@alteran/astro 0.3.0 → 0.3.1

package/README.md

@@ -94,7 +94,7 @@ Auth (JWT)
 - Use `Authorization: Bearer <accessJwt>` on write routes.
 - Secrets to set (Wrangler secrets or local bindings):
   - `USER_PASSWORD` (dev login password)
-  - `ACCESS_TOKEN_SECRET`, `REFRESH_TOKEN_SECRET` (HMAC keys)
+  - `ACCESS_TOKEN`, `REFRESH_TOKEN` (HMAC keys)
   - `PDS_DID`, `PDS_HANDLE`
 
 Rate limiting & limits
@@ -179,8 +179,8 @@ Set these secrets for each environment using `wrangler secret put <NAME> --env <
 | `PDS_DID` | Your DID identifier | `did:plc:abc123` or `did:web:example.com` |
 | `PDS_HANDLE` | Your handle | `user.bsky.social` |
 | `USER_PASSWORD` | Login password | Strong password |
-| `ACCESS_TOKEN_SECRET` | JWT access token secret | Random 32+ char string |
-| `REFRESH_TOKEN_SECRET` | JWT refresh token secret | Random 32+ char string |
+| `ACCESS_TOKEN` | JWT access token secret | Random 32+ char string |
+| `REFRESH_TOKEN` | JWT refresh token secret | Random 32+ char string |
 | `REPO_SIGNING_KEY` | Ed25519 signing key (base64) | From `generate-signing-key.ts` |
 
 **Generate secrets:**
@@ -196,8 +196,8 @@ bun run scripts/generate-signing-key.ts
 wrangler secret put PDS_DID --env production
 wrangler secret put PDS_HANDLE --env production
 wrangler secret put USER_PASSWORD --env production
-wrangler secret put ACCESS_TOKEN_SECRET --env production
-wrangler secret put REFRESH_TOKEN_SECRET --env production
+wrangler secret put ACCESS_TOKEN --env production
+wrangler secret put REFRESH_TOKEN --env production
 wrangler secret put REPO_SIGNING_KEY --env production
 # Optional: publish public key for DID document
 wrangler secret put REPO_SIGNING_KEY_PUBLIC --env production
@@ -212,8 +212,8 @@ Instead of Wrangler Secrets, you may bind secrets from Cloudflare Secret Store.
   // ...
   "secrets_store_secrets": [
     { "binding": "USER_PASSWORD", "secret_name": "user_password", "store_id": "<your-store-id>" },
-    { "binding": "ACCESS_TOKEN_SECRET", "secret_name": "access_token_secret", "store_id": "<your-store-id>" },
-    { "binding": "REFRESH_TOKEN_SECRET", "secret_name": "refresh_token_secret", "store_id": "<your-store-id>" },
+    { "binding": "ACCESS_TOKEN", "secret_name": "access_token", "store_id": "<your-store-id>" },
+    { "binding": "REFRESH_TOKEN", "secret_name": "refresh_token", "store_id": "<your-store-id>" },
     { "binding": "PDS_DID", "secret_name": "pds_did", "store_id": "<your-store-id>" },
     { "binding": "PDS_HANDLE", "secret_name": "pds_handle", "store_id": "<your-store-id>" }
   ]
@@ -312,7 +312,7 @@ Blob storage
 Secrets & config (Wrangler)
 - Required:
   - `PDS_DID`, `PDS_HANDLE`, `USER_PASSWORD`
-  - `ACCESS_TOKEN_SECRET`, `REFRESH_TOKEN_SECRET`
+  - `ACCESS_TOKEN`, `REFRESH_TOKEN`
 - Optional:
   - `PDS_ALLOWED_MIME`, `PDS_MAX_BLOB_SIZE`, `PDS_MAX_JSON_BYTES`, `PDS_RATE_LIMIT_PER_MIN`, `PDS_CORS_ORIGIN`
 - Durable Objects: ensure binding for `Sequencer` exists and migration tag added (see `wrangler.jsonc`).
@@ -370,7 +370,7 @@ wrangler secret put REPO_SIGNING_KEY  # From step 1
 wrangler secret put PDS_DID           # Your DID
 wrangler secret put PDS_HANDLE        # Your handle
 wrangler secret put USER_PASSWORD     # Login password
-wrangler secret put ACCESS_TOKEN_SECRET
+wrangler secret put REFRESH_TOKEN
 wrangler secret put REFRESH_TOKEN_SECRET
 # Optional: publish raw public key for DID document
 wrangler secret put REPO_SIGNING_KEY_PUBLIC
@@ -384,7 +384,7 @@ REPO_SIGNING_KEY=<base64-key-from-step-1>
 # Optional: publish raw 32-byte public key in did.json
 REPO_SIGNING_KEY_PUBLIC=<base64-raw-public-key>
 USER_PASSWORD=your-password
-ACCESS_TOKEN_SECRET=your-access-secret
+REFRESH_TOKEN=your-access-secret
 REFRESH_TOKEN_SECRET=your-refresh-secret
 PDS_SEQ_WINDOW=512
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alteran/astro",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Astro integration for running a Cloudflare-hosted Bluesky PDS with Alteran.",
   "module": "index.js",
   "types": "index.d.ts",
@@ -39,7 +39,8 @@
     "db:apply:local:direct": "wrangler d1 migrations apply pds --local",
     "db:reset:local": "rm -rf .wrangler/state && rm -rf drizzle && bun run db:generate && bun run db:apply:local",
     "secrets:setup": "bun run scripts/setup-secrets.ts",
-    "relay:request-crawl": "bun run scripts/request-crawl.ts"
+    "relay:request-crawl": "bun run scripts/request-crawl.ts",
+    "pds:test-create-session": "bun run scripts/test-create-session.ts"
   },
   "devDependencies": {
     "@astrojs/cloudflare": "^12.6.9",

