@hatk/hatk 0.0.1-alpha.46 → 0.0.1-alpha.48

package/dist/oauth/server.d.ts

@@ -59,12 +59,33 @@ export declare function getClientMetadata(issuer: string, config: OAuthConfig):
     dpop_bound_access_tokens: boolean;
     scope: string;
 };
+/**
+ * Handle a Pushed Authorization Request (PAR).
+ *
+ * Supports account creation via `prompt=create`. When set, `login_hint`
+ * is treated as a PDS hostname (e.g. "selfhosted.social" or "localhost:2583")
+ * rather than a handle or DID. The auth server is discovered from the PDS's
+ * protected resource metadata, and `prompt=create` is forwarded to the PDS
+ * PAR so it shows the signup page.
+ *
+ * For normal login, `login_hint` is a handle or DID as usual.
+ */
 export declare function handlePar(config: OAuthConfig, body: Record<string, string>, dpopHeader: string, requestUrl: string): Promise<{
     request_uri: string;
     expires_in: number;
 }>;
 export declare function buildAuthorizeRedirect(config: OAuthConfig, request: any): string;
-export declare function serverLogin(config: OAuthConfig, handle: string): Promise<string>;
+/**
+ * Initiate a server-side OAuth login or account creation flow.
+ *
+ * For account creation, pass `{ prompt: 'create', pds: 'selfhosted.social' }`.
+ * The `pds` is a bare hostname; the auth server is discovered from its
+ * protected resource metadata.
+ */
+export declare function serverLogin(config: OAuthConfig, handle: string, options?: {
+    prompt?: string;
+    pds?: string;
+}): Promise<string>;
 export declare function handleCallback(config: OAuthConfig, code: string, state: string | null, iss: string | null): Promise<{
     requestUri: string;
     clientRedirectUri: string;

package/dist/oauth/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/oauth/server.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AA4E/C,wBAAsB,SAAS,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBrG;AAID,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW;;;;;;;;;;;;;;;;;;;EAqBxE;AAED,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW;;;;;EAO/E;AAED,wBAAgB,OAAO;;;;;;;;;;;;;;;;;;;;;;EAWtB;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW;;;;;;;;;EAcpE;AAID,wBAAsB,SAAS,CAC7B,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CA+ItD;AAID,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,GAAG,MAAM,CAShF;AAID,wBAAsB,WAAW,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAsGtF;AAID,wBAAsB,cAAc,CAClC,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,GAAG,EAAE,MAAM,GAAG,IAAI,GACjB,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CA0HrG;AAID,wBAAsB,WAAW,CAC/B,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,GAAG,CAAC,CAUd;AA0JD,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACtF,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAoEpF;AAID,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CA0BjC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/oauth/server.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AA4E/C,wBAAsB,SAAS,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBrG;AAID,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW;;;;;;;;;;;;;;;;;;;EAqBxE;AAED,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW;;;;;EAO/E;AAED,wBAAgB,OAAO;;;;;;;;;;;;;;;;;;;;;;EAWtB;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW;;;;;;;;;EAcpE;AAID;;;;;;;;;;GAUG;AACH,wBAAsB,SAAS,CAC7B,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAwKtD;AAID,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,GAAG,MAAM,CAShF;AAID;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1C,OAAO,CAAC,MAAM,CAAC,CA6HjB;AAID,wBAAsB,cAAc,CAClC,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,GAAG,EAAE,MAAM,GAAG,IAAI,GACjB,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CA0HrG;AAID,wBAAsB,WAAW,CAC/B,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,GAAG,CAAC,CAUd;AA0JD,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACtF,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAoEpF;AAID,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CA0BjC"}

