@happyview/oauth-client 1.0.0-dev.2 → 1.0.1

package/LICENSE.md

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 Lexicon Community
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,111 @@
+# @happyview/oauth-client
+
+Core OAuth client for authenticating with a [HappyView](https://github.com/gamesgamesgamesgamesgames/happyview) instance.
+
+This is a platform-agnostic package. If you're building a browser app, use [`@happyview/oauth-client-browser`](https://www.npmjs.com/package/@happyview/oauth-client-browser) instead. It wraps this package with Web Crypto, localStorage, and a complete OAuth redirect flow.
+
+## Installation
+
+```bash
+npm install @happyview/oauth-client
+```
+
+## Usage
+
+`HappyViewOAuthClient` manages DPoP key provisioning, session registration, and session restoration lifecycle. You provide a `CryptoAdapter` and optional `StorageAdapter` for your platform.
+
+```typescript
+import { HappyViewOAuthClient } from "@happyview/oauth-client";
+
+const client = new HappyViewOAuthClient({
+  instanceUrl: "https://happyview.example.com",
+  clientKey: "hvc_your_client_key",
+  clientSecret: "hvs_your_secret", // optional, for confidential clients (server-to-server)
+  crypto: myCryptoAdapter,
+  storage: myStorageAdapter, // optional, defaults to in-memory
+});
+```
+
+### DPoP Key Provisioning
+
+Request a DPoP keypair from the HappyView instance:
+
+```typescript
+const { provisionId, dpopKey, pkceVerifier } = await client.provisionDpopKey();
+```
+
+### Session Registration
+
+After completing OAuth authorization with the user's PDS, register the session with HappyView:
+
+```typescript
+const session = await client.registerSession({
+  provisionId,
+  pkceVerifier,
+  did: "did:plc:abc123",
+  accessToken: tokens.access_token,
+  refreshToken: tokens.refresh_token,
+  scopes: "atproto",
+  pdsUrl: "https://pds.example.com",
+  issuer: tokens.iss,
+  dpopKey,
+});
+```
+
+### Making Authenticated Requests
+
+The returned `HappyViewSession` provides a `fetchHandler` that automatically attaches DPoP proof headers:
+
+```typescript
+const response = await session.fetchHandler("/xrpc/com.example.getStuff", {
+  method: "GET",
+});
+```
+
+### Session Restoration
+
+Restore a previously stored session:
+
+```typescript
+// Restore the last active session
+const session = await client.restore();
+
+// Or restore a specific user's session
+const session = await client.restoreSession("did:plc:abc123");
+```
+
+### Logout
+
+```typescript
+await client.deleteSession("did:plc:abc123");
+```
+
+## Adapters
+
+### CryptoAdapter
+
+Implement this interface for your platform's cryptographic primitives:
+
+```typescript
+interface CryptoAdapter {
+  generatePkceVerifier(): Promise<string>;
+  computePkceChallenge(verifier: string): Promise<string>;
+  signEs256(privateKey: JsonWebKey, payload: Uint8Array): Promise<Uint8Array>;
+  sha256(data: Uint8Array): Promise<Uint8Array>;
+  getRandomValues(length: number): Uint8Array;
+}
+```
+
+### StorageAdapter
+
+Implement this interface to persist sessions across restarts:
+
+```typescript
+interface StorageAdapter {
+  get(key: string): Promise<string | null>;
+  set(key: string, value: string): Promise<void>;
+  delete(key: string): Promise<void>;
+}
+```
+
+If no `StorageAdapter` is provided, sessions are stored in memory and will not survive page reloads or process restarts.

package/dist/index.cjs

@@ -29,8 +29,7 @@ __export(index_exports, {
   MemoryStorage: () => MemoryStorage,
   ResolutionError: () => ResolutionError,
   TokenExchangeError: () => TokenExchangeError,
-  base64urlEncode: () => base64urlEncode,
-  generateDpopProof: () => generateDpopProof
+  importJwk: () => importJwk
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -82,63 +81,46 @@ var ResolutionError = class extends HappyViewError {
   }
 };
 
-// src/dpop-proof.ts
-function base64urlEncode(data) {
-  let binary = "";
-  for (let i = 0; i < data.length; i++) {
-    binary += String.fromCharCode(data[i]);
-  }
-  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-async function generateDpopProof(crypto, params) {
-  const { privateKey, method, url, accessToken, nonce } = params;
-  const publicJwk = {
-    kty: privateKey.kty,
-    crv: privateKey.crv,
-    x: privateKey.x,
-    y: privateKey.y
-  };
-  const header = {
-    alg: "ES256",
-    typ: "dpop+jwt",
-    jwk: publicJwk
-  };
-  const jtiBytes = crypto.getRandomValues(16);
-  const jti = Array.from(jtiBytes, (b) => b.toString(16).padStart(2, "0")).join("");
-  const payload = {
-    htm: method,
-    htu: url,
-    iat: Math.floor(Date.now() / 1e3),
-    jti
-  };
-  if (accessToken) {
-    const tokenBytes = new TextEncoder().encode(accessToken);
-    const hashBuf = await crypto.sha256(tokenBytes);
-    payload.ath = base64urlEncode(hashBuf);
-  }
-  if (nonce !== void 0) {
-    payload.nonce = nonce;
-  }
-  const headerB64 = base64urlEncode(
-    new TextEncoder().encode(JSON.stringify(header))
+// src/import-jwk.ts
+var import_jwk_webcrypto = require("@atproto/jwk-webcrypto");
+async function importJwk(jwk) {
+  const privateKey = await crypto.subtle.importKey(
+    "jwk",
+    jwk,
+    { name: "ECDSA", namedCurve: "P-256" },
+    true,
+    ["sign"]
   );
-  const payloadB64 = base64urlEncode(
-    new TextEncoder().encode(JSON.stringify(payload))
+  const { d: _, ...publicJwkFields } = jwk;
+  const publicKey = await crypto.subtle.importKey(
+    "jwk",
+    publicJwkFields,
+    { name: "ECDSA", namedCurve: "P-256" },
+    true,
+    ["verify"]
   );
-  const message = new TextEncoder().encode(`${headerB64}.${payloadB64}`);
-  const signature = await crypto.signEs256(privateKey, message);
-  const sigB64 = base64urlEncode(signature);
-  return `${headerB64}.${payloadB64}.${sigB64}`;
+  return import_jwk_webcrypto.WebcryptoKey.fromKeypair({ privateKey, publicKey });
 }
 
