@openverifiable/connector-bluesky 1.0.0

package/lib/index.js

@@ -0,0 +1,1129 @@
+import got, { HTTPError } from 'got';
+import { ConnectorPlatform, ConnectorConfigFormItemType, ConnectorError, ConnectorErrorCodes, ConnectorType, validateConfig, parseJson, jsonGuard } from '@logto/connector-kit';
+import { z } from 'zod';
+import { randomBytes, createHash } from 'crypto';
+import { SignJWT, importJWK } from 'jose';
+
+// https://github.com/facebook/jest/issues/7547
+const assert = (value, error) => {
+    if (!value) {
+        // https://github.com/typescript-eslint/typescript-eslint/issues/3814
+        // eslint-disable-next-line @typescript-eslint/no-throw-literal
+        throw error;
+    }
+};
+
+/**
+ * BlueskyConfig
+ * Configuration for AT Protocol OAuth client
+ * Requires private_key_jwt for confidential client security
+ */
+const blueskyConfigGuard = z.object({
+    clientMetadataUri: z.string().url(),
+    clientId: z.string().url().optional(),
+    jwksUri: z.string().url(),
+    scope: z.string().default('atproto transition:generic'),
+    tokenEndpointAuthMethod: z.literal('private_key_jwt'),
+}).refine((data) => {
+    // JWKS URI is required for private_key_jwt
+    if (data.tokenEndpointAuthMethod === 'private_key_jwt' && !data.jwksUri) {
+        return false;
+    }
+    return true;
+}, {
+    message: 'jwksUri is required when tokenEndpointAuthMethod is private_key_jwt',
+    path: ['jwksUri'],
+});
+/**
+ * authResponseGuard
+ * Validates query parameters from AT Protocol authorization callback
+ */
+const authResponseGuard = z.object({
+    code: z.string().optional(),
+    state: z.string().optional(),
+    iss: z.string().url().optional(),
+    error: z.string().optional(),
+    error_description: z.string().optional(),
+}).passthrough();
+/**
+ * PARResponse
+ * Response from Pushed Authorization Request
+ */
+z.object({
+    request_uri: z.string(),
+    expires_in: z.number().optional(),
+});
+/**
+ * TokenResponse
+ * AT Protocol OAuth token response
+ */
+const tokenResponseGuard = z.object({
+    access_token: z.string(),
+    refresh_token: z.string().optional(),
+    token_type: z.literal('Bearer'),
+    expires_in: z.number(),
+    scope: z.string(),
+    sub: z.string(),
+    did: z.string().optional(), // Explicit DID field
+});
+/**
+ * ProfileResponse
+ * AT Protocol profile response from PDS
+ */
+const profileResponseGuard = z.object({
+    did: z.string(),
+    handle: z.string(),
+    displayName: z.string().optional(),
+    avatar: z.string().optional(),
+    email: z.string().optional(),
+    description: z.string().optional(),
+});
+/**
+ * AuthorizationServerMetadata
+ * OAuth authorization server metadata
+ */
+const authorizationServerMetadataGuard = z.object({
+    issuer: z.string().url(),
+    pushed_authorization_request_endpoint: z.string().url(),
+    authorization_endpoint: z.string().url(),
+    token_endpoint: z.string().url(),
+    scopes_supported: z.string(),
+});
+/**
+ * ResourceServerMetadata
+ * OAuth protected resource metadata
+ */
+const resourceServerMetadataGuard = z.object({
+    authorization_servers: z.array(z.string().url()),
+});
+/**
+ * DIDDocument
+ * AT Protocol DID document structure
+ */
+const didDocumentGuard = z.object({
+    id: z.string(),
+    service: z.array(z.object({
+        type: z.string(),
+        serviceEndpoint: z.string().url(),
+    })).optional(),
+});
+
+// Connector Metadata
+const defaultMetadata = {
+    id: 'bluesky-web',
+    target: 'bluesky',
+    platform: ConnectorPlatform.Web,
+    name: {
+        en: 'Bluesky',
+    },
+    logo: './logo.svg',
+    logoDark: './logo-dark.svg',
+    description: {
+        en: 'Sign in with Bluesky via AT Protocol OAuth. Supports custom PDS instances with PAR, PKCE, and DPoP.',
+    },
+    readme: './README.md',
+    formItems: [
+        {
+            key: 'clientMetadataUri',
+            type: ConnectorConfigFormItemType.Text,
+            required: true,
+            label: 'Client Metadata URI',
+            placeholder: 'https://yourdomain.com/.well-known/oauth-client-metadata.json',
+            description: 'Publicly accessible URL to your OAuth client metadata',
+        },
+        {
+            key: 'clientId',
+            type: ConnectorConfigFormItemType.Text,
+            required: true,
+            label: 'Client ID',
+            placeholder: 'https://yourdomain.com/client-id',
+            description: 'OAuth client identifier (usually same as metadata URI)',
+        },
+        {
+            key: 'jwksUri',
+            type: ConnectorConfigFormItemType.Text,
+            required: true,
+            label: 'JWKS URI',
+            placeholder: 'https://yourdomain.com/.well-known/jwks.json',
+            description: 'Public key set for client authentication (required for confidential clients with private_key_jwt)',
+        },
+        {
+            key: 'scope',
+            type: ConnectorConfigFormItemType.Text,
+            required: false,
+            label: 'OAuth Scopes',
+            placeholder: 'atproto transition:generic',
+            defaultValue: 'atproto transition:generic',
+            description: 'Space-separated OAuth scopes',
+        },
+    ],
+};
+// Well-known paths for AT Protocol
+const WELL_KNOWN_PATHS = {
+    OAUTH_CLIENT_METADATA: '/.well-known/oauth-client-metadata.json',
+    OAUTH_AUTHORIZATION_SERVER: '/.well-known/oauth-authorization-server',
+    OAUTH_PROTECTED_RESOURCE: '/.well-known/oauth-protected-resource',
+    ATPROTO_DID: '/.well-known/atproto-did',
+};
