@hatk/hatk 0.0.1-alpha.72 → 0.0.1-alpha.74

package/dist/adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,cAAc,EAAgB,MAAM,WAAW,CAAA;AAEnF;;GAEG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CA0BrE;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBzF;AAED,wFAAwF;AACxF,eAAO,MAAM,WAAW,UAcvB,CAAA;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;;;GAIG;AACH,wBAAgB,KAAK,CACnB,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,EAChD,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,MAAM,EACb,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,IAAI,KAAK,IAAI,6EA4BjF"}
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,cAAc,EAAgB,MAAM,WAAW,CAAA;AAEnF;;GAEG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CA0BrE;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBzF;AAED,wFAAwF;AACxF,eAAO,MAAM,WAAW,UAgBvB,CAAA;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;;;GAIG;AACH,wBAAgB,KAAK,CACnB,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,EAChD,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,MAAM,EACb,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,IAAI,KAAK,IAAI,6EA4BjF"}

package/dist/adapter.js

@@ -69,6 +69,8 @@ export const HATK_ROUTES = [
     '/_health',
     '/robots.txt',
     '/auth/logout',
+    '/auth/switch',
+    '/auth/accounts',
     '/__dev/',
 ];
 export function isHatkRoute(pathname) {

package/dist/oauth/server.d.ts

@@ -63,15 +63,59 @@ export declare function getJwks(): {
         y?: string;
     }[];
 };
+/**
+ * Whether we authenticate to PDSes as a confidential client.
+ *
+ * A confidential client gets a 2-year session and 3-month refresh window
+ * instead of 2 weeks, and is exempt from the consent screen atproto forces on
+ * every authorization request from a public client. It requires a fetchable
+ * `jwks_uri`, so loopback deployments (local dev) stay public.
+ */
+export declare function isConfidentialClient(issuer: string): boolean;
+/** Public half of the client-authentication key, for the PDS to verify assertions. */
+export declare function getClientJwks(): {
+    keys: {
+        kid: string;
+        use: string;
+        alg: string;
+        crv?: string;
+        d?: string;
+        dp?: string;
+        dq?: string;
+        e?: string;
+        ext?: boolean;
+        k?: string;
+        key_ops?: string[];
+        kty?: string;
+        n?: string;
+        oth?: RsaOtherPrimesInfo[];
+        p?: string;
+        q?: string;
+        qi?: string;
+        x?: string;
+        y?: string;
+    }[];
+};
 export declare function getClientMetadata(issuer: string, config: OAuthConfig): {
+    dpop_bound_access_tokens: boolean;
+    scope: string;
+    token_endpoint_auth_method: string;
+    token_endpoint_auth_signing_alg: string;
+    jwks_uri: string;
     client_id: string;
     client_name: string;
     redirect_uris: string[];
     grant_types: string[];
     response_types: string[];
-    token_endpoint_auth_method: string;
+} | {
     dpop_bound_access_tokens: boolean;
     scope: string;
+    token_endpoint_auth_method: string;
+    client_id: string;
+    client_name: string;
+    redirect_uris: string[];
+    grant_types: string[];
+    response_types: string[];
 };
 /**
  * Handle a Pushed Authorization Request (PAR).

