feat: confidential client

.gitignore

···
 yarn-*.log
 
 *.local
+*.local.json
 
 tsconfig.tsbuildinfo

package.json

···
 		"@atcute/identity": "^1.1.1",
 		"@atcute/identity-resolver": "^1.1.4",
 		"@atcute/lexicons": "^1.2.2",
-		"@atcute/oauth-browser-client": "2.0.0",
+		"@atcute/multibase": "^1.1.6",
+		"@atcute/oauth-browser-client": "2.0.1",
 		"@atcute/tid": "^1.0.3",
+		"@atcute/uint8array": "^1.0.5",
 		"@atcute/xrpc-server": "^0.1.3",
 		"@atlaskit/pragmatic-drag-and-drop": "1.6.0",
 		"@atlaskit/pragmatic-drag-and-drop-hitbox": "1.0.3",
···
 		"webm-muxer": "^5.1.4"
 	},
 	"devDependencies": {
+		"@badrap/valita": "^0.4.6",
 		"@cloudflare/vite-plugin": "^1.13.15",
 		"@trivago/prettier-plugin-sort-imports": "^5.2.2",
 		"@types/dom-close-watcher": "^1.0.0",
···
 		"terser": "^5.44.0",
 		"typescript": "~5.9.3",
 		"vite": "^7.1.12",
-		"vite-plugin-pwa": "0.21.0",
+		"vite-plugin-pwa": "1.1.0",
 		"vite-plugin-solid": "^2.11.10",
 		"wrangler": "^4.45.0"
 	},

pnpm-lock.yaml

···
       '@atcute/lexicons':
         specifier: ^1.2.2
         version: 1.2.2
+      '@atcute/multibase':
+        specifier: ^1.1.6
+        version: 1.1.6
       '@atcute/oauth-browser-client':
-        specifier: 2.0.0
-        version: 2.0.0
+        specifier: 2.0.1
+        version: 2.0.1
       '@atcute/tid':
         specifier: ^1.0.3
         version: 1.0.3
+      '@atcute/uint8array':
+        specifier: ^1.0.5
+        version: 1.0.5
       '@atcute/xrpc-server':
         specifier: ^0.1.3
         version: 0.1.3
···
         specifier: ^5.1.4
         version: 5.1.4
     devDependencies:
+      '@badrap/valita':
+        specifier: ^0.4.6
+        version: 0.4.6
       '@cloudflare/vite-plugin':
         specifier: ^1.13.15
         version: 1.13.15(vite@7.1.12(@types/node@24.9.1)(jiti@1.21.7)(terser@5.44.0))(workerd@1.20251011.0)(wrangler@4.45.0)
···
         specifier: ^7.1.12
         version: 7.1.12(@types/node@24.9.1)(jiti@1.21.7)(terser@5.44.0)
       vite-plugin-pwa:
-        specifier: 0.21.0
-        version: 0.21.0(patch_hash=003379ded749ad87080f87b428b17f04c4c88b6b64544df4d928aab76fbf6325)(@types/babel__core@7.20.5)(vite@7.1.12(@types/node@24.9.1)(jiti@1.21.7)(terser@5.44.0))
+        specifier: 1.1.0
+        version: 1.1.0(patch_hash=003379ded749ad87080f87b428b17f04c4c88b6b64544df4d928aab76fbf6325)(@types/babel__core@7.20.5)(vite@7.1.12(@types/node@24.9.1)(jiti@1.21.7)(terser@5.44.0))
       vite-plugin-solid:
         specifier: ^2.11.10
         version: 2.11.10(solid-js@1.9.9(patch_hash=9cf3f9930aa2f8d4e60502a75153adf9468eb53b42f69e86cac05dfaea3f82e7))(vite@7.1.12(@types/node@24.9.1)(jiti@1.21.7)(terser@5.44.0))
···
   '@atcute/multibase@1.1.6':
     resolution: {integrity: sha512-HBxuCgYLKPPxETV0Rot4VP9e24vKl8JdzGCZOVsDaOXJgbRZoRIF67Lp0H/OgnJeH/Xpva8Z5ReoTNJE5dn3kg==}
 
