astro-atmosphere-comments 0.4.2 → 0.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "astro-atmosphere-comments",
-  "version": "0.4.2",
+  "version": "0.5.0",
   "description": "Atmosphere Comments for Astro: Bluesky comments, likes, reposts and quote posts for Astro sites; readers sign in with their Atmosphere (AT Protocol) account and respond without leaving the page.",
   "type": "module",
   "license": "MIT",
@@ -34,14 +34,10 @@
     "./AtmosphereReactions.astro": "./components/AtmosphereReactions.astro"
   },
   "types": "./index.d.ts",
-  "bin": {
-    "astro-atmosphere-comments": "bin/cli.mjs"
-  },
   "files": [
     "index.mjs",
     "index.d.ts",
     "virtual.d.ts",
-    "bin",
     "components",
     "lib",
     "routes",
@@ -59,7 +55,6 @@
   },
   "dependencies": {
     "@atproto/api": "^0.25.0",
-    "@atproto/oauth-client": "^0.9.0",
-    "@atproto/oauth-client-node": "^0.5.13"
+    "@atproto/oauth-client-browser": "^0.5.11"
   }
 }

package/routes/callback.astro

@@ -0,0 +1,42 @@
+---
+// Where a reader's account host sends them back after they approve (or
+// decline) signing in. The browser finishes signing in here, keeping the
+// sign-in in its own storage, then goes back to the page the reader was on
+// (lib/client/account.ts). The approval arrives in the address's #fragment,
+// which browsers never send to the server.
+import settings from "../lib/settings";
+import { messagesFor, pickLocale, translate } from "../lib/i18n";
+
+const lang = pickLocale(undefined, settings.locale, Astro.currentLocale);
+const t = (key: string) => translate(messagesFor(lang, settings.messages), lang, key);
+---
+
+<!doctype html>
+<html lang={lang}>
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <meta name="robots" content="noindex" />
+    <meta name="referrer" content="no-referrer" />
+    <title>{t("callback.signingIn")}</title>
+    <style>
+      :root {
+        color-scheme: light dark;
+      }
+      body {
+        display: grid;
+        min-height: 100vh;
+        margin: 0;
+        place-items: center;
+        font: 1rem/1.5 system-ui, sans-serif;
+      }
+    </style>
+  </head>
+  <body>
+    <p role="status">{t("callback.signingIn")}</p>
+    <script>
+      import { finishSignIn } from "../lib/client/account";
+      void finishSignIn();
+    </script>
+  </body>
+</html>

package/routes/client-metadata.json.ts

@@ -1,7 +1,8 @@
 // The site's OAuth client metadata. Account hosts fetch this address (it is
 // the site's client ID) to learn its name, logo, callback address and scope.
 import type { APIRoute } from "astro";
-import { clientMetadata } from "../lib/oauth";
+import { clientMetadata } from "../lib/permissions";
+import settings from "../lib/settings";
 
 export const GET: APIRoute = () =>
-  Response.json(clientMetadata(), { headers: { "Cache-Control": "public, max-age=600" } });
+  Response.json(clientMetadata(settings), { headers: { "Cache-Control": "public, max-age=600" } });

package/routes/following.ts

@@ -0,0 +1,28 @@
+// Whether an account follows one of the site's own accounts, for the Follow
+// button: ?actor=<reader's DID>&subject=<DID in allowedAuthors> gives
+// { following } (the follow record's AT URI, or ""). From Bluesky's public
+// AppView: who follows whom is public.
+import type { APIRoute } from "astro";
+import { addressOf, json, rateLimit } from "../lib/http";
+import settings from "../lib/settings";
+
+const DID = /^did:[a-z0-9]+:[a-zA-Z0-9._:%-]+$/;
+const perAddress = rateLimit(30, 300);
+
+export const GET: APIRoute = async (context) => {
+  const actor = context.url.searchParams.get("actor") ?? "";
+  const subject = context.url.searchParams.get("subject") ?? "";
+  if (!DID.test(actor) || !settings.allowedAuthors.includes(subject)) return json({ error: "not-allowed" }, 400);
+  if (perAddress(addressOf(context))) return json({ error: "too-many" }, 429);
+  try {
+    const query = new URLSearchParams({ actor, others: subject });
+    const response = await fetch(`https://public.api.bsky.app/xrpc/app.bsky.graph.getRelationships?${query}`, {
+      signal: AbortSignal.timeout(5000),
+    });
+    if (!response.ok) throw new Error(`getRelationships ${response.status}`);
+    const data = (await response.json()) as { relationships?: Array<{ did?: string; following?: string }> };
+    return json({ following: data.relationships?.find((relationship) => relationship.did === subject)?.following ?? "" });
+  } catch {
+    return json({ error: "unavailable" }, 502);
+  }
+};