package/dist/oauth/server.js

@@ -3,7 +3,7 @@ import { generateKeyPair, importPrivateKey, computeJwkThumbprint, signJwt, parse
 import { parseDpopProof, createDpopProof } from "./dpop.js";
 import { initSession } from "./session.js";
 import { resolveClient, validateRedirectUri, isLoopbackClient } from "./client.js";
-import { discoverAuthServer, resolveHandle } from "./discovery.js";
+import { discoverAuthServer, resolveHandle, fetchProtectedResourceMetadata, fetchAuthServerMetadata } from "./discovery.js";
 import { getServerKey, storeServerKey, storeOAuthRequest, getOAuthRequest, deleteOAuthRequest, storeAuthCode, consumeAuthCode, storeSession, deleteSession, checkAndStoreDpopJti, cleanupExpiredOAuth, storeRefreshToken, getRefreshToken, revokeRefreshToken, } from "./db.js";
 import { emit } from "../logger.js";
 import { querySQL } from "../database/db.js";
@@ -122,6 +122,17 @@ export function getClientMetadata(issuer, config) {
     };
 }
 // --- PAR Endpoint ---
+/**
+ * Handle a Pushed Authorization Request (PAR).
+ *
+ * Supports account creation via `prompt=create`. When set, `login_hint`
+ * is treated as a PDS hostname (e.g. "selfhosted.social" or "localhost:2583")
+ * rather than a handle or DID. The auth server is discovered from the PDS's
+ * protected resource metadata, and `prompt=create` is forwarded to the PDS
+ * PAR so it shows the signup page.
+ *
+ * For normal login, `login_hint` is a handle or DID as usual.
+ */
 export async function handlePar(config, body, dpopHeader, requestUrl) {
     // Validate client DPoP proof
     const dpop = await parseDpopProof(dpopHeader, 'POST', requestUrl);
@@ -146,9 +157,34 @@ export async function handlePar(config, body, dpopHeader, requestUrl) {
         throw new Error('code_challenge is required');
     if (body.code_challenge_method && body.code_challenge_method !== 'S256')
         throw new Error('Only S256 supported');
-    // Resolve DID from login_hint
+    // Resolve DID and PDS from login_hint
+    const prompt = body.prompt;
     let did = body.login_hint;
-    if (did && !did.startsWith('did:')) {
+    let pdsRequestUri;
+    let pdsAuthServer;
+    let pdsCodeVerifier;
+    let pdsState;
+    let pdsEndpoint;
+    if (prompt === 'create' && body.login_hint) {
+        // Account creation: login_hint is a PDS URL, discover auth server from it directly
+        let pdsUrl;
+        if (body.login_hint.startsWith('http')) {
+            pdsUrl = body.login_hint;
+        }
+        else if (body.login_hint.match(/^localhost[:/]/)) {
+            pdsUrl = `http://${body.login_hint}`;
+        }
+        else {
+            pdsUrl = `https://${body.login_hint}`;
+        }
+        pdsEndpoint = pdsUrl;
+        const protectedResource = await fetchProtectedResourceMetadata(pdsUrl);
+        pdsAuthServer = protectedResource.authorization_servers[0];
+        if (!pdsAuthServer)
+            throw new Error(`No auth server for PDS ${pdsUrl}`);
+        did = undefined; // no DID yet for account creation
+    }
+    else if (did && !did.startsWith('did:')) {
         try {
             did = await resolveHandle(did, _relayUrl);
         }
@@ -156,33 +192,37 @@ export async function handlePar(config, body, dpopHeader, requestUrl) {
             throw new Error('Handle not found');
         }
     }
-    // Discover user's PDS auth server
-    let pdsRequestUri;
-    let pdsAuthServer;
-    let pdsCodeVerifier;
-    let pdsState;
-    let pdsEndpoint;
-    if (did) {
+    // Discover user's PDS auth server (for login flow with a resolved DID)
+    if (did && !pdsAuthServer) {
         const discovery = await discoverAuthServer(did, _plcUrl);
         pdsAuthServer = discovery.authServerEndpoint;
         pdsEndpoint = discovery.pdsEndpoint;
+    }
+    if (pdsAuthServer) {
+        const authServerMetadata = await fetchAuthServerMetadata(pdsAuthServer);
         // Create PKCE for our PAR to the PDS
         pdsCodeVerifier = randomToken();
         const pdsCodeChallenge = base64UrlEncode(await sha256(pdsCodeVerifier));
         pdsState = randomToken(); // unique state to correlate callback
         // PAR to the PDS
-        const parEndpoint = discovery.authServerMetadata.pushed_authorization_request_endpoint || `${pdsAuthServer}/oauth/par`;
+        const parEndpoint = authServerMetadata.pushed_authorization_request_endpoint || `${pdsAuthServer}/oauth/par`;
         const serverDpopProof = await createDpopProof(serverPrivateJwk, serverPublicJwk, 'POST', parEndpoint);
-        const pdsParBody = new URLSearchParams({
+        const pdsParParams = {
             client_id: pdsClientId(config.issuer, config),
             redirect_uri: pdsRedirectUri(config.issuer),
             response_type: 'code',
             code_challenge: pdsCodeChallenge,
             code_challenge_method: 'S256',
             scope: body.scope || 'atproto transition:generic',
-            login_hint: body.login_hint || did,
             state: pdsState,
-        });
+        };
+        if (prompt === 'create') {
+            pdsParParams.prompt = 'create';
+        }
+        if (did) {
+            pdsParParams.login_hint = body.login_hint || did;
+        }
+        const pdsParBody = new URLSearchParams(pdsParParams);
         const pdsParRes = await fetch(parEndpoint, {
             method: 'POST',
             headers: { 'Content-Type': 'application/x-www-form-urlencoded', DPoP: serverDpopProof },
@@ -265,34 +305,65 @@ export function buildAuthorizeRedirect(config, request) {
     return `${request.pds_auth_server}/oauth/authorize?${params}`;
 }
 // --- Server-initiated login (no DPoP required from browser) ---
-export async function serverLogin(config, handle) {
-    // Resolve handle to DID
-    let did = handle;
-    if (!did.startsWith('did:')) {
-        did = await resolveHandle(handle, _relayUrl);
+/**
+ * Initiate a server-side OAuth login or account creation flow.
+ *
+ * For account creation, pass `{ prompt: 'create', pds: 'selfhosted.social' }`.
+ * The `pds` is a bare hostname; the auth server is discovered from its
+ * protected resource metadata.
+ */
+export async function serverLogin(config, handle, options) {
+    let did;
+    let pdsAuthServer;
+    let pdsEndpoint;
+    if (options?.prompt === 'create' && options?.pds) {
+        // Account creation: discover auth server from PDS hostname
+        const pdsUrl = options.pds.startsWith('http')
+            ? options.pds
+            : options.pds.match(/^localhost[:/]/)
+                ? `http://${options.pds}`
+                : `https://${options.pds}`;
+        pdsEndpoint = pdsUrl;
+        const protectedResource = await fetchProtectedResourceMetadata(pdsUrl);
+        pdsAuthServer = protectedResource.authorization_servers[0];
+        if (!pdsAuthServer)
+            throw new Error(`No auth server for PDS ${pdsUrl}`);
+    }
+    else {
+        // Normal login: resolve handle to DID
+        did = handle;
+        if (!did.startsWith('did:')) {
+            did = await resolveHandle(handle, _relayUrl);
+        }
+        const discovery = await discoverAuthServer(did, _plcUrl);
+        pdsAuthServer = discovery.authServerEndpoint;
+        pdsEndpoint = discovery.pdsEndpoint;
     }
-    // Discover PDS auth server
-    const discovery = await discoverAuthServer(did, _plcUrl);
-    const pdsAuthServer = discovery.authServerEndpoint;
-    const pdsEndpoint = discovery.pdsEndpoint;
+    const authServerMetadata = await fetchAuthServerMetadata(pdsAuthServer);
     // Create PKCE for PAR to PDS
     const pdsCodeVerifier = randomToken();
     const pdsCodeChallenge = base64UrlEncode(await sha256(pdsCodeVerifier));
     const pdsState = randomToken();
     // PAR to the PDS
-    const parEndpoint = discovery.authServerMetadata.pushed_authorization_request_endpoint || `${pdsAuthServer}/oauth/par`;
+    const parEndpoint = authServerMetadata.pushed_authorization_request_endpoint || `${pdsAuthServer}/oauth/par`;
     const serverDpopProof = await createDpopProof(serverPrivateJwk, serverPublicJwk, 'POST', parEndpoint);
     const scope = config.scopes?.join(' ') || 'atproto transition:generic';
-    const pdsParBody = new URLSearchParams({
+    const pdsParParams = {
         client_id: pdsClientId(config.issuer, config),
         redirect_uri: pdsRedirectUri(config.issuer),
         response_type: 'code',
         code_challenge: pdsCodeChallenge,
         code_challenge_method: 'S256',
         scope,
-        login_hint: handle,
         state: pdsState,
-    });
+    };
+    if (options?.prompt === 'create') {
+        pdsParParams.prompt = 'create';
+    }
+    if (did) {
+        pdsParParams.login_hint = handle;
+    }
+    const pdsParBody = new URLSearchParams(pdsParParams);
     let pdsRequestUri;
     const pdsParRes = await fetch(parEndpoint, {
         method: 'POST',