+// HTTP client settings for SSRF hardening
+const HTTP_CLIENT_CONFIG = {
+    timeout: 10000,
+    maxRedirects: 3,
+    maxResponseSize: 1024 * 1024, // 1MB
+};
+// PKCE settings
+const PKCE_CONFIG = {
+    codeVerifierLength: 43,
+    codeChallengeMethod: 'S256',
+};
+// DPoP settings
+const DPOP_CONFIG = {
+    algorithm: 'ES256',
+    keyUsages: ['sign'],
+    jtiLength: 16, // Random token length
+};
+
+/**
+ * Generate a random code verifier for PKCE (RFC 7636)
+ * Returns base64url-encoded string of 32-96 random bytes
+ */
+function generateCodeVerifier() {
+    // Generate 32 random bytes (256 bits) for good security
+    const bytes = randomBytes(32);
+    // Convert to base64url (URL-safe base64)
+    return base64UrlEncode$1(bytes);
+}
+/**
+ * Generate code challenge from verifier using S256 method
+ * S256 = SHA256(code_verifier) encoded as base64url
+ */
+function generateCodeChallenge(verifier) {
+    const hash = createHash('sha256');
+    hash.update(verifier);
+    const digest = hash.digest();
+    return base64UrlEncode$1(digest);
+}
+/**
+ * Generate PKCE code pair (verifier + challenge)
+ */
+function generatePKCECodePair() {
+    const codeVerifier = generateCodeVerifier();
+    const codeChallenge = generateCodeChallenge(codeVerifier);
+    return {
+        codeVerifier,
+        codeChallenge,
+        codeChallengeMethod: PKCE_CONFIG.codeChallengeMethod,
+    };
+}
+/**
+ * Base64url encode (URL-safe base64)
+ * Replaces + with -, / with _, and removes padding =
+ */
+function base64UrlEncode$1(buffer) {
+    return buffer
+        .toString('base64')
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=/g, '');
+}
+
+/**
+ * Generate ES256 DPoP key pair
+ * Uses Web Crypto API (Node.js crypto.webcrypto)
+ */
+async function generateDPoPKeyPair() {
+    const crypto = globalThis.crypto || (await import('crypto')).webcrypto;
+    const keyPair = await crypto.subtle.generateKey({
+        name: 'ECDSA',
+        namedCurve: 'P-256', // ES256 uses P-256
+    }, true, // extractable (needed for server-side storage)
+    DPOP_CONFIG.keyUsages);
+    return {
+        publicKey: keyPair.publicKey,
+        privateKey: keyPair.privateKey,
+    };
+}
+/**
+ * Export public key as JWK for inclusion in DPoP proof header
+ */
+async function exportPublicKeyAsJWK(publicKey) {
+    const crypto = globalThis.crypto || (await import('crypto')).webcrypto;
+    const jwk = await crypto.subtle.exportKey('jwk', publicKey);
+    // Remove private key fields if present
+    const { d, ...publicJwk } = jwk;
+    return publicJwk;
+}
+/**
+ * Create DPoP proof JWT for token endpoint requests
+ */
+async function createDPoPProofForToken(keyPair, httpMethod, tokenEndpointUrl, nonce) {
+    const crypto = globalThis.crypto || (await import('crypto')).webcrypto;
+    const publicKeyJwk = await exportPublicKeyAsJWK(keyPair.publicKey);
+    // Generate unique jti
+    const jti = base64UrlEncode(randomBytes(DPOP_CONFIG.jtiLength));
+    const now = Math.floor(Date.now() / 1000);
+    const jwt = new SignJWT({
+        jti,
+        htm: httpMethod,
+        htu: tokenEndpointUrl,
+        iat: now,
+        exp: now + 60,
+        ...(nonce && { nonce }),
+    })
+        .setProtectedHeader({
+        typ: 'dpop+jwt',
+        alg: DPOP_CONFIG.algorithm,
+        jwk: publicKeyJwk,
+    });
+    // Sign with private key
+    // Note: jose library handles the signing, but we need to convert CryptoKey to JWK format
+    // For now, we'll use a workaround - in production, you'd use a proper JWT library
+    // that supports CryptoKey directly
+    // This is a simplified version - in production, use a library that supports CryptoKey
+    // For now, we'll need to export the private key and use it with jose
+    const privateKeyJwk = await crypto.subtle.exportKey('jwk', keyPair.privateKey);
+    // Ensure kty is defined and cast to JWK
+    if (!privateKeyJwk.kty || typeof privateKeyJwk.kty !== 'string') {
+        throw new Error('Private key JWK missing kty field');
+    }
+    // Import as JWK for jose - create a properly typed JWK object
+    const { importJWK } = await import('jose');
+    const jwkWithKty = {
+        ...privateKeyJwk,
+        kty: privateKeyJwk.kty,
+    };
+    const signingKey = await importJWK(jwkWithKty, DPOP_CONFIG.algorithm);
+    return await jwt.sign(signingKey);
+}
+/**
+ * Create DPoP proof JWT for resource server (PDS) requests
+ * Includes ath (access token hash) field
+ */
+async function createDPoPProofForResource(keyPair, httpMethod, resourceUrl, accessToken, nonce) {
+    const crypto = globalThis.crypto || (await import('crypto')).webcrypto;
+    const publicKeyJwk = await exportPublicKeyAsJWK(keyPair.publicKey);
+    // Hash access token for ath field (same as S256 PKCE challenge)
+    const tokenHash = createHash('sha256').update(accessToken).digest();
+    const ath = base64UrlEncode(tokenHash);
+    const jti = base64UrlEncode(randomBytes(DPOP_CONFIG.jtiLength));
+    const now = Math.floor(Date.now() / 1000);
+    const jwt = new SignJWT({
+        jti,
+        htm: httpMethod,
+        htu: resourceUrl,
+        iat: now,
+        exp: now + 60,
+        ath,
+        ...(nonce && { nonce }),
+    })
+        .setProtectedHeader({
+        typ: 'dpop+jwt',
+        alg: DPOP_CONFIG.algorithm,
+        jwk: publicKeyJwk,
+    });
+    const privateKeyJwk = await crypto.subtle.exportKey('jwk', keyPair.privateKey);
+    // Ensure kty is defined and cast to JWK
+    if (!privateKeyJwk.kty || typeof privateKeyJwk.kty !== 'string') {