 // src/session.ts
+function randomHex(byteLength) {
+  const bytes = crypto.getRandomValues(new Uint8Array(byteLength));
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+function base64url(buffer) {
+  const bytes = new Uint8Array(buffer);
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
 var HappyViewSession = class {
   did;
   dpopKey;
   accessToken;
   clientKey;
   instanceUrl;
-  crypto;
   _fetch;
   dpopNonce;
   constructor(options) {
@@ -147,29 +129,61 @@ var HappyViewSession = class {
     this.accessToken = options.accessToken;
     this.clientKey = options.clientKey;
     this.instanceUrl = options.instanceUrl.replace(/\/+$/, "");
-    this.crypto = options.crypto;
-    this._fetch = options.fetch ?? globalThis.fetch;
+    this._fetch = options.fetch ?? ((input, init) => fetch(input, init));
   }
   async fetchHandler(url, init) {
     const fullUrl = /^https?:\/\//i.test(url) ? url : `${this.instanceUrl}${url}`;
     const method = (init.method ?? "GET").toUpperCase();
-    const proof = await generateDpopProof(this.crypto, {
-      privateKey: this.dpopKey,
-      method,
-      url: fullUrl,
-      accessToken: this.accessToken,
-      nonce: this.dpopNonce
-    });
-    const headers = new Headers(init.headers);
-    headers.set("authorization", `DPoP ${this.accessToken}`);
-    headers.set("dpop", proof);
-    headers.set("x-client-key", this.clientKey);
-    const response = await this._fetch(fullUrl, {
-      ...init,
-      headers
-    });
+    const htu = fullUrl.split("?")[0];
+    const sendWithProof = async () => {
+      const tokenHash = await crypto.subtle.digest(
+        "SHA-256",
+        new TextEncoder().encode(this.accessToken)
+      );
+      const ath = base64url(tokenHash);
+      const proof = await this.dpopKey.createJwt(
+        {
+          alg: "ES256",
+          typ: "dpop+jwt",
+          jwk: this.dpopKey.publicJwk
+        },
+        {
+          htm: method,
+          htu,
+          iat: Math.floor(Date.now() / 1e3),
+          jti: randomHex(16),
+          ath,
+          nonce: this.dpopNonce
+        }
+      );
+      const headers = new Headers(init.headers);
+      headers.set("authorization", `DPoP ${this.accessToken}`);
+      headers.set("dpop", proof);
+      headers.set("x-client-key", this.clientKey);
+      return this._fetch(fullUrl, { ...init, headers });
+    };
+    let response;
+    try {
+      response = await sendWithProof();
+    } catch (e) {
+      const info = `_fetch type: ${typeof this._fetch}, toString: ${String(this._fetch).slice(0, 120)}, url: ${fullUrl}`;
+      throw new Error(`fetchHandler failed: ${e.message}
+
+DEBUG: ${info}`);
+    }
     const nonce = response.headers.get("dpop-nonce");
-    if (nonce) {
+    if (nonce && nonce !== this.dpopNonce && (response.status === 401 || response.status === 400)) {
+      this.dpopNonce = nonce;
+      try {
+        response = await sendWithProof();
+      } catch (e) {
+        throw new Error(`fetchHandler retry failed: ${e.message}`);
+      }
+      const retryNonce = response.headers.get("dpop-nonce");
+      if (retryNonce) {
+        this.dpopNonce = retryNonce;
+      }
+    } else if (nonce) {
       this.dpopNonce = nonce;
     }
     return response;
@@ -196,7 +210,6 @@ var LAST_ACTIVE_KEY = "happyview:last-active-did";
 var HappyViewOAuthClient = class {
   instanceUrl;
   clientKey;
-  crypto;
   storage;
   clientSecret;
   _fetch;
@@ -204,9 +217,8 @@ var HappyViewOAuthClient = class {
     this.instanceUrl = options.instanceUrl.replace(/\/+$/, "");
     this.clientKey = options.clientKey;
     this.clientSecret = options.clientSecret;
-    this.crypto = options.crypto;
     this.storage = options.storage ?? new MemoryStorage();
-    this._fetch = options.fetch ?? globalThis.fetch;
+    this._fetch = options.fetch ?? ((input, init) => fetch(input, init));
   }
   get isConfidential() {
     return this.clientSecret !== void 0;
@@ -222,8 +234,8 @@ var HappyViewOAuthClient = class {
     const body = {};
     let pkceVerifier;
     if (!this.isConfidential) {
-      pkceVerifier = await this.crypto.generatePkceVerifier();
-      const challenge = await this.crypto.computePkceChallenge(pkceVerifier);
+      pkceVerifier = generatePkceVerifier();
+      const challenge = await computePkceChallenge(pkceVerifier);
       body.pkce_challenge = challenge;
     }
     const resp = await this._fetch(`${this.instanceUrl}/oauth/dpop-keys`, {
@@ -240,9 +252,11 @@ var HappyViewOAuthClient = class {
       );
     }
     const data = await resp.json();
+    const dpopKey = await importJwk(data.dpop_key);
     return {
       provisionId: data.provision_id,
-      dpopKey: data.dpop_key,
+      dpopKey,
+      rawJwk: data.dpop_key,
       pkceVerifier
     };
   }
@@ -280,6 +294,7 @@ var HappyViewOAuthClient = class {
       );
     }
     const data = await resp.json();
+    const dpopKey = await importJwk(params.dpopKey);
     const storedSession = {
       did: data.did,
       dpopKey: params.dpopKey,
@@ -294,34 +309,28 @@ var HappyViewOAuthClient = class {
     await this.storage.set(LAST_ACTIVE_KEY, data.did);
     return new HappyViewSession({
       did: data.did,
-      dpopKey: params.dpopKey,
+      dpopKey,
       accessToken: params.accessToken,
       clientKey: this.clientKey,
       instanceUrl: this.instanceUrl,
-      crypto: this.crypto
+      fetch: this._fetch
     });
   }
   async deleteSession(did) {
-    const headers = {
-      "x-client-key": this.clientKey
-    };
-    if (this.clientSecret) {
-      headers["x-client-secret"] = this.clientSecret;
-    }
-    const resp = await this._fetch(
-      `${this.instanceUrl}/oauth/sessions/${did}`,
-      {
-        method: "DELETE",
-        headers
-      }
-    );
-    if (!resp.ok && resp.status !== 404) {
-      const body = await resp.json().catch(() => ({}));
-      throw new ApiError(
-        `Failed to delete session: ${resp.status} ${body.message ?? resp.statusText}`,
-        resp.status,
-        body
+    const session = await this.restoreSession(did);
+    if (session) {
+      const resp = await session.fetchHandler(
+        `${this.instanceUrl}/oauth/sessions/${did}`,
+        { method: "DELETE" }
       );
+      if (!resp.ok && resp.status !== 404) {
+        const body = await resp.json().catch(() => ({}));
+        throw new ApiError(
+          `Failed to delete session: ${resp.status} ${body.message ?? resp.statusText}`,
+          resp.status,
+          body
+        );
+      }
     }
     await this.storage.delete(`${STORAGE_PREFIX}${did}`);
     const lastActive = await this.storage.get(LAST_ACTIVE_KEY);
@@ -333,13 +342,14 @@ var HappyViewOAuthClient = class {
     const stored = await this.storage.get(`${STORAGE_PREFIX}${did}`);
     if (!stored) return null;
     const data = JSON.parse(stored);
+    const dpopKey = await importJwk(data.dpopKey);
     return new HappyViewSession({
       did: data.did,
-      dpopKey: data.dpopKey,
+      dpopKey,
       accessToken: data.accessToken,
       clientKey: data.clientKey,
       instanceUrl: data.instanceUrl,
-      crypto: this.crypto
+      fetch: this._fetch
     });
   }
   async restore() {
@@ -348,6 +358,26 @@ var HappyViewOAuthClient = class {
     return this.restoreSession(did);
   }
 };
+function generatePkceVerifier() {
+  const bytes = crypto.getRandomValues(new Uint8Array(32));
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function computePkceChallenge(verifier) {
+  const hash = await crypto.subtle.digest(
+    "SHA-256",
+    new TextEncoder().encode(verifier)
+  );
+  const bytes = new Uint8Array(hash);
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   ApiError,
@@ -359,7 +389,6 @@ var HappyViewOAuthClient = class {
   MemoryStorage,
   ResolutionError,
   TokenExchangeError,
-  base64urlEncode,
-  generateDpopProof
+  importJwk
 });
 //# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/errors.ts","../src/dpop-proof.ts","../src/session.ts","../src/storage.ts","../src/client.ts"],"sourcesContent":["export { HappyViewOAuthClient } from \"./client\";\nexport { base64urlEncode, generateDpopProof } from \"./dpop-proof\";\nexport type { DpopProofParams } from \"./dpop-proof\";\nexport {\n  ApiError,\n  AuthenticationError,\n  HappyViewError,\n  InvalidStateError,\n  ResolutionError,\n  TokenExchangeError,\n} from \"./errors\";\nexport { HappyViewSession } from \"./session\";\nexport type { HappyViewSessionOptions } from \"./session\";\nexport { MemoryStorage } from \"./storage\";\nexport type {\n  CryptoAdapter,\n  DpopProvision,\n  HappyViewOAuthClientOptions,\n  ProvisionKeyResponse,\n  RegisterSessionParams,\n  RegisterSessionResponse,\n  StorageAdapter,\n  StoredSession,\n} from \"./types\";\n","export class HappyViewError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"HappyViewError\";\n  }\n}\n\nexport class ApiError extends HappyViewError {\n  readonly status: number;\n  readonly body: unknown;\n\n  constructor(message: string, status: number, body?: unknown) {\n    super(message);\n    this.name = \"ApiError\";\n    this.status = status;\n    this.body = body;\n  }\n}\n\nexport class AuthenticationError extends HappyViewError {\n  readonly status: number;\n\n  constructor(message: string, status: number = 401) {\n    super(message);\n    this.name = \"AuthenticationError\";\n    this.status = status;\n  }\n}\n\nexport class InvalidStateError extends HappyViewError {\n  constructor(message: string) {\n    super(message);\n    this.name = \"InvalidStateError\";\n  }\n}\n\nexport class TokenExchangeError extends HappyViewError {\n  readonly status: number;\n  readonly body: string;\n\n  constructor(message: string, status: number, body: string) {\n    super(message);\n    this.name = \"TokenExchangeError\";\n    this.status = status;\n    this.body = body;\n  }\n}\n\nexport class ResolutionError extends HappyViewError {\n  constructor(message: string) {\n    super(message);\n    this.name = \"ResolutionError\";\n  }\n}\n","import type { CryptoAdapter } from \"./types\";\n\nexport function base64urlEncode(data: Uint8Array): string {\n  let binary = \"\";\n  for (let i = 0; i < data.length; i++) {\n    binary += String.fromCharCode(data[i]);\n  }\n  return btoa(binary)\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/, \"\");\n}\n\nexport interface DpopProofParams {\n  privateKey: JsonWebKey;\n  method: string;\n  url: string;\n  accessToken?: string;\n  nonce?: string;\n}\n\nexport async function generateDpopProof(\n  crypto: CryptoAdapter,\n  params: DpopProofParams,\n): Promise<string> {\n  const { privateKey, method, url, accessToken, nonce } = params;\n\n  const publicJwk = {\n    kty: privateKey.kty,\n    crv: privateKey.crv,\n    x: privateKey.x,\n    y: privateKey.y,\n  };\n\n  const header = {\n    alg: \"ES256\",\n    typ: \"dpop+jwt\",\n    jwk: publicJwk,\n  };\n\n  // Generate jti\n  const jtiBytes = crypto.getRandomValues(16);\n  const jti = Array.from(jtiBytes, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n\n  const payload: Record<string, unknown> = {\n    htm: method,\n    htu: url,\n    iat: Math.floor(Date.now() / 1000),\n    jti,\n  };\n\n  // Compute ath: base64url(SHA-256(access_token)) — only when token is present\n  if (accessToken) {\n    const tokenBytes = new TextEncoder().encode(accessToken);\n    const hashBuf = await crypto.sha256(tokenBytes);\n    payload.ath = base64urlEncode(hashBuf);\n  }\n\n  if (nonce !== undefined) {\n    payload.nonce = nonce;\n  }\n\n  const headerB64 = base64urlEncode(\n    new TextEncoder().encode(JSON.stringify(header)),\n  );\n  const payloadB64 = base64urlEncode(\n    new TextEncoder().encode(JSON.stringify(payload)),\n  );\n\n  const message = new TextEncoder().encode(`${headerB64}.${payloadB64}`);\n  const signature = await crypto.signEs256(privateKey, message);\n  const sigB64 = base64urlEncode(signature);\n\n  return `${headerB64}.${payloadB64}.${sigB64}`;\n}\n","import { generateDpopProof } from \"./dpop-proof\";\nimport type { CryptoAdapter } from \"./types\";\n\nexport interface HappyViewSessionOptions {\n  did: string;\n  dpopKey: JsonWebKey;\n  accessToken: string;\n  clientKey: string;\n  instanceUrl: string;\n  crypto: CryptoAdapter;\n  fetch?: typeof globalThis.fetch;\n}\n\nexport class HappyViewSession {\n  readonly did: string;\n\n  private readonly dpopKey: JsonWebKey;\n  private readonly accessToken: string;\n  private readonly clientKey: string;\n  private readonly instanceUrl: string;\n  private readonly crypto: CryptoAdapter;\n  private readonly _fetch: typeof globalThis.fetch;\n  private dpopNonce: string | undefined;\n\n  constructor(options: HappyViewSessionOptions) {\n    this.did = options.did;\n    this.dpopKey = options.dpopKey;\n    this.accessToken = options.accessToken;\n    this.clientKey = options.clientKey;\n    this.instanceUrl = options.instanceUrl.replace(/\\/+$/, \"\");\n    this.crypto = options.crypto;\n    this._fetch = options.fetch ?? globalThis.fetch;\n  }\n\n  async fetchHandler(url: string, init: RequestInit): Promise<Response> {\n    const fullUrl = /^https?:\\/\\//i.test(url) ? url : `${this.instanceUrl}${url}`;\n    const method = (init.method ?? \"GET\").toUpperCase();\n\n    const proof = await generateDpopProof(this.crypto, {\n      privateKey: this.dpopKey,\n      method,\n      url: fullUrl,\n      accessToken: this.accessToken,\n      nonce: this.dpopNonce,\n    });\n\n    const headers = new Headers(init.headers);\n    headers.set(\"authorization\", `DPoP ${this.accessToken}`);\n    headers.set(\"dpop\", proof);\n    headers.set(\"x-client-key\", this.clientKey);\n\n    const response = await this._fetch(fullUrl, {\n      ...init,\n      headers,\n    });\n\n    const nonce = response.headers.get(\"dpop-nonce\");\n    if (nonce) {\n      this.dpopNonce = nonce;\n    }\n\n    return response;\n  }\n}\n","import type { StorageAdapter } from \"./types\";\n\nexport class MemoryStorage implements StorageAdapter {\n  private data = new Map<string, string>();\n\n  async get(key: string): Promise<string | null> {\n    return this.data.get(key) ?? null;\n  }\n\n  async set(key: string, value: string): Promise<void> {\n    this.data.set(key, value);\n  }\n\n  async delete(key: string): Promise<void> {\n    this.data.delete(key);\n  }\n}\n","import { ApiError } from \"./errors\";\nimport { HappyViewSession } from \"./session\";\nimport { MemoryStorage } from \"./storage\";\nimport type {\n  CryptoAdapter,\n  HappyViewOAuthClientOptions,\n  ProvisionKeyResponse,\n  RegisterSessionParams,\n  RegisterSessionResponse,\n  StorageAdapter,\n  StoredSession,\n} from \"./types\";\n\nconst STORAGE_PREFIX = \"happyview:session:\";\nconst LAST_ACTIVE_KEY = \"happyview:last-active-did\";\n\nexport class HappyViewOAuthClient {\n  protected readonly instanceUrl: string;\n  protected readonly clientKey: string;\n  protected readonly crypto: CryptoAdapter;\n  protected readonly storage: StorageAdapter;\n  private readonly clientSecret: string | undefined;\n  private readonly _fetch: typeof globalThis.fetch;\n\n  constructor(\n    options: HappyViewOAuthClientOptions & {\n      fetch?: typeof globalThis.fetch;\n    },\n  ) {\n    this.instanceUrl = options.instanceUrl.replace(/\\/+$/, \"\");\n    this.clientKey = options.clientKey;\n    this.clientSecret = options.clientSecret;\n    this.crypto = options.crypto;\n    this.storage = options.storage ?? new MemoryStorage();\n    this._fetch = options.fetch ?? globalThis.fetch;\n  }\n\n  get isConfidential(): boolean {\n    return this.clientSecret !