@happyview/oauth-client 1.1.0-dev.1 → 1.1.0-dev.2

package/dist/index.cjs

@@ -15,6 +15,7 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget && __copyProps(secondTarget, mod, "default"));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/index.ts
@@ -28,11 +29,14 @@ __export(index_exports, {
   InvalidStateError: () => InvalidStateError,
   LAST_ACTIVE_KEY: () => LAST_ACTIVE_KEY,
   MemoryStorage: () => MemoryStorage,
+  OAuthCallbackError: () => OAuthCallbackError,
   ResolutionError: () => ResolutionError,
   TokenExchangeError: () => TokenExchangeError,
   importJwk: () => importJwk
 });
 module.exports = __toCommonJS(index_exports);
+__reExport(index_exports, require("@atproto/jwk"), module.exports);
+__reExport(index_exports, require("@atproto/jwk-webcrypto"), module.exports);
 
 // src/errors.ts
 var HappyViewError = class extends Error {
@@ -81,6 +85,26 @@ var ResolutionError = class extends HappyViewError {
     this.name = "ResolutionError";
   }
 };
+var OAuthCallbackError = class _OAuthCallbackError extends HappyViewError {
+  params;
+  state;
+  static from(err, params, state) {
+    if (err instanceof _OAuthCallbackError) return err;
+    const message = err instanceof Error ? err.message : void 0;
+    return new _OAuthCallbackError(params, message, state, err);
+  }
+  constructor(params, message, state, cause) {
+    super(
+      message ?? params.get("error_description") ?? "OAuth callback error"
+    );
+    this.name = "OAuthCallbackError";
+    this.params = params;
+    this.state = state;
+    if (cause !== void 0) {
+      this.cause = cause;
+    }
+  }
+};
 