+        throw new Error('Private key JWK missing kty field');
+    }
+    // Import as JWK for jose - create a properly typed JWK object
+    const { importJWK } = await import('jose');
+    const jwkWithKty = {
+        ...privateKeyJwk,
+        kty: privateKeyJwk.kty,
+    };
+    const signingKey = await importJWK(jwkWithKty, DPOP_CONFIG.algorithm);
+    return await jwt.sign(signingKey);
+}
+/**
+ * Extract DPoP nonce from response headers
+ */
+function extractDPoPNonce(headers) {
+    if (headers instanceof Headers) {
+        return headers.get('dpop-nonce') || null;
+    }
+    const dpopNonce = headers['dpop-nonce'] || headers['DPoP-Nonce'];
+    if (typeof dpopNonce === 'string') {
+        return dpopNonce;
+    }
+    if (Array.isArray(dpopNonce) && dpopNonce.length > 0 && typeof dpopNonce[0] === 'string') {
+        return dpopNonce[0];
+    }
+    return null;
+}
+/**
+ * Base64url encode
+ */
+function base64UrlEncode(buffer) {
+    return buffer
+        .toString('base64')
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=/g, '');
+}
+
+/**
+ * Validate URL to prevent SSRF attacks
+ * Rejects localhost, private IPs, and link-local addresses
+ */
+function validateUrl(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        throw new ConnectorError(ConnectorErrorCodes.InvalidConfig, {
+            error: `Invalid URL: ${url}`,
+        });
+    }
+    // Must be HTTPS
+    if (parsed.protocol !== 'https:') {
+        throw new ConnectorError(ConnectorErrorCodes.InvalidConfig, {
+            error: 'URL must use HTTPS protocol',
+        });
+    }
+    // Check for localhost or private IPs
+    const hostname = parsed.hostname.toLowerCase();
+    if (hostname === 'localhost' ||
+        hostname === '127.0.0.1' ||
+        hostname === '::1' ||
+        hostname.startsWith('192.168.') ||
+        hostname.startsWith('10.') ||
+        hostname.startsWith('172.16.') ||
+        hostname.startsWith('172.17.') ||
+        hostname.startsWith('172.18.') ||
+        hostname.startsWith('172.19.') ||
+        hostname.startsWith('172.20.') ||
+        hostname.startsWith('172.21.') ||
+        hostname.startsWith('172.22.') ||
+        hostname.startsWith('172.23.') ||
+        hostname.startsWith('172.24.') ||
+        hostname.startsWith('172.25.') ||
+        hostname.startsWith('172.26.') ||
+        hostname.startsWith('172.27.') ||
+        hostname.startsWith('172.28.') ||
+        hostname.startsWith('172.29.') ||
+        hostname.startsWith('172.30.') ||
+        hostname.startsWith('172.31.') ||
+        hostname.startsWith('169.254.') || // Link-local
+        hostname.startsWith('fe80:') // IPv6 link-local
+    ) {
+        throw new ConnectorError(ConnectorErrorCodes.InvalidConfig, {
+            error: 'URL must not point to localhost or private IP addresses',
+        });
+    }
+}
+/**
+ * Hardened HTTP fetch with SSRF protection
+ */
+async function hardenedFetch(url, options = {}) {
+    validateUrl(url);
+    try {
+        const method = options.method || 'GET';
+        const response = await got(url, {
+            method,
+            headers: options.headers,
+            body: options.body,
+            timeout: {
+                request: HTTP_CLIENT_CONFIG.timeout,
+            },
+            followRedirect: true,
+            maxRedirects: HTTP_CLIENT_CONFIG.maxRedirects,
+        });
+        // Convert got response to Response-like object
+        return {
+            ok: response.statusCode >= 200 && response.statusCode < 300,
+            status: response.statusCode,
+            statusText: response.statusMessage || '',
+            headers: new Headers(response.headers),
+            text: async () => response.body,
+            json: async () => JSON.parse(response.body),
+        };
+    }
+    catch (error) {
+        if (error instanceof Error) {
+            throw new ConnectorError(ConnectorErrorCodes.General, {
+                error: `HTTP request failed: ${error.message}`,
+            });
+        }
+        throw error;
+    }
+}
+/**
+ * Resolve handle to DID via .well-known/atproto-did
+ */
+async function resolveHandleToDID(handle) {
+    // Remove @ prefix if present
+    const cleanHandle = handle.startsWith('@') ? handle.slice(1) : handle;
+    // Try .well-known/atproto-did first
+    const wellKnownUrl = `https://${cleanHandle}${WELL_KNOWN_PATHS.ATPROTO_DID}`;
+    try {
+        validateUrl(wellKnownUrl);
+        const response = await hardenedFetch(wellKnownUrl);
+        if (response.ok) {
+            const did = await response.text();
+            return did.trim();
+        }
+    }
+    catch (error) {
+        // Fall through to DNS TXT resolution (not implemented here - would need DNS library)
+        // For now, throw error
+        throw new ConnectorError(ConnectorErrorCodes.General, {
+            error: `Could not resolve handle to DID: ${error instanceof Error ? error.message : 'Unknown error'}`,
+        });
+    }
+    throw new ConnectorError(ConnectorErrorCodes.General, {
+        error: `Could not resolve handle: ${handle}`,
+    });
+}
+/**
+ * Resolve DID to PDS endpoint from DID document
+ */
+async function resolvePDSFromDID(did) {
+    // For did:plc, use plc.directory
+    if (did.startsWith('did:plc:')) {
+        const didPath = did.replace('did:plc:', '');
+        const didDocUrl = `https://plc.directory/${didPath}`;
+        try {
+            validateUrl(didDocUrl);
+            const response = await hardenedFetch(didDocUrl);
+            if (response.ok) {
