OAuth: Reset password & Sign-up

.changeset/brave-countries-return.md

@@ -0,0 +1,5 @@
+---
+"@atproto/oauth-provider": patch
+---
+
+Add support for password reset

.changeset/eleven-ducks-boil.md

@@ -0,0 +1,5 @@
+---
+"@atproto-labs/fetch": patch
+---
+
+Improved error response parsing

.changeset/hip-feet-play.md

@@ -0,0 +1,5 @@
+---
+"@atproto/oauth-provider": minor
+---
+
+Add support for account sign-up

.changeset/hungry-buttons-clean.md

@@ -0,0 +1,5 @@
+---
+"@atproto/oauth-client-browser-example": patch
+---
+
+Update react to version 19

.changeset/long-bats-guess.md

@@ -0,0 +1,7 @@
+---
+"@atproto/oauth-provider": patch
+"@atproto/oauth-types": patch
+"@atproto/jwk": patch
+---
+
+Properly support locales with 3 chars (Asturian)

.changeset/rotten-hornets-develop.md

@@ -0,0 +1,5 @@
+---
+"@atproto/oauth-provider": patch
+---
+
+Add support for multiple locales

.changeset/short-masks-punch.md

@@ -0,0 +1,5 @@
+---
+"@atproto/syntax": patch
+---
+
+Deprecate unused classes

.changeset/sour-guests-work.md

@@ -0,0 +1,5 @@
+---
+"@atproto-labs/rollup-plugin-bundle-manifest": patch
+---
+
+Improve typing of plugin

.changeset/tall-rules-hammer.md

@@ -0,0 +1,5 @@
+---
+"@atproto/oauth-client": patch
+---
+
+Minor code optimizations

.changeset/tiny-goats-sing.md

@@ -0,0 +1,5 @@
+---
+"@atproto-labs/fetch": patch
+---
+
+Remove explicit dependency on "zod". Improved typing of `fetchJsonZodProcessor` function.

.changeset/weak-elephants-thank.md

@@ -0,0 +1,5 @@
+---
+"@atproto/oauth-client-browser-example": patch
+---
+
+Build using SWC

.changeset/young-parents-learn.md

@@ -0,0 +1,5 @@
+---
+"@atproto/pds": patch
+---
+
+Add support for account sign-ups during OAuth flows

.github/workflows/repo.yaml

@@ -35,6 +35,7 @@ jobs:
           path: |
             packages/*/dist
             packages/*/*/dist
+            packages/oauth/oauth-provider/src/assets/app/locales/*/messages.ts
           retention-days: 1
   test:
     name: Test

.npmrc

@@ -1 +1,2 @@
 enable-pre-post-scripts = true
+include-workspace-root = true

.prettierignore

@@ -12,3 +12,6 @@ packages/api/src/client
 packages/bsky/src/lexicon
 packages/pds/src/lexicon
 packages/ozone/src/lexicon
+
+# Automatically generated by lingui
+packages/oauth/oauth-provider/src/assets/app/locales/*/messages.ts

.vscode/settings.json

@@ -12,6 +12,7 @@
     "consolas",
     "dpop",
     "googleusercontent",
+    "hcaptcha",
     "hexeditor",
     "ingester",
     "insertable",

