@happyview/oauth-client 1.3.0 → 1.3.1-dev.1

package/README.md

@@ -95,6 +95,16 @@ const session = await client.restoreSession("did:plc:abc123");
 await client.deleteSession("did:plc:abc123");
 ```
 
+The local session is always cleared, even when the server refuses the revocation. `404`, `401`, and `403` are treated as a completed logout — the credential is already gone or unusable, so there is nothing left to revoke. `5xx` and network errors still throw, so you know revocation may not have reached the server, but they throw after the local cleanup: a failed logout can never leave the user signed in.
+
+To clear a session locally without contacting the server:
+
+```typescript
+await client.forgetSession("did:plc:abc123");
+```
+
+`STORAGE_PREFIX` and `LAST_ACTIVE_KEY` are exported for tooling that needs to inspect stored sessions directly.
+
 ## Adapters
 
 ### CryptoAdapter

package/dist/index.cjs

@@ -31,6 +31,7 @@ __export(index_exports, {
   MemoryStorage: () => MemoryStorage,
   OAuthCallbackError: () => OAuthCallbackError,
   ResolutionError: () => ResolutionError,
+  STORAGE_PREFIX: () => STORAGE_PREFIX,
   TokenExchangeError: () => TokenExchangeError,
   importJwk: () => importJwk
 });
@@ -397,22 +398,44 @@ var HappyViewOAuthClient = class {
     this.sessionHooks.onSessionUpdate?.(data.did);
     return session;
   }
+  /**
+   * Revoke the session server-side and clear it locally.
+   *
+   * The local cleanup runs unconditionally. If it did not, a server that
+   * refuses the revocation would leave the session in storage, `restore()`
+   * would sign the user back in on the next load, and the next logout would
+   * fail identically — a loop with no exit through this API.
+   */
   async deleteSession(did) {
-    const session = await this.restoreSession(did);
-    if (session) {
-      const resp = await session.fetchHandler(
-        `${this.instanceUrl}/oauth/sessions/${did}`,
-        { method: "DELETE" }
-      );
-      if (!resp.ok && resp.status !== 404) {
-        const body = await resp.json().catch(() => ({}));
-        throw new ApiError(
-          `Failed to delete session: ${resp.status} ${body.error ?? body.message ?? resp.statusText}`,
-          resp.status,
-          body
+    try {
+      const session = await this.restoreSession(did);
+      if (session) {
+        const resp = await session.fetchHandler(
+          `${this.instanceUrl}/oauth/sessions/${did}`,
+          { method: "DELETE" }
         );
+        const alreadyUnusable = resp.status === 404 || resp.status === 401 || resp.status === 403;
+        if (!resp.ok && !alreadyUnusable) {
+          const body = await resp.json().catch(() => ({}));
+          throw new ApiError(
+            `Failed to delete session: ${resp.status} ${body.error ?? body.message ?? resp.statusText}`,
+            resp.status,
+            body
+          );
+        }
       }
+    } finally {
+      await this.forgetSession(did);
     }
+  }
+  /**
+   * Clear a session locally without contacting the server.
+   *
+   * The escape hatch for a session that cannot be revoked remotely — a revoked
+   * or expired credential, an unreachable instance. Nothing is revoked, so the
+   * server may still consider the session live until it expires.
+   */
+  async forgetSession(did) {
     await this.storage.delete(`${STORAGE_PREFIX}${did}`);
     const lastActive = await this.storage.get(LAST_ACTIVE_KEY);
     if (lastActive === did) {
@@ -495,6 +518,7 @@ async function computePkceChallenge(verifier) {
   MemoryStorage,
   OAuthCallbackError,
   ResolutionError,
+  STORAGE_PREFIX,
   TokenExchangeError,
   importJwk,
   ...require("@atproto/jwk"),

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/errors.ts","../src/import-jwk.ts","../src/session.ts","../src/storage.ts","../src/client.ts"],"sourcesContent":["export * from \"@atproto/jwk\";\nexport * from \"@atproto/jwk-webcrypto\";\n\nexport { HappyViewOAuthClient, LAST_ACTIVE_KEY } from \"./client\";\nexport type { FetchMetadataOptions } from \"./client\";\nexport { importJwk } from \"./import-jwk\";\nexport {\n  ApiError,\n  AuthenticationError,\n  HappyViewError,\n  InvalidStateError,\n  OAuthCallbackError,\n  ResolutionError,\n  TokenExchangeError,\n} from \"./errors\";\nexport { HappyViewSession } from \"./session\";\nexport type { HappyViewSessionOptions } from \"./session\";\nexport { MemoryStorage } from \"./storage\";\nexport type {\n  DpopProvision,\n  GetSessionResponse,\n  HappyViewOAuthClientOptions,\n  ProvisionKeyResponse,\n  RegisterSessionParams,\n  RegisterSessionResponse,\n  SessionEventHooks,\n  StorageAdapter,\n  StoredSession,\n  TokenInfo,\n} from \"./types\";\n","export class HappyViewError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"HappyViewError\";\n  }\n}\n\nexport class ApiError extends HappyViewError {\n  readonly status: number;\n  readonly body: unknown;\n\n  constructor(message: string, status: number, body?: unknown) {\n    super(message);\n    this.name = \"ApiError\";\n    this.status = status;\n    this.body = body;\n  }\n}\n\nexport class AuthenticationError extends HappyViewError {\n  readonly status: number;\n\n  constructor(message: string, status: number = 401) {\n    super(message);\n    this.name = \"AuthenticationError\";\n    this.status = status;\n  }\n}\n\nexport class InvalidStateError extends HappyViewError {\n  constructor(message: string) {\n    super(message);\n    this.name = \"InvalidStateError\";\n  }\n}\n\nexport class TokenExchangeError extends HappyViewError {\n  readonly status: number;\n  readonly body: string;\n\n  constructor(message: string, status: number, body: string) {\n    super(message);\n    this.name = \"TokenExchangeError\";\n    this.status = status;\n    this.body = body;\n  }\n}\n\nexport class ResolutionError extends HappyViewError {\n  constructor(message: string) {\n    super(message);\n    this.name = \"ResolutionError\";\n  }\n}\n\nexport class OAuthCallbackError extends HappyViewError {\n  readonly params: URLSearchParams;\n  readonly state: string | undefined;\n\n  static from(\n    err: unknown,\n    params: URLSearchParams,\n    state?: string,\n  ): OAuthCallbackError {\n    if (err instanceof OAuthCallbackError) return err;\n    const message = err instanceof Error ? err.message : undefined;\n    return new OAuthCallbackError(params, message, state, err);\n  }\n\n  constructor(\n    params: URLSearchParams,\n    message?: string,\n    state?: string,\n    cause?: unknown,\n  ) {\n    super(\n      message ??\n        params.get(\"error_description\") ??\n        \"OAuth callback error\",\n    );\n    this.name = \"OAuthCallbackError\";\n    this.params = params;\n    this.state = state;\n    if (cause !== undefined) {\n      this.cause = cause;\n    }\n  }\n}\n","import { WebcryptoKey } from \"@atproto/jwk-webcrypto\";\n\n/**\n * Import a raw ES256 JWK (as returned by HappyView's /oauth/dpop-keys)\n * into a WebcryptoKey that can sign JWTs.\n */\nexport async function importJwk(jwk: JsonWebKey): Promise<WebcryptoKey> {\n  const privateKey = await crypto.subtle.importKey(\n    \"jwk\",\n    jwk,\n    { name: \"ECDSA\", namedCurve: \"P-256\" },\n    true,\n    [\"sign\"],\n  );\n\n  // Derive public key by stripping the private component\n  const { d: _, ...publicJwkFields } = jwk;\n  const publicKey = await crypto.subtle.importKey(\n    \"jwk\",\n    publicJwkFields,\n    { name: \"ECDSA\", namedCurve: \"P-256\" },\n    true,\n    [\"verify\"],\n  );\n\n  const kid = (jwk as JsonWebKey & { kid?: string }).kid ?? crypto.randomUUID();\n  return WebcryptoKey.fromKeypair({ privateKey, publicKey }, kid);\n}\n","import type { Key } from \"@atproto/jwk\";\nimport type { TokenInfo } from \"./types\";\n\nexport interface HappyViewSessionOptions {\n  did: string;\n  dpopKey: Key;\n  accessToken: string;\n  clientKey: string;\n  instanceUrl: string;\n  scopes?: string;\n  pdsUrl?: string;\n  issuer?: string;\n  fetch?: typeof globalThis.fetch;\n  onSignOut?: () => Promise<void>;\n}\n\nfunction randomHex(byteLength: number): string {\n  const bytes = crypto.getRandomValues(new Uint8Array(byteLength));\n  return Array.from(bytes, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction base64url(buffer: ArrayBuffer): string {\n  const bytes = new Uint8Array(buffer);\n  let binary = \"\";\n  for (let i = 0; i < bytes.length; i++) {\n    binary += String.fromCharCode(bytes[i]);\n  }\n  return btoa(binary)\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/, \"\");\n}\n\nexport class HappyViewSession {\n  readonly did: string;\n  readonly scopes: string[];\n\n  private readonly dpopKey: Key;\n  private readonly accessToken: string;\n  private readonly clientKey: string;\n  private readonly instanceUrl: string;\n  private readonly _scopes: string | undefined;\n  private readonly _pdsUrl: string | undefined;\n  private readonly _issuer: string | undefined;\n  private readonly _fetch: typeof globalThis.fetch;\n  private readonly _onSignOut: (() => Promise<void>) | undefined;\n  private dpopNonce: string | undefined;\n\n  constructor(options: HappyViewSessionOptions) {\n    this.did = options.did;\n    this.scopes = options.scopes ? options.scopes.split(\" \") : [];\n    this.dpopKey = options.dpopKey;\n    this.accessToken = options.accessToken;\n    this.clientKey = options.clientKey;\n    this.instanceUrl = options.instanceUrl.replace(/\\/+$/, \"\");\n    this._scopes = options.scopes;\n    this._pdsUrl = options.pdsUrl;\n    this._issuer = options.issuer;\n    this._fetch = options.fetch ?? ((input: RequestInfo | URL, init?: RequestInit) => fetch(input, init)) as typeof globalThis.fetch;\n    this._onSignOut = options.onSignOut;\n  }\n\n  get sub(): string {\n    return this.did;\n  }\n\n  getTokenInfo(): TokenInfo {\n    return {\n      scope: this._scopes,\n      iss: this._issuer,\n      aud: this._pdsUrl,\n      sub: this.did,\n    };\n  }\n\n  async signOut(): Promise<void> {\n    if (this._onSignOut) {\n      await this._onSignOut();\n    }\n  }\n\n  async fetchHandler(url: string, init: RequestInit): Promise<Response> {\n    const fullUrl = /^https?:\\/\\//i.test(url)\n      ? url\n      : `${this.instanceUrl}${url}`;\n    const method = (init.method ?? \"GET\").toUpperCase();\n    const htu = fullUrl.split(\"?\")[0];\n\n    const sendWithProof = async (): Promise<Response> => {\n      const tokenHash = await crypto.subtle.digest(\n        \"SHA-256\",\n        new TextEncoder().encode(this.accessToken),\n      );\n      const ath = base64url(tokenHash);\n\n      const proof = await this.dpopKey.createJwt(\n        {\n          alg: \"ES256\",\n          typ: \"dpop+jwt\",\n          jwk: this.dpopKey.publicJwk!,\n        },\n        {\n          htm: method,\n          htu,\n          iat: Math.floor(Date.now() / 1000),\n          jti: randomHex(16),\n          ath,\n          nonce: this.dpopNonce,\n        },\n      );\n\n      const headers = new Headers(init.headers);\n      headers.set(\"authorization\", `DPoP ${this.accessToken}`);\n      headers.set(\"dpop\", proof);\n      headers.set(\"x-client-key\", this.clientKey);\n\n      return this._fetch(fullUrl, { ...init, headers });\n    };\n\n    let response: Response;\n    try {\n      response = await sendWithProof();\n    } catch (e) {\n      const info = `_fetch type: ${typeof this._fetch}, toString: ${String(this._fetch).slice(0, 120)}, url: ${fullUrl}`;\n      throw new Error(`fetchHandler failed: ${(e as Error).message}\\n\\nDEBUG: ${info}`);\n    }\n\n    // Retry once if the server requires a DPoP nonce we didn't have\n    const nonce = response.headers.get(\"dpop-nonce\");\n    if (nonce && nonce !== this.dpopNonce && (response.status === 401 || response.status === 400)) {\n      this.dpopNonce = nonce;\n      try {\n        response = await sendWithProof();\n      } catch (e) {\n        throw new Error(`fetchHandler retry failed: ${(e as Error).message}`);\n      }\n      const retryNonce = response.headers.get(\"dpop-nonce\");\n      if (retryNonce) {\n        this.dpopNonce = retryNonce;\n      }\n    } else if (nonce) {\n      this.dpopNonce = nonce;\n    }\n\n    return response;\n  }\n}\n","import type { StorageAdapter } from \"./types\";\n\nexport class MemoryStorage implements StorageAdapter {\n  private data = new Map<string, string>();\n\n  async get(key: string): Promise<string | null> {\n    return this.data.get(key) ?? null;\n  }\n\n  async set(key: string, value: string): Promise<void> {\n    this.data.set(key, value);\n  }\n\n  async delete(key: string): Promise<void> {\n    this.data.delete(key);\n  }\n}\n","import type { Key } from \"@atproto/jwk\";\nimport { ApiError } from \"./errors\";\nimport { importJwk } from \"./import-jwk\";\nimport { HappyViewSession } from \"./session\";\nimport { MemoryStorage } from \"./storage\";\nimport type {\n  GetSessionResponse,\n  HappyViewOAuthClientOptions,\n  ProvisionKeyResponse,\n  RegisterSessionParams,\n  RegisterSessionResponse,\n  SessionEventHooks,\n  StorageAdapter,\n  StoredSession,\n} from \"./types\";\n\nconst STORAGE_PREFIX = \"happyview:session:\";\nexport const LAST_ACTIVE_KEY = \"happyview:last-active-did\";\n\nexport interface FetchMetadataOptions {\n  clientId: string;\n  fetch?: typeof globalThis.fetch;\n  signal?: AbortSignal;\n}\n\nexport class HappyViewOAuthClient {\n  static async fetchMetadata({\n    clientId,\n    fetch: fetchFn = globalThis.fetch,\n    signal,\n  }: FetchMetadataOptions): Promise<Record<string, unknown>> {\n    signal?.throwIfAborted();\n    const resp = await fetchFn(clientId, { redirect: \"error\", signal });\n    if (resp.status !== 200) {\n      resp.body?.cancel?.();\n      throw new Error(`Failed to fetch client metadata: ${resp.status}`);\n    }\n    const mime = resp.headers.get(\"content-type\")?.split(\";\")[0].trim();\n    if (mime !== \"application/json\") {\n      resp.body?.cancel?.();\n      throw new Error(`Invalid client metadata content type: ${mime}`);\n    }\n    return resp.json() as Promise<Record<string, unknown>>;\n  }\n\n  protected readonly instanceUrl: string;\n  protected readonly clientKey: string;\n  protected readonly storage: StorageAdapter;\n  private readonly clientSecret: string | undefined;\n  protected readonly _fetch: typeof globalThis.fetch;\n  private readonly sessionHooks: SessionEventHooks;\n\n  constructor(\n    options: HappyViewOAuthClientOptions & {\n      fetch?: typeof globalThis.fetch;\n    },\n  ) {\n    this.instanceUrl = options.instanceUrl.replace(/\\/+$/, \"\");\n    this.clientKey = options.clientKey;\n    this.clientSecret = options.clientSecret;\n    this.storage = options.storage ?? new MemoryStorage();\n    this._fetch = options.fetch ?? ((input: RequestInfo | URL, init?: RequestInit) => fetch(input, init)) as typeof globalThis.fetch;\n    this.sessionHooks = options.sessionHooks ?? {};\n  }\n\n  get isConfidential(): boolean {\n    return this.clientSecret !