+                const didDoc = await response.json();
+                const parsed = didDocumentGuard.safeParse(didDoc);
+                if (parsed.success) {
+                    const pdsService = parsed.data.service?.find((s) => s.type === 'AtprotoPersonalDataServer');
+                    if (pdsService?.serviceEndpoint) {
+                        validateUrl(pdsService.serviceEndpoint);
+                        return pdsService.serviceEndpoint;
+                    }
+                }
+            }
+        }
+        catch (error) {
+            throw new ConnectorError(ConnectorErrorCodes.General, {
+                error: `Could not resolve DID document: ${error instanceof Error ? error.message : 'Unknown error'}`,
+            });
+        }
+    }
+    // For did:web, resolve from domain
+    if (did.startsWith('did:web:')) {
+        const domain = did.replace('did:web:', '').replace(/:/g, '/');
+        const didDocUrl = `https://${domain}/.well-known/did.json`;
+        try {
+            validateUrl(didDocUrl);
+            const response = await hardenedFetch(didDocUrl);
+            if (response.ok) {
+                const didDoc = await response.json();
+                const parsed = didDocumentGuard.safeParse(didDoc);
+                if (parsed.success) {
+                    const pdsService = parsed.data.service?.find((s) => s.type === 'AtprotoPersonalDataServer');
+                    if (pdsService?.serviceEndpoint) {
+                        validateUrl(pdsService.serviceEndpoint);
+                        return pdsService.serviceEndpoint;
+                    }
+                }
+            }
+        }
+        catch (error) {
+            throw new ConnectorError(ConnectorErrorCodes.General, {
+                error: `Could not resolve DID document: ${error instanceof Error ? error.message : 'Unknown error'}`,
+            });
+        }
+    }
+    throw new ConnectorError(ConnectorErrorCodes.General, {
+        error: `Unsupported DID method or PDS not found for: ${did}`,
+    });
+}
+/**
+ * Resolve handle or DID to PDS endpoint
+ */
+async function resolvePDS(identifier) {
+    // If it's already a DID, resolve directly
+    if (identifier.startsWith('did:')) {
+        return resolvePDSFromDID(identifier);
+    }
+    // Otherwise, treat as handle and resolve to DID first
+    const did = await resolveHandleToDID(identifier);
+    return resolvePDSFromDID(did);
+}
+/**
+ * Fetch authorization server metadata from PDS
+ */
+async function fetchAuthorizationServerMetadata(pdsUrl) {
+    // First try protected resource metadata
+    const resourceMetadataUrl = `${pdsUrl}${WELL_KNOWN_PATHS.OAUTH_PROTECTED_RESOURCE}`;
+    try {
+        validateUrl(resourceMetadataUrl);
+        const resourceResponse = await hardenedFetch(resourceMetadataUrl);
+        if (resourceResponse.ok) {
+            const resourceMetadata = await resourceResponse.json();
+            const parsed = resourceServerMetadataGuard.safeParse(resourceMetadata);
+            if (parsed.success && parsed.data.authorization_servers.length > 0) {
+                // Use first authorization server
+                const authServerBase = parsed.data.authorization_servers[0];
+                if (authServerBase) {
+                    // Construct full metadata URL
+                    const authServerUrl = `${authServerBase}${WELL_KNOWN_PATHS.OAUTH_AUTHORIZATION_SERVER}`;
+                    return fetchAuthorizationServerMetadataFromUrl(authServerUrl);
+                }
+            }
+        }
+    }
+    catch {
+        // Fall through to try PDS directly as auth server
+    }
+    // Try PDS directly as authorization server
+    const authServerUrl = `${pdsUrl}${WELL_KNOWN_PATHS.OAUTH_AUTHORIZATION_SERVER}`;
+    return fetchAuthorizationServerMetadataFromUrl(authServerUrl);
+}
+/**
+ * Fetch authorization server metadata from specific URL
+ */
+async function fetchAuthorizationServerMetadataFromUrl(authServerUrl) {
+    validateUrl(authServerUrl);
+    const response = await hardenedFetch(authServerUrl);
+    if (!response.ok) {
+        throw new ConnectorError(ConnectorErrorCodes.General, {
+            error: `Failed to fetch authorization server metadata: ${response.status} ${response.statusText}`,
+        });
+    }
+    const metadata = await response.json();
+    const parsed = authorizationServerMetadataGuard.safeParse(metadata);
+    if (!parsed.success) {
+        throw new ConnectorError(ConnectorErrorCodes.InvalidResponse, {
+            error: 'Invalid authorization server metadata format',
+        });
+    }
+    // Validate that atproto scope is supported
+    const scopesSupported = parsed.data.scopes_supported;
+    if (typeof scopesSupported === 'string') {
+        const scopes = scopesSupported.split(' ');
+        if (!scopes.includes('atproto')) {
+            throw new ConnectorError(ConnectorErrorCodes.InvalidConfig, {
+                error: 'Authorization server does not support atproto scope',
+            });
+        }
+    }
+    return parsed.data;
+}
+
+/**
+ * Client Assertion Generation for private_key_jwt
+ *
+ * Generates JWT client assertion for OAuth token endpoint authentication
+ * RFC 7523: https://datatracker.ietf.org/doc/html/rfc7523
+ */
+/**
+ * Generate client assertion JWT
+ *
+ * Note: This requires access to the private key, which should be:
+ * 1. Stored in Logto connector config (encrypted by Logto), OR
+ * 2. Retrieved from a secure server endpoint
+ *
+ * For now, we'll support both approaches - if privateKeyJwk is in config, use it.
