  /**\n   * @throws see {@link OAuthServerAgent}\n   */\n  async fromMetadata(\n    serverMetadata: OAuthAuthorizationServerMetadata,\n    authMethod: ClientAuthMethod,\n    dpopKey: Key,\n  ) {\n    return new OAuthServerAgent(\n      authMethod,\n      dpopKey,\n      serverMetadata,\n      this.clientMetadata,\n      this.dpopNonceCache,\n      this.resolver,\n      this.runtime,\n      this.keyset,\n      this.fetch,\n    )\n  }\n}\n"]}
+{"version":3,"file":"oauth-server-factory.js","sourceRoot":"","sources":["../src/oauth-server-factory.ts"],"names":[],"mappings":";;;AAMA,mEAA0E;AAI1E,MAAa,kBAAkB;IAC7B,YACW,cAA8B,EAC9B,OAAgB,EAChB,QAAuB,EACvB,KAAY,EACZ,MAA0B,EAC1B,cAA8B;QALvC;;;;mBAAS,cAAc;WAAgB;QACvC;;;;mBAAS,OAAO;WAAS;QACzB;;;;mBAAS,QAAQ;WAAe;QAChC;;;;mBAAS,KAAK;WAAO;QACrB;;;;mBAAS,MAAM;WAAoB;QACnC;;;;mBAAS,cAAc;WAAgB;IACtC,CAAC;IAEJ;;;;;;;;OAQG;IACH,KAAK,CAAC,UAAU,CACd,MAAc,EACd,UAA4B,EAC5B,OAAY,EACZ,OAA0B;QAE1B,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,8BAA8B,CACvE,MAAM,EACN,OAAO,CACR,CAAA;QAED,OAAO,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IAC/D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAChB,cAAgD,EAChD,UAA4B,EAC5B,OAAY;QAEZ,OAAO,IAAI,wCAAgB,CACzB,UAAU,EACV,OAAO,EACP,cAAc,EACd,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;CACF;AArDD,gDAqDC","sourcesContent":["import { Key, Keyset } from '@atproto/jwk'\nimport { OAuthAuthorizationServerMetadata } from '@atproto/oauth-types'\nimport { Fetch } from '@atproto-labs/fetch'\nimport { GetCachedOptions } from './oauth-authorization-server-metadata-resolver.js'\nimport { ClientAuthMethod } from './oauth-client-auth.js'\nimport { OAuthResolver } from './oauth-resolver.js'\nimport { DpopNonceCache, OAuthServerAgent } from './oauth-server-agent.js'\nimport { Runtime } from './runtime.js'\nimport { ClientMetadata } from './types.js'\n\nexport class OAuthServerFactory {\n  constructor(\n    readonly clientMetadata: ClientMetadata,\n    readonly runtime: Runtime,\n    readonly resolver: OAuthResolver,\n    readonly fetch: Fetch,\n    readonly keyset: Keyset | undefined,\n    readonly dpopNonceCache: DpopNonceCache,\n  ) {}\n\n  /**\n   * @param authMethod `undefined` means that we are restoring a session that\n   * was created before we started storing the `authMethod` in the session. In\n   * that case, we will use the first key from the keyset.\n   *\n   * Support for this might be removed in the future.\n   *\n   * @throws see {@link OAuthServerFactory.fromMetadata}\n   */\n  async fromIssuer(\n    issuer: string,\n    authMethod: ClientAuthMethod,\n    dpopKey: Key,\n    options?: GetCachedOptions,\n  ) {\n    const serverMetadata = await this.resolver.getAuthorizationServerMetadata(\n      issuer,\n      options,\n    )\n\n    return this.fromMetadata(serverMetadata, authMethod, dpopKey)\n  }\n\n  /**\n   * @throws see {@link OAuthServerAgent}\n   */\n  async fromMetadata(\n    serverMetadata: OAuthAuthorizationServerMetadata,\n    authMethod: ClientAuthMethod,\n    dpopKey: Key,\n  ) {\n    return new OAuthServerAgent(\n      authMethod,\n      dpopKey,\n      serverMetadata,\n      this.clientMetadata,\n      this.dpopNonceCache,\n      this.resolver,\n      this.runtime,\n      this.keyset,\n      this.fetch,\n    )\n  }\n}\n"]}

package/dist/oauth-session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-session.d.ts","sourceRoot":"","sources":["../src/oauth-session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AACzC,OAAO,EACL,iBAAiB,EACjB,gCAAgC,EACjC,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,KAAK,EAAa,MAAM,qBAAqB,CAAA;AAItD,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAA;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAMnD,YAAY,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAA;AAC7C,MAAM,MAAM,SAAS,GAAG;IACtB,SAAS,CAAC,EAAE,IAAI,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,KAAK,EAAE,iBAAiB,CAAA;IACxB,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,UAAU,CAAA;CAChB,CAAA;AAED,qBAAa,YAAY;aAIL,MAAM,EAAE,gBAAgB;aACxB,GAAG,EAAE,UAAU;IAC/B,OAAO,CAAC,QAAQ,CAAC,aAAa;IALhC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;gBAGjB,MAAM,EAAE,gBAAgB,EACxB,GAAG,EAAE,UAAU,EACd,aAAa,EAAE,aAAa,EAC7C,KAAK,GAAE,KAAwB;IAYjC,IAAI,GAAG,IAAI,UAAU,CAEpB;IAED,IAAI,cAAc,IAAI,QAAQ,CAAC,gCAAgC,CAAC,CAE/D;IAED;;;;;OAKG;cACa,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IASnE,YAAY,CAAC,OAAO,GAAE,OAAO,GAAG,MAAe,GAAG,OAAO,CAAC,SAAS,CAAC;IAmBpE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAYxB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;CA2D5E"}