package/routes/identity.ts

@@ -0,0 +1,69 @@
+// Looks up an account for signing in: ?id=<handle or DID> gives its DID, its
+// DID document (which names the reader's account host) and its handle, as
+// the browser's OAuth library needs (lib/client/account.ts). Done here, so a
+// reader's browser contacts only their own account host while signing in,
+// not Bluesky's servers or the PLC directory. Nothing is stored; answers are
+// remembered for ten minutes, and requests are limited per address.
+import type { APIRoute } from "astro";
+import { addressOf, json, rateLimit } from "../lib/http";
+
+const APPVIEW = "https://public.api.bsky.app/xrpc/";
+const HANDLE = /^([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z][a-z0-9-]{0,61}[a-z0-9]$/;
+const DID_PLC = /^did:plc:[a-z2-7]{24}$/;
+const DID_WEB = /^did:web:([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z][a-z0-9-]{0,61}[a-z0-9]$/;
+const REMEMBER_MS = 10 * 60 * 1000;
+
+const perAddress = rateLimit(20, 200);
+const overall = rateLimit(300, 6000);
+const recent = new Map<string, { answer: Identity; at: number }>();
+
+type DidDocument = { id: string; alsoKnownAs?: string[]; service?: { id: string; type: string; serviceEndpoint: unknown }[] };
+type Identity = { did: string; didDoc: DidDocument; handle: string };
+
+async function getJson<T>(url: string): Promise<T> {
+  const response = await fetch(url, { redirect: "error", signal: AbortSignal.timeout(5000) });
+  if (!response.ok) throw new Error(`${response.status}`);
+  if (Number(response.headers.get("content-length") || 0) > 100_000) throw new Error("too big");
+  return (await response.json()) as T;
+}
+
+async function didForHandle(handle: string): Promise<string> {
+  const { did } = await getJson<{ did?: string }>(`${APPVIEW}com.atproto.identity.resolveHandle?handle=${encodeURIComponent(handle)}`);
+  if (!did || !(DID_PLC.test(did) || DID_WEB.test(did))) throw new Error("no DID");
+  return did;
+}
+
+async function documentFor(did: string): Promise<DidDocument> {
+  const document = await getJson<DidDocument>(
+    did.startsWith("did:web:") ? `https://${did.slice("did:web:".length)}/.well-known/did.json` : `https://plc.directory/${did}`,
+  );
+  if (document.id !== did) throw new Error("wrong document");
+  return document;
+}
+
+async function lookUp(id: string): Promise<Identity> {
+  const did = id.startsWith("did:") ? id : await didForHandle(id);
+  const didDoc = await documentFor(did);
+  // The handle counts only if the document claims it and it points back here.
+  const claimed = didDoc.alsoKnownAs?.find((alias) => alias.startsWith("at://"))?.slice("at://".length).toLowerCase();
+  let handle = "handle.invalid";
+  if (claimed && claimed === id) handle = claimed;
+  else if (claimed && HANDLE.test(claimed)) handle = (await didForHandle(claimed).catch(() => "")) === did ? claimed : handle;
+  return { did, didDoc, handle };
+}
+
+export const GET: APIRoute = async (context) => {
+  const id = (context.url.searchParams.get("id") ?? "").trim().toLowerCase();
+  if (!(HANDLE.test(id) || DID_PLC.test(id) || DID_WEB.test(id)) || id.length > 253) return json({ error: "bad-request" }, 400);
+  const known = recent.get(id);
+  if (known && Date.now() - known.at < REMEMBER_MS) return json(known.answer);
+  if (perAddress(addressOf(context)) || overall("all")) return json({ error: "too-many" }, 429);
+  try {
+    const answer = await lookUp(id);
+    if (recent.size >= 500) recent.delete(recent.keys().next().value!);
+    recent.set(id, { answer, at: Date.now() });
+    return json(answer);
+  } catch {
+    return json({ error: "not-found" }, 404);
+  }
+};