+ * Otherwise, the server should provide an endpoint to generate assertions.
+ */
+async function generateClientAssertion(clientId, tokenEndpoint, config) {
+    // Check if private key is available in config (for server-side connectors)
+    // In production, this would come from Vault via a server endpoint
+    const privateKeyJwkStr = config.privateKeyJwk;
+    if (!privateKeyJwkStr) {
+        // Private key not in config - would need to call server endpoint
+        // For now, return null to indicate assertion generation failed
+        return null;
+    }
+    try {
+        const privateKeyJwk = JSON.parse(privateKeyJwkStr);
+        const privateKey = await importJWK(privateKeyJwk, 'ES256');
+        const now = Math.floor(Date.now() / 1000);
+        const jti = randomBytes(16).toString('base64url');
+        const jwt = new SignJWT({
+            iss: clientId,
+            sub: clientId,
+            aud: tokenEndpoint,
+            jti,
+            exp: now + 600,
+            iat: now,
+        })
+            .setProtectedHeader({
+            alg: 'ES256',
+            typ: 'JWT',
+        });
+        return await jwt.sign(privateKey);
+    }
+    catch (error) {
+        throw new Error(`Failed to generate client assertion: ${error instanceof Error ? error.message : 'Unknown error'}`);
+    }
+}
+
+/**
+ * Bluesky/AT Protocol OAuth 2.0 connector implementation
+ * Implements PAR (Pushed Authorization Requests), PKCE, and DPoP
+ * https://atproto.com/specs/oauth
+ */
+const defaultTimeout = 10000;
+/**
+ * Make PAR (Pushed Authorization Request) with DPoP and nonce retry
+ */
+async function makePARRequest(parEndpoint, params, dpopKeyPair, nonce) {
+    let currentNonce = nonce;
+    let retries = 0;
+    const maxRetries = 3;
+    while (retries < maxRetries) {
+        try {
+            const dpopProof = await createDPoPProofForToken(dpopKeyPair, 'POST', parEndpoint, currentNonce);
+            const response = await got.post(parEndpoint, {
+                headers: {
+                    'Content-Type': 'application/x-www-form-urlencoded',
+                    'DPoP': dpopProof,
+                },
+                body: params.toString(),
+                timeout: { request: defaultTimeout },
+            });
+            // Check for nonce in response
+            const responseNonce = extractDPoPNonce(response.headers);
+            if (responseNonce && responseNonce !== currentNonce) {
+                currentNonce = responseNonce;
+            }
+            const result = parseJson(response.body);
+            if (result && result.request_uri) {
+                return {
+                    requestUri: result.request_uri,
+                    nonce: currentNonce || '',
+                };
+            }
+            // Check for use_dpop_nonce error
+            if (result && result.error === 'use_dpop_nonce') {
+                currentNonce = responseNonce || result.nonce || '';
+                retries++;
+                continue;
+            }
+            throw new ConnectorError(ConnectorErrorCodes.InvalidResponse, {
+                error: `PAR request failed: ${result?.error || 'Unknown error'}`,
+            });
+        }
+        catch (error) {
+            if (error instanceof HTTPError) {
+                const body = error.response?.body;
+                let errorData;
+                try {
+                    errorData = typeof body === 'string' ? parseJson(body) : body;
+                }
+                catch {
+                    errorData = body;
+                }
+                // Check for use_dpop_nonce error
+                if (errorData && typeof errorData === 'object' && 'error' in errorData && errorData.error === 'use_dpop_nonce') {
+                    const headers = error.response?.headers || {};
+                    currentNonce = extractDPoPNonce(headers) || errorData.nonce || '';
+                    retries++;
+                    continue;
+                }
+                throw new ConnectorError(ConnectorErrorCodes.General, {
+                    error: `PAR request failed: ${error.response?.statusCode} ${error.response?.statusMessage}`,
+                });
+            }
+            throw error;
+        }
+    }
+    throw new ConnectorError(ConnectorErrorCodes.General, {
+        error: 'PAR request failed after retries',
+    });
+}
+/**
+ * Exchange authorization code for tokens with DPoP and nonce retry
+ */
+async function exchangeCodeForTokens(code, redirectUri, tokenEndpoint, codeVerifier, dpopKeyPair, nonce, config) {
+    let currentNonce = nonce;
+    let retries = 0;
+    const maxRetries = 3;
+    while (retries < maxRetries) {
+        try {
+            const dpopProof = await createDPoPProofForToken(dpopKeyPair, 'POST', tokenEndpoint, currentNonce);
+            // Use clientId if provided, otherwise default to clientMetadataUri
+            const effectiveClientId = config.clientId || config.clientMetadataUri;
+            const params = new URLSearchParams({
+                grant_type: 'authorization_code',
+                code,
+                redirect_uri: redirectUri,
+                code_verifier: codeVerifier,
+                client_id: effectiveClientId,
+            });
+            const headers = {
+                'Content-Type': 'application/x-www-form-urlencoded',
+                'DPoP': dpopProof,
+            };
+            // For confidential clients, add client assertion JWT
+            if (config.tokenEndpointAuthMethod === 'private_key_jwt') {
+                try {