package.json

@@ -11,21 +11,21 @@
   "packageManager": "pnpm@8.15.9",
   "scripts": {
     "lint:fix": "pnpm lint --fix",
-    "lint": "eslint . --ext .ts,.js",
+    "lint": "eslint . --ext .ts,.js,.tsx,.jsx",
     "style:fix": "prettier --write .",
     "style": "prettier --check .",
     "verify": "pnpm --stream '/^verify:.+$/'",
     "verify:style": "pnpm run style",
     "verify:lint": "pnpm lint",
     "verify:types": "tsc --build tsconfig.json",
     "format": "pnpm lint:fix && pnpm style:fix",
-    "codegen": "pnpm run --recursive --stream --filter '@atproto/lex-cli...' build --force && pnpm run --recursive --stream --parallel codegen",
-    "build": "pnpm --recursive --stream build",
-    "dev": "NODE_ENV=development pnpm --stream '/^dev:.+$/'",
-    "dev:tsc": "tsc --build tsconfig.json --watch",
-    "dev:pkg": "pnpm --recursive --parallel --stream dev",
-    "test": "LOG_ENABLED=false ./packages/dev-infra/with-test-redis-and-db.sh pnpm --stream -r test",
-    "test:withFlags": "LOG_ENABLED=false ./packages/dev-infra/with-test-redis-and-db.sh pnpm --stream -r test --",
+    "precodegen": "pnpm run --recursive --stream --filter '@atproto/lex-cli...' build --force",
+    "codegen": "pnpm run --recursive --stream --parallel codegen",
+    "build": "pnpm run --recursive --stream '/^(build|build:.+)$/'",
+    "dev": "NODE_ENV=development pnpm run --recursive --parallel --stream '/^(dev|dev:.+)$/'",
+    "dev:tsc": "tsc --build tsconfig.json --preserveWatchOutput --watch",
+    "test": "LOG_ENABLED=false ./packages/dev-infra/with-test-redis-and-db.sh pnpm test --stream --recursive",
+    "test:withFlags": "pnpm run test --",
     "changeset": "changeset",
     "release": "pnpm build && changeset publish",
     "version-packages": "changeset version && git add ."