== undefined;\n  }\n\n  async provisionDpopKey(): Promise<{\n    provisionId: string;\n    dpopKey: JsonWebKey;\n    pkceVerifier?: string;\n  }> {\n    const headers: Record<string, string> = {\n      \"content-type\": \"application/json\",\n      \"x-client-key\": this.clientKey,\n    };\n    if (this.clientSecret) {\n      headers[\"x-client-secret\"] = this.clientSecret;\n    }\n\n    const body: Record<string, unknown> = {};\n    let pkceVerifier: string | undefined;\n\n    if (!this.isConfidential) {\n      pkceVerifier = await this.crypto.generatePkceVerifier();\n      const challenge = await this.crypto.computePkceChallenge(pkceVerifier);\n      body.pkce_challenge = challenge;\n    }\n\n    const resp = await this._fetch(`${this.instanceUrl}/oauth/dpop-keys`, {\n      method: \"POST\",\n      headers,\n      body: JSON.stringify(body),\n    });\n\n    if (!resp.ok) {\n      const body = await resp.json().catch(() => ({}));\n      throw new ApiError(\n        `Failed to provision DPoP key: ${resp.status} ${(body as any).message ?? resp.statusText}`,\n        resp.status,\n        body,\n      );\n    }\n\n    const data: ProvisionKeyResponse = await resp.json();\n    return {\n      provisionId: data.provision_id,\n      dpopKey: data.dpop_key,\n      pkceVerifier,\n    };\n  }\n\n  async registerSession(\n    params: RegisterSessionParams,\n  ): Promise<HappyViewSession> {\n    const headers: Record<string, string> = {\n      \"content-type\": \"application/json\",\n      \"x-client-key\": this.clientKey,\n    };\n    if (this.clientSecret) {\n      headers[\"x-client-secret\"] = this.clientSecret;\n    }\n\n    const body: Record<string, unknown> = {\n      provision_id: params.provisionId,\n      did: params.did,\n      access_token: params.accessToken,\n      refresh_token: params.refreshToken,\n      scopes: params.scopes,\n      pds_url: params.pdsUrl,\n      issuer: params.issuer,\n    };\n\n    if (!this.isConfidential && params.pkceVerifier) {\n      body.pkce_verifier = params.pkceVerifier;\n    }\n\n    const resp = await this._fetch(`${this.instanceUrl}/oauth/sessions`, {\n      method: \"POST\",\n      headers,\n      body: JSON.stringify(body),\n    });\n\n    if (!resp.ok) {\n      const body = await resp.json().catch(() => ({}));\n      throw new ApiError(\n        `Failed to register session: ${resp.status} ${(body as any).message ?? resp.statusText}`,\n        resp.status,\n        body,\n      );\n    }\n\n    const data: RegisterSessionResponse = await resp.json();\n\n    const storedSession: StoredSession = {\n      did: data.did,\n      dpopKey: params.dpopKey,\n      accessToken: params.accessToken,\n      clientKey: this.clientKey,\n      instanceUrl: this.instanceUrl,\n    };\n    await this.storage.set(\n      `${STORAGE_PREFIX}${data.did}`,\n      JSON.stringify(storedSession),\n    );\n    await this.storage.set(LAST_ACTIVE_KEY, data.did);\n\n    return new HappyViewSession({\n      did: data.did,\n      dpopKey: params.dpopKey,\n      accessToken: params.accessToken,\n      clientKey: this.clientKey,\n      instanceUrl: this.instanceUrl,\n      crypto: this.crypto,\n    });\n  }\n\n  async deleteSession(did: string): Promise<void> {\n    const headers: Record<string, string> = {\n      \"x-client-key\": this.clientKey,\n    };\n    if (this.clientSecret) {\n      headers[\"x-client-secret\"] = this.clientSecret;\n    }\n\n    const resp = await this._fetch(\n      `${this.instanceUrl}/oauth/sessions/${did}`,\n      {\n        method: \"DELETE\",\n        headers,\n      },\n    );\n\n    if (!resp.ok && resp.status !== 404) {\n      const body = await resp.json().catch(() => ({}));\n      throw new ApiError(\n        `Failed to delete session: ${resp.status} ${(body as any).message ?? resp.statusText}`,\n        resp.status,\n        body,\n      );\n    }\n\n    await this.storage.delete(`${STORAGE_PREFIX}${did}`);\n\n    const lastActive = await this.storage.get(LAST_ACTIVE_KEY);\n    if (lastActive === did) {\n      await this.storage.delete(LAST_ACTIVE_KEY);\n    }\n  }\n\n  async restoreSession(did: string): Promise<HappyViewSession | null> {\n    const stored = await this.storage.get(`${STORAGE_PREFIX}${did}`);\n    if (!stored) return null;\n\n    const data: StoredSession = JSON.parse(stored);\n    return new HappyViewSession({\n      did: data.did,\n      dpopKey: data.dpopKey,\n      accessToken: data.accessToken,\n      clientKey: data.clientKey,\n      instanceUrl: data.instanceUrl,\n      crypto: this.crypto,\n    });\n  }\n\n  async restore(): Promise<HappyViewSession | null> {\n    const did = await this.storage.get(LAST_ACTIVE_KEY);\n    if (!did) return null;\n    return this.restoreSession(did);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAO,IAAM,iBAAN,cAA6B,MAAM;AAAA,EACxC,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,WAAN,cAAuB,eAAe;AAAA,EAClC;AAAA,EACA;AAAA,EAET,YAAY,SAAiB,QAAgB,MAAgB;AAC3D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,sBAAN,cAAkC,eAAe;AAAA,EAC7C;AAAA,EAET,YAAY,SAAiB,SAAiB,KAAK;AACjD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AACF;AAEO,IAAM,oBAAN,cAAgC,eAAe;AAAA,EACpD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,qBAAN,cAAiC,eAAe;AAAA,EAC5C;AAAA,EACA;AAAA,EAET,YAAY,SAAiB,QAAgB,MAAc;AACzD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,kBAAN,cAA8B,eAAe;AAAA,EAClD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;;;ACnDO,SAAS,gBAAgB,MAA0B;AACxD,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,cAAU,OAAO,aAAa,KAAK,CAAC,CAAC;AAAA,EACvC;AACA,SAAO,KAAK,MAAM,EACf,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AACtB;AAUA,eAAsB,kBACpB,QACA,QACiB;AACjB,QAAM,EAAE,YAAY,QAAQ,KAAK,aAAa,MAAM,IAAI;AAExD,QAAM,YAAY;AAAA,IAChB,KAAK,WAAW;AAAA,IAChB,KAAK,WAAW;AAAA,IAChB,GAAG,WAAW;AAAA,IACd,GAAG,WAAW;AAAA,EAChB;AAEA,QAAM,SAAS;AAAA,IACb,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,EACP;AAGA,QAAM,WAAW,OAAO,gBAAgB,EAAE;AAC1C,QAAM,MAAM,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAEhF,QAAM,UAAmC;AAAA,IACvC,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAAA,IACjC;AAAA,EACF;AAGA,MAAI,aAAa;AACf,UAAM,aAAa,IAAI,YAAY,EAAE,OAAO,WAAW;AACvD,UAAM,UAAU,MAAM,OAAO,OAAO,UAAU;AAC9C,YAAQ,MAAM,gBAAgB,OAAO;AAAA,EACvC;AAEA,MAAI,UAAU,QAAW;AACvB,YAAQ,QAAQ;AAAA,EAClB;AAEA,QAAM,YAAY;AAAA,IAChB,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,MAAM,CAAC;AAAA,EACjD;AACA,QAAM,aAAa;AAAA,IACjB,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,OAAO,CAAC;AAAA,EAClD;AAEA,QAAM,UAAU,IAAI,YAAY,EAAE,OAAO,GAAG,SAAS,IAAI,UAAU,EAAE;AACrE,QAAM,YAAY,MAAM,OAAO,UAAU,YAAY,OAAO;AAC5D,QAAM,SAAS,gBAAgB,SAAS;AAExC,SAAO,GAAG,SAAS,IAAI,UAAU,IAAI,MAAM;AAC7C;;;AC7DO,IAAM,mBAAN,MAAuB;AAAA,EACnB;AAAA,EAEQ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACT;AAAA,EAER,YAAY,SAAkC;AAC5C,SAAK,MAAM,QAAQ;AACnB,SAAK,UAAU,QAAQ;AACvB,SAAK,cAAc,QAAQ;AAC3B,SAAK,YAAY,QAAQ;AACzB,SAAK,cAAc,QAAQ,YAAY,QAAQ,QAAQ,EAAE;AACzD,SAAK,SAAS,QAAQ;AACtB,SAAK,SAAS,QAAQ,SAAS,WAAW;AAAA,EAC5C;AAAA,EAEA,MAAM,aAAa,KAAa,MAAsC;AACpE,UAAM,UAAU,gBAAgB,KAAK,GAAG,IAAI,MAAM,GAAG,KAAK,WAAW,GAAG,GAAG;AAC3E,UAAM,UAAU,KAAK,UAAU,OAAO,YAAY;AAElD,UAAM,QAAQ,MAAM,kBAAkB,KAAK,QAAQ;AAAA,MACjD,YAAY,KAAK;AAAA,MACjB;AAAA,MACA,KAAK;AAAA,MACL,aAAa,KAAK;AAAA,MAClB,OAAO,KAAK;AAAA,IACd,CAAC;AAED,UAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;AACxC,YAAQ,IAAI,iBAAiB,QAAQ,KAAK,WAAW,EAAE;AACvD,YAAQ,IAAI,QAAQ,KAAK;AACzB,YAAQ,IAAI,gBAAgB,KAAK,SAAS;AAE1C,UAAM,WAAW,MAAM,KAAK,OAAO,SAAS;AAAA,MAC1C,GAAG;AAAA,MACH;AAAA,IACF,CAAC;AAED,UAAM,QAAQ,SAAS,QAAQ,IAAI,YAAY;AAC/C,QAAI,OAAO;AACT,WAAK,YAAY;AAAA,IACnB;AAEA,WAAO;AAAA,EACT;AACF;;;AC7DO,IAAM,gBAAN,MAA8C;AAAA,EAC3C,OAAO,oBAAI,IAAoB;AAAA,EAEvC,MAAM,IAAI,KAAqC;AAC7C,WAAO,KAAK,KAAK,IAAI,GAAG,KAAK;AAAA,EAC/B;AAAA,EAEA,MAAM,IAAI,KAAa,OAA8B;AACnD,SAAK,KAAK,IAAI,KAAK,KAAK;AAAA,EAC1B;AAAA,EAEA,MAAM,OAAO,KAA4B;AACvC,SAAK,KAAK,OAAO,GAAG;AAAA,EACtB;AACF;;;ACHA,IAAM,iBAAiB;AACvB,IAAM,kBAAkB;AAEjB,IAAM,uBAAN,MAA2B;AAAA,EACb;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACF;AAAA,EACA;AAAA,EAEjB,YACE,SAGA;AACA,SAAK,cAAc,QAAQ,YAAY,QAAQ,QAAQ,EAAE;AACzD,SAAK,YAAY,QAAQ;AACzB,SAAK,eAAe,QAAQ;AAC5B,SAAK,SAAS,QAAQ;AACtB,SAAK,UAAU,QAAQ,WAAW,IAAI,cAAc;AACpD,SAAK,SAAS,QAAQ,SAAS,WAAW;AAAA,EAC5C;AAAA,EAEA,IAAI,iBAA0B;AAC5B,WAAO,KAAK,iBAAiB;AAAA,EAC/B;AAAA,EAEA,MAAM,mBAIH;AACD,UAAM,UAAkC;AAAA,MACtC,gBAAgB;AAAA,MAChB,gBAAgB,KAAK;AAAA,IACvB;AACA,QAAI,KAAK,cAAc;AACrB,cAAQ,iBAAiB,IAAI,KAAK;AAAA,IACpC;AAEA,UAAM,OAAgC,CAAC;AACvC,QAAI;AAEJ,QAAI,CAAC,KAAK,gBAAgB;AACxB,qBAAe,MAAM,KAAK,OAAO,qBAAqB;AACtD,YAAM,YAAY,MAAM,KAAK,OAAO,qBAAqB,YAAY;AACrE,WAAK,iBAAiB;AAAA,IACxB;AAEA,UAAM,OAAO,MAAM,KAAK,OAAO,GAAG,KAAK,WAAW,oBAAoB;AAAA,MACpE,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAED,QAAI,CAAC,KAAK,IAAI;AACZ,YAAMA,QAAO,MAAM,KAAK,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,YAAM,IAAI;AAAA,QACR,iCAAiC,KAAK,MAAM,IAAKA,MAAa,WAAW,KAAK,UAAU;AAAA,QACxF,KAAK;AAAA,QACLA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,OAA6B,MAAM,KAAK,KAAK;AACnD,WAAO;AAAA,MACL,aAAa,KAAK;AAAA,MAClB,SAAS,KAAK;AAAA,MACd;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,gBACJ,QAC2B;AAC3B,UAAM,UAAkC;AAAA,MACtC,gBAAgB;AAAA,MAChB,gBAAgB,KAAK;AAAA,IACvB;AACA,QAAI,KAAK,cAAc;AACrB,cAAQ,iBAAiB,IAAI,KAAK;AAAA,IACpC;AAEA,UAAM,OAAgC;AAAA,MACpC,cAAc,OAAO;AAAA,MACrB,KAAK,OAAO;AAAA,MACZ,cAAc,OAAO;AAAA,MACrB,eAAe,OAAO;AAAA,MACtB,QAAQ,OAAO;AAAA,MACf,SAAS,OAAO;AAAA,MAChB,QAAQ,OAAO;AAAA,IACjB;AAEA,QAAI,CAAC,KAAK,kBAAkB,OAAO,cAAc;AAC/C,WAAK,gBAAgB,OAAO;AAAA,IAC9B;AAEA,UAAM,OAAO,MAAM,KAAK,OAAO,GAAG,KAAK,WAAW,mBAAmB;AAAA,MACnE,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAED,QAAI,CAAC,KAAK,IAAI;AACZ,YAAMA,QAAO,MAAM,KAAK,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,YAAM,IAAI;AAAA,QACR,+BAA+B,KAAK,MAAM,IAAKA,MAAa,WAAW,KAAK,UAAU;AAAA,QACtF,KAAK;AAAA,QACLA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,OAAgC,MAAM,KAAK,KAAK;AAEtD,UAAM,gBAA+B;AAAA,MACnC,KAAK,KAAK;AAAA,MACV,SAAS,OAAO;AAAA,MAChB,aAAa,OAAO;AAAA,MACpB,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,IACpB;AACA,UAAM,KAAK,QAAQ;AAAA,MACjB,GAAG,cAAc,GAAG,KAAK,GAAG;AAAA,MAC5B,KAAK,UAAU,aAAa;AAAA,IAC9B;AACA,UAAM,KAAK,QAAQ,IAAI,iBAAiB,KAAK,GAAG;AAEhD,WAAO,IAAI,iBAAiB;AAAA,MAC1B,KAAK,KAAK;AAAA,MACV,SAAS,OAAO;AAAA,MAChB,aAAa,OAAO;AAAA,MACpB,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,MAClB,QAAQ,KAAK;AAAA,IACf,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,cAAc,KAA4B;AAC9C,UAAM,UAAkC;AAAA,MACtC,gBAAgB,KAAK;AAAA,IACvB;AACA,QAAI,KAAK,cAAc;AACrB,cAAQ,iBAAiB,IAAI,KAAK;AAAA,IACpC;AAEA,UAAM,OAAO,MAAM,KAAK;AAAA,MACtB,GAAG,KAAK,WAAW,mBAAmB,GAAG;AAAA,MACzC;AAAA,QACE,QAAQ;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,KAAK,MAAM,KAAK,WAAW,KAAK;AACnC,YAAM,OAAO,MAAM,KAAK,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,YAAM,IAAI;AAAA,QACR,6BAA6B,KAAK,MAAM,IAAK,KAAa,WAAW,KAAK,UAAU;AAAA,QACpF,KAAK;AAAA,QACL;AAAA,MACF;AAAA,IACF;AAEA,UAAM,KAAK,QAAQ,OAAO,GAAG,cAAc,GAAG,GAAG,EAAE;AAEnD,UAAM,aAAa,MAAM,KAAK,QAAQ,IAAI,eAAe;AACzD,QAAI,eAAe,KAAK;AACtB,YAAM,KAAK,QAAQ,OAAO,eAAe;AAAA,IAC3C;AAAA,EACF;AAAA,EAEA,MAAM,eAAe,KAA+C;AAClE,UAAM,SAAS,MAAM,KAAK,QAAQ,IAAI,GAAG,cAAc,GAAG,GAAG,EAAE;AAC/D,QAAI,CAAC,OAAQ,QAAO;AAEpB,UAAM,OAAsB,KAAK,MAAM,MAAM;AAC7C,WAAO,IAAI,iBAAiB;AAAA,MAC1B,KAAK,KAAK;AAAA,MACV,SAAS,KAAK;AAAA,MACd,aAAa,KAAK;AAAA,MAClB,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,MAClB,QAAQ,KAAK;AAAA,IACf,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,UAA4C;AAChD,UAAM,MAAM,MAAM,KAAK,QAAQ,IAAI,eAAe;AAClD,QAAI,CAAC,IAAK,QAAO;AACjB,WAAO,KAAK,eAAe,GAAG;AAAA,EAChC;AACF;","names":["body"]}
+{"version":3,"sources":["../src/index.ts","../src/errors.ts","../src/import-jwk.ts","../src/session.ts","../src/storage.ts","../src/client.ts"],"sourcesContent":["export { HappyViewOAuthClient } from \"./client\";\nexport { importJwk } from \"./import-jwk\";\nexport {\n  ApiError,\n  AuthenticationError,\n  HappyViewError,\n  InvalidStateError,\n  ResolutionError,\n  TokenExchangeError,\n} from \"./errors\";\nexport { HappyViewSession } from \"./session\";\nexport type { HappyViewSessionOptions } from \"./session\";\nexport { MemoryStorage } from \"./storage\";\nexport type {\n  DpopProvision,\n  HappyViewOAuthClientOptions,\n  ProvisionKeyResponse,\n  RegisterSessionParams,\n  RegisterSessionResponse,\n  StorageAdapter,\n  StoredSession,\n} from \"./types\";\n","export class HappyViewError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"HappyViewError\";\n  }\n}\n\nexport class ApiError extends HappyViewError {\n  readonly status: number;\n  readonly body: unknown;\n\n  constructor(message: string, status: number, body?: unknown) {\n    super(message);\n    this.name = \"ApiError\";\n    this.status = status;\n    this.body = body;\n  }\n}\n\nexport class AuthenticationError extends HappyViewError {\n  readonly status: number;\n\n  constructor(message: string, status: number = 401) {\n    super(message);\n    this.name = \"AuthenticationError\";\n    this.status = status;\n  }\n}\n\nexport class InvalidStateError extends HappyViewError {\n  constructor(message: string) {\n    super(message);\n    this.name = \"InvalidStateError\";\n  }\n}\n\nexport class TokenExchangeError extends HappyViewError {\n  readonly status: number;\n  readonly body: string;\n\n  constructor(message: string, status: number, body: string) {\n    super(message);\n    this.name = \"TokenExchangeError\";\n    this.status = status;\n    this.body = body;\n  }\n}\n\nexport class ResolutionError extends HappyViewError {\n  constructor(message: string) {\n    super(message);\n    this.name = \"ResolutionError\";\n  }\n}\n","import { WebcryptoKey } from \"@atproto/jwk-webcrypto\";\n\n/**\n * Import a raw ES256 JWK (as returned by HappyView's /oauth/dpop-keys)\n * into a WebcryptoKey that can sign JWTs.\n */\nexport async function importJwk(jwk: JsonWebKey): Promise<WebcryptoKey> {\n  const privateKey = await crypto.subtle.importKey(\n    \"jwk\",\n    jwk,\n    { name: \"ECDSA\", namedCurve: \"P-256\" },\n    true,\n    [\"sign\"],\n  );\n\n  // Derive public key by stripping the private component\n  const { d: _, ...publicJwkFields } = jwk;\n  const publicKey = await crypto.subtle.importKey(\n    \"jwk\",\n    publicJwkFields,\n    { name: \"ECDSA\", namedCurve: \"P-256\" },\n    true,\n    [\"verify\"],\n  );\n\n  return WebcryptoKey.fromKeypair({ privateKey, publicKey });\n}\n","import type { Key } from \"@atproto/jwk\";\n\nexport interface HappyViewSessionOptions {\n  did: string;\n  dpopKey: Key;\n  accessToken: string;\n  clientKey: string;\n  instanceUrl: string;\n  fetch?: typeof globalThis.fetch;\n}\n\nfunction randomHex(byteLength: number): string {\n  const bytes = crypto.getRandomValues(new Uint8Array(byteLength));\n  return Array.from(bytes, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction base64url(buffer: ArrayBuffer): string {\n  const bytes = new Uint8Array(buffer);\n  let binary = \"\";\n  for (let i = 0; i < bytes.length; i++) {\n    binary += String.fromCharCode(bytes[i]);\n  }\n  return btoa(binary)\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/, \"\");\n}\n\nexport class HappyViewSession {\n  readonly did: string;\n\n  private readonly dpopKey: Key;\n  private readonly accessToken: string;\n  private readonly clientKey: string;\n  private readonly instanceUrl: string;\n  private readonly _fetch: typeof globalThis.fetch;\n  private dpopNonce: string | undefined;\n\n  constructor(options: HappyViewSessionOptions) {\n    this.did = options.did;\n    this.dpopKey = options.dpopKey;\n    this.accessToken = options.accessToken;\n    this.clientKey = options.clientKey;\n    this.instanceUrl = options.instanceUrl.replace(/\\/+$/, \"\");\n    this._fetch = options.fetch ?? ((input: RequestInfo | URL, init?: RequestInit) => fetch(input, init)) as typeof globalThis.fetch;\n  }\n\n  async fetchHandler(url: string, init: RequestInit): Promise<Response> {\n    const fullUrl = /^https?:\\/\\//i.test(url)\n      ? url\n      : `${this.instanceUrl}${url}`;\n    const method = (init.method ?? \"GET\").toUpperCase();\n    const htu = fullUrl.split(\"?\")[0];\n\n    const sendWithProof = async (): Promise<Response> => {\n      const tokenHash = await crypto.subtle.digest(\n        \"SHA-256\",\n        new TextEncoder().encode(this.accessToken),\n      );\n      const ath = base64url(tokenHash);\n\n      const proof = await this.dpopKey.createJwt(\n        {\n          alg: \"ES256\",\n          typ: \"dpop+jwt\",\n          jwk: this.dpopKey.publicJwk!,\n        },\n        {\n          htm: method,\n          htu,\n          iat: Math.floor(Date.now() / 1000),\n          jti: randomHex(16),\n          ath,\n          nonce: this.dpopNonce,\n        },\n      );\n\n      const headers = new Headers(init.headers);\n      headers.set(\"authorization\", `DPoP ${this.accessToken}`);\n      headers.set(\"dpop\", proof);\n      headers.set(\"x-client-key\", this.clientKey);\n\n      return this._fetch(fullUrl, { ...init, headers });\n    };\n\n    let response: Response;\n    try {\n      response = await sendWithProof();\n    } catch (e) {\n      const info = `_fetch type: ${typeof this._fetch}, toString: ${String(this._fetch).slice(0, 120)}, url: ${fullUrl}`;\n      throw new Error(`fetchHandler failed: ${(e as Error).message}\\n\\nDEBUG: ${info}`);\n    }\n\n    // Retry once if the server requires a DPoP nonce we didn't have\n    const nonce = response.headers.get(\"dpop-nonce\");\n    if (nonce && nonce !