 // src/import-jwk.ts
 var import_jwk_webcrypto = require("@atproto/jwk-webcrypto");
@@ -122,7 +146,11 @@ var HappyViewSession = class {
   accessToken;
   clientKey;
   instanceUrl;
+  _scopes;
+  _pdsUrl;
+  _issuer;
   _fetch;
+  _onSignOut;
   dpopNonce;
   constructor(options) {
     this.did = options.did;
@@ -130,7 +158,27 @@ var HappyViewSession = class {
     this.accessToken = options.accessToken;
     this.clientKey = options.clientKey;
     this.instanceUrl = options.instanceUrl.replace(/\/+$/, "");
+    this._scopes = options.scopes;
+    this._pdsUrl = options.pdsUrl;
+    this._issuer = options.issuer;
     this._fetch = options.fetch ?? ((input, init) => fetch(input, init));
+    this._onSignOut = options.onSignOut;
+  }
+  get sub() {
+    return this.did;
+  }
+  getTokenInfo() {
+    return {
+      scope: this._scopes,
+      iss: this._issuer,
+      aud: this._pdsUrl,
+      sub: this.did
+    };
+  }
+  async signOut() {
+    if (this._onSignOut) {
+      await this._onSignOut();
+    }
   }
   async fetchHandler(url, init) {
     const fullUrl = /^https?:\/\//i.test(url) ? url : `${this.instanceUrl}${url}`;
@@ -209,17 +257,37 @@ var MemoryStorage = class {
 var STORAGE_PREFIX = "happyview:session:";
 var LAST_ACTIVE_KEY = "happyview:last-active-did";
 var HappyViewOAuthClient = class {
+  static async fetchMetadata({
+    clientId,
+    fetch: fetchFn = globalThis.fetch,
+    signal
+  }) {
+    signal?.throwIfAborted();
+    const resp = await fetchFn(clientId, { redirect: "error", signal });
+    if (resp.status !== 200) {
+      resp.body?.cancel?.();
+      throw new Error(`Failed to fetch client metadata: ${resp.status}`);
+    }
+    const mime = resp.headers.get("content-type")?.split(";")[0].trim();
+    if (mime !== "application/json") {
+      resp.body?.cancel?.();
+      throw new Error(`Invalid client metadata content type: ${mime}`);
+    }
+    return resp.json();
+  }
   instanceUrl;
   clientKey;
   storage;
   clientSecret;
   _fetch;
+  sessionHooks;
   constructor(options) {
     this.instanceUrl = options.instanceUrl.replace(/\/+$/, "");
     this.clientKey = options.clientKey;
     this.clientSecret = options.clientSecret;
     this.storage = options.storage ?? new MemoryStorage();
     this._fetch = options.fetch ?? ((input, init) => fetch(input, init));
+    this.sessionHooks = options.sessionHooks ?? {};
   }
   get isConfidential() {
     return this.clientSecret !== void 0;
@@ -301,21 +369,30 @@ var HappyViewOAuthClient = class {
       dpopKey: params.dpopKey,
       accessToken: params.accessToken,
       clientKey: this.clientKey,
-      instanceUrl: this.instanceUrl
+      instanceUrl: this.instanceUrl,
+      scopes: params.scopes,
+      pdsUrl: params.pdsUrl,
+      issuer: params.issuer
     };
     await this.storage.set(
       `${STORAGE_PREFIX}${data.did}`,
       JSON.stringify(storedSession)
     );
     await this.storage.set(LAST_ACTIVE_KEY, data.did);
-    return new HappyViewSession({
+    const session = new HappyViewSession({
       did: data.did,
       dpopKey,
       accessToken: params.accessToken,
       clientKey: this.clientKey,
       instanceUrl: this.instanceUrl,
-      fetch: this._fetch
+      scopes: params.scopes,
+      pdsUrl: params.pdsUrl,
+      issuer: params.issuer,
+      fetch: this._fetch,
+      onSignOut: () => this.deleteSession(data.did)
     });
+    this.sessionHooks.onSessionUpdate?.(data.did);
+    return session;
   }
   async deleteSession(did) {
     const session = await this.restoreSession(did);
@@ -338,6 +415,7 @@ var HappyViewOAuthClient = class {
     if (lastActive === did) {
       await this.storage.delete(LAST_ACTIVE_KEY);
     }
+    this.sessionHooks.onSessionDelete?.(did);
   }
   async restoreSession(did) {
     const stored = await this.storage.get(`${STORAGE_PREFIX}${did}`);
@@ -350,7 +428,11 @@ var HappyViewOAuthClient = class {
       accessToken: data.accessToken,
       clientKey: data.clientKey,
       instanceUrl: data.instanceUrl,
-      fetch: this._fetch
+      scopes: data.scopes,
+      pdsUrl: data.pdsUrl,
+      issuer: data.issuer,
+      fetch: this._fetch,
+      onSignOut: () => this.deleteSession(data.did)
     });
   }
   async restore() {
@@ -389,8 +471,11 @@ async function computePkceChallenge(verifier) {
   InvalidStateError,
   LAST_ACTIVE_KEY,
   MemoryStorage,
+  OAuthCallbackError,
   ResolutionError,
   TokenExchangeError,
-  importJwk
+  importJwk,
+  ...require("@atproto/jwk"),
+  ...require("@atproto/jwk-webcrypto")
 });
 //# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/errors.ts","../src/import-jwk.ts","../src/session.ts","../src/storage.ts","../src/client.ts"],"sourcesContent":["export { HappyViewOAuthClient, LAST_ACTIVE_KEY } from \"./client\";\nexport { importJwk } from \"./import-jwk\";\nexport {\n  ApiError,\n  AuthenticationError,\n  HappyViewError,\n  InvalidStateError,\n  ResolutionError,\n  TokenExchangeError,\n} from \"./errors\";\nexport { HappyViewSession } from \"./session\";\nexport type { HappyViewSessionOptions } from \"./session\";\nexport { MemoryStorage } from \"./storage\";\nexport type {\n  DpopProvision,\n  HappyViewOAuthClientOptions,\n  ProvisionKeyResponse,\n  RegisterSessionParams,\n  RegisterSessionResponse,\n  StorageAdapter,\n  StoredSession,\n} from \"./types\";\n","export class HappyViewError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"HappyViewError\";\n  }\n}\n\nexport class ApiError extends HappyViewError {\n  readonly status: number;\n  readonly body: unknown;\n\n  constructor(message: string, status: number, body?: unknown) {\n    super(message);\n    this.name = \"ApiError\";\n    this.status = status;\n    this.body = body;\n  }\n}\n\nexport class AuthenticationError extends HappyViewError {\n  readonly status: number;\n\n  constructor(message: string, status: number = 401) {\n    super(message);\n    this.name = \"AuthenticationError\";\n    this.status = status;\n  }\n}\n\nexport class InvalidStateError extends HappyViewError {\n  constructor(message: string) {\n    super(message);\n    this.name = \"InvalidStateError\";\n  }\n}\n\nexport class TokenExchangeError extends HappyViewError {\n  readonly status: number;\n  readonly body: string;\n\n  constructor(message: string, status: number, body: string) {\n    super(message);\n    this.name = \"TokenExchangeError\";\n    this.status = status;\n    this.body = body;\n  }\n}\n\nexport class ResolutionError extends HappyViewError {\n  constructor(message: string) {\n    super(message);\n    this.name = \"ResolutionError\";\n  }\n}\n","import { WebcryptoKey } from \"@atproto/jwk-webcrypto\";\n\n/**\n * Import a raw ES256 JWK (as returned by HappyView's /oauth/dpop-keys)\n * into a WebcryptoKey that can sign JWTs.\n */\nexport async function importJwk(jwk: JsonWebKey): Promise<WebcryptoKey> {\n  const privateKey = await crypto.subtle.importKey(\n    \"jwk\",\n    jwk,\n    { name: \"ECDSA\", namedCurve: \"P-256\" },\n    true,\n    [\"sign\"],\n  );\n\n  // Derive public key by stripping the private component\n  const { d: _, ...publicJwkFields } = jwk;\n  const publicKey = await crypto.subtle.importKey(\n    \"jwk\",\n    publicJwkFields,\n    { name: \"ECDSA\", namedCurve: \"P-256\" },\n    true,\n    [\"verify\"],\n  );\n\n  return WebcryptoKey.fromKeypair({ privateKey, publicKey });\n}\n","import type { Key } from \"@atproto/jwk\";\n\nexport interface HappyViewSessionOptions {\n  did: string;\n  dpopKey: Key;\n  accessToken: string;\n  clientKey: string;\n  instanceUrl: string;\n  fetch?: typeof globalThis.fetch;\n}\n\nfunction randomHex(byteLength: number): string {\n  const bytes = crypto.getRandomValues(new Uint8Array(byteLength));\n  return Array.from(bytes, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction base64url(buffer: ArrayBuffer): string {\n  const bytes = new Uint8Array(buffer);\n  let binary = \"\";\n  for (let i = 0; i < bytes.length; i++) {\n    binary += String.fromCharCode(bytes[i]);\n  }\n  return btoa(binary)\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/, \"\");\n}\n\nexport class HappyViewSession {\n  readonly did: string;\n\n  private readonly dpopKey: Key;\n  private readonly accessToken: string;\n  private readonly clientKey: string;\n  private readonly instanceUrl: string;\n  private readonly _fetch: typeof globalThis.fetch;\n  private dpopNonce: string | undefined;\n\n  constructor(options: HappyViewSessionOptions) {\n    this.did = options.did;\n    this.dpopKey = options.dpopKey;\n    this.accessToken = options.accessToken;\n    this.clientKey = options.clientKey;\n    this.instanceUrl = options.instanceUrl.replace(/\\/+$/, \"\");\n    this._fetch = options.fetch ?? ((input: RequestInfo | URL, init?: RequestInit) => fetch(input, init)) as typeof globalThis.fetch;\n  }\n\n  async fetchHandler(url: string, init: RequestInit): Promise<Response> {\n    const fullUrl = /^https?:\\/\\//i.test(url)\n      ? url\n      : `${this.instanceUrl}${url}`;\n    const method = (init.method ?? \"GET\").toUpperCase();\n    const htu = fullUrl.split(\"?\")[0];\n\n    const sendWithProof = async (): Promise<Response> => {\n      const tokenHash = await crypto.subtle.digest(\n        \"SHA-256\",\n        new TextEncoder().encode(this.accessToken),\n      );\n      const ath = base64url(tokenHash);\n\n      const proof = await this.dpopKey.createJwt(\n        {\n          alg: \"ES256\",\n          typ: \"dpop+jwt\",\n          jwk: this.dpopKey.publicJwk!,\n        },\n        {\n          htm: method,\n          htu,\n          iat: Math.floor(Date.now() / 1000),\n          jti: randomHex(16),\n          ath,\n          nonce: this.dpopNonce,\n        },\n      );\n\n      const headers = new Headers(init.headers);\n      headers.set(\"authorization\", `DPoP ${this.accessToken}`);\n      headers.set(\"dpop\", proof);\n      headers.set(\"x-client-key\", this.clientKey);\n\n      return this._fetch(fullUrl, { ...init, headers });\n    };\n\n    let response: Response;\n    try {\n      response = await sendWithProof();\n    } catch (e) {\n      const info = `_fetch type: ${typeof this._fetch}, toString: ${String(this._fetch).slice(0, 120)}, url: ${fullUrl}`;\n      throw new Error(`fetchHandler failed: ${(e as Error).message}\\n\\nDEBUG: ${info}`);\n    }\n\n    // Retry once if the server requires a DPoP nonce we didn't have\n    const nonce = response.headers.get(\"dpop-nonce\");\n    if (nonce && nonce !== this.dpopNonce && (response.status === 401 || response.status === 400)) {\n      this.dpopNonce = nonce;\n      try {\n        response = await sendWithProof();\n      } catch (e) {\n        throw new Error(`fetchHandler retry failed: ${(e as Error).message}`);\n      }\n      const retryNonce = response.headers.get(\"dpop-nonce\");\n      if (retryNonce) {\n        this.dpopNonce = retryNonce;\n      }\n    } else if (nonce) {\n      this.dpopNonce = nonce;\n    }\n\n    return response;\n  }\n}\n","import type { StorageAdapter } from \"./types\";\n\nexport class MemoryStorage implements StorageAdapter {\n  private data = new Map<string, string>();\n\n  async get(key: string): Promise<string | null> {\n    return this.data.get(key) ?? null;\n  }\n\n  async set(key: string, value: string): Promise<void> {\n    this.data.set(key, value);\n  }\n\n  async delete(key: string): Promise<void> {\n    this.data.delete(key);\n  }\n}\n","import type { Key } from \"@atproto/jwk\";\nimport { ApiError } from \"./errors\";\nimport { importJwk } from \"./import-jwk\";\nimport { HappyViewSession } from \"./session\";\nimport { MemoryStorage } from \"./storage\";\nimport type {\n  HappyViewOAuthClientOptions,\n  ProvisionKeyResponse,\n  RegisterSessionParams,\n  RegisterSessionResponse,\n  StorageAdapter,\n  StoredSession,\n} from \"./types\";\n\nconst STORAGE_PREFIX = \"happyview:session:\";\nexport const LAST_ACTIVE_KEY = \"happyview:last-active-did\";\n\nexport class HappyViewOAuthClient {\n  protected readonly instanceUrl: string;\n  protected readonly clientKey: string;\n  protected readonly storage: StorageAdapter;\n  private readonly clientSecret: string | undefined;\n  protected readonly _fetch: typeof globalThis.fetch;\n\n  constructor(\n    options: HappyViewOAuthClientOptions & {\n      fetch?: typeof globalThis.fetch;\n    },\n  ) {\n    this.instanceUrl = options.instanceUrl.replace(/\\/+$/, \"\");\n    this.clientKey = options.clientKey;\n    this.clientSecret = options.clientSecret;\n    this.storage = options.storage ?? new MemoryStorage();\n    this._fetch = options.fetch ?? ((input: RequestInfo | URL, init?: RequestInit) => fetch(input, init)) as typeof globalThis.fetch;\n  }\n\n  get isConfidential(): boolean {\n    return this.clientSecret !== undefined;\n  }\n\n  async provisionDpopKey(): Promise<{\n    provisionId: string;\n    dpopKey: Key;\n    rawJwk: JsonWebKey;\n    pkceVerifier?: string;\n  }> {\n    const headers: Record<string, string> = {\n      \"content-type\": \"application/json\",\n      \"x-client-key\": this.clientKey,\n    };\n    if (this.clientSecret) {\n      headers[\"x-client-secret\"] = this.clientSecret;\n    }\n\n    const body: Record<string, unknown> = {};\n    let pkceVerifier: string | undefined;\n\n    if (!this.isConfidential) {\n      pkceVerifier = generatePkceVerifier();\n      const challenge = await computePkceChallenge(pkceVerifier);\n      body.pkce_challenge = challenge;\n    }\n\n    const resp = await this._fetch(`${this.instanceUrl}/oauth/dpop-keys`, {\n      method: \"POST\",\n      headers,\n      body: JSON.stringify(body),\n    });\n\n    if (!resp.ok) {\n      const body = await resp.json().catch(() => ({}));\n      throw new ApiError(\n        `Failed to provision DPoP key: ${resp.status} ${(body as any).message ?? resp.statusText}`,\n        resp.status,\n        body,\n      );\n    }\n\n    const data: ProvisionKeyResponse = await resp.json();\n    const dpopKey = await importJwk(data.dpop_key);\n    return {\n      provisionId: data.provision_id,\n      dpopKey,\n      rawJwk: data.dpop_key,\n      pkceVerifier,\n    };\n  }\n\n  async registerSession(\n    params: RegisterSessionParams,\n  ): Promise<HappyViewSession> {\n    const headers: Record<string, string> = {\n      \"content-type\": \"application/json\",\n      \"x-client-key\": this.clientKey,\n    };\n    if (this.clientSecret) {\n      headers[\"x-client-secret\"] = this.clientSecret;\n    }\n\n    const body: Record<string, unknown> = {\n      provision_id: params.provisionId,\n      did: params.did,\n      access_token: params.accessToken,\n      refresh_token: params.refreshToken,\n      scopes: params.scopes,\n      pds_url: params.pdsUrl,\n      issuer: params.issuer,\n    };\n\n    if (!this.isConfidential && params.pkceVerifier) {\n      body.pkce_verifier = params.pkceVerifier;\n    }\n\n    const resp = await this._fetch(`${this.instanceUrl}/oauth/sessions`, {\n      method: \"POST\",\n      headers,\n      body: JSON.stringify(body),\n    });\n\n    if (!resp.ok) {\n      const body = await resp.json().catch(() => ({}));\n      throw new ApiError(\n        `Failed to register session: ${resp.status} ${(body as any).message ?? resp.statusText}`,\n        resp.status,\n        body,\n      );\n    }\n\n    const data: RegisterSessionResponse = await resp.json();\n    const dpopKey = await importJwk(params.dpopKey);\n\n    const storedSession: StoredSession = {\n      did: data.did,\n      dpopKey: params.dpopKey,\n      accessToken: params.accessToken,\n      clientKey: this.clientKey,\n      instanceUrl: this.instanceUrl,\n    };\n    await this.storage.set(\n      `${STORAGE_PREFIX}${data.did}`,\n      JSON.stringify(storedSession),\n    );\n    await this.storage.set(LAST_ACTIVE_KEY, data.did);\n\n    return new HappyViewSession({\n      did: data.did,\n      dpopKey,\n      accessToken: params.accessToken,\n      clientKey: this.clientKey,\n      instanceUrl: this.instanceUrl,\n      fetch: this._fetch,\n    });\n  }\n\n  async deleteSession(did: string): Promise<void> {\n    const session = await this.restoreSession(did);\n    if (session) {\n      const resp = await session.fetchHandler(\n        `${this.instanceUrl}/oauth/sessions/${did}`,\n        { method: \"DELETE\" },\n      );\n\n      if (!resp.ok && resp.status !