package/src/lib/jwt.ts

@@ -1,7 +1,11 @@
-import type { Env } from '../env';
-import { getRuntimeString } from './secrets';
-import { base58btc } from 'multiformats/bases/base58';
-import { issueSessionTokens, verifyAccessToken, verifyRefreshToken } from './session-tokens';
+import type { Env } from "../env";
+import { getRuntimeString } from "./secrets";
+import { base58btc } from "multiformats/bases/base58";
+import {
+  issueSessionTokens,
+  verifyAccessToken,
+  verifyRefreshToken,
+} from "./session-tokens";
 
 export interface JwtClaims {
   sub: string; // DID
@@ -9,26 +13,35 @@ export interface JwtClaims {
   scope?: string;
   aud?: string;
   jti?: string;
-  t: 'access' | 'refresh';
+  t: "access" | "refresh";
 }
 
 // JWT
-export async function signJwt(env: Env, claims: JwtClaims, kind: 'access' | 'refresh'): Promise<string> {
+export async function signJwt(
+  env: Env,
+  claims: JwtClaims,
+  kind: "access" | "refresh",
+): Promise<string> {
   if (!claims.sub) {
-    throw new Error('Cannot sign JWT without subject');
+    throw new Error("Cannot sign JWT without subject");
   }
   const { accessJwt, refreshJwt } = await issueSessionTokens(env, claims.sub, {
     jti: claims.jti,
   });
-  return kind === 'access' ? accessJwt : refreshJwt;
+  return kind === "access" ? accessJwt : refreshJwt;
 }
 
-export async function verifyJwt(env: Env, token: string): Promise<{ valid: boolean; payload: JwtClaims } | null> {
-  const parts = token.split('.');
+export async function verifyJwt(
+  env: Env,
+  token: string,
+): Promise<{ valid: boolean; payload: JwtClaims } | null> {
+  const parts = token.split(".");
   if (parts.length !== 3) return null;
-  const header = JSON.parse(atob(parts[0].replace(/-/g, '+').replace(/_/g, '/')));
+  const header = JSON.parse(
+    atob(parts[0].replace(/-/g, "+").replace(/_/g, "/")),
+  );
 