-  '@atcute/oauth-browser-client@2.0.0':
-    resolution: {integrity: sha512-zK4wcQ79g9EqU7NJk/Wxx9ImOH6UwhpEcazDA8bimUJhl9pwXxMC0u0x/tgzFjJZYgwnOHoBMwLmhl0900hcCQ==}
+  '@atcute/oauth-browser-client@2.0.1':
+    resolution: {integrity: sha512-lG021GkeORG06zfFf4bH85egObjBEKHNgAWHvbtY/E2dX4wxo88hf370pJDx8acdnuUJLJ2VKPikJtZwo4Heeg==}
 
   '@atcute/tid@1.0.3':
     resolution: {integrity: sha512-wfMJx1IMdnu0CZgWl0uR4JO2s6PGT1YPhpytD4ZHzEYKKQVuqV6Eb/7vieaVo1eYNMp2FrY67FZObeR7utRl2w==}
···
   validate-html-nesting@1.2.3:
     resolution: {integrity: sha512-kdkWdCl6eCeLlRShJKbjVOU2kFKxMF8Ghu50n+crEoyx+VKm3FxAxF9z4DCy6+bbTOqNW0+jcIYRnjoIRzigRw==}
 
-  vite-plugin-pwa@0.21.0:
-    resolution: {integrity: sha512-gnDE5sN2hdxA4vTl0pe6PCTPXqChk175jH8dZVVTBjFhWarZZoXaAdoTIKCIa8Zbx94sC0CnCOyERBWpxvry+g==}
+  vite-plugin-pwa@1.1.0:
+    resolution: {integrity: sha512-VsSpdubPzXhHWVINcSx6uHRMpOHVHQcHsef1QgkOlEoaIDAlssFEW88LBq1a59BuokAhsh2kUDJbaX1bZv4Bjw==}
     engines: {node: '>=16.0.0'}
     peerDependencies:
-      '@vite-pwa/assets-generator': ^0.2.6
-      vite: ^3.1.0 || ^4.0.0 || ^5.0.0
+      '@vite-pwa/assets-generator': ^1.0.0
+      vite: ^3.1.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0
     peerDependenciesMeta:
       '@vite-pwa/assets-generator':
         optional: true
···
     dependencies:
       '@atcute/uint8array': 1.0.5
 
-  '@atcute/oauth-browser-client@2.0.0':
+  '@atcute/oauth-browser-client@2.0.1':
     dependencies:
       '@atcute/client': 4.0.5
       '@atcute/identity': 1.1.1
···
 
   validate-html-nesting@1.2.3: {}
 
-  vite-plugin-pwa@0.21.0(patch_hash=003379ded749ad87080f87b428b17f04c4c88b6b64544df4d928aab76fbf6325)(@types/babel__core@7.20.5)(vite@7.1.12(@types/node@24.9.1)(jiti@1.21.7)(terser@5.44.0)):
+  vite-plugin-pwa@1.1.0(patch_hash=003379ded749ad87080f87b428b17f04c4c88b6b64544df4d928aab76fbf6325)(@types/babel__core@7.20.5)(vite@7.1.12(@types/node@24.9.1)(jiti@1.21.7)(terser@5.44.0)):
     dependencies:
       debug: 4.4.3
       pretty-bytes: 6.1.1

public/oauth-client-metadata.json

···
-{
-	"client_id": "https://aglais.kelinci.net/oauth-client-metadata.json",
-	"client_uri": "https://aglais.kelinci.net",
-	"client_name": "Aglais",
-	"application_type": "web",
-	"scope": "atproto transition:generic transition:chat.bsky",
-	"grant_types": ["authorization_code", "refresh_token"],
-	"redirect_uris": ["https://aglais.kelinci.net/oauth/callback"],
-	"response_types": ["code"],
-	"token_endpoint_auth_method": "none",
-	"dpop_bound_access_tokens": true
-}