== 404) {\n        const body = await resp.json().catch(() => ({}));\n        throw new ApiError(\n          `Failed to delete session: ${resp.status} ${(body as any).message ?? resp.statusText}`,\n          resp.status,\n          body,\n        );\n      }\n    }\n\n    await this.storage.delete(`${STORAGE_PREFIX}${did}`);\n\n    const lastActive = await this.storage.get(LAST_ACTIVE_KEY);\n    if (lastActive === did) {\n      await this.storage.delete(LAST_ACTIVE_KEY);\n    }\n  }\n\n  async restoreSession(did: string): Promise<HappyViewSession | null> {\n    const stored = await this.storage.get(`${STORAGE_PREFIX}${did}`);\n    if (!stored) return null;\n\n    const data: StoredSession = JSON.parse(stored);\n    const dpopKey = await importJwk(data.dpopKey);\n    return new HappyViewSession({\n      did: data.did,\n      dpopKey,\n      accessToken: data.accessToken,\n      clientKey: data.clientKey,\n      instanceUrl: data.instanceUrl,\n      fetch: this._fetch,\n    });\n  }\n\n  async restore(): Promise<HappyViewSession | null> {\n    const did = await this.storage.get(LAST_ACTIVE_KEY);\n    if (!did) return null;\n    return this.restoreSession(did);\n  }\n}\n\n// PKCE helpers — inline since they're just a few lines of Web Crypto\nfunction generatePkceVerifier(): string {\n  const bytes = crypto.getRandomValues(new Uint8Array(32));\n  let binary = \"\";\n  for (let i = 0; i < bytes.length; i++) {\n    binary += String.fromCharCode(bytes[i]);\n  }\n  return btoa(binary)\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/, \"\");\n}\n\nasync function computePkceChallenge(verifier: string): Promise<string> {\n  const hash = await crypto.subtle.digest(\n    \"SHA-256\",\n    new TextEncoder().encode(verifier),\n  );\n  const bytes = new Uint8Array(hash);\n  let binary = \"\";\n  for (let i = 0; i < bytes.length; i++) {\n    binary += String.fromCharCode(bytes[i]);\n  }\n  return btoa(binary)\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/, \"\");\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAO,IAAM,iBAAN,cAA6B,MAAM;AAAA,EACxC,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,WAAN,cAAuB,eAAe;AAAA,EAClC;AAAA,EACA;AAAA,EAET,YAAY,SAAiB,QAAgB,MAAgB;AAC3D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,sBAAN,cAAkC,eAAe;AAAA,EAC7C;AAAA,EAET,YAAY,SAAiB,SAAiB,KAAK;AACjD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AACF;AAEO,IAAM,oBAAN,cAAgC,eAAe;AAAA,EACpD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,qBAAN,cAAiC,eAAe;AAAA,EAC5C;AAAA,EACA;AAAA,EAET,YAAY,SAAiB,QAAgB,MAAc;AACzD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,kBAAN,cAA8B,eAAe;AAAA,EAClD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;;;ACrDA,2BAA6B;AAM7B,eAAsB,UAAU,KAAwC;AACtE,QAAM,aAAa,MAAM,OAAO,OAAO;AAAA,IACrC;AAAA,IACA;AAAA,IACA,EAAE,MAAM,SAAS,YAAY,QAAQ;AAAA,IACrC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AAGA,QAAM,EAAE,GAAG,GAAG,GAAG,gBAAgB,IAAI;AACrC,QAAM,YAAY,MAAM,OAAO,OAAO;AAAA,IACpC;AAAA,IACA;AAAA,IACA,EAAE,MAAM,SAAS,YAAY,QAAQ;AAAA,IACrC;AAAA,IACA,CAAC,QAAQ;AAAA,EACX;AAEA,SAAO,kCAAa,YAAY,EAAE,YAAY,UAAU,CAAC;AAC3D;;;ACfA,SAAS,UAAU,YAA4B;AAC7C,QAAM,QAAQ,OAAO,gBAAgB,IAAI,WAAW,UAAU,CAAC;AAC/D,SAAO,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAC1E;AAEA,SAAS,UAAU,QAA6B;AAC9C,QAAM,QAAQ,IAAI,WAAW,MAAM;AACnC,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EACxC;AACA,SAAO,KAAK,MAAM,EACf,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AACtB;AAEO,IAAM,mBAAN,MAAuB;AAAA,EACnB;AAAA,EAEQ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACT;AAAA,EAER,YAAY,SAAkC;AAC5C,SAAK,MAAM,QAAQ;AACnB,SAAK,UAAU,QAAQ;AACvB,SAAK,cAAc,QAAQ;AAC3B,SAAK,YAAY,QAAQ;AACzB,SAAK,cAAc,QAAQ,YAAY,QAAQ,QAAQ,EAAE;AACzD,SAAK,SAAS,QAAQ,UAAU,CAAC,OAA0B,SAAuB,MAAM,OAAO,IAAI;AAAA,EACrG;AAAA,EAEA,MAAM,aAAa,KAAa,MAAsC;AACpE,UAAM,UAAU,gBAAgB,KAAK,GAAG,IACpC,MACA,GAAG,KAAK,WAAW,GAAG,GAAG;AAC7B,UAAM,UAAU,KAAK,UAAU,OAAO,YAAY;AAClD,UAAM,MAAM,QAAQ,MAAM,GAAG,EAAE,CAAC;AAEhC,UAAM,gBAAgB,YAA+B;AACnD,YAAM,YAAY,MAAM,OAAO,OAAO;AAAA,QACpC;AAAA,QACA,IAAI,YAAY,EAAE,OAAO,KAAK,WAAW;AAAA,MAC3C;AACA,YAAM,MAAM,UAAU,SAAS;AAE/B,YAAM,QAAQ,MAAM,KAAK,QAAQ;AAAA,QAC/B;AAAA,UACE,KAAK;AAAA,UACL,KAAK;AAAA,UACL,KAAK,KAAK,QAAQ;AAAA,QACpB;AAAA,QACA;AAAA,UACE,KAAK;AAAA,UACL;AAAA,UACA,KAAK,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAAA,UACjC,KAAK,UAAU,EAAE;AAAA,UACjB;AAAA,UACA,OAAO,KAAK;AAAA,QACd;AAAA,MACF;AAEA,YAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;AACxC,cAAQ,IAAI,iBAAiB,QAAQ,KAAK,WAAW,EAAE;AACvD,cAAQ,IAAI,QAAQ,KAAK;AACzB,cAAQ,IAAI,gBAAgB,KAAK,SAAS;AAE1C,aAAO,KAAK,OAAO,SAAS,EAAE,GAAG,MAAM,QAAQ,CAAC;AAAA,IAClD;AAEA,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,cAAc;AAAA,IACjC,SAAS,GAAG;AACV,YAAM,OAAO,gBAAgB,OAAO,KAAK,MAAM,eAAe,OAAO,KAAK,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC,UAAU,OAAO;AAChH,YAAM,IAAI,MAAM,wBAAyB,EAAY,OAAO;AAAA;AAAA,SAAc,IAAI,EAAE;AAAA,IAClF;AAGA,UAAM,QAAQ,SAAS,QAAQ,IAAI,YAAY;AAC/C,QAAI,SAAS,UAAU,KAAK,cAAc,SAAS,WAAW,OAAO,SAAS,WAAW,MAAM;AAC7F,WAAK,YAAY;AACjB,UAAI;AACF,mBAAW,MAAM,cAAc;AAAA,MACjC,SAAS,GAAG;AACV,cAAM,IAAI,MAAM,8BAA+B,EAAY,OAAO,EAAE;AAAA,MACtE;AACA,YAAM,aAAa,SAAS,QAAQ,IAAI,YAAY;AACpD,UAAI,YAAY;AACd,aAAK,YAAY;AAAA,MACnB;AAAA,IACF,WAAW,OAAO;AAChB,WAAK,YAAY;AAAA,IACnB;AAEA,WAAO;AAAA,EACT;AACF;;;AC9GO,IAAM,gBAAN,MAA8C;AAAA,EAC3C,OAAO,oBAAI,IAAoB;AAAA,EAEvC,MAAM,IAAI,KAAqC;AAC7C,WAAO,KAAK,KAAK,IAAI,GAAG,KAAK;AAAA,EAC/B;AAAA,EAEA,MAAM,IAAI,KAAa,OAA8B;AACnD,SAAK,KAAK,IAAI,KAAK,KAAK;AAAA,EAC1B;AAAA,EAEA,MAAM,OAAO,KAA4B;AACvC,SAAK,KAAK,OAAO,GAAG;AAAA,EACtB;AACF;;;ACFA,IAAM,iBAAiB;AAChB,IAAM,kBAAkB;AAExB,IAAM,uBAAN,MAA2B;AAAA,EACb;AAAA,EACA;AAAA,EACA;AAAA,EACF;AAAA,EACE;AAAA,EAEnB,YACE,SAGA;AACA,SAAK,cAAc,QAAQ,YAAY,QAAQ,QAAQ,EAAE;AACzD,SAAK,YAAY,QAAQ;AACzB,SAAK,eAAe,QAAQ;AAC5B,SAAK,UAAU,QAAQ,WAAW,IAAI,cAAc;AACpD,SAAK,SAAS,QAAQ,UAAU,CAAC,OAA0B,SAAuB,MAAM,OAAO,IAAI;AAAA,EACrG;AAAA,EAEA,IAAI,iBAA0B;AAC5B,WAAO,KAAK,iBAAiB;AAAA,EAC/B;AAAA,EAEA,MAAM,mBAKH;AACD,UAAM,UAAkC;AAAA,MACtC,gBAAgB;AAAA,MAChB,gBAAgB,KAAK;AAAA,IACvB;AACA,QAAI,KAAK,cAAc;AACrB,cAAQ,iBAAiB,IAAI,KAAK;AAAA,IACpC;AAEA,UAAM,OAAgC,CAAC;AACvC,QAAI;AAEJ,QAAI,CAAC,KAAK,gBAAgB;AACxB,qBAAe,qBAAqB;AACpC,YAAM,YAAY,MAAM,qBAAqB,YAAY;AACzD,WAAK,iBAAiB;AAAA,IACxB;AAEA,UAAM,OAAO,MAAM,KAAK,OAAO,GAAG,KAAK,WAAW,oBAAoB;AAAA,MACpE,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAED,QAAI,CAAC,KAAK,IAAI;AACZ,YAAMA,QAAO,MAAM,KAAK,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,YAAM,IAAI;AAAA,QACR,iCAAiC,KAAK,MAAM,IAAKA,MAAa,WAAW,KAAK,UAAU;AAAA,QACxF,KAAK;AAAA,QACLA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,OAA6B,MAAM,KAAK,KAAK;AACnD,UAAM,UAAU,MAAM,UAAU,KAAK,QAAQ;AAC7C,WAAO;AAAA,MACL,aAAa,KAAK;AAAA,MAClB;AAAA,MACA,QAAQ,KAAK;AAAA,MACb;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,gBACJ,QAC2B;AAC3B,UAAM,UAAkC;AAAA,MACtC,gBAAgB;AAAA,MAChB,gBAAgB,KAAK;AAAA,IACvB;AACA,QAAI,KAAK,cAAc;AACrB,cAAQ,iBAAiB,IAAI,KAAK;AAAA,IACpC;AAEA,UAAM,OAAgC;AAAA,MACpC,cAAc,OAAO;AAAA,MACrB,KAAK,OAAO;AAAA,MACZ,cAAc,OAAO;AAAA,MACrB,eAAe,OAAO;AAAA,MACtB,QAAQ,OAAO;AAAA,MACf,SAAS,OAAO;AAAA,MAChB,QAAQ,OAAO;AAAA,IACjB;AAEA,QAAI,CAAC,KAAK,kBAAkB,OAAO,cAAc;AAC/C,WAAK,gBAAgB,OAAO;AAAA,IAC9B;AAEA,UAAM,OAAO,MAAM,KAAK,OAAO,GAAG,KAAK,WAAW,mBAAmB;AAAA,MACnE,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAED,QAAI,CAAC,KAAK,IAAI;AACZ,YAAMA,QAAO,MAAM,KAAK,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,YAAM,IAAI;AAAA,QACR,+BAA+B,KAAK,MAAM,IAAKA,MAAa,WAAW,KAAK,UAAU;AAAA,QACtF,KAAK;AAAA,QACLA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,OAAgC,MAAM,KAAK,KAAK;AACtD,UAAM,UAAU,MAAM,UAAU,OAAO,OAAO;AAE9C,UAAM,gBAA+B;AAAA,MACnC,KAAK,KAAK;AAAA,MACV,SAAS,OAAO;AAAA,MAChB,aAAa,OAAO;AAAA,MACpB,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,IACpB;AACA,UAAM,KAAK,QAAQ;AAAA,MACjB,GAAG,cAAc,GAAG,KAAK,GAAG;AAAA,MAC5B,KAAK,UAAU,aAAa;AAAA,IAC9B;AACA,UAAM,KAAK,QAAQ,IAAI,iBAAiB,KAAK,GAAG;AAEhD,WAAO,IAAI,iBAAiB;AAAA,MAC1B,KAAK,KAAK;AAAA,MACV;AAAA,MACA,aAAa,OAAO;AAAA,MACpB,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,MAClB,OAAO,KAAK;AAAA,IACd,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,cAAc,KAA4B;AAC9C,UAAM,UAAU,MAAM,KAAK,eAAe,GAAG;AAC7C,QAAI,SAAS;AACX,YAAM,OAAO,MAAM,QAAQ;AAAA,QACzB,GAAG,KAAK,WAAW,mBAAmB,GAAG;AAAA,QACzC,EAAE,QAAQ,SAAS;AAAA,MACrB;AAEA,UAAI,CAAC,KAAK,MAAM,KAAK,WAAW,KAAK;AACnC,cAAM,OAAO,MAAM,KAAK,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,cAAM,IAAI;AAAA,UACR,6BAA6B,KAAK,MAAM,IAAK,KAAa,WAAW,KAAK,UAAU;AAAA,UACpF,KAAK;AAAA,UACL;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,KAAK,QAAQ,OAAO,GAAG,cAAc,GAAG,GAAG,EAAE;AAEnD,UAAM,aAAa,MAAM,KAAK,QAAQ,IAAI,eAAe;AACzD,QAAI,eAAe,KAAK;AACtB,YAAM,KAAK,QAAQ,OAAO,eAAe;AAAA,IAC3C;AAAA,EACF;AAAA,EAEA,MAAM,eAAe,KAA+C;AAClE,UAAM,SAAS,MAAM,KAAK,QAAQ,IAAI,GAAG,cAAc,GAAG,GAAG,EAAE;AAC/D,QAAI,CAAC,OAAQ,QAAO;AAEpB,UAAM,OAAsB,KAAK,MAAM,MAAM;AAC7C,UAAM,UAAU,MAAM,UAAU,KAAK,OAAO;AAC5C,WAAO,IAAI,iBAAiB;AAAA,MAC1B,KAAK,KAAK;AAAA,MACV;AAAA,MACA,aAAa,KAAK;AAAA,MAClB,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,MAClB,OAAO,KAAK;AAAA,IACd,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,UAA4C;AAChD,UAAM,MAAM,MAAM,KAAK,QAAQ,IAAI,eAAe;AAClD,QAAI,CAAC,IAAK,QAAO;AACjB,WAAO,KAAK,eAAe,GAAG;AAAA,EAChC;AACF;AAGA,SAAS,uBAA+B;AACtC,QAAM,QAAQ,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AACvD,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EACxC;AACA,SAAO,KAAK,MAAM,EACf,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AACtB;AAEA,eAAe,qBAAqB,UAAmC;AACrE,QAAM,OAAO,MAAM,OAAO,OAAO;AAAA,IAC/B;AAAA,IACA,IAAI,YAAY,EAAE,OAAO,QAAQ;AAAA,EACnC;AACA,QAAM,QAAQ,IAAI,WAAW,IAAI;AACjC,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EACxC;AACA,SAAO,KAAK,MAAM,EACf,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AACtB;","names":["body"]}
+{"version":3,"sources":["../src/index.ts","../src/errors.ts","../src/import-jwk.ts","../src/session.ts","../src/storage.ts","../src/client.ts"],"sourcesContent":["export * from \"@atproto/jwk\";\nexport * from \"@atproto/jwk-webcrypto\";\n\nexport { HappyViewOAuthClient, LAST_ACTIVE_KEY } from \"./client\";\nexport type { FetchMetadataOptions } from \"./client\";\nexport { importJwk } from \"./import-jwk\";\nexport {\n  ApiError,\n  AuthenticationError,\n  HappyViewError,\n  InvalidStateError,\n  OAuthCallbackError,\n  ResolutionError,\n  TokenExchangeError,\n} from \"./errors\";\nexport { HappyViewSession } from \"./session\";\nexport type { HappyViewSessionOptions } from \"./session\";\nexport { MemoryStorage } from \"./storage\";\nexport type {\n  DpopProvision,\n  HappyViewOAuthClientOptions,\n  ProvisionKeyResponse,\n  RegisterSessionParams,\n  RegisterSessionResponse,\n  SessionEventHooks,\n  StorageAdapter,\n  StoredSession,\n  TokenInfo,\n} from \"./types\";\n","export class HappyViewError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"HappyViewError\";\n  }\n}\n\nexport class ApiError extends HappyViewError {\n  readonly status: number;\n  readonly body: unknown;\n\n  constructor(message: string, status: number, body?: unknown) {\n    super(message);\n    this.name = \"ApiError\";\n    this.status = status;\n    this.body = body;\n  }\n}\n\nexport class AuthenticationError extends HappyViewError {\n  readonly status: number;\n\n  constructor(message: string, status: number = 401) {\n    super(message);\n    this.name = \"AuthenticationError\";\n    this.status = status;\n  }\n}\n\nexport class InvalidStateError extends HappyViewError {\n  constructor(message: string) {\n    super(message);\n    this.name = \"InvalidStateError\";\n  }\n}\n\nexport class TokenExchangeError extends HappyViewError {\n  readonly status: number;\n  readonly body: string;\n\n  constructor(message: string, status: number, body: string) {\n    super(message);\n    this.name = \"TokenExchangeError\";\n    this.status = status;\n    this.body = body;\n  }\n}\n\nexport class ResolutionError extends HappyViewError {\n  constructor(message: string) {\n    super(message);\n    this.name = \"ResolutionError\";\n  }\n}\n\nexport class OAuthCallbackError extends HappyViewError {\n  readonly params: URLSearchParams;\n  readonly state: string | undefined;\n\n  static from(\n    err: unknown,\n    params: URLSearchParams,\n    state?: string,\n  ): OAuthCallbackError {\n    if (err instanceof OAuthCallbackError) return err;\n    const message = err instanceof Error ? err.message : undefined;\n    return new OAuthCallbackError(params, message, state, err);\n  }\n\n  constructor(\n    params: URLSearchParams,\n    message?: string,\n    state?: string,\n    cause?: unknown,\n  ) {\n    super(\n      message ??\n        params.get(\"error_description\") ??\n        \"OAuth callback error\",\n    );\n    this.name = \"OAuthCallbackError\";\n    this.params = params;\n    this.state = state;\n    if (cause !== undefined) {\n      this.cause = cause;\n    }\n  }\n}\n","import { WebcryptoKey } from \"@atproto/jwk-webcrypto\";\n\n/**\n * Import a raw ES256 JWK (as returned by HappyView's /oauth/dpop-keys)\n * into a WebcryptoKey that can sign JWTs.\n */\nexport async function importJwk(jwk: JsonWebKey): Promise<WebcryptoKey> {\n  const privateKey = await crypto.subtle.importKey(\n    \"jwk\",\n    jwk,\n    { name: \"ECDSA\", namedCurve: \"P-256\" },\n    true,\n    [\"sign\"],\n  );\n\n  // Derive public key by stripping the private component\n  const { d: _, ...publicJwkFields } = jwk;\n  const publicKey = await crypto.subtle.importKey(\n    \"jwk\",\n    publicJwkFields,\n    { name: \"ECDSA\", namedCurve: \"P-256\" },\n    true,\n    [\"verify\"],\n  );\n\n  return WebcryptoKey.fromKeypair({ privateKey, publicKey });\n}\n","import type { Key } from \"@atproto/jwk\";\nimport type { TokenInfo } from \"./types\";\n\nexport interface HappyViewSessionOptions {\n  did: string;\n  dpopKey: Key;\n  accessToken: string;\n  clientKey: string;\n  instanceUrl: string;\n  scopes?: string;\n  pdsUrl?: string;\n  issuer?: string;\n  fetch?: typeof globalThis.fetch;\n  onSignOut?: () => Promise<void>;\n}\n\nfunction randomHex(byteLength: number): string {\n  const bytes = crypto.getRandomValues(new Uint8Array(byteLength));\n  return Array.from(bytes, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction base64url(buffer: ArrayBuffer): string {\n  const bytes = new Uint8Array(buffer);\n  let binary = \"\";\n  for (let i = 0; i < bytes.length; i++) {\n    binary += String.fromCharCode(bytes[i]);\n  }\n  return btoa(binary)\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/, \"\");\n}\n\nexport class HappyViewSession {\n  readonly did: string;\n\n  private readonly dpopKey: Key;\n  private readonly accessToken: string;\n  private readonly clientKey: string;\n  private readonly instanceUrl: string;\n  private readonly _scopes: string | undefined;\n  private readonly _pdsUrl: string | undefined;\n  private readonly _issuer: string | undefined;\n  private readonly _fetch: typeof globalThis.fetch;\n  private readonly _onSignOut: (() => Promise<void>) | undefined;\n  private dpopNonce: string | undefined;\n\n  constructor(options: HappyViewSessionOptions) {\n    this.did = options.did;\n    this.dpopKey = options.dpopKey;\n    this.accessToken = options.accessToken;\n    this.clientKey = options.clientKey;\n    this.instanceUrl = options.instanceUrl.replace(/\\/+$/, \"\");\n    this._scopes = options.scopes;\n    this._pdsUrl = options.pdsUrl;\n    this._issuer = options.issuer;\n    this._fetch = options.fetch ?? ((input: RequestInfo | URL, init?: RequestInit) => fetch(input, init)) as typeof globalThis.fetch;\n    this._onSignOut = options.onSignOut;\n  }\n\n  get sub(): string {\n    return this.did;\n  }\n\n  getTokenInfo(): TokenInfo {\n    return {\n      scope: this._scopes,\n      iss: this._issuer,\n      aud: this._pdsUrl,\n      sub: this.did,\n    };\n  }\n\n  async signOut(): Promise<void> {\n    if (this._onSignOut) {\n      await this._onSignOut();\n    }\n  }\n\n  async fetchHandler(url: string, init: RequestInit): Promise<Response> {\n    const fullUrl = /^https?:\\/\\//i.test(url)\n      ? url\n      : `${this.instanceUrl}${url}`;\n    const method = (init.method ?? \"GET\").toUpperCase();\n    const htu = fullUrl.split(\"?\")[0];\n\n    const sendWithProof = async (): Promise<Response> => {\n      const tokenHash = await crypto.subtle.digest(\n        \"SHA-256\",\n        new TextEncoder().encode(this.accessToken),\n      );\n      const ath = base64url(tokenHash);\n\n      const proof = await this.dpopKey.createJwt(\n        {\n          alg: \"ES256\",\n          typ: \"dpop+jwt\",\n          jwk: this.dpopKey.publicJwk!,\n        },\n        {\n          htm: method,\n          htu,\n          iat: Math.floor(Date.now() / 1000),\n          jti: randomHex(16),\n          ath,\n          nonce: this.dpopNonce,\n        },\n      );\n\n      const headers = new Headers(init.headers);\n      headers.set(\"authorization\", `DPoP ${this.accessToken}`);\n      headers.set(\"dpop\", proof);\n      headers.set(\"x-client-key\", this.clientKey);\n\n      return this._fetch(fullUrl, { ...init, headers });\n    };\n\n    let response: Response;\n    try {\n      response = await sendWithProof();\n    } catch (e) {\n      const info = `_fetch type: ${typeof this._fetch}, toString: ${String(this._fetch).slice(0, 120)}, url: ${fullUrl}`;\n      throw new Error(`fetchHandler failed: ${(e as Error).message}\\n\\nDEBUG: ${info}`);\n    }\n\n    // Retry once if the server requires a DPoP nonce we didn't have\n    const nonce = response.headers.get(\"dpop-nonce\");\n    if (nonce && nonce !== this.dpopNonce && (response.status === 401 || response.status === 400)) {\n      this.dpopNonce = nonce;\n      try {\n        response = await sendWithProof();\n      } catch (e) {\n        throw new Error(`fetchHandler retry failed: ${(e as Error).message}`);\n      }\n      const retryNonce = response.headers.get(\"dpop-nonce\");\n      if (retryNonce) {\n        this.dpopNonce = retryNonce;\n      }\n    } else if (nonce) {\n      this.dpopNonce = nonce;\n    }\n\n    return response;\n  }\n}\n","import type { StorageAdapter } from \"./types\";\n\nexport class MemoryStorage implements StorageAdapter {\n  private data = new Map<string, string>();\n\n  async get(key: string): Promise<string | null> {\n    return this.data.get(key) ?? null;\n  }\n\n  async set(key: string, value: string): Promise<void> {\n    this.data.set(key, value);\n  }\n\n  async delete(key: string): Promise<void> {\n    this.data.delete(key);\n  }\n}\n","import type { Key } from \"@atproto/jwk\";\nimport { ApiError } from \"./errors\";\nimport { importJwk } from \"./import-jwk\";\nimport { HappyViewSession } from \"./session\";\nimport { MemoryStorage } from \"./storage\";\nimport type {\n  HappyViewOAuthClientOptions,\n  ProvisionKeyResponse,\n  RegisterSessionParams,\n  RegisterSessionResponse,\n  SessionEventHooks,\n  StorageAdapter,\n  StoredSession,\n} from \"./types\";\n\nconst STORAGE_PREFIX = \"happyview:session:\";\nexport const LAST_ACTIVE_KEY = \"happyview:last-active-did\";\n\nexport interface FetchMetadataOptions {\n  clientId: string;\n  fetch?: typeof globalThis.fetch;\n  signal?: AbortSignal;\n}\n\nexport class HappyViewOAuthClient {\n  static async fetchMetadata({\n    clientId,\n    fetch: fetchFn = globalThis.fetch,\n    signal,\n  }: FetchMetadataOptions): Promise<Record<string, unknown>> {\n    signal?.throwIfAborted();\n    const resp = await fetchFn(clientId, { redirect: \"error\", signal });\n    if (resp.status !