-  if (header.typ === 'at+jwt') {
+  if (header.typ === "at+jwt") {
     const payload = await verifyAccessToken(env, token).catch(() => null);
     if (!payload) return null;
     if (!payload.sub) return null;
@@ -37,7 +50,7 @@ export async function verifyJwt(env: Env, token: string): Promise<{ valid: boole
       aud: payload.aud as string | undefined,
       scope: payload.scope as string | undefined,
       jti: payload.jti as string | undefined,
-      t: 'access',
+      t: "access",
     };
     if (payload.handle) {
       claims.handle = String(payload.handle);
@@ -45,7 +58,7 @@ export async function verifyJwt(env: Env, token: string): Promise<{ valid: boole
     return { valid: true, payload: claims };
   }
 
-  if (header.typ === 'refresh+jwt') {
+  if (header.typ === "refresh+jwt") {
     const verified = await verifyRefreshToken(env, token).catch(() => null);
     if (!verified) return null;
     if (!verified.payload.sub) return null;
@@ -54,24 +67,26 @@ export async function verifyJwt(env: Env, token: string): Promise<{ valid: boole
       aud: verified.payload.aud as string | undefined,
       scope: verified.payload.scope as string | undefined,
       jti: verified.payload.jti as string | undefined,
-      t: 'refresh',
+      t: "refresh",
     };
     return { valid: true, payload };
   }
 
-  const payload = JSON.parse(atob(parts[1].replace(/-/g, '+').replace(/_/g, '/')));
+  const payload = JSON.parse(
+    atob(parts[1].replace(/-/g, "+").replace(/_/g, "/")),
+  );
 
   let ok = false;
-  if (header.alg === 'HS256' && header.typ === 'JWT') {
+  if (header.alg === "HS256" && header.typ === "JWT") {
     const secret = await getRuntimeString(
       env,
-      payload.t === 'refresh' ? 'REFRESH_TOKEN_SECRET' : 'ACCESS_TOKEN_SECRET',
-      payload.t === 'refresh' ? 'dev-refresh' : 'dev-access'
+      payload.t === "refresh" ? "REFRESH_TOKEN_SECRET" : "REFRESH_TOKEN",
+      payload.t === "refresh" ? "dev-refresh" : "dev-access",
     );
     if (!secret) return null;
-    ok = await hmacJwtVerify(parts[0] + '.' + parts[1], parts[2], secret);
-  } else if (header.alg === 'EdDSA' && header.typ === 'JWT') {
-    ok = await eddsaJwtVerify(parts[0] + '.' + parts[1], parts[2], env);
+    ok = await hmacJwtVerify(parts[0] + "." + parts[1], parts[2], secret);
+  } else if (header.alg === "EdDSA" && header.typ === "JWT") {
+    ok = await eddsaJwtVerify(parts[0] + "." + parts[1], parts[2], env);
   } else {
     return null;
   }
@@ -83,113 +98,152 @@ export async function verifyJwt(env: Env, token: string): Promise<{ valid: boole
 
 async function hmacJwtSign(payload: any, secret: string): Promise<string> {
   const enc = new TextEncoder();
-  const header = { alg: 'HS256', typ: 'JWT' };
+  const header = { alg: "HS256", typ: "JWT" };
   const h = b64url(enc.encode(JSON.stringify(header)));
   const p = b64url(enc.encode(JSON.stringify(payload)));
   const data = `${h}.${p}`;
-  const key = await crypto.subtle.importKey('raw', enc.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
-  const sig = await crypto.subtle.sign('HMAC', key, enc.encode(data));
+  const key = await crypto.subtle.importKey(
+    "raw",
+    enc.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"],
+  );
+  const sig = await crypto.subtle.sign("HMAC", key, enc.encode(data));
   const s = b64url(new Uint8Array(sig));
   return `${h}.${p}.${s}`;
 }
 