== undefined;\n  }\n\n  async provisionDpopKey(): Promise<{\n    provisionId: string;\n    dpopKey: Key;\n    rawJwk: JsonWebKey;\n    pkceVerifier?: string;\n  }> {\n    const headers: Record<string, string> = {\n      \"content-type\": \"application/json\",\n      \"x-client-key\": this.clientKey,\n    };\n    if (this.clientSecret) {\n      headers[\"x-client-secret\"] = this.clientSecret;\n    }\n\n    const body: Record<string, unknown> = {};\n    let pkceVerifier: string | undefined;\n\n    if (!this.isConfidential) {\n      pkceVerifier = generatePkceVerifier();\n      const challenge = await computePkceChallenge(pkceVerifier);\n      body.pkce_challenge = challenge;\n    }\n\n    const resp = await this._fetch(`${this.instanceUrl}/oauth/dpop-keys`, {\n      method: \"POST\",\n      headers,\n      body: JSON.stringify(body),\n    });\n\n    if (!resp.ok) {\n      const body = await resp.json().catch(() => ({}));\n      throw new ApiError(\n        `Failed to provision DPoP key: ${resp.status} ${(body as any).error ?? (body as any).message ?? resp.statusText}`,\n        resp.status,\n        body,\n      );\n    }\n\n    const data: ProvisionKeyResponse = await resp.json();\n    const dpopKey = await importJwk(data.dpop_key);\n    return {\n      provisionId: data.provision_id,\n      dpopKey,\n      rawJwk: data.dpop_key,\n      pkceVerifier,\n    };\n  }\n\n  async registerSession(\n    params: RegisterSessionParams,\n  ): Promise<HappyViewSession> {\n    const headers: Record<string, string> = {\n      \"content-type\": \"application/json\",\n      \"x-client-key\": this.clientKey,\n    };\n    if (this.clientSecret) {\n      headers[\"x-client-secret\"] = this.clientSecret;\n    }\n\n    const body: Record<string, unknown> = {\n      provision_id: params.provisionId,\n      did: params.did,\n      access_token: params.accessToken,\n      refresh_token: params.refreshToken,\n      scopes: params.scopes,\n      pds_url: params.pdsUrl,\n      issuer: params.issuer,\n    };\n\n    if (!this.isConfidential && params.pkceVerifier) {\n      body.pkce_verifier = params.pkceVerifier;\n    }\n\n    const resp = await this._fetch(`${this.instanceUrl}/oauth/sessions`, {\n      method: \"POST\",\n      headers,\n      body: JSON.stringify(body),\n    });\n\n    if (!resp.ok) {\n      const body = await resp.json().catch(() => ({}));\n      throw new ApiError(\n        `Failed to register session: ${resp.status} ${(body as any).error ?? (body as any).message ?? resp.statusText}`,\n        resp.status,\n        body,\n      );\n    }\n\n    const data: RegisterSessionResponse = await resp.json();\n    const dpopKey = await importJwk(params.dpopKey);\n\n    const storedSession: StoredSession = {\n      did: data.did,\n      dpopKey: params.dpopKey,\n      accessToken: params.accessToken,\n      clientKey: this.clientKey,\n      instanceUrl: this.instanceUrl,\n      scopes: params.scopes,\n      pdsUrl: params.pdsUrl,\n      issuer: params.issuer,\n    };\n    await this.storage.set(\n      `${STORAGE_PREFIX}${data.did}`,\n      JSON.stringify(storedSession),\n    );\n    await this.storage.set(LAST_ACTIVE_KEY, data.did);\n\n    const session = new HappyViewSession({\n      did: data.did,\n      dpopKey,\n      accessToken: params.accessToken,\n      clientKey: this.clientKey,\n      instanceUrl: this.instanceUrl,\n      scopes: params.scopes,\n      pdsUrl: params.pdsUrl,\n      issuer: params.issuer,\n      fetch: this._fetch,\n      onSignOut: () => this.deleteSession(data.did),\n    });\n\n    this.sessionHooks.onSessionUpdate?.(data.did);\n\n    return session;\n  }\n\n  async deleteSession(did: string): Promise<void> {\n    const session = await this.restoreSession(did);\n    if (session) {\n      const resp = await session.fetchHandler(\n        `${this.instanceUrl}/oauth/sessions/${did}`,\n        { method: \"DELETE\" },\n      );\n\n      if (!resp.ok && resp.status !== 404) {\n        const body = await resp.json().catch(() => ({}));\n        throw new ApiError(\n          `Failed to delete session: ${resp.status} ${(body as any).error ?? (body as any).message ?? resp.statusText}`,\n          resp.status,\n          body,\n        );\n      }\n    }\n\n    await this.storage.delete(`${STORAGE_PREFIX}${did}`);\n\n    const lastActive = await this.storage.get(LAST_ACTIVE_KEY);\n    if (lastActive === did) {\n      await this.storage.delete(LAST_ACTIVE_KEY);\n    }\n\n    this.sessionHooks.onSessionDelete?.(did);\n  }\n\n  async restoreSession(did: string): Promise<HappyViewSession | null> {\n    const stored = await this.storage.get(`${STORAGE_PREFIX}${did}`);\n    if (!stored) return null;\n\n    const data: StoredSession = JSON.parse(stored);\n    const dpopKey = await importJwk(data.dpopKey);\n    return new HappyViewSession({\n      did: data.did,\n      dpopKey,\n      accessToken: data.accessToken,\n      clientKey: data.clientKey,\n      instanceUrl: data.instanceUrl,\n      scopes: data.scopes,\n      pdsUrl: data.pdsUrl,\n      issuer: data.issuer,\n      fetch: this._fetch,\n      onSignOut: () => this.deleteSession(data.did),\n    });\n  }\n\n  async getSession(did: string): Promise<GetSessionResponse> {\n    const session = await this.restoreSession(did);\n    if (!session) {\n      throw new ApiError(\"No stored session for this DID\", 404, {});\n    }\n\n    const resp = await session.fetchHandler(\n      `${this.instanceUrl}/oauth/sessions/${did}`,\n      { method: \"GET\" },\n    );\n\n    if (!resp.ok) {\n      const body = await resp.json().catch(() => ({}));\n      throw new ApiError(\n        `Failed to get session: ${resp.status} ${(body as any).error ?? (body as any).message ?? resp.statusText}`,\n        resp.status,\n        body,\n      );\n    }\n\n    return resp.json();\n  }\n\n  async restore(): Promise<HappyViewSession | null> {\n    const did = await this.storage.get(LAST_ACTIVE_KEY);\n    if (!did) return null;\n    return this.restoreSession(did);\n  }\n}\n\n// PKCE helpers — inline since they're just a few lines of Web Crypto\nfunction generatePkceVerifier(): string {\n  const bytes = crypto.getRandomValues(new Uint8Array(32));\n  let binary = \"\";\n  for (let i = 0; i < bytes.length; i++) {\n    binary += String.fromCharCode(bytes[i]);\n  }\n  return btoa(binary)\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/, \"\");\n}\n\nasync function computePkceChallenge(verifier: string): Promise<string> {\n  const hash = await crypto.subtle.digest(\n    \"SHA-256\",\n    new TextEncoder().encode(verifier),\n  );\n  const bytes = new Uint8Array(hash);\n  let binary = \"\";\n  for (let i = 0; i < bytes.length; i++) {\n    binary += String.fromCharCode(bytes[i]);\n  }\n  return btoa(binary)\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/, \"\");\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,0BAAc,yBAAd;AACA,0BAAc,mCADd;;;ACAO,IAAM,iBAAN,cAA6B,MAAM;AAAA,EACxC,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,WAAN,cAAuB,eAAe;AAAA,EAClC;AAAA,EACA;AAAA,EAET,YAAY,SAAiB,QAAgB,MAAgB;AAC3D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,sBAAN,cAAkC,eAAe;AAAA,EAC7C;AAAA,EAET,YAAY,SAAiB,SAAiB,KAAK;AACjD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AACF;AAEO,IAAM,oBAAN,cAAgC,eAAe;AAAA,EACpD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,qBAAN,cAAiC,eAAe;AAAA,EAC5C;AAAA,EACA;AAAA,EAET,YAAY,SAAiB,QAAgB,MAAc;AACzD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,kBAAN,cAA8B,eAAe;AAAA,EAClD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,qBAAN,MAAM,4BAA2B,eAAe;AAAA,EAC5C;AAAA,EACA;AAAA,EAET,OAAO,KACL,KACA,QACA,OACoB;AACpB,QAAI,eAAe,oBAAoB,QAAO;AAC9C,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,WAAO,IAAI,oBAAmB,QAAQ,SAAS,OAAO,GAAG;AAAA,EAC3D;AAAA,EAEA,YACE,QACA,SACA,OACA,OACA;AACA;AAAA,MACE,WACE,OAAO,IAAI,mBAAmB,KAC9B;AAAA,IACJ;AACA,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,QAAQ;AACb,QAAI,UAAU,QAAW;AACvB,WAAK,QAAQ;AAAA,IACf;AAAA,EACF;AACF;;;ACvFA,2BAA6B;AAM7B,eAAsB,UAAU,KAAwC;AACtE,QAAM,aAAa,MAAM,OAAO,OAAO;AAAA,IACrC;AAAA,IACA;AAAA,IACA,EAAE,MAAM,SAAS,YAAY,QAAQ;AAAA,IACrC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AAGA,QAAM,EAAE,GAAG,GAAG,GAAG,gBAAgB,IAAI;AACrC,QAAM,YAAY,MAAM,OAAO,OAAO;AAAA,IACpC;AAAA,IACA;AAAA,IACA,EAAE,MAAM,SAAS,YAAY,QAAQ;AAAA,IACrC;AAAA,IACA,CAAC,QAAQ;AAAA,EACX;AAEA,QAAM,MAAO,IAAsC,OAAO,OAAO,WAAW;AAC5E,SAAO,kCAAa,YAAY,EAAE,YAAY,UAAU,GAAG,GAAG;AAChE;;;ACXA,SAAS,UAAU,YAA4B;AAC7C,QAAM,QAAQ,OAAO,gBAAgB,IAAI,WAAW,UAAU,CAAC;AAC/D,SAAO,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAC1E;AAEA,SAAS,UAAU,QAA6B;AAC9C,QAAM,QAAQ,IAAI,WAAW,MAAM;AACnC,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EACxC;AACA,SAAO,KAAK,MAAM,EACf,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AACtB;AAEO,IAAM,mBAAN,MAAuB;AAAA,EACnB;AAAA,EACA;AAAA,EAEQ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACT;AAAA,EAER,YAAY,SAAkC;AAC5C,SAAK,MAAM,QAAQ;AACnB,SAAK,SAAS,QAAQ,SAAS,QAAQ,OAAO,MAAM,GAAG,IAAI,CAAC;AAC5D,SAAK,UAAU,QAAQ;AACvB,SAAK,cAAc,QAAQ;AAC3B,SAAK,YAAY,QAAQ;AACzB,SAAK,cAAc,QAAQ,YAAY,QAAQ,QAAQ,EAAE;AACzD,SAAK,UAAU,QAAQ;AACvB,SAAK,UAAU,QAAQ;AACvB,SAAK,UAAU,QAAQ;AACvB,SAAK,SAAS,QAAQ,UAAU,CAAC,OAA0B,SAAuB,MAAM,OAAO,IAAI;AACnG,SAAK,aAAa,QAAQ;AAAA,EAC5B;AAAA,EAEA,IAAI,MAAc;AAChB,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,eAA0B;AACxB,WAAO;AAAA,MACL,OAAO,KAAK;AAAA,MACZ,KAAK,KAAK;AAAA,MACV,KAAK,KAAK;AAAA,MACV,KAAK,KAAK;AAAA,IACZ;AAAA,EACF;AAAA,EAEA,MAAM,UAAyB;AAC7B,QAAI,KAAK,YAAY;AACnB,YAAM,KAAK,WAAW;AAAA,IACxB;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,KAAa,MAAsC;AACpE,UAAM,UAAU,gBAAgB,KAAK,GAAG,IACpC,MACA,GAAG,KAAK,WAAW,GAAG,GAAG;AAC7B,UAAM,UAAU,KAAK,UAAU,OAAO,YAAY;AAClD,UAAM,MAAM,QAAQ,MAAM,GAAG,EAAE,CAAC;AAEhC,UAAM,gBAAgB,YAA+B;AACnD,YAAM,YAAY,MAAM,OAAO,OAAO;AAAA,QACpC;AAAA,QACA,IAAI,YAAY,EAAE,OAAO,KAAK,WAAW;AAAA,MAC3C;AACA,YAAM,MAAM,UAAU,SAAS;AAE/B,YAAM,QAAQ,MAAM,KAAK,QAAQ;AAAA,QAC/B;AAAA,UACE,KAAK;AAAA,UACL,KAAK;AAAA,UACL,KAAK,KAAK,QAAQ;AAAA,QACpB;AAAA,QACA;AAAA,UACE,KAAK;AAAA,UACL;AAAA,UACA,KAAK,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAAA,UACjC,KAAK,UAAU,EAAE;AAAA,UACjB;AAAA,UACA,OAAO,KAAK;AAAA,QACd;AAAA,MACF;AAEA,YAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;AACxC,cAAQ,IAAI,iBAAiB,QAAQ,KAAK,WAAW,EAAE;AACvD,cAAQ,IAAI,QAAQ,KAAK;AACzB,cAAQ,IAAI,gBAAgB,KAAK,SAAS;AAE1C,aAAO,KAAK,OAAO,SAAS,EAAE,GAAG,MAAM,QAAQ,CAAC;AAAA,IAClD;AAEA,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,cAAc;AAAA,IACjC,SAAS,GAAG;AACV,YAAM,OAAO,gBAAgB,OAAO,KAAK,MAAM,eAAe,OAAO,KAAK,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC,UAAU,OAAO;AAChH,YAAM,IAAI,MAAM,wBAAyB,EAAY,OAAO;AAAA;AAAA,SAAc,IAAI,EAAE;AAAA,IAClF;AAGA,UAAM,QAAQ,SAAS,QAAQ,IAAI,YAAY;AAC/C,QAAI,SAAS,UAAU,KAAK,cAAc,SAAS,WAAW,OAAO,SAAS,WAAW,MAAM;AAC7F,WAAK,YAAY;AACjB,UAAI;AACF,mBAAW,MAAM,cAAc;AAAA,MACjC,SAAS,GAAG;AACV,cAAM,IAAI,MAAM,8BAA+B,EAAY,OAAO,EAAE;AAAA,MACtE;AACA,YAAM,aAAa,SAAS,QAAQ,IAAI,YAAY;AACpD,UAAI,YAAY;AACd,aAAK,YAAY;AAAA,MACnB;AAAA,IACF,WAAW,OAAO;AAChB,WAAK,YAAY;AAAA,IACnB;AAEA,WAAO;AAAA,EACT;AACF;;;AChJO,IAAM,gBAAN,MAA8C;AAAA,EAC3C,OAAO,oBAAI,IAAoB;AAAA,EAEvC,MAAM,IAAI,KAAqC;AAC7C,WAAO,KAAK,KAAK,IAAI,GAAG,KAAK;AAAA,EAC/B;AAAA,EAEA,MAAM,IAAI,KAAa,OAA8B;AACnD,SAAK,KAAK,IAAI,KAAK,KAAK;AAAA,EAC1B;AAAA,EAEA,MAAM,OAAO,KAA4B;AACvC,SAAK,KAAK,OAAO,GAAG;AAAA,EACtB;AACF;;;ACAA,IAAM,iBAAiB;AAChB,IAAM,kBAAkB;AAQxB,IAAM,uBAAN,MAA2B;AAAA,EAChC,aAAa,cAAc;AAAA,IACzB;AAAA,IACA,OAAO,UAAU,WAAW;AAAA,IAC5B;AAAA,EACF,GAA2D;AACzD,YAAQ,eAAe;AACvB,UAAM,OAAO,MAAM,QAAQ,UAAU,EAAE,UAAU,SAAS,OAAO,CAAC;AAClE,QAAI,KAAK,WAAW,KAAK;AACvB,WAAK,MAAM,SAAS;AACpB,YAAM,IAAI,MAAM,oCAAoC,KAAK,MAAM,EAAE;AAAA,IACnE;AACA,UAAM,OAAO,KAAK,QAAQ,IAAI,cAAc,GAAG,MAAM,GAAG,EAAE,CAAC,EAAE,KAAK;AAClE,QAAI,SAAS,oBAAoB;AAC/B,WAAK,MAAM,SAAS;AACpB,YAAM,IAAI,MAAM,yCAAyC,IAAI,EAAE;AAAA,IACjE;AACA,WAAO,KAAK,KAAK;AAAA,EACnB;AAAA,EAEmB;AAAA,EACA;AAAA,EACA;AAAA,EACF;AAAA,EACE;AAAA,EACF;AAAA,EAEjB,YACE,SAGA;AACA,SAAK,cAAc,QAAQ,YAAY,QAAQ,QAAQ,EAAE;AACzD,SAAK,YAAY,QAAQ;AACzB,SAAK,eAAe,QAAQ;AAC5B,SAAK,UAAU,QAAQ,WAAW,IAAI,cAAc;AACpD,SAAK,SAAS,QAAQ,UAAU,CAAC,OAA0B,SAAuB,MAAM,OAAO,IAAI;AACnG,SAAK,eAAe,QAAQ,gBAAgB,CAAC;AAAA,EAC/C;AAAA,EAEA,IAAI,iBAA0B;AAC5B,WAAO,KAAK,iBAAiB;AAAA,EAC/B;AAAA,EAEA,MAAM,mBAKH;AACD,UAAM,UAAkC;AAAA,MACtC,gBAAgB;AAAA,MAChB,gBAAgB,KAAK;AAAA,IACvB;AACA,QAAI,KAAK,cAAc;AACrB,cAAQ,iBAAiB,IAAI,KAAK;AAAA,IACpC;AAEA,UAAM,OAAgC,CAAC;AACvC,QAAI;AAEJ,QAAI,CAAC,KAAK,gBAAgB;AACxB,qBAAe,qBAAqB;AACpC,YAAM,YAAY,MAAM,qBAAqB,YAAY;AACzD,WAAK,iBAAiB;AAAA,IACxB;AAEA,UAAM,OAAO,MAAM,KAAK,OAAO,GAAG,KAAK,WAAW,oBAAoB;AAAA,MACpE,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAED,QAAI,CAAC,KAAK,IAAI;AACZ,YAAMA,QAAO,MAAM,KAAK,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,YAAM,IAAI;AAAA,QACR,iCAAiC,KAAK,MAAM,IAAKA,MAAa,SAAUA,MAAa,WAAW,KAAK,UAAU;AAAA,QAC/G,KAAK;AAAA,QACLA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,OAA6B,MAAM,KAAK,KAAK;AACnD,UAAM,UAAU,MAAM,UAAU,KAAK,QAAQ;AAC7C,WAAO;AAAA,MACL,aAAa,KAAK;AAAA,MAClB;AAAA,MACA,QAAQ,KAAK;AAAA,MACb;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,gBACJ,QAC2B;AAC3B,UAAM,UAAkC;AAAA,MACtC,gBAAgB;AAAA,MAChB,gBAAgB,KAAK;AAAA,IACvB;AACA,QAAI,KAAK,cAAc;AACrB,cAAQ,iBAAiB,IAAI,KAAK;AAAA,IACpC;AAEA,UAAM,OAAgC;AAAA,MACpC,cAAc,OAAO;AAAA,MACrB,KAAK,OAAO;AAAA,MACZ,cAAc,OAAO;AAAA,MACrB,eAAe,OAAO;AAAA,MACtB,QAAQ,OAAO;AAAA,MACf,SAAS,OAAO;AAAA,MAChB,QAAQ,OAAO;AAAA,IACjB;AAEA,QAAI,CAAC,KAAK,kBAAkB,OAAO,cAAc;AAC/C,WAAK,gBAAgB,OAAO;AAAA,IAC9B;AAEA,UAAM,OAAO,MAAM,KAAK,OAAO,GAAG,KAAK,WAAW,mBAAmB;AAAA,MACnE,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAED,QAAI,CAAC,KAAK,IAAI;AACZ,YAAMA,QAAO,MAAM,KAAK,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,YAAM,IAAI;AAAA,QACR,+BAA+B,KAAK,MAAM,IAAKA,MAAa,SAAUA,MAAa,WAAW,KAAK,UAAU;AAAA,QAC7G,KAAK;AAAA,QACLA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,OAAgC,MAAM,KAAK,KAAK;AACtD,UAAM,UAAU,MAAM,UAAU,OAAO,OAAO;AAE9C,UAAM,gBAA+B;AAAA,MACnC,KAAK,KAAK;AAAA,MACV,SAAS,OAAO;AAAA,MAChB,aAAa,OAAO;AAAA,MACpB,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,MAClB,QAAQ,OAAO;AAAA,MACf,QAAQ,OAAO;AAAA,MACf,QAAQ,OAAO;AAAA,IACjB;AACA,UAAM,KAAK,QAAQ;AAAA,MACjB,GAAG,cAAc,GAAG,KAAK,GAAG;AAAA,MAC5B,KAAK,UAAU,aAAa;AAAA,IAC9B;AACA,UAAM,KAAK,QAAQ,IAAI,iBAAiB,KAAK,GAAG;AAEhD,UAAM,UAAU,IAAI,iBAAiB;AAAA,MACnC,KAAK,KAAK;AAAA,MACV;AAAA,MACA,aAAa,OAAO;AAAA,MACpB,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,MAClB,QAAQ,OAAO;AAAA,MACf,QAAQ,OAAO;AAAA,MACf,QAAQ,OAAO;AAAA,MACf,OAAO,KAAK;AAAA,MACZ,WAAW,MAAM,KAAK,cAAc,KAAK,GAAG;AAAA,IAC9C,CAAC;AAED,SAAK,aAAa,kBAAkB,KAAK,GAAG;AAE5C,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,cAAc,KAA4B;AAC9C,UAAM,UAAU,MAAM,KAAK,eAAe,GAAG;AAC7C,QAAI,SAAS;AACX,YAAM,OAAO,MAAM,QAAQ;AAAA,QACzB,GAAG,KAAK,WAAW,mBAAmB,GAAG;AAAA,QACzC,EAAE,QAAQ,SAAS;AAAA,MACrB;AAEA,UAAI,CAAC,KAAK,MAAM,KAAK,WAAW,KAAK;AACnC,cAAM,OAAO,MAAM,KAAK,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,cAAM,IAAI;AAAA,UACR,6BAA6B,KAAK,MAAM,IAAK,KAAa,SAAU,KAAa,WAAW,KAAK,UAAU;AAAA,UAC3G,KAAK;AAAA,UACL;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,KAAK,QAAQ,OAAO,GAAG,cAAc,GAAG,GAAG,EAAE;AAEnD,UAAM,aAAa,MAAM,KAAK,QAAQ,IAAI,eAAe;AACzD,QAAI,eAAe,KAAK;AACtB,YAAM,KAAK,QAAQ,OAAO,eAAe;AAAA,IAC3C;AAEA,SAAK,aAAa,kBAAkB,GAAG;AAAA,EACzC;AAAA,EAEA,MAAM,eAAe,KAA+C;AAClE,UAAM,SAAS,MAAM,KAAK,QAAQ,IAAI,GAAG,cAAc,GAAG,GAAG,EAAE;AAC/D,QAAI,CAAC,OAAQ,QAAO;AAEpB,UAAM,OAAsB,KAAK,MAAM,MAAM;AAC7C,UAAM,UAAU,MAAM,UAAU,KAAK,OAAO;AAC5C,WAAO,IAAI,iBAAiB;AAAA,MAC1B,KAAK,KAAK;AAAA,MACV;AAAA,MACA,aAAa,KAAK;AAAA,MAClB,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,MAClB,QAAQ,KAAK;AAAA,MACb,QAAQ,KAAK;AAAA,MACb,QAAQ,KAAK;AAAA,MACb,OAAO,KAAK;AAAA,MACZ,WAAW,MAAM,KAAK,cAAc,KAAK,GAAG;AAAA,IAC9C,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,WAAW,KAA0C;AACzD,UAAM,UAAU,MAAM,KAAK,eAAe,GAAG;AAC7C,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,SAAS,kCAAkC,KAAK,CAAC,CAAC;AAAA,IAC9D;AAEA,UAAM,OAAO,MAAM,QAAQ;AAAA,MACzB,GAAG,KAAK,WAAW,mBAAmB,GAAG;AAAA,MACzC,EAAE,QAAQ,MAAM;AAAA,IAClB;AAEA,QAAI,CAAC,KAAK,IAAI;AACZ,YAAM,OAAO,MAAM,KAAK,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,YAAM,IAAI;AAAA,QACR,0BAA0B,KAAK,MAAM,IAAK,KAAa,SAAU,KAAa,WAAW,KAAK,UAAU;AAAA,QACxG,KAAK;AAAA,QACL;AAAA,MACF;AAAA,IACF;AAEA,WAAO,KAAK,KAAK;AAAA,EACnB;AAAA,EAEA,MAAM,UAA4C;AAChD,UAAM,MAAM,MAAM,KAAK,QAAQ,IAAI,eAAe;AAClD,QAAI,CAAC,IAAK,QAAO;AACjB,WAAO,KAAK,eAAe,GAAG;AAAA,EAChC;AACF;AAGA,SAAS,uBAA+B;AACtC,QAAM,QAAQ,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AACvD,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EACxC;AACA,SAAO,KAAK,MAAM,EACf,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AACtB;AAEA,eAAe,qBAAqB,UAAmC;AACrE,QAAM,OAAO,MAAM,OAAO,OAAO;AAAA,IAC/B;AAAA,IACA,IAAI,YAAY,EAAE,OAAO,QAAQ;AAAA,EACnC;AACA,QAAM,QAAQ,IAAI,WAAW,IAAI;AACjC,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EACxC;AACA,SAAO,KAAK,MAAM,EACf,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AACtB;","names":["body"]}