== 200) {\n      resp.body?.cancel?.();\n      throw new Error(`Failed to fetch client metadata: ${resp.status}`);\n    }\n    const mime = resp.headers.get(\"content-type\")?.split(\";\")[0].trim();\n    if (mime !== \"application/json\") {\n      resp.body?.cancel?.();\n      throw new Error(`Invalid client metadata content type: ${mime}`);\n    }\n    return resp.json() as Promise<Record<string, unknown>>;\n  }\n\n  protected readonly instanceUrl: string;\n  protected readonly clientKey: string;\n  protected readonly storage: StorageAdapter;\n  private readonly clientSecret: string | undefined;\n  protected readonly _fetch: typeof globalThis.fetch;\n  private readonly sessionHooks: SessionEventHooks;\n\n  constructor(\n    options: HappyViewOAuthClientOptions & {\n      fetch?: typeof globalThis.fetch;\n    },\n  ) {\n    this.instanceUrl = options.instanceUrl.replace(/\\/+$/, \"\");\n    this.clientKey = options.clientKey;\n    this.clientSecret = options.clientSecret;\n    this.storage = options.storage ?? new MemoryStorage();\n    this._fetch = options.fetch ?? ((input: RequestInfo | URL, init?: RequestInit) => fetch(input, init)) as typeof globalThis.fetch;\n    this.sessionHooks = options.sessionHooks ?? {};\n  }\n\n  get isConfidential(): boolean {\n    return this.clientSecret !== undefined;\n  }\n\n  async provisionDpopKey(): Promise<{\n    provisionId: string;\n    dpopKey: Key;\n    rawJwk: JsonWebKey;\n    pkceVerifier?: string;\n  }> {\n    const headers: Record<string, string> = {\n      \"content-type\": \"application/json\",\n      \"x-client-key\": this.clientKey,\n    };\n    if (this.clientSecret) {\n      headers[\"x-client-secret\"] = this.clientSecret;\n    }\n\n    const body: Record<string, unknown> = {};\n    let pkceVerifier: string | undefined;\n\n    if (!this.isConfidential) {\n      pkceVerifier = generatePkceVerifier();\n      const challenge = await computePkceChallenge(pkceVerifier);\n      body.pkce_challenge = challenge;\n    }\n\n    const resp = await this._fetch(`${this.instanceUrl}/oauth/dpop-keys`, {\n      method: \"POST\",\n      headers,\n      body: JSON.stringify(body),\n    });\n\n    if (!resp.ok) {\n      const body = await resp.json().catch(() => ({}));\n      throw new ApiError(\n        `Failed to provision DPoP key: ${resp.status} ${(body as any).message ?? resp.statusText}`,\n        resp.status,\n        body,\n      );\n    }\n\n    const data: ProvisionKeyResponse = await resp.json();\n    const dpopKey = await importJwk(data.dpop_key);\n    return {\n      provisionId: data.provision_id,\n      dpopKey,\n      rawJwk: data.dpop_key,\n      pkceVerifier,\n    };\n  }\n\n  async registerSession(\n    params: RegisterSessionParams,\n  ): Promise<HappyViewSession> {\n    const headers: Record<string, string> = {\n      \"content-type\": \"application/json\",\n      \"x-client-key\": this.clientKey,\n    };\n    if (this.clientSecret) {\n      headers[\"x-client-secret\"] = this.clientSecret;\n    }\n\n    const body: Record<string, unknown> = {\n      provision_id: params.provisionId,\n      did: params.did,\n      access_token: params.accessToken,\n      refresh_token: params.refreshToken,\n      scopes: params.scopes,\n      pds_url: params.pdsUrl,\n      issuer: params.issuer,\n    };\n\n    if (!this.isConfidential && params.pkceVerifier) {\n      body.pkce_verifier = params.pkceVerifier;\n    }\n\n    const resp = await this._fetch(`${this.instanceUrl}/oauth/sessions`, {\n      method: \"POST\",\n      headers,\n      body: JSON.stringify(body),\n    });\n\n    if (!resp.ok) {\n      const body = await resp.json().catch(() => ({}));\n      throw new ApiError(\n        `Failed to register session: ${resp.status} ${(body as any).message ?? resp.statusText}`,\n        resp.status,\n        body,\n      );\n    }\n\n    const data: RegisterSessionResponse = await resp.json();\n    const dpopKey = await importJwk(params.dpopKey);\n\n    const storedSession: StoredSession = {\n      did: data.did,\n      dpopKey: params.dpopKey,\n      accessToken: params.accessToken,\n      clientKey: this.clientKey,\n      instanceUrl: this.instanceUrl,\n      scopes: params.scopes,\n      pdsUrl: params.pdsUrl,\n      issuer: params.issuer,\n    };\n    await this.storage.set(\n      `${STORAGE_PREFIX}${data.did}`,\n      JSON.stringify(storedSession),\n    );\n    await this.storage.set(LAST_ACTIVE_KEY, data.did);\n\n    const session = new HappyViewSession({\n      did: data.did,\n      dpopKey,\n      accessToken: params.accessToken,\n      clientKey: this.clientKey,\n      instanceUrl: this.instanceUrl,\n      scopes: params.scopes,\n      pdsUrl: params.pdsUrl,\n      issuer: params.issuer,\n      fetch: this._fetch,\n      onSignOut: () => this.deleteSession(data.did),\n    });\n\n    this.sessionHooks.onSessionUpdate?.(data.did);\n\n    return session;\n  }\n\n  async deleteSession(did: string): Promise<void> {\n    const session = await this.restoreSession(did);\n    if (session) {\n      const resp = await session.fetchHandler(\n        `${this.instanceUrl}/oauth/sessions/${did}`,\n        { method: \"DELETE\" },\n      );\n\n      if (!resp.ok && resp.status !== 404) {\n        const body = await resp.json().catch(() => ({}));\n        throw new ApiError(\n          `Failed to delete session: ${resp.status} ${(body as any).message ?? resp.statusText}`,\n          resp.status,\n          body,\n        );\n      }\n    }\n\n    await this.storage.delete(`${STORAGE_PREFIX}${did}`);\n\n    const lastActive = await this.storage.get(LAST_ACTIVE_KEY);\n    if (lastActive === did) {\n      await this.storage.delete(LAST_ACTIVE_KEY);\n    }\n\n    this.sessionHooks.onSessionDelete?.(did);\n  }\n\n  async restoreSession(did: string): Promise<HappyViewSession | null> {\n    const stored = await this.storage.get(`${STORAGE_PREFIX}${did}`);\n    if (!stored) return null;\n\n    const data: StoredSession = JSON.parse(stored);\n    const dpopKey = await importJwk(data.dpopKey);\n    return new HappyViewSession({\n      did: data.did,\n      dpopKey,\n      accessToken: data.accessToken,\n      clientKey: data.clientKey,\n      instanceUrl: data.instanceUrl,\n      scopes: data.scopes,\n      pdsUrl: data.pdsUrl,\n      issuer: data.issuer,\n      fetch: this._fetch,\n      onSignOut: () => this.deleteSession(data.did),\n    });\n  }\n\n  async restore(): Promise<HappyViewSession | null> {\n    const did = await this.storage.get(LAST_ACTIVE_KEY);\n    if (!did) return null;\n    return this.restoreSession(did);\n  }\n}\n\n// PKCE helpers — inline since they're just a few lines of Web Crypto\nfunction generatePkceVerifier(): string {\n  const bytes = crypto.getRandomValues(new Uint8Array(32));\n  let binary = \"\";\n  for (let i = 0; i < bytes.length; i++) {\n    binary += String.fromCharCode(bytes[i]);\n  }\n  return btoa(binary)\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/, \"\");\n}\n\nasync function computePkceChallenge(verifier: string): Promise<string> {\n  const hash = await crypto.subtle.digest(\n    \"SHA-256\",\n    new TextEncoder().encode(verifier),\n  );\n  const bytes = new Uint8Array(hash);\n  let binary = \"\";\n  for (let i = 0; i < bytes.length; i++) {\n    binary += String.fromCharCode(bytes[i]);\n  }\n  return btoa(binary)\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/, \"\");\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,0BAAc,yBAAd;AACA,0BAAc,mCADd;;;ACAO,IAAM,iBAAN,cAA6B,MAAM;AAAA,EACxC,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,WAAN,cAAuB,eAAe;AAAA,EAClC;AAAA,EACA;AAAA,EAET,YAAY,SAAiB,QAAgB,MAAgB;AAC3D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,sBAAN,cAAkC,eAAe;AAAA,EAC7C;AAAA,EAET,YAAY,SAAiB,SAAiB,KAAK;AACjD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AACF;AAEO,IAAM,oBAAN,cAAgC,eAAe;AAAA,EACpD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,qBAAN,cAAiC,eAAe;AAAA,EAC5C;AAAA,EACA;AAAA,EAET,YAAY,SAAiB,QAAgB,MAAc;AACzD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,kBAAN,cAA8B,eAAe;AAAA,EAClD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,qBAAN,MAAM,4BAA2B,eAAe;AAAA,EAC5C;AAAA,EACA;AAAA,EAET,OAAO,KACL,KACA,QACA,OACoB;AACpB,QAAI,eAAe,oBAAoB,QAAO;AAC9C,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,WAAO,IAAI,oBAAmB,QAAQ,SAAS,OAAO,GAAG;AAAA,EAC3D;AAAA,EAEA,YACE,QACA,SACA,OACA,OACA;AACA;AAAA,MACE,WACE,OAAO,IAAI,mBAAmB,KAC9B;AAAA,IACJ;AACA,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,QAAQ;AACb,QAAI,UAAU,QAAW;AACvB,WAAK,QAAQ;AAAA,IACf;AAAA,EACF;AACF;;;ACvFA,2BAA6B;AAM7B,eAAsB,UAAU,KAAwC;AACtE,QAAM,aAAa,MAAM,OAAO,OAAO;AAAA,IACrC;AAAA,IACA;AAAA,IACA,EAAE,MAAM,SAAS,YAAY,QAAQ;AAAA,IACrC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AAGA,QAAM,EAAE,GAAG,GAAG,GAAG,gBAAgB,IAAI;AACrC,QAAM,YAAY,MAAM,OAAO,OAAO;AAAA,IACpC;AAAA,IACA;AAAA,IACA,EAAE,MAAM,SAAS,YAAY,QAAQ;AAAA,IACrC;AAAA,IACA,CAAC,QAAQ;AAAA,EACX;AAEA,SAAO,kCAAa,YAAY,EAAE,YAAY,UAAU,CAAC;AAC3D;;;ACVA,SAAS,UAAU,YAA4B;AAC7C,QAAM,QAAQ,OAAO,gBAAgB,IAAI,WAAW,UAAU,CAAC;AAC/D,SAAO,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAC1E;AAEA,SAAS,UAAU,QAA6B;AAC9C,QAAM,QAAQ,IAAI,WAAW,MAAM;AACnC,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EACxC;AACA,SAAO,KAAK,MAAM,EACf,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AACtB;AAEO,IAAM,mBAAN,MAAuB;AAAA,EACnB;AAAA,EAEQ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACT;AAAA,EAER,YAAY,SAAkC;AAC5C,SAAK,MAAM,QAAQ;AACnB,SAAK,UAAU,QAAQ;AACvB,SAAK,cAAc,QAAQ;AAC3B,SAAK,YAAY,QAAQ;AACzB,SAAK,cAAc,QAAQ,YAAY,QAAQ,QAAQ,EAAE;AACzD,SAAK,UAAU,QAAQ;AACvB,SAAK,UAAU,QAAQ;AACvB,SAAK,UAAU,QAAQ;AACvB,SAAK,SAAS,QAAQ,UAAU,CAAC,OAA0B,SAAuB,MAAM,OAAO,IAAI;AACnG,SAAK,aAAa,QAAQ;AAAA,EAC5B;AAAA,EAEA,IAAI,MAAc;AAChB,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,eAA0B;AACxB,WAAO;AAAA,MACL,OAAO,KAAK;AAAA,MACZ,KAAK,KAAK;AAAA,MACV,KAAK,KAAK;AAAA,MACV,KAAK,KAAK;AAAA,IACZ;AAAA,EACF;AAAA,EAEA,MAAM,UAAyB;AAC7B,QAAI,KAAK,YAAY;AACnB,YAAM,KAAK,WAAW;AAAA,IACxB;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,KAAa,MAAsC;AACpE,UAAM,UAAU,gBAAgB,KAAK,GAAG,IACpC,MACA,GAAG,KAAK,WAAW,GAAG,GAAG;AAC7B,UAAM,UAAU,KAAK,UAAU,OAAO,YAAY;AAClD,UAAM,MAAM,QAAQ,MAAM,GAAG,EAAE,CAAC;AAEhC,UAAM,gBAAgB,YAA+B;AACnD,YAAM,YAAY,MAAM,OAAO,OAAO;AAAA,QACpC;AAAA,QACA,IAAI,YAAY,EAAE,OAAO,KAAK,WAAW;AAAA,MAC3C;AACA,YAAM,MAAM,UAAU,SAAS;AAE/B,YAAM,QAAQ,MAAM,KAAK,QAAQ;AAAA,QAC/B;AAAA,UACE,KAAK;AAAA,UACL,KAAK;AAAA,UACL,KAAK,KAAK,QAAQ;AAAA,QACpB;AAAA,QACA;AAAA,UACE,KAAK;AAAA,UACL;AAAA,UACA,KAAK,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAAA,UACjC,KAAK,UAAU,EAAE;AAAA,UACjB;AAAA,UACA,OAAO,KAAK;AAAA,QACd;AAAA,MACF;AAEA,YAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;AACxC,cAAQ,IAAI,iBAAiB,QAAQ,KAAK,WAAW,EAAE;AACvD,cAAQ,IAAI,QAAQ,KAAK;AACzB,cAAQ,IAAI,gBAAgB,KAAK,SAAS;AAE1C,aAAO,KAAK,OAAO,SAAS,EAAE,GAAG,MAAM,QAAQ,CAAC;AAAA,IAClD;AAEA,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,cAAc;AAAA,IACjC,SAAS,GAAG;AACV,YAAM,OAAO,gBAAgB,OAAO,KAAK,MAAM,eAAe,OAAO,KAAK,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC,UAAU,OAAO;AAChH,YAAM,IAAI,MAAM,wBAAyB,EAAY,OAAO;AAAA;AAAA,SAAc,IAAI,EAAE;AAAA,IAClF;AAGA,UAAM,QAAQ,SAAS,QAAQ,IAAI,YAAY;AAC/C,QAAI,SAAS,UAAU,KAAK,cAAc,SAAS,WAAW,OAAO,SAAS,WAAW,MAAM;AAC7F,WAAK,YAAY;AACjB,UAAI;AACF,mBAAW,MAAM,cAAc;AAAA,MACjC,SAAS,GAAG;AACV,cAAM,IAAI,MAAM,8BAA+B,EAAY,OAAO,EAAE;AAAA,MACtE;AACA,YAAM,aAAa,SAAS,QAAQ,IAAI,YAAY;AACpD,UAAI,YAAY;AACd,aAAK,YAAY;AAAA,MACnB;AAAA,IACF,WAAW,OAAO;AAChB,WAAK,YAAY;AAAA,IACnB;AAEA,WAAO;AAAA,EACT;AACF;;;AC9IO,IAAM,gBAAN,MAA8C;AAAA,EAC3C,OAAO,oBAAI,IAAoB;AAAA,EAEvC,MAAM,IAAI,KAAqC;AAC7C,WAAO,KAAK,KAAK,IAAI,GAAG,KAAK;AAAA,EAC/B;AAAA,EAEA,MAAM,IAAI,KAAa,OAA8B;AACnD,SAAK,KAAK,IAAI,KAAK,KAAK;AAAA,EAC1B;AAAA,EAEA,MAAM,OAAO,KAA4B;AACvC,SAAK,KAAK,OAAO,GAAG;AAAA,EACtB;AACF;;;ACDA,IAAM,iBAAiB;AAChB,IAAM,kBAAkB;AAQxB,IAAM,uBAAN,MAA2B;AAAA,EAChC,aAAa,cAAc;AAAA,IACzB;AAAA,IACA,OAAO,UAAU,WAAW;AAAA,IAC5B;AAAA,EACF,GAA2D;AACzD,YAAQ,eAAe;AACvB,UAAM,OAAO,MAAM,QAAQ,UAAU,EAAE,UAAU,SAAS,OAAO,CAAC;AAClE,QAAI,KAAK,WAAW,KAAK;AACvB,WAAK,MAAM,SAAS;AACpB,YAAM,IAAI,MAAM,oCAAoC,KAAK,MAAM,EAAE;AAAA,IACnE;AACA,UAAM,OAAO,KAAK,QAAQ,IAAI,cAAc,GAAG,MAAM,GAAG,EAAE,CAAC,EAAE,KAAK;AAClE,QAAI,SAAS,oBAAoB;AAC/B,WAAK,MAAM,SAAS;AACpB,YAAM,IAAI,MAAM,yCAAyC,IAAI,EAAE;AAAA,IACjE;AACA,WAAO,KAAK,KAAK;AAAA,EACnB;AAAA,EAEmB;AAAA,EACA;AAAA,EACA;AAAA,EACF;AAAA,EACE;AAAA,EACF;AAAA,EAEjB,YACE,SAGA;AACA,SAAK,cAAc,QAAQ,YAAY,QAAQ,QAAQ,EAAE;AACzD,SAAK,YAAY,QAAQ;AACzB,SAAK,eAAe,QAAQ;AAC5B,SAAK,UAAU,QAAQ,WAAW,IAAI,cAAc;AACpD,SAAK,SAAS,QAAQ,UAAU,CAAC,OAA0B,SAAuB,MAAM,OAAO,IAAI;AACnG,SAAK,eAAe,QAAQ,gBAAgB,CAAC;AAAA,EAC/C;AAAA,EAEA,IAAI,iBAA0B;AAC5B,WAAO,KAAK,iBAAiB;AAAA,EAC/B;AAAA,EAEA,MAAM,mBAKH;AACD,UAAM,UAAkC;AAAA,MACtC,gBAAgB;AAAA,MAChB,gBAAgB,KAAK;AAAA,IACvB;AACA,QAAI,KAAK,cAAc;AACrB,cAAQ,iBAAiB,IAAI,KAAK;AAAA,IACpC;AAEA,UAAM,OAAgC,CAAC;AACvC,QAAI;AAEJ,QAAI,CAAC,KAAK,gBAAgB;AACxB,qBAAe,qBAAqB;AACpC,YAAM,YAAY,MAAM,qBAAqB,YAAY;AACzD,WAAK,iBAAiB;AAAA,IACxB;AAEA,UAAM,OAAO,MAAM,KAAK,OAAO,GAAG,KAAK,WAAW,oBAAoB;AAAA,MACpE,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAED,QAAI,CAAC,KAAK,IAAI;AACZ,YAAMA,QAAO,MAAM,KAAK,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,YAAM,IAAI;AAAA,QACR,iCAAiC,KAAK,MAAM,IAAKA,MAAa,WAAW,KAAK,UAAU;AAAA,QACxF,KAAK;AAAA,QACLA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,OAA6B,MAAM,KAAK,KAAK;AACnD,UAAM,UAAU,MAAM,UAAU,KAAK,QAAQ;AAC7C,WAAO;AAAA,MACL,aAAa,KAAK;AAAA,MAClB;AAAA,MACA,QAAQ,KAAK;AAAA,MACb;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,gBACJ,QAC2B;AAC3B,UAAM,UAAkC;AAAA,MACtC,gBAAgB;AAAA,MAChB,gBAAgB,KAAK;AAAA,IACvB;AACA,QAAI,KAAK,cAAc;AACrB,cAAQ,iBAAiB,IAAI,KAAK;AAAA,IACpC;AAEA,UAAM,OAAgC;AAAA,MACpC,cAAc,OAAO;AAAA,MACrB,KAAK,OAAO;AAAA,MACZ,cAAc,OAAO;AAAA,MACrB,eAAe,OAAO;AAAA,MACtB,QAAQ,OAAO;AAAA,MACf,SAAS,OAAO;AAAA,MAChB,QAAQ,OAAO;AAAA,IACjB;AAEA,QAAI,CAAC,KAAK,kBAAkB,OAAO,cAAc;AAC/C,WAAK,gBAAgB,OAAO;AAAA,IAC9B;AAEA,UAAM,OAAO,MAAM,KAAK,OAAO,GAAG,KAAK,WAAW,mBAAmB;AAAA,MACnE,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAED,QAAI,CAAC,KAAK,IAAI;AACZ,YAAMA,QAAO,MAAM,KAAK,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,YAAM,IAAI;AAAA,QACR,+BAA+B,KAAK,MAAM,IAAKA,MAAa,WAAW,KAAK,UAAU;AAAA,QACtF,KAAK;AAAA,QACLA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,OAAgC,MAAM,KAAK,KAAK;AACtD,UAAM,UAAU,MAAM,UAAU,OAAO,OAAO;AAE9C,UAAM,gBAA+B;AAAA,MACnC,KAAK,KAAK;AAAA,MACV,SAAS,OAAO;AAAA,MAChB,aAAa,OAAO;AAAA,MACpB,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,MAClB,QAAQ,OAAO;AAAA,MACf,QAAQ,OAAO;AAAA,MACf,QAAQ,OAAO;AAAA,IACjB;AACA,UAAM,KAAK,QAAQ;AAAA,MACjB,GAAG,cAAc,GAAG,KAAK,GAAG;AAAA,MAC5B,KAAK,UAAU,aAAa;AAAA,IAC9B;AACA,UAAM,KAAK,QAAQ,IAAI,iBAAiB,KAAK,GAAG;AAEhD,UAAM,UAAU,IAAI,iBAAiB;AAAA,MACnC,KAAK,KAAK;AAAA,MACV;AAAA,MACA,aAAa,OAAO;AAAA,MACpB,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,MAClB,QAAQ,OAAO;AAAA,MACf,QAAQ,OAAO;AAAA,MACf,QAAQ,OAAO;AAAA,MACf,OAAO,KAAK;AAAA,MACZ,WAAW,MAAM,KAAK,cAAc,KAAK,GAAG;AAAA,IAC9C,CAAC;AAED,SAAK,aAAa,kBAAkB,KAAK,GAAG;AAE5C,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,cAAc,KAA4B;AAC9C,UAAM,UAAU,MAAM,KAAK,eAAe,GAAG;AAC7C,QAAI,SAAS;AACX,YAAM,OAAO,MAAM,QAAQ;AAAA,QACzB,GAAG,KAAK,WAAW,mBAAmB,GAAG;AAAA,QACzC,EAAE,QAAQ,SAAS;AAAA,MACrB;AAEA,UAAI,CAAC,KAAK,MAAM,KAAK,WAAW,KAAK;AACnC,cAAM,OAAO,MAAM,KAAK,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,cAAM,IAAI;AAAA,UACR,6BAA6B,KAAK,MAAM,IAAK,KAAa,WAAW,KAAK,UAAU;AAAA,UACpF,KAAK;AAAA,UACL;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,KAAK,QAAQ,OAAO,GAAG,cAAc,GAAG,GAAG,EAAE;AAEnD,UAAM,aAAa,MAAM,KAAK,QAAQ,IAAI,eAAe;AACzD,QAAI,eAAe,KAAK;AACtB,YAAM,KAAK,QAAQ,OAAO,eAAe;AAAA,IAC3C;AAEA,SAAK,aAAa,kBAAkB,GAAG;AAAA,EACzC;AAAA,EAEA,MAAM,eAAe,KAA+C;AAClE,UAAM,SAAS,MAAM,KAAK,QAAQ,IAAI,GAAG,cAAc,GAAG,GAAG,EAAE;AAC/D,QAAI,CAAC,OAAQ,QAAO;AAEpB,UAAM,OAAsB,KAAK,MAAM,MAAM;AAC7C,UAAM,UAAU,MAAM,UAAU,KAAK,OAAO;AAC5C,WAAO,IAAI,iBAAiB;AAAA,MAC1B,KAAK,KAAK;AAAA,MACV;AAAA,MACA,aAAa,KAAK;AAAA,MAClB,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,MAClB,QAAQ,KAAK;AAAA,MACb,QAAQ,KAAK;AAAA,MACb,QAAQ,KAAK;AAAA,MACb,OAAO,KAAK;AAAA,MACZ,WAAW,MAAM,KAAK,cAAc,KAAK,GAAG;AAAA,IAC9C,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,UAA4C;AAChD,UAAM,MAAM,MAAM,KAAK,QAAQ,IAAI,eAAe;AAClD,QAAI,CAAC,IAAK,QAAO;AACjB,WAAO,KAAK,eAAe,GAAG;AAAA,EAChC;AACF;AAGA,SAAS,uBAA+B;AACtC,QAAM,QAAQ,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AACvD,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EACxC;AACA,SAAO,KAAK,MAAM,EACf,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AACtB;AAEA,eAAe,qBAAqB,UAAmC;AACrE,QAAM,OAAO,MAAM,OAAO,OAAO;AAAA,IAC/B;AAAA,IACA,IAAI,YAAY,EAAE,OAAO,QAAQ;AAAA,EACnC;AACA,QAAM,QAAQ,IAAI,WAAW,IAAI;AACjC,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EACxC;AACA,SAAO,KAAK,MAAM,EACf,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AACtB;","names":["body"]}