packages/dev-env/src/pds.ts

@@ -37,7 +37,9 @@ export class TestPds {
       recoveryDidKey: recoveryKey,
       adminPassword: ADMIN_PASSWORD,
       jwtSecret: JWT_SECRET,
-      serviceHandleDomains: ['.test'],
+      // @NOTE ".example" will not actually work and is only used to display
+      // multiple domains in the sing-up UI
+      serviceHandleDomains: ['.test', '.example'],
       bskyAppViewUrl: 'https://appview.invalid',
       bskyAppViewDid: 'did:example:invalid',
       bskyAppViewCdnUrlPattern: 'http://cdn.appview.com/%s/%s/%s',
@@ -47,10 +49,15 @@ export class TestPds {
       inviteRequired: false,
       disableSsrfProtection: true,
       serviceName: 'Development PDS',
-      brandColor: '#ffcb1e',
-      errorColor: undefined,
+      brandColor: '#8338ec',
+      errorColor: '#ff006e',
+      warningColor: '#fb5607',
+      successColor: '#02c39a',
       logoUrl:
-        'https://uxwing.com/wp-content/themes/uxwing/download/animals-and-birds/bee-icon.png',
+        // Using a "data:" instead of a real URL to avoid making CORS requests in dev.
+        // License: https://uxwing.com/license/
+        // Source: https://uxwing.com/bee-icon/
+        `data:image/svg+xml;base64,${Buffer.from('<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 117.47 122.88"><defs><style>.cls-1,.cls-2{fill-rule:evenodd;}.cls-2{fill:#ffcb1e;}</style></defs><title>bee</title><path class="cls-1" d="M72.69,49.18c5.93.81,12.68,1.76,19.09,3.3,41.08,9.87,25.49,44.79,4.33,40.78A23.57,23.57,0,0,1,83.48,86.2c0,1.23-.12,2.45-.24,3.65a1.47,1.47,0,0,1-.07.72,49.21,49.21,0,0,1-6.78,20.68c-4.49,7.15-10.75,11.63-17.72,11.63S45.4,118.52,40.9,111.46a41.91,41.91,0,0,1-4-8.23l-.06-.18a54.7,54.7,0,0,1-3-17.22,24.75,24.75,0,0,1-13,7.43C.68,97.49-15.49,62.44,25.22,52.48A184,184,0,0,1,44.4,49.16l-.09-.09a9.18,9.18,0,0,1-1.9-2.74,28,28,0,0,1-2.26-10.81,17.15,17.15,0,0,1,5.41-12.45,18.57,18.57,0,0,1,7.78-4.42,19.21,19.21,0,0,0-2.19-7.07A8.05,8.05,0,0,0,47.4,8.13a4.77,4.77,0,1,1,1.38-3.36c0,.22,0,.43,0,.64a11,11,0,0,1,5,4.64,21.82,21.82,0,0,1,2.56,8,20.17,20.17,0,0,1,2.21-.13c.56,0,1.11,0,1.65.07a21.65,21.65,0,0,1,2.66-8.14,10.84,10.84,0,0,1,5.45-4.68c0-.14,0-.28,0-.42A4.77,4.77,0,1,1,69.49,8a7.8,7.8,0,0,0-4.07,3.48,18.73,18.73,0,0,0-2.26,7.06,18.57,18.57,0,0,1,8.31,4.56,17.11,17.11,0,0,1,5.41,12.45,27.65,27.65,0,0,1-2.6,11.38,10,10,0,0,1-1.59,2.28Z"/><path class="cls-2" d="M40.15,103.25a37.55,37.55,0,0,0,3.3,6.59c3.94,6.18,9.33,10,15.22,10s11.22-3.94,15.16-10.21A38.55,38.55,0,0,0,77,103.28q-9.49-5.66-18.7-5.66a33.91,33.91,0,0,0-18.17,5.63Zm31-37.85c-.65-1.51-1.29-3-1.92-4.42-1.84-4.19-3.37-7.81-5.18-12a21.24,21.24,0,0,0-5.76-.9,22,22,0,0,0-5.23.54C51.2,53,49.64,56.67,47.74,61l-1.89,4.36a41.7,41.7,0,0,1,12.58-2.09A37.6,37.6,0,0,1,71.17,65.4ZM69.39,25.26A15.7,15.7,0,0,0,58.52,21a15.89,15.89,0,0,0-3,.28,1.21,1.21,0,0,1-.33.07h0a15.56,15.56,0,0,0-7.47,3.93,14.13,14.13,0,0,0-4.46,10.26,24.67,24.67,0,0,0,2,9.51,6.21,6.21,0,0,0,1.24,1.83,1.43,1.43,0,0,0,1,.47,1.51,1.51,0,0,0,.64-.16,24,24,0,0,1,20.6.37,1.55,1.55,0,0,0,.73.2,1.57,1.57,0,0,0,1-.46,6.41,6.41,0,0,0,1.3-1.78,24.28,24.28,0,0,0,2.25-10,14.17,14.17,0,0,0-4.46-10.26Zm9.38,55c-1.86-2.83-4.59-10.46-7.11-11.45a35.4,35.4,0,0,0-13.21-2.54A40,40,0,0,0,45,68.82c-1.8.66-5.3,9.18-6.78,11.44-1.65,2.51-1.33,1.13-1.36,3.52,0,.12,0,.45,0,1s0,1.32,0,2c.29-.28.59-.55.89-.81C43.56,81,51.53,79.15,59.3,79.48S74.62,82.3,79.69,86.1l.73.58c0-.82.06-3.55.06-4.38,0-.39-.85-.74-1.71-2ZM37.19,90.9a50.67,50.67,0,0,0,1.94,9.42A36.54,36.54,0,0,1,58.32,94.6q9.78,0,19.73,5.78a52,52,0,0,0,2.08-9.86,17.62,17.62,0,0,0-2.26-2c-4.6-3.45-11.55-5.72-18.69-6S44.9,83.86,39.76,88.26a19.46,19.46,0,0,0-2.57,2.64Z"/></svg>', 'utf8').toString('base64')}`,
       homeUrl: 'https://bsky.social/',
       termsOfServiceUrl: 'https://bsky.social/about/support/tos',
       privacyPolicyUrl: 'https://bsky.social/about/support/privacy-policy',

packages/internal/fetch/package.json

@@ -28,9 +28,6 @@
   "devDependencies": {
     "typescript": "^5.6.3"
   },
-  "optionalDependencies": {
-    "zod": "^3.23.8"
-  },
   "scripts": {
     "build": "tsc --build tsconfig.json"
   }

packages/internal/fetch/src/fetch-response.ts

@@ -1,12 +1,10 @@
-import type { ParseParams, TypeOf, ZodTypeAny } from 'zod'
 import { Transformer, pipe } from '@atproto-labs/pipe'
 import { FetchError } from './fetch-error.js'
 import { TransformedResponse } from './transformed-response.js'
 import {
   Json,
   MaxBytesTransformStream,
   cancelBody,
-  ifObject,
   ifString,
   logCancellationError,
 } from './util.js'
@@ -69,15 +67,16 @@ const extractResponseMessage: ResponseMessageGetter = async (response) => {
       const json: unknown = await response.json()
 
       if (typeof json === 'string') return json
+      if (typeof json === 'object' && json != null) {
+        const errorDescription = ifString(json['error_description'])
+        if (errorDescription) return errorDescription
 