scripts/generate-oauth-keys.js

···
+import * as fs from 'node:fs/promises';
+
+import * as v from '@badrap/valita';
+
+import * as TID from '@atcute/tid';
+
+const jwksSchema = v.object({
+	keys: v.array(
+		v.object({
+			privateKey: v.unknown(),
+			publicKey: v.unknown(),
+		}),
+	),
+});
+
+/** @type {v.Infer<typeof jwksSchema> | undefined} */
+let jwks;
+try {
+	const raw = await fs.readFile('./oauth-credentials.local.json', 'utf-8');
+	const json = JSON.parse(raw);
+
+	jwks = jwksSchema.parse(json, { mode: 'passthrough' });
+} catch (err) {
+	if (err.code !== 'ENOENT') {
+		throw err;
+	}
+
+	jwks = {
+		keys: [],
+	};
+}
+
+const { publicKey, privateKey } = await crypto.subtle.generateKey(
+	{
+		name: 'ECDSA',
+		namedCurve: 'P-256',
+	},
+	true,
+	['sign', 'verify'],
+);
+
+const kid = `aglais-${TID.now()}`;
+const privateJWK = await crypto.subtle.exportKey('jwk', privateKey);
+const publicJWK = await crypto.subtle.exportKey('jwk', publicKey);
+
+jwks = {
+	keys: [
+		{
+			privateKey: {
+				...privateJWK,
+				kid: kid,
+			},
+			publicKey: {
+				kty: publicJWK.kty,
+				crv: publicJWK.crv,
+				x: publicJWK.x,
+				y: publicJWK.y,
+				use: 'sig',
+				alg: 'ES256',
+				kid: kid,
+			},
+		},
+		...jwks.keys,
+	],
+};
+
+await fs.writeFile('./oauth-credentials.local.json', JSON.stringify(jwks, null, '\t') + '\n');

server/index.ts

···
-import { ComAtprotoIdentityResolveDid, ComAtprotoIdentityResolveHandle } from '@atcute/atproto';
+import { type DidDocument, getAtprotoHandle, getPdsEndpoint } from '@atcute/identity';
 import {
 	AmbiguousHandleError,
 	CompositeDidDocumentResolver,
···
 	WebDidDocumentResolver,
 	WellKnownHandleResolver,
 } from '@atcute/identity-resolver';
-import { InvalidRequestError, XRPCRouter, json } from '@atcute/xrpc-server';
+import { type Did, type Handle, type ResourceUri, isDid } from '@atcute/lexicons/syntax';
+import { AuthRequiredError, InvalidRequestError, XRPCRouter, json } from '@atcute/xrpc-server';
+
+import * as jwks from '../oauth-credentials.local.json' with { type: 'json' };
+
+import { InvalidDPoPError, createClientAssertion, verifyDPoP } from './jwt';
+import { requestAssertionSchema, resolveIdentitySchema } from './lexicons';
+
+const privateKeyId = jwks.keys[0].privateKey.kid;
+const privateKey = await crypto.subtle.importKey(
+	'jwk',
+	jwks.keys[0].privateKey,
+	{ name: 'ECDSA', namedCurve: 'P-256' },
+	false,
+	['sign'],
+);
 
 const handleResolver = new CompositeHandleResolver({
 	methods: {
···
 	},
 });
 
-const didDocResolver = new CompositeDidDocumentResolver<string>({
+const didDocumentResolver = new CompositeDidDocumentResolver<string>({
 	methods: {
 		plc: new PlcDidDocumentResolver(),
 		web: new WebDidDocumentResolver(),
···
 const router = new XRPCRouter({
 	middlewares: [
 		async (request, next) => {
+			if (request.method !== 'GET') {
+				return await next(request);
+			}
+
 			let response = await cache.match(request);
 			if (response === undefined) {
 				response = await next(request);
···
 	],
 });
 
-router.add(ComAtprotoIdentityResolveHandle.mainSchema, {
-	async handler({ params: { handle } }) {
-		try {
-			const did = await handleResolver.resolve(handle);
+router.addProcedure(requestAssertionSchema, {
+	async handler({ input: { jkt, aud }, request }) {
+		const url = new URL(request.url);
 
-			return json({ did }, { headers: { 'cache-control': 'public, max-age=600' } });
+		const origin = request.headers.get('origin');
+		if (origin !== url.origin) {
+			throw new AuthRequiredError({ description: 'invalid origin' });
+		}
+
+		const dpop = request.headers.get('dpop');
+		try {
+			await verifyDPoP(dpop, jkt);
 		} catch (err) {
-			console.error(`resolveHandleToDid`, handle, err);
-
-			if (err instanceof DidNotFoundError) {
-				throw new InvalidRequestError({ description: `no did found under that handle` });
+			if (err instanceof InvalidDPoPError) {
+				throw new AuthRequiredError({ description: err.message });
 			}
 
-			if (err instanceof InvalidResolvedHandleError) {
-				throw new InvalidRequestError({ description: `did found but is invalid atproto did` });
-			}
+			throw err;
+		}
 