+{"version":3,"file":"oauth-session.d.ts","sourceRoot":"","sources":["../src/oauth-session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AACzC,OAAO,EACL,iBAAiB,EACjB,gCAAgC,EACjC,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,KAAK,EAAa,MAAM,qBAAqB,CAAA;AAItD,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAA;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAMnD,YAAY,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAA;AAC7C,MAAM,MAAM,SAAS,GAAG;IACtB,SAAS,CAAC,EAAE,IAAI,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,KAAK,EAAE,iBAAiB,CAAA;IACxB,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,UAAU,CAAA;CAChB,CAAA;AAED,qBAAa,YAAY;aAIL,MAAM,EAAE,gBAAgB;aACxB,GAAG,EAAE,UAAU;IAC/B,OAAO,CAAC,QAAQ,CAAC,aAAa;IALhC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;gBAGjB,MAAM,EAAE,gBAAgB,EACxB,GAAG,EAAE,UAAU,EACd,aAAa,EAAE,aAAa,EAC7C,KAAK,GAAE,KAAwB;IAYjC,IAAI,GAAG,IAAI,UAAU,CAEpB;IAED,IAAI,cAAc,IAAI,QAAQ,CAAC,gCAAgC,CAAC,CAE/D;IAED;;;;;OAKG;cACa,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAMnE,YAAY,CAAC,OAAO,GAAE,OAAO,GAAG,MAAe,GAAG,OAAO,CAAC,SAAS,CAAC;IAmBpE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAYxB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;CA2D5E"}

package/dist/oauth-session.js

@@ -54,10 +54,7 @@ class OAuthSession {
      * if, and only if, they are (about to be) expired. Defaults to `undefined`.
      */
     async getTokenSet(refresh) {
-        const { tokenSet } = await this.sessionGetter.get(this.sub, {
-            noCache: refresh === true,
-            allowStale: refresh === false,
-        });
+        const { tokenSet } = await this.sessionGetter.getSession(this.sub, refresh);
         return tokenSet;
     }
     async getTokenInfo(refresh = 'auto') {

package/dist/oauth-session.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-session.js","sourceRoot":"","sources":["../src/oauth-session.ts"],"names":[],"mappings":";;;AAKA,+CAAsD;AACtD,4EAAmE;AACnE,4EAAmE;AACnE,mDAAkD;AAIlD,MAAM,cAAc,GAAG,UAAU,CAAC,cAErB,CAAA;AAYb,MAAa,YAAY;IAGvB,YACkB,MAAwB,EACxB,GAAe,EACd,aAA4B,EAC7C,QAAe,UAAU,CAAC,KAAK;QAH/B;;;;mBAAgB,MAAM;WAAkB;QACxC;;;;mBAAgB,GAAG;WAAY;QAC/B;;;;mBAAiB,aAAa;WAAe;QALrC;;;;;WAAyB;QAQjC,IAAI,CAAC,SAAS,GAAG,IAAA,gCAAgB,EAAO;YACtC,KAAK,EAAE,IAAA,iBAAS,EAAC,KAAK,CAAC;YACvB,GAAG,EAAE,MAAM,CAAC,OAAO;YACnB,aAAa,EAAE,MAAM,CAAC,cAAc,CAAC,iCAAiC;YACtE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;YAC7C,MAAM,EAAE,MAAM,CAAC,UAAU;YACzB,YAAY,EAAE,KAAK;SACpB,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,GAAG,CAAA;IACjB,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAA;IACnC,CAAC;IAED;;;;;OAKG;IACO,KAAK,CAAC,WAAW,CAAC,OAAyB;QACnD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE;YAC1D,OAAO,EAAE,OAAO,KAAK,IAAI;YACzB,UAAU,EAAE,OAAO,KAAK,KAAK;SAC9B,CAAC,CAAA;QAEF,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,UAA4B,MAAM;QACnD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QAChD,MAAM,SAAS,GACb,QAAQ,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;QAEzE,OAAO;YACL,SAAS;YACT,IAAI,OAAO;gBACT,OAAO,SAAS,IAAI,IAAI;oBACtB,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAA;YAC5C,CAAC;YACD,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,GAAG,EAAE,QAAQ,CAAC,GAAG;SAClB,CAAA;IACH,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;YAC9C,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;QACjD,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAChC,IAAI,CAAC,GAAG,EACR,IAAI,0CAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAChC,CAAA;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,IAAkB;QACrD,mEAAmE;QACnE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QAE/C