+{"version":3,"sources":["../src/index.ts","../src/errors.ts","../src/import-jwk.ts","../src/session.ts","../src/storage.ts","../src/client.ts"],"sourcesContent":["export * from \"@atproto/jwk\";\nexport * from \"@atproto/jwk-webcrypto\";\n\nexport {\n  HappyViewOAuthClient,\n  LAST_ACTIVE_KEY,\n  STORAGE_PREFIX,\n} from \"./client\";\nexport type { FetchMetadataOptions } from \"./client\";\nexport { importJwk } from \"./import-jwk\";\nexport {\n  ApiError,\n  AuthenticationError,\n  HappyViewError,\n  InvalidStateError,\n  OAuthCallbackError,\n  ResolutionError,\n  TokenExchangeError,\n} from \"./errors\";\nexport { HappyViewSession } from \"./session\";\nexport type { HappyViewSessionOptions } from \"./session\";\nexport { MemoryStorage } from \"./storage\";\nexport type {\n  DpopProvision,\n  GetSessionResponse,\n  HappyViewOAuthClientOptions,\n  ProvisionKeyResponse,\n  RegisterSessionParams,\n  RegisterSessionResponse,\n  SessionEventHooks,\n  StorageAdapter,\n  StoredSession,\n  TokenInfo,\n} from \"./types\";\n","export class HappyViewError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"HappyViewError\";\n  }\n}\n\nexport class ApiError extends HappyViewError {\n  readonly status: number;\n  readonly body: unknown;\n\n  constructor(message: string, status: number, body?: unknown) {\n    super(message);\n    this.name = \"ApiError\";\n    this.status = status;\n    this.body = body;\n  }\n}\n\nexport class AuthenticationError extends HappyViewError {\n  readonly status: number;\n\n  constructor(message: string, status: number = 401) {\n    super(message);\n    this.name = \"AuthenticationError\";\n    this.status = status;\n  }\n}\n\nexport class InvalidStateError extends HappyViewError {\n  constructor(message: string) {\n    super(message);\n    this.name = \"InvalidStateError\";\n  }\n}\n\nexport class TokenExchangeError extends HappyViewError {\n  readonly status: number;\n  readonly body: string;\n\n  constructor(message: string, status: number, body: string) {\n    super(message);\n    this.name = \"TokenExchangeError\";\n    this.status = status;\n    this.body = body;\n  }\n}\n\nexport class ResolutionError extends HappyViewError {\n  constructor(message: string) {\n    super(message);\n    this.name = \"ResolutionError\";\n  }\n}\n\nexport class OAuthCallbackError extends HappyViewError {\n  readonly params: URLSearchParams;\n  readonly state: string | undefined;\n\n  static from(\n    err: unknown,\n    params: URLSearchParams,\n    state?: string,\n  ): OAuthCallbackError {\n    if (err instanceof OAuthCallbackError) return err;\n    const message = err instanceof Error ? err.message : undefined;\n    return new OAuthCallbackError(params, message, state, err);\n  }\n\n  constructor(\n    params: URLSearchParams,\n    message?: string,\n    state?: string,\n    cause?: unknown,\n  ) {\n    super(\n      message ??\n        params.get(\"error_description\") ??\n        \"OAuth callback error\",\n    );\n    this.name = \"OAuthCallbackError\";\n    this.params = params;\n    this.state = state;\n    if (cause !== undefined) {\n      this.cause = cause;\n    }\n  }\n}\n","import { WebcryptoKey } from \"@atproto/jwk-webcrypto\";\n\n/**\n * Import a raw ES256 JWK (as returned by HappyView's /oauth/dpop-keys)\n * into a WebcryptoKey that can sign JWTs.\n */\nexport async function importJwk(jwk: JsonWebKey): Promise<WebcryptoKey> {\n  const privateKey = await crypto.subtle.importKey(\n    \"jwk\",\n    jwk,\n    { name: \"ECDSA\", namedCurve: \"P-256\" },\n    true,\n    [\"sign\"],\n  );\n\n  // Derive public key by stripping the private component\n  const { d: _, ...publicJwkFields } = jwk;\n  const publicKey = await crypto.subtle.importKey(\n    \"jwk\",\n    publicJwkFields,\n    { name: \"ECDSA\", namedCurve: \"P-256\" },\n    true,\n    [\"verify\"],\n  );\n\n  const kid = (jwk as JsonWebKey & { kid?: string }).kid ?? crypto.randomUUID();\n  return WebcryptoKey.fromKeypair({ privateKey, publicKey }, kid);\n}\n","import type { Key } from \"@atproto/jwk\";\nimport type { TokenInfo } from \"./types\";\n\nexport interface HappyViewSessionOptions {\n  did: string;\n  dpopKey: Key;\n  accessToken: string;\n  clientKey: string;\n  instanceUrl: string;\n  scopes?: string;\n  pdsUrl?: string;\n  issuer?: string;\n  fetch?: typeof globalThis.fetch;\n  onSignOut?: () => Promise<void>;\n}\n\nfunction randomHex(byteLength: number): string {\n  const bytes = crypto.getRandomValues(new Uint8Array(byteLength));\n  return Array.from(bytes, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction base64url(buffer: ArrayBuffer): string {\n  const bytes = new Uint8Array(buffer);\n  let binary = \"\";\n  for (let i = 0; i < bytes.length; i++) {\n    binary += String.fromCharCode(bytes[i]);\n  }\n  return btoa(binary)\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/, \"\");\n}\n\nexport class HappyViewSession {\n  readonly did: string;\n  readonly scopes: string[];\n\n  private readonly dpopKey: Key;\n  private readonly accessToken: string;\n  private readonly clientKey: string;\n  private readonly instanceUrl: string;\n  private readonly _scopes: string | undefined;\n  private readonly _pdsUrl: string | undefined;\n  private readonly _issuer: string | undefined;\n  private readonly _fetch: typeof globalThis.fetch;\n  private readonly _onSignOut: (() => Promise<void>) | undefined;\n  private dpopNonce: string | undefined;\n\n  constructor(options: HappyViewSessionOptions) {\n    this.did = options.did;\n    this.scopes = options.scopes ? options.scopes.split(\" \") : [];\n    this.dpopKey = options.dpopKey;\n    this.accessToken = options.accessToken;\n    this.clientKey = options.clientKey;\n    this.instanceUrl = options.instanceUrl.replace(/\\/+$/, \"\");\n    this._scopes = options.scopes;\n    this._pdsUrl = options.pdsUrl;\n    this._issuer = options.issuer;\n    this._fetch = options.fetch ?? ((input: RequestInfo | URL, init?: RequestInit) => fetch(input, init)) as typeof globalThis.fetch;\n    this._onSignOut = options.onSignOut;\n  }\n\n  get sub(): string {\n    return this.did;\n  }\n\n  getTokenInfo(): TokenInfo {\n    return {\n      scope: this._scopes,\n      iss: this._issuer,\n      aud: this._pdsUrl,\n      sub: this.did,\n    };\n  }\n\n  async signOut(): Promise<void> {\n    if (this._onSignOut) {\n      await this._onSignOut();\n    }\n  }\n\n  async fetchHandler(url: string, init: RequestInit): Promise<Response> {\n    const fullUrl = /^https?:\\/\\//i.test(url)\n      ? url\n      : `${this.instanceUrl}${url}`;\n    const method = (init.method ?? \"GET\").toUpperCase();\n    const htu = fullUrl.split(\"?\")[0];\n\n    const sendWithProof = async (): Promise<Response> => {\n      const tokenHash = await crypto.subtle.digest(\n        \"SHA-256\",\n        new TextEncoder().encode(this.accessToken),\n      );\n      const ath = base64url(tokenHash);\n\n      const proof = await this.dpopKey.createJwt(\n        {\n          alg: \"ES256\",\n          typ: \"dpop+jwt\",\n          jwk: this.dpopKey.publicJwk!,\n        },\n        {\n          htm: method,\n          htu,\n          iat: Math.floor(Date.now() / 1000),\n          jti: randomHex(16),\n          ath,\n          nonce: this.dpopNonce,\n        },\n      );\n\n      const headers = new Headers(init.headers);\n      headers.set(\"authorization\", `DPoP ${this.accessToken}`);\n      headers.set(\"dpop\", proof);\n      headers.set(\"x-client-key\", this.clientKey);\n\n      return this._fetch(fullUrl, { ...init, headers });\n    };\n\n    let response: Response;\n    try {\n      response = await sendWithProof();\n    } catch (e) {\n      const info = `_fetch type: ${typeof this._fetch}, toString: ${String(this._fetch).slice(0, 120)}, url: ${fullUrl}`;\n      throw new Error(`fetchHandler failed: ${(e as Error).message}\\n\\nDEBUG: ${info}`);\n    }\n\n    // Retry once if the server requires a DPoP nonce we didn't have\n    const nonce = response.headers.get(\"dpop-nonce\");\n    if (nonce && nonce !== this.dpopNonce && (response.status === 401 || response.status === 400)) {\n      this.dpopNonce = nonce;\n      try {\n        response = await sendWithProof();\n      } catch (e) {\n        throw new Error(`fetchHandler retry failed: ${(e as Error).message}`);\n      }\n      const retryNonce = response.headers.get(\"dpop-nonce\");\n      if (retryNonce) {\n        this.dpopNonce = retryNonce;\n      }\n    } else if (nonce) {\n      this.dpopNonce = nonce;\n    }\n\n    return response;\n  }\n}\n","import type { StorageAdapter } from \"./types\";\n\nexport class MemoryStorage implements StorageAdapter {\n  private data = new Map<string, string>();\n\n  async get(key: string): Promise<string | null> {\n    return this.data.get(key) ?? null;\n  }\n\n  async set(key: string, value: string): Promise<void> {\n    this.data.set(key, value);\n  }\n\n  async delete(key: string): Promise<void> {\n    this.data.delete(key);\n  }\n}\n","import type { Key } from \"@atproto/jwk\";\nimport { ApiError } from \"./errors\";\nimport { importJwk } from \"./import-jwk\";\nimport { HappyViewSession } from \"./session\";\nimport { MemoryStorage } from \"./storage\";\nimport type {\n  GetSessionResponse,\n  HappyViewOAuthClientOptions,\n  ProvisionKeyResponse,\n  RegisterSessionParams,\n  RegisterSessionResponse,\n  SessionEventHooks,\n  StorageAdapter,\n  StoredSession,\n} from \"./types\";\n\n/// The storage keys this client reads and writes. Exported because a consumer\n/// recovering a wedged session by hand would otherwise have to hardcode them,\n/// which silently breaks the day they are renamed.\nexport const STORAGE_PREFIX = \"happyview:session:\";\nexport const LAST_ACTIVE_KEY = \"happyview:last-active-did\";\n\nexport interface FetchMetadataOptions {\n  clientId: string;\n  fetch?: typeof globalThis.fetch;\n  signal?: AbortSignal;\n}\n\nexport class HappyViewOAuthClient {\n  static async fetchMetadata({\n    clientId,\n    fetch: fetchFn = globalThis.fetch,\n    signal,\n  }: FetchMetadataOptions): Promise<Record<string, unknown>> {\n    signal?.throwIfAborted();\n    const resp = await fetchFn(clientId, { redirect: \"error\", signal });\n    if (resp.status !== 200) {\n      resp.body?.cancel?.();\n      throw new Error(`Failed to fetch client metadata: ${resp.status}`);\n    }\n    const mime = resp.headers.get(\"content-type\")?.split(\";\")[0].trim();\n    if (mime !== \"application/json\") {\n      resp.body?.cancel?.();\n      throw new Error(`Invalid client metadata content type: ${mime}`);\n    }\n    return resp.json() as Promise<Record<string, unknown>>;\n  }\n\n  protected readonly instanceUrl: string;\n  protected readonly clientKey: string;\n  protected readonly storage: StorageAdapter;\n  private readonly clientSecret: string | undefined;\n  protected readonly _fetch: typeof globalThis.fetch;\n  private readonly sessionHooks: SessionEventHooks;\n\n  constructor(\n    options: HappyViewOAuthClientOptions & {\n      fetch?: typeof globalThis.fetch;\n    },\n  ) {\n    this.instanceUrl = options.instanceUrl.replace(/\\/+$/, \"\");\n    this.clientKey = options.clientKey;\n    this.clientSecret = options.clientSecret;\n    this.storage = options.storage ?? new MemoryStorage();\n    this._fetch = options.fetch ?? ((input: RequestInfo | URL, init?: RequestInit) => fetch(input, init)) as typeof globalThis.fetch;\n    this.sessionHooks = options.sessionHooks ?? {};\n  }\n\n  get isConfidential(): boolean {\n    return this.clientSecret !== undefined;\n  }\n\n  async provisionDpopKey(): Promise<{\n    provisionId: string;\n    dpopKey: Key;\n    rawJwk: JsonWebKey;\n    pkceVerifier?: string;\n  }> {\n    const headers: Record<string, string> = {\n      \"content-type\": \"application/json\",\n      \"x-client-key\": this.clientKey,\n    };\n    if (this.clientSecret) {\n      headers[\"x-client-secret\"] = this.clientSecret;\n    }\n\n    const body: Record<string, unknown> = {};\n    let pkceVerifier: string | undefined;\n\n    if (!this.isConfidential) {\n      pkceVerifier = generatePkceVerifier();\n      const challenge = await computePkceChallenge(pkceVerifier);\n      body.pkce_challenge = challenge;\n    }\n\n    const resp = await this._fetch(`${this.instanceUrl}/oauth/dpop-keys`, {\n      method: \"POST\",\n      headers,\n      body: JSON.stringify(body),\n    });\n\n    if (!resp.ok) {\n      const body = await resp.json().catch(() => ({}));\n      throw new ApiError(\n        `Failed to provision DPoP key: ${resp.status} ${(body as any).error ?? (body as any).message ?? resp.statusText}`,\n        resp.status,\n        body,\n      );\n    }\n\n    const data: ProvisionKeyResponse = await resp.json();\n    const dpopKey = await importJwk(data.dpop_key);\n    return {\n      provisionId: data.provision_id,\n      dpopKey,\n      rawJwk: data.dpop_key,\n      pkceVerifier,\n    };\n  }\n\n  async registerSession(\n    params: RegisterSessionParams,\n  ): Promise<HappyViewSession> {\n    const headers: Record<string, string> = {\n      \"content-type\": \"application/json\",\n      \"x-client-key\": this.clientKey,\n    };\n    if (this.clientSecret) {\n      headers[\"x-client-secret\"] = this.clientSecret;\n    }\n\n    const body: Record<string, unknown> = {\n      provision_id: params.provisionId,\n      did: params.did,\n      access_token: params.accessToken,\n      refresh_token: params.refreshToken,\n      scopes: params.scopes,\n      pds_url: params.pdsUrl,\n      issuer: params.issuer,\n    };\n\n    if (!this.isConfidential && params.pkceVerifier) {\n      body.pkce_verifier = params.pkceVerifier;\n    }\n\n    const resp = await this._fetch(`${this.instanceUrl}/oauth/sessions`, {\n      method: \"POST\",\n      headers,\n      body: JSON.stringify(body),\n    });\n\n    if (!resp.ok) {\n      const body = await resp.json().catch(() => ({}));\n      throw new ApiError(\n        `Failed to register session: ${resp.status} ${(body as any).error ?? (body as any).message ?? resp.statusText}`,\n        resp.status,\n        body,\n      );\n    }\n\n    const data: RegisterSessionResponse = await resp.json();\n    const dpopKey = await importJwk(params.dpopKey);\n\n    const storedSession: StoredSession = {\n      did: data.did,\n      dpopKey: params.dpopKey,\n      accessToken: params.accessToken,\n      clientKey: this.clientKey,\n      instanceUrl: this.instanceUrl,\n      scopes: params.scopes,\n      pdsUrl: params.pdsUrl,\n      issuer: params.issuer,\n    };\n    await this.storage.set(\n      `${STORAGE_PREFIX}${data.did}`,\n      JSON.stringify(storedSession),\n    );\n    await this.storage.set(LAST_ACTIVE_KEY, data.did);\n\n    const session = new HappyViewSession({\n      did: data.did,\n      dpopKey,\n      accessToken: params.accessToken,\n      clientKey: this.clientKey,\n      instanceUrl: this.instanceUrl,\n      scopes: params.scopes,\n      pdsUrl: params.pdsUrl,\n      issuer: params.issuer,\n      fetch: this._fetch,\n      onSignOut: () => this.deleteSession(data.did),\n    });\n\n    this.sessionHooks.onSessionUpdate?.(data.did);\n\n    return session;\n  }\n\n  /**\n   * Revoke the session server-side and clear it locally.\n   *\n   * The local cleanup runs unconditionally. If it did not, a server that\n   * refuses the revocation would leave the session in storage, `restore()`\n   * would sign the user back in on the next load, and the next logout would\n   * fail identically — a loop with no exit through this API.