-async function hmacJwtVerify(data: string, sigB64: string, secret: string): Promise<boolean> {
+async function hmacJwtVerify(
+  data: string,
+  sigB64: string,
+  secret: string,
+): Promise<boolean> {
   const enc = new TextEncoder();
-  const key = await crypto.subtle.importKey('raw', enc.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['verify']);
-  const ok = await crypto.subtle.verify('HMAC', key, b64urlDecode(sigB64), enc.encode(data));
+  const key = await crypto.subtle.importKey(
+    "raw",
+    enc.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["verify"],
+  );
+  const ok = await crypto.subtle.verify(
+    "HMAC",
+    key,
+    b64urlDecode(sigB64),
+    enc.encode(data),
+  );
   return !!ok;
 }
 
 async function eddsaJwtSign(payload: any, env: Env): Promise<string> {
   const enc = new TextEncoder();
-  const header = { alg: 'EdDSA', typ: 'JWT' };
+  const header = { alg: "EdDSA", typ: "JWT" };
   const h = b64url(enc.encode(JSON.stringify(header)));
   const p = b64url(enc.encode(JSON.stringify(payload)));
   const data = `${h}.${p}`;
 
   // Import Ed25519 private key from env
-  const keyData = await getRuntimeString(env, 'REPO_SIGNING_KEY');
+  const keyData = await getRuntimeString(env, "REPO_SIGNING_KEY");
   if (!keyData) {
-    throw new Error('REPO_SIGNING_KEY not configured for EdDSA JWTs');
+    throw new Error("REPO_SIGNING_KEY not configured for EdDSA JWTs");
   }
 
   // Decode base64 private key
   const keyBytes = b64urlDecode(keyData);
   const key = await crypto.subtle.importKey(
-    'pkcs8',
+    "pkcs8",
     keyBytes,
-    { name: 'Ed25519' } as any,
+    { name: "Ed25519" } as any,
     false,
-    ['sign']
+    ["sign"],
   );
 
-  const sig = await crypto.subtle.sign('Ed25519', key, enc.encode(data));
+  const sig = await crypto.subtle.sign("Ed25519", key, enc.encode(data));
   const s = b64url(new Uint8Array(sig));
   return `${h}.${p}.${s}`;
 }
 
-async function eddsaJwtVerify(data: string, sigB64: string, env: Env): Promise<boolean> {
+async function eddsaJwtVerify(
+  data: string,
+  sigB64: string,
+  env: Env,
+): Promise<boolean> {
   const enc = new TextEncoder();
 
   // Import Ed25519 public key from env
-  const keyData = await getRuntimeString(env, 'REPO_SIGNING_KEY_PUBLIC');
+  const keyData = await getRuntimeString(env, "REPO_SIGNING_KEY_PUBLIC");
   if (!keyData) {
-    console.error('EdDSA JWT verification failed: REPO_SIGNING_KEY_PUBLIC not configured');
+    console.error(
+      "EdDSA JWT verification failed: REPO_SIGNING_KEY_PUBLIC not configured",
+    );
     return false;
   }
 
   try {
     const key = await importEd25519PublicKey(keyData);
     if (!key) {
-      console.error('EdDSA JWT verification failed: unsupported public key format for Ed25519');
+      console.error(
+        "EdDSA JWT verification failed: unsupported public key format for Ed25519",
+      );
       return false;
     }
 
-    const ok = await crypto.subtle.verify('Ed25519', key, b64urlDecode(sigB64), enc.encode(data));
+    const ok = await crypto.subtle.verify(
+      "Ed25519",
+      key,
+      b64urlDecode(sigB64),
+      enc.encode(data),
+    );
     return !!ok;
   } catch (error) {
-    console.error('EdDSA JWT verification error:', error);
+    console.error("EdDSA JWT verification error:", error);
     return false;
   }
 }
 
 function b64url(bytes: ArrayBuffer | Uint8Array): string {
   const b = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
-  let s = '';
+  let s = "";
   for (let i = 0; i < b.length; i++) {
     s += String.fromCharCode(b[i]);
   }
-  return btoa(s).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 
 function b64urlDecode(s: string): Uint8Array {
-  const pad = s.length % 4 === 2 ? '==' : s.length % 4 === 3 ? '=' : '';
-  const bin = atob(s.replace(/-/g, '+').replace(/_/g, '/') + pad);
+  const pad = s.length % 4 === 2 ? "==" : s.length % 4 === 3 ? "=" : "";
+  const bin = atob(s.replace(/-/g, "+").replace(/_/g, "/") + pad);
   const out = new Uint8Array(bin.length);
   for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
   return out;
 }
 