+                    const clientAssertion = await generateClientAssertion(effectiveClientId, tokenEndpoint, config);
+                    if (clientAssertion) {
+                        params.append('client_assertion', clientAssertion);
+                        params.append('client_assertion_type', 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer');
+                    }
+                    else {
+                        // If assertion generation failed, try to get it from server endpoint
+                        const assertionEndpoint = config.assertionEndpoint;
+                        if (assertionEndpoint) {
+                            const assertionResponse = await got.post(assertionEndpoint, {
+                                json: { clientId: effectiveClientId, tokenEndpoint },
+                                headers: {
+                                    'X-API-Key': config.assertionApiKey || '',
+                                },
+                                timeout: { request: defaultTimeout },
+                            });
+                            const assertionData = parseJson(assertionResponse.body);
+                            if (assertionData?.client_assertion) {
+                                params.append('client_assertion', assertionData.client_assertion);
+                                params.append('client_assertion_type', 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer');
+                            }
+                            else {
+                                throw new ConnectorError(ConnectorErrorCodes.InvalidConfig, {
+                                    error: 'Client assertion required for private_key_jwt but could not be generated',
+                                });
+                            }
+                        }
+                        else {
+                            throw new ConnectorError(ConnectorErrorCodes.InvalidConfig, {
+                                error: 'Client assertion required for private_key_jwt but could not be generated. Provide privateKeyJwk in config or assertionEndpoint.',
+                            });
+                        }
+                    }
+                }
+                catch (error) {
+                    if (error instanceof ConnectorError) {
+                        throw error;
+                    }
+                    throw new ConnectorError(ConnectorErrorCodes.General, {
+                        error: `Failed to generate client assertion: ${error instanceof Error ? error.message : 'Unknown error'}`,
+                    });
+                }
+            }
+            const response = await got.post(tokenEndpoint, {
+                headers,
+                body: params.toString(),
+                timeout: { request: defaultTimeout },
+            });
+            const responseNonce = extractDPoPNonce(response.headers);
+            if (responseNonce && responseNonce !== currentNonce) {
+                currentNonce = responseNonce;
+            }
+            const result = tokenResponseGuard.safeParse(parseJson(response.body));
+            if (result.success) {
+                return {
+                    tokens: result.data,
+                    nonce: currentNonce,
+                };
+            }
+            // Check for use_dpop_nonce error
+            const parsed = parseJson(response.body);
+            if (parsed && typeof parsed === 'object' && 'error' in parsed && parsed.error === 'use_dpop_nonce') {
+                currentNonce = responseNonce || parsed.nonce || '';
+                retries++;
+                continue;
+            }
+            throw new ConnectorError(ConnectorErrorCodes.InvalidResponse, result.error);
+        }
+        catch (error) {
+            if (error instanceof HTTPError) {
+                const body = error.response?.body;
+                let errorData;
+                try {
+                    errorData = typeof body === 'string' ? parseJson(body) : body;
+                }
+                catch {
+                    errorData = body;
+                }
+                if (errorData && typeof errorData === 'object' && 'error' in errorData && errorData.error === 'use_dpop_nonce') {
+                    const headers = error.response?.headers || {};
+                    currentNonce = extractDPoPNonce(headers) || errorData.nonce || '';
+                    retries++;
+                    continue;
+                }
+                throw new ConnectorError(ConnectorErrorCodes.General, {
+                    error: `Token exchange failed: ${error.response?.statusCode} ${error.response?.statusMessage}`,
+                });
+            }
+            throw error;
+        }
+    }
+    throw new ConnectorError(ConnectorErrorCodes.General, {
+        error: 'Token exchange failed after retries',
+    });
+}
+/**
+ * Fetch user profile from PDS with DPoP
+ */
+async function fetchProfile(pdsUrl, accessToken, did, dpopKeyPair, nonce) {
+    let currentNonce = nonce;
+    let retries = 0;
+    const maxRetries = 3;
+    // AT Protocol profile endpoint
+    const profileUrl = `${pdsUrl}/xrpc/app.bsky.actor.getProfile?actor=${encodeURIComponent(did)}`;
+    while (retries < maxRetries) {
+        try {
+            const dpopProof = await createDPoPProofForResource(dpopKeyPair, 'GET', profileUrl, accessToken, currentNonce);
+            const response = await got.get(profileUrl, {
+                headers: {
+                    'Authorization': `DPoP ${accessToken}`,
+                    'DPoP': dpopProof,
+                },
+                timeout: { request: defaultTimeout },
+            });