\n   */\n  async deleteSession(did: string): Promise<void> {\n    try {\n      const session = await this.restoreSession(did);\n      if (session) {\n        const resp = await session.fetchHandler(\n          `${this.instanceUrl}/oauth/sessions/${did}`,\n          { method: \"DELETE\" },\n        );\n\n        // 404: already gone. 401/403: the credential is itself invalid, so\n        // there is no live session left to revoke. None of these is a logout\n        // that failed, so none of them should be reported as one.\n        const alreadyUnusable =\n          resp.status === 404 || resp.status === 401 || resp.status === 403;\n\n        if (!resp.ok && !alreadyUnusable) {\n          const body = await resp.json().catch(() => ({}));\n          throw new ApiError(\n            `Failed to delete session: ${resp.status} ${(body as any).error ?? (body as any).message ?? resp.statusText}`,\n            resp.status,\n            body,\n          );\n        }\n      }\n    } finally {\n      // 5xx and network errors still throw — the server may genuinely still\n      // hold a live session and the caller deserves to know. They throw from\n      // here, after the local state is gone, so the user is logged out either\n      // way.\n      await this.forgetSession(did);\n    }\n  }\n\n  /**\n   * Clear a session locally without contacting the server.\n   *\n   * The escape hatch for a session that cannot be revoked remotely — a revoked\n   * or expired credential, an unreachable instance. Nothing is revoked, so the\n   * server may still consider the session live until it expires.\n   */\n  async forgetSession(did: string): Promise<void> {\n    await this.storage.delete(`${STORAGE_PREFIX}${did}`);\n\n    const lastActive = await this.storage.get(LAST_ACTIVE_KEY);\n    if (lastActive === did) {\n      await this.storage.delete(LAST_ACTIVE_KEY);\n    }\n\n    this.sessionHooks.onSessionDelete?.(did);\n  }\n\n  async restoreSession(did: string): Promise<HappyViewSession | null> {\n    const stored = await this.storage.get(`${STORAGE_PREFIX}${did}`);\n    if (!stored) return null;\n\n    const data: StoredSession = JSON.parse(stored);\n    const dpopKey = await importJwk(data.dpopKey);\n    return new HappyViewSession({\n      did: data.did,\n      dpopKey,\n      accessToken: data.accessToken,\n      clientKey: data.clientKey,\n      instanceUrl: data.instanceUrl,\n      scopes: data.scopes,\n      pdsUrl: data.pdsUrl,\n      issuer: data.issuer,\n      fetch: this._fetch,\n      onSignOut: () => this.deleteSession(data.did),\n    });\n  }\n\n  async getSession(did: string): Promise<GetSessionResponse> {\n    const session = await this.restoreSession(did);\n    if (!session) {\n      throw new ApiError(\"No stored session for this DID\", 404, {});\n    }\n\n    const resp = await session.fetchHandler(\n      `${this.instanceUrl}/oauth/sessions/${did}`,\n      { method: \"GET\" },\n    );\n\n    if (!resp.ok) {\n      const body = await resp.json().catch(() => ({}));\n      throw new ApiError(\n        `Failed to get session: ${resp.status} ${(body as any).error ?? (body as any).message ?? resp.statusText}`,\n        resp.status,\n        body,\n      );\n    }\n\n    return resp.json();\n  }\n\n  async restore(): Promise<HappyViewSession | null> {\n    const did = await this.storage.get(LAST_ACTIVE_KEY);\n    if (!did) return null;\n    return this.restoreSession(did);\n  }\n}\n\n// PKCE helpers — inline since they're just a few lines of Web Crypto\nfunction generatePkceVerifier(): string {\n  const bytes = crypto.getRandomValues(new Uint8Array(32));\n  let binary = \"\";\n  for (let i = 0; i < bytes.length; i++) {\n    binary += String.fromCharCode(bytes[i]);\n  }\n  return btoa(binary)\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/, \"\");\n}\n\nasync function computePkceChallenge(verifier: string): Promise<string> {\n  const hash = await crypto.subtle.digest(\n    \"SHA-256\",\n    new TextEncoder().encode(verifier),\n  );\n  const bytes = new Uint8Array(hash);\n  let binary = \"\";\n  for (let i = 0; i < bytes.length; i++) {\n    binary += String.fromCharCode(bytes[i]);\n  }\n  return btoa(binary)\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/, \"\");\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,0BAAc,yBAAd;AACA,0BAAc,mCADd;;;ACAO,IAAM,iBAAN,cAA6B,MAAM;AAAA,EACxC,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,WAAN,cAAuB,eAAe;AAAA,EAClC;AAAA,EACA;AAAA,EAET,YAAY,SAAiB,QAAgB,MAAgB;AAC3D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,sBAAN,cAAkC,eAAe;AAAA,EAC7C;AAAA,EAET,YAAY,SAAiB,SAAiB,KAAK;AACjD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AACF;AAEO,IAAM,oBAAN,cAAgC,eAAe;AAAA,EACpD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,qBAAN,cAAiC,eAAe;AAAA,EAC5C;AAAA,EACA;AAAA,EAET,YAAY,SAAiB,QAAgB,MAAc;AACzD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,kBAAN,cAA8B,eAAe;AAAA,EAClD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,qBAAN,MAAM,4BAA2B,eAAe;AAAA,EAC5C;AAAA,EACA;AAAA,EAET,OAAO,KACL,KACA,QACA,OACoB;AACpB,QAAI,eAAe,oBAAoB,QAAO;AAC9C,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,WAAO,IAAI,oBAAmB,QAAQ,SAAS,OAAO,GAAG;AAAA,EAC3D;AAAA,EAEA,YACE,QACA,SACA,OACA,OACA;AACA;AAAA,MACE,WACE,OAAO,IAAI,mBAAmB,KAC9B;AAAA,IACJ;AACA,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,QAAQ;AACb,QAAI,UAAU,QAAW;AACvB,WAAK,QAAQ;AAAA,IACf;AAAA,EACF;AACF;;;ACvFA,2BAA6B;AAM7B,eAAsB,UAAU,KAAwC;AACtE,QAAM,aAAa,MAAM,OAAO,OAAO;AAAA,IACrC;AAAA,IACA;AAAA,IACA,EAAE,MAAM,SAAS,YAAY,QAAQ;AAAA,IACrC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AAGA,QAAM,EAAE,GAAG,GAAG,GAAG,gBAAgB,IAAI;AACrC,QAAM,YAAY,MAAM,OAAO,OAAO;AAAA,IACpC;AAAA,IACA;AAAA,IACA,EAAE,MAAM,SAAS,YAAY,QAAQ;AAAA,IACrC;AAAA,IACA,CAAC,QAAQ;AAAA,EACX;AAEA,QAAM,MAAO,IAAsC,OAAO,OAAO,WAAW;AAC5E,SAAO,kCAAa,YAAY,EAAE,YAAY,UAAU,GAAG,GAAG;AAChE;;;ACXA,SAAS,UAAU,YAA4B;AAC7C,QAAM,QAAQ,OAAO,gBAAgB,IAAI,WAAW,UAAU,CAAC;AAC/D,SAAO,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAC1E;AAEA,SAAS,UAAU,QAA6B;AAC9C,QAAM,QAAQ,IAAI,WAAW,MAAM;AACnC,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EACxC;AACA,SAAO,KAAK,MAAM,EACf,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AACtB;AAEO,IAAM,mBAAN,MAAuB;AAAA,EACnB;AAAA,EACA;AAAA,EAEQ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACT;AAAA,EAER,YAAY,SAAkC;AAC5C,SAAK,MAAM,QAAQ;AACnB,SAAK,SAAS,QAAQ,SAAS,QAAQ,OAAO,MAAM,GAAG,IAAI,CAAC;AAC5D,SAAK,UAAU,QAAQ;AACvB,SAAK,cAAc,QAAQ;AAC3B,SAAK,YAAY,QAAQ;AACzB,SAAK,cAAc,QAAQ,YAAY,QAAQ,QAAQ,EAAE;AACzD,SAAK,UAAU,QAAQ;AACvB,SAAK,UAAU,QAAQ;AACvB,SAAK,UAAU,QAAQ;AACvB,SAAK,SAAS,QAAQ,UAAU,CAAC,OAA0B,SAAuB,MAAM,OAAO,IAAI;AACnG,SAAK,aAAa,QAAQ;AAAA,EAC5B;AAAA,EAEA,IAAI,MAAc;AAChB,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,eAA0B;AACxB,WAAO;AAAA,MACL,OAAO,KAAK;AAAA,MACZ,KAAK,KAAK;AAAA,MACV,KAAK,KAAK;AAAA,MACV,KAAK,KAAK;AAAA,IACZ;AAAA,EACF;AAAA,EAEA,MAAM,UAAyB;AAC7B,QAAI,KAAK,YAAY;AACnB,YAAM,KAAK,WAAW;AAAA,IACxB;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,KAAa,MAAsC;AACpE,UAAM,UAAU,gBAAgB,KAAK,GAAG,IACpC,MACA,GAAG,KAAK,WAAW,GAAG,GAAG;AAC7B,UAAM,UAAU,KAAK,UAAU,OAAO,YAAY;AAClD,UAAM,MAAM,QAAQ,MAAM,GAAG,EAAE,CAAC;AAEhC,UAAM,gBAAgB,YAA+B;AACnD,YAAM,YAAY,MAAM,OAAO,OAAO;AAAA,QACpC;AAAA,QACA,IAAI,YAAY,EAAE,OAAO,KAAK,WAAW;AAAA,MAC3C;AACA,YAAM,MAAM,UAAU,SAAS;AAE/B,YAAM,QAAQ,MAAM,KAAK,QAAQ;AAAA,QAC/B;AAAA,UACE,KAAK;AAAA,UACL,KAAK;AAAA,UACL,KAAK,KAAK,QAAQ;AAAA,QACpB;AAAA,QACA;AAAA,UACE,KAAK;AAAA,UACL;AAAA,UACA,KAAK,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAAA,UACjC,KAAK,UAAU,EAAE;AAAA,UACjB;AAAA,UACA,OAAO,KAAK;AAAA,QACd;AAAA,MACF;AAEA,YAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;AACxC,cAAQ,IAAI,iBAAiB,QAAQ,KAAK,WAAW,EAAE;AACvD,cAAQ,IAAI,QAAQ,KAAK;AACzB,cAAQ,IAAI,gBAAgB,KAAK,SAAS;AAE1C,aAAO,KAAK,OAAO,SAAS,EAAE,GAAG,MAAM,QAAQ,CAAC;AAAA,IAClD;AAEA,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,cAAc;AAAA,IACjC,SAAS,GAAG;AACV,YAAM,OAAO,gBAAgB,OAAO,KAAK,MAAM,eAAe,OAAO,KAAK,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC,UAAU,OAAO;AAChH,YAAM,IAAI,MAAM,wBAAyB,EAAY,OAAO;AAAA;AAAA,SAAc,IAAI,EAAE;AAAA,IAClF;AAGA,UAAM,QAAQ,SAAS,QAAQ,IAAI,YAAY;AAC/C,QAAI,SAAS,UAAU,KAAK,cAAc,SAAS,WAAW,OAAO,SAAS,WAAW,MAAM;AAC7F,WAAK,YAAY;AACjB,UAAI;AACF,mBAAW,MAAM,cAAc;AAAA,MACjC,SAAS,GAAG;AACV,cAAM,IAAI,MAAM,8BAA+B,EAAY,OAAO,EAAE;AAAA,MACtE;AACA,YAAM,aAAa,SAAS,QAAQ,IAAI,YAAY;AACpD,UAAI,YAAY;AACd,aAAK,YAAY;AAAA,MACnB;AAAA,IACF,WAAW,OAAO;AAChB,WAAK,YAAY;AAAA,IACnB;AAEA,WAAO;AAAA,EACT;AACF;;;AChJO,IAAM,gBAAN,MAA8C;AAAA,EAC3C,OAAO,oBAAI,IAAoB;AAAA,EAEvC,MAAM,IAAI,KAAqC;AAC7C,WAAO,KAAK,KAAK,IAAI,GAAG,KAAK;AAAA,EAC/B;AAAA,EAEA,MAAM,IAAI,KAAa,OAA8B;AACnD,SAAK,KAAK,IAAI,KAAK,KAAK;AAAA,EAC1B;AAAA,EAEA,MAAM,OAAO,KAA4B;AACvC,SAAK,KAAK,OAAO,GAAG;AAAA,EACtB;AACF;;;ACGO,IAAM,iBAAiB;AACvB,IAAM,kBAAkB;AAQxB,IAAM,uBAAN,MAA2B;AAAA,EAChC,aAAa,cAAc;AAAA,IACzB;AAAA,IACA,OAAO,UAAU,WAAW;AAAA,IAC5B;AAAA,EACF,GAA2D;AACzD,YAAQ,eAAe;AACvB,UAAM,OAAO,MAAM,QAAQ,UAAU,EAAE,UAAU,SAAS,OAAO,CAAC;AAClE,QAAI,KAAK,WAAW,KAAK;AACvB,WAAK,MAAM,SAAS;AACpB,YAAM,IAAI,MAAM,oCAAoC,KAAK,MAAM,EAAE;AAAA,IACnE;AACA,UAAM,OAAO,KAAK,QAAQ,IAAI,cAAc,GAAG,MAAM,GAAG,EAAE,CAAC,EAAE,KAAK;AAClE,QAAI,SAAS,oBAAoB;AAC/B,WAAK,MAAM,SAAS;AACpB,YAAM,IAAI,MAAM,yCAAyC,IAAI,EAAE;AAAA,IACjE;AACA,WAAO,KAAK,KAAK;AAAA,EACnB;AAAA,EAEmB;AAAA,EACA;AAAA,EACA;AAAA,EACF;AAAA,EACE;AAAA,EACF;AAAA,EAEjB,YACE,SAGA;AACA,SAAK,cAAc,QAAQ,YAAY,QAAQ,QAAQ,EAAE;AACzD,SAAK,YAAY,QAAQ;AACzB,SAAK,eAAe,QAAQ;AAC5B,SAAK,UAAU,QAAQ,WAAW,IAAI,cAAc;AACpD,SAAK,SAAS,QAAQ,UAAU,CAAC,OAA0B,SAAuB,MAAM,OAAO,IAAI;AACnG,SAAK,eAAe,QAAQ,gBAAgB,CAAC;AAAA,EAC/C;AAAA,EAEA,IAAI,iBAA0B;AAC5B,WAAO,KAAK,iBAAiB;AAAA,EAC/B;AAAA,EAEA,MAAM,mBAKH;AACD,UAAM,UAAkC;AAAA,MACtC,gBAAgB;AAAA,MAChB,gBAAgB,KAAK;AAAA,IACvB;AACA,QAAI,KAAK,cAAc;AACrB,cAAQ,iBAAiB,IAAI,KAAK;AAAA,IACpC;AAEA,UAAM,OAAgC,CAAC;AACvC,QAAI;AAEJ,QAAI,CAAC,KAAK,gBAAgB;AACxB,qBAAe,qBAAqB;AACpC,YAAM,YAAY,MAAM,qBAAqB,YAAY;AACzD,WAAK,iBAAiB;AAAA,IACxB;AAEA,UAAM,OAAO,MAAM,KAAK,OAAO,GAAG,KAAK,WAAW,oBAAoB;AAAA,MACpE,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAED,QAAI,CAAC,KAAK,IAAI;AACZ,YAAMA,QAAO,MAAM,KAAK,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,YAAM,IAAI;AAAA,QACR,iCAAiC,KAAK,MAAM,IAAKA,MAAa,SAAUA,MAAa,WAAW,KAAK,UAAU;AAAA,QAC/G,KAAK;AAAA,QACLA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,OAA6B,MAAM,KAAK,KAAK;AACnD,UAAM,UAAU,MAAM,UAAU,KAAK,QAAQ;AAC7C,WAAO;AAAA,MACL,aAAa,KAAK;AAAA,MAClB;AAAA,MACA,QAAQ,KAAK;AAAA,MACb;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,gBACJ,QAC2B;AAC3B,UAAM,UAAkC;AAAA,MACtC,gBAAgB;AAAA,MAChB,gBAAgB,KAAK;AAAA,IACvB;AACA,QAAI,KAAK,cAAc;AACrB,cAAQ,iBAAiB,IAAI,KAAK;AAAA,IACpC;AAEA,UAAM,OAAgC;AAAA,MACpC,cAAc,OAAO;AAAA,MACrB,KAAK,OAAO;AAAA,MACZ,cAAc,OAAO;AAAA,MACrB,eAAe,OAAO;AAAA,MACtB,QAAQ,OAAO;AAAA,MACf,SAAS,OAAO;AAAA,MAChB,QAAQ,OAAO;AAAA,IACjB;AAEA,QAAI,CAAC,KAAK,kBAAkB,OAAO,cAAc;AAC/C,WAAK,gBAAgB,OAAO;AAAA,IAC9B;AAEA,UAAM,OAAO,MAAM,KAAK,OAAO,GAAG,KAAK,WAAW,mBAAmB;AAAA,MACnE,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAED,QAAI,CAAC,KAAK,IAAI;AACZ,YAAMA,QAAO,MAAM,KAAK,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,YAAM,IAAI;AAAA,QACR,+BAA+B,KAAK,MAAM,IAAKA,MAAa,SAAUA,MAAa,WAAW,KAAK,UAAU;AAAA,QAC7G,KAAK;AAAA,QACLA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,OAAgC,MAAM,KAAK,KAAK;AACtD,UAAM,UAAU,MAAM,UAAU,OAAO,OAAO;AAE9C,UAAM,gBAA+B;AAAA,MACnC,KAAK,KAAK;AAAA,MACV,SAAS,OAAO;AAAA,MAChB,aAAa,OAAO;AAAA,MACpB,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,MAClB,QAAQ,OAAO;AAAA,MACf,QAAQ,OAAO;AAAA,MACf,QAAQ,OAAO;AAAA,IACjB;AACA,UAAM,KAAK,QAAQ;AAAA,MACjB,GAAG,cAAc,GAAG,KAAK,GAAG;AAAA,MAC5B,KAAK,UAAU,aAAa;AAAA,IAC9B;AACA,UAAM,KAAK,QAAQ,IAAI,iBAAiB,KAAK,GAAG;AAEhD,UAAM,UAAU,IAAI,iBAAiB;AAAA,MACnC,KAAK,KAAK;AAAA,MACV;AAAA,MACA,aAAa,OAAO;AAAA,MACpB,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,MAClB,QAAQ,OAAO;AAAA,MACf,QAAQ,OAAO;AAAA,MACf,QAAQ,OAAO;AAAA,MACf,OAAO,KAAK;AAAA,MACZ,WAAW,MAAM,KAAK,cAAc,KAAK,GAAG;AAAA,IAC9C,CAAC;AAED,SAAK,aAAa,kBAAkB,KAAK,GAAG;AAE5C,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,cAAc,KAA4B;AAC9C,QAAI;AACF,YAAM,UAAU,MAAM,KAAK,eAAe,GAAG;AAC7C,UAAI,SAAS;AACX,cAAM,OAAO,MAAM,QAAQ;AAAA,UACzB,GAAG,KAAK,WAAW,mBAAmB,GAAG;AAAA,UACzC,EAAE,QAAQ,SAAS;AAAA,QACrB;AAKA,cAAM,kBACJ,KAAK,WAAW,OAAO,KAAK,WAAW,OAAO,KAAK,WAAW;AAEhE,YAAI,CAAC,KAAK,MAAM,CAAC,iBAAiB;AAChC,gBAAM,OAAO,MAAM,KAAK,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,gBAAM,IAAI;AAAA,YACR,6BAA6B,KAAK,MAAM,IAAK,KAAa,SAAU,KAAa,WAAW,KAAK,UAAU;AAAA,YAC3G,KAAK;AAAA,YACL;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF,UAAE;AAKA,YAAM,KAAK,cAAc,GAAG;AAAA,IAC9B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,cAAc,KAA4B;AAC9C,UAAM,KAAK,QAAQ,OAAO,GAAG,cAAc,GAAG,GAAG,EAAE;AAEnD,UAAM,aAAa,MAAM,KAAK,QAAQ,IAAI,eAAe;AACzD,QAAI,eAAe,KAAK;AACtB,YAAM,KAAK,QAAQ,OAAO,eAAe;AAAA,IAC3C;AAEA,SAAK,aAAa,kBAAkB,GAAG;AAAA,EACzC;AAAA,EAEA,MAAM,eAAe,KAA+C;AAClE,UAAM,SAAS,MAAM,KAAK,QAAQ,IAAI,GAAG,cAAc,GAAG,GAAG,EAAE;AAC/D,QAAI,CAAC,OAAQ,QAAO;AAEpB,UAAM,OAAsB,KAAK,MAAM,MAAM;AAC7C,UAAM,UAAU,MAAM,UAAU,KAAK,OAAO;AAC5C,WAAO,IAAI,iBAAiB;AAAA,MAC1B,KAAK,KAAK;AAAA,MACV;AAAA,MACA,aAAa,KAAK;AAAA,MAClB,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,MAClB,QAAQ,KAAK;AAAA,MACb,QAAQ,KAAK;AAAA,MACb,QAAQ,KAAK;AAAA,MACb,OAAO,KAAK;AAAA,MACZ,WAAW,MAAM,KAAK,cAAc,KAAK,GAAG;AAAA,IAC9C,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,WAAW,KAA0C;AACzD,UAAM,UAAU,MAAM,KAAK,eAAe,GAAG;AAC7C,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,SAAS,kCAAkC,KAAK,CAAC,CAAC;AAAA,IAC9D;AAEA,UAAM,OAAO,MAAM,QAAQ;AAAA,MACzB,GAAG,KAAK,WAAW,mBAAmB,GAAG;AAAA,MACzC,EAAE,QAAQ,MAAM;AAAA,IAClB;AAEA,QAAI,CAAC,KAAK,IAAI;AACZ,YAAM,OAAO,MAAM,KAAK,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,YAAM,IAAI;AAAA,QACR,0BAA0B,KAAK,MAAM,IAAK,KAAa,SAAU,KAAa,WAAW,KAAK,UAAU;AAAA,QACxG,KAAK;AAAA,QACL;AAAA,MACF;AAAA,IACF;AAEA,WAAO,KAAK,KAAK;AAAA,EACnB;AAAA,EAEA,MAAM,UAA4C;AAChD,UAAM,MAAM,MAAM,KAAK,QAAQ,IAAI,eAAe;AAClD,QAAI,CAAC,IAAK,QAAO;AACjB,WAAO,KAAK,eAAe,GAAG;AAAA,EAChC;AACF;AAGA,SAAS,uBAA+B;AACtC,QAAM,QAAQ,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AACvD,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EACxC;AACA,SAAO,KAAK,MAAM,EACf,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AACtB;AAEA,eAAe,qBAAqB,UAAmC;AACrE,QAAM,OAAO,MAAM,OAAO,OAAO;AAAA,IAC/B;AAAA,IACA,IAAI,YAAY,EAAE,OAAO,QAAQ;AAAA,EACnC;AACA,QAAM,QAAQ,IAAI,WAAW,IAAI;AACjC,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EACxC;AACA,SAAO,KAAK,MAAM,EACf,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AACtB;","names":["body"]}

package/dist/index.d.cts

@@ -104,6 +104,7 @@ declare class HappyViewSession {
     fetchHandler(url: string, init: RequestInit): Promise<Response>;
 }
 
+declare const STORAGE_PREFIX = "happyview:session:";
 declare const LAST_ACTIVE_KEY = "happyview:last-active-did";
 interface FetchMetadataOptions {
     clientId: string;
@@ -129,7 +130,23 @@ declare class HappyViewOAuthClient {
         pkceVerifier?: string;
     }>;
     registerSession(params: RegisterSessionParams): Promise<HappyViewSession>;
+    /**
+     * Revoke the session server-side and clear it locally.
+     *
+     * The local cleanup runs unconditionally. If it did not, a server that
+     * refuses the revocation would leave the session in storage, `restore()`
+     * would sign the user back in on the next load, and the next logout would
+     * fail identically — a loop with no exit through this API.
+     */
     deleteSession(did: string): Promise<void>;
+    /**
+     * Clear a session locally without contacting the server.
+     *
+     * The escape hatch for a session that cannot be revoked remotely — a revoked
+     * or expired credential, an unreachable instance. Nothing is revoked, so the
+     * server may still consider the session live until it expires.