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAoB,CAAC,CAAA;QACnE,MAAM,WAAW,GAAG,GAAG,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAA;QAErE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QAC1C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,WAAW,CAAC,CAAA;QAEzC,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE;YACvD,GAAG,IAAI;YACP,OAAO;SACR,CAAC,CAAA;QAEF,2DAA2D;QAC3D,IAAI,CAAC,sBAAsB,CAAC,eAAe,CAAC,EAAE,CAAC;YAC7C,OAAO,eAAe,CAAA;QACxB,CAAC;QAED,IAAI,aAAuB,CAAA;QAC3B,IAAI,CAAC;YACH,kBAAkB;YAClB,aAAa,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAA;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,eAAe,CAAA;QACxB,CAAC;QAED,2EAA2E;QAC3E,yEAAyE;QACzE,yEAAyE;QACzE,wEAAwE;QACxE,IAAI,cAAc,IAAI,IAAI,EAAE,IAAI,YAAY,cAAc,EAAE,CAAC;YAC3D,OAAO,eAAe,CAAA;QACxB,CAAC;QAED,MAAM,SAAS,GAAG,GAAG,aAAa,CAAC,UAAU,IAAI,aAAa,CAAC,YAAY,EAAE,CAAA;QAC7E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,CAAA;QAErD,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,SAAS,CAAC,CAAA;QAEvC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;QAE1E,yEAAyE;QACzE,0EAA0E;QAC1E,yEAAyE;QACzE,iEAAiE;QACjE,IAAI,sBAAsB,CAAC,aAAa,CAAC,EAAE,CAAC;YAC1C,oEAAoE;YACpE,0EAA0E;YAC1E,kCAAkC;YAClC,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAChC,IAAI,CAAC,GAAG,EACR,IAAI,0CAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAChC,CAAA;QACH,CAAC;QAED,OAAO,aAAa,CAAA;IACtB,CAAC;CACF;AApID,oCAoIC;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAAC,QAAkB;IAChD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,KAAK,CAAA;IACzC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;IACxD,OAAO,CACL,OAAO,IAAI,IAAI;QACf,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC9D,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAC1C,CAAA;AACH,CAAC","sourcesContent":["import { AtprotoDid } from '@atproto/did'\nimport {\n  AtprotoOAuthScope,\n  OAuthAuthorizationServerMetadata,\n} from '@atproto/oauth-types'\nimport { Fetch, bindFetch } from '@atproto-labs/fetch'\nimport { TokenInvalidError } from './errors/token-invalid-error.js'\nimport { TokenRevokedError } from './errors/token-revoked-error.js'\nimport { dpopFetchWrapper } from './fetch-dpop.js'\nimport { OAuthServerAgent, TokenSet } from './oauth-server-agent.js'\nimport { SessionGetter } from './session-getter.js'\n\nconst ReadableStream = globalThis.ReadableStream as\n  | typeof globalThis.ReadableStream\n  | undefined\n\nexport type { AtprotoDid, AtprotoOAuthScope }\nexport type TokenInfo = {\n  expiresAt?: Date\n  expired?: boolean\n  scope: AtprotoOAuthScope\n  iss: string\n  aud: string\n  sub: AtprotoDid\n}\n\nexport class OAuthSession {\n  protected dpopFetch: Fetch<unknown>\n\n  constructor(\n    public readonly server: OAuthServerAgent,\n    public readonly sub: AtprotoDid,\n    private readonly sessionGetter: SessionGetter,\n    fetch: Fetch = globalThis.fetch,\n  ) {\n    this.dpopFetch = dpopFetchWrapper<void>({\n      fetch: bindFetch(fetch),\n      key: server.dpopKey,\n      supportedAlgs: server.serverMetadata.dpop_signing_alg_values_supported,\n      sha256: async (v) => server.runtime.sha256(v),\n      nonces: server.dpopNonces,\n      isAuthServer: false,\n    })\n  }\n\n  get did(): AtprotoDid {\n    return this.sub\n  }\n\n  get serverMetadata(): Readonly<OAuthAuthorizationServerMetadata> {\n    return this.server.serverMetadata\n  }\n\n  /**\n   * @param refresh When `true`, the credentials will be refreshed even if they\n   * are not expired. When `false`, the credentials will not be refreshed even\n   * if they are expired. When `undefined`, the credentials will be refreshed\n   * if, and only if, they are (about to be) expired. Defaults to `undefined`.