-async function importEd25519PublicKey(value: string): Promise<CryptoKey | null> {
+async function importEd25519PublicKey(
+  value: string,
+): Promise<CryptoKey | null> {
   const attempts = buildPublicKeyCandidates(value);
   for (const attempt of attempts) {
     try {
       return await crypto.subtle.importKey(
         attempt.format,
         attempt.data,
-        { name: 'Ed25519', namedCurve: 'Ed25519' } as any,
+        { name: "Ed25519", namedCurve: "Ed25519" } as any,
         false,
-        ['verify']
+        ["verify"],
       );
     } catch (error) {
-      console.warn('EdDSA JWT verification warning: failed to import key candidate', error);
+      console.warn(
+        "EdDSA JWT verification warning: failed to import key candidate",
+        error,
+      );
     }
   }
   return null;
 }
 
 type KeyImportAttempt = { format: KeyFormat; data: Uint8Array };
-type KeyFormat = 'raw' | 'spki';
+type KeyFormat = "raw" | "spki";
 
 function buildPublicKeyCandidates(value: string): KeyImportAttempt[] {
   const trimmed = value.trim();
@@ -197,24 +251,26 @@ function buildPublicKeyCandidates(value: string): KeyImportAttempt[] {
 
   const didKeyCandidate = decodeDidKey(trimmed);
   if (didKeyCandidate) {
-    attempts.push({ format: 'raw', data: didKeyCandidate });
+    attempts.push({ format: "raw", data: didKeyCandidate });
   }
 
-  const pemMatch = trimmed.match(/-----BEGIN PUBLIC KEY-----([\s\S]+?)-----END PUBLIC KEY-----/);
+  const pemMatch = trimmed.match(
+    /-----BEGIN PUBLIC KEY-----([\s\S]+?)-----END PUBLIC KEY-----/,
+  );
   if (pemMatch) {
-    const derBytes = decodeBase64(pemMatch[1].replace(/\s+/g, ''));
+    const derBytes = decodeBase64(pemMatch[1].replace(/\s+/g, ""));
     if (derBytes) {
-      attempts.push({ format: 'spki', data: derBytes });
+      attempts.push({ format: "spki", data: derBytes });
     }
   }
 
-  const compact = trimmed.replace(/\s+/g, '');
+  const compact = trimmed.replace(/\s+/g, "");
   const decoded = decodeBase64(compact);
   if (decoded) {
     if (decoded.length === 32) {
-      attempts.push({ format: 'raw', data: decoded });
+      attempts.push({ format: "raw", data: decoded });
     } else {
-      attempts.push({ format: 'spki', data: decoded });
+      attempts.push({ format: "spki", data: decoded });
     }
   }
 
@@ -222,21 +278,21 @@ function buildPublicKeyCandidates(value: string): KeyImportAttempt[] {
 }
 
 function decodeBase64(value: string): Uint8Array | null {
-  const cleaned = value.replace(/\s+/g, '');
+  const cleaned = value.replace(/\s+/g, "");
   if (!cleaned) return null;
   try {
     return b64urlDecode(cleaned);
   } catch {
-    const normalized = cleaned.replace(/-/g, '+').replace(/_/g, '/');
+    const normalized = cleaned.replace(/-/g, "+").replace(/_/g, "/");
     const padLength = normalized.length % 4;
     const padded =
       padLength === 0
         ? normalized
         : padLength === 2
-          ? normalized + '=='
+          ? normalized + "=="
           : padLength === 3
-            ? normalized + '='
-            : normalized + '===';
+            ? normalized + "="
+            : normalized + "===";
     const bin = atob(padded);
     const out = new Uint8Array(bin.length);
     for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
@@ -245,16 +301,21 @@ function decodeBase64(value: string): Uint8Array | null {
 }
 