+     */
+    forgetSession(did: string): Promise<void>;
     restoreSession(did: string): Promise<HappyViewSession | null>;
     getSession(did: string): Promise<GetSessionResponse>;
     restore(): Promise<HappyViewSession | null>;
@@ -178,4 +195,4 @@ declare class MemoryStorage implements StorageAdapter {
     delete(key: string): Promise<void>;
 }
 
-export { ApiError, AuthenticationError, type DpopProvision, type FetchMetadataOptions, type GetSessionResponse, HappyViewError, HappyViewOAuthClient, type HappyViewOAuthClientOptions, HappyViewSession, type HappyViewSessionOptions, InvalidStateError, LAST_ACTIVE_KEY, MemoryStorage, OAuthCallbackError, type ProvisionKeyResponse, type RegisterSessionParams, type RegisterSessionResponse, ResolutionError, type SessionEventHooks, type StorageAdapter, type StoredSession, TokenExchangeError, type TokenInfo, importJwk };
+export { ApiError, AuthenticationError, type DpopProvision, type FetchMetadataOptions, type GetSessionResponse, HappyViewError, HappyViewOAuthClient, type HappyViewOAuthClientOptions, HappyViewSession, type HappyViewSessionOptions, InvalidStateError, LAST_ACTIVE_KEY, MemoryStorage, OAuthCallbackError, type ProvisionKeyResponse, type RegisterSessionParams, type RegisterSessionResponse, ResolutionError, STORAGE_PREFIX, type SessionEventHooks, type StorageAdapter, type StoredSession, TokenExchangeError, type TokenInfo, importJwk };

package/dist/index.d.ts

@@ -104,6 +104,7 @@ declare class HappyViewSession {
     fetchHandler(url: string, init: RequestInit): Promise<Response>;
 }
 
+declare const STORAGE_PREFIX = "happyview:session:";
 declare const LAST_ACTIVE_KEY = "happyview:last-active-did";
 interface FetchMetadataOptions {
     clientId: string;
@@ -129,7 +130,23 @@ declare class HappyViewOAuthClient {
         pkceVerifier?: string;
     }>;
     registerSession(params: RegisterSessionParams): Promise<HappyViewSession>;
+    /**
+     * Revoke the session server-side and clear it locally.
+     *
+     * The local cleanup runs unconditionally. If it did not, a server that
+     * refuses the revocation would leave the session in storage, `restore()`
+     * would sign the user back in on the next load, and the next logout would
+     * fail identically — a loop with no exit through this API.
+     */
     deleteSession(did: string): Promise<void>;
+    /**
+     * Clear a session locally without contacting the server.
+     *
+     * The escape hatch for a session that cannot be revoked remotely — a revoked
+     * or expired credential, an unreachable instance. Nothing is revoked, so the
+     * server may still consider the session live until it expires.
+     */
+    forgetSession(did: string): Promise<void>;
     restoreSession(did: string): Promise<HappyViewSession | null>;
     getSession(did: string): Promise<GetSessionResponse>;
     restore(): Promise<HappyViewSession | null>;
@@ -178,4 +195,4 @@ declare class MemoryStorage implements StorageAdapter {
     delete(key: string): Promise<void>;
 }
 
-export { ApiError, AuthenticationError, type DpopProvision, type FetchMetadataOptions, type GetSessionResponse, HappyViewError, HappyViewOAuthClient, type HappyViewOAuthClientOptions, HappyViewSession, type HappyViewSessionOptions, InvalidStateError, LAST_ACTIVE_KEY, MemoryStorage, OAuthCallbackError, type ProvisionKeyResponse, type RegisterSessionParams, type RegisterSessionResponse, ResolutionError, type SessionEventHooks, type StorageAdapter, type StoredSession, TokenExchangeError, type TokenInfo, importJwk };
+export { ApiError, AuthenticationError, type DpopProvision, type FetchMetadataOptions, type GetSessionResponse, HappyViewError, HappyViewOAuthClient, type HappyViewOAuthClientOptions, HappyViewSession, type HappyViewSessionOptions, InvalidStateError, LAST_ACTIVE_KEY, MemoryStorage, OAuthCallbackError, type ProvisionKeyResponse, type RegisterSessionParams, type RegisterSessionResponse, ResolutionError, STORAGE_PREFIX, type SessionEventHooks, type StorageAdapter, type StoredSession, TokenExchangeError, type TokenInfo, importJwk };

package/dist/index.js

@@ -361,22 +361,44 @@ var HappyViewOAuthClient = class {
     this.sessionHooks.onSessionUpdate?.(data.did);
     return session;
   }
+  /**
+   * Revoke the session server-side and clear it locally.
+   *
+   * The local cleanup runs unconditionally. If it did not, a server that
+   * refuses the revocation would leave the session in storage, `restore()`
+   * would sign the user back in on the next load, and the next logout would
+   * fail identically — a loop with no exit through this API.
+   */
   async deleteSession(did) {
-    const session = await this.restoreSession(did);
-    if (session) {
-      const resp = await session.fetchHandler(
-        `${this.instanceUrl}/oauth/sessions/${did}`,
-        { method: "DELETE" }
-      );
-      if (!resp.ok && resp.status !== 404) {
-        const body = await resp.json().catch(() => ({}));
-        throw new ApiError(
-          `Failed to delete session: ${resp.status} ${body.error ?? body.message ?? resp.statusText}`,
-          resp.status,
-          body
+    try {
+      const session = await this.restoreSession(did);
+      if (session) {
+        const resp = await session.fetchHandler(
+          `${this.instanceUrl}/oauth/sessions/${did}`,
+          { method: "DELETE" }
         );
+        const alreadyUnusable = resp.status === 404 || resp.status === 401 || resp.status === 403;
+        if (!resp.ok && !alreadyUnusable) {
+          const body = await resp.json().catch(() => ({}));
+          throw new ApiError(
+            `Failed to delete session: ${resp.status} ${body.error ?? body.message ?? resp.statusText}`,
+            resp.status,
+            body
+          );
+        }
       }
+    } finally {
+      await this.forgetSession(did);
     }
+  }
+  /**
+   * Clear a session locally without contacting the server.
+   *
+   * The escape hatch for a session that cannot be revoked remotely — a revoked
+   * or expired credential, an unreachable instance. Nothing is revoked, so the
+   * server may still consider the session live until it expires.
+   */
+  async forgetSession(did) {
     await this.storage.delete(`${STORAGE_PREFIX}${did}`);
     const lastActive = await this.storage.get(LAST_ACTIVE_KEY);
     if (lastActive === did) {
@@ -458,6 +480,7 @@ export {
   MemoryStorage,
   OAuthCallbackError,
   ResolutionError,
+  STORAGE_PREFIX,
   TokenExchangeError,
   importJwk
 };

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/errors.ts","../src/import-jwk.ts","../src/session.ts","../src/storage.ts","../src/client.ts"],"sourcesContent":["export * from \"@atproto/jwk\";\nexport * from \"@atproto/jwk-webcrypto\";\n\nexport { HappyViewOAuthClient, LAST_ACTIVE_KEY } from \"./client\";\nexport type { FetchMetadataOptions } from \"./client\";\nexport { importJwk } from \"./import-jwk\";\nexport {\n  ApiError,\n  AuthenticationError,\n  HappyViewError,\n  InvalidStateError,\n  OAuthCallbackError,\n  ResolutionError,\n  TokenExchangeError,\n} from \"./errors\";\nexport { HappyViewSession } from \"./session\";\nexport type { HappyViewSessionOptions } from \"./session\";\nexport { MemoryStorage } from \"./storage\";\nexport type {\n  DpopProvision,\n  GetSessionResponse,\n  HappyViewOAuthClientOptions,\n  ProvisionKeyResponse,\n  RegisterSessionParams,\n  RegisterSessionResponse,\n  SessionEventHooks,\n  StorageAdapter,\n  StoredSession,\n  TokenInfo,\n} from \"./types\";\n","export class HappyViewError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"HappyViewError\";\n  }\n}\n\nexport class ApiError extends HappyViewError {\n  readonly status: number;\n  readonly body: unknown;\n\n  constructor(message: string, status: number, body?: unknown) {\n    super(message);\n    this.name = \"ApiError\";\n    this.status = status;\n    this.body = body;\n  }\n}\n\nexport class AuthenticationError extends HappyViewError {\n  readonly status: number;\n\n  constructor(message: string, status: number = 401) {\n    super(message);\n    this.name = \"AuthenticationError\";\n    this.status = status;\n  }\n}\n\nexport class InvalidStateError extends HappyViewError {\n  constructor(message: string) {\n    super(message);\n    this.name = \"InvalidStateError\";\n  }\n}\n\nexport class TokenExchangeError extends HappyViewError {\n  readonly status: number;\n  readonly body: string;\n\n  constructor(message: string, status: number, body: string) {\n    super(message);\n    this.name = \"TokenExchangeError\";\n    this.status = status;\n    this.body = body;\n  }\n}\n\nexport class ResolutionError extends HappyViewError {\n  constructor(message: string) {\n    super(message);\n    this.name = \"ResolutionError\";\n  }\n}\n\nexport class OAuthCallbackError extends HappyViewError {\n  readonly params: URLSearchParams;\n  readonly state: string | undefined;\n\n  static from(\n    err: unknown,\n    params: URLSearchParams,\n    state?: string,\n  ): OAuthCallbackError {\n    if (err instanceof OAuthCallbackError) return err;\n    const message = err instanceof Error ? err.message : undefined;\n    return new OAuthCallbackError(params, message, state, err);\n  }\n\n  constructor(\n    params: URLSearchParams,\n    message?: string,\n    state?: string,\n    cause?: unknown,\n  ) {\n    super(\n      message ??\n        params.get(\"error_description\") ??\n        \"OAuth callback error\",\n    );\n    this.name = \"OAuthCallbackError\";\n    this.params = params;\n    this.state = state;\n    if (cause !== undefined) {\n      this.cause = cause;\n    }\n  }\n}\n","import { WebcryptoKey } from \"@atproto/jwk-webcrypto\";\n\n/**\n * Import a raw ES256 JWK (as returned by HappyView's /oauth/dpop-keys)\n * into a WebcryptoKey that can sign JWTs.\n */\nexport async function importJwk(jwk: JsonWebKey): Promise<WebcryptoKey> {\n  const privateKey = await crypto.subtle.importKey(\n    \"jwk\",\n    jwk,\n    { name: \"ECDSA\", namedCurve: \"P-256\" },\n    true,\n    [\"sign\"],\n  );\n\n  // Derive public key by stripping the private component\n  const { d: _, ...publicJwkFields } = jwk;\n  const publicKey = await crypto.subtle.importKey(\n    \"jwk\",\n    publicJwkFields,\n    { name: \"ECDSA\", namedCurve: \"P-256\" },\n    true,\n    [\"verify\"],\n  );\n\n  const kid = (jwk as JsonWebKey & { kid?: string }).kid ?? crypto.randomUUID();\n  return WebcryptoKey.fromKeypair({ privateKey, publicKey }, kid);\n}\n","import type { Key } from \"@atproto/jwk\";\nimport type { TokenInfo } from \"./types\";\n\nexport interface HappyViewSessionOptions {\n  did: string;\n  dpopKey: Key;\n  accessToken: string;\n  clientKey: string;\n  instanceUrl: string;\n  scopes?: string;\n  pdsUrl?: string;\n  issuer?: string;\n  fetch?: typeof globalThis.fetch;\n  onSignOut?: () => Promise<void>;\n}\n\nfunction randomHex(byteLength: number): string {\n  const bytes = crypto.getRandomValues(new Uint8Array(byteLength));\n  return Array.from(bytes, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction base64url(buffer: ArrayBuffer): string {\n  const bytes = new Uint8Array(buffer);\n  let binary = \"\";\n  for (let i = 0; i < bytes.length; i++) {\n    binary += String.fromCharCode(bytes[i]);\n  }\n  return btoa(binary)\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/, \"\");\n}\n\nexport class HappyViewSession {\n  readonly did: string;\n  readonly scopes: string[];\n\n  private readonly dpopKey: Key;\n  private readonly accessToken: string;\n  private readonly clientKey: string;\n  private readonly instanceUrl: string;\n  private readonly _scopes: string | undefined;\n  private readonly _pdsUrl: string | undefined;\n  private readonly _issuer: string | undefined;\n  private readonly _fetch: typeof globalThis.fetch;\n  private readonly _onSignOut: (() => Promise<void>) | undefined;\n  private dpopNonce: string | undefined;\n\n  constructor(options: HappyViewSessionOptions) {\n    this.did = options.did;\n    this.scopes = options.scopes ? options.scopes.split(\" \") : [];\n    this.dpopKey = options.dpopKey;\n    this.accessToken = options.accessToken;\n    this.clientKey = options.clientKey;\n    this.instanceUrl = options.instanceUrl.replace(/\\/+$/, \"\");\n    this._scopes = options.scopes;\n    this._pdsUrl = options.pdsUrl;\n    this._issuer = options.issuer;\n    this._fetch = options.fetch ?? ((input: RequestInfo | URL, init?: RequestInit) => fetch(input, init)) as typeof globalThis.fetch;\n    this._onSignOut = options.onSignOut;\n  }\n\n  get sub(): string {\n    return this.did;\n  }\n\n  getTokenInfo(): TokenInfo {\n    return {\n      scope: this._scopes,\n      iss: this._issuer,\n      aud: this._pdsUrl,\n      sub: this.did,\n    };\n  }\n\n  async signOut(): Promise<void> {\n    if (this._onSignOut) {\n      await this._onSignOut();\n    }\n  }\n\n  async fetchHandler(url: string, init: RequestInit): Promise<Response> {\n    const fullUrl = /^https?:\\/\\//i.test(url)\n      ? url\n      : `${this.instanceUrl}${url}`;\n    const method = (init.method ?? \"GET\").toUpperCase();\n    const htu = fullUrl.split(\"?\")[0];\n\n    const sendWithProof = async (): Promise<Response> => {\n      const tokenHash = await crypto.subtle.digest(\n        \"SHA-256\",\n        new TextEncoder().encode(this.accessToken),\n      );\n      const ath = base64url(tokenHash);\n\n      const proof = await this.dpopKey.createJwt(\n        {\n          alg: \"ES256\",\n          typ: \"dpop+jwt\",\n          jwk: this.dpopKey.publicJwk!,\n        },\n        {\n          htm: method,\n          htu,\n          iat: Math.floor(Date.now() / 1000),\n          jti: randomHex(16),\n          ath,\n          nonce: this.dpopNonce,\n        },\n      );\n\n      const headers = new Headers(init.headers);\n      headers.set(\"authorization\", `DPoP ${this.accessToken}`);\n      headers.set(\"dpop\", proof);\n      headers.set(\"x-client-key\", this.clientKey);\n\n      return this._fetch(fullUrl, { ...init, headers });\n    };\n\n    let response: Response;\n    try {\n      response = await sendWithProof();\n    } catch (e) {\n      const info = `_fetch type: ${typeof this._fetch}, toString: ${String(this._fetch).slice(0, 120)}, url: ${fullUrl}`;\n      throw new Error(`fetchHandler failed: ${(e as Error).message}\\n\\nDEBUG: ${info}`);\n    }\n\n    // Retry once if the server requires a DPoP nonce we didn't have\n    const nonce = response.headers.get(\"dpop-nonce\");\n    if (nonce && nonce !== this.dpopNonce && (response.status === 401 || response.status === 400)) {\n      this.dpopNonce = nonce;\n      try {\n        response = await sendWithProof();\n      } catch (e) {\n        throw new Error(`fetchHandler retry failed: ${(e as Error).message}`);\n      }\n      const retryNonce = response.headers.get(\"dpop-nonce\");\n      if (retryNonce) {\n        this.dpopNonce = retryNonce;\n      }\n    } else if (nonce) {\n      this.dpopNonce = nonce;\n    }\n\n    return response;\n  }\n}\n","import type { StorageAdapter } from \"./types\";\n\nexport class MemoryStorage implements StorageAdapter {\n  private data = new Map<string, string>();\n\n  async get(key: string): Promise<string | null> {\n    return this.data.get(key) ?? null;\n  }\n\n  async set(key: string, value: string): Promise<void> {\n    this.data.set(key, value);\n  }\n\n  async delete(key: string): Promise<void> {\n    this.data.delete(key);\n  }\n}\n","import type { Key } from \"@atproto/jwk\";\nimport { ApiError } from \"./errors\";\nimport { importJwk } from \"./import-jwk\";\nimport { HappyViewSession } from \"./session\";\nimport { MemoryStorage } from \"./storage\";\nimport type {\n  GetSessionResponse,\n  HappyViewOAuthClientOptions,\n  ProvisionKeyResponse,\n  RegisterSessionParams,\n  RegisterSessionResponse,\n  SessionEventHooks,\n  StorageAdapter,\n  StoredSession,\n} from \"./types\";\n\nconst STORAGE_PREFIX = \"happyview:session:\";\nexport const LAST_ACTIVE_KEY = \"happyview:last-active-did\";\n\nexport interface FetchMetadataOptions {\n  clientId: string;\n  fetch?: typeof globalThis.fetch;\n  signal?: AbortSignal;\n}\n\nexport class HappyViewOAuthClient {\n  static async fetchMetadata({\n    clientId,\n    fetch: fetchFn = globalThis.fetch,\n    signal,\n  }: FetchMetadataOptions): Promise<Record<string, unknown>> {\n    signal?.throwIfAborted();\n    const resp = await fetchFn(clientId, { redirect: \"error\", signal });\n    if (resp.status !