package/routes/media.ts

@@ -1,27 +1,26 @@
 // Passes on a few images from Bluesky's image server, so readers' browsers
 // never load anything from Bluesky directly:
-//   ?avatar=<did>  the signed-in reader's own avatar, a site account's, or
-//                  one shown recently (in a thread, or suggested for an @mention);
+//   ?avatar=<did>  a site account's avatar, or one shown recently (in a
+//                  thread, suggested for an @mention, or a signed-in reader's
+//                  own, looked up by routes/profile.ts);
 //   ?thumb=<uri>   the link-card picture of one of the site's announcements.
 // Nothing else can be fetched through it.
 import type { APIRoute } from "astro";
 import { profileFor } from "../lib/profile";
 import { quotedPost } from "../lib/quoted";
-import { isSitePost } from "../lib/reader";
+import { isSitePost } from "../lib/uris";
 import settings from "../lib/settings";
 import { knownAvatar } from "../lib/avatars";
-import { signedInDid } from "../lib/visitor";
 
 const IMAGE_TYPES = new Set(["image/jpeg", "image/png", "image/webp", "image/gif"]);
 const MAX_BYTES = 3 * 1024 * 1024;
 
 const notFound = () => new Response("Not found", { status: 404 });
 
-export const GET: APIRoute = async ({ url, cookies }) => {
+export const GET: APIRoute = async ({ url }) => {
   const avatar = url.searchParams.get("avatar");
   const thumb = url.searchParams.get("thumb");
   let source: string | undefined;
-  let shared = true;
 
   if (avatar) {
     const isSiteAccount = settings.allowedAuthors.includes(avatar);
@@ -29,10 +28,9 @@ export const GET: APIRoute = async ({ url, cookies }) => {
     if (recentlyShown) {
       source = recentlyShown;
     } else {
-      if (!isSiteAccount && avatar !== (await signedInDid(cookies))) return notFound();
+      if (!isSiteAccount) return notFound();
       source = (await profileFor(avatar)).avatarSource;
     }
-    shared = isSiteAccount || !!recentlyShown;
   } else if (thumb && isSitePost(thumb)) {
     source = (await quotedPost(thumb).catch(() => null))?.external?.thumbSource;
   }
@@ -47,8 +45,7 @@ export const GET: APIRoute = async ({ url, cookies }) => {
     return new Response(body, {
       headers: {
         "Content-Type": type,
-        // A reader's own avatar is only for them; site images can be shared.
-        "Cache-Control": shared ? "public, max-age=3600" : "private, max-age=600",
+        "Cache-Control": "public, max-age=3600",
         "Content-Security-Policy": "default-src 'none'; sandbox",
         "X-Content-Type-Options": "nosniff",
       },

package/routes/post.ts

@@ -5,7 +5,7 @@ import type { APIRoute } from "astro";
 import { json } from "../lib/http";
 import { publicProfile } from "../lib/profile";
 import { quotedPost } from "../lib/quoted";
-import { isSitePost } from "../lib/reader";
+import { isSitePost } from "../lib/uris";
 import settings from "../lib/settings";
 
 export const GET: APIRoute = async ({ url }) => {

package/routes/profile.ts

@@ -0,0 +1,20 @@
+// A signed-in reader's public profile, for the comment box and the account
+// menu: ?did=<DID> gives their handle, display name and avatar (through this
+// site, routes/media.ts). The page asks for it after the reader signs in in
+// their own browser; it's public, so no sign-in is needed to ask.
+import type { APIRoute } from "astro";
+import { rememberAvatar } from "../lib/avatars";
+import { addressOf, json, rateLimit } from "../lib/http";
+import { profileFor, publicProfile } from "../lib/profile";
+
+const DID = /^did:[a-z0-9]+:[a-zA-Z0-9._:%-]+$/;
+const perAddress = rateLimit(30, 300);
+
+export const GET: APIRoute = async (context) => {
+  const did = context.url.searchParams.get("did") ?? "";
+  if (!DID.test(did) || did.length > 200) return json({ error: "bad-request" }, 400);
+  if (perAddress(addressOf(context))) return json({ error: "too-many" }, 429);
+  const profile = await profileFor(did);
+  if (profile.avatarSource) rememberAvatar(did, profile.avatarSource);
+  return json(publicProfile(profile));
+};