-      const errorDescription = ifString(ifObject(json)?.['error_description'])
-      if (errorDescription) return errorDescription
+        const error = ifString(json['error'])
+        if (error) return error
 
-      const error = ifString(ifObject(json)?.['error'])
-      if (error) return error
-
-      const message = ifString(ifObject(json)?.['message'])
-      if (message) return message
+        const message = ifString(json['message'])
+        if (message) return message
+      }
     }
   } catch {
     // noop
@@ -283,10 +282,31 @@ export function fetchJsonProcessor<T = Json>(
   )
 }
 
-export function fetchJsonZodProcessor<S extends ZodTypeAny>(
-  schema: S,
-  params?: Partial<ParseParams>,
-): Transformer<ParsedJsonResponse, TypeOf<S>> {
-  return async (jsonResponse: ParsedJsonResponse): Promise<TypeOf<S>> =>
-    schema.parseAsync(jsonResponse.json, params)
+export type SyncValidationSchema<S, P = unknown> = {
+  parse(value: unknown, params?: P): S
+}
+
+export type AsyncValidationSchema<S, P = unknown> = {
+  parseAsync(value: unknown, params?: P): Promise<S>
+}
+
+export function fetchJsonValidatorProcessor<S, P = unknown>(
+  schema: SyncValidationSchema<S, P> | AsyncValidationSchema<S, P>,
+  params?: P,
+): Transformer<ParsedJsonResponse, S> {
+  if ('parseAsync' in schema && typeof schema.parseAsync === 'function') {
+    return async (jsonResponse: ParsedJsonResponse): Promise<S> =>
+      schema.parseAsync(jsonResponse.json, params)
+  }
+
+  if ('parse' in schema && typeof schema.parse === 'function') {
+    return async (jsonResponse: ParsedJsonResponse): Promise<S> =>
+      schema.parse(jsonResponse.json, params)
+  }
+
+  // Needed for type safety (and allows fool proofing the usage of this function)
+  throw new TypeError('Invalid schema')
 }
+
+/** @note Use {@link fetchJsonValidatorProcessor} instead */
+export const fetchJsonZodProcessor = fetchJsonValidatorProcessor

packages/internal/fetch/src/util.ts

@@ -24,24 +24,6 @@ export function isIp(hostname: string) {
   return false
 }
 
-const plainObjectProto = Object.prototype
-export const ifObject = <V>(v: V) => {
-  if (typeof v === 'object' && v != null && !Array.isArray(v)) {
-    const proto = Object.getPrototypeOf(v)
-    if (proto === null || proto === plainObjectProto) {
-      // eslint-disable-next-line @typescript-eslint/ban-types
-      return v as V extends JsonScalar | JsonArray | Function | symbol
-        ? never
-        : V extends Json
-          ? V
-          : // Plain object are (mostly) safe to access using a string index
-            Record<string, unknown>
-    }
-  }
-
-  return undefined
-}
-
 export const ifString = <V>(v: V) => (typeof v === 'string' ? v : undefined)
 
 export class MaxBytesTransformStream extends TransformStream<

packages/internal/rollup-plugin-bundle-manifest/src/index.ts

@@ -32,7 +32,7 @@ export default function bundleManifest({
 }: {
   name?: string
   data?: boolean
-} = {}): Plugin {
+} = {}): Plugin<never> {
   return {
     name: 'bundle-manifest',
     generateBundle(outputOptions, bundle) {

packages/oauth/jwk/src/jwt.ts

@@ -129,7 +129,7 @@ export const jwtPayloadSchema = z
       .optional(),
     locale: z
       .string()
-      .regex(/^[a-z]{2}(-[A-Z]{2})?$/)
+      .regex(/^[a-z]{2,3}(-[A-Z]{2})?$/)
       .optional(),
     updated_at: z.number().int().optional(),
 