package/dist/oauth/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/oauth/server.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AA4C/C;;;;;;;GAOG;AACH,qBAAa,UAAW,SAAQ,KAAK;aAEjB,IAAI,EAChB,iBAAiB,GACjB,gBAAgB,GAChB,eAAe,GACf,qBAAqB,GACrB,wBAAwB,GACxB,eAAe;aACH,WAAW,EAAE,MAAM;aACnB,MAAM,EAAE,MAAM;gBARd,IAAI,EAChB,iBAAiB,GACjB,gBAAgB,GAChB,eAAe,GACf,qBAAqB,GACrB,wBAAwB,GACxB,eAAe,EACH,WAAW,EAAE,MAAM,EACnB,MAAM,GAAE,MAAY;CAKvC;AAuCD,wBAAsB,SAAS,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBrG;AAID,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW;;;;;;;;;;;;;;;;;;;EAqBxE;AAED,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW;;;;;EAO/E;AAED,wBAAgB,OAAO;;;;;;;;;;;;;;;;;;;;;;EAWtB;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW;;;;;;;;;EAcpE;AAID;;;;;;;;;;GAUG;AACH,wBAAsB,SAAS,CAC7B,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAuKtD;AAID,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,GAAG,MAAM,CAShF;AAID;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1C,OAAO,CAAC,MAAM,CAAC,CA6HjB;AAID,wBAAsB,cAAc,CAClC,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,GAAG,EAAE,MAAM,GAAG,IAAI,GACjB,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CA2HrG;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,MAAM,EACb,gBAAgB,EAAE,MAAM,GAAG,IAAI,EAC/B,KAAK,EAAE,MAAM,GAAG,IAAI,GACnB,OAAO,CAAC,MAAM,CAAC,CAsBjB;AAID,wBAAsB,WAAW,CAC/B,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,GAAG,CAAC,CAUd;AA4JD,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAChH,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAsEpF;AAID,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CA0BjC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/oauth/server.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AA8C/C;;;;;;;GAOG;AACH,qBAAa,UAAW,SAAQ,KAAK;aAEjB,IAAI,EAChB,iBAAiB,GACjB,gBAAgB,GAChB,eAAe,GACf,qBAAqB,GACrB,wBAAwB,GACxB,eAAe;aACH,WAAW,EAAE,MAAM;aACnB,MAAM,EAAE,MAAM;gBARd,IAAI,EAChB,iBAAiB,GACjB,gBAAgB,GAChB,eAAe,GACf,qBAAqB,GACrB,wBAAwB,GACxB,eAAe,EACH,WAAW,EAAE,MAAM,EACnB,MAAM,GAAE,MAAY;CAKvC;AAyCD,wBAAsB,SAAS,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAwCrG;AAID,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW;;;;;;;;;;;;;;;;;;;EAqBxE;AAED,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW;;;;;EAO/E;AAED,wBAAgB,OAAO;;;;;;;;;;;;;;;;;;;;;;EAWtB;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED,sFAAsF;AACtF,wBAAgB,aAAa;;;;;;;;;;;;;;;;;;;;;;EAW5B;AA0CD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW;;;;;;;;;;;;;;;;;;;;EAuBpE;AAID;;;;;;;;;;GAUG;AACH,wBAAsB,SAAS,CAC7B,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAyKtD;AAID,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,GAAG,MAAM,CAShF;AAID;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1C,OAAO,CAAC,MAAM,CAAC,CA+HjB;AAID,wBAAsB,cAAc,CAClC,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,GAAG,EAAE,MAAM,GAAG,IAAI,GACjB,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAkIrG;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,MAAM,EACb,gBAAgB,EAAE,MAAM,GAAG,IAAI,EAC/B,KAAK,EAAE,MAAM,GAAG,IAAI,GACnB,OAAO,CAAC,MAAM,CAAC,CAsBjB;AAID,wBAAsB,WAAW,CAC/B,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,GAAG,CAAC,CAUd;AA4JD,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAChH,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CA6EpF;AAID,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CA0BjC"}