+            const responseNonce = extractDPoPNonce(response.headers);
+            if (responseNonce && responseNonce !== currentNonce) {
+                currentNonce = responseNonce;
+            }
+            const result = profileResponseGuard.safeParse(parseJson(response.body));
+            if (result.success) {
+                return result.data;
+            }
+            // Check for use_dpop_nonce error
+            const parsed = parseJson(response.body);
+            if (parsed && typeof parsed === 'object' && 'error' in parsed && parsed.error === 'use_dpop_nonce') {
+                currentNonce = responseNonce || parsed.nonce || '';
+                retries++;
+                continue;
+            }
+            throw new ConnectorError(ConnectorErrorCodes.InvalidResponse, result.error);
+        }
+        catch (error) {
+            if (error instanceof HTTPError) {
+                const wwwAuth = error.response?.headers['www-authenticate'];
+                if (wwwAuth && wwwAuth.includes('use_dpop_nonce')) {
+                    // Extract nonce from WWW-Authenticate header
+                    const nonceMatch = wwwAuth.match(/nonce="([^"]+)"/);
+                    if (nonceMatch) {
+                        currentNonce = nonceMatch[1];
+                        retries++;
+                        continue;
+                    }
+                }
+                throw new ConnectorError(ConnectorErrorCodes.General, {
+                    error: `Profile fetch failed: ${error.response?.statusCode} ${error.response?.statusMessage}`,
+                });
+            }
+            throw error;
+        }
+    }
+    throw new ConnectorError(ConnectorErrorCodes.General, {
+        error: 'Profile fetch failed after retries',
+    });
+}
+/**
+ * Generate authorization URI using PAR
+ */
+const getAuthorizationUri = (getConfig) => async ({ state, redirectUri, ...rest }) => {
+    const config = await getConfig(defaultMetadata.id);
+    validateConfig(config, blueskyConfigGuard);
+    const validatedConfig = config;
+    // Use clientId if provided, otherwise default to clientMetadataUri
+    const effectiveClientId = validatedConfig.clientId || validatedConfig.clientMetadataUri;
+    // Generate PKCE code pair
+    const pkce = generatePKCECodePair();
+    // Generate DPoP key pair
+    const dpopKeyPair = await generateDPoPKeyPair();
+    // Resolve PDS from login_hint if provided, otherwise use default
+    let authServerMetadata;
+    if ('login_hint' in rest && rest.login_hint) {
+        const pdsUrl = await resolvePDS(rest.login_hint);
+        authServerMetadata = await fetchAuthorizationServerMetadata(pdsUrl);
+    }
+    else {
+        // Use default bsky.social for now
+        // In production, you'd want to discover this differently
+        authServerMetadata = await fetchAuthorizationServerMetadata('https://bsky.social');
+    }
+    // Make PAR request
+    const parParams = new URLSearchParams({
+        client_id: effectiveClientId,
+        redirect_uri: redirectUri,
+        response_type: 'code',
+        scope: validatedConfig.scope,
+        state,
+        code_challenge: pkce.codeChallenge,
+        code_challenge_method: pkce.codeChallengeMethod,
+        ...('login_hint' in rest && rest.login_hint ? { login_hint: String(rest.login_hint) } : {}),
+    });
+    const { requestUri, nonce } = await makePARRequest(authServerMetadata.pushed_authorization_request_endpoint, parParams, dpopKeyPair);
+    // Store PKCE verifier and DPoP key pair in state store
+    // Export DPoP keypair as JWK for storage
+    const crypto = globalThis.crypto || (await import('crypto')).webcrypto;
+    const publicKeyJwk = await crypto.subtle.exportKey('jwk', dpopKeyPair.publicKey);
+    const privateKeyJwk = await crypto.subtle.exportKey('jwk', dpopKeyPair.privateKey);
+    // Try to store state via server endpoint if available
+    const stateEndpoint = config.stateEndpoint;
+    const stateApiKey = config.stateApiKey;
+    if (stateEndpoint && stateApiKey) {
+        try {
+            await got.post(stateEndpoint, {
+                json: {
+                    state,
+                    action: 'store',
+                    data: {
+                        pkce,
+                        dpopKeyPair: {
+                            publicKeyJwk: JSON.stringify(publicKeyJwk),
+                            privateKeyJwk: JSON.stringify(privateKeyJwk),
+                        },
+                        requestUri,
+                        authServerNonce: nonce,
+                    },
+                },
+                headers: {
+                    'X-API-Key': stateApiKey,
+                },
+                timeout: { request: defaultTimeout },
+            });
+        }
+        catch (error) {
+            // Log but don't fail - state storage is best effort
+            console.warn('Failed to store OAuth state:', error);
+        }
+    }
+    // Build authorization URL with request_uri
+    const authParams = new URLSearchParams({
+        client_id: effectiveClientId,
+        request_uri: requestUri,
+    });
+    const queryString = authParams.toString();
+    const endpoint = authServerMetadata.authorization_endpoint;
+    // @ts-expect-error - TypeScript compiler limitation with deeply nested generic types
+    return `${endpoint}?${queryString}`;
+};
+/**
+ * Handle authorization callback and fetch user info
+ */
+const getUserInfo = (getConfig) => async (data) => {
+    const { code, state, iss } = await authResponseGuard.parse(data);
+    const { redirectUri } = data;