== this.dpopNonce && (response.status === 401 || response.status === 400)) {\n      this.dpopNonce = nonce;\n      try {\n        response = await sendWithProof();\n      } catch (e) {\n        throw new Error(`fetchHandler retry failed: ${(e as Error).message}`);\n      }\n      const retryNonce = response.headers.get(\"dpop-nonce\");\n      if (retryNonce) {\n        this.dpopNonce = retryNonce;\n      }\n    } else if (nonce) {\n      this.dpopNonce = nonce;\n    }\n\n    return response;\n  }\n}\n","import type { StorageAdapter } from \"./types\";\n\nexport class MemoryStorage implements StorageAdapter {\n  private data = new Map<string, string>();\n\n  async get(key: string): Promise<string | null> {\n    return this.data.get(key) ?? null;\n  }\n\n  async set(key: string, value: string): Promise<void> {\n    this.data.set(key, value);\n  }\n\n  async delete(key: string): Promise<void> {\n    this.data.delete(key);\n  }\n}\n","import type { Key } from \"@atproto/jwk\";\nimport { ApiError } from \"./errors\";\nimport { importJwk } from \"./import-jwk\";\nimport { HappyViewSession } from \"./session\";\nimport { MemoryStorage } from \"./storage\";\nimport type {\n  HappyViewOAuthClientOptions,\n  ProvisionKeyResponse,\n  RegisterSessionParams,\n  RegisterSessionResponse,\n  StorageAdapter,\n  StoredSession,\n} from \"./types\";\n\nconst STORAGE_PREFIX = \"happyview:session:\";\nconst LAST_ACTIVE_KEY = \"happyview:last-active-did\";\n\nexport class HappyViewOAuthClient {\n  protected readonly instanceUrl: string;\n  protected readonly clientKey: string;\n  protected readonly storage: StorageAdapter;\n  private readonly clientSecret: string | undefined;\n  protected readonly _fetch: typeof globalThis.fetch;\n\n  constructor(\n    options: HappyViewOAuthClientOptions & {\n      fetch?: typeof globalThis.fetch;\n    },\n  ) {\n    this.instanceUrl = options.instanceUrl.replace(/\\/+$/, \"\");\n    this.clientKey = options.clientKey;\n    this.clientSecret = options.clientSecret;\n    this.storage = options.storage ?? new MemoryStorage();\n    this._fetch = options.fetch ?? ((input: RequestInfo | URL, init?: RequestInit) => fetch(input, init)) as typeof globalThis.fetch;\n  }\n\n  get isConfidential(): boolean {\n    return this.clientSecret !== undefined;\n  }\n\n  async provisionDpopKey(): Promise<{\n    provisionId: string;\n    dpopKey: Key;\n    rawJwk: JsonWebKey;\n    pkceVerifier?: string;\n  }> {\n    const headers: Record<string, string> = {\n      \"content-type\": \"application/json\",\n      \"x-client-key\": this.clientKey,\n    };\n    if (this.clientSecret) {\n      headers[\"x-client-secret\"] = this.clientSecret;\n    }\n\n    const body: Record<string, unknown> = {};\n    let pkceVerifier: string | undefined;\n\n    if (!this.isConfidential) {\n      pkceVerifier = generatePkceVerifier();\n      const challenge = await computePkceChallenge(pkceVerifier);\n      body.pkce_challenge = challenge;\n    }\n\n    const resp = await this._fetch(`${this.instanceUrl}/oauth/dpop-keys`, {\n      method: \"POST\",\n      headers,\n      body: JSON.stringify(body),\n    });\n\n    if (!resp.ok) {\n      const body = await resp.json().catch(() => ({}));\n      throw new ApiError(\n        `Failed to provision DPoP key: ${resp.status} ${(body as any).message ?? resp.statusText}`,\n        resp.status,\n        body,\n      );\n    }\n\n    const data: ProvisionKeyResponse = await resp.json();\n    const dpopKey = await importJwk(data.dpop_key);\n    return {\n      provisionId: data.provision_id,\n      dpopKey,\n      rawJwk: data.dpop_key,\n      pkceVerifier,\n    };\n  }\n\n  async registerSession(\n    params: RegisterSessionParams,\n  ): Promise<HappyViewSession> {\n    const headers: Record<string, string> = {\n      \"content-type\": \"application/json\",\n      \"x-client-key\": this.clientKey,\n    };\n    if (this.clientSecret) {\n      headers[\"x-client-secret\"] = this.clientSecret;\n    }\n\n    const body: Record<string, unknown> = {\n      provision_id: params.provisionId,\n      did: params.did,\n      access_token: params.accessToken,\n      refresh_token: params.refreshToken,\n      scopes: params.scopes,\n      pds_url: params.pdsUrl,\n      issuer: params.issuer,\n    };\n\n    if (!this.isConfidential && params.pkceVerifier) {\n      body.pkce_verifier = params.pkceVerifier;\n    }\n\n    const resp = await this._fetch(`${this.instanceUrl}/oauth/sessions`, {\n      method: \"POST\",\n      headers,\n      body: JSON.stringify(body),\n    });\n\n    if (!resp.ok) {\n      const body = await resp.json().catch(() => ({}));\n      throw new ApiError(\n        `Failed to register session: ${resp.status} ${(body as any).message ?? resp.statusText}`,\n        resp.status,\n        body,\n      );\n    }\n\n    const data: RegisterSessionResponse = await resp.json();\n    const dpopKey = await importJwk(params.dpopKey);\n\n    const storedSession: StoredSession = {\n      did: data.did,\n      dpopKey: params.dpopKey,\n      accessToken: params.accessToken,\n      clientKey: this.clientKey,\n      instanceUrl: this.instanceUrl,\n    };\n    await this.storage.set(\n      `${STORAGE_PREFIX}${data.did}`,\n      JSON.stringify(storedSession),\n    );\n    await this.storage.set(LAST_ACTIVE_KEY, data.did);\n\n    return new HappyViewSession({\n      did: data.did,\n      dpopKey,\n      accessToken: params.accessToken,\n      clientKey: this.clientKey,\n      instanceUrl: this.instanceUrl,\n      fetch: this._fetch,\n    });\n  }\n\n  async deleteSession(did: string): Promise<void> {\n    const session = await this.restoreSession(did);\n    if (session) {\n      const resp = await session.fetchHandler(\n        `${this.instanceUrl}/oauth/sessions/${did}`,\n        { method: \"DELETE\" },\n      );\n\n      if (!resp.ok && resp.status !== 404) {\n        const body = await resp.json().catch(() => ({}));\n        throw new ApiError(\n          `Failed to delete session: ${resp.status} ${(body as any).message ?? resp.statusText}`,\n          resp.status,\n          body,\n        );\n      }\n    }\n\n    await this.storage.delete(`${STORAGE_PREFIX}${did}`);\n\n    const lastActive = await this.storage.get(LAST_ACTIVE_KEY);\n    if (lastActive === did) {\n      await this.storage.delete(LAST_ACTIVE_KEY);\n    }\n  }\n\n  async restoreSession(did: string): Promise<HappyViewSession | null> {\n    const stored = await this.storage.get(`${STORAGE_PREFIX}${did}`);\n    if (!stored) return null;\n\n    const data: StoredSession = JSON.parse(stored);\n    const dpopKey = await importJwk(data.dpopKey);\n    return new HappyViewSession({\n      did: data.did,\n      dpopKey,\n      accessToken: data.accessToken,\n      clientKey: data.clientKey,\n      instanceUrl: data.instanceUrl,\n      fetch: this._fetch,\n    });\n  }\n\n  async restore(): Promise<HappyViewSession | null> {\n    const did = await this.storage.get(LAST_ACTIVE_KEY);\n    if (!did) return null;\n    return this.restoreSession(did);\n  }\n}\n\n// PKCE helpers — inline since they're just a few lines of Web Crypto\nfunction generatePkceVerifier(): string {\n  const bytes = crypto.getRandomValues(new Uint8Array(32));\n  let binary = \"\";\n  for (let i = 0; i < bytes.length; i++) {\n    binary += String.fromCharCode(bytes[i]);\n  }\n  return btoa(binary)\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/, \"\");\n}\n\nasync function computePkceChallenge(verifier: string): Promise<string> {\n  const hash = await crypto.subtle.digest(\n    \"SHA-256\",\n    new TextEncoder().encode(verifier),\n  );\n  const bytes = new Uint8Array(hash);\n  let binary = \"\";\n  for (let i = 0; i < bytes.length; i++) {\n    binary += String.fromCharCode(bytes[i]);\n  }\n  return btoa(binary)\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/, \"\");\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAO,IAAM,iBAAN,cAA6B,MAAM;AAAA,EACxC,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,WAAN,cAAuB,eAAe;AAAA,EAClC;AAAA,EACA;AAAA,EAET,YAAY,SAAiB,QAAgB,MAAgB;AAC3D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,sBAAN,cAAkC,eAAe;AAAA,EAC7C;AAAA,EAET,YAAY,SAAiB,SAAiB,KAAK;AACjD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AACF;AAEO,IAAM,oBAAN,cAAgC,eAAe;AAAA,EACpD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,qBAAN,cAAiC,eAAe;AAAA,EAC5C;AAAA,EACA;AAAA,EAET,YAAY,SAAiB,QAAgB,MAAc;AACzD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,kBAAN,cAA8B,eAAe;AAAA,EAClD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;;;ACrDA,2BAA6B;AAM7B,eAAsB,UAAU,KAAwC;AACtE,QAAM,aAAa,MAAM,OAAO,OAAO;AAAA,IACrC;AAAA,IACA;AAAA,IACA,EAAE,MAAM,SAAS,YAAY,QAAQ;AAAA,IACrC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AAGA,QAAM,EAAE,GAAG,GAAG,GAAG,gBAAgB,IAAI;AACrC,QAAM,YAAY,MAAM,OAAO,OAAO;AAAA,IACpC;AAAA,IACA;AAAA,IACA,EAAE,MAAM,SAAS,YAAY,QAAQ;AAAA,IACrC;AAAA,IACA,CAAC,QAAQ;AAAA,EACX;AAEA,SAAO,kCAAa,YAAY,EAAE,YAAY,UAAU,CAAC;AAC3D;;;ACfA,SAAS,UAAU,YAA4B;AAC7C,QAAM,QAAQ,OAAO,gBAAgB,IAAI,WAAW,UAAU,CAAC;AAC/D,SAAO,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAC1E;AAEA,SAAS,UAAU,QAA6B;AAC9C,QAAM,QAAQ,IAAI,WAAW,MAAM;AACnC,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EACxC;AACA,SAAO,KAAK,MAAM,EACf,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AACtB;AAEO,IAAM,mBAAN,MAAuB;AAAA,EACnB;AAAA,EAEQ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACT;AAAA,EAER,YAAY,SAAkC;AAC5C,SAAK,MAAM,QAAQ;AACnB,SAAK,UAAU,QAAQ;AACvB,SAAK,cAAc,QAAQ;AAC3B,SAAK,YAAY,QAAQ;AACzB,SAAK,cAAc,QAAQ,YAAY,QAAQ,QAAQ,EAAE;AACzD,SAAK,SAAS,QAAQ,UAAU,CAAC,OAA0B,SAAuB,MAAM,OAAO,IAAI;AAAA,EACrG;AAAA,EAEA,MAAM,aAAa,KAAa,MAAsC;AACpE,UAAM,UAAU,gBAAgB,KAAK,GAAG,IACpC,MACA,GAAG,KAAK,WAAW,GAAG,GAAG;AAC7B,UAAM,UAAU,KAAK,UAAU,OAAO,YAAY;AAClD,UAAM,MAAM,QAAQ,MAAM,GAAG,EAAE,CAAC;AAEhC,UAAM,gBAAgB,YAA+B;AACnD,YAAM,YAAY,MAAM,OAAO,OAAO;AAAA,QACpC;AAAA,QACA,IAAI,YAAY,EAAE,OAAO,KAAK,WAAW;AAAA,MAC3C;AACA,YAAM,MAAM,UAAU,SAAS;AAE/B,YAAM,QAAQ,MAAM,KAAK,QAAQ;AAAA,QAC/B;AAAA,UACE,KAAK;AAAA,UACL,KAAK;AAAA,UACL,KAAK,KAAK,QAAQ;AAAA,QACpB;AAAA,QACA;AAAA,UACE,KAAK;AAAA,UACL;AAAA,UACA,KAAK,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAAA,UACjC,KAAK,UAAU,EAAE;AAAA,UACjB;AAAA,UACA,OAAO,KAAK;AAAA,QACd;AAAA,MACF;AAEA,YAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;AACxC,cAAQ,IAAI,iBAAiB,QAAQ,KAAK,WAAW,EAAE;AACvD,cAAQ,IAAI,QAAQ,KAAK;AACzB,cAAQ,IAAI,gBAAgB,KAAK,SAAS;AAE1C,aAAO,KAAK,OAAO,SAAS,EAAE,GAAG,MAAM,QAAQ,CAAC;AAAA,IAClD;AAEA,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,cAAc;AAAA,IACjC,SAAS,GAAG;AACV,YAAM,OAAO,gBAAgB,OAAO,KAAK,MAAM,eAAe,OAAO,KAAK,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC,UAAU,OAAO;AAChH,YAAM,IAAI,MAAM,wBAAyB,EAAY,OAAO;AAAA;AAAA,SAAc,IAAI,EAAE;AAAA,IAClF;AAGA,UAAM,QAAQ,SAAS,QAAQ,IAAI,YAAY;AAC/C,QAAI,SAAS,UAAU,KAAK,cAAc,SAAS,WAAW,OAAO,SAAS,WAAW,MAAM;AAC7F,WAAK,YAAY;AACjB,UAAI;AACF,mBAAW,MAAM,cAAc;AAAA,MACjC,SAAS,GAAG;AACV,cAAM,IAAI,MAAM,8BAA+B,EAAY,OAAO,EAAE;AAAA,MACtE;AACA,YAAM,aAAa,SAAS,QAAQ,IAAI,YAAY;AACpD,UAAI,YAAY;AACd,aAAK,YAAY;AAAA,MACnB;AAAA,IACF,WAAW,OAAO;AAChB,WAAK,YAAY;AAAA,IACnB;AAEA,WAAO;AAAA,EACT;AACF;;;AC9GO,IAAM,gBAAN,MAA8C;AAAA,EAC3C,OAAO,oBAAI,IAAoB;AAAA,EAEvC,MAAM,IAAI,KAAqC;AAC7C,WAAO,KAAK,KAAK,IAAI,GAAG,KAAK;AAAA,EAC/B;AAAA,EAEA,MAAM,IAAI,KAAa,OAA8B;AACnD,SAAK,KAAK,IAAI,KAAK,KAAK;AAAA,EAC1B;AAAA,EAEA,MAAM,OAAO,KAA4B;AACvC,SAAK,KAAK,OAAO,GAAG;AAAA,EACtB;AACF;;;ACFA,IAAM,iBAAiB;AACvB,IAAM,kBAAkB;AAEjB,IAAM,uBAAN,MAA2B;AAAA,EACb;AAAA,EACA;AAAA,EACA;AAAA,EACF;AAAA,EACE;AAAA,EAEnB,YACE,SAGA;AACA,SAAK,cAAc,QAAQ,YAAY,QAAQ,QAAQ,EAAE;AACzD,SAAK,YAAY,QAAQ;AACzB,SAAK,eAAe,QAAQ;AAC5B,SAAK,UAAU,QAAQ,WAAW,IAAI,cAAc;AACpD,SAAK,SAAS,QAAQ,UAAU,CAAC,OAA0B,SAAuB,MAAM,OAAO,IAAI;AAAA,EACrG;AAAA,EAEA,IAAI,iBAA0B;AAC5B,WAAO,KAAK,iBAAiB;AAAA,EAC/B;AAAA,EAEA,MAAM,mBAKH;AACD,UAAM,UAAkC;AAAA,MACtC,gBAAgB;AAAA,MAChB,gBAAgB,KAAK;AAAA,IACvB;AACA,QAAI,KAAK,cAAc;AACrB,cAAQ,iBAAiB,IAAI,KAAK;AAAA,IACpC;AAEA,UAAM,OAAgC,CAAC;AACvC,QAAI;AAEJ,QAAI,CAAC,KAAK,gBAAgB;AACxB,qBAAe,qBAAqB;AACpC,YAAM,YAAY,MAAM,qBAAqB,YAAY;AACzD,WAAK,iBAAiB;AAAA,IACxB;AAEA,UAAM,OAAO,MAAM,KAAK,OAAO,GAAG,KAAK,WAAW,oBAAoB;AAAA,MACpE,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAED,QAAI,CAAC,KAAK,IAAI;AACZ,YAAMA,QAAO,MAAM,KAAK,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,YAAM,IAAI;AAAA,QACR,iCAAiC,KAAK,MAAM,IAAKA,MAAa,WAAW,KAAK,UAAU;AAAA,QACxF,KAAK;AAAA,QACLA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,OAA6B,MAAM,KAAK,KAAK;AACnD,UAAM,UAAU,MAAM,UAAU,KAAK,QAAQ;AAC7C,WAAO;AAAA,MACL,aAAa,KAAK;AAAA,MAClB;AAAA,MACA,QAAQ,KAAK;AAAA,MACb;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,gBACJ,QAC2B;AAC3B,UAAM,UAAkC;AAAA,MACtC,gBAAgB;AAAA,MAChB,gBAAgB,KAAK;AAAA,IACvB;AACA,QAAI,KAAK,cAAc;AACrB,cAAQ,iBAAiB,IAAI,KAAK;AAAA,IACpC;AAEA,UAAM,OAAgC;AAAA,MACpC,cAAc,OAAO;AAAA,MACrB,KAAK,OAAO;AAAA,MACZ,cAAc,OAAO;AAAA,MACrB,eAAe,OAAO;AAAA,MACtB,QAAQ,OAAO;AAAA,MACf,SAAS,OAAO;AAAA,MAChB,QAAQ,OAAO;AAAA,IACjB;AAEA,QAAI,CAAC,KAAK,kBAAkB,OAAO,cAAc;AAC/C,WAAK,gBAAgB,OAAO;AAAA,IAC9B;AAEA,UAAM,OAAO,MAAM,KAAK,OAAO,GAAG,KAAK,WAAW,mBAAmB;AAAA,MACnE,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAED,QAAI,CAAC,KAAK,IAAI;AACZ,YAAMA,QAAO,MAAM,KAAK,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,YAAM,IAAI;AAAA,QACR,+BAA+B,KAAK,MAAM,IAAKA,MAAa,WAAW,KAAK,UAAU;AAAA,QACtF,KAAK;AAAA,QACLA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,OAAgC,MAAM,KAAK,KAAK;AACtD,UAAM,UAAU,MAAM,UAAU,OAAO,OAAO;AAE9C,UAAM,gBAA+B;AAAA,MACnC,KAAK,KAAK;AAAA,MACV,SAAS,OAAO;AAAA,MAChB,aAAa,OAAO;AAAA,MACpB,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,IACpB;AACA,UAAM,KAAK,QAAQ;AAAA,MACjB,GAAG,cAAc,GAAG,KAAK,GAAG;AAAA,MAC5B,KAAK,UAAU,aAAa;AAAA,IAC9B;AACA,UAAM,KAAK,QAAQ,IAAI,iBAAiB,KAAK,GAAG;AAEhD,WAAO,IAAI,iBAAiB;AAAA,MAC1B,KAAK,KAAK;AAAA,MACV;AAAA,MACA,aAAa,OAAO;AAAA,MACpB,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,MAClB,OAAO,KAAK;AAAA,IACd,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,cAAc,KAA4B;AAC9C,UAAM,UAAU,MAAM,KAAK,eAAe,GAAG;AAC7C,QAAI,SAAS;AACX,YAAM,OAAO,MAAM,QAAQ;AAAA,QACzB,GAAG,KAAK,WAAW,mBAAmB,GAAG;AAAA,QACzC,EAAE,QAAQ,SAAS;AAAA,MACrB;AAEA,UAAI,CAAC,KAAK,MAAM,KAAK,WAAW,KAAK;AACnC,cAAM,OAAO,MAAM,KAAK,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,cAAM,IAAI;AAAA,UACR,6BAA6B,KAAK,MAAM,IAAK,KAAa,WAAW,KAAK,UAAU;AAAA,UACpF,KAAK;AAAA,UACL;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,KAAK,QAAQ,OAAO,GAAG,cAAc,GAAG,GAAG,EAAE;AAEnD,UAAM,aAAa,MAAM,KAAK,QAAQ,IAAI,eAAe;AACzD,QAAI,eAAe,KAAK;AACtB,YAAM,KAAK,QAAQ,OAAO,eAAe;AAAA,IAC3C;AAAA,EACF;AAAA,EAEA,MAAM,eAAe,KAA+C;AAClE,UAAM,SAAS,MAAM,KAAK,QAAQ,IAAI,GAAG,cAAc,GAAG,GAAG,EAAE;AAC/D,QAAI,CAAC,OAAQ,QAAO;AAEpB,UAAM,OAAsB,KAAK,MAAM,MAAM;AAC7C,UAAM,UAAU,MAAM,UAAU,KAAK,OAAO;AAC5C,WAAO,IAAI,iBAAiB;AAAA,MAC1B,KAAK,KAAK;AAAA,MACV;AAAA,MACA,aAAa,KAAK;AAAA,MAClB,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,MAClB,OAAO,KAAK;AAAA,IACd,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,UAA4C;AAChD,UAAM,MAAM,MAAM,KAAK,QAAQ,IAAI,eAAe;AAClD,QAAI,CAAC,IAAK,QAAO;AACjB,WAAO,KAAK,eAAe,GAAG;AAAA,EAChC;AACF;AAGA,SAAS,uBAA+B;AACtC,QAAM,QAAQ,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AACvD,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EACxC;AACA,SAAO,KAAK,MAAM,EACf,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AACtB;AAEA,eAAe,qBAAqB,UAAmC;AACrE,QAAM,OAAO,MAAM,OAAO,OAAO;AAAA,IAC/B;AAAA,IACA,IAAI,YAAY,EAAE,OAAO,QAAQ;AAAA,EACnC;AACA,QAAM,QAAQ,IAAI,WAAW,IAAI;AACjC,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EACxC;AACA,SAAO,KAAK,MAAM,EACf,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AACtB;","names":["body"]}