package/dist/oauth/server.js

@@ -9,6 +9,8 @@ import { emit } from "../logger.js";
 import { querySQL } from "../database/db.js";
 import { fireOnLoginHook } from "../hooks.js";
 const SERVER_KEY_KID = 'appview-oauth-key';
+const CLIENT_KEY_KID = 'pds-client-auth-key';
+const CLIENT_ASSERTION_TYPE = 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer';
 /**
  * RFC 6749 §5.2 OAuth token-endpoint error.
  *
@@ -59,6 +61,8 @@ let serverPrivateJwk;
 let serverPublicJwk;
 let serverPrivateKey;
 let serverJkt;
+let clientPublicJwk;
+let clientPrivateKey;
 let _plcUrl;
 let _relayUrl;
 export async function initOAuth(_config, plcUrl, relayUrl) {
@@ -78,6 +82,24 @@ export async function initOAuth(_config, plcUrl, relayUrl) {
     }
     serverPrivateKey = await importPrivateKey(serverPrivateJwk);
     serverJkt = await computeJwkThumbprint(serverPublicJwk);
+    // Client-authentication key, kept separate from the access-token signing key
+    // above. A PDS binds each session to the kid that authenticated it and
+    // refuses a later refresh signed by a different one, so this key can't be
+    // rotated without signing every user out — keeping it distinct means the
+    // access-token key stays rotatable.
+    const existingClientKey = await getServerKey(CLIENT_KEY_KID);
+    let clientPrivateJwk;
+    if (existingClientKey) {
+        clientPrivateJwk = JSON.parse(existingClientKey.privateKey);
+        clientPublicJwk = JSON.parse(existingClientKey.publicKey);
+    }
+    else {
+        const kp = await generateKeyPair();
+        clientPrivateJwk = kp.privateJwk;
+        clientPublicJwk = kp.publicJwk;
+        await storeServerKey(CLIENT_KEY_KID, JSON.stringify(clientPrivateJwk), JSON.stringify(clientPublicJwk));
+    }
+    clientPrivateKey = await importPrivateKey(clientPrivateJwk);
     // Initialize SSR session cookie signing
     initSession(serverPrivateJwk, _config.cookieName);
     // Periodic cleanup of expired OAuth data
@@ -126,17 +148,80 @@ export function getJwks() {
         ],
     };
 }
+/**
+ * Whether we authenticate to PDSes as a confidential client.
+ *
+ * A confidential client gets a 2-year session and 3-month refresh window
+ * instead of 2 weeks, and is exempt from the consent screen atproto forces on
+ * every authorization request from a public client. It requires a fetchable
+ * `jwks_uri`, so loopback deployments (local dev) stay public.
+ */
+export function isConfidentialClient(issuer) {
+    return !isLoopbackClient(issuer);
+}
+/** Public half of the client-authentication key, for the PDS to verify assertions. */
+export function getClientJwks() {
+    return {
+        keys: [
+            {
+                ...clientPublicJwk,
+                kid: CLIENT_KEY_KID,
+                use: 'sig',
+                alg: 'ES256',
+            },
+        ],
+    };
+}
+/**
+ * A JWT proving we are this client, per RFC 7523. The PDS checks `sub` against
+ * the client_id it resolved and `aud` against its own issuer, then verifies the
+ * signature against the key it fetched from `jwks_uri`.
+ */
+async function createClientAssertion(issuer, config, audience) {
+    const clientId = pdsClientId(issuer, config);
+    const now = Math.floor(Date.now() / 1000);
+    return signJwt({ typ: 'JWT', alg: 'ES256', kid: CLIENT_KEY_KID }, {
+        iss: clientId,
+        sub: clientId,
+        aud: audience,
+        jti: randomToken(),
+        iat: now,
+        exp: now + 60,
+    }, clientPrivateKey);
+}
+/**
+ * Add client authentication to a PAR or token request body. No-op for loopback
+ * deployments, which stay public clients.
+ */
+async function withClientAuth(params, issuer, config, audience) {
+    if (!isConfidentialClient(issuer))
+        return params;
+    return {
+        ...params,
+        client_assertion_type: CLIENT_ASSERTION_TYPE,
+        client_assertion: await createClientAssertion(issuer, config, audience),
+    };
+}
 export function getClientMetadata(issuer, config) {
     // Find the metadata client entry to get its scope
     const metadataClientId = `${issuer}/oauth-client-metadata.json`;
     const clientConfig = config.clients.find((c) => c.client_id === metadataClientId);
+    const confidential = isConfidentialClient(issuer);
     return {
         client_id: metadataClientId,
         client_name: clientConfig?.client_name || 'hatk',
         redirect_uris: [`${issuer}/oauth/callback`],
         grant_types: ['authorization_code', 'refresh_token'],
         response_types: ['code'],
-        token_endpoint_auth_method: 'none',
+        // atproto requires the signing alg alongside private_key_jwt, and requires
+        // its absence for a public client.
+        ...(confidential
+            ? {
+                token_endpoint_auth_method: 'private_key_jwt',
+                token_endpoint_auth_signing_alg: 'ES256',
+                jwks_uri: `${issuer}/oauth/client-jwks.json`,
+            }
+            : { token_endpoint_auth_method: 'none' }),
         dpop_bound_access_tokens: true,
         scope: clientConfig?.scope || 'atproto transition:generic',
     };
@@ -242,7 +327,7 @@ export async function handlePar(config, body, dpopHeader, requestUrl) {
         if (did) {
             pdsParParams.login_hint = body.login_hint || did;
         }
-        const pdsParBody = new URLSearchParams(pdsParParams);
+        const pdsParBody = new URLSearchParams(await withClientAuth(pdsParParams, config.issuer, config, authServerMetadata.issuer || pdsAuthServer));
         const pdsParRes = await fetch(parEndpoint, {
             method: 'POST',
             headers: { 'Content-Type': 'application/x-www-form-urlencoded', DPoP: serverDpopProof },
@@ -383,7 +468,7 @@ export async function serverLogin(config, handle, options) {
     if (did) {
         pdsParParams.login_hint = handle;
     }
-    const pdsParBody = new URLSearchParams(pdsParParams);
+    const pdsParBody = new URLSearchParams(await withClientAuth(pdsParParams, config.issuer, config, authServerMetadata.issuer || pdsAuthServer));
     let pdsRequestUri;
     const pdsParRes = await fetch(parEndpoint, {
         method: 'POST',
@@ -466,13 +551,13 @@ export async function handleCallback(config, code, state, iss) {
     // Exchange code at PDS token endpoint
     const tokenEndpoint = `${request.pds_auth_server}/oauth/token`;
     const serverDpopProof = await createDpopProof(serverPrivateJwk, serverPublicJwk, 'POST', tokenEndpoint);
-    const tokenBody = new URLSearchParams({
+    const tokenBody = new URLSearchParams(await withClientAuth({
         grant_type: 'authorization_code',
         code,
         redirect_uri: pdsRedirectUri(config.issuer),
         client_id: pdsClientId(config.issuer, config),
         code_verifier: request.pds_code_verifier,
-    });
+    }, config.issuer, config, request.pds_auth_server));
     let tokenRes = await fetch(tokenEndpoint, {
         method: 'POST',
         headers: { 'Content-Type': 'application/x-www-form-urlencoded', DPoP: serverDpopProof },
@@ -721,11 +806,11 @@ export async function refreshPdsSession(config, session) {
     const tokenEndpoint = `${session.pds_auth_server || session.pds_endpoint}/oauth/token`;
     const clientId = pdsClientId(config.issuer, config);
     const dpopProof = await createDpopProof(serverPrivateJwk, serverPublicJwk, 'POST', tokenEndpoint);
-    const body = new URLSearchParams({
+    const body = new URLSearchParams(await withClientAuth({
         grant_type: 'refresh_token',
         refresh_token: session.refresh_token,
         client_id: clientId,
-    });
+    }, config.issuer, config, session.pds_auth_server || session.pds_endpoint));
     let tokenRes = await fetch(tokenEndpoint, {
         method: 'POST',
         headers: { 'Content-Type': 'application/x-www-form-urlencoded', DPoP: dpopProof },