package/routes/richtext.ts

@@ -0,0 +1,30 @@
+// Finds the links, @mentions and #hashtags in a comment before the reader's
+// browser posts it, as the Bluesky app does: POST { text } gives { text,
+// facets }. Mentions are looked up here (Bluesky's public API), so the
+// reader's browser doesn't contact Bluesky. Nothing is posted or kept.
+import { AtpAgent, RichText } from "@atproto/api";
+import type { APIRoute } from "astro";
+import { addressOf, fromThisSite, json, rateLimit } from "../lib/http";
+
+const publicAgent = new AtpAgent({ service: "https://public.api.bsky.app" });
+const perAddress = rateLimit(20, 200);
+
+export const POST: APIRoute = async (context) => {
+  const { request, url } = context;
+  if (!fromThisSite(request, url)) return json({ error: "forbidden" }, 403);
+  let text: unknown;
+  try {
+    ({ text } = await request.json());
+  } catch {
+    return json({ error: "bad-request" }, 400);
+  }
+  if (typeof text !== "string" || !text.trim() || text.length > 3000) return json({ error: "bad-request" }, 400);
+  if (perAddress(addressOf(context))) return json({ error: "too-many" }, 429);
+  const richText = new RichText({ text: text.trim() });
+  try {
+    await richText.detectFacets(publicAgent);
+  } catch {
+    richText.detectFacetsWithoutResolution();
+  }
+  return json({ text: richText.text, facets: richText.facets ?? [] });
+};

package/routes/thread.ts

@@ -3,11 +3,16 @@
 //   ?document=<at:// URI of the page's Standard.site record>, whose
 //   bskyPostRef names the announcement.
 // Only threads started by the site's own accounts are served.
+//
+// POST { root } forgets the cached copy of a thread, so a comment the
+// reader's browser has just posted shows when the page is next loaded.
 import type { APIRoute } from "astro";
-import { json } from "../lib/http";
-import { isSitePost } from "../lib/reader";
+import { addressOf, fromThisSite, json, rateLimit } from "../lib/http";
+import { isSitePost } from "../lib/uris";
 import { announcementFromDocument, postUriFromUrl } from "../lib/resolve";
-import { getThread } from "../lib/thread";
+import { forgetThread, getThread } from "../lib/thread";
+
+const perAddress = rateLimit(10, 100);
 
 export const GET: APIRoute = async ({ url }) => {
   const post = url.searchParams.get("post");
@@ -25,3 +30,18 @@ export const GET: APIRoute = async ({ url }) => {
   const thread = await getThread(uri);
   return thread ? json({ thread }) : json({ error: "unavailable" }, 502);
 };
+
+export const POST: APIRoute = async (context) => {
+  const { request, url } = context;
+  if (!fromThisSite(request, url)) return json({ error: "forbidden" }, 403);
+  let root: unknown;
+  try {
+    ({ root } = await request.json());
+  } catch {
+    return json({ error: "bad-request" }, 400);
+  }
+  if (!isSitePost(root)) return json({ error: "not-allowed" }, 400);
+  if (perAddress(addressOf(context))) return json({ error: "too-many" }, 429);
+  forgetThread(root);
+  return json({ ok: true });
+};

package/routes/typeahead.ts

@@ -6,15 +6,12 @@
 // proxy every visitor may share one address), so the site can't be used to
 // flood Bluesky's search. Answers are remembered for a minute.
 import type { APIRoute } from "astro";
-import { json } from "../lib/http";
-import { rateLimit } from "../lib/reader";
+import { addressOf, json, rateLimit } from "../lib/http";
 import settings from "../lib/settings";
 import { rememberAvatar } from "../lib/avatars";
-import { signedInDid } from "../lib/visitor";
 
-const perReader = rateLimit(60, 1200);
-const perAddress = rateLimit(30, 300);
-const signedOutOverall = rateLimit(300, 6000);
+const perAddress = rateLimit(60, 600);
+const overall = rateLimit(600, 12000);
 
 type Actor = { did: string; handle: string; displayName?: string; avatar?: string };
 const recent = new Map<string, { actors: Actor[]; at: number }>();
@@ -36,23 +33,10 @@ async function search(q: string): Promise<Actor[]> {
   return actors;
 }
 