-			if (err instanceof AmbiguousHandleError) {
-				throw new InvalidRequestError({ description: `multiple did found under that handle` });
-			}
+		const assertion = await createClientAssertion({
+			privateKey: privateKey,
+
+			client_id: `https://${url.host}/oauth-client-metadata.json`,
+			kid: privateKeyId,
+			aud: aud,
+		});
 
-			throw err;
-		}
+		return json({
+			assertion: assertion,
+		});
 	},
 });
 
-router.add(ComAtprotoIdentityResolveDid.mainSchema, {
-	async handler({ params: { did } }) {
-		try {
-			const doc = await didDocResolver.resolve(did);
+router.addQuery(resolveIdentitySchema, {
+	async handler({ params: { identifier } }) {
+		const identifierIsDid = isDid(identifier);
 
-			return json(
-				{ didDoc: doc as unknown as Record<string, unknown> },
-				{ headers: { 'cache-control': 'public, max-age=3600' } },
-			);
-		} catch (err) {
-			console.error(`resolveDidToDoc`, did, err);
+		let did: Did;
+		if (identifierIsDid) {
+			did = identifier;
+		} else {
+			try {
+				did = await handleResolver.resolve(identifier);
+			} catch (err) {
+				if (err instanceof DidNotFoundError) {
+					throw new InvalidRequestError({ description: `no did found under that handle` });
+				}
 
+				if (err instanceof InvalidResolvedHandleError) {
+					throw new InvalidRequestError({ description: `did found but is invalid atproto did` });
+				}
+
+				if (err instanceof AmbiguousHandleError) {
+					throw new InvalidRequestError({ description: `multiple did found under that handle` });
+				}
+
+				throw err;
+			}
+		}
+
+		let doc: DidDocument;
+		try {
+			doc = await didDocumentResolver.resolve(did);
+		} catch (err) {
 			if (err instanceof DocumentNotFoundError) {
 				throw new InvalidRequestError({ description: `no document found under that did` });
 			}
···
 
 			throw err;
 		}
+
+		const pds = getPdsEndpoint(doc);
+		if (!pds) {
+			throw new InvalidRequestError({ description: `missing pds endpoint` });
+		}
+
+		let handle: Handle = 'handle.invalid';
+		if (identifierIsDid) {
+			const writtenHandle = getAtprotoHandle(doc);
+			if (writtenHandle) {
+				try {
+					const resolved = await handleResolver.resolve(writtenHandle);
+
+					if (resolved === did) {
+						handle = writtenHandle;
+					}
+				} catch {}
+			}
+		} else if (getAtprotoHandle(doc) === identifier) {
+			handle = identifier;
+		}
+
+		return json({
+			did: did,
+			handle: handle,
+			pds: new URL(pds).href as ResourceUri,
+		});
 	},
 });
 
 export default {
 	fetch(request, _env, ctx) {
+		const url = new URL(request.url);
+
+		if (url.pathname === '/oauth-client-metadata.json') {
+			return Response.json({
+				client_id: `https://${url.host}/oauth-client-metadata.json`,
+				client_uri: `https://${url.host}`,
+				client_name: import.meta.env.VITE_APP_NAME,
+				application_type: 'web',
+				scope: 'atproto transition:generic transition:chat.bsky',
+				grant_types: ['authorization_code', 'refresh_token'],
+				redirect_uris: [`https://${url.host}/oauth/callback`],
+				response_types: ['code'],
+				token_endpoint_auth_method: 'private_key_jwt',
+				token_endpoint_auth_signing_alg: 'ES256',
+				jwks_uri: `https://${url.host}/oauth-jwks.json`,
+				dpop_bound_access_tokens: true,
+			});
+		}
+
+		if (url.pathname === '/oauth-jwks.json') {
+			return Response.json({
+				keys: jwks.keys.map((key) => key.publicKey),
+			});
+		}
+
 		contexts.set(request, ctx);
 		return router.fetch(request);
 	},