package/dist/oauth/session.d.ts

@@ -3,9 +3,30 @@ export type SessionData = {
     handle: string;
 };
 export declare function getSessionCookieName(): string;
+/**
+ * Companion cookie listing every account this browser has signed in as.
+ *
+ * The session cookie names the *active* account; this one is the set the
+ * browser is entitled to switch between without going back to the PDS. It's
+ * encrypted with the same key, so a client can't add a DID to it and assume
+ * that identity — which is the whole security gate on `/auth/switch`.
+ */
+export declare function getAccountsCookieName(): string;
 export declare function initSession(privateJwk: JsonWebKey, cookieName?: string): void;
 export declare function createSessionCookie(data: SessionData): Promise<string>;
 export declare function sessionCookieHeader(value: string, secure: boolean): string;
 export declare function clearSessionCookieHeader(): string;
 export declare function parseSessionCookie(request: Request): Promise<SessionData | null>;
+export declare function createAccountsCookie(accounts: SessionData[]): Promise<string>;
+export declare function accountsCookieHeader(value: string, secure: boolean): string;
+export declare function clearAccountsCookieHeader(): string;
+/** Every account this browser has signed in as, oldest first. */
+export declare function parseAccountsCookie(request: Request): Promise<SessionData[]>;
+/**
+ * Add (or refresh) an account in the browser's list. Existing entries keep
+ * their position so the switcher doesn't reshuffle; a re-login just updates
+ * the handle.
+ */
+export declare function withAccount(accounts: SessionData[], account: SessionData): SessionData[];
+export declare function withoutAccount(accounts: SessionData[], did: string): SessionData[];
 //# sourceMappingURL=session.d.ts.map

package/dist/oauth/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/oauth/session.ts"],"names":[],"mappings":"AASA,MAAM,MAAM,WAAW,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAEzD,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED,wBAAgB,WAAW,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAG7E;AAcD,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAM5E;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,MAAM,CAI1E;AAED,wBAAgB,wBAAwB,IAAI,MAAM,CAEjD;AAED,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAuBtF"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/oauth/session.ts"],"names":[],"mappings":"AAYA,MAAM,MAAM,WAAW,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAEzD,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C;AAED,wBAAgB,WAAW,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAG7E;AAoDD,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAE5E;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,MAAM,CAE1E;AAED,wBAAgB,wBAAwB,IAAI,MAAM,CAEjD;AAED,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAOtF;AAID,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAEnF;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,MAAM,CAE3E;AAED,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAED,iEAAiE;AACjE,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAUlF;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,WAAW,GAAG,WAAW,EAAE,CAMxF;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,WAAW,EAAE,CAElF"}