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAyDA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AA0B9C;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,GAAG,IAAI,CAuK3F;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,KAAK,EAAE,WAAW,GAAG,IAAI,CAAA;IACzB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACxF,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;IAC5D,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAA;CACtB;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CA6zB5F;AAGD,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EAAE,EACrB,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,KAAK,EAAE,WAAW,GAAG,IAAI,EACzB,MAAM,GAAE,MAAM,EAAO,EACrB,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAC5D,QAAQ,CAAC,EAAE,MAAM,IAAI,GACpB,OAAO,WAAW,EAAE,MAAM,CAG5B"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAyDA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AA0B9C;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,GAAG,IAAI,CAuK3F;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,KAAK,EAAE,WAAW,GAAG,IAAI,CAAA;IACzB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACxF,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;IAC5D,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAA;CACtB;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CA+zB5F;AAGD,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EAAE,EACrB,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,KAAK,EAAE,WAAW,GAAG,IAAI,EACzB,MAAM,GAAE,MAAM,EAAO,EACrB,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAC5D,QAAQ,CAAC,EAAE,MAAM,IAAI,GACpB,OAAO,WAAW,EAAE,MAAM,CAG5B"}

package/dist/server.js

@@ -728,11 +728,13 @@ export function createHandler(config) {
             }
             // OAuth Login (server-initiated, no DPoP required)
             if (url.pathname === '/oauth/login' && oauth) {
-                const handle = url.searchParams.get('handle');
-                if (!handle)
+                const handle = url.searchParams.get('handle') || '';
+                const prompt = url.searchParams.get('prompt') || undefined;
+                const pds = url.searchParams.get('pds') || undefined;
+                if (!handle && prompt !== 'create')
                     return withCors(jsonError(400, 'handle required', acceptEncoding));
                 try {
-                    const redirectUrl = await serverLogin(oauth, handle);
+                    const redirectUrl = await serverLogin(oauth, handle, { prompt, pds });
                     return new Response(null, {
                         status: 302,
                         headers: { Location: redirectUrl, 'Set-Cookie': clearSessionCookieHeader() },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hatk/hatk",
-  "version": "0.0.1-alpha.46",
+  "version": "0.0.1-alpha.48",
   "license": "MIT",
   "bin": {
     "hatk": "dist/cli.js"