\n   */\n  protected async getTokenSet(refresh: boolean | 'auto'): Promise<TokenSet> {\n    const { tokenSet } = await this.sessionGetter.get(this.sub, {\n      noCache: refresh === true,\n      allowStale: refresh === false,\n    })\n\n    return tokenSet\n  }\n\n  async getTokenInfo(refresh: boolean | 'auto' = 'auto'): Promise<TokenInfo> {\n    const tokenSet = await this.getTokenSet(refresh)\n    const expiresAt =\n      tokenSet.expires_at == null ? undefined : new Date(tokenSet.expires_at)\n\n    return {\n      expiresAt,\n      get expired() {\n        return expiresAt == null\n          ? undefined\n          : expiresAt.getTime() < Date.now() - 5e3\n      },\n      scope: tokenSet.scope,\n      iss: tokenSet.iss,\n      aud: tokenSet.aud,\n      sub: tokenSet.sub,\n    }\n  }\n\n  async signOut(): Promise<void> {\n    try {\n      const tokenSet = await this.getTokenSet(false)\n      await this.server.revoke(tokenSet.access_token)\n    } finally {\n      await this.sessionGetter.delStored(\n        this.sub,\n        new TokenRevokedError(this.sub),\n      )\n    }\n  }\n\n  async fetchHandler(pathname: string, init?: RequestInit): Promise<Response> {\n    // This will try and refresh the token if it is known to be expired\n    const tokenSet = await this.getTokenSet('auto')\n\n    const initialUrl = new URL(pathname, tokenSet.aud satisfies string)\n    const initialAuth = `${tokenSet.token_type} ${tokenSet.access_token}`\n\n    const headers = new Headers(init?.headers)\n    headers.set('Authorization', initialAuth)\n\n    const initialResponse = await this.dpopFetch(initialUrl, {\n      ...init,\n      headers,\n    })\n\n    // If the token is not expired, we don't need to refresh it\n    if (!isInvalidTokenResponse(initialResponse)) {\n      return initialResponse\n    }\n\n    let tokenSetFresh: TokenSet\n    try {\n      // Force a refresh\n      tokenSetFresh = await this.getTokenSet(true)\n    } catch (err) {\n      return initialResponse\n    }\n\n    // The stream was already consumed. We cannot retry the request. A solution\n    // would be to tee() the input stream but that would bufferize the entire\n    // stream in memory which can lead to memory starvation. Instead, we will\n    // return the original response and let the calling code handle retries.\n    if (ReadableStream && init?.body instanceof ReadableStream) {\n      return initialResponse\n    }\n\n    const finalAuth = `${tokenSetFresh.token_type} ${tokenSetFresh.access_token}`\n    const finalUrl = new URL(pathname, tokenSetFresh.aud)\n\n    headers.set('Authorization', finalAuth)\n\n    const finalResponse = await this.dpopFetch(finalUrl, { ...init, headers })\n\n    // The token was successfully refreshed, but is still not accepted by the\n    // resource server. This might be due to the resource server not accepting\n    // credentials from the authorization server (e.g. because some migration\n    // occurred). Any ways, there is no point in keeping the session.\n    if (isInvalidTokenResponse(finalResponse)) {\n      // @TODO Is there a \"softer\" way to handle this, e.g. by marking the\n      // session as \"expired\" in the session store, allowing the user to trigger\n      // a new login (using login_hint)?\n      await this.sessionGetter.delStored(\n        this.sub,\n        new TokenInvalidError(this.sub),\n      )\n    }\n\n    return finalResponse\n  }\n}\n\n/**\n * @see {@link https://datatracker.ietf.org/doc/html/rfc6750#section-3}\n * @see {@link https://datatracker.ietf.org/doc/html/rfc9449#name-resource-server-provided-no}\n */\nfunction isInvalidTokenResponse(response: Response) {\n  if (response.status !== 401) return false\n  const wwwAuth = response.headers.get('WWW-Authenticate')\n  return (\n    wwwAuth != null &&\n    (wwwAuth.startsWith('Bearer ') || wwwAuth.startsWith('DPoP ')) &&\n    wwwAuth.includes('error=\"invalid_token\"')\n  )\n}\n"]}
+{"version":3,"file":"oauth-session.js","sourceRoot":"","sources":["../src/oauth-session.ts"],"names":[],"mappings":";;;AAKA,+CAAsD;AACtD,4EAAmE;AACnE,4EAAmE;AACnE,mDAAkD;AAIlD,MAAM,cAAc,GAAG,UAAU,CAAC,cAErB,CAAA;AAYb,MAAa,YAAY;IAGvB,YACkB,MAAwB,EACxB,GAAe,EACd,aAA4B,EAC7C,QAAe,UAAU,CAAC,KAAK;QAH/B;;;;mBAAgB,MAAM;WAAkB;QACxC;;;;mBAAgB,GAAG;WAAY;QAC/B;;;;mBAAiB,aAAa;WAAe;QALrC;;;;;WAAyB;QAQjC,IAAI,CAAC,SAAS,GAAG,IAAA,gCAAgB,EAAO;YACtC,KAAK,EAAE,IAAA,iBAAS,EAAC,KAAK,CAAC;YACvB,GAAG,EAAE,MAAM,CAAC,OAAO;YACnB,aAAa,EAAE,MAAM,CAAC,cAAc,CAAC,iCAAiC;YACtE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;YAC7C,MAAM,EAAE,MAAM,CAAC