package/dist/oauth/session.js

@@ -4,9 +4,22 @@ import { base64UrlEncode, base64UrlDecode } from "./crypto.js";
 let _privateJwk;
 let _cookieName = '__hatk_session';
 const MAX_AGE = 30 * 24 * 60 * 60; // 30 days in seconds
+/** Most accounts one browser can keep signed in at once. */
+const MAX_ACCOUNTS = 10;
 export function getSessionCookieName() {
     return _cookieName;
 }
+/**
+ * Companion cookie listing every account this browser has signed in as.
+ *
+ * The session cookie names the *active* account; this one is the set the
+ * browser is entitled to switch between without going back to the PDS. It's
+ * encrypted with the same key, so a client can't add a DID to it and assume
+ * that identity — which is the whole security gate on `/auth/switch`.
+ */
+export function getAccountsCookieName() {
+    return `${_cookieName}_accounts`;
+}
 export function initSession(privateJwk, cookieName) {
     _privateJwk = privateJwk;
     if (cookieName)
@@ -17,33 +30,14 @@ async function aesKey() {
     const keyMaterial = await crypto.subtle.importKey('raw', raw, 'HKDF', false, ['deriveKey']);
     return crypto.subtle.deriveKey({ name: 'HKDF', hash: 'SHA-256', salt: new Uint8Array(0), info: new TextEncoder().encode('hatk-session-cookie') }, keyMaterial, { name: 'AES-GCM', length: 256 }, false, ['encrypt', 'decrypt']);
 }
-export async function createSessionCookie(data) {
-    const payload = JSON.stringify({ ...data, ts: Math.floor(Date.now() / 1000) });
+async function encrypt(payload) {
     const iv = crypto.getRandomValues(new Uint8Array(12));
     const key = await aesKey();
-    const ciphertext = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, key, new TextEncoder().encode(payload));
+    const plaintext = new TextEncoder().encode(JSON.stringify(payload));
+    const ciphertext = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, key, plaintext);
     return `${base64UrlEncode(iv)}.${base64UrlEncode(new Uint8Array(ciphertext))}`;
 }
-export function sessionCookieHeader(value, secure) {
-    const parts = [`${_cookieName}=${value}`, 'HttpOnly', 'SameSite=Lax', 'Path=/', `Max-Age=${MAX_AGE}`];
-    if (secure)
-        parts.push('Secure');
-    return parts.join('; ');
-}
-export function clearSessionCookieHeader() {
-    return `${_cookieName}=; HttpOnly; SameSite=Lax; Path=/; Max-Age=0`;
-}
-export async function parseSessionCookie(request) {
-    const cookieHeader = request.headers.get('cookie');
-    if (!cookieHeader)
-        return null;
-    const match = cookieHeader
-        .split(';')
-        .map((c) => c.trim())
-        .find((c) => c.startsWith(`${_cookieName}=`));
-    if (!match)
-        return null;
-    const value = match.slice(_cookieName.length + 1);
+async function decrypt(value) {
     const parts = value.split('.');
     if (parts.length !== 2)
         return null;
@@ -52,14 +46,86 @@ export async function parseSessionCookie(request) {
         const ciphertext = base64UrlDecode(parts[1]);
         const key = await aesKey();
         const plaintext = await crypto.subtle.decrypt({ name: 'AES-GCM', iv }, key, ciphertext);
-        const data = JSON.parse(new TextDecoder().decode(plaintext));
-        if (!data.did || !data.handle || !data.ts)
-            return null;
-        if (Date.now() / 1000 - data.ts > MAX_AGE)
-            return null;
-        return { did: data.did, handle: data.handle };
+        return JSON.parse(new TextDecoder().decode(plaintext));
     }
     catch {
         return null;
     }
 }
+function readCookie(request, name) {
+    const cookieHeader = request.headers.get('cookie');
+    if (!cookieHeader)
+        return null;
+    const match = cookieHeader
+        .split(';')
+        .map((c) => c.trim())
+        .find((c) => c.startsWith(`${name}=`));
+    return match ? match.slice(name.length + 1) : null;
+}
+function cookieHeader(name, value, secure) {
+    const parts = [`${name}=${value}`, 'HttpOnly', 'SameSite=Lax', 'Path=/', `Max-Age=${MAX_AGE}`];
+    if (secure)
+        parts.push('Secure');
+    return parts.join('; ');
+}
+export async function createSessionCookie(data) {
+    return encrypt({ ...data, ts: Math.floor(Date.now() / 1000) });
+}
+export function sessionCookieHeader(value, secure) {
+    return cookieHeader(_cookieName, value, secure);
+}
+export function clearSessionCookieHeader() {
+    return `${_cookieName}=; HttpOnly; SameSite=Lax; Path=/; Max-Age=0`;
+}
+export async function parseSessionCookie(request) {
+    const value = readCookie(request, _cookieName);
+    if (!value)
+        return null;
+    const data = await decrypt(value);
+    if (!data?.did || !data.handle || !data.ts)
+        return null;
+    if (Date.now() / 1000 - data.ts > MAX_AGE)
+        return null;
+    return { did: data.did, handle: data.handle };
+}
+// --- Accounts cookie ---
+export async function createAccountsCookie(accounts) {
+    return encrypt({ accounts: accounts.slice(-MAX_ACCOUNTS), ts: Math.floor(Date.now() / 1000) });
+}
+export function accountsCookieHeader(value, secure) {
+    return cookieHeader(getAccountsCookieName(), value, secure);
+}
+export function clearAccountsCookieHeader() {
+    return `${getAccountsCookieName()}=; HttpOnly; SameSite=Lax; Path=/; Max-Age=0`;
+}
+/** Every account this browser has signed in as, oldest first. */
+export async function parseAccountsCookie(request) {
+    const value = readCookie(request, getAccountsCookieName());
+    if (!value)
+        return [];
+    const data = await decrypt(value);
+    if (!data?.ts || !Array.isArray(data.accounts))
+        return [];
+    if (Date.now() / 1000 - data.ts > MAX_AGE)
+        return [];
+    return data.accounts.filter((a) => {
+        const account = a;
+        return !!account && typeof account.did === 'string' && typeof account.handle === 'string';
+    });
+}
+/**
+ * Add (or refresh) an account in the browser's list. Existing entries keep
+ * their position so the switcher doesn't reshuffle; a re-login just updates
+ * the handle.
+ */
+export function withAccount(accounts, account) {
+    const index = accounts.findIndex((a) => a.did === account.did);
+    if (index === -1)
+        return [...accounts, account];
+    const next = [...accounts];
+    next[index] = account;
+    return next;
+}
+export function withoutAccount(accounts, did) {
+    return accounts.filter((a) => a.did !== did);
+}