package/dist/index.d.cts

@@ -1,36 +1,23 @@
 import { Key } from '@atproto/jwk';
+export * from '@atproto/jwk';
 import { WebcryptoKey } from '@atproto/jwk-webcrypto';
-
-interface HappyViewSessionOptions {
-    did: string;
-    dpopKey: Key;
-    accessToken: string;
-    clientKey: string;
-    instanceUrl: string;
-    fetch?: typeof globalThis.fetch;
-}
-declare class HappyViewSession {
-    readonly did: string;
-    private readonly dpopKey;
-    private readonly accessToken;
-    private readonly clientKey;
-    private readonly instanceUrl;
-    private readonly _fetch;
-    private dpopNonce;
-    constructor(options: HappyViewSessionOptions);
-    fetchHandler(url: string, init: RequestInit): Promise<Response>;
-}
+export * from '@atproto/jwk-webcrypto';
 
 interface StorageAdapter {
     get(key: string): Promise<string | null>;
     set(key: string, value: string): Promise<void>;
     delete(key: string): Promise<void>;
 }
+interface SessionEventHooks {
+    onSessionUpdate?: (did: string) => void;
+    onSessionDelete?: (did: string, cause?: unknown) => void;
+}
 interface HappyViewOAuthClientOptions {
     instanceUrl: string;
     clientKey: string;
     clientSecret?: string;
     storage?: StorageAdapter;
+    sessionHooks?: SessionEventHooks;
 }
 interface DpopProvision {
     provisionId: string;
@@ -59,6 +46,17 @@ interface StoredSession {
     accessToken: string;
     clientKey: string;
     instanceUrl: string;
+    scopes?: string;
+    pdsUrl?: string;
+    issuer?: string;
+}
+interface TokenInfo {
+    expiresAt?: Date;
+    expired?: boolean;
+    scope?: string;
+    iss?: string;
+    aud?: string;
+    sub: string;
 }
 interface ProvisionKeyResponse {
     provision_id: string;
@@ -69,13 +67,51 @@ interface RegisterSessionResponse {
     did: string;
 }
 
+interface HappyViewSessionOptions {
+    did: string;
+    dpopKey: Key;
+    accessToken: string;
+    clientKey: string;
+    instanceUrl: string;
+    scopes?: string;
+    pdsUrl?: string;
+    issuer?: string;
+    fetch?: typeof globalThis.fetch;
+    onSignOut?: () => Promise<void>;
+}
+declare class HappyViewSession {
+    readonly did: string;
+    private readonly dpopKey;
+    private readonly accessToken;
+    private readonly clientKey;
+    private readonly instanceUrl;
+    private readonly _scopes;
+    private readonly _pdsUrl;
+    private readonly _issuer;
+    private readonly _fetch;
+    private readonly _onSignOut;
+    private dpopNonce;
+    constructor(options: HappyViewSessionOptions);
+    get sub(): string;
+    getTokenInfo(): TokenInfo;
+    signOut(): Promise<void>;
+    fetchHandler(url: string, init: RequestInit): Promise<Response>;
+}
+
 declare const LAST_ACTIVE_KEY = "happyview:last-active-did";
+interface FetchMetadataOptions {
+    clientId: string;
+    fetch?: typeof globalThis.fetch;
+    signal?: AbortSignal;
+}
 declare class HappyViewOAuthClient {
+    static fetchMetadata({ clientId, fetch: fetchFn, signal, }: FetchMetadataOptions): Promise<Record<string, unknown>>;
     protected readonly instanceUrl: string;
     protected readonly clientKey: string;
     protected readonly storage: StorageAdapter;
     private readonly clientSecret;
     protected readonly _fetch: typeof globalThis.fetch;
+    private readonly sessionHooks;
     constructor(options: HappyViewOAuthClientOptions & {
         fetch?: typeof globalThis.fetch;
     });
@@ -121,6 +157,12 @@ declare class TokenExchangeError extends HappyViewError {
 declare class ResolutionError extends HappyViewError {
     constructor(message: string);
 }
+declare class OAuthCallbackError extends HappyViewError {
+    readonly params: URLSearchParams;
+    readonly state: string | undefined;
+    static from(err: unknown, params: URLSearchParams, state?: string): OAuthCallbackError;
+    constructor(params: URLSearchParams, message?: string, state?: string, cause?: unknown);
+}
 
 declare class MemoryStorage implements StorageAdapter {
     private data;
@@ -129,4 +171,4 @@ declare class MemoryStorage implements StorageAdapter {
     delete(key: string): Promise<void>;
 }
 