,UAAU;YACzB,YAAY,EAAE,KAAK;SACpB,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,GAAG,CAAA;IACjB,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAA;IACnC,CAAC;IAED;;;;;OAKG;IACO,KAAK,CAAC,WAAW,CAAC,OAAyB;QACnD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QAE3E,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,UAA4B,MAAM;QACnD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QAChD,MAAM,SAAS,GACb,QAAQ,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;QAEzE,OAAO;YACL,SAAS;YACT,IAAI,OAAO;gBACT,OAAO,SAAS,IAAI,IAAI;oBACtB,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAA;YAC5C,CAAC;YACD,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,GAAG,EAAE,QAAQ,CAAC,GAAG;SAClB,CAAA;IACH,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;YAC9C,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;QACjD,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAChC,IAAI,CAAC,GAAG,EACR,IAAI,0CAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAChC,CAAA;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,IAAkB;QACrD,mEAAmE;QACnE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QAE/C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAoB,CAAC,CAAA;QACnE,MAAM,WAAW,GAAG,GAAG,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAA;QAErE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QAC1C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,WAAW,CAAC,CAAA;QAEzC,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE;YACvD,GAAG,IAAI;YACP,OAAO;SACR,CAAC,CAAA;QAEF,2DAA2D;QAC3D,IAAI,CAAC,sBAAsB,CAAC,eAAe,CAAC,EAAE,CAAC;YAC7C,OAAO,eAAe,CAAA;QACxB,CAAC;QAED,IAAI,aAAuB,CAAA;QAC3B,IAAI,CAAC;YACH,kBAAkB;YAClB,aAAa,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAA;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,eAAe,CAAA;QACxB,CAAC;QAED,2EAA2E;QAC3E,yEAAyE;QACzE,yEAAyE;QACzE,wEAAwE;QACxE,IAAI,cAAc,IAAI,IAAI,EAAE,IAAI,YAAY,cAAc,EAAE,CAAC;YAC3D,OAAO,eAAe,CAAA;QACxB,CAAC;QAED,MAAM,SAAS,GAAG,GAAG,aAAa,CAAC,UAAU,IAAI,aAAa,CAAC,YAAY,EAAE,CAAA;QAC7E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,CAAA;QAErD,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,SAAS,CAAC,CAAA;QAEvC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;QAE1E,yEAAyE;QACzE,0EAA0E;QAC1E,yEAAyE;QACzE,iEAAiE;QACjE,IAAI,sBAAsB,CAAC,aAAa,CAAC,EAAE,CAAC;YAC1C,oEAAoE;YACpE,0EAA0E;YAC1E,kCAAkC;YAClC,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAChC,IAAI,CAAC,GAAG,EACR,IAAI,0CAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAChC,CAAA;QACH,CAAC;QAED,OAAO,aAAa,CAAA;IACtB,CAAC;CACF;AAjID,oCAiIC;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAAC,QAAkB;IAChD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,KAAK,CAAA;IACzC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;IACxD,OAAO,CACL,OAAO,IAAI,IAAI;QACf,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC9D,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAC1C,CAAA;AACH,CAAC","sourcesContent":["import { AtprotoDid } from '@atproto/did'\nimport {\n  AtprotoOAuthScope,\n  OAuthAuthorizationServerMetadata,\n} from '@atproto/oauth-types'\nimport { Fetch, bindFetch } from '@atproto-labs/fetch'\nimport { TokenInvalidError } from './errors/token-invalid-error.js'\nimport { TokenRevokedError } from './errors/token-revoked-error.js'\nimport { dpopFetchWrapper } from './fetch-dpop.js'\nimport { OAuthServerAgent, TokenSet } from './oauth-server-agent.js'\nimport { SessionGetter } from './session-getter.js'\n\nconst ReadableStream = globalThis.ReadableStream as\n  | typeof globalThis.ReadableStream\n  | undefined\n\nexport type { AtprotoDid, AtprotoOAuthScope }\nexport type TokenInfo = {\n  expiresAt?: Date\n  expired?: boolean\n  scope: AtprotoOAuthScope\n  iss: string\n  aud: string\n  sub: AtprotoDid\n}\n\nexport class OAuthSession {\n  protected dpopFetch: Fetch<unknown>\n\n  constructor(\n    public readonly server: OAuthServerAgent,\n    public readonly sub: AtprotoDid,\n    private readonly sessionGetter: SessionGetter,\n    fetch: Fetch = globalThis.fetch,\n  ) {\n    this.dpopFetch = dpopFetchWrapper<void>({\n      fetch: bindFetch(fetch),\n      key: server.dpopKey,\n      