server/jwt.ts

···
+import * as v from '@badrap/valita';
+
+import { fromBase64Url, toBase64Url } from '@atcute/multibase';
+import { decodeUtf8From, encodeUtf8 } from '@atcute/uint8array';
+
+export class MalformedJwtError extends Error {
+	name = 'MalformedJwtError';
+
+	constructor(options?: ErrorOptions) {
+		super(`malformed JWT`, options);
+	}
+}
+
+export interface DecodedJwt<THeader, TPayload> {
+	header: THeader;
+	payload: TPayload;
+	message: Uint8Array<ArrayBuffer>;
+	signature: Uint8Array<ArrayBuffer>;
+}
+
+const decodeJwt = <THeader, TPayload>(
+	input: string,
+	schemas: { header: v.Type<THeader>; payload: v.Type<TPayload> },
+): DecodedJwt<THeader, TPayload> => {
+	const parts = input.split('.');
+	if (parts.length !== 3) {
+		throw new MalformedJwtError();
+	}
+
+	const [headerString, payloadString, signatureString] = parts;
+
+	const header = decodeJwtPortion(schemas.header, headerString);
+	const payload = decodeJwtPortion(schemas.payload, payloadString);
+	const signature = decodeJwtSignature(signatureString);
+
+	return {
+		header: header,
+		payload: payload,
+		message: encodeUtf8(`${headerString}.${payloadString}`),
+		signature: signature,
+	};
+};
+
+const decodeJwtPortion = <T>(schema: v.Type<T>, input: string): T => {
+	try {
+		const raw = decodeUtf8From(fromBase64Url(input));
+		const json = JSON.parse(raw);
+
+		return schema.parse(json, { mode: 'passthrough' });
+	} catch (err) {
+		throw new MalformedJwtError({ cause: err });
+	}
+};
+
+const decodeJwtSignature = (input: string): Uint8Array<ArrayBuffer> => {
+	try {
+		return fromBase64Url(input);
+	} catch (err) {
+		throw new MalformedJwtError({ cause: err });
+	}
+};
+
+const encodeJwtPortion = (data: unknown): string => {
+	return toBase64Url(encodeUtf8(JSON.stringify(data)));
+};
+
+const encodeJwtSignature = (data: Uint8Array): string => {
+	return toBase64Url(data);
+};
+
+// #region DPoP
+export class InvalidDPoPError extends Error {
+	name = 'InvalidDPoPError';
+}
+
+const dpopHeaderSchema = v.object({
+	typ: v.literal('dpop+jwt'),
+	alg: v.literal('ES256'),
+	jwk: v.object({
+		kty: v.literal('EC'),
+		crv: v.literal('P-256'),
+		x: v.string(),
+		y: v.string(),
+	}),
+});
+
+const dpopPayloadSchema = v.object({
+	htm: v.string(),
+	htu: v.string(),
+	iat: v.number(),
+	jti: v.string(),
+});
+
+const calculateJwkThumbprint = async (jwk: JsonWebKey): Promise<string> => {
+	// For EC keys, thumbprint is SHA-256 of canonical JSON
+	// Members must be in lexicographic order
+	const canonical = JSON.stringify({
+		crv: jwk.crv,
+		kty: jwk.kty,
+		x: jwk.x,
+		y: jwk.y,
+	});
+
+	const hash = await crypto.subtle.digest('SHA-256', encodeUtf8(canonical));
+	return toBase64Url(new Uint8Array(hash));
+};
+
+export const verifyDPoP = async (dpop: string | null, jkt: string): Promise<void> => {
+	if (!dpop) {
+		throw new InvalidDPoPError(`missing DPoP header`);
+	}
+
+	// Decode the DPoP JWT
+	let decoded;
+	try {
+		decoded = decodeJwt(dpop, {
+			header: dpopHeaderSchema,
+			payload: dpopPayloadSchema,
+		});
+	} catch (err) {
+		throw new InvalidDPoPError(`malformed JWT`, { cause: err });
+	}
+
+	const { header, message, signature } = decoded;
+
+	// Verify JWK thumbprint matches jkt
+	const thumbprint = await calculateJwkThumbprint(header.jwk);
+	if (thumbprint !== jkt) {
+		throw new InvalidDPoPError(`JWK thumbprint mismatch`);
+	}
+
+	// Import the public key for signature verification
+	let publicKey: CryptoKey;
+	try {
+		publicKey = await crypto.subtle.importKey(
+			'jwk',
+			header.jwk,
+			{ name: 'ECDSA', namedCurve: 'P-256' },
+			false,
+			['verify'],
+		);
+	} catch (err) {
+		throw new InvalidDPoPError(`failed to import JWK`, { cause: err });
+	}
+
+	// Verify the signature
+	const isValid = await crypto.subtle.verify(
+		{ name: 'ECDSA', hash: 'SHA-256' },
+		publicKey,
+		signature,
+		message,
+	);
+
+	if (!isValid) {
+		throw new InvalidDPoPError(`invalid DPoP signature`);
+	}
+};
+
+// #endregion
+
+// #region Client assertions
+
+export const createClientAssertion = async (options: {
+	kid: string;
+	client_id: string;
+	aud: string;
+	privateKey: CryptoKey;
+}): Promise<string> => {
+	const { kid, client_id, aud, privateKey } = options;
+
+	const now = Math.floor(Date.now() / 1000);
+
+	const header = {
+		alg: 'ES256',
+		typ: 'JWT',
+		kid: kid,
+	};
+
+	const payload = {
+		iss: client_id,
+		sub: client_id,
+		aud: aud,
+		jti: crypto.randomUUID(),
+		iat: now,
+		exp: now + 60,
+	};
+
+	const message = `${encodeJwtPortion(header)}.${encodeJwtPortion(payload)}`;
+
+	const signature = encodeJwtSignature(
+		new Uint8Array(
+			await crypto.subtle.sign(
+				{
+					name: 'ECDSA',
+					hash: 'SHA-256',
+				},
+				privateKey,
+				encodeUtf8(message),
+			),
+		),
+	);
+
+	return `${message}.${signature}`;
+};
+
+// #endregion