-export { ApiError, AuthenticationError, type DpopProvision, HappyViewError, HappyViewOAuthClient, type HappyViewOAuthClientOptions, HappyViewSession, type HappyViewSessionOptions, InvalidStateError, LAST_ACTIVE_KEY, MemoryStorage, type ProvisionKeyResponse, type RegisterSessionParams, type RegisterSessionResponse, ResolutionError, type StorageAdapter, type StoredSession, TokenExchangeError, importJwk };
+export { ApiError, AuthenticationError, type DpopProvision, type FetchMetadataOptions, HappyViewError, HappyViewOAuthClient, type HappyViewOAuthClientOptions, HappyViewSession, type HappyViewSessionOptions, InvalidStateError, LAST_ACTIVE_KEY, MemoryStorage, OAuthCallbackError, type ProvisionKeyResponse, type RegisterSessionParams, type RegisterSessionResponse, ResolutionError, type SessionEventHooks, type StorageAdapter, type StoredSession, TokenExchangeError, type TokenInfo, importJwk };

package/dist/index.d.ts

@@ -1,36 +1,23 @@
 import { Key } from '@atproto/jwk';
+export * from '@atproto/jwk';
 import { WebcryptoKey } from '@atproto/jwk-webcrypto';
-
-interface HappyViewSessionOptions {
-    did: string;
-    dpopKey: Key;
-    accessToken: string;
-    clientKey: string;
-    instanceUrl: string;
-    fetch?: typeof globalThis.fetch;
-}
-declare class HappyViewSession {
-    readonly did: string;
-    private readonly dpopKey;
-    private readonly accessToken;
-    private readonly clientKey;
-    private readonly instanceUrl;
-    private readonly _fetch;
-    private dpopNonce;
-    constructor(options: HappyViewSessionOptions);
-    fetchHandler(url: string, init: RequestInit): Promise<Response>;
-}
+export * from '@atproto/jwk-webcrypto';
 
 interface StorageAdapter {
     get(key: string): Promise<string | null>;
     set(key: string, value: string): Promise<void>;
     delete(key: string): Promise<void>;
 }
+interface SessionEventHooks {
+    onSessionUpdate?: (did: string) => void;
+    onSessionDelete?: (did: string, cause?: unknown) => void;
+}
 interface HappyViewOAuthClientOptions {
     instanceUrl: string;
     clientKey: string;
     clientSecret?: string;
     storage?: StorageAdapter;
+    sessionHooks?: SessionEventHooks;
 }
 interface DpopProvision {
     provisionId: string;
@@ -59,6 +46,17 @@ interface StoredSession {
     accessToken: string;
     clientKey: string;
     instanceUrl: string;
+    scopes?: string;
+    pdsUrl?: string;
+    issuer?: string;
+}
+interface TokenInfo {
+    expiresAt?: Date;
+    expired?: boolean;
+    scope?: string;
+    iss?: string;
+    aud?: string;
+    sub: string;
 }
 interface ProvisionKeyResponse {
     provision_id: string;
@@ -69,13 +67,51 @@ interface RegisterSessionResponse {
     did: string;
 }
 
+interface HappyViewSessionOptions {
+    did: string;
+    dpopKey: Key;
+    accessToken: string;
+    clientKey: string;
+    instanceUrl: string;
+    scopes?: string;
+    pdsUrl?: string;
+    issuer?: string;
+    fetch?: typeof globalThis.fetch;
+    onSignOut?: () => Promise<void>;
+}
+declare class HappyViewSession {
+    readonly did: string;
+    private readonly dpopKey;
+    private readonly accessToken;
+    private readonly clientKey;
+    private readonly instanceUrl;
+    private readonly _scopes;
+    private readonly _pdsUrl;
+    private readonly _issuer;
+    private readonly _fetch;
+    private readonly _onSignOut;
+    private dpopNonce;
+    constructor(options: HappyViewSessionOptions);
+    get sub(): string;
+    getTokenInfo(): TokenInfo;
+    signOut(): Promise<void>;
+    fetchHandler(url: string, init: RequestInit): Promise<Response>;
+}
+
 declare const LAST_ACTIVE_KEY = "happyview:last-active-did";
+interface FetchMetadataOptions {
+    clientId: string;
+    fetch?: typeof globalThis.fetch;
+    signal?: AbortSignal;
+}
 declare class HappyViewOAuthClient {
+    static fetchMetadata({ clientId, fetch: fetchFn, signal, }: FetchMetadataOptions): Promise<Record<string, unknown>>;
     protected readonly instanceUrl: string;
     protected readonly clientKey: string;
     protected readonly storage: StorageAdapter;
     private readonly clientSecret;
     protected readonly _fetch: typeof globalThis.fetch;
+    private readonly sessionHooks;
     constructor(options: HappyViewOAuthClientOptions & {
         fetch?: typeof globalThis.fetch;
     });
@@ -121,6 +157,12 @@ declare class TokenExchangeError extends HappyViewError {
 declare class ResolutionError extends HappyViewError {
     constructor(message: string);
 }
+declare class OAuthCallbackError extends HappyViewError {
+    readonly params: URLSearchParams;
+    readonly state: string | undefined;
+    static from(err: unknown, params: URLSearchParams, state?: string): OAuthCallbackError;
+    constructor(params: URLSearchParams, message?: string, state?: string, cause?: unknown);
+}
 
 declare class MemoryStorage implements StorageAdapter {
     private data;
@@ -129,4 +171,4 @@ declare class MemoryStorage implements StorageAdapter {
     delete(key: string): Promise<void>;
 }
 
-export { ApiError, AuthenticationError, type DpopProvision, HappyViewError, HappyViewOAuthClient, type HappyViewOAuthClientOptions, HappyViewSession, type HappyViewSessionOptions, InvalidStateError, LAST_ACTIVE_KEY, MemoryStorage, type ProvisionKeyResponse, type RegisterSessionParams, type RegisterSessionResponse, ResolutionError, type StorageAdapter, type StoredSession, TokenExchangeError, importJwk };
+export { ApiError, AuthenticationError, type DpopProvision, type FetchMetadataOptions, HappyViewError, HappyViewOAuthClient, type HappyViewOAuthClientOptions, HappyViewSession, type HappyViewSessionOptions, InvalidStateError, LAST_ACTIVE_KEY, MemoryStorage, OAuthCallbackError, type ProvisionKeyResponse, type RegisterSessionParams, type RegisterSessionResponse, ResolutionError, type SessionEventHooks, type StorageAdapter, type StoredSession, TokenExchangeError, type TokenInfo, importJwk };

package/dist/index.js

@@ -1,3 +1,7 @@
+// src/index.ts
+export * from "@atproto/jwk";
+export * from "@atproto/jwk-webcrypto";
+
 // src/errors.ts
 var HappyViewError = class extends Error {
   constructor(message) {
@@ -45,6 +49,26 @@ var ResolutionError = class extends HappyViewError {
     this.name = "ResolutionError";
   }
 };
+var OAuthCallbackError = class _OAuthCallbackError extends HappyViewError {
+  params;
+  state;
+  static from(err, params, state) {
+    if (err instanceof _OAuthCallbackError) return err;
+    const message = err instanceof Error ? err.message : void 0;
+    return new _OAuthCallbackError(params, message, state, err);
+  }
+  constructor(params, message, state, cause) {
+    super(
+      message ?? params.get("error_description") ?? "OAuth callback error"
+    );
+    this.name = "OAuthCallbackError";
+    this.params = params;
+    this.state = state;
+    if (cause !== void 0) {
+      this.cause = cause;
+    }
+  }
+};
 
 // src/import-jwk.ts
 import { WebcryptoKey } from "@atproto/jwk-webcrypto";
@@ -86,7 +110,11 @@ var HappyViewSession = class {
   accessToken;
   clientKey;
   instanceUrl;
+  _scopes;
+  _pdsUrl;
+  _issuer;
   _fetch;
+  _onSignOut;
   dpopNonce;
   constructor(options) {
     this.did = options.did;
@@ -94,7 +122,27 @@ var HappyViewSession = class {
     this.accessToken = options.accessToken;
     this.clientKey = options.clientKey;
     this.instanceUrl = options.instanceUrl.replace(/\/+$/, "");
+    this._scopes = options.scopes;
+    this._pdsUrl = options.pdsUrl;
+    this._issuer = options.issuer;
     this._fetch = options.fetch ?? ((input, init) => fetch(input, init));
+    this._onSignOut = options.onSignOut;
+  }
+  get sub() {
+    return this.did;
+  }
+  getTokenInfo() {
+    return {
+      scope: this._scopes,
+      iss: this._issuer,
+      aud: this._pdsUrl,
+      sub: this.did
+    };
+  }
+  async signOut() {
+    if (this._onSignOut) {
+      await this._onSignOut();
+    }
   }
   async fetchHandler(url, init) {
     const fullUrl = /^https?:\/\//i.test(url) ? url : `${this.instanceUrl}${url}`;
@@ -173,17 +221,37 @@ var MemoryStorage = class {
 var STORAGE_PREFIX = "happyview:session:";
 var LAST_ACTIVE_KEY = "happyview:last-active-did";
 var HappyViewOAuthClient = class {
+  static async fetchMetadata({
+    clientId,
+    fetch: fetchFn = globalThis.fetch,
+    signal
+  }) {
+    signal?.throwIfAborted();
+    const resp = await fetchFn(clientId, { redirect: "error", signal });
+    if (resp.status !== 200) {
+      resp.body?.cancel?.();
+      throw new Error(`Failed to fetch client metadata: ${resp.status}`);
+    }
+    const mime = resp.headers.get("content-type")?.split(";")[0].trim();
+    if (mime !== "application/json") {
+      resp.body?.cancel?.();
+      throw new Error(`Invalid client metadata content type: ${mime}`);
+    }
+    return resp.json();
+  }
   instanceUrl;
   clientKey;
   storage;
   clientSecret;
   _fetch;
+  sessionHooks;
   constructor(options) {
     this.instanceUrl = options.instanceUrl.replace(/\/+$/, "");
     this.clientKey = options.clientKey;
     this.clientSecret = options.clientSecret;
     this.storage = options.storage ?? new MemoryStorage();
     this._fetch = options.fetch ?? ((input, init) => fetch(input, init));
+    this.sessionHooks = options.sessionHooks ?? {};
   }
   get isConfidential() {
     return this.clientSecret !== void 0;
@@ -265,21 +333,30 @@ var HappyViewOAuthClient = class {
       dpopKey: params.dpopKey,
       accessToken: params.accessToken,
       clientKey: this.clientKey,
-      instanceUrl: this.instanceUrl
+      instanceUrl: this.instanceUrl,
+      scopes: params.scopes,
+      pdsUrl: params.pdsUrl,
+      issuer: params.issuer
     };
     await this.storage.set(
       `${STORAGE_PREFIX}${data.did}`,
       JSON.stringify(storedSession)
     );
     await this.storage.set(LAST_ACTIVE_KEY, data.did);
-    return new HappyViewSession({
+    const session = new HappyViewSession({
       did: data.did,
       dpopKey,
       accessToken: params.accessToken,
       clientKey: this.clientKey,
       instanceUrl: this.instanceUrl,
-      fetch: this._fetch
+      scopes: params.scopes,
+      pdsUrl: params.pdsUrl,
+      issuer: params.issuer,
+      fetch: this._fetch,
+      onSignOut: () => this.deleteSession(data.did)
     });
+    this.sessionHooks.onSessionUpdate?.(data.did);
+    return session;
   }
   async deleteSession(did) {
     const session = await this.restoreSession(did);
@@ -302,6 +379,7 @@ var HappyViewOAuthClient = class {
     if (lastActive === did) {
       await this.storage.delete(LAST_ACTIVE_KEY);
     }
+    this.sessionHooks.onSessionDelete?.(did);
   }
   async restoreSession(did) {
     const stored = await this.storage.get(`${STORAGE_PREFIX}${did}`);
@@ -314,7 +392,11 @@ var HappyViewOAuthClient = class {
       accessToken: data.accessToken,
       clientKey: data.clientKey,
       instanceUrl: data.instanceUrl,
-      fetch: this._fetch
+      scopes: data.scopes,
+      pdsUrl: data.pdsUrl,
+      issuer: data.issuer,
+      fetch: this._fetch,
+      onSignOut: () => this.deleteSession(data.did)
     });
   }
   async restore() {
@@ -352,6 +434,7 @@ export {
   InvalidStateError,
   LAST_ACTIVE_KEY,
   MemoryStorage,
+  OAuthCallbackError,
   ResolutionError,
   TokenExchangeError,
   importJwk