package/dist/index.d.cts

@@ -1,10 +1,26 @@
-interface CryptoAdapter {
-    generatePkceVerifier(): Promise<string>;
-    computePkceChallenge(verifier: string): Promise<string>;
-    signEs256(privateKey: JsonWebKey, payload: Uint8Array): Promise<Uint8Array>;
-    sha256(data: Uint8Array): Promise<Uint8Array>;
-    getRandomValues(length: number): Uint8Array;
+import { Key } from '@atproto/jwk';
+import { WebcryptoKey } from '@atproto/jwk-webcrypto';
+
+interface HappyViewSessionOptions {
+    did: string;
+    dpopKey: Key;
+    accessToken: string;
+    clientKey: string;
+    instanceUrl: string;
+    fetch?: typeof globalThis.fetch;
 }
+declare class HappyViewSession {
+    readonly did: string;
+    private readonly dpopKey;
+    private readonly accessToken;
+    private readonly clientKey;
+    private readonly instanceUrl;
+    private readonly _fetch;
+    private dpopNonce;
+    constructor(options: HappyViewSessionOptions);
+    fetchHandler(url: string, init: RequestInit): Promise<Response>;
+}
+
 interface StorageAdapter {
     get(key: string): Promise<string | null>;
     set(key: string, value: string): Promise<void>;
@@ -14,7 +30,6 @@ interface HappyViewOAuthClientOptions {
     instanceUrl: string;
     clientKey: string;
     clientSecret?: string;
-    crypto: CryptoAdapter;
     storage?: StorageAdapter;
 }
 interface DpopProvision {
@@ -54,42 +69,20 @@ interface RegisterSessionResponse {
     did: string;
 }
 
-interface HappyViewSessionOptions {
-    did: string;
-    dpopKey: JsonWebKey;
-    accessToken: string;
-    clientKey: string;
-    instanceUrl: string;
-    crypto: CryptoAdapter;
-    fetch?: typeof globalThis.fetch;
-}
-declare class HappyViewSession {
-    readonly did: string;
-    private readonly dpopKey;
-    private readonly accessToken;
-    private readonly clientKey;
-    private readonly instanceUrl;
-    private readonly crypto;
-    private readonly _fetch;
-    private dpopNonce;
-    constructor(options: HappyViewSessionOptions);
-    fetchHandler(url: string, init: RequestInit): Promise<Response>;
-}
-
 declare class HappyViewOAuthClient {
     protected readonly instanceUrl: string;
     protected readonly clientKey: string;
-    protected readonly crypto: CryptoAdapter;
     protected readonly storage: StorageAdapter;
     private readonly clientSecret;
-    private readonly _fetch;
+    protected readonly _fetch: typeof globalThis.fetch;
     constructor(options: HappyViewOAuthClientOptions & {
         fetch?: typeof globalThis.fetch;
     });
     get isConfidential(): boolean;
     provisionDpopKey(): Promise<{
         provisionId: string;
-        dpopKey: JsonWebKey;
+        dpopKey: Key;
+        rawJwk: JsonWebKey;
         pkceVerifier?: string;
     }>;
     registerSession(params: RegisterSessionParams): Promise<HappyViewSession>;
@@ -98,15 +91,11 @@ declare class HappyViewOAuthClient {
     restore(): Promise<HappyViewSession | null>;
 }
 