 function decodeDidKey(didKey: string): Uint8Array | null {
-  if (!didKey.startsWith('did:key:')) return null;
+  if (!didKey.startsWith("did:key:")) return null;
   try {
-    const multibase = didKey.slice('did:key:'.length);
+    const multibase = didKey.slice("did:key:".length);
     const bytes = base58btc.decode(multibase);
     if (bytes.length === 34 && bytes[0] === 0xed && bytes[1] === 0x01) {
       return bytes.slice(2);
     }
-    console.warn('EdDSA JWT verification warning: unsupported did:key multicodec prefix');
+    console.warn(
+      "EdDSA JWT verification warning: unsupported did:key multicodec prefix",
+    );
   } catch (error) {
-    console.warn('EdDSA JWT verification warning: failed to parse did:key', error);
+    console.warn(
+      "EdDSA JWT verification warning: failed to parse did:key",
+      error,
+    );
   }
   return null;
 }

package/src/lib/secrets.ts

@@ -1,29 +1,33 @@
-import { setGetEnv } from 'astro/env/setup';
-import type { Env } from '../env';
-import type { SecretsStoreSecret } from '../../types/env';
+import { setGetEnv } from "astro/env/setup";
+import type { Env } from "../env";
+import type { SecretsStoreSecret } from "../../types/env";
 
 const SECRET_KEYS = [
-  'PDS_DID',
-  'PDS_HANDLE',
-  'USER_PASSWORD',
-  'ACCESS_TOKEN_SECRET',
-  'REFRESH_TOKEN_SECRET',
-  'SESSION_JWT_SECRET',
-  'REPO_SIGNING_KEY',
-  'REPO_SIGNING_KEY_PUBLIC',
-  'PDS_PLC_ROTATION_KEY',
-  'PDS_SERVICE_SIGNING_KEY_HEX',
+  "PDS_DID",
+  "PDS_HANDLE",
+  "USER_PASSWORD",
+  "REFRESH_TOKEN",
+  "REFRESH_TOKEN_SECRET",
+  "SESSION_JWT_SECRET",
+  "REPO_SIGNING_KEY",
+  "REPO_SIGNING_KEY_PUBLIC",
+  "PDS_PLC_ROTATION_KEY",
+  "PDS_SERVICE_SIGNING_KEY_HEX",
 ] as const satisfies readonly (keyof Env)[];
 
 function isSecretStoreBinding(value: unknown): value is SecretsStoreSecret {
-  return !!value && typeof value === 'object' && typeof (value as any).get === 'function';
+  return (
+    !!value &&
+    typeof value === "object" &&
+    typeof (value as any).get === "function"
+  );
 }
 
 export async function resolveSecret(
-  value: string | SecretsStoreSecret | undefined
+  value: string | SecretsStoreSecret | undefined,
 ): Promise<string | undefined> {
   if (value === undefined) return undefined;
-  if (typeof value === 'string') return value;
+  if (typeof value === "string") return value;
   if (isSecretStoreBinding(value)) return value.get();
   return undefined;
 }
@@ -41,15 +45,16 @@ export async function resolveEnvSecrets<E extends Env>(env: E): Promise<E> {
       if (val !== undefined) {
         resolved[key as string] = val;
       }
-    })
+    }),
   );
 
   setGetEnv((key) => {
     const local = resolved[key];
-    if (typeof local === 'string') return local;
-    if (typeof local === 'number' || typeof local === 'boolean') return String(local);
+    if (typeof local === "string") return local;
+    if (typeof local === "number" || typeof local === "boolean")
+      return String(local);
     const fallback = process.env[key];
-    return typeof fallback === 'string' ? fallback : undefined;
+    return typeof fallback === "string" ? fallback : undefined;
   });
 