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/errors.ts","../src/import-jwk.ts","../src/session.ts","../src/storage.ts","../src/client.ts"],"sourcesContent":["export class HappyViewError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"HappyViewError\";\n  }\n}\n\nexport class ApiError extends HappyViewError {\n  readonly status: number;\n  readonly body: unknown;\n\n  constructor(message: string, status: number, body?: unknown) {\n    super(message);\n    this.name = \"ApiError\";\n    this.status = status;\n    this.body = body;\n  }\n}\n\nexport class AuthenticationError extends HappyViewError {\n  readonly status: number;\n\n  constructor(message: string, status: number = 401) {\n    super(message);\n    this.name = \"AuthenticationError\";\n    this.status = status;\n  }\n}\n\nexport class InvalidStateError extends HappyViewError {\n  constructor(message: string) {\n    super(message);\n    this.name = \"InvalidStateError\";\n  }\n}\n\nexport class TokenExchangeError extends HappyViewError {\n  readonly status: number;\n  readonly body: string;\n\n  constructor(message: string, status: number, body: string) {\n    super(message);\n    this.name = \"TokenExchangeError\";\n    this.status = status;\n    this.body = body;\n  }\n}\n\nexport class ResolutionError extends HappyViewError {\n  constructor(message: string) {\n    super(message);\n    this.name = \"ResolutionError\";\n  }\n}\n","import { WebcryptoKey } from \"@atproto/jwk-webcrypto\";\n\n/**\n * Import a raw ES256 JWK (as returned by HappyView's /oauth/dpop-keys)\n * into a WebcryptoKey that can sign JWTs.\n */\nexport async function importJwk(jwk: JsonWebKey): Promise<WebcryptoKey> {\n  const privateKey = await crypto.subtle.importKey(\n    \"jwk\",\n    jwk,\n    { name: \"ECDSA\", namedCurve: \"P-256\" },\n    true,\n    [\"sign\"],\n  );\n\n  // Derive public key by stripping the private component\n  const { d: _, ...publicJwkFields } = jwk;\n  const publicKey = await crypto.subtle.importKey(\n    \"jwk\",\n    publicJwkFields,\n    { name: \"ECDSA\", namedCurve: \"P-256\" },\n    true,\n    [\"verify\"],\n  );\n\n  return WebcryptoKey.fromKeypair({ privateKey, publicKey });\n}\n","import type { Key } from \"@atproto/jwk\";\n\nexport interface HappyViewSessionOptions {\n  did: string;\n  dpopKey: Key;\n  accessToken: string;\n  clientKey: string;\n  instanceUrl: string;\n  fetch?: typeof globalThis.fetch;\n}\n\nfunction randomHex(byteLength: number): string {\n  const bytes = crypto.getRandomValues(new Uint8Array(byteLength));\n  return Array.from(bytes, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction base64url(buffer: ArrayBuffer): string {\n  const bytes = new Uint8Array(buffer);\n  let binary = \"\";\n  for (let i = 0; i < bytes.length; i++) {\n    binary += String.fromCharCode(bytes[i]);\n  }\n  return btoa(binary)\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/, \"\");\n}\n\nexport class HappyViewSession {\n  readonly did: string;\n\n  private readonly dpopKey: Key;\n  private readonly accessToken: string;\n  private readonly clientKey: string;\n  private readonly instanceUrl: string;\n  private readonly _fetch: typeof globalThis.fetch;\n  private dpopNonce: string | undefined;\n\n  constructor(options: HappyViewSessionOptions) {\n    this.did = options.did;\n    this.dpopKey = options.dpopKey;\n    this.accessToken = options.accessToken;\n    this.clientKey = options.clientKey;\n    this.instanceUrl = options.instanceUrl.replace(/\\/+$/, \"\");\n    this._fetch = options.fetch ?? ((input: RequestInfo | URL, init?: RequestInit) => fetch(input, init)) as typeof globalThis.fetch;\n  }\n\n  async fetchHandler(url: string, init: RequestInit): Promise<Response> {\n    const fullUrl = /^https?:\\/\\//i.test(url)\n      ? url\n      : `${this.instanceUrl}${url}`;\n    const method = (init.method ?? \"GET\").toUpperCase();\n    const htu = fullUrl.split(\"?\")[0];\n\n    const sendWithProof = async (): Promise<Response> => {\n      const tokenHash = await crypto.subtle.digest(\n        \"SHA-256\",\n        new TextEncoder().encode(this.accessToken),\n      );\n      const ath = base64url(tokenHash);\n\n      const proof = await this.dpopKey.createJwt(\n        {\n          alg: \"ES256\",\n          typ: \"dpop+jwt\",\n          jwk: this.dpopKey.publicJwk!,\n        },\n        {\n          htm: method,\n          htu,\n          iat: Math.floor(Date.now() / 1000),\n          jti: randomHex(16),\n          ath,\n          nonce: this.dpopNonce,\n        },\n      );\n\n      const headers = new Headers(init.headers);\n      headers.set(\"authorization\", `DPoP ${this.accessToken}`);\n      headers.set(\"dpop\", proof);\n      headers.set(\"x-client-key\", this.clientKey);\n\n      return this._fetch(fullUrl, { ...init, headers });\n    };\n\n    let response: Response;\n    try {\n      response = await sendWithProof();\n    } catch (e) {\n      const info = `_fetch type: ${typeof this._fetch}, toString: ${String(this._fetch).slice(0, 120)}, url: ${fullUrl}`;\n      throw new Error(`fetchHandler failed: ${(e as Error).message}\\n\\nDEBUG: ${info}`);\n    }\n\n    // Retry once if the server requires a DPoP nonce we didn't have\n    const nonce = response.headers.get(\"dpop-nonce\");\n    if (nonce && nonce !== this.dpopNonce && (response.status === 401 || response.status === 400)) {\n      this.dpopNonce = nonce;\n      try {\n        response = await sendWithProof();\n      } catch (e) {\n        throw new Error(`fetchHandler retry failed: ${(e as Error).message}`);\n      }\n      const retryNonce = response.headers.get(\"dpop-nonce\");\n      if (retryNonce) {\n        this.dpopNonce = retryNonce;\n      }\n    } else if (nonce) {\n      this.dpopNonce = nonce;\n    }\n\n    return response;\n  }\n}\n","import type { StorageAdapter } from \"./types\";\n\nexport class MemoryStorage implements StorageAdapter {\n  private data = new Map<string, string>();\n\n  async get(key: string): Promise<string | null> {\n    return this.data.get(key) ?? null;\n  }\n\n  async set(key: string, value: string): Promise<void> {\n    this.data.set(key, value);\n  }\n\n  async delete(key: string): Promise<void> {\n    this.data.delete(key);\n  }\n}\n","import type { Key } from \"@atproto/jwk\";\nimport { ApiError } from \"./errors\";\nimport { importJwk } from \"./import-jwk\";\nimport { HappyViewSession } from \"./session\";\nimport { MemoryStorage } from \"./storage\";\nimport type {\n  HappyViewOAuthClientOptions,\n  ProvisionKeyResponse,\n  RegisterSessionParams,\n  RegisterSessionResponse,\n  StorageAdapter,\n  StoredSession,\n} from \"./types\";\n\nconst STORAGE_PREFIX = \"happyview:session:\";\nexport const LAST_ACTIVE_KEY = \"happyview:last-active-did\";\n\nexport class HappyViewOAuthClient {\n  protected readonly instanceUrl: string;\n  protected readonly clientKey: string;\n  protected readonly storage: StorageAdapter;\n  private readonly clientSecret: string | undefined;\n  protected readonly _fetch: typeof globalThis.fetch;\n\n  constructor(\n    options: HappyViewOAuthClientOptions & {\n      fetch?: typeof globalThis.fetch;\n    },\n  ) {\n    this.instanceUrl = options.instanceUrl.replace(/\\/+$/, \"\");\n    this.clientKey = options.clientKey;\n    this.clientSecret = options.clientSecret;\n    this.storage = options.storage ?? new MemoryStorage();\n    this._fetch = options.fetch ?? ((input: RequestInfo | URL, init?: RequestInit) => fetch(input, init)) as typeof globalThis.fetch;\n  }\n\n  get isConfidential(): boolean {\n    return this.clientSecret !== undefined;\n  }\n\n  async provisionDpopKey(): Promise<{\n    provisionId: string;\n    dpopKey: Key;\n    rawJwk: JsonWebKey;\n    pkceVerifier?: string;\n  }> {\n    const headers: Record<string, string> = {\n      \"content-type\": \"application/json\",\n      \"x-client-key\": this.clientKey,\n    };\n    if (this.clientSecret) {\n      headers[\"x-client-secret\"] = this.clientSecret;\n    }\n\n    const body: Record<string, unknown> = {};\n    let pkceVerifier: string | undefined;\n\n    if (!this.isConfidential) {\n      pkceVerifier = generatePkceVerifier();\n      const challenge = await computePkceChallenge(pkceVerifier);\n      body.pkce_challenge = challenge;\n    }\n\n    const resp = await this._fetch(`${this.instanceUrl}/oauth/dpop-keys`, {\n      method: \"POST\",\n      headers,\n      body: JSON.stringify(body),\n    });\n\n    if (!resp.ok) {\n      const body = await resp.json().catch(() => ({}));\n      throw new ApiError(\n        `Failed to provision DPoP key: ${resp.status} ${(body as any).message ?? resp.statusText}`,\n        resp.status,\n        body,\n      );\n    }\n\n    const data: ProvisionKeyResponse = await resp.json();\n    const dpopKey = await importJwk(data.dpop_key);\n    return {\n      provisionId: data.provision_id,\n      dpopKey,\n      rawJwk: data.dpop_key,\n      pkceVerifier,\n    };\n  }\n\n  async registerSession(\n    params: RegisterSessionParams,\n  ): Promise<HappyViewSession> {\n    const headers: Record<string, string> = {\n      \"content-type\": \"application/json\",\n      \"x-client-key\": this.clientKey,\n    };\n    if (this.clientSecret) {\n      headers[\"x-client-secret\"] = this.clientSecret;\n    }\n\n    const body: Record<string, unknown> = {\n      provision_id: params.provisionId,\n      did: params.did,\n      access_token: params.accessToken,\n      refresh_token: params.refreshToken,\n      scopes: params.scopes,\n      pds_url: params.pdsUrl,\n      issuer: params.issuer,\n    };\n\n    if (!this.isConfidential && params.pkceVerifier) {\n      body.pkce_verifier = params.pkceVerifier;\n    }\n\n    const resp = await this._fetch(`${this.instanceUrl}/oauth/sessions`, {\n      method: \"POST\",\n      headers,\n      body: JSON.stringify(body),\n    });\n\n    if (!resp.ok) {\n      const body = await resp.json().catch(() => ({}));\n      throw new ApiError(\n        `Failed to register session: ${resp.status} ${(body as any).message ?? resp.statusText}`,\n        resp.status,\n        body,\n      );\n    }\n\n    const data: RegisterSessionResponse = await resp.json();\n    const dpopKey = await importJwk(params.dpopKey);\n\n    const storedSession: StoredSession = {\n      did: data.did,\n      dpopKey: params.dpopKey,\n      accessToken: params.accessToken,\n      clientKey: this.clientKey,\n      instanceUrl: this.instanceUrl,\n    };\n    await this.storage.set(\n      `${STORAGE_PREFIX}${data.did}`,\n      JSON.stringify(storedSession),\n    );\n    await this.storage.set(LAST_ACTIVE_KEY, data.did);\n\n    return new HappyViewSession({\n      did: data.did,\n      dpopKey,\n      accessToken: params.accessToken,\n      clientKey: this.clientKey,\n      instanceUrl: this.instanceUrl,\n      fetch: this._fetch,\n    });\n  }\n\n  async deleteSession(did: string): Promise<void> {\n    const session = await this.restoreSession(did);\n    if (session) {\n      const resp = await session.fetchHandler(\n        `${this.instanceUrl}/oauth/sessions/${did}`,\n        { method: \"DELETE\" },\n      );\n\n      if (!resp.ok && resp.status !== 404) {\n        const body = await resp.json().catch(() => ({}));\n        throw new ApiError(\n          `Failed to delete session: ${resp.status} ${(body as any).message ?? resp.statusText}`,\n          resp.status,\n          body,\n        );\n      }\n    }\n\n    await this.storage.delete(`${STORAGE_PREFIX}${did}`);\n\n    const lastActive = await this.storage.get(LAST_ACTIVE_KEY);\n    if (lastActive === did) {\n      await this.storage.delete(LAST_ACTIVE_KEY);\n    }\n  }\n\n  async restoreSession(did: string): Promise<HappyViewSession | null> {\n    const stored = await this.storage.get(`${STORAGE_PREFIX}${did}`);\n    if (!stored) return null;\n\n    const data: StoredSession = JSON.parse(stored);\n    const dpopKey = await importJwk(data.dpopKey);\n    return new HappyViewSession({\n      did: data.did,\n      dpopKey,\n      accessToken: data.accessToken,\n      clientKey: data.clientKey,\n      instanceUrl: data.instanceUrl,\n      fetch: this._fetch,\n    });\n  }\n\n  async restore(): Promise<HappyViewSession | null> {\n    const did = await this.storage.get(LAST_ACTIVE_KEY);\n    if (!did) return null;\n    return this.restoreSession(did);\n  }\n}\n\n// PKCE helpers — inline since they're just a few lines of Web Crypto\nfunction generatePkceVerifier(): string {\n  const bytes = crypto.getRandomValues(new Uint8Array(32));\n  let binary = \"\";\n  for (let i = 0; i < bytes.length; i++) {\n    binary += String.fromCharCode(bytes[i]);\n  }\n  return btoa(binary)\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/, \"\");\n}\n\nasync function computePkceChallenge(verifier: string): Promise<string> {\n  const hash = await crypto.subtle.digest(\n    \"SHA-256\",\n    new TextEncoder().encode(verifier),\n  );\n  const bytes = new Uint8Array(hash);\n  let binary = \"\";\n  for (let i = 0; i < bytes.length; i++) {\n    binary += String.fromCharCode(bytes[i]);\n  }\n  return btoa(binary)\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/, \"\");\n}\n"],"mappings":";AAAO,IAAM,iBAAN,cAA6B,MAAM;AAAA,EACxC,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,WAAN,cAAuB,eAAe;AAAA,EAClC;AAAA,EACA;AAAA,EAET,YAAY,SAAiB,QAAgB,MAAgB;AAC3D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,sBAAN,cAAkC,eAAe;AAAA,EAC7C;AAAA,EAET,YAAY,SAAiB,SAAiB,KAAK;AACjD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AACF;AAEO,IAAM,oBAAN,cAAgC,eAAe;AAAA,EACpD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,qBAAN,cAAiC,eAAe;AAAA,EAC5C;AAAA,EACA;AAAA,EAET,YAAY,SAAiB,QAAgB,MAAc;AACzD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,kBAAN,cAA8B,eAAe;AAAA,EAClD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;;;ACrDA,SAAS,oBAAoB;AAM7B,eAAsB,UAAU,KAAwC;AACtE,QAAM,aAAa,MAAM,OAAO,OAAO;AAAA,IACrC;AAAA,IACA;AAAA,IACA,EAAE,MAAM,SAAS,YAAY,QAAQ;AAAA,IACrC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AAGA,QAAM,EAAE,GAAG,GAAG,GAAG,gBAAgB,IAAI;AACrC,QAAM,YAAY,MAAM,OAAO,OAAO;AAAA,IACpC;AAAA,IACA;AAAA,IACA,EAAE,MAAM,SAAS,YAAY,QAAQ;AAAA,IACrC;AAAA,IACA,CAAC,QAAQ;AAAA,EACX;AAEA,SAAO,aAAa,YAAY,EAAE,YAAY,UAAU,CAAC;AAC3D;;;ACfA,SAAS,UAAU,YAA4B;AAC7C,QAAM,QAAQ,OAAO,gBAAgB,IAAI,WAAW,UAAU,CAAC;AAC/D,SAAO,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAC1E;AAEA,SAAS,UAAU,QAA6B;AAC9C,QAAM,QAAQ,IAAI,WAAW,MAAM;AACnC,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EACxC;AACA,SAAO,KAAK,MAAM,EACf,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AACtB;AAEO,IAAM,mBAAN,MAAuB;AAAA,EACnB;AAAA,EAEQ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACT;AAAA,EAER,YAAY,SAAkC;AAC5C,SAAK,MAAM,QAAQ;AACnB,SAAK,UAAU,QAAQ;AACvB,SAAK,cAAc,QAAQ;AAC3B,SAAK,YAAY,QAAQ;AACzB,SAAK,cAAc,QAAQ,YAAY,QAAQ,QAAQ,EAAE;AACzD,SAAK,SAAS,QAAQ,UAAU,CAAC,OAA0B,SAAuB,MAAM,OAAO,IAAI;AAAA,EACrG;AAAA,EAEA,MAAM,aAAa,KAAa,MAAsC;AACpE,UAAM,UAAU,gBAAgB,KAAK,GAAG,IACpC,MACA,GAAG,KAAK,WAAW,GAAG,GAAG;AAC7B,UAAM,UAAU,KAAK,UAAU,OAAO,YAAY;AAClD,UAAM,MAAM,QAAQ,MAAM,GAAG,EAAE,CAAC;AAEhC,UAAM,gBAAgB,YAA+B;AACnD,YAAM,YAAY,MAAM,OAAO,OAAO;AAAA,QACpC;AAAA,QACA,IAAI,YAAY,EAAE,OAAO,KAAK,WAAW;AAAA,MAC3C;AACA,YAAM,MAAM,UAAU,SAAS;AAE/B,YAAM,QAAQ,MAAM,KAAK,QAAQ;AAAA,QAC/B;AAAA,UACE,KAAK;AAAA,UACL,KAAK;AAAA,UACL,KAAK,KAAK,QAAQ;AAAA,QACpB;AAAA,QACA;AAAA,UACE,KAAK;AAAA,UACL;AAAA,UACA,KAAK,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAAA,UACjC,KAAK,UAAU,EAAE;AAAA,UACjB;AAAA,UACA,OAAO,KAAK;AAAA,QACd;AAAA,MACF;AAEA,YAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;AACxC,cAAQ,IAAI,iBAAiB,QAAQ,KAAK,WAAW,EAAE;AACvD,cAAQ,IAAI,QAAQ,KAAK;AACzB,cAAQ,IAAI,gBAAgB,KAAK,SAAS;AAE1C,aAAO,KAAK,OAAO,SAAS,EAAE,GAAG,MAAM,QAAQ,CAAC;AAAA,IAClD;AAEA,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,cAAc;AAAA,IACjC,SAAS,GAAG;AACV,YAAM,OAAO,gBAAgB,OAAO,KAAK,MAAM,eAAe,OAAO,KAAK,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC,UAAU,OAAO;AAChH,YAAM,IAAI,MAAM,wBAAyB,EAAY,OAAO;AAAA;AAAA,SAAc,IAAI,EAAE;AAAA,IAClF;AAGA,UAAM,QAAQ,SAAS,QAAQ,IAAI,YAAY;AAC/C,QAAI,SAAS,UAAU,KAAK,cAAc,SAAS,WAAW,OAAO,SAAS,WAAW,MAAM;AAC7F,WAAK,YAAY;AACjB,UAAI;AACF,mBAAW,MAAM,cAAc;AAAA,MACjC,SAAS,GAAG;AACV,cAAM,IAAI,MAAM,8BAA+B,EAAY,OAAO,EAAE;AAAA,MACtE;AACA,YAAM,aAAa,SAAS,QAAQ,IAAI,YAAY;AACpD,UAAI,YAAY;AACd,aAAK,YAAY;AAAA,MACnB;AAAA,IACF,WAAW,OAAO;AAChB,WAAK,YAAY;AAAA,IACnB;AAEA,WAAO;AAAA,EACT;AACF;;;AC9GO,IAAM,gBAAN,MAA8C;AAAA,EAC3C,OAAO,oBAAI,IAAoB;AAAA,EAEvC,MAAM,IAAI,KAAqC;AAC7C,WAAO,KAAK,KAAK,IAAI,GAAG,KAAK;AAAA,EAC/B;AAAA,EAEA,MAAM,IAAI,KAAa,OAA8B;AACnD,SAAK,KAAK,IAAI,KAAK,KAAK;AAAA,EAC1B;AAAA,EAEA,MAAM,OAAO,KAA4B;AACvC,SAAK,KAAK,OAAO,GAAG;AAAA,EACtB;AACF;;;ACFA,IAAM,iBAAiB;AAChB,IAAM,kBAAkB;AAExB,IAAM,uBAAN,MAA2B;AAAA,EACb;AAAA,EACA;AAAA,EACA;AAAA,EACF;AAAA,EACE;AAAA,EAEnB,YACE,SAGA;AACA,SAAK,cAAc,QAAQ,YAAY,QAAQ,QAAQ,EAAE;AACzD,SAAK,YAAY,QAAQ;AACzB,SAAK,eAAe,QAAQ;AAC5B,SAAK,UAAU,QAAQ,WAAW,IAAI,cAAc;AACpD,SAAK,SAAS,QAAQ,UAAU,CAAC,OAA0B,SAAuB,MAAM,OAAO,IAAI;AAAA,EACrG;AAAA,EAEA,IAAI,iBAA0B;AAC5B,WAAO,KAAK,iBAAiB;AAAA,EAC/B;AAAA,EAEA,MAAM,mBAKH;AACD,UAAM,UAAkC;AAAA,MACtC,gBAAgB;AAAA,MAChB,gBAAgB,KAAK;AAAA,IACvB;AACA,QAAI,KAAK,cAAc;AACrB,cAAQ,iBAAiB,IAAI,KAAK;AAAA,IACpC;AAEA,UAAM,OAAgC,CAAC;AACvC,QAAI;AAEJ,QAAI,CAAC,KAAK,gBAAgB;AACxB,qBAAe,qBAAqB;AACpC,YAAM,YAAY,MAAM,qBAAqB,YAAY;AACzD,WAAK,iBAAiB;AAAA,IACxB;AAEA,UAAM,OAAO,MAAM,KAAK,OAAO,GAAG,KAAK,WAAW,oBAAoB;AAAA,MACpE,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAED,QAAI,CAAC,KAAK,IAAI;AACZ,YAAMA,QAAO,MAAM,KAAK,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,YAAM,IAAI;AAAA,QACR,iCAAiC,KAAK,MAAM,IAAKA,MAAa,WAAW,KAAK,UAAU;AAAA,QACxF,KAAK;AAAA,QACLA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,OAA6B,MAAM,KAAK,KAAK;AACnD,UAAM,UAAU,MAAM,UAAU,KAAK,QAAQ;AAC7C,WAAO;AAAA,MACL,aAAa,KAAK;AAAA,MAClB;AAAA,MACA,QAAQ,KAAK;AAAA,MACb;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,gBACJ,QAC2B;AAC3B,UAAM,UAAkC;AAAA,MACtC,gBAAgB;AAAA,MAChB,gBAAgB,KAAK;AAAA,IACvB;AACA,QAAI,KAAK,cAAc;AACrB,cAAQ,iBAAiB,IAAI,KAAK;AAAA,IACpC;AAEA,UAAM,OAAgC;AAAA,MACpC,cAAc,OAAO;AAAA,MACrB,KAAK,OAAO;AAAA,MACZ,cAAc,OAAO;AAAA,MACrB,eAAe,OAAO;AAAA,MACtB,QAAQ,OAAO;AAAA,MACf,SAAS,OAAO;AAAA,MAChB,QAAQ,OAAO;AAAA,IACjB;AAEA,QAAI,CAAC,KAAK,kBAAkB,OAAO,cAAc;AAC/C,WAAK,gBAAgB,OAAO;AAAA,IAC9B;AAEA,UAAM,OAAO,MAAM,KAAK,OAAO,GAAG,KAAK,WAAW,mBAAmB;AAAA,MACnE,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAED,QAAI,CAAC,KAAK,IAAI;AACZ,YAAMA,QAAO,MAAM,KAAK,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,YAAM,IAAI;AAAA,QACR,+BAA+B,KAAK,MAAM,IAAKA,MAAa,WAAW,KAAK,UAAU;AAAA,QACtF,KAAK;AAAA,QACLA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,OAAgC,MAAM,KAAK,KAAK;AACtD,UAAM,UAAU,MAAM,UAAU,OAAO,OAAO;AAE9C,UAAM,gBAA+B;AAAA,MACnC,KAAK,KAAK;AAAA,MACV,SAAS,OAAO;AAAA,MAChB,aAAa,OAAO;AAAA,MACpB,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,IACpB;AACA,UAAM,KAAK,QAAQ;AAAA,MACjB,GAAG,cAAc,GAAG,KAAK,GAAG;AAAA,MAC5B,KAAK,UAAU,aAAa;AAAA,IAC9B;AACA,UAAM,KAAK,QAAQ,IAAI,iBAAiB,KAAK,GAAG;AAEhD,WAAO,IAAI,iBAAiB;AAAA,MAC1B,KAAK,KAAK;AAAA,MACV;AAAA,MACA,aAAa,OAAO;AAAA,MACpB,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,MAClB,OAAO,KAAK;AAAA,IACd,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,cAAc,KAA4B;AAC9C,UAAM,UAAU,MAAM,KAAK,eAAe,GAAG;AAC7C,QAAI,SAAS;AACX,YAAM,OAAO,MAAM,QAAQ;AAAA,QACzB,GAAG,KAAK,WAAW,mBAAmB,GAAG;AAAA,QACzC,EAAE,QAAQ,SAAS;AAAA,MACrB;AAEA,UAAI,CAAC,KAAK,MAAM,KAAK,WAAW,KAAK;AACnC,cAAM,OAAO,MAAM,KAAK,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,cAAM,IAAI;AAAA,UACR,6BAA6B,KAAK,MAAM,IAAK,KAAa,WAAW,KAAK,UAAU;AAAA,UACpF,KAAK;AAAA,UACL;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,KAAK,QAAQ,OAAO,GAAG,cAAc,GAAG,GAAG,EAAE;AAEnD,UAAM,aAAa,MAAM,KAAK,QAAQ,IAAI,eAAe;AACzD,QAAI,eAAe,KAAK;AACtB,YAAM,KAAK,QAAQ,OAAO,eAAe;AAAA,IAC3C;AAAA,EACF;AAAA,EAEA,MAAM,eAAe,KAA+C;AAClE,UAAM,SAAS,MAAM,KAAK,QAAQ,IAAI,GAAG,cAAc,GAAG,GAAG,EAAE;AAC/D,QAAI,CAAC,OAAQ,QAAO;AAEpB,UAAM,OAAsB,KAAK,MAAM,MAAM;AAC7C,UAAM,UAAU,MAAM,UAAU,KAAK,OAAO;AAC5C,WAAO,IAAI,iBAAiB;AAAA,MAC1B,KAAK,KAAK;AAAA,MACV;AAAA,MACA,aAAa,KAAK;AAAA,MAClB,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,MAClB,OAAO,KAAK;AAAA,IACd,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,UAA4C;AAChD,UAAM,MAAM,MAAM,KAAK,QAAQ,IAAI,eAAe;AAClD,QAAI,CAAC,IAAK,QAAO;AACjB,WAAO,KAAK,eAAe,GAAG;AAAA,EAChC;AACF;AAGA,SAAS,uBAA+B;AACtC,QAAM,QAAQ,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AACvD,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EACxC;AACA,SAAO,KAAK,MAAM,EACf,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AACtB;AAEA,eAAe,qBAAqB,UAAmC;AACrE,QAAM,OAAO,MAAM,OAAO,OAAO;AAAA,IAC/B;AAAA,IACA,IAAI,YAAY,EAAE,OAAO,QAAQ;AAAA,EACnC;AACA,QAAM,QAAQ,IAAI,WAAW,IAAI;AACjC,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EACxC;AACA,SAAO,KAAK,MAAM,EACf,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AACtB;","names":["body"]}