== 200) {\n      resp.body?.cancel?.();\n      throw new Error(`Failed to fetch client metadata: ${resp.status}`);\n    }\n    const mime = resp.headers.get(\"content-type\")?.split(\";\")[0].trim();\n    if (mime !== \"application/json\") {\n      resp.body?.cancel?.();\n      throw new Error(`Invalid client metadata content type: ${mime}`);\n    }\n    return resp.json() as Promise<Record<string, unknown>>;\n  }\n\n  protected readonly instanceUrl: string;\n  protected readonly clientKey: string;\n  protected readonly storage: StorageAdapter;\n  private readonly clientSecret: string | undefined;\n  protected readonly _fetch: typeof globalThis.fetch;\n  private readonly sessionHooks: SessionEventHooks;\n\n  constructor(\n    options: HappyViewOAuthClientOptions & {\n      fetch?: typeof globalThis.fetch;\n    },\n  ) {\n    this.instanceUrl = options.instanceUrl.replace(/\\/+$/, \"\");\n    this.clientKey = options.clientKey;\n    this.clientSecret = options.clientSecret;\n    this.storage = options.storage ?? new MemoryStorage();\n    this._fetch = options.fetch ?? ((input: RequestInfo | URL, init?: RequestInit) => fetch(input, init)) as typeof globalThis.fetch;\n    this.sessionHooks = options.sessionHooks ?? {};\n  }\n\n  get isConfidential(): boolean {\n    return this.clientSecret !== undefined;\n  }\n\n  async provisionDpopKey(): Promise<{\n    provisionId: string;\n    dpopKey: Key;\n    rawJwk: JsonWebKey;\n    pkceVerifier?: string;\n  }> {\n    const headers: Record<string, string> = {\n      \"content-type\": \"application/json\",\n      \"x-client-key\": this.clientKey,\n    };\n    if (this.clientSecret) {\n      headers[\"x-client-secret\"] = this.clientSecret;\n    }\n\n    const body: Record<string, unknown> = {};\n    let pkceVerifier: string | undefined;\n\n    if (!this.isConfidential) {\n      pkceVerifier = generatePkceVerifier();\n      const challenge = await computePkceChallenge(pkceVerifier);\n      body.pkce_challenge = challenge;\n    }\n\n    const resp = await this._fetch(`${this.instanceUrl}/oauth/dpop-keys`, {\n      method: \"POST\",\n      headers,\n      body: JSON.stringify(body),\n    });\n\n    if (!resp.ok) {\n      const body = await resp.json().catch(() => ({}));\n      throw new ApiError(\n        `Failed to provision DPoP key: ${resp.status} ${(body as any).error ?? (body as any).message ?? resp.statusText}`,\n        resp.status,\n        body,\n      );\n    }\n\n    const data: ProvisionKeyResponse = await resp.json();\n    const dpopKey = await importJwk(data.dpop_key);\n    return {\n      provisionId: data.provision_id,\n      dpopKey,\n      rawJwk: data.dpop_key,\n      pkceVerifier,\n    };\n  }\n\n  async registerSession(\n    params: RegisterSessionParams,\n  ): Promise<HappyViewSession> {\n    const headers: Record<string, string> = {\n      \"content-type\": \"application/json\",\n      \"x-client-key\": this.clientKey,\n    };\n    if (this.clientSecret) {\n      headers[\"x-client-secret\"] = this.clientSecret;\n    }\n\n    const body: Record<string, unknown> = {\n      provision_id: params.provisionId,\n      did: params.did,\n      access_token: params.accessToken,\n      refresh_token: params.refreshToken,\n      scopes: params.scopes,\n      pds_url: params.pdsUrl,\n      issuer: params.issuer,\n    };\n\n    if (!this.isConfidential && params.pkceVerifier) {\n      body.pkce_verifier = params.pkceVerifier;\n    }\n\n    const resp = await this._fetch(`${this.instanceUrl}/oauth/sessions`, {\n      method: \"POST\",\n      headers,\n      body: JSON.stringify(body),\n    });\n\n    if (!resp.ok) {\n      const body = await resp.json().catch(() => ({}));\n      throw new ApiError(\n        `Failed to register session: ${resp.status} ${(body as any).error ?? (body as any).message ?? resp.statusText}`,\n        resp.status,\n        body,\n      );\n    }\n\n    const data: RegisterSessionResponse = await resp.json();\n    const dpopKey = await importJwk(params.dpopKey);\n\n    const storedSession: StoredSession = {\n      did: data.did,\n      dpopKey: params.dpopKey,\n      accessToken: params.accessToken,\n      clientKey: this.clientKey,\n      instanceUrl: this.instanceUrl,\n      scopes: params.scopes,\n      pdsUrl: params.pdsUrl,\n      issuer: params.issuer,\n    };\n    await this.storage.set(\n      `${STORAGE_PREFIX}${data.did}`,\n      JSON.stringify(storedSession),\n    );\n    await this.storage.set(LAST_ACTIVE_KEY, data.did);\n\n    const session = new HappyViewSession({\n      did: data.did,\n      dpopKey,\n      accessToken: params.accessToken,\n      clientKey: this.clientKey,\n      instanceUrl: this.instanceUrl,\n      scopes: params.scopes,\n      pdsUrl: params.pdsUrl,\n      issuer: params.issuer,\n      fetch: this._fetch,\n      onSignOut: () => this.deleteSession(data.did),\n    });\n\n    this.sessionHooks.onSessionUpdate?.(data.did);\n\n    return session;\n  }\n\n  async deleteSession(did: string): Promise<void> {\n    const session = await this.restoreSession(did);\n    if (session) {\n      const resp = await session.fetchHandler(\n        `${this.instanceUrl}/oauth/sessions/${did}`,\n        { method: \"DELETE\" },\n      );\n\n      if (!resp.ok && resp.status !== 404) {\n        const body = await resp.json().catch(() => ({}));\n        throw new ApiError(\n          `Failed to delete session: ${resp.status} ${(body as any).error ?? (body as any).message ?? resp.statusText}`,\n          resp.status,\n          body,\n        );\n      }\n    }\n\n    await this.storage.delete(`${STORAGE_PREFIX}${did}`);\n\n    const lastActive = await this.storage.get(LAST_ACTIVE_KEY);\n    if (lastActive === did) {\n      await this.storage.delete(LAST_ACTIVE_KEY);\n    }\n\n    this.sessionHooks.onSessionDelete?.(did);\n  }\n\n  async restoreSession(did: string): Promise<HappyViewSession | null> {\n    const stored = await this.storage.get(`${STORAGE_PREFIX}${did}`);\n    if (!stored) return null;\n\n    const data: StoredSession = JSON.parse(stored);\n    const dpopKey = await importJwk(data.dpopKey);\n    return new HappyViewSession({\n      did: data.did,\n      dpopKey,\n      accessToken: data.accessToken,\n      clientKey: data.clientKey,\n      instanceUrl: data.instanceUrl,\n      scopes: data.scopes,\n      pdsUrl: data.pdsUrl,\n      issuer: data.issuer,\n      fetch: this._fetch,\n      onSignOut: () => this.deleteSession(data.did),\n    });\n  }\n\n  async getSession(did: string): Promise<GetSessionResponse> {\n    const session = await this.restoreSession(did);\n    if (!session) {\n      throw new ApiError(\"No stored session for this DID\", 404, {});\n    }\n\n    const resp = await session.fetchHandler(\n      `${this.instanceUrl}/oauth/sessions/${did}`,\n      { method: \"GET\" },\n    );\n\n    if (!resp.ok) {\n      const body = await resp.json().catch(() => ({}));\n      throw new ApiError(\n        `Failed to get session: ${resp.status} ${(body as any).error ?? (body as any).message ?? resp.statusText}`,\n        resp.status,\n        body,\n      );\n    }\n\n    return resp.json();\n  }\n\n  async restore(): Promise<HappyViewSession | null> {\n    const did = await this.storage.get(LAST_ACTIVE_KEY);\n    if (!did) return null;\n    return this.restoreSession(did);\n  }\n}\n\n// PKCE helpers — inline since they're just a few lines of Web Crypto\nfunction generatePkceVerifier(): string {\n  const bytes = crypto.getRandomValues(new Uint8Array(32));\n  let binary = \"\";\n  for (let i = 0; i < bytes.length; i++) {\n    binary += String.fromCharCode(bytes[i]);\n  }\n  return btoa(binary)\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/, \"\");\n}\n\nasync function computePkceChallenge(verifier: string): Promise<string> {\n  const hash = await crypto.subtle.digest(\n    \"SHA-256\",\n    new TextEncoder().encode(verifier),\n  );\n  const bytes = new Uint8Array(hash);\n  let binary = \"\";\n  for (let i = 0; i < bytes.length; i++) {\n    binary += String.fromCharCode(bytes[i]);\n  }\n  return btoa(binary)\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/, \"\");\n}\n"],"mappings":";AAAA,cAAc;AACd,cAAc;;;ACDP,IAAM,iBAAN,cAA6B,MAAM;AAAA,EACxC,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,WAAN,cAAuB,eAAe;AAAA,EAClC;AAAA,EACA;AAAA,EAET,YAAY,SAAiB,QAAgB,MAAgB;AAC3D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,sBAAN,cAAkC,eAAe;AAAA,EAC7C;AAAA,EAET,YAAY,SAAiB,SAAiB,KAAK;AACjD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AACF;AAEO,IAAM,oBAAN,cAAgC,eAAe;AAAA,EACpD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,qBAAN,cAAiC,eAAe;AAAA,EAC5C;AAAA,EACA;AAAA,EAET,YAAY,SAAiB,QAAgB,MAAc;AACzD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,kBAAN,cAA8B,eAAe;AAAA,EAClD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,qBAAN,MAAM,4BAA2B,eAAe;AAAA,EAC5C;AAAA,EACA;AAAA,EAET,OAAO,KACL,KACA,QACA,OACoB;AACpB,QAAI,eAAe,oBAAoB,QAAO;AAC9C,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,WAAO,IAAI,oBAAmB,QAAQ,SAAS,OAAO,GAAG;AAAA,EAC3D;AAAA,EAEA,YACE,QACA,SACA,OACA,OACA;AACA;AAAA,MACE,WACE,OAAO,IAAI,mBAAmB,KAC9B;AAAA,IACJ;AACA,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,QAAQ;AACb,QAAI,UAAU,QAAW;AACvB,WAAK,QAAQ;AAAA,IACf;AAAA,EACF;AACF;;;ACvFA,SAAS,oBAAoB;AAM7B,eAAsB,UAAU,KAAwC;AACtE,QAAM,aAAa,MAAM,OAAO,OAAO;AAAA,IACrC;AAAA,IACA;AAAA,IACA,EAAE,MAAM,SAAS,YAAY,QAAQ;AAAA,IACrC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AAGA,QAAM,EAAE,GAAG,GAAG,GAAG,gBAAgB,IAAI;AACrC,QAAM,YAAY,MAAM,OAAO,OAAO;AAAA,IACpC;AAAA,IACA;AAAA,IACA,EAAE,MAAM,SAAS,YAAY,QAAQ;AAAA,IACrC;AAAA,IACA,CAAC,QAAQ;AAAA,EACX;AAEA,QAAM,MAAO,IAAsC,OAAO,OAAO,WAAW;AAC5E,SAAO,aAAa,YAAY,EAAE,YAAY,UAAU,GAAG,GAAG;AAChE;;;ACXA,SAAS,UAAU,YAA4B;AAC7C,QAAM,QAAQ,OAAO,gBAAgB,IAAI,WAAW,UAAU,CAAC;AAC/D,SAAO,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAC1E;AAEA,SAAS,UAAU,QAA6B;AAC9C,QAAM,QAAQ,IAAI,WAAW,MAAM;AACnC,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EACxC;AACA,SAAO,KAAK,MAAM,EACf,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AACtB;AAEO,IAAM,mBAAN,MAAuB;AAAA,EACnB;AAAA,EACA;AAAA,EAEQ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACT;AAAA,EAER,YAAY,SAAkC;AAC5C,SAAK,MAAM,QAAQ;AACnB,SAAK,SAAS,QAAQ,SAAS,QAAQ,OAAO,MAAM,GAAG,IAAI,CAAC;AAC5D,SAAK,UAAU,QAAQ;AACvB,SAAK,cAAc,QAAQ;AAC3B,SAAK,YAAY,QAAQ;AACzB,SAAK,cAAc,QAAQ,YAAY,QAAQ,QAAQ,EAAE;AACzD,SAAK,UAAU,QAAQ;AACvB,SAAK,UAAU,QAAQ;AACvB,SAAK,UAAU,QAAQ;AACvB,SAAK,SAAS,QAAQ,UAAU,CAAC,OAA0B,SAAuB,MAAM,OAAO,IAAI;AACnG,SAAK,aAAa,QAAQ;AAAA,EAC5B;AAAA,EAEA,IAAI,MAAc;AAChB,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,eAA0B;AACxB,WAAO;AAAA,MACL,OAAO,KAAK;AAAA,MACZ,KAAK,KAAK;AAAA,MACV,KAAK,KAAK;AAAA,MACV,KAAK,KAAK;AAAA,IACZ;AAAA,EACF;AAAA,EAEA,MAAM,UAAyB;AAC7B,QAAI,KAAK,YAAY;AACnB,YAAM,KAAK,WAAW;AAAA,IACxB;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,KAAa,MAAsC;AACpE,UAAM,UAAU,gBAAgB,KAAK,GAAG,IACpC,MACA,GAAG,KAAK,WAAW,GAAG,GAAG;AAC7B,UAAM,UAAU,KAAK,UAAU,OAAO,YAAY;AAClD,UAAM,MAAM,QAAQ,MAAM,GAAG,EAAE,CAAC;AAEhC,UAAM,gBAAgB,YAA+B;AACnD,YAAM,YAAY,MAAM,OAAO,OAAO;AAAA,QACpC;AAAA,QACA,IAAI,YAAY,EAAE,OAAO,KAAK,WAAW;AAAA,MAC3C;AACA,YAAM,MAAM,UAAU,SAAS;AAE/B,YAAM,QAAQ,MAAM,KAAK,QAAQ;AAAA,QAC/B;AAAA,UACE,KAAK;AAAA,UACL,KAAK;AAAA,UACL,KAAK,KAAK,QAAQ;AAAA,QACpB;AAAA,QACA;AAAA,UACE,KAAK;AAAA,UACL;AAAA,UACA,KAAK,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAAA,UACjC,KAAK,UAAU,EAAE;AAAA,UACjB;AAAA,UACA,OAAO,KAAK;AAAA,QACd;AAAA,MACF;AAEA,YAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;AACxC,cAAQ,IAAI,iBAAiB,QAAQ,KAAK,WAAW,EAAE;AACvD,cAAQ,IAAI,QAAQ,KAAK;AACzB,cAAQ,IAAI,gBAAgB,KAAK,SAAS;AAE1C,aAAO,KAAK,OAAO,SAAS,EAAE,GAAG,MAAM,QAAQ,CAAC;AAAA,IAClD;AAEA,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,cAAc;AAAA,IACjC,SAAS,GAAG;AACV,YAAM,OAAO,gBAAgB,OAAO,KAAK,MAAM,eAAe,OAAO,KAAK,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC,UAAU,OAAO;AAChH,YAAM,IAAI,MAAM,wBAAyB,EAAY,OAAO;AAAA;AAAA,SAAc,IAAI,EAAE;AAAA,IAClF;AAGA,UAAM,QAAQ,SAAS,QAAQ,IAAI,YAAY;AAC/C,QAAI,SAAS,UAAU,KAAK,cAAc,SAAS,WAAW,OAAO,SAAS,WAAW,MAAM;AAC7F,WAAK,YAAY;AACjB,UAAI;AACF,mBAAW,MAAM,cAAc;AAAA,MACjC,SAAS,GAAG;AACV,cAAM,IAAI,MAAM,8BAA+B,EAAY,OAAO,EAAE;AAAA,MACtE;AACA,YAAM,aAAa,SAAS,QAAQ,IAAI,YAAY;AACpD,UAAI,YAAY;AACd,aAAK,YAAY;AAAA,MACnB;AAAA,IACF,WAAW,OAAO;AAChB,WAAK,YAAY;AAAA,IACnB;AAEA,WAAO;AAAA,EACT;AACF;;;AChJO,IAAM,gBAAN,MAA8C;AAAA,EAC3C,OAAO,oBAAI,IAAoB;AAAA,EAEvC,MAAM,IAAI,KAAqC;AAC7C,WAAO,KAAK,KAAK,IAAI,GAAG,KAAK;AAAA,EAC/B;AAAA,EAEA,MAAM,IAAI,KAAa,OAA8B;AACnD,SAAK,KAAK,IAAI,KAAK,KAAK;AAAA,EAC1B;AAAA,EAEA,MAAM,OAAO,KAA4B;AACvC,SAAK,KAAK,OAAO,GAAG;AAAA,EACtB;AACF;;;ACAA,IAAM,iBAAiB;AAChB,IAAM,kBAAkB;AAQxB,IAAM,uBAAN,MAA2B;AAAA,EAChC,aAAa,cAAc;AAAA,IACzB;AAAA,IACA,OAAO,UAAU,WAAW;AAAA,IAC5B;AAAA,EACF,GAA2D;AACzD,YAAQ,eAAe;AACvB,UAAM,OAAO,MAAM,QAAQ,UAAU,EAAE,UAAU,SAAS,OAAO,CAAC;AAClE,QAAI,KAAK,WAAW,KAAK;AACvB,WAAK,MAAM,SAAS;AACpB,YAAM,IAAI,MAAM,oCAAoC,KAAK,MAAM,EAAE;AAAA,IACnE;AACA,UAAM,OAAO,KAAK,QAAQ,IAAI,cAAc,GAAG,MAAM,GAAG,EAAE,CAAC,EAAE,KAAK;AAClE,QAAI,SAAS,oBAAoB;AAC/B,WAAK,MAAM,SAAS;AACpB,YAAM,IAAI,MAAM,yCAAyC,IAAI,EAAE;AAAA,IACjE;AACA,WAAO,KAAK,KAAK;AAAA,EACnB;AAAA,EAEmB;AAAA,EACA;AAAA,EACA;AAAA,EACF;AAAA,EACE;AAAA,EACF;AAAA,EAEjB,YACE,SAGA;AACA,SAAK,cAAc,QAAQ,YAAY,QAAQ,QAAQ,EAAE;AACzD,SAAK,YAAY,QAAQ;AACzB,SAAK,eAAe,QAAQ;AAC5B,SAAK,UAAU,QAAQ,WAAW,IAAI,cAAc;AACpD,SAAK,SAAS,QAAQ,UAAU,CAAC,OAA0B,SAAuB,MAAM,OAAO,IAAI;AACnG,SAAK,eAAe,QAAQ,gBAAgB,CAAC;AAAA,EAC/C;AAAA,EAEA,IAAI,iBAA0B;AAC5B,WAAO,KAAK,iBAAiB;AAAA,EAC/B;AAAA,EAEA,MAAM,mBAKH;AACD,UAAM,UAAkC;AAAA,MACtC,gBAAgB;AAAA,MAChB,gBAAgB,KAAK;AAAA,IACvB;AACA,QAAI,KAAK,cAAc;AACrB,cAAQ,iBAAiB,IAAI,KAAK;AAAA,IACpC;AAEA,UAAM,OAAgC,CAAC;AACvC,QAAI;AAEJ,QAAI,CAAC,KAAK,gBAAgB;AACxB,qBAAe,qBAAqB;AACpC,YAAM,YAAY,MAAM,qBAAqB,YAAY;AACzD,WAAK,iBAAiB;AAAA,IACxB;AAEA,UAAM,OAAO,MAAM,KAAK,OAAO,GAAG,KAAK,WAAW,oBAAoB;AAAA,MACpE,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAED,QAAI,CAAC,KAAK,IAAI;AACZ,YAAMA,QAAO,MAAM,KAAK,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,YAAM,IAAI;AAAA,QACR,iCAAiC,KAAK,MAAM,IAAKA,MAAa,SAAUA,MAAa,WAAW,KAAK,UAAU;AAAA,QAC/G,KAAK;AAAA,QACLA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,OAA6B,MAAM,KAAK,KAAK;AACnD,UAAM,UAAU,MAAM,UAAU,KAAK,QAAQ;AAC7C,WAAO;AAAA,MACL,aAAa,KAAK;AAAA,MAClB;AAAA,MACA,QAAQ,KAAK;AAAA,MACb;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,gBACJ,QAC2B;AAC3B,UAAM,UAAkC;AAAA,MACtC,gBAAgB;AAAA,MAChB,gBAAgB,KAAK;AAAA,IACvB;AACA,QAAI,KAAK,cAAc;AACrB,cAAQ,iBAAiB,IAAI,KAAK;AAAA,IACpC;AAEA,UAAM,OAAgC;AAAA,MACpC,cAAc,OAAO;AAAA,MACrB,KAAK,OAAO;AAAA,MACZ,cAAc,OAAO;AAAA,MACrB,eAAe,OAAO;AAAA,MACtB,QAAQ,OAAO;AAAA,MACf,SAAS,OAAO;AAAA,MAChB,QAAQ,OAAO;AAAA,IACjB;AAEA,QAAI,CAAC,KAAK,kBAAkB,OAAO,cAAc;AAC/C,WAAK,gBAAgB,OAAO;AAAA,IAC9B;AAEA,UAAM,OAAO,MAAM,KAAK,OAAO,GAAG,KAAK,WAAW,mBAAmB;AAAA,MACnE,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAED,QAAI,CAAC,KAAK,IAAI;AACZ,YAAMA,QAAO,MAAM,KAAK,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,YAAM,IAAI;AAAA,QACR,+BAA+B,KAAK,MAAM,IAAKA,MAAa,SAAUA,MAAa,WAAW,KAAK,UAAU;AAAA,QAC7G,KAAK;AAAA,QACLA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,OAAgC,MAAM,KAAK,KAAK;AACtD,UAAM,UAAU,MAAM,UAAU,OAAO,OAAO;AAE9C,UAAM,gBAA+B;AAAA,MACnC,KAAK,KAAK;AAAA,MACV,SAAS,OAAO;AAAA,MAChB,aAAa,OAAO;AAAA,MACpB,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,MAClB,QAAQ,OAAO;AAAA,MACf,QAAQ,OAAO;AAAA,MACf,QAAQ,OAAO;AAAA,IACjB;AACA,UAAM,KAAK,QAAQ;AAAA,MACjB,GAAG,cAAc,GAAG,KAAK,GAAG;AAAA,MAC5B,KAAK,UAAU,aAAa;AAAA,IAC9B;AACA,UAAM,KAAK,QAAQ,IAAI,iBAAiB,KAAK,GAAG;AAEhD,UAAM,UAAU,IAAI,iBAAiB;AAAA,MACnC,KAAK,KAAK;AAAA,MACV;AAAA,MACA,aAAa,OAAO;AAAA,MACpB,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,MAClB,QAAQ,OAAO;AAAA,MACf,QAAQ,OAAO;AAAA,MACf,QAAQ,OAAO;AAAA,MACf,OAAO,KAAK;AAAA,MACZ,WAAW,MAAM,KAAK,cAAc,KAAK,GAAG;AAAA,IAC9C,CAAC;AAED,SAAK,aAAa,kBAAkB,KAAK,GAAG;AAE5C,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,cAAc,KAA4B;AAC9C,UAAM,UAAU,MAAM,KAAK,eAAe,GAAG;AAC7C,QAAI,SAAS;AACX,YAAM,OAAO,MAAM,QAAQ;AAAA,QACzB,GAAG,KAAK,WAAW,mBAAmB,GAAG;AAAA,QACzC,EAAE,QAAQ,SAAS;AAAA,MACrB;AAEA,UAAI,CAAC,KAAK,MAAM,KAAK,WAAW,KAAK;AACnC,cAAM,OAAO,MAAM,KAAK,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,cAAM,IAAI;AAAA,UACR,6BAA6B,KAAK,MAAM,IAAK,KAAa,SAAU,KAAa,WAAW,KAAK,UAAU;AAAA,UAC3G,KAAK;AAAA,UACL;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,KAAK,QAAQ,OAAO,GAAG,cAAc,GAAG,GAAG,EAAE;AAEnD,UAAM,aAAa,MAAM,KAAK,QAAQ,IAAI,eAAe;AACzD,QAAI,eAAe,KAAK;AACtB,YAAM,KAAK,QAAQ,OAAO,eAAe;AAAA,IAC3C;AAEA,SAAK,aAAa,kBAAkB,GAAG;AAAA,EACzC;AAAA,EAEA,MAAM,eAAe,KAA+C;AAClE,UAAM,SAAS,MAAM,KAAK,QAAQ,IAAI,GAAG,cAAc,GAAG,GAAG,EAAE;AAC/D,QAAI,CAAC,OAAQ,QAAO;AAEpB,UAAM,OAAsB,KAAK,MAAM,MAAM;AAC7C,UAAM,UAAU,MAAM,UAAU,KAAK,OAAO;AAC5C,WAAO,IAAI,iBAAiB;AAAA,MAC1B,KAAK,KAAK;AAAA,MACV;AAAA,MACA,aAAa,KAAK;AAAA,MAClB,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,MAClB,QAAQ,KAAK;AAAA,MACb,QAAQ,KAAK;AAAA,MACb,QAAQ,KAAK;AAAA,MACb,OAAO,KAAK;AAAA,MACZ,WAAW,MAAM,KAAK,cAAc,KAAK,GAAG;AAAA,IAC9C,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,WAAW,KAA0C;AACzD,UAAM,UAAU,MAAM,KAAK,eAAe,GAAG;AAC7C,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,SAAS,kCAAkC,KAAK,CAAC,CAAC;AAAA,IAC9D;AAEA,UAAM,OAAO,MAAM,QAAQ;AAAA,MACzB,GAAG,KAAK,WAAW,mBAAmB,GAAG;AAAA,MACzC,EAAE,QAAQ,MAAM;AAAA,IAClB;AAEA,QAAI,CAAC,KAAK,IAAI;AACZ,YAAM,OAAO,MAAM,KAAK,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,YAAM,IAAI;AAAA,QACR,0BAA0B,KAAK,MAAM,IAAK,KAAa,SAAU,KAAa,WAAW,KAAK,UAAU;AAAA,QACxG,KAAK;AAAA,QACL;AAAA,MACF;AAAA,IACF;AAEA,WAAO,KAAK,KAAK;AAAA,EACnB;AAAA,EAEA,MAAM,UAA4C;AAChD,UAAM,MAAM,MAAM,KAAK,QAAQ,IAAI,eAAe;AAClD,QAAI,CAAC,IAAK,QAAO;AACjB,WAAO,KAAK,eAAe,GAAG;AAAA,EAChC;AACF;AAGA,SAAS,uBAA+B;AACtC,QAAM,QAAQ,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AACvD,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EACxC;AACA,SAAO,KAAK,MAAM,EACf,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AACtB;AAEA,eAAe,qBAAqB,UAAmC;AACrE,QAAM,OAAO,MAAM,OAAO,OAAO;AAAA,IAC/B;AAAA,IACA,IAAI,YAAY,EAAE,OAAO,QAAQ;AAAA,EACnC;AACA,QAAM,QAAQ,IAAI,WAAW,IAAI;AACjC,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EACxC;AACA,SAAO,KAAK,MAAM,EACf,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AACtB;","names":["body"]}