packages/oauth/oauth-client-browser-example/package.json

@@ -38,15 +38,14 @@
     "@rollup/plugin-json": "^6.1.0",
     "@rollup/plugin-html": "^1.0.4",
     "@rollup/plugin-node-resolve": "^15.2.3",
-    "@rollup/plugin-replace": "^5.0.5",
-    "@rollup/plugin-terser": "^0.4.4",
-    "@rollup/plugin-typescript": "^11.1.6",
-    "@types/react": "^18.2.50",
-    "@types/react-dom": "^18.2.18",
+    "@rollup/plugin-swc": "^0.4.0",
+    "@swc/helpers": "^0.5.15",
+    "@types/react": "^19.0.10",
+    "@types/react-dom": "^19.0.4",
     "autoprefixer": "^10.4.17",
     "postcss": "^8.4.33",
-    "react": "^18.2.0",
-    "react-dom": "^18.2.0",
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0",
     "rollup": "^4.13.0",
     "rollup-plugin-postcss": "^4.0.2",
     "rollup-plugin-serve": "^1.1.1",

packages/oauth/oauth-client-browser-example/rollup.config.js

@@ -4,9 +4,7 @@ const { default: commonjs } = require('@rollup/plugin-commonjs')
 const { default: html, makeHtmlAttributes } = require('@rollup/plugin-html')
 const { default: json } = require('@rollup/plugin-json')
 const { default: nodeResolve } = require('@rollup/plugin-node-resolve')
-const { default: replace } = require('@rollup/plugin-replace')
-const { default: terser } = require('@rollup/plugin-terser')
-const { default: typescript } = require('@rollup/plugin-typescript')
+const { default: swc } = require('@rollup/plugin-swc')
 const { defineConfig } = require('rollup')
 const {
   default: manifest,
@@ -19,7 +17,7 @@ module.exports = defineConfig((commandLineArguments) => {
     process.env['NODE_ENV'] ??
     (commandLineArguments.watch ? 'development' : 'production')
 
-  const minify = NODE_ENV !== 'development'
+  const devMode = NODE_ENV === 'development'
 
   return {
     input: 'src/main.tsx',
@@ -30,17 +28,46 @@ module.exports = defineConfig((commandLineArguments) => {
       format: 'iife',
     },
     plugins: [
+      {
+        name: 'resolve-swc-helpers',
+        resolveId(src) {
+          // For some reason, "nodeResolve" doesn't resolve these:
+          if (src.startsWith('@swc/helpers/')) return require.resolve(src)
+        },
+      },
       nodeResolve({ preferBuiltins: false, browser: true }),
       commonjs(),
       json(),
       postcss({ config: true, extract: true, minimize: false }),
-      typescript({
-        tsconfig: './tsconfig.build.json',
-        outputToFilesystem: true,
-      }),
-      replace({
-        preventAssignment: true,
-        values: { 'process.env.NODE_ENV': JSON.stringify(NODE_ENV) },
+      swc({
+        swc: {
+          swcrc: false,
+          configFile: false,
+          sourceMaps: true,
+          minify: !devMode,
+          jsc: {
+            minify: {
+              compress: {
+                module: true,
+                unused: true,
+              },
+              mangle: true,
+            },
+            externalHelpers: true,
+            target: 'es2020',
+            parser: { syntax: 'typescript', tsx: true },
+            transform: {
+              useDefineForClassFields: true,
+              react: { runtime: 'automatic' },
+              optimizer: {
+                simplify: true,
+                globals: {
+                  vars: { 'process.env.NODE_ENV': JSON.stringify(NODE_ENV) },
+                },
+              },
+            },
+          },
+        },
       }),
       html({
         title: 'OAuth Client Example',
@@ -79,7 +106,6 @@ module.exports = defineConfig((commandLineArguments) => {
           </html>
         `,
       }),
-      minify && terser({}),
       manifest({ name: 'files.json', data: true }),
 
       commandLineArguments.watch &&