package/dist/push.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"push.d.ts","sourceRoot":"","sources":["../src/push.ts"],"names":[],"mappings":"AAeA,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,OAAO,CAAA;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,UAAU,CAAA;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9C;AAOD,iEAAiE;AACjE,wBAAgB,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CASpE;AAED,iDAAiD;AACjD,wBAAgB,aAAa,IAAI,OAAO,CAEvC;AAED,4DAA4D;AAC5D,wBAAgB,kBAAkB,IAAI,aAAa,CAElD;AAsJD,4DAA4D;AAC5D,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO/F;AAED,2BAA2B;AAC3B,wBAAsB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9D;AAED,6CAA6C;AAC7C,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/E"}
+{"version":3,"file":"push.d.ts","sourceRoot":"","sources":["../src/push.ts"],"names":[],"mappings":"AAeA,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,OAAO,CAAA;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,UAAU,CAAA;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9C;AAOD,iEAAiE;AACjE,wBAAgB,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CASpE;AAED,iDAAiD;AACjD,wBAAgB,aAAa,IAAI,OAAO,CAEvC;AAED,4DAA4D;AAC5D,wBAAgB,kBAAkB,IAAI,aAAa,CAElD;AA0JD,4DAA4D;AAC5D,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO/F;AAED,2BAA2B;AAC3B,wBAAsB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9D;AAED,6CAA6C;AAC7C,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/E"}

package/dist/push.js

@@ -91,6 +91,10 @@ async function send(payload) {
     const aps = {
         alert: { title: payload.title, body: payload.body },
         sound: 'default',
+        // Run the client's notification service extension before the alert is
+        // shown, so it can enrich the payload (Grain attaches the actor's avatar
+        // from `data.avatar`). Ignored by clients that don't ship one.
+        'mutable-content': 1,
     };
     if (payload.badge !== undefined) {
         aps.badge = payload.badge;

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AA6DA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AA4B9C;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,GAAG,IAAI,CAqM3F;AAgDD,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,KAAK,EAAE,WAAW,GAAG,IAAI,CAAA;IACzB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACxF,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;IAC5D,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAA;CACtB;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAs6B5F;AAGD,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EAAE,EACrB,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,KAAK,EAAE,WAAW,GAAG,IAAI,EACzB,MAAM,GAAE,MAAM,EAAO,EACrB,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAC5D,QAAQ,CAAC,EAAE,MAAM,IAAI,GACpB,OAAO,WAAW,EAAE,MAAM,CAG5B"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAqEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AA4B9C;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,GAAG,IAAI,CAqM3F;AAgDD,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,KAAK,EAAE,WAAW,GAAG,IAAI,CAAA;IACzB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACxF,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;IAC5D,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAA;CACtB;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CA6gC5F;AAGD,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EAAE,EACrB,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,KAAK,EAAE,WAAW,GAAG,IAAI,EACzB,MAAM,GAAE,MAAM,EAAO,EACrB,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAC5D,QAAQ,CAAC,EAAE,MAAM,IAAI,GACpB,OAAO,WAAW,EAAE,MAAM,CAG5B"}