-declare function base64urlEncode(data: Uint8Array): string;
-interface DpopProofParams {
-    privateKey: JsonWebKey;
-    method: string;
-    url: string;
-    accessToken?: string;
-    nonce?: string;
-}
-declare function generateDpopProof(crypto: CryptoAdapter, params: DpopProofParams): Promise<string>;
+/**
+ * Import a raw ES256 JWK (as returned by HappyView's /oauth/dpop-keys)
+ * into a WebcryptoKey that can sign JWTs.
+ */
+declare function importJwk(jwk: JsonWebKey): Promise<WebcryptoKey>;
 
 declare class HappyViewError extends Error {
     constructor(message: string);
@@ -139,4 +128,4 @@ declare class MemoryStorage implements StorageAdapter {
     delete(key: string): Promise<void>;
 }
 
-export { ApiError, AuthenticationError, type CryptoAdapter, type DpopProofParams, type DpopProvision, HappyViewError, HappyViewOAuthClient, type HappyViewOAuthClientOptions, HappyViewSession, type HappyViewSessionOptions, InvalidStateError, MemoryStorage, type ProvisionKeyResponse, type RegisterSessionParams, type RegisterSessionResponse, ResolutionError, type StorageAdapter, type StoredSession, TokenExchangeError, base64urlEncode, generateDpopProof };
+export { ApiError, AuthenticationError, type DpopProvision, HappyViewError, HappyViewOAuthClient, type HappyViewOAuthClientOptions, HappyViewSession, type HappyViewSessionOptions, InvalidStateError, MemoryStorage, type ProvisionKeyResponse, type RegisterSessionParams, type RegisterSessionResponse, ResolutionError, type StorageAdapter, type StoredSession, TokenExchangeError, importJwk };

package/dist/index.d.ts

@@ -1,10 +1,26 @@
-interface CryptoAdapter {
-    generatePkceVerifier(): Promise<string>;
-    computePkceChallenge(verifier: string): Promise<string>;
-    signEs256(privateKey: JsonWebKey, payload: Uint8Array): Promise<Uint8Array>;
-    sha256(data: Uint8Array): Promise<Uint8Array>;
-    getRandomValues(length: number): Uint8Array;
+import { Key } from '@atproto/jwk';
+import { WebcryptoKey } from '@atproto/jwk-webcrypto';
+
+interface HappyViewSessionOptions {
+    did: string;
+    dpopKey: Key;
+    accessToken: string;
+    clientKey: string;
+    instanceUrl: string;
+    fetch?: typeof globalThis.fetch;
 }
+declare class HappyViewSession {
+    readonly did: string;
+    private readonly dpopKey;
+    private readonly accessToken;
+    private readonly clientKey;
+    private readonly instanceUrl;
+    private readonly _fetch;
+    private dpopNonce;
+    constructor(options: HappyViewSessionOptions);
+    fetchHandler(url: string, init: RequestInit): Promise<Response>;
+}
+
 interface StorageAdapter {
     get(key: string): Promise<string | null>;
     set(key: string, value: string): Promise<void>;
@@ -14,7 +30,6 @@ interface HappyViewOAuthClientOptions {
     instanceUrl: string;
     clientKey: string;
     clientSecret?: string;
-    crypto: CryptoAdapter;
     storage?: StorageAdapter;
 }
 interface DpopProvision {
@@ -54,42 +69,20 @@ interface RegisterSessionResponse {
     did: string;
 }
 
-interface HappyViewSessionOptions {
-    did: string;
-    dpopKey: JsonWebKey;
-    accessToken: string;
-    clientKey: string;
-    instanceUrl: string;
-    crypto: CryptoAdapter;
-    fetch?: typeof globalThis.fetch;
-}
-declare class HappyViewSession {
-    readonly did: string;
-    private readonly dpopKey;
-    private readonly accessToken;
-    private readonly clientKey;
-    private readonly instanceUrl;
-    private readonly crypto;
-    private readonly _fetch;
-    private dpopNonce;
-    constructor(options: HappyViewSessionOptions);
-    fetchHandler(url: string, init: RequestInit): Promise<Response>;
-}
-
 declare class HappyViewOAuthClient {
     protected readonly instanceUrl: string;
     protected readonly clientKey: string;
-    protected readonly crypto: CryptoAdapter;
     protected readonly storage: StorageAdapter;
     private readonly clientSecret;
-    private readonly _fetch;
+    protected readonly _fetch: typeof globalThis.fetch;
     constructor(options: HappyViewOAuthClientOptions & {
         fetch?: typeof globalThis.fetch;
     });
     get isConfidential(): boolean;
     provisionDpopKey(): Promise<{
         provisionId: string;
-        dpopKey: JsonWebKey;
+        dpopKey: Key;
+        rawJwk: JsonWebKey;
         pkceVerifier?: string;
     }>;
     registerSession(params: RegisterSessionParams): Promise<HappyViewSession>;
@@ -98,15 +91,11 @@ declare class HappyViewOAuthClient {
     restore(): Promise<HappyViewSession | null>;
 }
 
-declare function base64urlEncode(data: Uint8Array): string;
-interface DpopProofParams {
-    privateKey: JsonWebKey;
-    method: string;
-    url: string;
-    accessToken?: string;
-    nonce?: string;
-}
-declare function generateDpopProof(crypto: CryptoAdapter, params: DpopProofParams): Promise<string>;
+/**
+ * Import a raw ES256 JWK (as returned by HappyView's /oauth/dpop-keys)
+ * into a WebcryptoKey that can sign JWTs.
+ */
+declare function importJwk(jwk: JsonWebKey): Promise<WebcryptoKey>;
 
 declare class HappyViewError extends Error {
     constructor(message: string);
@@ -139,4 +128,4 @@ declare class MemoryStorage implements StorageAdapter {
     delete(key: string): Promise<void>;
 }
 
-export { ApiError, AuthenticationError, type CryptoAdapter, type DpopProofParams, type DpopProvision, HappyViewError, HappyViewOAuthClient, type HappyViewOAuthClientOptions, HappyViewSession, type HappyViewSessionOptions, InvalidStateError, MemoryStorage, type ProvisionKeyResponse, type RegisterSessionParams, type RegisterSessionResponse, ResolutionError, type StorageAdapter, type StoredSession, TokenExchangeError, base64urlEncode, generateDpopProof };
+export { ApiError, AuthenticationError, type DpopProvision, HappyViewError, HappyViewOAuthClient, type HappyViewOAuthClientOptions, HappyViewSession, type HappyViewSessionOptions, InvalidStateError, MemoryStorage, type ProvisionKeyResponse, type RegisterSessionParams, type RegisterSessionResponse, ResolutionError, type StorageAdapter, type StoredSession, TokenExchangeError, importJwk };

package/dist/index.js

@@ -46,63 +46,46 @@ var ResolutionError = class extends HappyViewError {
   }
 };
 
-// src/dpop-proof.ts
-function base64urlEncode(data) {
-  let binary = "";
-  for (let i = 0; i < data.length; i++) {
-    binary += String.fromCharCode(data[i]);
-  }
-  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-async function generateDpopProof(crypto, params) {
-  const { privateKey, method, url, accessToken, nonce } = params;
-  const publicJwk = {
-    kty: privateKey.kty,
-    crv: privateKey.crv,
-    x: privateKey.x,
-    y: privateKey.y
-  };
-  const header = {
-    alg: "ES256",
-    typ: "dpop+jwt",
-    jwk: publicJwk
-  };
-  const jtiBytes = crypto.getRandomValues(16);
-  const jti = Array.from(jtiBytes, (b) => b.toString(16).padStart(2, "0")).join("");
-  const payload = {
-    htm: method,
-    htu: url,
-    iat: Math.floor(Date.now() / 1e3),
-    jti
-  };
-  if (accessToken) {
-    const tokenBytes = new TextEncoder().encode(accessToken);
-    const hashBuf = await crypto.sha256(tokenBytes);
-    payload.ath = base64urlEncode(hashBuf);
-  }
-  if (nonce !== void 0) {
-    payload.nonce = nonce;
-  }
-  const headerB64 = base64urlEncode(
-    new TextEncoder().encode(JSON.stringify(header))
+// src/import-jwk.ts
+import { WebcryptoKey } from "@atproto/jwk-webcrypto";
+async function importJwk(jwk) {
+  const privateKey = await crypto.subtle.importKey(
+    "jwk",
+    jwk,
+    { name: "ECDSA", namedCurve: "P-256" },
+    true,
+    ["sign"]
   );
-  const payloadB64 = base64urlEncode(
-    new TextEncoder().encode(JSON.stringify(payload))
+  const { d: _, ...publicJwkFields } = jwk;
+  const publicKey = await crypto.subtle.importKey(
+    "jwk",
+    publicJwkFields,
+    { name: "ECDSA", namedCurve: "P-256" },
+    true,
+    ["verify"]
   );
-  const message = new TextEncoder().encode(`${headerB64}.${payloadB64}`);
-  const signature = await crypto.signEs256(privateKey, message);
-  const sigB64 = base64urlEncode(signature);
-  return `${headerB64}.${payloadB64}.${sigB64}`;
+  return WebcryptoKey.fromKeypair({ privateKey, publicKey });
 }
 