+{"version":3,"sources":["../src/index.ts","../src/errors.ts","../src/import-jwk.ts","../src/session.ts","../src/storage.ts","../src/client.ts"],"sourcesContent":["export * from \"@atproto/jwk\";\nexport * from \"@atproto/jwk-webcrypto\";\n\nexport { HappyViewOAuthClient, LAST_ACTIVE_KEY } from \"./client\";\nexport type { FetchMetadataOptions } from \"./client\";\nexport { importJwk } from \"./import-jwk\";\nexport {\n  ApiError,\n  AuthenticationError,\n  HappyViewError,\n  InvalidStateError,\n  OAuthCallbackError,\n  ResolutionError,\n  TokenExchangeError,\n} from \"./errors\";\nexport { HappyViewSession } from \"./session\";\nexport type { HappyViewSessionOptions } from \"./session\";\nexport { MemoryStorage } from \"./storage\";\nexport type {\n  DpopProvision,\n  HappyViewOAuthClientOptions,\n  ProvisionKeyResponse,\n  RegisterSessionParams,\n  RegisterSessionResponse,\n  SessionEventHooks,\n  StorageAdapter,\n  StoredSession,\n  TokenInfo,\n} from \"./types\";\n","export class HappyViewError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"HappyViewError\";\n  }\n}\n\nexport class ApiError extends HappyViewError {\n  readonly status: number;\n  readonly body: unknown;\n\n  constructor(message: string, status: number, body?: unknown) {\n    super(message);\n    this.name = \"ApiError\";\n    this.status = status;\n    this.body = body;\n  }\n}\n\nexport class AuthenticationError extends HappyViewError {\n  readonly status: number;\n\n  constructor(message: string, status: number = 401) {\n    super(message);\n    this.name = \"AuthenticationError\";\n    this.status = status;\n  }\n}\n\nexport class InvalidStateError extends HappyViewError {\n  constructor(message: string) {\n    super(message);\n    this.name = \"InvalidStateError\";\n  }\n}\n\nexport class TokenExchangeError extends HappyViewError {\n  readonly status: number;\n  readonly body: string;\n\n  constructor(message: string, status: number, body: string) {\n    super(message);\n    this.name = \"TokenExchangeError\";\n    this.status = status;\n    this.body = body;\n  }\n}\n\nexport class ResolutionError extends HappyViewError {\n  constructor(message: string) {\n    super(message);\n    this.name = \"ResolutionError\";\n  }\n}\n\nexport class OAuthCallbackError extends HappyViewError {\n  readonly params: URLSearchParams;\n  readonly state: string | undefined;\n\n  static from(\n    err: unknown,\n    params: URLSearchParams,\n    state?: string,\n  ): OAuthCallbackError {\n    if (err instanceof OAuthCallbackError) return err;\n    const message = err instanceof Error ? err.message : undefined;\n    return new OAuthCallbackError(params, message, state, err);\n  }\n\n  constructor(\n    params: URLSearchParams,\n    message?: string,\n    state?: string,\n    cause?: unknown,\n  ) {\n    super(\n      message ??\n        params.get(\"error_description\") ??\n        \"OAuth callback error\",\n    );\n    this.name = \"OAuthCallbackError\";\n    this.params = params;\n    this.state = state;\n    if (cause !== undefined) {\n      this.cause = cause;\n    }\n  }\n}\n","import { WebcryptoKey } from \"@atproto/jwk-webcrypto\";\n\n/**\n * Import a raw ES256 JWK (as returned by HappyView's /oauth/dpop-keys)\n * into a WebcryptoKey that can sign JWTs.\n */\nexport async function importJwk(jwk: JsonWebKey): Promise<WebcryptoKey> {\n  const privateKey = await crypto.subtle.importKey(\n    \"jwk\",\n    jwk,\n    { name: \"ECDSA\", namedCurve: \"P-256\" },\n    true,\n    [\"sign\"],\n  );\n\n  // Derive public key by stripping the private component\n  const { d: _, ...publicJwkFields } = jwk;\n  const publicKey = await crypto.subtle.importKey(\n    \"jwk\",\n    publicJwkFields,\n    { name: \"ECDSA\", namedCurve: \"P-256\" },\n    true,\n    [\"verify\"],\n  );\n\n  return WebcryptoKey.fromKeypair({ privateKey, publicKey });\n}\n","import type { Key } from \"@atproto/jwk\";\nimport type { TokenInfo } from \"./types\";\n\nexport interface HappyViewSessionOptions {\n  did: string;\n  dpopKey: Key;\n  accessToken: string;\n  clientKey: string;\n  instanceUrl: string;\n  scopes?: string;\n  pdsUrl?: string;\n  issuer?: string;\n  fetch?: typeof globalThis.fetch;\n  onSignOut?: () => Promise<void>;\n}\n\nfunction randomHex(byteLength: number): string {\n  const bytes = crypto.getRandomValues(new Uint8Array(byteLength));\n  return Array.from(bytes, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction base64url(buffer: ArrayBuffer): string {\n  const bytes = new Uint8Array(buffer);\n  let binary = \"\";\n  for (let i = 0; i < bytes.length; i++) {\n    binary += String.fromCharCode(bytes[i]);\n  }\n  return btoa(binary)\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/, \"\");\n}\n\nexport class HappyViewSession {\n  readonly did: string;\n\n  private readonly dpopKey: Key;\n  private readonly accessToken: string;\n  private readonly clientKey: string;\n  private readonly instanceUrl: string;\n  private readonly _scopes: string | undefined;\n  private readonly _pdsUrl: string | undefined;\n  private readonly _issuer: string | undefined;\n  private readonly _fetch: typeof globalThis.fetch;\n  private readonly _onSignOut: (() => Promise<void>) | undefined;\n  private dpopNonce: string | undefined;\n\n  constructor(options: HappyViewSessionOptions) {\n    this.did = options.did;\n    this.dpopKey = options.dpopKey;\n    this.accessToken = options.accessToken;\n    this.clientKey = options.clientKey;\n    this.instanceUrl = options.instanceUrl.replace(/\\/+$/, \"\");\n    this._scopes = options.scopes;\n    this._pdsUrl = options.pdsUrl;\n    this._issuer = options.issuer;\n    this._fetch = options.fetch ?? ((input: RequestInfo | URL, init?: RequestInit) => fetch(input, init)) as typeof globalThis.fetch;\n    this._onSignOut = options.onSignOut;\n  }\n\n  get sub(): string {\n    return this.did;\n  }\n\n  getTokenInfo(): TokenInfo {\n    return {\n      scope: this._scopes,\n      iss: this._issuer,\n      aud: this._pdsUrl,\n      sub: this.did,\n    };\n  }\n\n  async signOut(): Promise<void> {\n    if (this._onSignOut) {\n      await this._onSignOut();\n    }\n  }\n\n  async fetchHandler(url: string, init: RequestInit): Promise<Response> {\n    const fullUrl = /^https?:\\/\\//i.test(url)\n      ? url\n      : `${this.instanceUrl}${url}`;\n    const method = (init.method ?? \"GET\").toUpperCase();\n    const htu = fullUrl.split(\"?\")[0];\n\n    const sendWithProof = async (): Promise<Response> => {\n      const tokenHash = await crypto.subtle.digest(\n        \"SHA-256\",\n        new TextEncoder().encode(this.accessToken),\n      );\n      const ath = base64url(tokenHash);\n\n      const proof = await this.dpopKey.createJwt(\n        {\n          alg: \"ES256\",\n          typ: \"dpop+jwt\",\n          jwk: this.dpopKey.publicJwk!,\n        },\n        {\n          htm: method,\n          htu,\n          iat: Math.floor(Date.now() / 1000),\n          jti: randomHex(16),\n          ath,\n          nonce: this.dpopNonce,\n        },\n      );\n\n      const headers = new Headers(init.headers);\n      headers.set(\"authorization\", `DPoP ${this.accessToken}`);\n      headers.set(\"dpop\", proof);\n      headers.set(\"x-client-key\", this.clientKey);\n\n      return this._fetch(fullUrl, { ...init, headers });\n    };\n\n    let response: Response;\n    try {\n      response = await sendWithProof();\n    } catch (e) {\n      const info = `_fetch type: ${typeof this._fetch}, toString: ${String(this._fetch).slice(0, 120)}, url: ${fullUrl}`;\n      throw new Error(`fetchHandler failed: ${(e as Error).message}\\n\\nDEBUG: ${info}`);\n    }\n\n    // Retry once if the server requires a DPoP nonce we didn't have\n    const nonce = response.headers.get(\"dpop-nonce\");\n    if (nonce && nonce !== this.dpopNonce && (response.status === 401 || response.status === 400)) {\n      this.dpopNonce = nonce;\n      try {\n        response = await sendWithProof();\n      } catch (e) {\n        throw new Error(`fetchHandler retry failed: ${(e as Error).message}`);\n      }\n      const retryNonce = response.headers.get(\"dpop-nonce\");\n      if (retryNonce) {\n        this.dpopNonce = retryNonce;\n      }\n    } else if (nonce) {\n      this.dpopNonce = nonce;\n    }\n\n    return response;\n  }\n}\n","import type { StorageAdapter } from \"./types\";\n\nexport class MemoryStorage implements StorageAdapter {\n  private data = new Map<string, string>();\n\n  async get(key: string): Promise<string | null> {\n    return this.data.get(key) ?? null;\n  }\n\n  async set(key: string, value: string): Promise<void> {\n    this.data.set(key, value);\n  }\n\n  async delete(key: string): Promise<void> {\n    this.data.delete(key);\n  }\n}\n","import type { Key } from \"@atproto/jwk\";\nimport { ApiError } from \"./errors\";\nimport { importJwk } from \"./import-jwk\";\nimport { HappyViewSession } from \"./session\";\nimport { MemoryStorage } from \"./storage\";\nimport type {\n  HappyViewOAuthClientOptions,\n  ProvisionKeyResponse,\n  RegisterSessionParams,\n  RegisterSessionResponse,\n  SessionEventHooks,\n  StorageAdapter,\n  StoredSession,\n} from \"./types\";\n\nconst STORAGE_PREFIX = \"happyview:session:\";\nexport const LAST_ACTIVE_KEY = \"happyview:last-active-did\";\n\nexport interface FetchMetadataOptions {\n  clientId: string;\n  fetch?: typeof globalThis.fetch;\n  signal?: AbortSignal;\n}\n\nexport class HappyViewOAuthClient {\n  static async fetchMetadata({\n    clientId,\n    fetch: fetchFn = globalThis.fetch,\n    signal,\n  }: FetchMetadataOptions): Promise<Record<string, unknown>> {\n    signal?.throwIfAborted();\n    const resp = await fetchFn(clientId, { redirect: \"error\", signal });\n    if (resp.status !== 200) {\n      resp.body?.cancel?.();\n      throw new Error(`Failed to fetch client metadata: ${resp.status}`);\n    }\n    const mime = resp.headers.get(\"content-type\")?.split(\";\")[0].trim();\n    if (mime !== \"application/json\") {\n      resp.body?.cancel?.();\n      throw new Error(`Invalid client metadata content type: ${mime}`);\n    }\n    return resp.json() as Promise<Record<string, unknown>>;\n  }\n\n  protected readonly instanceUrl: string;\n  protected readonly clientKey: string;\n  protected readonly storage: StorageAdapter;\n  private readonly clientSecret: string | undefined;\n  protected readonly _fetch: typeof globalThis.fetch;\n  private readonly sessionHooks: SessionEventHooks;\n\n  constructor(\n    options: HappyViewOAuthClientOptions & {\n      fetch?: typeof globalThis.fetch;\n    },\n  ) {\n    this.instanceUrl = options.instanceUrl.replace(/\\/+$/, \"\");\n    this.clientKey = options.clientKey;\n    this.clientSecret = options.clientSecret;\n    this.storage = options.storage ?? new MemoryStorage();\n    this._fetch = options.fetch ?? ((input: RequestInfo | URL, init?: RequestInit) => fetch(input, init)) as typeof globalThis.fetch;\n    this.sessionHooks = options.sessionHooks ?? {};\n  }\n\n  get isConfidential(): boolean {\n    return this.clientSecret !== undefined;\n  }\n\n  async provisionDpopKey(): Promise<{\n    provisionId: string;\n    dpopKey: Key;\n    rawJwk: JsonWebKey;\n    pkceVerifier?: string;\n  }> {\n    const headers: Record<string, string> = {\n      \"content-type\": \"application/json\",\n      \"x-client-key\": this.clientKey,\n    };\n    if (this.clientSecret) {\n      headers[\"x-client-secret\"] = this.clientSecret;\n    }\n\n    const body: Record<string, unknown> = {};\n    let pkceVerifier: string | undefined;\n\n    if (!this.isConfidential) {\n      pkceVerifier = generatePkceVerifier();\n      const challenge = await computePkceChallenge(pkceVerifier);\n      body.pkce_challenge = challenge;\n    }\n\n    const resp = await this._fetch(`${this.instanceUrl}/oauth/dpop-keys`, {\n      method: \"POST\",\n      headers,\n      body: JSON.stringify(body),\n    });\n\n    if (!resp.ok) {\n      const body = await resp.json().catch(() => ({}));\n      throw new ApiError(\n        `Failed to provision DPoP key: ${resp.status} ${(body as any).message ?? resp.statusText}`,\n        resp.status,\n        body,\n      );\n    }\n\n    const data: ProvisionKeyResponse = await resp.json();\n    const dpopKey = await importJwk(data.dpop_key);\n    return {\n      provisionId: data.provision_id,\n      dpopKey,\n      rawJwk: data.dpop_key,\n      pkceVerifier,\n    };\n  }\n\n  async registerSession(\n    params: RegisterSessionParams,\n  ): Promise<HappyViewSession> {\n    const headers: Record<string, string> = {\n      \"content-type\": \"application/json\",\n      \"x-client-key\": this.clientKey,\n    };\n    if (this.clientSecret) {\n      headers[\"x-client-secret\"] = this.clientSecret;\n    }\n\n    const body: Record<string, unknown> = {\n      provision_id: params.provisionId,\n      did: params.did,\n      access_token: params.accessToken,\n      refresh_token: params.refreshToken,\n      scopes: params.scopes,\n      pds_url: params.pdsUrl,\n      issuer: params.issuer,\n    };\n\n    if (!this.isConfidential && params.pkceVerifier) {\n      body.pkce_verifier = params.pkceVerifier;\n    }\n\n    const resp = await this._fetch(`${this.instanceUrl}/oauth/sessions`, {\n      method: \"POST\",\n      headers,\n      body: JSON.stringify(body),\n    });\n\n    if (!resp.ok) {\n      const body = await resp.json().catch(() => ({}));\n      throw new ApiError(\n        `Failed to register session: ${resp.status} ${(body as any).message ?? resp.statusText}`,\n        resp.status,\n        body,\n      );\n    }\n\n    const data: RegisterSessionResponse = await resp.json();\n    const dpopKey = await importJwk(params.dpopKey);\n\n    const storedSession: StoredSession = {\n      did: data.did,\n      dpopKey: params.dpopKey,\n      accessToken: params.accessToken,\n      clientKey: this.clientKey,\n      instanceUrl: this.instanceUrl,\n      scopes: params.scopes,\n      pdsUrl: params.pdsUrl,\n      issuer: params.issuer,\n    };\n    await this.storage.set(\n      `${STORAGE_PREFIX}${data.did}`,\n      JSON.stringify(storedSession),\n    );\n    await this.storage.set(LAST_ACTIVE_KEY, data.did);\n\n    const session = new HappyViewSession({\n      did: data.did,\n      dpopKey,\n      accessToken: params.accessToken,\n      clientKey: this.clientKey,\n      instanceUrl: this.instanceUrl,\n      scopes: params.scopes,\n      pdsUrl: params.pdsUrl,\n      issuer: params.issuer,\n      fetch: this._fetch,\n      onSignOut: () => this.deleteSession(data.did),\n    });\n\n    this.sessionHooks.onSessionUpdate?.(data.did);\n\n    return session;\n  }\n\n  async deleteSession(did: string): Promise<void> {\n    const session = await this.restoreSession(did);\n    if (session) {\n      const resp = await session.fetchHandler(\n        `${this.instanceUrl}/oauth/sessions/${did}`,\n        { method: \"DELETE\" },\n      );\n\n      if (!resp.ok && resp.status !== 404) {\n        const body = await resp.json().catch(() => ({}));\n        throw new ApiError(\n          `Failed to delete session: ${resp.status} ${(body as any).message ?? resp.statusText}`,\n          resp.status,\n          body,\n        );\n      }\n    }\n\n    await this.storage.delete(`${STORAGE_PREFIX}${did}`);\n\n    const lastActive = await this.storage.get(LAST_ACTIVE_KEY);\n    if (lastActive === did) {\n      await this.storage.delete(LAST_ACTIVE_KEY);\n    }\n\n    this.sessionHooks.onSessionDelete?.(did);\n  }\n\n  async restoreSession(did: string): Promise<HappyViewSession | null> {\n    const stored = await this.storage.get(`${STORAGE_PREFIX}${did}`);\n    if (!stored) return null;\n\n    const data: StoredSession = JSON.parse(stored);\n    const dpopKey = await importJwk(data.dpopKey);\n    return new HappyViewSession({\n      did: data.did,\n      dpopKey,\n      accessToken: data.accessToken,\n      clientKey: data.clientKey,\n      instanceUrl: data.instanceUrl,\n      scopes: data.scopes,\n      pdsUrl: data.pdsUrl,\n      issuer: data.issuer,\n      fetch: this._fetch,\n      onSignOut: () => this.deleteSession(data.did),\n    });\n  }\n\n  async restore(): Promise<HappyViewSession | null> {\n    const did = await this.storage.get(LAST_ACTIVE_KEY);\n    if (!did) return null;\n    return this.restoreSession(did);\n  }\n}\n\n// PKCE helpers — inline since they're just a few lines of Web Crypto\nfunction generatePkceVerifier(): string {\n  const bytes = crypto.getRandomValues(new Uint8Array(32));\n  let binary = \"\";\n  for (let i = 0; i < bytes.length; i++) {\n    binary += String.fromCharCode(bytes[i]);\n  }\n  return btoa(binary)\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/, \"\");\n}\n\nasync function computePkceChallenge(verifier: string): Promise<string> {\n  const hash = await crypto.subtle.digest(\n    \"SHA-256\",\n    new TextEncoder().encode(verifier),\n  );\n  const bytes = new Uint8Array(hash);\n  let binary = \"\";\n  for (let i = 0; i < bytes.length; i++) {\n    binary += String.fromCharCode(bytes[i]);\n  }\n  return btoa(binary)\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/, \"\");\n}\n"],"mappings":";AAAA,cAAc;AACd,cAAc;;;ACDP,IAAM,iBAAN,cAA6B,MAAM;AAAA,EACxC,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,WAAN,cAAuB,eAAe;AAAA,EAClC;AAAA,EACA;AAAA,EAET,YAAY,SAAiB,QAAgB,MAAgB;AAC3D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,sBAAN,cAAkC,eAAe;AAAA,EAC7C;AAAA,EAET,YAAY,SAAiB,SAAiB,KAAK;AACjD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AACF;AAEO,IAAM,oBAAN,cAAgC,eAAe;AAAA,EACpD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,qBAAN,cAAiC,eAAe;AAAA,EAC5C;AAAA,EACA;AAAA,EAET,YAAY,SAAiB,QAAgB,MAAc;AACzD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,kBAAN,cAA8B,eAAe;AAAA,EAClD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,qBAAN,MAAM,4BAA2B,eAAe;AAAA,EAC5C;AAAA,EACA;AAAA,EAET,OAAO,KACL,KACA,QACA,OACoB;AACpB,QAAI,eAAe,oBAAoB,QAAO;AAC9C,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,WAAO,IAAI,oBAAmB,QAAQ,SAAS,OAAO,GAAG;AAAA,EAC3D;AAAA,EAEA,YACE,QACA,SACA,OACA,OACA;AACA;AAAA,MACE,WACE,OAAO,IAAI,mBAAmB,KAC9B;AAAA,IACJ;AACA,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,QAAQ;AACb,QAAI,UAAU,QAAW;AACvB,WAAK,QAAQ;AAAA,IACf;AAAA,EACF;AACF;;;ACvFA,SAAS,oBAAoB;AAM7B,eAAsB,UAAU,KAAwC;AACtE,QAAM,aAAa,MAAM,OAAO,OAAO;AAAA,IACrC;AAAA,IACA;AAAA,IACA,EAAE,MAAM,SAAS,YAAY,QAAQ;AAAA,IACrC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AAGA,QAAM,EAAE,GAAG,GAAG,GAAG,gBAAgB,IAAI;AACrC,QAAM,YAAY,MAAM,OAAO,OAAO;AAAA,IACpC;AAAA,IACA;AAAA,IACA,EAAE,MAAM,SAAS,YAAY,QAAQ;AAAA,IACrC;AAAA,IACA,CAAC,QAAQ;AAAA,EACX;AAEA,SAAO,aAAa,YAAY,EAAE,YAAY,UAAU,CAAC;AAC3D;;;ACVA,SAAS,UAAU,YAA4B;AAC7C,QAAM,QAAQ,OAAO,gBAAgB,IAAI,WAAW,UAAU,CAAC;AAC/D,SAAO,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAC1E;AAEA,SAAS,UAAU,QAA6B;AAC9C,QAAM,QAAQ,IAAI,WAAW,MAAM;AACnC,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EACxC;AACA,SAAO,KAAK,MAAM,EACf,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AACtB;AAEO,IAAM,mBAAN,MAAuB;AAAA,EACnB;AAAA,EAEQ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACT;AAAA,EAER,YAAY,SAAkC;AAC5C,SAAK,MAAM,QAAQ;AACnB,SAAK,UAAU,QAAQ;AACvB,SAAK,cAAc,QAAQ;AAC3B,SAAK,YAAY,QAAQ;AACzB,SAAK,cAAc,QAAQ,YAAY,QAAQ,QAAQ,EAAE;AACzD,SAAK,UAAU,QAAQ;AACvB,SAAK,UAAU,QAAQ;AACvB,SAAK,UAAU,QAAQ;AACvB,SAAK,SAAS,QAAQ,UAAU,CAAC,OAA0B,SAAuB,MAAM,OAAO,IAAI;AACnG,SAAK,aAAa,QAAQ;AAAA,EAC5B;AAAA,EAEA,IAAI,MAAc;AAChB,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,eAA0B;AACxB,WAAO;AAAA,MACL,OAAO,KAAK;AAAA,MACZ,KAAK,KAAK;AAAA,MACV,KAAK,KAAK;AAAA,MACV,KAAK,KAAK;AAAA,IACZ;AAAA,EACF;AAAA,EAEA,MAAM,UAAyB;AAC7B,QAAI,KAAK,YAAY;AACnB,YAAM,KAAK,WAAW;AAAA,IACxB;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,KAAa,MAAsC;AACpE,UAAM,UAAU,gBAAgB,KAAK,GAAG,IACpC,MACA,GAAG,KAAK,WAAW,GAAG,GAAG;AAC7B,UAAM,UAAU,KAAK,UAAU,OAAO,YAAY;AAClD,UAAM,MAAM,QAAQ,MAAM,GAAG,EAAE,CAAC;AAEhC,UAAM,gBAAgB,YAA+B;AACnD,YAAM,YAAY,MAAM,OAAO,OAAO;AAAA,QACpC;AAAA,QACA,IAAI,YAAY,EAAE,OAAO,KAAK,WAAW;AAAA,MAC3C;AACA,YAAM,MAAM,UAAU,SAAS;AAE/B,YAAM,QAAQ,MAAM,KAAK,QAAQ;AAAA,QAC/B;AAAA,UACE,KAAK;AAAA,UACL,KAAK;AAAA,UACL,KAAK,KAAK,QAAQ;AAAA,QACpB;AAAA,QACA;AAAA,UACE,KAAK;AAAA,UACL;AAAA,UACA,KAAK,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAAA,UACjC,KAAK,UAAU,EAAE;AAAA,UACjB;AAAA,UACA,OAAO,KAAK;AAAA,QACd;AAAA,MACF;AAEA,YAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;AACxC,cAAQ,IAAI,iBAAiB,QAAQ,KAAK,WAAW,EAAE;AACvD,cAAQ,IAAI,QAAQ,KAAK;AACzB,cAAQ,IAAI,gBAAgB,KAAK,SAAS;AAE1C,aAAO,KAAK,OAAO,SAAS,EAAE,GAAG,MAAM,QAAQ,CAAC;AAAA,IAClD;AAEA,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,cAAc;AAAA,IACjC,SAAS,GAAG;AACV,YAAM,OAAO,gBAAgB,OAAO,KAAK,MAAM,eAAe,OAAO,KAAK,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC,UAAU,OAAO;AAChH,YAAM,IAAI,MAAM,wBAAyB,EAAY,OAAO;AAAA;AAAA,SAAc,IAAI,EAAE;AAAA,IAClF;AAGA,UAAM,QAAQ,SAAS,QAAQ,IAAI,YAAY;AAC/C,QAAI,SAAS,UAAU,KAAK,cAAc,SAAS,WAAW,OAAO,SAAS,WAAW,MAAM;AAC7F,WAAK,YAAY;AACjB,UAAI;AACF,mBAAW,MAAM,cAAc;AAAA,MACjC,SAAS,GAAG;AACV,cAAM,IAAI,MAAM,8BAA+B,EAAY,OAAO,EAAE;AAAA,MACtE;AACA,YAAM,aAAa,SAAS,QAAQ,IAAI,YAAY;AACpD,UAAI,YAAY;AACd,aAAK,YAAY;AAAA,MACnB;AAAA,IACF,WAAW,OAAO;AAChB,WAAK,YAAY;AAAA,IACnB;AAEA,WAAO;AAAA,EACT;AACF;;;AC9IO,IAAM,gBAAN,MAA8C;AAAA,EAC3C,OAAO,oBAAI,IAAoB;AAAA,EAEvC,MAAM,IAAI,KAAqC;AAC7C,WAAO,KAAK,KAAK,IAAI,GAAG,KAAK;AAAA,EAC/B;AAAA,EAEA,MAAM,IAAI,KAAa,OAA8B;AACnD,SAAK,KAAK,IAAI,KAAK,KAAK;AAAA,EAC1B;AAAA,EAEA,MAAM,OAAO,KAA4B;AACvC,SAAK,KAAK,OAAO,GAAG;AAAA,EACtB;AACF;;;ACDA,IAAM,iBAAiB;AAChB,IAAM,kBAAkB;AAQxB,IAAM,uBAAN,MAA2B;AAAA,EAChC,aAAa,cAAc;AAAA,IACzB;AAAA,IACA,OAAO,UAAU,WAAW;AAAA,IAC5B;AAAA,EACF,GAA2D;AACzD,YAAQ,eAAe;AACvB,UAAM,OAAO,MAAM,QAAQ,UAAU,EAAE,UAAU,SAAS,OAAO,CAAC;AAClE,QAAI,KAAK,WAAW,KAAK;AACvB,WAAK,MAAM,SAAS;AACpB,YAAM,IAAI,MAAM,oCAAoC,KAAK,MAAM,EAAE;AAAA,IACnE;AACA,UAAM,OAAO,KAAK,QAAQ,IAAI,cAAc,GAAG,MAAM,GAAG,EAAE,CAAC,EAAE,KAAK;AAClE,QAAI,SAAS,oBAAoB;AAC/B,WAAK,MAAM,SAAS;AACpB,YAAM,IAAI,MAAM,yCAAyC,IAAI,EAAE;AAAA,IACjE;AACA,WAAO,KAAK,KAAK;AAAA,EACnB;AAAA,EAEmB;AAAA,EACA;AAAA,EACA;AAAA,EACF;AAAA,EACE;AAAA,EACF;AAAA,EAEjB,YACE,SAGA;AACA,SAAK,cAAc,QAAQ,YAAY,QAAQ,QAAQ,EAAE;AACzD,SAAK,YAAY,QAAQ;AACzB,SAAK,eAAe,QAAQ;AAC5B,SAAK,UAAU,QAAQ,WAAW,IAAI,cAAc;AACpD,SAAK,SAAS,QAAQ,UAAU,CAAC,OAA0B,SAAuB,MAAM,OAAO,IAAI;AACnG,SAAK,eAAe,QAAQ,gBAAgB,CAAC;AAAA,EAC/C;AAAA,EAEA,IAAI,iBAA0B;AAC5B,WAAO,KAAK,iBAAiB;AAAA,EAC/B;AAAA,EAEA,MAAM,mBAKH;AACD,UAAM,UAAkC;AAAA,MACtC,gBAAgB;AAAA,MAChB,gBAAgB,KAAK;AAAA,IACvB;AACA,QAAI,KAAK,cAAc;AACrB,cAAQ,iBAAiB,IAAI,KAAK;AAAA,IACpC;AAEA,UAAM,OAAgC,CAAC;AACvC,QAAI;AAEJ,QAAI,CAAC,KAAK,gBAAgB;AACxB,qBAAe,qBAAqB;AACpC,YAAM,YAAY,MAAM,qBAAqB,YAAY;AACzD,WAAK,iBAAiB;AAAA,IACxB;AAEA,UAAM,OAAO,MAAM,KAAK,OAAO,GAAG,KAAK,WAAW,oBAAoB;AAAA,MACpE,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAED,QAAI,CAAC,KAAK,IAAI;AACZ,YAAMA,QAAO,MAAM,KAAK,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,YAAM,IAAI;AAAA,QACR,iCAAiC,KAAK,MAAM,IAAKA,MAAa,WAAW,KAAK,UAAU;AAAA,QACxF,KAAK;AAAA,QACLA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,OAA6B,MAAM,KAAK,KAAK;AACnD,UAAM,UAAU,MAAM,UAAU,KAAK,QAAQ;AAC7C,WAAO;AAAA,MACL,aAAa,KAAK;AAAA,MAClB;AAAA,MACA,QAAQ,KAAK;AAAA,MACb;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,gBACJ,QAC2B;AAC3B,UAAM,UAAkC;AAAA,MACtC,gBAAgB;AAAA,MAChB,gBAAgB,KAAK;AAAA,IACvB;AACA,QAAI,KAAK,cAAc;AACrB,cAAQ,iBAAiB,IAAI,KAAK;AAAA,IACpC;AAEA,UAAM,OAAgC;AAAA,MACpC,cAAc,OAAO;AAAA,MACrB,KAAK,OAAO;AAAA,MACZ,cAAc,OAAO;AAAA,MACrB,eAAe,OAAO;AAAA,MACtB,QAAQ,OAAO;AAAA,MACf,SAAS,OAAO;AAAA,MAChB,QAAQ,OAAO;AAAA,IACjB;AAEA,QAAI,CAAC,KAAK,kBAAkB,OAAO,cAAc;AAC/C,WAAK,gBAAgB,OAAO;AAAA,IAC9B;AAEA,UAAM,OAAO,MAAM,KAAK,OAAO,GAAG,KAAK,WAAW,mBAAmB;AAAA,MACnE,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAED,QAAI,CAAC,KAAK,IAAI;AACZ,YAAMA,QAAO,MAAM,KAAK,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,YAAM,IAAI;AAAA,QACR,+BAA+B,KAAK,MAAM,IAAKA,MAAa,WAAW,KAAK,UAAU;AAAA,QACtF,KAAK;AAAA,QACLA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,OAAgC,MAAM,KAAK,KAAK;AACtD,UAAM,UAAU,MAAM,UAAU,OAAO,OAAO;AAE9C,UAAM,gBAA+B;AAAA,MACnC,KAAK,KAAK;AAAA,MACV,SAAS,OAAO;AAAA,MAChB,aAAa,OAAO;AAAA,MACpB,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,MAClB,QAAQ,OAAO;AAAA,MACf,QAAQ,OAAO;AAAA,MACf,QAAQ,OAAO;AAAA,IACjB;AACA,UAAM,KAAK,QAAQ;AAAA,MACjB,GAAG,cAAc,GAAG,KAAK,GAAG;AAAA,MAC5B,KAAK,UAAU,aAAa;AAAA,IAC9B;AACA,UAAM,KAAK,QAAQ,IAAI,iBAAiB,KAAK,GAAG;AAEhD,UAAM,UAAU,IAAI,iBAAiB;AAAA,MACnC,KAAK,KAAK;AAAA,MACV;AAAA,MACA,aAAa,OAAO;AAAA,MACpB,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,MAClB,QAAQ,OAAO;AAAA,MACf,QAAQ,OAAO;AAAA,MACf,QAAQ,OAAO;AAAA,MACf,OAAO,KAAK;AAAA,MACZ,WAAW,MAAM,KAAK,cAAc,KAAK,GAAG;AAAA,IAC9C,CAAC;AAED,SAAK,aAAa,kBAAkB,KAAK,GAAG;AAE5C,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,cAAc,KAA4B;AAC9C,UAAM,UAAU,MAAM,KAAK,eAAe,GAAG;AAC7C,QAAI,SAAS;AACX,YAAM,OAAO,MAAM,QAAQ;AAAA,QACzB,GAAG,KAAK,WAAW,mBAAmB,GAAG;AAAA,QACzC,EAAE,QAAQ,SAAS;AAAA,MACrB;AAEA,UAAI,CAAC,KAAK,MAAM,KAAK,WAAW,KAAK;AACnC,cAAM,OAAO,MAAM,KAAK,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,cAAM,IAAI;AAAA,UACR,6BAA6B,KAAK,MAAM,IAAK,KAAa,WAAW,KAAK,UAAU;AAAA,UACpF,KAAK;AAAA,UACL;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,KAAK,QAAQ,OAAO,GAAG,cAAc,GAAG,GAAG,EAAE;AAEnD,UAAM,aAAa,MAAM,KAAK,QAAQ,IAAI,eAAe;AACzD,QAAI,eAAe,KAAK;AACtB,YAAM,KAAK,QAAQ,OAAO,eAAe;AAAA,IAC3C;AAEA,SAAK,aAAa,kBAAkB,GAAG;AAAA,EACzC;AAAA,EAEA,MAAM,eAAe,KAA+C;AAClE,UAAM,SAAS,MAAM,KAAK,QAAQ,IAAI,GAAG,cAAc,GAAG,GAAG,EAAE;AAC/D,QAAI,CAAC,OAAQ,QAAO;AAEpB,UAAM,OAAsB,KAAK,MAAM,MAAM;AAC7C,UAAM,UAAU,MAAM,UAAU,KAAK,OAAO;AAC5C,WAAO,IAAI,iBAAiB;AAAA,MAC1B,KAAK,KAAK;AAAA,MACV;AAAA,MACA,aAAa,KAAK;AAAA,MAClB,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,MAClB,QAAQ,KAAK;AAAA,MACb,QAAQ,KAAK;AAAA,MACb,QAAQ,KAAK;AAAA,MACb,OAAO,KAAK;AAAA,MACZ,WAAW,MAAM,KAAK,cAAc,KAAK,GAAG;AAAA,IAC9C,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,UAA4C;AAChD,UAAM,MAAM,MAAM,KAAK,QAAQ,IAAI,eAAe;AAClD,QAAI,CAAC,IAAK,QAAO;AACjB,WAAO,KAAK,eAAe,GAAG;AAAA,EAChC;AACF;AAGA,SAAS,uBAA+B;AACtC,QAAM,QAAQ,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AACvD,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EACxC;AACA,SAAO,KAAK,MAAM,EACf,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AACtB;AAEA,eAAe,qBAAqB,UAAmC;AACrE,QAAM,OAAO,MAAM,OAAO,OAAO;AAAA,IAC/B;AAAA,IACA,IAAI,YAAY,EAAE,OAAO,QAAQ;AAAA,EACnC;AACA,QAAM,QAAQ,IAAI,WAAW,IAAI;AACjC,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EACxC;AACA,SAAO,KAAK,MAAM,EACf,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AACtB;","names":["body"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@happyview/oauth-client",
-  "version": "1.1.0-dev.1",
+  "version": "1.1.0-dev.2",
   "description": "HappyView OAuth client for ATProto DPoP authentication",
   "license": "MIT",
   "repository": {