-export const GET: APIRoute = async ({ url, cookies, clientAddress }) => {
-  const q = (url.searchParams.get("q") ?? "").trim().replace(/^@/, "");
-  const did = await signedInDid(cookies);
-  // One letter is enough for an @mention; signing in needs two.
-  if (!q || (!did && q.length < 2) || q.length > 64 || /[\s<>"]/.test(q)) return json({ actors: [] });
-
-  if (did) {
-    if (perReader(did)) return json({ error: "too-many" }, 429);
-  } else {
-    let address = "unknown";
-    try {
-      address = clientAddress;
-    } catch {
-      // Some adapters can't tell; the overall cap still applies.
-    }
-    if (perAddress(address) || signedOutOverall("all")) return json({ error: "too-many" }, 429);
-  }
+export const GET: APIRoute = async (context) => {
+  const q = (context.url.searchParams.get("q") ?? "").trim().replace(/^@/, "");
+  if (!q || q.length > 64 || /[\s<>"]/.test(q)) return json({ actors: [] });
+  if (perAddress(addressOf(context)) || overall("all")) return json({ error: "too-many" }, 429);
 
   try {
     const actors = (await search(q)).map((actor) => {

package/virtual.d.ts

@@ -2,3 +2,8 @@ declare module "virtual:atmosphere-comments/settings" {
   const settings: import("./lib/settings").AtmosphereSettings;
   export default settings;
 }
+
+declare module "virtual:atmosphere-comments/public-settings" {
+  const settings: import("./lib/public-settings").PublicSettings;
+  export default settings;
+}

package/bin/cli.mjs

@@ -1,31 +0,0 @@
-#!/usr/bin/env node
-// npx astro-atmosphere-comments keygen
-//
-// Creates your site's private signing key and adds it to .env (in the folder
-// you run it from) as ATMOSPHERE_PRIVATE_JWK, without printing it. Account
-// hosts check your site's requests against the public half, which the
-// integration publishes at /atmosphere/jwks.json. It refuses if .env already
-// has a key: a new key signs every reader out.
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import { JoseKey } from "@atproto/oauth-client-node";
-
-const [command] = process.argv.slice(2);
-if (command !== "keygen") {
-  console.log("Usage: npx astro-atmosphere-comments keygen\n\nAdds a new signing key to .env as ATMOSPHERE_PRIVATE_JWK.");
-  process.exit(command ? 1 : 0);
-}
-
-const envFile = ".env";
-const existing = existsSync(envFile) ? readFileSync(envFile, "utf8") : "";
-if (/^ATMOSPHERE_PRIVATE_JWK=.+/m.test(existing)) {
-  console.error("ATMOSPHERE_PRIVATE_JWK is already set in .env; leaving it alone.");
-  process.exit(1);
-}
-
-const key = await JoseKey.generate(["ES256"], "atmosphere-comments-1");
-const line = `ATMOSPHERE_PRIVATE_JWK='${JSON.stringify(key.privateJwk)}'`;
-const kept = existing.replace(/^ATMOSPHERE_PRIVATE_JWK=\s*$/m, "").replace(/\n*$/, existing ? "\n" : "");
-writeFileSync(envFile, `${kept}${line}\n`, { mode: 0o600 });
-console.log(
-  "Added ATMOSPHERE_PRIVATE_JWK to .env (not shown). Set the same value on your server, keep .env out of Git, and keep a backup somewhere safe.",
-);