server/lexicons.ts

···
+import type {} from '@atcute/lexicons/ambient';
+import * as v from '@atcute/lexicons/validations';
+
+export const requestAssertionSchema = v.procedure('x.aglais.requestAssertion', {
+	params: null,
+	input: {
+		type: 'lex',
+		schema: v.object({
+			jkt: v.string(),
+			aud: v.string(),
+		}),
+	},
+	output: {
+		type: 'lex',
+		schema: v.object({
+			assertion: v.string(),
+		}),
+	},
+});
+
+export const resolveIdentitySchema = v.query('x.aglais.resolveIdentity', {
+	params: v.object({
+		identifier: v.actorIdentifierString(),
+	}),
+	output: {
+		type: 'lex',
+		schema: v.object({
+			did: v.didString(),
+			handle: v.handleString(),
+			pds: v.genericUriString(),
+		}),
+	},
+});
+
+declare module '@atcute/lexicons/ambient' {
+	interface XRPCProcedures {
+		'x.aglais.requestAssertion': typeof requestAssertionSchema;
+	}
+
+	interface XRPCQueries {
+		'x.aglais.resolveIdentity': typeof resolveIdentitySchema;
+	}
+}

server/vite-env.d.ts

···
+/// <reference types="vite/client" />
+
+interface ImportMetaEnv {
+	readonly VITE_APP_NAME: string;
+}
+
+interface ImportMeta {
+	readonly env: ImportMetaEnv;
+}

src/components/main/sign-in-dialog.tsx

···
 
 			const authUrl = await createAuthorizationUrl({
 				target: target,
-				scope: import.meta.env.VITE_OAUTH_SCOPE,
+				scope: 'atproto transition:generic transition:chat.bsky',
 			});
 
 			setPending(`Redirecting to authorization page`);

src/main.tsx

···
 import { type JSX, createSignal, onMount } from 'solid-js';
 import { render } from 'solid-js/web';
 
-import type { Did, Handle } from '@atcute/lexicons';
+import { Client, ok, simpleFetchHandler } from '@atcute/client';
+import type { Did } from '@atcute/lexicons';
 import { configureOAuth } from '@atcute/oauth-browser-client';
 
 import * as navigation from '~/globals/navigation';
···
 import CircularProgress from '~/components/circular-progress';
 import ModalRenderer from '~/components/main/modal-renderer';
 
+import type {} from '../server/lexicons';
+
 import routes from './routes';
 import './service-worker';
 import Shell from './shell';
···
 
 // Configure OAuth
 {
+	const host = new Client({
+		handler: simpleFetchHandler({ service: location.origin }),
+	});
+
 	configureOAuth({
 		metadata: {
-			client_id: import.meta.env.VITE_OAUTH_CLIENT_ID,
-			redirect_uri: import.meta.env.VITE_OAUTH_REDIRECT_URL,
+			client_id: `${location.origin}/oauth-client-metadata.json`,
+			redirect_uri: `${location.origin}/oauth/callback`,
 		},
 
 		identityResolver: {
 			async resolve(actor) {
-				const url = new URL('https://slingshot.microcosm.blue/xrpc/com.bad-example.identity.resolveMiniDoc');
-				url.searchParams.set('identifier', actor);
+				const data = await ok(
+					host.get('x.aglais.resolveIdentity', {
+						params: {
+							identifier: actor,
+						},
+					}),
+				);
 