supportedAlgs: server.serverMetadata.dpop_signing_alg_values_supported,\n      sha256: async (v) => server.runtime.sha256(v),\n      nonces: server.dpopNonces,\n      isAuthServer: false,\n    })\n  }\n\n  get did(): AtprotoDid {\n    return this.sub\n  }\n\n  get serverMetadata(): Readonly<OAuthAuthorizationServerMetadata> {\n    return this.server.serverMetadata\n  }\n\n  /**\n   * @param refresh When `true`, the credentials will be refreshed even if they\n   * are not expired. When `false`, the credentials will not be refreshed even\n   * if they are expired. When `undefined`, the credentials will be refreshed\n   * if, and only if, they are (about to be) expired. Defaults to `undefined`.\n   */\n  protected async getTokenSet(refresh: boolean | 'auto'): Promise<TokenSet> {\n    const { tokenSet } = await this.sessionGetter.getSession(this.sub, refresh)\n\n    return tokenSet\n  }\n\n  async getTokenInfo(refresh: boolean | 'auto' = 'auto'): Promise<TokenInfo> {\n    const tokenSet = await this.getTokenSet(refresh)\n    const expiresAt =\n      tokenSet.expires_at == null ? undefined : new Date(tokenSet.expires_at)\n\n    return {\n      expiresAt,\n      get expired() {\n        return expiresAt == null\n          ? undefined\n          : expiresAt.getTime() < Date.now() - 5e3\n      },\n      scope: tokenSet.scope,\n      iss: tokenSet.iss,\n      aud: tokenSet.aud,\n      sub: tokenSet.sub,\n    }\n  }\n\n  async signOut(): Promise<void> {\n    try {\n      const tokenSet = await this.getTokenSet(false)\n      await this.server.revoke(tokenSet.access_token)\n    } finally {\n      await this.sessionGetter.delStored(\n        this.sub,\n        new TokenRevokedError(this.sub),\n      )\n    }\n  }\n\n  async fetchHandler(pathname: string, init?: RequestInit): Promise<Response> {\n    // This will try and refresh the token if it is known to be expired\n    const tokenSet = await this.getTokenSet('auto')\n\n    const initialUrl = new URL(pathname, tokenSet.aud satisfies string)\n    const initialAuth = `${tokenSet.token_type} ${tokenSet.access_token}`\n\n    const headers = new Headers(init?.headers)\n    headers.set('Authorization', initialAuth)\n\n    const initialResponse = await this.dpopFetch(initialUrl, {\n      ...init,\n      headers,\n    })\n\n    // If the token is not expired, we don't need to refresh it\n    if (!isInvalidTokenResponse(initialResponse)) {\n      return initialResponse\n    }\n\n    let tokenSetFresh: TokenSet\n    try {\n      // Force a refresh\n      tokenSetFresh = await this.getTokenSet(true)\n    } catch (err) {\n      return initialResponse\n    }\n\n    // The stream was already consumed. We cannot retry the request. A solution\n    // would be to tee() the input stream but that would bufferize the entire\n    // stream in memory which can lead to memory starvation. Instead, we will\n    // return the original response and let the calling code handle retries.\n    if (ReadableStream && init?.body instanceof ReadableStream) {\n      return initialResponse\n    }\n\n    const finalAuth = `${tokenSetFresh.token_type} ${tokenSetFresh.access_token}`\n    const finalUrl = new URL(pathname, tokenSetFresh.aud)\n\n    headers.set('Authorization', finalAuth)\n\n    const finalResponse = await this.dpopFetch(finalUrl, { ...init, headers })\n\n    // The token was successfully refreshed, but is still not accepted by the\n    // resource server. This might be due to the resource server not accepting\n    // credentials from the authorization server (e.g. because some migration\n    // occurred). Any ways, there is no point in keeping the session.\n    if (isInvalidTokenResponse(finalResponse)) {\n      // @TODO Is there a \"softer\" way to handle this, e.g. by marking the\n      // session as \"expired\" in the session store, allowing the user to trigger\n      // a new login (using login_hint)?\n      await this.sessionGetter.delStored(\n        this.sub,\n        new TokenInvalidError(this.sub),\n      )\n    }\n\n    return finalResponse\n  }\n}\n\n/**\n * @see {@link https://datatracker.ietf.org/doc/html/rfc6750#section-3}\n * @see {@link https://datatracker.ietf.org/doc/html/rfc9449#name-resource-server-provided-no}\n */\nfunction isInvalidTokenResponse(response: Response) {\n  if (response.status !== 401) return false\n  const wwwAuth = response.headers.get('WWW-Authenticate')\n  return (\n    wwwAuth != null &&\n    (wwwAuth.startsWith('Bearer ') || wwwAuth.startsWith('DPoP ')) &&\n    wwwAuth.includes('error=\"invalid_token\"')\n  )\n}\n"]}