package/lib/oauth.ts

@@ -1,110 +0,0 @@
-// The AT Protocol OAuth client: how this site asks a reader's account host for
-// permission to post comments on their behalf.
-//
-// - Live, the site is a "confidential client": account hosts read its
-//   /oauth-client-metadata.json, and it proves who it is with a private key
-//   (ATMOSPHERE_PRIVATE_JWK, server-only). Sign-ins can then last for months.
-// - In `astro dev`, it uses the protocol's local-testing client (no key, no
-//   public address needed). Open the site at http://127.0.0.1:<port>, not
-//   localhost, because the host sends readers back to that address.
-import { requestLocalLock } from "@atproto/oauth-client";
-import {
-  buildAtprotoLoopbackClientMetadata,
-  JoseKey,
-  NodeOAuthClient,
-  type NodeSavedSession,
-  type NodeSavedState,
-} from "@atproto/oauth-client-node";
-import { getSecret } from "astro:env/server";
-import settings from "./settings";
-import { fileStore } from "./store";
-
-// Only what commenting needs: create posts, create (and delete again) likes
-// and reposts, and read posts as the reader sees them (to know whether they've
-// already liked or reposted), through Bluesky's AppView.
-export const SCOPE = [
-  "atproto",
-  "repo:app.bsky.feed.post?action=create",
-  "repo:app.bsky.feed.like?action=create&action=delete",
-  "repo:app.bsky.feed.repost?action=create&action=delete",
-  "rpc:app.bsky.feed.getPosts?aud=did:web:api.bsky.app%23bsky_appview",
-].join(" ");
-
-// Deleting posts is asked for separately, only when a reader first deletes a
-// comment here, so most readers never grant it. (A permission can only name a
-// kind of record, not particular posts: the delete route itself makes sure it
-// is only used on the reader's own comments under the site's posts.)
-export const DELETE_SCOPE = "repo:app.bsky.feed.post?action=delete";
-
-// Following (and unfollowing) the site's own accounts is asked for the same
-// way, the first time a reader presses Follow.
-export const FOLLOW_SCOPE = "repo:app.bsky.graph.follow?action=create&action=delete";
-
-// Everything the site may ask for, which its client metadata has to list.
-const ALL_SCOPES = `${SCOPE} ${DELETE_SCOPE} ${FOLLOW_SCOPE}`;
-
-const KEY_ID = "atmosphere-comments-1";
-
-export const callbackPath = `${settings.base}/callback`;
-
-export function clientMetadata() {
-  return {
-    // At the site's root, the address account hosts treat as the convention:
-    // Bluesky's approval page then shows just the site's address.
-    client_id: `${settings.site}/oauth-client-metadata.json`,
-    client_name: settings.clientName,
-    client_uri: settings.site,
-    ...(settings.logoUri && { logo_uri: settings.logoUri }),
-    ...(settings.policyUri && { policy_uri: settings.policyUri }),
-    ...(settings.tosUri && { tos_uri: settings.tosUri }),
-    redirect_uris: [`${settings.site}${callbackPath}`] as [string],
-    scope: ALL_SCOPES,
-    grant_types: ["authorization_code", "refresh_token"] as ["authorization_code", "refresh_token"],
-    response_types: ["code"] as ["code"],
-    application_type: "web" as const,
-    token_endpoint_auth_method: "private_key_jwt" as const,
-    token_endpoint_auth_signing_alg: "ES256",
-    dpop_bound_access_tokens: true,
-    jwks_uri: `${settings.site}${settings.base}/jwks.json`,
-  };
-}
-
-let keyPromise: Promise<JoseKey> | undefined;
-
-export function privateKey(): Promise<JoseKey> {
-  keyPromise ??= (async () => {
-    const jwk = getSecret("ATMOSPHERE_PRIVATE_JWK");
-    if (!jwk) throw new Error("ATMOSPHERE_PRIVATE_JWK is not set");
-    return JoseKey.fromImportable(jwk, KEY_ID);
-  })();
-  return keyPromise;
-}
-
-const stores = {
-  // A sign-in in progress: kept for an hour at most.
-  state: fileStore<NodeSavedState>("oauth-state", 60 * 60 * 1000),
-  // Each reader's tokens, by their DID.
-  session: fileStore<NodeSavedSession>("oauth-sessions"),
-};
-
-let clientPromise: Promise<NodeOAuthClient> | undefined;
-
-/** The OAuth client. `origin` is only used in `astro dev`, for the local callback address. */
-export function oauthClient(origin: string): Promise<NodeOAuthClient> {
-  clientPromise ??= (async () => {
-    const common = { stateStore: stores.state, sessionStore: stores.session, requestLock: requestLocalLock };
-    if (import.meta.env.DEV) {
-      const local = new URL(origin);
-      local.hostname = "127.0.0.1";
-      return new NodeOAuthClient({
-        ...common,
-        clientMetadata: buildAtprotoLoopbackClientMetadata({
-          scope: ALL_SCOPES,
-          redirect_uris: [`${local.origin}${callbackPath}`],
-        }),
-      });
-    }
-    return new NodeOAuthClient({ ...common, clientMetadata: clientMetadata(), keyset: [await privateKey()] });
-  })();
-  return clientPromise;
-}