-				const response = await fetch(url);
-				if (!response.ok) {
-					throw new Error(`resolver responded with status ${response.status}`);
-				}
+				return data;
+			},
+		},
+		async fetchClientAssertion({ aud, jkt, createDpopProof }) {
+			const dpop = await createDpopProof(`${location.origin}/xrpc/x.aglais.requestAssertion`);
 
-				const json = (await response.json()) as {
-					did: Did;
-					handle: Handle;
-					pds: string;
-					signing_key: string;
-				};
+			const data = await ok(
+				host.post('x.aglais.requestAssertion', {
+					input: {
+						aud: aud,
+						jkt: jkt,
+					},
+					headers: {
+						dpop: dpop,
+					},
+				}),
+			);
 
-				return {
-					did: json.did,
-					handle: json.handle,
-					pds: json.pds,
-				};
-			},
+			return {
+				client_assertion_type: 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer',
+				client_assertion: data.assertion,
+			};
 		},
 	});
 }

src/vite-env.d.ts

···
 
 interface ImportMetaEnv {
 	readonly VITE_APP_NAME: string;
-
-	readonly VITE_DEV_SERVER_PORT?: string;
-	readonly VITE_CLIENT_URI: string;
-	readonly VITE_OAUTH_CLIENT_ID: string;
-	readonly VITE_OAUTH_REDIRECT_URL: string;
-	readonly VITE_OAUTH_SCOPE: string;
 }
 
 interface ImportMeta {

vite.config.ts

···
 import { VitePWA } from 'vite-plugin-pwa';
 import solid from 'vite-plugin-solid';
 
-import metadata from './public/oauth-client-metadata.json';
-
-const SERVER_HOST = '127.0.0.1';
-const SERVER_PORT = 52222;
-
 export default defineConfig({
 	build: {
 		target: 'esnext',
···
 		},
 	},
 	server: {
-		host: SERVER_HOST,
-		port: SERVER_PORT,
+		allowedHosts: ['.trycloudflare.com'],
 	},
 	optimizeDeps: {
 		esbuildOptions: {
···
 			},
 		}),
 
-		process.env.NODE_ENV === 'development' && cloudflare(),
+		cloudflare(),
 
 		VitePWA({
 			registerType: 'prompt',
···
 				);
 
 				return { code: transformed, map: null };
-			},
-		},
-
-		// Injects OAuth-related variables
-		{
-			name: 'aglais-oauth-inject',
-			config(_conf, { command }) {
-				if (command === 'build') {
-					process.env.VITE_OAUTH_CLIENT_ID = metadata.client_id;
-					process.env.VITE_OAUTH_REDIRECT_URL = metadata.redirect_uris[0];
-				} else {
-					const redirectUri = (() => {
-						const url = new URL(metadata.redirect_uris[0]);
-						return `http://${SERVER_HOST}:${SERVER_PORT}${url.pathname}`;
-					})();
-
-					const clientId =
-						`http://localhost` +
-						`?redirect_uri=${encodeURIComponent(redirectUri)}` +
-						`&scope=${encodeURIComponent(metadata.scope)}`;
-
-					process.env.VITE_DEV_SERVER_PORT = '' + SERVER_PORT;
-					process.env.VITE_OAUTH_CLIENT_ID = clientId;
-					process.env.VITE_OAUTH_REDIRECT_URL = redirectUri;
-				}
-
-				process.env.VITE_CLIENT_URI = metadata.client_uri;
-				process.env.VITE_OAUTH_SCOPE = metadata.scope;
 			},
 		},
 	],

wrangler.jsonc

···
 	"compatibility_date": "2025-08-16",
 	"main": "server/index.ts",
 	"assets": {
-		"directory": "dist",
 		"not_found_handling": "single-page-application",
-		"run_worker_first": ["/xrpc/*"],
+		"run_worker_first": ["/xrpc/*", "/oauth-client-metadata.json", "/oauth-jwks.json"],
 	},
 }