package/dist/server.js

@@ -11,9 +11,9 @@ import { handleOpengraphRequest, buildOgMeta } from "./opengraph.js";
 import { getLabelDefinitions, rescanLabels } from "./labels.js";
 import { triggerAutoBackfill } from "./indexer.js";
 import { emit, timer } from "./logger.js";
-import { getAuthServerMetadata, getProtectedResourceMetadata, getJwks, getClientMetadata, handlePar, buildAuthorizeRedirect, handleCallback, handleCallbackError, serverLogin, handleToken, authenticate, OAuthError, } from "./oauth/server.js";
-import { createSessionCookie, sessionCookieHeader, clearSessionCookieHeader, parseSessionCookie, } from "./oauth/session.js";
-import { getOAuthRequest } from "./oauth/db.js";
+import { getAuthServerMetadata, getProtectedResourceMetadata, getJwks, getClientMetadata, getClientJwks, handlePar, buildAuthorizeRedirect, handleCallback, handleCallbackError, serverLogin, handleToken, authenticate, OAuthError, } from "./oauth/server.js";
+import { createSessionCookie, sessionCookieHeader, clearSessionCookieHeader, parseSessionCookie, createAccountsCookie, accountsCookieHeader, clearAccountsCookieHeader, parseAccountsCookie, withAccount, withoutAccount, } from "./oauth/session.js";
+import { getOAuthRequest, getSession } from "./oauth/db.js";
 import { pdsCreateRecord, pdsDeleteRecord, pdsPutRecord, pdsApplyWrites, pdsUploadBlob, ProxyError, ScopeMissingProxyError, } from "./pds-proxy.js";
 import { json, jsonError, cors, withCors, file, notFound } from "./response.js";
 import { collectionFromUri, isPrivateCollection } from "./private-collections.js";
@@ -828,6 +828,10 @@ export function createHandler(config) {
             if ((url.pathname === '/oauth/client-metadata.json' || url.pathname === '/oauth-client-metadata.json') && oauth) {
                 return withCors(json(getClientMetadata(oauth.issuer, oauth), 200, acceptEncoding));
             }
+            // Public key a PDS fetches to verify our client assertions.
+            if (url.pathname === '/oauth/client-jwks.json' && oauth) {
+                return withCors(json(getClientJwks(), 200, acceptEncoding));
+            }
             // Dev-only: create a session cookie for any DID (for testing)
             if (url.pathname === '/__dev/login' && devMode && oauth) {
                 const did = url.searchParams.get('did');
@@ -836,12 +840,14 @@ export function createHandler(config) {
                 const handle = (await getRepoHandle(did)) ?? did;
                 const cookieValue = await createSessionCookie({ did, handle });
                 const secure = url.protocol === 'https:';
+                const accounts = await createAccountsCookie(withAccount(await parseAccountsCookie(request), { did, handle }));
                 return new Response(JSON.stringify({ ok: true }), {
                     status: 200,
-                    headers: {
-                        'Content-Type': 'application/json',
-                        'Set-Cookie': sessionCookieHeader(cookieValue, secure),
-                    },
+                    headers: [
+                        ['Content-Type', 'application/json'],
+                        ['Set-Cookie', sessionCookieHeader(cookieValue, secure)],
+                        ['Set-Cookie', accountsCookieHeader(accounts, secure)],
+                    ],
                 });
             }
             // OAuth Login (server-initiated, no DPoP required)
@@ -916,7 +922,11 @@ export function createHandler(config) {
                     const result = await handleCallback(oauth, code, state, iss);
                     const isSecure = requestOrigin.startsWith('https');
                     const handle = (await getRepoHandle(result.did)) ?? result.did;
-                    const cookie = await createSessionCookie({ did: result.did, handle });
+                    const session = { did: result.did, handle };
+                    const cookie = await createSessionCookie(session);
+                    // Remember the account alongside the active session so the browser
+                    // can switch back to it later without another trip to the PDS.
+                    const accounts = await createAccountsCookie(withAccount(await parseAccountsCookie(request), session));
                     // Server-initiated login stores redirectUri as '/' — redirect cleanly without code/iss params
                     const redirectTo = result.clientRedirectUri.startsWith('/?code=') ? '/' : result.clientRedirectUri;
                     return new Response(null, {
@@ -924,17 +934,96 @@ export function createHandler(config) {
                         headers: [
                             ['Location', redirectTo],
                             ['Set-Cookie', sessionCookieHeader(cookie, isSecure)],
+                            ['Set-Cookie', accountsCookieHeader(accounts, isSecure)],
                         ],
                     });
                 }
                 // Client-side callback — fall through to SPA
             }
-            // Session cookie logout
+            // Session cookie logout. Also drops the account from the switch list —
+            // leaving it there would keep a working path back into an account the
+            // user believes they signed out of, which matters on a shared machine.
             if (url.pathname === '/auth/logout' && request.method === 'POST') {
-                return new Response(null, {
-                    status: 200,
-                    headers: { 'Set-Cookie': clearSessionCookieHeader() },
-                });
+                const current = await parseSessionCookie(request);
+                const isSecure = requestOrigin.startsWith('https');