+{"version":3,"sources":["../src/index.ts","../src/errors.ts","../src/import-jwk.ts","../src/session.ts","../src/storage.ts","../src/client.ts"],"sourcesContent":["export * from \"@atproto/jwk\";\nexport * from \"@atproto/jwk-webcrypto\";\n\nexport {\n  HappyViewOAuthClient,\n  LAST_ACTIVE_KEY,\n  STORAGE_PREFIX,\n} from \"./client\";\nexport type { FetchMetadataOptions } from \"./client\";\nexport { importJwk } from \"./import-jwk\";\nexport {\n  ApiError,\n  AuthenticationError,\n  HappyViewError,\n  InvalidStateError,\n  OAuthCallbackError,\n  ResolutionError,\n  TokenExchangeError,\n} from \"./errors\";\nexport { HappyViewSession } from \"./session\";\nexport type { HappyViewSessionOptions } from \"./session\";\nexport { MemoryStorage } from \"./storage\";\nexport type {\n  DpopProvision,\n  GetSessionResponse,\n  HappyViewOAuthClientOptions,\n  ProvisionKeyResponse,\n  RegisterSessionParams,\n  RegisterSessionResponse,\n  SessionEventHooks,\n  StorageAdapter,\n  StoredSession,\n  TokenInfo,\n} from \"./types\";\n","export class HappyViewError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"HappyViewError\";\n  }\n}\n\nexport class ApiError extends HappyViewError {\n  readonly status: number;\n  readonly body: unknown;\n\n  constructor(message: string, status: number, body?: unknown) {\n    super(message);\n    this.name = \"ApiError\";\n    this.status = status;\n    this.body = body;\n  }\n}\n\nexport class AuthenticationError extends HappyViewError {\n  readonly status: number;\n\n  constructor(message: string, status: number = 401) {\n    super(message);\n    this.name = \"AuthenticationError\";\n    this.status = status;\n  }\n}\n\nexport class InvalidStateError extends HappyViewError {\n  constructor(message: string) {\n    super(message);\n    this.name = \"InvalidStateError\";\n  }\n}\n\nexport class TokenExchangeError extends HappyViewError {\n  readonly status: number;\n  readonly body: string;\n\n  constructor(message: string, status: number, body: string) {\n    super(message);\n    this.name = \"TokenExchangeError\";\n    this.status = status;\n    this.body = body;\n  }\n}\n\nexport class ResolutionError extends HappyViewError {\n  constructor(message: string) {\n    super(message);\n    this.name = \"ResolutionError\";\n  }\n}\n\nexport class OAuthCallbackError extends HappyViewError {\n  readonly params: URLSearchParams;\n  readonly state: string | undefined;\n\n  static from(\n    err: unknown,\n    params: URLSearchParams,\n    state?: string,\n  ): OAuthCallbackError {\n    if (err instanceof OAuthCallbackError) return err;\n    const message = err instanceof Error ? err.message : undefined;\n    return new OAuthCallbackError(params, message, state, err);\n  }\n\n  constructor(\n    params: URLSearchParams,\n    message?: string,\n    state?: string,\n    cause?: unknown,\n  ) {\n    super(\n      message ??\n        params.get(\"error_description\") ??\n        \"OAuth callback error\",\n    );\n    this.name = \"OAuthCallbackError\";\n    this.params = params;\n    this.state = state;\n    if (cause !== undefined) {\n      this.cause = cause;\n    }\n  }\n}\n","import { WebcryptoKey } from \"@atproto/jwk-webcrypto\";\n\n/**\n * Import a raw ES256 JWK (as returned by HappyView's /oauth/dpop-keys)\n * into a WebcryptoKey that can sign JWTs.\n */\nexport async function importJwk(jwk: JsonWebKey): Promise<WebcryptoKey> {\n  const privateKey = await crypto.subtle.importKey(\n    \"jwk\",\n    jwk,\n    { name: \"ECDSA\", namedCurve: \"P-256\" },\n    true,\n    [\"sign\"],\n  );\n\n  // Derive public key by stripping the private component\n  const { d: _, ...publicJwkFields } = jwk;\n  const publicKey = await crypto.subtle.importKey(\n    \"jwk\",\n    publicJwkFields,\n    { name: \"ECDSA\", namedCurve: \"P-256\" },\n    true,\n    [\"verify\"],\n  );\n\n  const kid = (jwk as JsonWebKey & { kid?: string }).kid ?? crypto.randomUUID();\n  return WebcryptoKey.fromKeypair({ privateKey, publicKey }, kid);\n}\n","import type { Key } from \"@atproto/jwk\";\nimport type { TokenInfo } from \"./types\";\n\nexport interface HappyViewSessionOptions {\n  did: string;\n  dpopKey: Key;\n  accessToken: string;\n  clientKey: string;\n  instanceUrl: string;\n  scopes?: string;\n  pdsUrl?: string;\n  issuer?: string;\n  fetch?: typeof globalThis.fetch;\n  onSignOut?: () => Promise<void>;\n}\n\nfunction randomHex(byteLength: number): string {\n  const bytes = crypto.getRandomValues(new Uint8Array(byteLength));\n  return Array.from(bytes, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction base64url(buffer: ArrayBuffer): string {\n  const bytes = new Uint8Array(buffer);\n  let binary = \"\";\n  for (let i = 0; i < bytes.length; i++) {\n    binary += String.fromCharCode(bytes[i]);\n  }\n  return btoa(binary)\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/, \"\");\n}\n\nexport class HappyViewSession {\n  readonly did: string;\n  readonly scopes: string[];\n\n  private readonly dpopKey: Key;\n  private readonly accessToken: string;\n  private readonly clientKey: string;\n  private readonly instanceUrl: string;\n  private readonly _scopes: string | undefined;\n  private readonly _pdsUrl: string | undefined;\n  private readonly _issuer: string | undefined;\n  private readonly _fetch: typeof globalThis.fetch;\n  private readonly _onSignOut: (() => Promise<void>) | undefined;\n  private dpopNonce: string | undefined;\n\n  constructor(options: HappyViewSessionOptions) {\n    this.did = options.did;\n    this.scopes = options.scopes ? options.scopes.split(\" \") : [];\n    this.dpopKey = options.dpopKey;\n    this.accessToken = options.accessToken;\n    this.clientKey = options.clientKey;\n    this.instanceUrl = options.instanceUrl.replace(/\\/+$/, \"\");\n    this._scopes = options.scopes;\n    this._pdsUrl = options.pdsUrl;\n    this._issuer = options.issuer;\n    this._fetch = options.fetch ?? ((input: RequestInfo | URL, init?: RequestInit) => fetch(input, init)) as typeof globalThis.fetch;\n    this._onSignOut = options.onSignOut;\n  }\n\n  get sub(): string {\n    return this.did;\n  }\n\n  getTokenInfo(): TokenInfo {\n    return {\n      scope: this._scopes,\n      iss: this._issuer,\n      aud: this._pdsUrl,\n      sub: this.did,\n    };\n  }\n\n  async signOut(): Promise<void> {\n    if (this._onSignOut) {\n      await this._onSignOut();\n    }\n  }\n\n  async fetchHandler(url: string, init: RequestInit): Promise<Response> {\n    const fullUrl = /^https?:\\/\\//i.test(url)\n      ? url\n      : `${this.instanceUrl}${url}`;\n    const method = (init.method ?? \"GET\").toUpperCase();\n    const htu = fullUrl.split(\"?\")[0];\n\n    const sendWithProof = async (): Promise<Response> => {\n      const tokenHash = await crypto.subtle.digest(\n        \"SHA-256\",\n        new TextEncoder().encode(this.accessToken),\n      );\n      const ath = base64url(tokenHash);\n\n      const proof = await this.dpopKey.createJwt(\n        {\n          alg: \"ES256\",\n          typ: \"dpop+jwt\",\n          jwk: this.dpopKey.publicJwk!,\n        },\n        {\n          htm: method,\n          htu,\n          iat: Math.floor(Date.now() / 1000),\n          jti: randomHex(16),\n          ath,\n          nonce: this.dpopNonce,\n        },\n      );\n\n      const headers = new Headers(init.headers);\n      headers.set(\"authorization\", `DPoP ${this.accessToken}`);\n      headers.set(\"dpop\", proof);\n      headers.set(\"x-client-key\", this.clientKey);\n\n      return this._fetch(fullUrl, { ...init, headers });\n    };\n\n    let response: Response;\n    try {\n      response = await sendWithProof();\n    } catch (e) {\n      const info = `_fetch type: ${typeof this._fetch}, toString: ${String(this._fetch).slice(0, 120)}, url: ${fullUrl}`;\n      throw new Error(`fetchHandler failed: ${(e as Error).message}\\n\\nDEBUG: ${info}`);\n    }\n\n    // Retry once if the server requires a DPoP nonce we didn't have\n    const nonce = response.headers.get(\"dpop-nonce\");\n    if (nonce && nonce !== this.dpopNonce && (response.status === 401 || response.status === 400)) {\n      this.dpopNonce = nonce;\n      try {\n        response = await sendWithProof();\n      } catch (e) {\n        throw new Error(`fetchHandler retry failed: ${(e as Error).message}`);\n      }\n      const retryNonce = response.headers.get(\"dpop-nonce\");\n      if (retryNonce) {\n        this.dpopNonce = retryNonce;\n      }\n    } else if (nonce) {\n      this.dpopNonce = nonce;\n    }\n\n    return response;\n  }\n}\n","import type { StorageAdapter } from \"./types\";\n\nexport class MemoryStorage implements StorageAdapter {\n  private data = new Map<string, string>();\n\n  async get(key: string): Promise<string | null> {\n    return this.data.get(key) ?? null;\n  }\n\n  async set(key: string, value: string): Promise<void> {\n    this.data.set(key, value);\n  }\n\n  async delete(key: string): Promise<void> {\n    this.data.delete(key);\n  }\n}\n","import type { Key } from \"@atproto/jwk\";\nimport { ApiError } from \"./errors\";\nimport { importJwk } from \"./import-jwk\";\nimport { HappyViewSession } from \"./session\";\nimport { MemoryStorage } from \"./storage\";\nimport type {\n  GetSessionResponse,\n  HappyViewOAuthClientOptions,\n  ProvisionKeyResponse,\n  RegisterSessionParams,\n  RegisterSessionResponse,\n  SessionEventHooks,\n  StorageAdapter,\n  StoredSession,\n} from \"./types\";\n\n/// The storage keys this client reads and writes. Exported because a consumer\n/// recovering a wedged session by hand would otherwise have to hardcode them,\n/// which silently breaks the day they are renamed.\nexport const STORAGE_PREFIX = \"happyview:session:\";\nexport const LAST_ACTIVE_KEY = \"happyview:last-active-did\";\n\nexport interface FetchMetadataOptions {\n  clientId: string;\n  fetch?: typeof globalThis.fetch;\n  signal?: AbortSignal;\n}\n\nexport class HappyViewOAuthClient {\n  static async fetchMetadata({\n    clientId,\n    fetch: fetchFn = globalThis.fetch,\n    signal,\n  }: FetchMetadataOptions): Promise<Record<string, unknown>> {\n    signal?.throwIfAborted();\n    const resp = await fetchFn(clientId, { redirect: \"error\", signal });\n    if (resp.status !== 200) {\n      resp.body?.cancel?.();\n      throw new Error(`Failed to fetch client metadata: ${resp.status}`);\n    }\n    const mime = resp.headers.get(\"content-type\")?.split(\";\")[0].trim();\n    if (mime !== \"application/json\") {\n      resp.body?.cancel?.();\n      throw new Error(`Invalid client metadata content type: ${mime}`);\n    }\n    return resp.json() as Promise<Record<string, unknown>>;\n  }\n\n  protected readonly instanceUrl: string;\n  protected readonly clientKey: string;\n  protected readonly storage: StorageAdapter;\n  private readonly clientSecret: string | undefined;\n  protected readonly _fetch: typeof globalThis.fetch;\n  private readonly sessionHooks: SessionEventHooks;\n\n  constructor(\n    options: HappyViewOAuthClientOptions & {\n      fetch?: typeof globalThis.fetch;\n    },\n  ) {\n    this.instanceUrl = options.instanceUrl.replace(/\\/+$/, \"\");\n    this.clientKey = options.clientKey;\n    this.clientSecret = options.clientSecret;\n    this.storage = options.storage ?? new MemoryStorage();\n    this._fetch = options.fetch ?? ((input: RequestInfo | URL, init?: RequestInit) => fetch(input, init)) as typeof globalThis.fetch;\n    this.sessionHooks = options.sessionHooks ?? {};\n  }\n\n  get isConfidential(): boolean {\n    return this.clientSecret !== undefined;\n  }\n\n  async provisionDpopKey(): Promise<{\n    provisionId: string;\n    dpopKey: Key;\n    rawJwk: JsonWebKey;\n    pkceVerifier?: string;\n  }> {\n    const headers: Record<string, string> = {\n      \"content-type\": \"application/json\",\n      \"x-client-key\": this.clientKey,\n    };\n    if (this.clientSecret) {\n      headers[\"x-client-secret\"] = this.clientSecret;\n    }\n\n    const body: Record<string, unknown> = {};\n    let pkceVerifier: string | undefined;\n\n    if (!this.isConfidential) {\n      pkceVerifier = generatePkceVerifier();\n      const challenge = await computePkceChallenge(pkceVerifier);\n      body.pkce_challenge = challenge;\n    }\n\n    const resp = await this._fetch(`${this.instanceUrl}/oauth/dpop-keys`, {\n      method: \"POST\",\n      headers,\n      body: JSON.stringify(body),\n    });\n\n    if (!resp.ok) {\n      const body = await resp.json().catch(() => ({}));\n      throw new ApiError(\n        `Failed to provision DPoP key: ${resp.status} ${(body as any).error ?? (body as any).message ?? resp.statusText}`,\n        resp.status,\n        body,\n      );\n    }\n\n    const data: ProvisionKeyResponse = await resp.json();\n    const dpopKey = await importJwk(data.dpop_key);\n    return {\n      provisionId: data.provision_id,\n      dpopKey,\n      rawJwk: data.dpop_key,\n      pkceVerifier,\n    };\n  }\n\n  async registerSession(\n    params: RegisterSessionParams,\n  ): Promise<HappyViewSession> {\n    const headers: Record<string, string> = {\n      \"content-type\": \"application/json\",\n      \"x-client-key\": this.clientKey,\n    };\n    if (this.clientSecret) {\n      headers[\"x-client-secret\"] = this.clientSecret;\n    }\n\n    const body: Record<string, unknown> = {\n      provision_id: params.provisionId,\n      did: params.did,\n      access_token: params.accessToken,\n      refresh_token: params.refreshToken,\n      scopes: params.scopes,\n      pds_url: params.pdsUrl,\n      issuer: params.issuer,\n    };\n\n    if (!this.isConfidential && params.pkceVerifier) {\n      body.pkce_verifier = params.pkceVerifier;\n    }\n\n    const resp = await this._fetch(`${this.instanceUrl}/oauth/sessions`, {\n      method: \"POST\",\n      headers,\n      body: JSON.stringify(body),\n    });\n\n    if (!resp.ok) {\n      const body = await resp.json().catch(() => ({}));\n      throw new ApiError(\n        `Failed to register session: ${resp.status} ${(body as any).error ?? (body as any).message ?? resp.statusText}`,\n        resp.status,\n        body,\n      );\n    }\n\n    const data: RegisterSessionResponse = await resp.json();\n    const dpopKey = await importJwk(params.dpopKey);\n\n    const storedSession: StoredSession = {\n      did: data.did,\n      dpopKey: params.dpopKey,\n      accessToken: params.accessToken,\n      clientKey: this.clientKey,\n      instanceUrl: this.instanceUrl,\n      scopes: params.scopes,\n      pdsUrl: params.pdsUrl,\n      issuer: params.issuer,\n    };\n    await this.storage.set(\n      `${STORAGE_PREFIX}${data.did}`,\n      JSON.stringify(storedSession),\n    );\n    await this.storage.set(LAST_ACTIVE_KEY, data.did);\n\n    const session = new HappyViewSession({\n      did: data.did,\n      dpopKey,\n      accessToken: params.accessToken,\n      clientKey: this.clientKey,\n      instanceUrl: this.instanceUrl,\n      scopes: params.scopes,\n      pdsUrl: params.pdsUrl,\n      issuer: params.issuer,\n      fetch: this._fetch,\n      onSignOut: () => this.deleteSession(data.did),\n    });\n\n    this.sessionHooks.onSessionUpdate?.