 // src/session.ts
+function randomHex(byteLength) {
+  const bytes = crypto.getRandomValues(new Uint8Array(byteLength));
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+function base64url(buffer) {
+  const bytes = new Uint8Array(buffer);
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
 var HappyViewSession = class {
   did;
   dpopKey;
   accessToken;
   clientKey;
   instanceUrl;
-  crypto;
   _fetch;
   dpopNonce;
   constructor(options) {
@@ -111,29 +94,61 @@ var HappyViewSession = class {
     this.accessToken = options.accessToken;
     this.clientKey = options.clientKey;
     this.instanceUrl = options.instanceUrl.replace(/\/+$/, "");
-    this.crypto = options.crypto;
-    this._fetch = options.fetch ?? globalThis.fetch;
+    this._fetch = options.fetch ?? ((input, init) => fetch(input, init));
   }
   async fetchHandler(url, init) {
     const fullUrl = /^https?:\/\//i.test(url) ? url : `${this.instanceUrl}${url}`;
     const method = (init.method ?? "GET").toUpperCase();
-    const proof = await generateDpopProof(this.crypto, {
-      privateKey: this.dpopKey,
-      method,
-      url: fullUrl,
-      accessToken: this.accessToken,
-      nonce: this.dpopNonce
-    });
-    const headers = new Headers(init.headers);
-    headers.set("authorization", `DPoP ${this.accessToken}`);
-    headers.set("dpop", proof);
-    headers.set("x-client-key", this.clientKey);
-    const response = await this._fetch(fullUrl, {
-      ...init,
-      headers
-    });
+    const htu = fullUrl.split("?")[0];
+    const sendWithProof = async () => {
+      const tokenHash = await crypto.subtle.digest(
+        "SHA-256",
+        new TextEncoder().encode(this.accessToken)
+      );
+      const ath = base64url(tokenHash);
+      const proof = await this.dpopKey.createJwt(
+        {
+          alg: "ES256",
+          typ: "dpop+jwt",
+          jwk: this.dpopKey.publicJwk
+        },
+        {
+          htm: method,
+          htu,
+          iat: Math.floor(Date.now() / 1e3),
+          jti: randomHex(16),
+          ath,
+          nonce: this.dpopNonce
+        }
+      );
+      const headers = new Headers(init.headers);
+      headers.set("authorization", `DPoP ${this.accessToken}`);
+      headers.set("dpop", proof);
+      headers.set("x-client-key", this.clientKey);
+      return this._fetch(fullUrl, { ...init, headers });
+    };
+    let response;
+    try {
+      response = await sendWithProof();
+    } catch (e) {
+      const info = `_fetch type: ${typeof this._fetch}, toString: ${String(this._fetch).slice(0, 120)}, url: ${fullUrl}`;
+      throw new Error(`fetchHandler failed: ${e.message}
+
+DEBUG: ${info}`);
+    }
     const nonce = response.headers.get("dpop-nonce");
-    if (nonce) {
+    if (nonce && nonce !== this.dpopNonce && (response.status === 401 || response.status === 400)) {
+      this.dpopNonce = nonce;
+      try {
+        response = await sendWithProof();
+      } catch (e) {
+        throw new Error(`fetchHandler retry failed: ${e.message}`);
+      }
+      const retryNonce = response.headers.get("dpop-nonce");
+      if (retryNonce) {
+        this.dpopNonce = retryNonce;
+      }
+    } else if (nonce) {
       this.dpopNonce = nonce;
     }
     return response;
@@ -160,7 +175,6 @@ var LAST_ACTIVE_KEY = "happyview:last-active-did";
 var HappyViewOAuthClient = class {
   instanceUrl;
   clientKey;
-  crypto;
   storage;
   clientSecret;
   _fetch;
@@ -168,9 +182,8 @@ var HappyViewOAuthClient = class {
     this.instanceUrl = options.instanceUrl.replace(/\/+$/, "");
     this.clientKey = options.clientKey;
     this.clientSecret = options.clientSecret;
-    this.crypto = options.crypto;
     this.storage = options.storage ?? new MemoryStorage();
-    this._fetch = options.fetch ?? globalThis.fetch;
+    this._fetch = options.fetch ?? ((input, init) => fetch(input, init));
   }
   get isConfidential() {
     return this.clientSecret !== void 0;
@@ -186,8 +199,8 @@ var HappyViewOAuthClient = class {
     const body = {};
     let pkceVerifier;
     if (!this.isConfidential) {
-      pkceVerifier = await this.crypto.generatePkceVerifier();
-      const challenge = await this.crypto.computePkceChallenge(pkceVerifier);
+      pkceVerifier = generatePkceVerifier();
+      const challenge = await computePkceChallenge(pkceVerifier);
       body.pkce_challenge = challenge;
     }
     const resp = await this._fetch(`${this.instanceUrl}/oauth/dpop-keys`, {
@@ -204,9 +217,11 @@ var HappyViewOAuthClient = class {
       );
     }
     const data = await resp.json();
+    const dpopKey = await importJwk(data.dpop_key);
     return {
       provisionId: data.provision_id,
-      dpopKey: data.dpop_key,
+      dpopKey,
+      rawJwk: data.dpop_key,
       pkceVerifier
     };
   }
@@ -244,6 +259,7 @@ var HappyViewOAuthClient = class {
       );
     }
     const data = await resp.json();
+    const dpopKey = await importJwk(params.dpopKey);
     const storedSession = {
       did: data.did,
       dpopKey: params.dpopKey,
@@ -258,34 +274,28 @@ var HappyViewOAuthClient = class {
     await this.storage.set(LAST_ACTIVE_KEY, data.did);
     return new HappyViewSession({
       did: data.did,
-      dpopKey: params.dpopKey,
+      dpopKey,
       accessToken: params.accessToken,
       clientKey: this.clientKey,
       instanceUrl: this.instanceUrl,
-      crypto: this.crypto
+      fetch: this._fetch
     });
   }
   async deleteSession(did) {
-    const headers = {
-      "x-client-key": this.clientKey
-    };
-    if (this.clientSecret) {
-      headers["x-client-secret"] = this.clientSecret;
-    }
-    const resp = await this._fetch(
-      `${this.instanceUrl}/oauth/sessions/${did}`,
-      {
-        method: "DELETE",
-        headers
-      }
-    );
-    if (!resp.ok && resp.status !== 404) {
-      const body = await resp.json().catch(() => ({}));
-      throw new ApiError(
-        `Failed to delete session: ${resp.status} ${body.message ?? resp.statusText}`,
-        resp.status,
-        body
+    const session = await this.restoreSession(did);
+    if (session) {
+      const resp = await session.fetchHandler(
+        `${this.instanceUrl}/oauth/sessions/${did}`,
+        { method: "DELETE" }
       );
+      if (!resp.ok && resp.status !== 404) {
+        const body = await resp.json().catch(() => ({}));
+        throw new ApiError(
+          `Failed to delete session: ${resp.status} ${body.message ?? resp.statusText}`,
+          resp.status,
+          body
+        );
+      }
     }
     await this.storage.delete(`${STORAGE_PREFIX}${did}`);
     const lastActive = await this.storage.get(LAST_ACTIVE_KEY);
@@ -297,13 +307,14 @@ var HappyViewOAuthClient = class {
     const stored = await this.storage.get(`${STORAGE_PREFIX}${did}`);
     if (!stored) return null;
     const data = JSON.parse(stored);
+    const dpopKey = await importJwk(data.dpopKey);
     return new HappyViewSession({
       did: data.did,
-      dpopKey: data.dpopKey,
+      dpopKey,
       accessToken: data.accessToken,
       clientKey: data.clientKey,
       instanceUrl: data.instanceUrl,
-      crypto: this.crypto
+      fetch: this._fetch
     });
   }
   async restore() {
@@ -312,6 +323,26 @@ var HappyViewOAuthClient = class {
     return this.restoreSession(did);
   }
 };
+function generatePkceVerifier() {
+  const bytes = crypto.getRandomValues(new Uint8Array(32));
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function computePkceChallenge(verifier) {
+  const hash = await crypto.subtle.digest(
+    "SHA-256",
+    new TextEncoder().encode(verifier)
+  );
+  const bytes = new Uint8Array(hash);
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
 export {
   ApiError,
   AuthenticationError,
@@ -322,7 +353,6 @@ export {
   MemoryStorage,
   ResolutionError,
   TokenExchangeError,
-  base64urlEncode,
-  generateDpopProof
+  importJwk
 };
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/errors.ts","../src/dpop-proof.ts","../src/session.ts","../src/storage.ts","../src/client.ts"],"sourcesContent":["export class HappyViewError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"HappyViewError\";\n  }\n}\n\nexport class ApiError extends HappyViewError {\n  readonly status: number;\n  readonly body: unknown;\n\n  constructor(message: string, status: number, body?: unknown) {\n    super(message);\n    this.name = \"ApiError\";\n    this.status = status;\n    this.body = body;\n  }\n}\n\nexport class AuthenticationError extends HappyViewError {\n  readonly status: number;\n\n  constructor(message: string, status: number = 401) {\n    super(message);\n    this.name = \"AuthenticationError\";\n    this.status = status;\n  }\n}\n\nexport class InvalidStateError extends HappyViewError {\n  constructor(message: string) {\n    super(message);\n    this.name = \"InvalidStateError\";\n  }\n}\n\nexport class TokenExchangeError extends HappyViewError {\n  readonly status: number;\n  readonly body: string;\n\n  constructor(message: string, status: number, body: string) {\n    super(message);\n    this.name = \"TokenExchangeError\";\n    this.status = status;\n    this.body = body;\n  }\n}\n\nexport class ResolutionError extends HappyViewError {\n  constructor(message: string) {\n    super(message);\n    this.name = \"ResolutionError\";\n  }\n}\n","import type { CryptoAdapter } from \"./types\";\n\nexport function base64urlEncode(data: Uint8Array): string {\n  let binary = \"\";\n  for (let i = 0; i < data.length; i++) {\n    binary += String.fromCharCode(data[i]);\n  }\n  return btoa(binary)\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/, \"\");\n}\n\nexport interface DpopProofParams {\n  privateKey: JsonWebKey;\n  method: string;\n  url: string;\n  accessToken?: string;\n  nonce?: string;\n}\n\nexport async function generateDpopProof(\n  crypto: CryptoAdapter,\n  params: DpopProofParams,\n): Promise<string> {\n  const { privateKey, method, url, accessToken, nonce } = params;\n\n  const publicJwk = {\n    kty: privateKey.kty,\n    crv: privateKey.crv,\n    x: privateKey.x,\n    y: privateKey.y,\n  };\n\n  const header = {\n    alg: \"ES256\",\n    typ: \"dpop+jwt\",\n    jwk: publicJwk,\n  };\n\n  // Generate jti\n  const jtiBytes = crypto.getRandomValues(16);\n  const jti = Array.from(jtiBytes, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n\n  const payload: Record<string, unknown> = {\n    htm: method,\n    htu: url,\n    iat: Math.floor(Date.now() / 1000),\n    jti,\n  };\n\n  // Compute ath: base64url(SHA-256(access_token)) — only when token is present\n  if (accessToken) {\n    const tokenBytes = new TextEncoder().encode(accessToken);\n    const hashBuf = await crypto.sha256(tokenBytes);\n    payload.ath = base64urlEncode(hashBuf);\n  }\n\n  if (nonce !== undefined) {\n    payload.nonce = nonce;\n  }\n\n  const headerB64 = base64urlEncode(\n    new TextEncoder().encode(JSON.stringify(header)),\n  );\n  const payloadB64 = base64urlEncode(\n    new TextEncoder().encode(JSON.stringify(payload)),\n  );\n\n  const message = new TextEncoder().encode(`${headerB64}.${payloadB64}`);\n  const signature = await crypto.signEs256(privateKey, message);\n  const sigB64 = base64urlEncode(signature);\n\n  return `${headerB64}.${payloadB64}.${sigB64}`;\n}\n","import { generateDpopProof } from \"./dpop-proof\";\nimport type { CryptoAdapter } from \"./types\";\n\nexport interface HappyViewSessionOptions {\n  did: string;\n  dpopKey: JsonWebKey;\n  accessToken: string;\n  clientKey: string;\n  instanceUrl: string;\n  crypto: CryptoAdapter;\n  fetch?: typeof globalThis.fetch;\n}\n\nexport class HappyViewSession {\n  readonly did: string;\n\n  private readonly dpopKey: JsonWebKey;\n  private readonly accessToken: string;\n  private readonly clientKey: string;\n  private readonly instanceUrl: string;\n  private readonly crypto: CryptoAdapter;\n  private readonly _fetch: typeof globalThis.fetch;\n  private dpopNonce: string | undefined;\n\n  constructor(options: HappyViewSessionOptions) {\n    this.did = options.did;\n    this.dpopKey = options.dpopKey;\n    this.accessToken = options.accessToken;\n    this.clientKey = options.clientKey;\n    this.instanceUrl = options.instanceUrl.replace(/\\/+$/, \"\");\n    this.crypto = options.crypto;\n    this._fetch = options.fetch ?? globalThis.fetch;\n  }\n\n  async fetchHandler(url: string, init: RequestInit): Promise<Response> {\n    const fullUrl = /^https?:\\/\\//i.test(url) ? url : `${this.instanceUrl}${url}`;\n    const method = (init.method ?? \"GET\").toUpperCase();\n\n    const proof = await generateDpopProof(this.crypto, {\n      privateKey: this.dpopKey,\n      method,\n      url: fullUrl,\n      accessToken: this.accessToken,\n      nonce: this.dpopNonce,\n    });\n\n    const headers = new Headers(init.headers);\n    headers.set(\"authorization\", `DPoP ${this.accessToken}`);\n    headers.set(\"dpop\", proof);\n    headers.set(\"x-client-key\", this.clientKey);\n\n    const response = await this._fetch(fullUrl, {\n      ...init,\n      headers,\n    });\n\n    const nonce = response.headers.get(\"dpop-nonce\");\n    if (nonce) {\n      this.dpopNonce = nonce;\n    }\n\n    return response;\n  }\n}\n","import type { StorageAdapter } from \"./types\";\n\nexport class MemoryStorage implements StorageAdapter {\n  private data = new Map<string, string>();\n\n  async get(key: string): Promise<string | null> {\n    return this.data.get(key) ?? null;\n  }\n\n  async set(key: string, value: string): Promise<void> {\n    this.data.set(key, value);\n  }\n\n  async delete(key: string): Promise<void> {\n    this.data.delete(key);\n  }\n}\n","import { ApiError } from \"./errors\";\nimport { HappyViewSession } from \"./session\";\nimport { MemoryStorage } from \"./storage\";\nimport type {\n  CryptoAdapter,\n  HappyViewOAuthClientOptions,\n  ProvisionKeyResponse,\n  RegisterSessionParams,\n  RegisterSessionResponse,\n  StorageAdapter,\n  StoredSession,\n} from \"./types\";\n\nconst STORAGE_PREFIX = \"happyview:session:\";\nconst LAST_ACTIVE_KEY = \"happyview:last-active-did\";\n\nexport class HappyViewOAuthClient {\n  protected readonly instanceUrl: string;\n  protected readonly clientKey: string;\n  protected readonly crypto: CryptoAdapter;\n  protected readonly storage: StorageAdapter;\n  private readonly clientSecret: string | undefined;\n  private readonly _fetch: typeof globalThis.fetch;\n\n  constructor(\n    options: HappyViewOAuthClientOptions & {\n      fetch?: typeof globalThis.fetch;\n    },\n  ) {\n    this.instanceUrl = options.instanceUrl.replace(/\\/+$/, \"\");\n    this.clientKey = options.clientKey;\n    this.clientSecret = options.clientSecret;\n    this.crypto = options.crypto;\n    this.storage = options.storage ?? new MemoryStorage();\n    this._fetch = options.fetch ?? globalThis.fetch;\n  }\n\n  get isConfidential(): boolean {\n    return this.clientSecret !== undefined;\n  }\n\n  async provisionDpopKey(): Promise<{\n    provisionId: string;\n    dpopKey: JsonWebKey;\n    pkceVerifier?: string;\n  }> {\n    const headers: Record<string, string> = {\n      \"content-type\": \"application/json\",\n      \"x-client-key\": this.clientKey,\n    };\n    if (this.clientSecret) {\n      headers[\"x-client-secret\"] = this.clientSecret;\n    }\n\n    const body: Record<string, unknown> = {};\n    let pkceVerifier: string | undefined;\n\n    if (!this.isConfidential) {\n      pkceVerifier = await this.crypto.generatePkceVerifier();\n      const challenge = await this.crypto.computePkceChallenge(pkceVerifier);\n      body.pkce_challenge = challenge;\n    }\n\n    const resp = await this._fetch(`${this.instanceUrl}/oauth/dpop-keys`, {\n      method: \"POST\",\n      headers,\n      body: JSON.stringify(body),\n    });\n\n    if (!resp.ok) {\n      const body = await resp.json().catch(() => ({}));\n      throw new ApiError(\n        `Failed to provision DPoP key: ${resp.status} ${(body as any).message ?? resp.statusText}`,\n        resp.status,\n        body,\n      );\n    }\n\n    const data: ProvisionKeyResponse = await resp.json();\n    return {\n      provisionId: data.provision_id,\n      dpopKey: data.dpop_key,\n      pkceVerifier,\n    };\n  }\n\n  async registerSession(\n    params: RegisterSessionParams,\n  ): Promise<HappyViewSession> {\n    const headers: Record<string, string> = {\n      \"content-type\": \"application/json\",\n      \"x-client-key\": this.clientKey,\n    };\n    if (this.clientSecret) {\n      headers[\"x-client-secret\"] = this.clientSecret;\n    }\n\n    const body: Record<string, unknown> = {\n      provision_id: params.provisionId,\n      did: params.did,\n      access_token: params.accessToken,\n      refresh_token: params.refreshToken,\n      scopes: params.scopes,\n      pds_url: params.pdsUrl,\n      issuer: params.issuer,\n    };\n\n    if (!this.isConfidential && params.pkceVerifier) {\n      body.pkce_verifier = params.pkceVerifier;\n    }\n\n    const resp = await this._fetch(`${this.instanceUrl}/oauth/sessions`, {\n      method: \"POST\",\n      headers,\n      body: JSON.stringify(body),\n    });\n\n    if (!resp.ok) {\n      const body = await resp.json().catch(() => ({}));\n      throw new ApiError(\n        `Failed to register session: ${resp.status} ${(body as any).message ?? resp.statusText}`,\n        resp.status,\n        body,\n      );\n    }\n\n    const data: RegisterSessionResponse = await resp.json();\n\n    const storedSession: StoredSession = {\n      did: data.did,\n      dpopKey: params.dpopKey,\n      accessToken: params.accessToken,\n      clientKey: this.clientKey,\n      instanceUrl: this.instanceUrl,\n    };\n    await this.storage.set(\n      `${STORAGE_PREFIX}${data.did}`,\n      JSON.stringify(storedSession),\n    );\n    await this.storage.set(LAST_ACTIVE_KEY, data.did);\n\n    return new HappyViewSession({\n      did: data.did,\n      dpopKey: params.dpopKey,\n      accessToken: params.accessToken,\n      clientKey: this.clientKey,\n      instanceUrl: this.instanceUrl,\n      crypto: this.crypto,\n    });\n  }\n\n  async deleteSession(did: string): Promise<void> {\n    const headers: Record<string, string> = {\n      \"x-client-key\": this.clientKey,\n    };\n    if (this.clientSecret) {\n      headers[\"x-client-secret\"] = this.clientSecret;\n    }\n\n    const resp = await this._fetch(\n      `${this.instanceUrl}/oauth/sessions/${did}`,\n      {\n        method: \"DELETE\",\n        headers,\n      },\n    );\n\n    if (!resp.ok && resp.status !== 404) {\n      const body = await resp.json().catch(() => ({}));\n      throw new ApiError(\n        `Failed to delete session: ${resp.status} ${(body as any).message ?? resp.statusText}`,\n        resp.status,\n        body,\n      );\n    }\n\n    await this.storage.delete(`${STORAGE_PREFIX}${did}`);\n\n    const lastActive = await this.storage.get(LAST_ACTIVE_KEY);\n    if (lastActive === did) {\n      await this.storage.delete(LAST_ACTIVE_KEY);\n    }\n  }\n\n  async restoreSession(did: string): Promise<HappyViewSession | null> {\n    const stored = await this.storage.get(`${STORAGE_PREFIX}${did}`);\n    if (!stored) return null;\n\n    const data: StoredSession = JSON.parse(stored);\n    return new HappyViewSession({\n      did: data.did,\n      dpopKey: data.dpopKey,\n      accessToken: data.accessToken,\n      clientKey: data.clientKey,\n      instanceUrl: data.instanceUrl,\n      crypto: this.crypto,\n    });\n  }\n\n  async restore(): Promise<HappyViewSession | null> {\n    const did = await this.storage.get(LAST_ACTIVE_KEY);\n    if (!did) return null;\n    return this.restoreSession(did);\n  }\n}\n"],"mappings":";AAAO,IAAM,iBAAN,cAA6B,MAAM;AAAA,EACxC,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,WAAN,cAAuB,eAAe;AAAA,EAClC;AAAA,EACA;AAAA,EAET,YAAY,SAAiB,QAAgB,MAAgB;AAC3D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,sBAAN,cAAkC,eAAe;AAAA,EAC7C;AAAA,EAET,YAAY,SAAiB,SAAiB,KAAK;AACjD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AACF;AAEO,IAAM,oBAAN,cAAgC,eAAe;AAAA,EACpD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,qBAAN,cAAiC,eAAe;AAAA,EAC5C;AAAA,EACA;AAAA,EAET,YAAY,SAAiB,QAAgB,MAAc;AACzD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,kBAAN,cAA8B,eAAe;AAAA,EAClD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;;;ACnDO,SAAS,gBAAgB,MAA0B;AACxD,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,cAAU,OAAO,aAAa,KAAK,CAAC,CAAC;AAAA,EACvC;AACA,SAAO,KAAK,MAAM,EACf,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AACtB;AAUA,eAAsB,kBACpB,QACA,QACiB;AACjB,QAAM,EAAE,YAAY,QAAQ,KAAK,aAAa,MAAM,IAAI;AAExD,QAAM,YAAY;AAAA,IAChB,KAAK,WAAW;AAAA,IAChB,KAAK,WAAW;AAAA,IAChB,GAAG,WAAW;AAAA,IACd,GAAG,WAAW;AAAA,EAChB;AAEA,QAAM,SAAS;AAAA,IACb,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,EACP;AAGA,QAAM,WAAW,OAAO,gBAAgB,EAAE;AAC1C,QAAM,MAAM,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAEhF,QAAM,UAAmC;AAAA,IACvC,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAAA,IACjC;AAAA,EACF;AAGA,MAAI,aAAa;AACf,UAAM,aAAa,IAAI,YAAY,EAAE,OAAO,WAAW;AACvD,UAAM,UAAU,MAAM,OAAO,OAAO,UAAU;AAC9C,YAAQ,MAAM,gBAAgB,OAAO;AAAA,EACvC;AAEA,MAAI,UAAU,QAAW;AACvB,YAAQ,QAAQ;AAAA,EAClB;AAEA,QAAM,YAAY;AAAA,IAChB,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,MAAM,CAAC;AAAA,EACjD;AACA,QAAM,aAAa;AAAA,IACjB,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,OAAO,CAAC;AAAA,EAClD;AAEA,QAAM,UAAU,IAAI,YAAY,EAAE,OAAO,GAAG,SAAS,IAAI,UAAU,EAAE;AACrE,QAAM,YAAY,MAAM,OAAO,UAAU,YAAY,OAAO;AAC5D,QAAM,SAAS,gBAAgB,SAAS;AAExC,SAAO,GAAG,SAAS,IAAI,UAAU,IAAI,MAAM;AAC7C;;;AC7DO,IAAM,mBAAN,MAAuB;AAAA,EACnB;AAAA,EAEQ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACT;AAAA,EAER,YAAY,SAAkC;AAC5C,SAAK,MAAM,QAAQ;AACnB,SAAK,UAAU,QAAQ;AACvB,SAAK,cAAc,QAAQ;AAC3B,SAAK,YAAY,QAAQ;AACzB,SAAK,cAAc,QAAQ,YAAY,QAAQ,QAAQ,EAAE;AACzD,SAAK,SAAS,QAAQ;AACtB,SAAK,SAAS,QAAQ,SAAS,WAAW;AAAA,EAC5C;AAAA,EAEA,MAAM,aAAa,KAAa,MAAsC;AACpE,UAAM,UAAU,gBAAgB,KAAK,GAAG,IAAI,MAAM,GAAG,KAAK,WAAW,GAAG,GAAG;AAC3E,UAAM,UAAU,KAAK,UAAU,OAAO,YAAY;AAElD,UAAM,QAAQ,MAAM,kBAAkB,KAAK,QAAQ;AAAA,MACjD,YAAY,KAAK;AAAA,MACjB;AAAA,MACA,KAAK;AAAA,MACL,aAAa,KAAK;AAAA,MAClB,OAAO,KAAK;AAAA,IACd,CAAC;AAED,UAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;AACxC,YAAQ,IAAI,iBAAiB,QAAQ,KAAK,WAAW,EAAE;AACvD,YAAQ,IAAI,QAAQ,KAAK;AACzB,YAAQ,IAAI,gBAAgB,KAAK,SAAS;AAE1C,UAAM,WAAW,MAAM,KAAK,OAAO,SAAS;AAAA,MAC1C,GAAG;AAAA,MACH;AAAA,IACF,CAAC;AAED,UAAM,QAAQ,SAAS,QAAQ,IAAI,YAAY;AAC/C,QAAI,OAAO;AACT,WAAK,YAAY;AAAA,IACnB;AAEA,WAAO;AAAA,EACT;AACF;;;AC7DO,IAAM,gBAAN,MAA8C;AAAA,EAC3C,OAAO,oBAAI,IAAoB;AAAA,EAEvC,MAAM,IAAI,KAAqC;AAC7C,WAAO,KAAK,KAAK,IAAI,GAAG,KAAK;AAAA,EAC/B;AAAA,EAEA,MAAM,IAAI,KAAa,OAA8B;AACnD,SAAK,KAAK,IAAI,KAAK,KAAK;AAAA,EAC1B;AAAA,EAEA,MAAM,OAAO,KAA4B;AACvC,SAAK,KAAK,OAAO,GAAG;AAAA,EACtB;AACF;;;ACHA,IAAM,iBAAiB;AACvB,IAAM,kBAAkB;AAEjB,IAAM,uBAAN,MAA2B;AAAA,EACb;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACF;AAAA,EACA;AAAA,EAEjB,YACE,SAGA;AACA,SAAK,cAAc,QAAQ,YAAY,QAAQ,QAAQ,EAAE;AACzD,SAAK,YAAY,QAAQ;AACzB,SAAK,eAAe,QAAQ;AAC5B,SAAK,SAAS,QAAQ;AACtB,SAAK,UAAU,QAAQ,WAAW,IAAI,cAAc;AACpD,SAAK,SAAS,QAAQ,SAAS,WAAW;AAAA,EAC5C;AAAA,EAEA,IAAI,iBAA0B;AAC5B,WAAO,KAAK,iBAAiB;AAAA,EAC/B;AAAA,EAEA,MAAM,mBAIH;AACD,UAAM,UAAkC;AAAA,MACtC,gBAAgB;AAAA,MAChB,gBAAgB,KAAK;AAAA,IACvB;AACA,QAAI,KAAK,cAAc;AACrB,cAAQ,iBAAiB,IAAI,KAAK;AAAA,IACpC;AAEA,UAAM,OAAgC,CAAC;AACvC,QAAI;AAEJ,QAAI,CAAC,KAAK,gBAAgB;AACxB,qBAAe,MAAM,KAAK,OAAO,qBAAqB;AACtD,YAAM,YAAY,MAAM,KAAK,OAAO,qBAAqB,YAAY;AACrE,WAAK,iBAAiB;AAAA,IACxB;AAEA,UAAM,OAAO,MAAM,KAAK,OAAO,GAAG,KAAK,WAAW,oBAAoB;AAAA,MACpE,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAED,QAAI,CAAC,KAAK,IAAI;AACZ,YAAMA,QAAO,MAAM,KAAK,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,YAAM,IAAI;AAAA,QACR,iCAAiC,KAAK,MAAM,IAAKA,MAAa,WAAW,KAAK,UAAU;AAAA,QACxF,KAAK;AAAA,QACLA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,OAA6B,MAAM,KAAK,KAAK;AACnD,WAAO;AAAA,MACL,aAAa,KAAK;AAAA,MAClB,SAAS,KAAK;AAAA,MACd;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,gBACJ,QAC2B;AAC3B,UAAM,UAAkC;AAAA,MACtC,gBAAgB;AAAA,MAChB,gBAAgB,KAAK;AAAA,IACvB;AACA,QAAI,KAAK,cAAc;AACrB,cAAQ,iBAAiB,IAAI,KAAK;AAAA,IACpC;AAEA,UAAM,OAAgC;AAAA,MACpC,cAAc,OAAO;AAAA,MACrB,KAAK,OAAO;AAAA,MACZ,cAAc,OAAO;AAAA,MACrB,eAAe,OAAO;AAAA,MACtB,QAAQ,OAAO;AAAA,MACf,SAAS,OAAO;AAAA,MAChB,QAAQ,OAAO;AAAA,IACjB;AAEA,QAAI,CAAC,KAAK,kBAAkB,OAAO,cAAc;AAC/C,WAAK,gBAAgB,OAAO;AAAA,IAC9B;AAEA,UAAM,OAAO,MAAM,KAAK,OAAO,GAAG,KAAK,WAAW,mBAAmB;AAAA,MACnE,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAED,QAAI,CAAC,KAAK,IAAI;AACZ,YAAMA,QAAO,MAAM,KAAK,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,YAAM,IAAI;AAAA,QACR,+BAA+B,KAAK,MAAM,IAAKA,MAAa,WAAW,KAAK,UAAU;AAAA,QACtF,KAAK;AAAA,QACLA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,OAAgC,MAAM,KAAK,KAAK;AAEtD,UAAM,gBAA+B;AAAA,MACnC,KAAK,KAAK;AAAA,MACV,SAAS,OAAO;AAAA,MAChB,aAAa,OAAO;AAAA,MACpB,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,IACpB;AACA,UAAM,KAAK,QAAQ;AAAA,MACjB,GAAG,cAAc,GAAG,KAAK,GAAG;AAAA,MAC5B,KAAK,UAAU,aAAa;AAAA,IAC9B;AACA,UAAM,KAAK,QAAQ,IAAI,iBAAiB,KAAK,GAAG;AAEhD,WAAO,IAAI,iBAAiB;AAAA,MAC1B,KAAK,KAAK;AAAA,MACV,SAAS,OAAO;AAAA,MAChB,aAAa,OAAO;AAAA,MACpB,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,MAClB,QAAQ,KAAK;AAAA,IACf,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,cAAc,KAA4B;AAC9C,UAAM,UAAkC;AAAA,MACtC,gBAAgB,KAAK;AAAA,IACvB;AACA,QAAI,KAAK,cAAc;AACrB,cAAQ,iBAAiB,IAAI,KAAK;AAAA,IACpC;AAEA,UAAM,OAAO,MAAM,KAAK;AAAA,MACtB,GAAG,KAAK,WAAW,mBAAmB,GAAG;AAAA,MACzC;AAAA,QACE,QAAQ;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,KAAK,MAAM,KAAK,WAAW,KAAK;AACnC,YAAM,OAAO,MAAM,KAAK,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,YAAM,IAAI;AAAA,QACR,6BAA6B,KAAK,MAAM,IAAK,KAAa,WAAW,KAAK,UAAU;AAAA,QACpF,KAAK;AAAA,QACL;AAAA,MACF;AAAA,IACF;AAEA,UAAM,KAAK,QAAQ,OAAO,GAAG,cAAc,GAAG,GAAG,EAAE;AAEnD,UAAM,aAAa,MAAM,KAAK,QAAQ,IAAI,eAAe;AACzD,QAAI,eAAe,KAAK;AACtB,YAAM,KAAK,QAAQ,OAAO,eAAe;AAAA,IAC3C;AAAA,EACF;AAAA,EAEA,MAAM,eAAe,KAA+C;AAClE,UAAM,SAAS,MAAM,KAAK,QAAQ,IAAI,GAAG,cAAc,GAAG,GAAG,EAAE;AAC/D,QAAI,CAAC,OAAQ,QAAO;AAEpB,UAAM,OAAsB,KAAK,MAAM,MAAM;AAC7C,WAAO,IAAI,iBAAiB;AAAA,MAC1B,KAAK,KAAK;AAAA,MACV,SAAS,KAAK;AAAA,MACd,aAAa,KAAK;AAAA,MAClB,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,MAClB,QAAQ,KAAK;AAAA,IACf,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,UAA4C;AAChD,UAAM,MAAM,MAAM,KAAK,QAAQ,IAAI,eAAe;AAClD,QAAI,CAAC,IAAK,QAAO;AACjB,WAAO,KAAK,eAAe,GAAG;AAAA,EAChC;AACF;","names":["body"]}