   return resolved as E;
@@ -62,7 +67,7 @@ let astroGetSecret: AstroGetSecret | null | undefined;
 async function loadAstroGetSecret(): Promise<AstroGetSecret | null> {
   if (astroGetSecret !== undefined) return astroGetSecret;
   try {
-    const mod = await import('astro:env/server');
+    const mod = await import("astro:env/server");
     astroGetSecret = mod.getSecret as AstroGetSecret;
   } catch {
     astroGetSecret = null;
@@ -73,10 +78,10 @@ async function loadAstroGetSecret(): Promise<AstroGetSecret | null> {
 export async function getRuntimeString<K extends keyof Env>(
   env: Env,
   key: K,
-  fallback?: string
+  fallback?: string,
 ): Promise<string | undefined> {
   const current = env[key];
-  if (typeof current === 'string' && current !== '') {
+  if (typeof current === "string" && current !== "") {
     return current;
   }
 
@@ -84,7 +89,7 @@ export async function getRuntimeString<K extends keyof Env>(
   if (secretFn) {
     try {
       const value = secretFn(String(key));
-      if (typeof value === 'string' && value !== '') {
+      if (typeof value === "string" && value !== "") {
         return value;
       }
     } catch (error) {

package/src/worker/runtime.ts

@@ -63,6 +63,18 @@ export function createPdsFetchHandler(options?: CreatePdsFetchHandlerOptions): P
       ) as unknown as WorkersResponse;
     }
 
+    // Short-circuit CORS preflight at the worker entrypoint to avoid
+    // adapter/method routing mismatches causing 500s on OPTIONS.
+    if (request.method === 'OPTIONS') {
+      const headers = new Headers({
+        'Access-Control-Allow-Origin': '*',
+        'Access-Control-Allow-Methods': '*',
+        'Access-Control-Allow-Headers': '*',
+        'Access-Control-Max-Age': '86400',
+      });
+      return new Response(null, { status: 204, headers }) as unknown as WorkersResponse;
+    }
+
     await seed(resolvedEnv.DB, (resolvedEnv.PDS_DID as string | undefined) ?? 'did:example:single-user');
 
     // Fire-and-forget: let relays know this PDS exists and is reachable.

package/types/env.d.ts

@@ -5,7 +5,7 @@ import type {
   DurableObjectNamespace,
   ExecutionContext,
   R2Bucket,
-} from '@cloudflare/workers-types';
+} from "@cloudflare/workers-types";
 
 // Minimal Secret Store binding interface. Cloudflare exposes each bound secret
 // as an object with an async `get()` that returns the secret value.
@@ -27,7 +27,7 @@ declare global {
     PDS_ALLOWED_MIME?: string;
     USER_PASSWORD?: string | SecretsStoreSecret;
     PDS_MAX_BLOB_SIZE?: string;
-    ACCESS_TOKEN_SECRET?: string | SecretsStoreSecret;
+    REFRESH_TOKEN?: string | SecretsStoreSecret;
     REFRESH_TOKEN_SECRET?: string | SecretsStoreSecret;
     SESSION_JWT_SECRET?: string | SecretsStoreSecret;
     PDS_ACCESS_TTL_SEC?: string;
@@ -46,8 +46,8 @@ declare global {
     PDS_BSKY_APP_VIEW_CDN_URL_PATTERN?: string;
     PDS_SERVICE_SIGNING_KEY_HEX?: string | SecretsStoreSecret;
     // Relay crawl configuration
-    PDS_RELAY_HOSTS?: string;          // CSV of relay hostnames (no scheme). Default: bsky.network
-    PDS_RELAY_NOTIFY?: string;         // 'false' to disable auto notify
+    PDS_RELAY_HOSTS?: string; // CSV of relay hostnames (no scheme). Default: bsky.network
+    PDS_RELAY_NOTIFY?: string; // 'false' to disable auto notify
   }
 
   namespace App {