package/dist/session-getter.d.ts

@@ -1,6 +1,7 @@
 import { AtprotoDid } from '@atproto/did';
 import { Key } from '@atproto/jwk';
-import { CachedGetter, GetCachedOptions, SimpleStore } from '@atproto-labs/simple-store';
+import { CachedGetter, GetCachedOptions, GetOptions, SimpleStore } from '@atproto-labs/simple-store';
+import { AuthMethodUnsatisfiableError } from './errors/auth-method-unsatisfiable-error.js';
 import { TokenInvalidError } from './errors/token-invalid-error.js';
 import { TokenRefreshError } from './errors/token-refresh-error.js';
 import { TokenRevokedError } from './errors/token-revoked-error.js';
@@ -10,23 +11,15 @@ import { OAuthServerFactory } from './oauth-server-factory.js';
 import { Runtime } from './runtime.js';
 export type Session = {
     dpopKey: Key;
-    /**
-     * Previous implementation of this lib did not define an `authMethod`
-     */
-    authMethod?: ClientAuthMethod;
+    authMethod: ClientAuthMethod;
     tokenSet: TokenSet;
 };
 export type SessionStore = SimpleStore<string, Session>;
-export type SessionEventMap = {
-    updated: {
-        sub: string;
-    } & Session;
-    deleted: {
-        sub: string;
-        cause: TokenRefreshError | TokenRevokedError | TokenInvalidError | unknown;
-    };
+export type SessionHooks = {
+    onUpdate?: (sub: AtprotoDid, session: Session) => void;
+    onDelete?: (sub: AtprotoDid, cause: TokenRefreshError | TokenRevokedError | TokenInvalidError | unknown) => void;
 };
-export type SessionEventListener<T extends keyof SessionEventMap = keyof SessionEventMap> = (event: CustomEvent<SessionEventMap[T]>) => void;
+export declare function isExpectedSessionError(err: unknown): err is TypeError | AuthMethodUnsatisfiableError | TokenRevokedError | TokenRefreshError | TokenInvalidError;
 /**
  * There are several advantages to wrapping the sessionStore in a (single)
  * CachedGetter, the main of which is that the cached getter will ensure that at
@@ -36,13 +29,16 @@ export type SessionEventListener<T extends keyof SessionEventMap = keyof Session
  */
 export declare class SessionGetter extends CachedGetter<AtprotoDid, Session> {
     private readonly runtime;
-    private readonly eventTarget;
-    constructor(sessionStore: SessionStore, serverFactory: OAuthServerFactory, runtime: Runtime);
-    addEventListener<T extends keyof SessionEventMap>(type: T, callback: SessionEventListener<T>, options?: AddEventListenerOptions | boolean): void;
-    removeEventListener<T extends keyof SessionEventMap>(type: T, callback: SessionEventListener<T>, options?: EventListenerOptions | boolean): void;
-    dispatchEvent<T extends keyof SessionEventMap>(type: T, detail: SessionEventMap[T]): boolean;
-    setStored(sub: string, session: Session): Promise<void>;
+    private readonly hooks;
+    constructor(sessionStore: SessionStore, serverFactory: OAuthServerFactory, runtime: Runtime, hooks?: SessionHooks);
+    getStored(sub: AtprotoDid, options?: GetOptions): Promise<Session | undefined>;
+    setStored(sub: AtprotoDid, session: Session): Promise<void>;
     delStored(sub: AtprotoDid, cause?: unknown): Promise<void>;
+    /**
+     * @deprecated Use {@link getSession} instead
+     * @internal (not really deprecated)
+     */
+    get(sub: AtprotoDid, options?: GetCachedOptions): Promise<Session>;
     /**
      * @param refresh When `true`, the credentials will be refreshed even if they
      * are not expired. When `false`, the credentials will not be refreshed even
@@ -50,6 +46,5 @@ export declare class SessionGetter extends CachedGetter<AtprotoDid, Session> {
      * if, and only if, they are (about to be) expired. Defaults to `undefined`.