+    assert(code, new ConnectorError(ConnectorErrorCodes.InvalidResponse, 'Missing authorization code'));
+    assert(iss, new ConnectorError(ConnectorErrorCodes.InvalidResponse, 'Missing authorization server issuer'));
+    const config = await getConfig(defaultMetadata.id);
+    validateConfig(config, blueskyConfigGuard);
+    const validatedConfig = config;
+    // Fetch authorization server metadata
+    const authServerMetadata = await fetchAuthorizationServerMetadataFromIssuer(iss);
+    // Retrieve PKCE verifier and DPoP key pair from state store
+    assert(state, new ConnectorError(ConnectorErrorCodes.InvalidResponse, 'Missing state parameter'));
+    const stateEndpoint = validatedConfig.stateEndpoint;
+    const stateApiKey = validatedConfig.stateApiKey;
+    let pkce;
+    let dpopKeyPair;
+    let authServerNonce = '';
+    if (stateEndpoint && stateApiKey) {
+        try {
+            const stateResponse = await got.post(stateEndpoint, {
+                json: {
+                    state,
+                    action: 'get',
+                },
+                headers: {
+                    'X-API-Key': stateApiKey,
+                },
+                timeout: { request: defaultTimeout },
+            });
+            const stateData = parseJson(stateResponse.body);
+            if (stateData?.pkce && stateData.dpopKeyPair) {
+                pkce = stateData.pkce;
+                authServerNonce = stateData.authServerNonce || '';
+                // Reconstruct DPoP keypair from JWK
+                const crypto = globalThis.crypto || (await import('crypto')).webcrypto;
+                const { importJWK } = await import('jose');
+                const publicKeyJwk = JSON.parse(stateData.dpopKeyPair.publicKeyJwk);
+                const privateKeyJwk = JSON.parse(stateData.dpopKeyPair.privateKeyJwk);
+                const publicKey = await importJWK(publicKeyJwk, 'ES256');
+                const privateKey = await importJWK(privateKeyJwk, 'ES256');
+                dpopKeyPair = {
+                    publicKey: publicKey,
+                    privateKey: privateKey,
+                };
+                // Delete state after use
+                try {
+                    await got.post(stateEndpoint, {
+                        json: { state, action: 'delete' },
+                        headers: { 'X-API-Key': stateApiKey },
+                        timeout: { request: defaultTimeout },
+                    });
+                }
+                catch {
+                    // Ignore delete errors
+                }
+            }
+            else {
+                throw new ConnectorError(ConnectorErrorCodes.InvalidResponse, {
+                    error: 'Invalid state data retrieved',
+                });
+            }
+        }
+        catch (error) {
+            if (error instanceof ConnectorError) {
+                throw error;
+            }
+            // Fall back to generating new keys (not ideal, but allows flow to continue)
+            console.warn('Failed to retrieve OAuth state, generating new keys:', error);
+            pkce = generatePKCECodePair();
+            dpopKeyPair = await generateDPoPKeyPair();
+        }
+    }
+    else {
+        // No state endpoint configured - generate new keys (not secure, but allows flow)
+        console.warn('State endpoint not configured - generating new PKCE/DPoP keys (not recommended)');
+        pkce = generatePKCECodePair();
+        dpopKeyPair = await generateDPoPKeyPair();
+    }
+    // Exchange code for tokens
+    const { tokens, nonce } = await exchangeCodeForTokens(code, redirectUri, authServerMetadata.token_endpoint, pkce.codeVerifier, dpopKeyPair, authServerNonce, // Use nonce from state if available
+    validatedConfig);
+    // Verify DID matches expected (if login_hint was provided)
+    const did = tokens.did || tokens.sub;
+    assert(did, new ConnectorError(ConnectorErrorCodes.InvalidResponse, 'Missing DID in token response'));
+    // Resolve PDS from DID
+    const pdsUrl = await resolvePDS(did);
+    // Fetch profile from PDS
+    const profile = await fetchProfile(pdsUrl, tokens.access_token, did, dpopKeyPair, nonce);
+    return {
+        id: did,
+        name: profile.displayName || profile.handle,
+        email: profile.email,
+        avatar: profile.avatar,
+        rawData: jsonGuard.parse({
+            did,
+            handle: profile.handle,
+            pds: pdsUrl,
+            displayName: profile.displayName,
+            description: profile.description,
+        }),
+    };
+};
+/**
+ * Fetch authorization server metadata from issuer URL
+ */
+async function fetchAuthorizationServerMetadataFromIssuer(issuer) {
+    const metadataUrl = `${issuer}/.well-known/oauth-authorization-server`;
+    const response = await got.get(metadataUrl, {
+        timeout: { request: defaultTimeout },
+    });
+    const result = authorizationServerMetadataGuard.safeParse(parseJson(response.body));
+    if (!result.success) {
+        throw new ConnectorError(ConnectorErrorCodes.InvalidResponse, {
+            error: 'Invalid authorization server metadata',
+        });
+    }
+    return result.data;
+}
+/**
+ * Create the Bluesky connector instance
+ */
+const createBlueskyConnector = async ({ getConfig, }) => {
+    return {
+        metadata: defaultMetadata,
+        type: ConnectorType.Social,
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        configGuard: blueskyConfigGuard,
+        getAuthorizationUri: getAuthorizationUri(getConfig),
+        getUserInfo: getUserInfo(getConfig),
+    };
+};
+
+export { createBlueskyConnector as default };