atproto/browser/oauth/flow

Async mirror of atproto/oauth/flow.gleam: start an authorization flow (resolve the PDS, discover the authorization server, push the request (PAR) with PKCE + DPoP), returning the authorization URL and the pending Flow the caller must hold (e.g. in sessionStorage, or an in-memory store keyed by state) until the callback returns with the code.

A thin async wrapper over the shared effect kernel in atproto_core/oauth/flow: it generates the browser one-shots (WebCrypto PKCE, WebCrypto DPoP key, state) and folds the key into the Flow record the kernel never sees. Meant for a public client; confidential-client fields still go through extra_form.

pub type Flow {
  Flow(
    identifier: String,
    pds: String,
    issuer: String,
    token_endpoint: String,
    dpop_key: dpop.DpopKey,
    pkce_verifier: String,
    client_id: String,
    state: String,
  )
}

pub type FlowError {
  ResolveFailed(String)
  DiscoverFailed(String)
  ParFailed(String)
}

pub fn start(
  client: xrpc.Client,
  resolver resolver: String,
  identifier identifier: String,
  client_id client_id: String,
  redirect_uri redirect_uri: String,
  scope scope: String,
  extra_form extra_form: List(#(String, String)),
) -> promise.Promise(Result(#(String, Flow), FlowError))