What this library won't do, and won't by being asked again: a DID, a handle or a server it won't ask, an answer it won't read, a sign-in that went wrong. Its message says why, to whoever asked (tcm prints it as it does any error a command meets).
A sign-in for `scope`, as `who` (a handle or DID) or, without one, the one used last: kept from before (its tokens refreshed if they've expired), or a new one, in the browser, kept for next time.
A DID's document: did:plc from the PLC directory, did:web from its host: a host name, and a port (`%3A`) alone, fetched as any server someone else names is (`guardedFetch`: https, public addresses only, no redirects).
Where identities are looked up, if not on the network itself: `$TCM_ATPROTO_DIRECTORY`, a PLC directory that also resolves handles (`com.atproto.identity.resolveHandle`), for a private network or a test's.
Whether the AT Protocol network is one on this machine, or a test's (`$TCM_ATPROTO_LOCAL=1`): plain http, and addresses only this machine or its network reach, are allowed for the servers records and documents name. Never set for a registry on the internet.
A server on 127.0.0.1 (a port of its own) for the browser to come back to from signing in: its port, and the query it comes back with (or a timeout, after `waitMs`). With `state`, only an answer with that state is taken: any other request (another program on this machine's) is turned away, and the sign-in goes on waiting.
A DID document's PDS (`#atproto_pds`), as an origin to put paths after: https (http on a local network), and nothing but a scheme and a host (no path, query or credentials, which would let a document choose where tcm's requests go on a host). Throws if there's none, or it's anything else.
Whether an IP address is one only this machine or its own network reaches: unspecified, loopback, private, link-local, carrier-grade NAT, benchmarking, multicast or reserved, unique-local, or an IPv4 address mapped into IPv6 that is one.
A URL tcm may fetch on someone else's say-so (a record's, a DID document's, a registry visitor's): https, with no credentials in it, at a host whose addresses are all public. On a local network (`localNetwork`) http, and any address, are allowed. Throws a `Refused` saying why otherwise.
Who a handle or DID is. A handle counts only both ways: it names the DID, and the DID's document names it back; a DID's handle is left out when it doesn't.
Sign in as `who` (a handle or DID) with OAuth, in the browser, for `scope`: as AT Protocol's loopback client (no client metadata to host), with PKCE and DPoP-bound tokens. `tell` says what's happening.
A DID's repository signing key, from its DID document (`#atproto`): a `Multikey`, or a legacy `EcdsaSecp256k1VerificationKey2019` / `EcdsaSecp256r1VerificationKey2019`, whose key is written uncompressed (as a PLC directory still serves some, and did:web documents may), compressed for importing.
A response's body, read only up to `max` bytes: one that says it's longer, or turns out to be, is refused (an answer from a server someone else names can't take all the memory there is).
An elliptic-curve public key in compressed form (33 bytes: 2 or 3 for y's parity, then x), as `importRaw` takes it; one written uncompressed (65 bytes: 4, x, y), as legacy DID documents write theirs, is compressed.
`fetch`, for a URL someone else gave (`publicUrl` checks it): redirects aren't followed (a server can't send tcm on to an address it wouldn't ask), and it gives up after `ms` (default 15 s).
The code an authorization server's answer gives, if it's this sign-in's: its state, no error, and its issuer named (RFC 9207) as the one asked. Throws saying which isn't so.
A record at `did`/`collection`/`rkey`, as its author's repository signs it: fetched from their PDS with `com.atproto.sync.getRecord`, its blocks checked against their CIDs and its commit against the DID's key. A DID, document or PDS tcm won't ask (`guardedFetch`, `pdsOf`), or a proof too big to be one, is `NotTheirs`; a record the repository doesn't hold is `NoSuchRecord`.