+                const headers = [['Set-Cookie', clearSessionCookieHeader()]];
+                if (current) {
+                    const remaining = withoutAccount(await parseAccountsCookie(request), current.did);
+                    headers.push([
+                        'Set-Cookie',
+                        remaining.length
+                            ? accountsCookieHeader(await createAccountsCookie(remaining), isSecure)
+                            : clearAccountsCookieHeader(),
+                    ]);
+                }
+                return new Response(null, { status: 200, headers });
+            }
+            // Accounts this browser may switch between. The cookie is HttpOnly, so
+            // this is the only way for a client to see what's in it.
+            if (url.pathname === '/auth/accounts' && request.method === 'GET') {
+                const stored = await parseAccountsCookie(request);
+                const active = await parseSessionCookie(request);
+                // Sessions created before this feature existed have a session cookie
+                // and no accounts cookie. Adopt the active account into the list rather
+                // than reporting it as unknown — otherwise the switcher looks empty and
+                // signing into a second account appears to drop the first.
+                const needsHealing = !!active && !stored.some((a) => a.did === active.did);
+                const accounts = needsHealing ? withAccount(stored, active) : stored;
+                // An account whose server-side OAuth session is gone can't be switched
+                // to — say so rather than letting the client offer a dead option.
+                // `__dev/login` fabricates a session with no OAuth grant behind it, so
+                // in dev every remembered account counts as switchable.
+                const resolved = await Promise.all(accounts.map(async (a) => ({ ...a, available: devMode || !!(await getSession(a.did)) })));
+                const res = withCors(json({ accounts: resolved, active: active?.did ?? null }, 200, acceptEncoding));
+                // Persist the adoption so the next switch has something to authorize
+                // against, instead of healing the list again on every load.
+                if (needsHealing) {
+                    res.headers.append('Set-Cookie', accountsCookieHeader(await createAccountsCookie(accounts), requestOrigin.startsWith('https')));
+                }
+                return res;
+            }
+            // Switch the active account without re-authorizing at the PDS.
+            //
+            // The OAuth grant belongs to this server acting for the user, not to a
+            // browser session — so once a browser has proven it owns an account, we
+            // can re-issue its session cookie from the stored session. The accounts
+            // cookie is the proof: it's encrypted with the server key, so a client
+            // can't name a DID it never signed in as.
+            if (url.pathname === '/auth/switch' && request.method === 'POST') {
+                let did;
+                try {
+                    const body = await request.json();
+                    did = typeof body?.did === 'string' ? body.did : undefined;
+                }
+                catch {
+                    return withCors(jsonError(400, 'Invalid JSON body', acceptEncoding));
+                }
+                if (!did)
+                    return withCors(jsonError(400, 'did required', acceptEncoding));
+                const accounts = await parseAccountsCookie(request);
+                const account = accounts.find((a) => a.did === did);
+                if (!account)
+                    return withCors(jsonError(403, 'Not signed in as that account', acceptEncoding));
+                if (!devMode && !(await getSession(account.did))) {
+                    // The stored grant is gone (revoked, or cleaned up). Drop it from the
+                    // list so the client stops offering it and can send the user through
+                    // a fresh sign-in instead.
+                    const isSecure = requestOrigin.startsWith('https');
+                    const remaining = withoutAccount(accounts, account.did);
+                    const res = withCors(jsonError(409, 'Session expired for that account', acceptEncoding));
+                    res.headers.append('Set-Cookie', remaining.length
+                        ? accountsCookieHeader(await createAccountsCookie(remaining), isSecure)
+                        : clearAccountsCookieHeader());
+                    return res;
+                }
+                // Refresh the handle in passing — it may have changed while dormant.
+                const handle = (await getRepoHandle(account.did)) ?? account.handle;
+                const session = { did: account.did, handle };
+                const isSecure = requestOrigin.startsWith('https');
+                const res = withCors(json({ did: session.did, handle: session.handle }, 200, acceptEncoding));
+                res.headers.append('Set-Cookie', sessionCookieHeader(await createSessionCookie(session), isSecure));
+                res.headers.append('Set-Cookie', accountsCookieHeader(await createAccountsCookie(withAccount(accounts, session)), isSecure));
+                return res;
             }
             // OAuth Token
             if (url.pathname === '/oauth/token' && request.method === 'POST' && oauth) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hatk/hatk",
-  "version": "0.0.1-alpha.72",
+  "version": "0.0.1-alpha.74",
   "license": "MIT",
   "bin": {
     "hatk": "dist/cli.js"