      */
     getSession(sub: AtprotoDid, refresh?: boolean | 'auto'): Promise<Session>;
-    get(sub: AtprotoDid, options?: GetCachedOptions): Promise<Session>;
 }
 //# sourceMappingURL=session-getter.d.ts.map

package/dist/session-getter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-getter.d.ts","sourceRoot":"","sources":["../src/session-getter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AACzC,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAClC,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACZ,MAAM,4BAA4B,CAAA;AAEnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAA;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAA;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAA;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAEzD,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAA;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAGtC,MAAM,MAAM,OAAO,GAAG;IACpB,OAAO,EAAE,GAAG,CAAA;IACZ;;OAEG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAA;IAC7B,QAAQ,EAAE,QAAQ,CAAA;CACnB,CAAA;AAED,MAAM,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAEvD,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE;QACP,GAAG,EAAE,MAAM,CAAA;KACZ,GAAG,OAAO,CAAA;IACX,OAAO,EAAE;QACP,GAAG,EAAE,MAAM,CAAA;QACX,KAAK,EAAE,iBAAiB,GAAG,iBAAiB,GAAG,iBAAiB,GAAG,OAAO,CAAA;KAC3E,CAAA;CACF,CAAA;AAED,MAAM,MAAM,oBAAoB,CAC9B,CAAC,SAAS,MAAM,eAAe,GAAG,MAAM,eAAe,IACrD,CAAC,KAAK,EAAE,WAAW,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAA;AAEpD;;;;;;GAMG;AACH,qBAAa,aAAc,SAAQ,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC;IAMhE,OAAO,CAAC,QAAQ,CAAC,OAAO;IAL1B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA2C;gBAGrE,YAAY,EAAE,YAAY,EAC1B,aAAa,EAAE,kBAAkB,EAChB,OAAO,EAAE,OAAO;IAuKnC,gBAAgB,CAAC,CAAC,SAAS,MAAM,eAAe,EAC9C,IAAI,EAAE,CAAC,EACP,QAAQ,EAAE,oBAAoB,CAAC,CAAC,CAAC,EACjC,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO;IAK7C,mBAAmB,CAAC,CAAC,SAAS,MAAM,eAAe,EACjD,IAAI,EAAE,CAAC,EACP,QAAQ,EAAE,oBAAoB,CAAC,CAAC,CAAC,EACjC,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO;IAK1C,aAAa,CAAC,CAAC,SAAS,MAAM,eAAe,EAC3C,IAAI,EAAE,CAAC,EACP,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC,GACzB,OAAO;IAIJ,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO;IAS9B,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAKzE;;;;;OAKG;IACG,UAAU,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,GAAE,OAAO,GAAG,MAAe;IAO9D,GAAG,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;CAwBzE"}
+{"version":3,"file":"session-getter.d.ts","sourceRoot":"","sources":["../src/session-getter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AACzC,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAClC,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,UAAU,EACV,WAAW,EACZ,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,4BAA4B,EAAE,MAAM,6CAA6C,CAAA;AAC1F,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAA;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAA;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAA;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAEzD,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAA;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAGtC,MAAM,MAAM,OAAO,GAAG;IACpB,OAAO,EAAE,GAAG,CAAA;IACZ,UAAU,EAAE,gBAAgB,CAAA;IAC5B,QAAQ,EAAE,QAAQ,CAAA;CACnB,CAAA;AAED,MAAM,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAEvD,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,CAAA;IACtD,QAAQ,CAAC,EAAE,CACT,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,iBAAiB,GAAG,iBAAiB,GAAG,iBAAiB,GAAG,OAAO,KACvE,IAAI,CAAA;CACV,CAAA;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,+GAUlD;AAED;;;;;;GAMG;AACH,qBAAa,aAAc,SAAQ,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC;IAIhE,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAHtB,YAAY,EAAE,YAAY,EAC1B,aAAa,EAAE,kBAAkB,EAChB,OAAO,EAAE,OAAO,EAChB,KAAK,GAAE,YAAiB;IA4J5B,SAAS,CACtB,GAAG,EAAE,UAAU,EACf,OAAO,CAAC,EAAE,UAAU,GACnB,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;IAIhB,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO;IAS3C,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAKzE;;;OAGG;IACY,GAAG,CAChB,GAAG,EAAE,UAAU,EACf,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,OAAO,CAAC;IAyBnB;;;;;OAKG;IACG,UAAU,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,GAAE,OAAO,GAAG,MAAe;CAMrE"}