(data.did);\n\n    return session;\n  }\n\n  /**\n   * Revoke the session server-side and clear it locally.\n   *\n   * The local cleanup runs unconditionally. If it did not, a server that\n   * refuses the revocation would leave the session in storage, `restore()`\n   * would sign the user back in on the next load, and the next logout would\n   * fail identically — a loop with no exit through this API.\n   */\n  async deleteSession(did: string): Promise<void> {\n    try {\n      const session = await this.restoreSession(did);\n      if (session) {\n        const resp = await session.fetchHandler(\n          `${this.instanceUrl}/oauth/sessions/${did}`,\n          { method: \"DELETE\" },\n        );\n\n        // 404: already gone. 401/403: the credential is itself invalid, so\n        // there is no live session left to revoke. None of these is a logout\n        // that failed, so none of them should be reported as one.\n        const alreadyUnusable =\n          resp.status === 404 || resp.status === 401 || resp.status === 403;\n\n        if (!resp.ok && !alreadyUnusable) {\n          const body = await resp.json().catch(() => ({}));\n          throw new ApiError(\n            `Failed to delete session: ${resp.status} ${(body as any).error ?? (body as any).message ?? resp.statusText}`,\n            resp.status,\n            body,\n          );\n        }\n      }\n    } finally {\n      // 5xx and network errors still throw — the server may genuinely still\n      // hold a live session and the caller deserves to know. They throw from\n      // here, after the local state is gone, so the user is logged out either\n      // way.\n      await this.forgetSession(did);\n    }\n  }\n\n  /**\n   * Clear a session locally without contacting the server.\n   *\n   * The escape hatch for a session that cannot be revoked remotely — a revoked\n   * or expired credential, an unreachable instance. Nothing is revoked, so the\n   * server may still consider the session live until it expires.\n   */\n  async forgetSession(did: string): Promise<void> {\n    await this.storage.delete(`${STORAGE_PREFIX}${did}`);\n\n    const lastActive = await this.storage.get(LAST_ACTIVE_KEY);\n    if (lastActive === did) {\n      await this.storage.delete(LAST_ACTIVE_KEY);\n    }\n\n    this.sessionHooks.onSessionDelete?.(did);\n  }\n\n  async restoreSession(did: string): Promise<HappyViewSession | null> {\n    const stored = await this.storage.get(`${STORAGE_PREFIX}${did}`);\n    if (!stored) return null;\n\n    const data: StoredSession = JSON.parse(stored);\n    const dpopKey = await importJwk(data.dpopKey);\n    return new HappyViewSession({\n      did: data.did,\n      dpopKey,\n      accessToken: data.accessToken,\n      clientKey: data.clientKey,\n      instanceUrl: data.instanceUrl,\n      scopes: data.scopes,\n      pdsUrl: data.pdsUrl,\n      issuer: data.issuer,\n      fetch: this._fetch,\n      onSignOut: () => this.deleteSession(data.did),\n    });\n  }\n\n  async getSession(did: string): Promise<GetSessionResponse> {\n    const session = await this.restoreSession(did);\n    if (!session) {\n      throw new ApiError(\"No stored session for this DID\", 404, {});\n    }\n\n    const resp = await session.fetchHandler(\n      `${this.instanceUrl}/oauth/sessions/${did}`,\n      { method: \"GET\" },\n    );\n\n    if (!resp.ok) {\n      const body = await resp.json().catch(() => ({}));\n      throw new ApiError(\n        `Failed to get session: ${resp.status} ${(body as any).error ?? (body as any).message ?? resp.statusText}`,\n        resp.status,\n        body,\n      );\n    }\n\n    return resp.json();\n  }\n\n  async restore(): Promise<HappyViewSession | null> {\n    const did = await this.storage.get(LAST_ACTIVE_KEY);\n    if (!did) return null;\n    return this.restoreSession(did);\n  }\n}\n\n// PKCE helpers — inline since they're just a few lines of Web Crypto\nfunction generatePkceVerifier(): string {\n  const bytes = crypto.getRandomValues(new Uint8Array(32));\n  let binary = \"\";\n  for (let i = 0; i < bytes.length; i++) {\n    binary += String.fromCharCode(bytes[i]);\n  }\n  return btoa(binary)\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/, \"\");\n}\n\nasync function computePkceChallenge(verifier: string): Promise<string> {\n  const hash = await crypto.subtle.digest(\n    \"SHA-256\",\n    new TextEncoder().encode(verifier),\n  );\n  const bytes = new Uint8Array(hash);\n  let binary = \"\";\n  for (let i = 0; i < bytes.length; i++) {\n    binary += String.fromCharCode(bytes[i]);\n  }\n  return btoa(binary)\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/, \"\");\n}\n"],"mappings":";AAAA,cAAc;AACd,cAAc;;;ACDP,IAAM,iBAAN,cAA6B,MAAM;AAAA,EACxC,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,WAAN,cAAuB,eAAe;AAAA,EAClC;AAAA,EACA;AAAA,EAET,YAAY,SAAiB,QAAgB,MAAgB;AAC3D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,sBAAN,cAAkC,eAAe;AAAA,EAC7C;AAAA,EAET,YAAY,SAAiB,SAAiB,KAAK;AACjD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AACF;AAEO,IAAM,oBAAN,cAAgC,eAAe;AAAA,EACpD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,qBAAN,cAAiC,eAAe;AAAA,EAC5C;AAAA,EACA;AAAA,EAET,YAAY,SAAiB,QAAgB,MAAc;AACzD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,kBAAN,cAA8B,eAAe;AAAA,EAClD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,qBAAN,MAAM,4BAA2B,eAAe;AAAA,EAC5C;AAAA,EACA;AAAA,EAET,OAAO,KACL,KACA,QACA,OACoB;AACpB,QAAI,eAAe,oBAAoB,QAAO;AAC9C,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,WAAO,IAAI,oBAAmB,QAAQ,SAAS,OAAO,GAAG;AAAA,EAC3D;AAAA,EAEA,YACE,QACA,SACA,OACA,OACA;AACA;AAAA,MACE,WACE,OAAO,IAAI,mBAAmB,KAC9B;AAAA,IACJ;AACA,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,QAAQ;AACb,QAAI,UAAU,QAAW;AACvB,WAAK,QAAQ;AAAA,IACf;AAAA,EACF;AACF;;;ACvFA,SAAS,oBAAoB;AAM7B,eAAsB,UAAU,KAAwC;AACtE,QAAM,aAAa,MAAM,OAAO,OAAO;AAAA,IACrC;AAAA,IACA;AAAA,IACA,EAAE,MAAM,SAAS,YAAY,QAAQ;AAAA,IACrC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AAGA,QAAM,EAAE,GAAG,GAAG,GAAG,gBAAgB,IAAI;AACrC,QAAM,YAAY,MAAM,OAAO,OAAO;AAAA,IACpC;AAAA,IACA;AAAA,IACA,EAAE,MAAM,SAAS,YAAY,QAAQ;AAAA,IACrC;AAAA,IACA,CAAC,QAAQ;AAAA,EACX;AAEA,QAAM,MAAO,IAAsC,OAAO,OAAO,WAAW;AAC5E,SAAO,aAAa,YAAY,EAAE,YAAY,UAAU,GAAG,GAAG;AAChE;;;ACXA,SAAS,UAAU,YAA4B;AAC7C,QAAM,QAAQ,OAAO,gBAAgB,IAAI,WAAW,UAAU,CAAC;AAC/D,SAAO,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAC1E;AAEA,SAAS,UAAU,QAA6B;AAC9C,QAAM,QAAQ,IAAI,WAAW,MAAM;AACnC,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EACxC;AACA,SAAO,KAAK,MAAM,EACf,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AACtB;AAEO,IAAM,mBAAN,MAAuB;AAAA,EACnB;AAAA,EACA;AAAA,EAEQ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACT;AAAA,EAER,YAAY,SAAkC;AAC5C,SAAK,MAAM,QAAQ;AACnB,SAAK,SAAS,QAAQ,SAAS,QAAQ,OAAO,MAAM,GAAG,IAAI,CAAC;AAC5D,SAAK,UAAU,QAAQ;AACvB,SAAK,cAAc,QAAQ;AAC3B,SAAK,YAAY,QAAQ;AACzB,SAAK,cAAc,QAAQ,YAAY,QAAQ,QAAQ,EAAE;AACzD,SAAK,UAAU,QAAQ;AACvB,SAAK,UAAU,QAAQ;AACvB,SAAK,UAAU,QAAQ;AACvB,SAAK,SAAS,QAAQ,UAAU,CAAC,OAA0B,SAAuB,MAAM,OAAO,IAAI;AACnG,SAAK,aAAa,QAAQ;AAAA,EAC5B;AAAA,EAEA,IAAI,MAAc;AAChB,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,eAA0B;AACxB,WAAO;AAAA,MACL,OAAO,KAAK;AAAA,MACZ,KAAK,KAAK;AAAA,MACV,KAAK,KAAK;AAAA,MACV,KAAK,KAAK;AAAA,IACZ;AAAA,EACF;AAAA,EAEA,MAAM,UAAyB;AAC7B,QAAI,KAAK,YAAY;AACnB,YAAM,KAAK,WAAW;AAAA,IACxB;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,KAAa,MAAsC;AACpE,UAAM,UAAU,gBAAgB,KAAK,GAAG,IACpC,MACA,GAAG,KAAK,WAAW,GAAG,GAAG;AAC7B,UAAM,UAAU,KAAK,UAAU,OAAO,YAAY;AAClD,UAAM,MAAM,QAAQ,MAAM,GAAG,EAAE,CAAC;AAEhC,UAAM,gBAAgB,YAA+B;AACnD,YAAM,YAAY,MAAM,OAAO,OAAO;AAAA,QACpC;AAAA,QACA,IAAI,YAAY,EAAE,OAAO,KAAK,WAAW;AAAA,MAC3C;AACA,YAAM,MAAM,UAAU,SAAS;AAE/B,YAAM,QAAQ,MAAM,KAAK,QAAQ;AAAA,QAC/B;AAAA,UACE,KAAK;AAAA,UACL,KAAK;AAAA,UACL,KAAK,KAAK,QAAQ;AAAA,QACpB;AAAA,QACA;AAAA,UACE,KAAK;AAAA,UACL;AAAA,UACA,KAAK,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAAA,UACjC,KAAK,UAAU,EAAE;AAAA,UACjB;AAAA,UACA,OAAO,KAAK;AAAA,QACd;AAAA,MACF;AAEA,YAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;AACxC,cAAQ,IAAI,iBAAiB,QAAQ,KAAK,WAAW,EAAE;AACvD,cAAQ,IAAI,QAAQ,KAAK;AACzB,cAAQ,IAAI,gBAAgB,KAAK,SAAS;AAE1C,aAAO,KAAK,OAAO,SAAS,EAAE,GAAG,MAAM,QAAQ,CAAC;AAAA,IAClD;AAEA,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,cAAc;AAAA,IACjC,SAAS,GAAG;AACV,YAAM,OAAO,gBAAgB,OAAO,KAAK,MAAM,eAAe,OAAO,KAAK,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC,UAAU,OAAO;AAChH,YAAM,IAAI,MAAM,wBAAyB,EAAY,OAAO;AAAA;AAAA,SAAc,IAAI,EAAE;AAAA,IAClF;AAGA,UAAM,QAAQ,SAAS,QAAQ,IAAI,YAAY;AAC/C,QAAI,SAAS,UAAU,KAAK,cAAc,SAAS,WAAW,OAAO,SAAS,WAAW,MAAM;AAC7F,WAAK,YAAY;AACjB,UAAI;AACF,mBAAW,MAAM,cAAc;AAAA,MACjC,SAAS,GAAG;AACV,cAAM,IAAI,MAAM,8BAA+B,EAAY,OAAO,EAAE;AAAA,MACtE;AACA,YAAM,aAAa,SAAS,QAAQ,IAAI,YAAY;AACpD,UAAI,YAAY;AACd,aAAK,YAAY;AAAA,MACnB;AAAA,IACF,WAAW,OAAO;AAChB,WAAK,YAAY;AAAA,IACnB;AAEA,WAAO;AAAA,EACT;AACF;;;AChJO,IAAM,gBAAN,MAA8C;AAAA,EAC3C,OAAO,oBAAI,IAAoB;AAAA,EAEvC,MAAM,IAAI,KAAqC;AAC7C,WAAO,KAAK,KAAK,IAAI,GAAG,KAAK;AAAA,EAC/B;AAAA,EAEA,MAAM,IAAI,KAAa,OAA8B;AACnD,SAAK,KAAK,IAAI,KAAK,KAAK;AAAA,EAC1B;AAAA,EAEA,MAAM,OAAO,KAA4B;AACvC,SAAK,KAAK,OAAO,GAAG;AAAA,EACtB;AACF;;;ACGO,IAAM,iBAAiB;AACvB,IAAM,kBAAkB;AAQxB,IAAM,uBAAN,MAA2B;AAAA,EAChC,aAAa,cAAc;AAAA,IACzB;AAAA,IACA,OAAO,UAAU,WAAW;AAAA,IAC5B;AAAA,EACF,GAA2D;AACzD,YAAQ,eAAe;AACvB,UAAM,OAAO,MAAM,QAAQ,UAAU,EAAE,UAAU,SAAS,OAAO,CAAC;AAClE,QAAI,KAAK,WAAW,KAAK;AACvB,WAAK,MAAM,SAAS;AACpB,YAAM,IAAI,MAAM,oCAAoC,KAAK,MAAM,EAAE;AAAA,IACnE;AACA,UAAM,OAAO,KAAK,QAAQ,IAAI,cAAc,GAAG,MAAM,GAAG,EAAE,CAAC,EAAE,KAAK;AAClE,QAAI,SAAS,oBAAoB;AAC/B,WAAK,MAAM,SAAS;AACpB,YAAM,IAAI,MAAM,yCAAyC,IAAI,EAAE;AAAA,IACjE;AACA,WAAO,KAAK,KAAK;AAAA,EACnB;AAAA,EAEmB;AAAA,EACA;AAAA,EACA;AAAA,EACF;AAAA,EACE;AAAA,EACF;AAAA,EAEjB,YACE,SAGA;AACA,SAAK,cAAc,QAAQ,YAAY,QAAQ,QAAQ,EAAE;AACzD,SAAK,YAAY,QAAQ;AACzB,SAAK,eAAe,QAAQ;AAC5B,SAAK,UAAU,QAAQ,WAAW,IAAI,cAAc;AACpD,SAAK,SAAS,QAAQ,UAAU,CAAC,OAA0B,SAAuB,MAAM,OAAO,IAAI;AACnG,SAAK,eAAe,QAAQ,gBAAgB,CAAC;AAAA,EAC/C;AAAA,EAEA,IAAI,iBAA0B;AAC5B,WAAO,KAAK,iBAAiB;AAAA,EAC/B;AAAA,EAEA,MAAM,mBAKH;AACD,UAAM,UAAkC;AAAA,MACtC,gBAAgB;AAAA,MAChB,gBAAgB,KAAK;AAAA,IACvB;AACA,QAAI,KAAK,cAAc;AACrB,cAAQ,iBAAiB,IAAI,KAAK;AAAA,IACpC;AAEA,UAAM,OAAgC,CAAC;AACvC,QAAI;AAEJ,QAAI,CAAC,KAAK,gBAAgB;AACxB,qBAAe,qBAAqB;AACpC,YAAM,YAAY,MAAM,qBAAqB,YAAY;AACzD,WAAK,iBAAiB;AAAA,IACxB;AAEA,UAAM,OAAO,MAAM,KAAK,OAAO,GAAG,KAAK,WAAW,oBAAoB;AAAA,MACpE,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAED,QAAI,CAAC,KAAK,IAAI;AACZ,YAAMA,QAAO,MAAM,KAAK,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,YAAM,IAAI;AAAA,QACR,iCAAiC,KAAK,MAAM,IAAKA,MAAa,SAAUA,MAAa,WAAW,KAAK,UAAU;AAAA,QAC/G,KAAK;AAAA,QACLA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,OAA6B,MAAM,KAAK,KAAK;AACnD,UAAM,UAAU,MAAM,UAAU,KAAK,QAAQ;AAC7C,WAAO;AAAA,MACL,aAAa,KAAK;AAAA,MAClB;AAAA,MACA,QAAQ,KAAK;AAAA,MACb;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,gBACJ,QAC2B;AAC3B,UAAM,UAAkC;AAAA,MACtC,gBAAgB;AAAA,MAChB,gBAAgB,KAAK;AAAA,IACvB;AACA,QAAI,KAAK,cAAc;AACrB,cAAQ,iBAAiB,IAAI,KAAK;AAAA,IACpC;AAEA,UAAM,OAAgC;AAAA,MACpC,cAAc,OAAO;AAAA,MACrB,KAAK,OAAO;AAAA,MACZ,cAAc,OAAO;AAAA,MACrB,eAAe,OAAO;AAAA,MACtB,QAAQ,OAAO;AAAA,MACf,SAAS,OAAO;AAAA,MAChB,QAAQ,OAAO;AAAA,IACjB;AAEA,QAAI,CAAC,KAAK,kBAAkB,OAAO,cAAc;AAC/C,WAAK,gBAAgB,OAAO;AAAA,IAC9B;AAEA,UAAM,OAAO,MAAM,KAAK,OAAO,GAAG,KAAK,WAAW,mBAAmB;AAAA,MACnE,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,UAAU,IAAI;AAAA,IAC3B,CAAC;AAED,QAAI,CAAC,KAAK,IAAI;AACZ,YAAMA,QAAO,MAAM,KAAK,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,YAAM,IAAI;AAAA,QACR,+BAA+B,KAAK,MAAM,IAAKA,MAAa,SAAUA,MAAa,WAAW,KAAK,UAAU;AAAA,QAC7G,KAAK;AAAA,QACLA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,OAAgC,MAAM,KAAK,KAAK;AACtD,UAAM,UAAU,MAAM,UAAU,OAAO,OAAO;AAE9C,UAAM,gBAA+B;AAAA,MACnC,KAAK,KAAK;AAAA,MACV,SAAS,OAAO;AAAA,MAChB,aAAa,OAAO;AAAA,MACpB,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,MAClB,QAAQ,OAAO;AAAA,MACf,QAAQ,OAAO;AAAA,MACf,QAAQ,OAAO;AAAA,IACjB;AACA,UAAM,KAAK,QAAQ;AAAA,MACjB,GAAG,cAAc,GAAG,KAAK,GAAG;AAAA,MAC5B,KAAK,UAAU,aAAa;AAAA,IAC9B;AACA,UAAM,KAAK,QAAQ,IAAI,iBAAiB,KAAK,GAAG;AAEhD,UAAM,UAAU,IAAI,iBAAiB;AAAA,MACnC,KAAK,KAAK;AAAA,MACV;AAAA,MACA,aAAa,OAAO;AAAA,MACpB,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,MAClB,QAAQ,OAAO;AAAA,MACf,QAAQ,OAAO;AAAA,MACf,QAAQ,OAAO;AAAA,MACf,OAAO,KAAK;AAAA,MACZ,WAAW,MAAM,KAAK,cAAc,KAAK,GAAG;AAAA,IAC9C,CAAC;AAED,SAAK,aAAa,kBAAkB,KAAK,GAAG;AAE5C,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,cAAc,KAA4B;AAC9C,QAAI;AACF,YAAM,UAAU,MAAM,KAAK,eAAe,GAAG;AAC7C,UAAI,SAAS;AACX,cAAM,OAAO,MAAM,QAAQ;AAAA,UACzB,GAAG,KAAK,WAAW,mBAAmB,GAAG;AAAA,UACzC,EAAE,QAAQ,SAAS;AAAA,QACrB;AAKA,cAAM,kBACJ,KAAK,WAAW,OAAO,KAAK,WAAW,OAAO,KAAK,WAAW;AAEhE,YAAI,CAAC,KAAK,MAAM,CAAC,iBAAiB;AAChC,gBAAM,OAAO,MAAM,KAAK,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,gBAAM,IAAI;AAAA,YACR,6BAA6B,KAAK,MAAM,IAAK,KAAa,SAAU,KAAa,WAAW,KAAK,UAAU;AAAA,YAC3G,KAAK;AAAA,YACL;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF,UAAE;AAKA,YAAM,KAAK,cAAc,GAAG;AAAA,IAC9B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,cAAc,KAA4B;AAC9C,UAAM,KAAK,QAAQ,OAAO,GAAG,cAAc,GAAG,GAAG,EAAE;AAEnD,UAAM,aAAa,MAAM,KAAK,QAAQ,IAAI,eAAe;AACzD,QAAI,eAAe,KAAK;AACtB,YAAM,KAAK,QAAQ,OAAO,eAAe;AAAA,IAC3C;AAEA,SAAK,aAAa,kBAAkB,GAAG;AAAA,EACzC;AAAA,EAEA,MAAM,eAAe,KAA+C;AAClE,UAAM,SAAS,MAAM,KAAK,QAAQ,IAAI,GAAG,cAAc,GAAG,GAAG,EAAE;AAC/D,QAAI,CAAC,OAAQ,QAAO;AAEpB,UAAM,OAAsB,KAAK,MAAM,MAAM;AAC7C,UAAM,UAAU,MAAM,UAAU,KAAK,OAAO;AAC5C,WAAO,IAAI,iBAAiB;AAAA,MAC1B,KAAK,KAAK;AAAA,MACV;AAAA,MACA,aAAa,KAAK;AAAA,MAClB,WAAW,KAAK;AAAA,MAChB,aAAa,KAAK;AAAA,MAClB,QAAQ,KAAK;AAAA,MACb,QAAQ,KAAK;AAAA,MACb,QAAQ,KAAK;AAAA,MACb,OAAO,KAAK;AAAA,MACZ,WAAW,MAAM,KAAK,cAAc,KAAK,GAAG;AAAA,IAC9C,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,WAAW,KAA0C;AACzD,UAAM,UAAU,MAAM,KAAK,eAAe,GAAG;AAC7C,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,SAAS,kCAAkC,KAAK,CAAC,CAAC;AAAA,IAC9D;AAEA,UAAM,OAAO,MAAM,QAAQ;AAAA,MACzB,GAAG,KAAK,WAAW,mBAAmB,GAAG;AAAA,MACzC,EAAE,QAAQ,MAAM;AAAA,IAClB;AAEA,QAAI,CAAC,KAAK,IAAI;AACZ,YAAM,OAAO,MAAM,KAAK,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,YAAM,IAAI;AAAA,QACR,0BAA0B,KAAK,MAAM,IAAK,KAAa,SAAU,KAAa,WAAW,KAAK,UAAU;AAAA,QACxG,KAAK;AAAA,QACL;AAAA,MACF;AAAA,IACF;AAEA,WAAO,KAAK,KAAK;AAAA,EACnB;AAAA,EAEA,MAAM,UAA4C;AAChD,UAAM,MAAM,MAAM,KAAK,QAAQ,IAAI,eAAe;AAClD,QAAI,CAAC,IAAK,QAAO;AACjB,WAAO,KAAK,eAAe,GAAG;AAAA,EAChC;AACF;AAGA,SAAS,uBAA+B;AACtC,QAAM,QAAQ,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AACvD,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EACxC;AACA,SAAO,KAAK,MAAM,EACf,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AACtB;AAEA,eAAe,qBAAqB,UAAmC;AACrE,QAAM,OAAO,MAAM,OAAO,OAAO;AAAA,IAC/B;AAAA,IACA,IAAI,YAAY,EAAE,OAAO,QAAQ;AAAA,EACnC;AACA,QAAM,QAAQ,IAAI,WAAW,IAAI;AACjC,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EACxC;AACA,SAAO,KAAK,MAAM,EACf,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AACtB;","names":["body"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@happyview/oauth-client",
-  "version": "1.3.0",
+  "version": "1.3.1-dev.1",
   "description": "HappyView OAuth client for ATProto DPoP authentication",
   "license": "MIT",
   "repository": {