+{"version":3,"sources":["../src/errors.ts","../src/import-jwk.ts","../src/session.ts","../src/storage.ts","../src/client.ts"],"sourcesContent":["export class HappyViewError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"HappyViewError\";\n  }\n}\n\nexport class ApiError extends HappyViewError {\n  readonly status: number;\n  readonly body: unknown;\n\n  constructor(message: string, status: number, body?: unknown) {\n    super(message);\n    this.name = \"ApiError\";\n    this.status = status;\n    this.body = body;\n  }\n}\n\nexport class AuthenticationError extends HappyViewError {\n  readonly status: number;\n\n  constructor(message: string, status: number = 401) {\n    super(message);\n    this.name = \"AuthenticationError\";\n    this.status = status;\n  }\n}\n\nexport class InvalidStateError extends HappyViewError {\n  constructor(message: string) {\n    super(message);\n    this.name = \"InvalidStateError\";\n  }\n}\n\nexport class TokenExchangeError extends HappyViewError {\n  readonly status: number;\n  readonly body: string;\n\n  constructor(message: string, status: number, body: string) {\n    super(message);\n    this.name = \"TokenExchangeError\";\n    this.status = status;\n    this.body = body;\n  }\n}\n\nexport class ResolutionError extends HappyViewError {\n  constructor(message: string) {\n    super(message);\n    this.name = \"ResolutionError\";\n  }\n}\n","import { WebcryptoKey } from \"@atproto/jwk-webcrypto\";\n\n/**\n * Import a raw ES256 JWK (as returned by HappyView's /oauth/dpop-keys)\n * into a WebcryptoKey that can sign JWTs.\n */\nexport async function importJwk(jwk: JsonWebKey): Promise<WebcryptoKey> {\n  const privateKey = await crypto.subtle.importKey(\n    \"jwk\",\n    jwk,\n    { name: \"ECDSA\", namedCurve: \"P-256\" },\n    true,\n    [\"sign\"],\n  );\n\n  // Derive public key by stripping the private component\n  const { d: _, ...publicJwkFields } = jwk;\n  const publicKey = await crypto.subtle.importKey(\n    \"jwk\",\n    publicJwkFields,\n    { name: \"ECDSA\", namedCurve: \"P-256\" },\n    true,\n    [\"verify\"],\n  );\n\n  return WebcryptoKey.fromKeypair({ privateKey, publicKey });\n}\n","import type { Key } from \"@atproto/jwk\";\n\nexport interface HappyViewSessionOptions {\n  did: string;\n  dpopKey: Key;\n  accessToken: string;\n  clientKey: string;\n  instanceUrl: string;\n  fetch?: typeof globalThis.fetch;\n}\n\nfunction randomHex(byteLength: number): string {\n  const bytes = crypto.getRandomValues(new Uint8Array(byteLength));\n  return Array.from(bytes, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction base64url(buffer: ArrayBuffer): string {\n  const bytes = new Uint8Array(buffer);\n  let binary = \"\";\n  for (let i = 0; i < bytes.length; i++) {\n    binary += String.fromCharCode(bytes[i]);\n  }\n  return btoa(binary)\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/, \"\");\n}\n\nexport class HappyViewSession {\n  readonly did: string;\n\n  private readonly dpopKey: Key;\n  private readonly accessToken: string;\n  private readonly clientKey: string;\n  private readonly instanceUrl: string;\n  private readonly _fetch: typeof globalThis.fetch;\n  private dpopNonce: string | undefined;\n\n  constructor(options: HappyViewSessionOptions) {\n    this.did = options.did;\n    this.dpopKey = options.dpopKey;\n    this.accessToken = options.accessToken;\n    this.clientKey = options.clientKey;\n    this.instanceUrl = options.instanceUrl.replace(/\\/+$/, \"\");\n    this._fetch = options.fetch ?? ((input: RequestInfo | URL, init?: RequestInit) => fetch(input, init)) as typeof globalThis.fetch;\n  }\n\n  async fetchHandler(url: string, init: RequestInit): Promise<Response> {\n    const fullUrl = /^https?:\\/\\//i.test(url)\n      ? url\n      : `${this.instanceUrl}${url}`;\n    const method = (init.method ?? \"GET\").toUpperCase();\n    const htu = fullUrl.split(\"?\")[0];\n\n    const sendWithProof = async (): Promise<Response> => {\n      const tokenHash = await crypto.subtle.digest(\n        \"SHA-256\",\n        new TextEncoder().encode(this.accessToken),\n      );\n      const ath = base64url(tokenHash);\n\n      const proof = await this.dpopKey.createJwt(\n        {\n          alg: \"ES256\",\n          typ: \"dpop+jwt\",\n          jwk: this.dpopKey.publicJwk!,\n        },\n        {\n          htm: method,\n          htu,\n          iat: Math.floor(Date.now() / 1000),\n          jti: randomHex(16),\n          ath,\n          nonce: this.dpopNonce,\n        },\n      );\n\n      const headers = new Headers(init.headers);\n      headers.set(\"authorization\", `DPoP ${this.accessToken}`);\n      headers.set(\"dpop\", proof);\n      headers.set(\"x-client-key\", this.clientKey);\n\n      return this._fetch(fullUrl, { ...init, headers });\n    };\n\n    let response: Response;\n    try {\n      response = await sendWithProof();\n    } catch (e) {\n      const info = `_fetch type: ${typeof this._fetch}, toString: ${String(this._fetch).slice(0, 120)}, url: ${fullUrl}`;\n      throw new Error(`fetchHandler failed: ${(e as Error).message}\\n\\nDEBUG: ${info}`);\n    }\n\n    // Retry once if the server requires a DPoP nonce we didn't have\n    const nonce = response.headers.get(\"dpop-nonce\");\n    if (nonce && nonce !== this.dpopNonce && (response.status === 401 || response.status === 400)) {\n      this.dpopNonce = nonce;\n      try {\n        response = await sendWithProof();\n      } catch (e) {\n        throw new Error(`fetchHandler retry failed: ${(e as Error).message}`);\n      }\n      const retryNonce = response.headers.get(\"dpop-nonce\");\n      if (retryNonce) {\n        this.dpopNonce = retryNonce;\n      }\n    } else if (nonce) {\n      this.dpopNonce = nonce;\n    }\n\n    return response;\n  }\n}\n","import type { StorageAdapter } from \"./types\";\n\nexport class MemoryStorage implements StorageAdapter {\n  private data = new Map<string, string>();\n\n  async get(key: string): Promise<string | null> {\n    return this.data.get(key) ?? null;\n  }\n\n  async set(key: string, value: string): Promise<void> {\n    this.data.set(key, value);\n  }\n\n  async delete(key: string): Promise<void> {\n    this.data.delete(key);\n  }\n}\n","import type { Key } from \"@atproto/jwk\";\nimport { ApiError } from \"./errors\";\nimport { importJwk } from \"./import-jwk\";\nimport { HappyViewSession } from \"./session\";\nimport { MemoryStorage } from \"./storage\";\nimport type {\n  HappyViewOAuthClientOptions,\n  ProvisionKeyResponse,\n  RegisterSessionParams,\n  RegisterSessionResponse,\n  StorageAdapter,\n  StoredSession,\n} from \"./types\";\n\nconst STORAGE_PREFIX = \"happyview:session:\";\nconst LAST_ACTIVE_KEY = \"happyview:last-active-did\";\n\nexport class HappyViewOAuthClient {\n  protected readonly instanceUrl: string;\n  protected readonly clientKey: string;\n  protected readonly storage: StorageAdapter;\n  private readonly clientSecret: string | undefined;\n  protected readonly _fetch: typeof globalThis.fetch;\n\n  constructor(\n    options: HappyViewOAuthClientOptions & {\n      fetch?: typeof globalThis.fetch;\n    },\n  ) {\n    this.instanceUrl = options.instanceUrl.replace(/\\/+$/, \"\");\n    this.clientKey = options.clientKey;\n    this.clientSecret = options.clientSecret;\n    this.storage = options.storage ?? new MemoryStorage();\n    this._fetch = options.fetch ?? ((input: RequestInfo | URL, init?: RequestInit) => fetch(input, init)) as typeof globalThis.fetch;\n  }\n\n  get isConfidential(): boolean {\n    return this.clientSecret !== undefined;\n  }\n\n  async provisionDpopKey(): Promise<{\n    provisionId: string;\n    dpopKey: Key;\n    rawJwk: JsonWebKey;\n    pkceVerifier?: string;\n  }> {\n    const headers: Record<string, string> = {\n      \"content-type\": \"application/json\",\n      \"x-client-key\": this.clientKey,\n    };\n    if (this.clientSecret) {\n      headers[\"x-client-secret\"] = this.clientSecret;\n    }\n\n    const body: Record<string, unknown> = {};\n    let pkceVerifier: string | undefined;\n\n    if (!this.isConfidential) {\n      pkceVerifier = generatePkceVerifier();\n      const challenge = await computePkceChallenge(pkceVerifier);\n      body.pkce_challenge = challenge;\n    }\n\n    const resp = await this._fetch(`${this.instanceUrl}/oauth/dpop-keys`, {\n      method: \"POST\",\n      headers,\n      body: JSON.stringify(body),\n    });\n\n    if (!resp.ok) {\n      const body = await resp.json().catch(() => ({}));\n      throw new ApiError(\n        `Failed to provision DPoP key: ${resp.status} ${(body as any).message ?? resp.statusText}`,\n        resp.status,\n        body,\n      );\n    }\n\n    const data: ProvisionKeyResponse = await resp.json();\n    const dpopKey = await importJwk(data.dpop_key);\n    return {\n      provisionId: data.provision_id,\n      dpopKey,\n      rawJwk: data.dpop_key,\n      pkceVerifier,\n    };\n  }\n\n  async registerSession(\n    params: RegisterSessionParams,\n  ): Promise<HappyViewSession> {\n    const headers: Record<string, string> = {\n      \"content-type\": \"application/json\",\n      \"x-client-key\": this.clientKey,\n    };\n    if (this.clientSecret) {\n      headers[\"x-client-secret\"] = this.clientSecret;\n    }\n\n    const body: Record<string, unknown> = {\n      provision_id: params.provisionId,\n      did: params.did,\n      access_token: params.accessToken,\n      refresh_token: params.refreshToken,\n      scopes: params.scopes,\n      pds_url: params.pdsUrl,\n      issuer: params.issuer,\n    };\n\n    if (!this.isConfidential && params.pkceVerifier) {\n      body.pkce_verifier = params.pkceVerifier;\n    }\n\n    const resp = await this._fetch(`${this.instanceUrl}/oauth/sessions`, {\n      method: \"POST\",\n      headers,\n      body: JSON.stringify(body),\n    });\n\n    if (!resp.ok) {\n      const body = await resp.json().catch(() => ({}));\n      throw new ApiError(\n        `Failed to register session: ${resp.status} ${(body as any).message ?? resp.statusText}`,\n        resp.status,\n        body,\n      );\n    }\n\n    const data: RegisterSessionResponse = await resp.json();\n    const dpopKey = await importJwk(params.dpopKey);\n\n    const storedSession: StoredSession = {\n      did: data.did,\n      dpopKey: params.dpopKey,\n      accessToken: params.accessToken,\n      clientKey: this.clientKey,\n      instanceUrl: this.instanceUrl,\n    };\n    await this.storage.set(\n      `${STORAGE_PREFIX}${data.did}`,\n      JSON.stringify(storedSession),\n    );\n    await this.storage.set(LAST_ACTIVE_KEY, data.did);\n\n    return new HappyViewSession({\n      did: data.did,\n      dpopKey,\n      accessToken: params.accessToken,\n      clientKey: this.clientKey,\n      instanceUrl: this.instanceUrl,\n      fetch: this._fetch,\n    });\n  }\n\n  async deleteSession(did: string): Promise<void> {\n    const session = await this.restoreSession(did);\n    if (session) {\n      const resp = await session.fetchHandler(\n        `${this.instanceUrl}/oauth/sessions/${did}`,\n        { method: \"DELETE\" },\n      );\n\n      if (!resp.ok && resp.status !== 404) {\n        const body = await resp.json().catch(() => ({}));\n        throw new ApiError(\n          `Failed to delete session: ${resp.status} ${(body as any).message ?? resp.statusText}`,\n          resp.status,\n          body,\n        );\n      }\n    }\n\n    await this.storage.delete(`${STORAGE_PREFIX}${did}`);\n\n    const lastActive = await this.storage.get(LAST_ACTIVE_KEY);\n    if (lastActive === did) {\n      await this.storage.delete(LAST_ACTIVE_KEY);\n    }\n  }\n\n  async restoreSession(did: string): Promise<HappyViewSession | null> {\n    const stored = await this.storage.get(`${STORAGE_PREFIX}${did}`);\n    if (!stored) return null;\n\n    const data: StoredSession = JSON.parse(stored);\n    const dpopKey = await importJwk(data.dpopKey);\n    return new HappyViewSession({\n      did: data.did,\n      dpopKey,\n      accessToken: data.accessToken,\n      clientKey: data.clientKey,\n      instanceUrl: data.instanceUrl,\n      fetch: this._fetch,\n    });\n  }\n\n  async restore(): Promise<HappyViewSession | null> {\n    const did = await this.storage.get(LAST_ACTIVE_KEY);\n    if (!did) return null;\n    return this.restoreSession(did);\n  }\n}\n\n// PKCE helpers — inline since they're just a few lines of Web Crypto\nfunction generatePkceVerifier(): string {\n  const bytes = crypto.getRandomValues(new Uint8Array(32));\n  let binary = \"\";\n  for (let i = 0; i < bytes.length; i++) {\n    binary += String.fromCharCode(bytes[i]);\n  }\n  return btoa(binary)\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/, \"\");\n}\n\nasync function computePkceChallenge(verifier: string): Promise<string> {\n  const hash = await crypto.subtle.digest(\n    \"SHA-256\",\n    new TextEncoder().encode(verifier),\n  );\n  const bytes = new Uint8Array(hash);\n  let binary = \"\";\n  for (let i = 0; i < bytes.length; i++) {\n    binary += String.fromCharCode(bytes[i]);\n  }\n  return btoa(binary)\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/, \"\");\n}\n"],"mappings":";AAAO,IAAM,iBAAN,cAA6B,MAAM;AAAA,EACxC,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,WAAN,cAAuB,eAAe;AAAA,EAClC;AAAA,EACA;AAAA,EAET,YAAY,SAAiB,QAAgB,MAAgB;AAC3D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,sBAAN,cAAkC,eAAe;AAAA,EAC7C;AAAA,EAET,YAAY,SAAiB,SAAiB,KAAK;AACjD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AACF;AAEO,IAAM,oBAAN,cAAgC,eAAe;AAAA,EACpD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,qBAAN,cAAiC,eAAe;AAAA,EAC5C;AAAA,EACA;AAAA,EAET,YAAY,SAAiB,QAAgB,MAAc;AACzD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,kBAAN,cAA8B,eAAe;AAAA,EAClD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;;;ACrDA,SAAS,oBAAoB;AAM7B,eAAsB,UAAU,KAAwC;AACtE,QAAM,aAAa,MAAM,OAAO,OAAO;AAAA,IACrC;AAAA,IACA;AAAA,IACA,EAAE,MAAM,SAAS,YAAY,QAAQ;AAAA,IACrC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AAGA,QAAM,EAAE,GAAG,GAAG,GAAG,gBAAgB,IAAI;AACrC,QAAM,YAAY,MAAM,OAAO,OAAO;AAAA,IACpC;AAAA,IACA;AAAA,IACA,EAAE,MAAM,SAAS,YAAY,QAAQ;AAAA,IACrC;AAAA,IACA,CAAC,QAAQ;AAAA,EACX;AAEA,SAAO,aAAa,YAAY,EAAE,YAAY,UAAU,CAAC;AAC3D;;;ACfA,SAAS,UAAU,YAA4B;AAC7C,QAAM,QAAQ,OAAO,gBAAgB,IAAI,WAAW,UAAU,CAAC;AAC/D,SAAO,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAC1E;AAEA,SAAS,UAAU,QAA6B;AAC9C,QAAM,QAAQ,IAAI,WAAW,MAAM;AACnC,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EACxC;AACA,SAAO,KAAK,MAAM,EACf,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AACtB;AAEO,IAAM,mBAAN,MAAuB;AAAA,EACnB;AAAA,EAEQ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACT;AAAA,EAER,YAAY,SAAkC;AAC5C,SAAK,MAAM,QAAQ;AACnB,SAAK,UAAU,QAAQ;AACvB,SAAK,cAAc,QAAQ;AAC3B,SAAK,YAAY,QAAQ;AACzB,SAAK,cAAc,QAAQ,YAAY,QAAQ,QAAQ,EAAE;AACzD,SAAK,SAAS,QAAQ,UAAU,CAAC,OAA0B,SAAuB,MAAM,OAAO,IAAI;AAAA,EACrG;AAAA,EAEA,MAAM,aAAa,KAAa,MAAsC;AACpE,UAAM,UAAU,gBAAgB,KAAK,GAAG,IACpC,MACA,GAAG,KAAK,WAAW,GAAG,GAAG;AAC7B,UAAM,UAAU,KAAK,UAAU,OAAO,YAAY;AAClD,UAAM,MAAM,QAAQ,MAAM,GAAG,EAAE,CAAC;AAEhC,UAAM,gBAAgB,YAA+B;AACnD,YAAM,YAAY,MAAM,OAAO,OAAO;AAAA,QACpC;AAAA,QACA,IAAI,YAAY,EAAE,OAAO,KAAK,WAAW;AAAA,MAC3C;AACA,YAAM,MAAM,UAAU,SAAS;AAE/B,YAAM,QAAQ,MAAM,KAAK,QAAQ;AAAA,QAC/B;AAAA,UACE,KAAK;AAAA,UACL,KAAK;AAAA,UACL,KAAK,KAAK,QAAQ;AAAA,QACpB;AAAA,QACA;AAAA,UACE,KAAK;AAAA,UACL;AAAA,UACA,KAAK,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAAA,UACjC,KAAK,UAAU,EAAE;AAAA,UACjB;AAAA,UACA,OAAO,KAAK;AAAA,QACd;AAAA,MACF;AAEA,YAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;AACxC,cAAQ,IAAI,iBAAiB,QAAQ,KAAK,WAAW,EAAE;AACvD,cAAQ,IAAI,QAAQ,KAAK;AACzB,cAAQ,IAAI,gBAAgB,KAAK,SAAS;AAE1C,aAAO,KAAK,OAAO,SAAS,EAAE,GAAG,MAAM,QAAQ,CAAC;AAAA,IAClD;AAEA,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,cAAc;AAAA,IACjC,SAAS,GAAG;AACV,YAAM,OAAO,gBAAgB,OAAO,KAAK,MAAM,eAAe,OAAO,KAAK,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC,UAAU,OAAO;AAChH,YAAM,IAAI,MAAM,wBAAyB,EAAY,OAAO;AAAA;AAAA,SAAc,IAAI,EAAE;AAAA,IAClF;AAGA,UAAM,QAAQ,SAAS,QAAQ,IAAI,YAAY;AAC/C,QAAI,SAAS,UAAU,KAAK,cAAc,SAAS,WAAW,OAAO,SAAS,WAAW,MAAM;AAC7F,WAAK,YAAY;AACjB,UAAI;AACF,mBAAW,MAAM,cAAc;AAAA,MACjC,SAAS,GAAG;AACV,cAAM,IAAI,MAAM,8BAA+B,EAAY,OAAO,EAAE;AAAA,MACtE;AACA,YAAM,aAAa,SAAS,QAAQ,IAAI,YAAY;AACpD,UAAI,YAAY;AACd,aAAK,YAAY;AAAA,MACnB;AAAA,IACF,WAAW,OAAO;AAChB,WAAK,YAAY;AAAA,IACnB;AAEA,WAAO;AAAA,EACT;AACF;;;AC9GO,IAAM,gBAAN,MAA8C;AAAA,EAC3C,OAAO,oBAAI,IAAoB;AAAA,EAEvC,MAAM,IAAI,KAAqC;AAC7C,WAAO,KAAK,KAAK,IAAI,GAAG,KAAK;AAAA,EAC/B;AAAA,EAEA,MAAM,IAAI,KAAa,OAA8B;AACnD,SAAK,KAAK,IAAI,KAAK,KAAK;AAAA,EAC1B;AAAA,EAEA,MAAM,OAAO,KAA4B;AACvC,SAAK,KAAK,OAAO,GAAG;AAAA,EACtB;AACF;;;ACFA,IAAM,iBAAiB;AACvB,IAAM,kBAAkB;AAEjB,IAAM,uBAAN,MAA2B;AAAA,EACb;AAAA,EACA;AAAA,EACA;AAAA,EACF;AAAA,EACE;AAAA,EAEnB,YACE,SAGA;AACA,SAAK,cAAc,QAAQ,YAAY,QAAQ,QAAQ,EAAE;AACzD,SAAK,YAAY,QAAQ;AACzB,SAAK,eAAe,QAAQ;AAC5B,SAAK,UAAU,QAAQ,WAAW,IAAI,cAAc;AACpD,SAAK,SAAS,QAAQ,UAAU,CAAC,OAA0B,SAAuB,MAAM,OAAO,IAAI;AAAA,EACrG;AAAA,EAEA,IAAI,iBAA0B;AAC5B,WAAO,KAAK,iBAAiB;AAAA,EAC/B;AAAA,EAEA,MAAM,mBAKH;AACD,UAAM,UAAkC;AAAA,MACtC,gBAAgB;AAAA,MAChB,gBAAgB,KAAK;AAAA,IACvB;AACA,QAAI,KAAK,cAAc;AACrB,cAAQ,iBAAiB,IAAI,KAAK;AAAA,IACpC;AAEA,UAAM,OAAgC,CAAC;AACvC,QAAI;AAEJ,QAAI,CAAC,KAAK,gBAAgB;AACxB,qBAAe,qBAAqB;AACpC,YAAM,YAAY,MAAM,qBAAqB,YAAY;AACzD,WAAK,iBAAiB;AAAA,IACxB;AAEA,UAAM,OAAO,MAAM,KAAK,OAAO,GAAG,KAAK,WAAW,oBAAoB;AAAA,MACpE,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAED,QAAI,CAAC,KAAK,IAAI;AACZ,YAAMA,QAAO,MAAM,KAAK,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,YAAM,IAAI;AAAA,QACR,iCAAiC,KAAK,MAAM,IAAKA,MAAa,WAAW,KAAK,UAAU;AAAA,QACxF,KAAK;AAAA,QACLA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,OAA6B,MAAM,KAAK,KAAK;AACnD,UAAM,UAAU,MAAM,UAAU,KAAK,QAAQ;AAC7C,WAAO;AAAA,MACL,aAAa,KAAK;AAAA,MAClB;AAAA,MACA,QAAQ,KAAK;AAAA,MACb;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,gBACJ,QAC2B;AAC3B,UAAM,UAAkC;AAAA,MACtC,gBAAgB;AAAA,MAChB,gBAAgB,KAAK;AAAA,IACvB;AACA,QAAI,KAAK,cAAc;AACrB,cAAQ,iBAAiB,IAAI,KAAK;AAAA,IACpC;AAEA,UAAM,OAAgC;AAAA,MACpC,cAAc,OAAO;AAAA,MACrB,KAAK,OAAO;AAAA,MACZ,cAAc,OAAO;AAAA,MACrB,eAAe,OAAO;AAAA,MACtB,QAAQ,OAAO;AAAA,MACf,SAAS,OAAO;AAAA,MAChB,QAAQ,OAAO;AAAA,IACjB;AAEA,QAAI,CAAC,KAAK,kBAAkB,OAAO,cAAc;AAC/C,WAAK,gBAAgB,OAAO;AAAA,IAC9B;AAEA,UAAM,OAAO,MAAM,KAAK,OAAO,GAAG,KAAK,WAAW,mBAAmB;AAAA,MACnE,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAED,QAAI,CAAC,KAAK,IAAI;AACZ,YAAMA,QAAO,MAAM,KAAK,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,YAAM,IAAI;AAAA,QACR,+BAA+B,KAAK,MAAM,IAAKA,MAAa,WAAW,KAAK,UAAU;AAAA,QACtF,KAAK;AAAA,QACLA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,OAAgC,MAAM,KAAK,KAAK;AACtD,UAAM,UAAU,MAAM,UAAU,OAAO,OAAO;AAE9C,UAAM,gBAA+B;AAAA,MACnC,KAAK,KAAK;AAAA,MACV,SAAS,OAAO;AAAA,MAChB,aAAa,OAAO;AAAA,MACpB,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,IACpB;AACA,UAAM,KAAK,QAAQ;AAAA,MACjB,GAAG,cAAc,GAAG,KAAK,GAAG;AAAA,MAC5B,KAAK,UAAU,aAAa;AAAA,IAC9B;AACA,UAAM,KAAK,QAAQ,IAAI,iBAAiB,KAAK,GAAG;AAEhD,WAAO,IAAI,iBAAiB;AAAA,MAC1B,KAAK,KAAK;AAAA,MACV;AAAA,MACA,aAAa,OAAO;AAAA,MACpB,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,MAClB,OAAO,KAAK;AAAA,IACd,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,cAAc,KAA4B;AAC9C,UAAM,UAAU,MAAM,KAAK,eAAe,GAAG;AAC7C,QAAI,SAAS;AACX,YAAM,OAAO,MAAM,QAAQ;AAAA,QACzB,GAAG,KAAK,WAAW,mBAAmB,GAAG;AAAA,QACzC,EAAE,QAAQ,SAAS;AAAA,MACrB;AAEA,UAAI,CAAC,KAAK,MAAM,KAAK,WAAW,KAAK;AACnC,cAAM,OAAO,MAAM,KAAK,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,cAAM,IAAI;AAAA,UACR,6BAA6B,KAAK,MAAM,IAAK,KAAa,WAAW,KAAK,UAAU;AAAA,UACpF,KAAK;AAAA,UACL;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,KAAK,QAAQ,OAAO,GAAG,cAAc,GAAG,GAAG,EAAE;AAEnD,UAAM,aAAa,MAAM,KAAK,QAAQ,IAAI,eAAe;AACzD,QAAI,eAAe,KAAK;AACtB,YAAM,KAAK,QAAQ,OAAO,eAAe;AAAA,IAC3C;AAAA,EACF;AAAA,EAEA,MAAM,eAAe,KAA+C;AAClE,UAAM,SAAS,MAAM,KAAK,QAAQ,IAAI,GAAG,cAAc,GAAG,GAAG,EAAE;AAC/D,QAAI,CAAC,OAAQ,QAAO;AAEpB,UAAM,OAAsB,KAAK,MAAM,MAAM;AAC7C,UAAM,UAAU,MAAM,UAAU,KAAK,OAAO;AAC5C,WAAO,IAAI,iBAAiB;AAAA,MAC1B,KAAK,KAAK;AAAA,MACV;AAAA,MACA,aAAa,KAAK;AAAA,MAClB,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,MAClB,OAAO,KAAK;AAAA,IACd,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,UAA4C;AAChD,UAAM,MAAM,MAAM,KAAK,QAAQ,IAAI,eAAe;AAClD,QAAI,CAAC,IAAK,QAAO;AACjB,WAAO,KAAK,eAAe,GAAG;AAAA,EAChC;AACF;AAGA,SAAS,uBAA+B;AACtC,QAAM,QAAQ,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AACvD,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EACxC;AACA,SAAO,KAAK,MAAM,EACf,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AACtB;AAEA,eAAe,qBAAqB,UAAmC;AACrE,QAAM,OAAO,MAAM,OAAO,OAAO;AAAA,IAC/B;AAAA,IACA,IAAI,YAAY,EAAE,OAAO,QAAQ;AAAA,EACnC;AACA,QAAM,QAAQ,IAAI,WAAW,IAAI;AACjC,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EACxC;AACA,SAAO,KAAK,MAAM,EACf,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AACtB;","names":["body"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@happyview/oauth-client",
-  "version": "1.0.0-dev.2",
+  "version": "1.0.1",
   "description": "HappyView OAuth client for ATProto DPoP authentication",
   "license": "MIT",
   "repository": {
@@ -8,6 +8,8 @@
     "url": "https://github.com/gamesgamesgamesgamesgames/happyview.git",
     "directory": "packages/oauth-client"
   },
+  "bugs": "https://github.com/gamesgamesgamesgamesgames/happyview/issues",
+  "homepage": "https://happyview.dev",
   "publishConfig": {
     "access": "public"
   },
@@ -30,6 +32,10 @@
     "test": "bun test",
     "typecheck": "tsc --noEmit"
   },
+  "dependencies": {
+    "@atproto/jwk": "^0.6.0",
+    "@atproto/jwk-webcrypto": "^0.2.0"
+  },
   "devDependencies": {
     "@semantic-release/commit-analyzer": "^13.0.1",
     "@semantic-release/github": "^12.0.6",