@alteran/astro 0.5.2 → 0.6.3

package/README.md

@@ -254,6 +254,18 @@ validateConfigOrThrow(env);
 - Handle format is valid
 - Numeric values are positive
 
+### Cloudflare Security Rules
+
+`com.atproto.server.refreshSession` is a valid bodyless `POST`. Production deployments must allow this request shape through to the XRPC handler:
+
+```txt
+(http.request.method eq "POST" and http.request.uri.path eq "/xrpc/com.atproto.server.refreshSession")
+```
+
+Astro's SSR origin-check middleware rejects unsafe requests with no `Origin` header before project middleware runs. Alteran normalizes `/xrpc/*` requests at the Worker entrypoint so bearer-token XRPC clients can send bodyless POSTs without tripping Astro's form CSRF guard.
+
+If Cloudflare WAF/API Shield also protects the deployment, keep any exception narrow to the expression above. This exception is not configured in `wrangler.jsonc`; Wrangler only manages the Worker deployment and bindings.
+
 ### Environment-Specific Settings
 
 See [`wrangler.jsonc`](wrangler.jsonc:40) for environment-specific configurations:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alteran/astro",
-  "version": "0.5.2",
+  "version": "0.6.3",
   "description": "Astro integration for running a Cloudflare-hosted Bluesky PDS with Alteran.",
   "module": "index.js",
   "types": "index.d.ts",

package/src/db/client.ts

@@ -3,5 +3,5 @@ import { drizzle } from 'drizzle-orm/d1';
 import type { Env } from '../env';
 
 export function getDb(env: Env) {
-  return drizzle(env.DB);
+  return drizzle(env.ALTERAN_DB);
 }

package/src/db/repo.ts

@@ -10,7 +10,7 @@ import { encodeBlocksForCommit } from '../services/car';
 import { ServerMisconfigured } from '../lib/errors';
 
 export async function getRoot(env: Env) {
-  const db = drizzle(env.DB);
+  const db = drizzle(env.ALTERAN_DB);
   const did = (await resolveSecret(env.PDS_DID)) ?? 'did:example:single-user';
   return db.select().from(repo_root).where(eq(repo_root.did, did)).get();
 }
@@ -30,7 +30,7 @@ export async function bumpRoot(env: Env, prevMstRoot?: CID, currentMstRoot?: CID
   sig: string;
   blocks: string; // base64-encoded CAR
 }> {
-  const db = drizzle(env.DB);
+  const db = drizzle(env.ALTERAN_DB);
   const did = (await resolveSecret(env.PDS_DID)) ?? 'did:example:single-user';
 
   // Falls back to an ephemeral key only in non-production so dev runs work
@@ -107,7 +107,7 @@ export async function bumpRoot(env: Env, prevMstRoot?: CID, currentMstRoot?: CID
 }
 
 export async function appendCommit(env: Env, cid: string, rev: string, data: string, sig: string) {
-  const db = drizzle(env.DB);
+  const db = drizzle(env.ALTERAN_DB);
   const ts = Date.now();
 
   await db

package/src/handlers/debug.ts

@@ -3,7 +3,7 @@ import { putRecord as dalPutRecord, getRecord as dalGetRecord } from '../db/dal'
 
 export async function POST_db_bootstrap(ctx: APIContext) {
   const env: any = (ctx.locals as any).runtime?.env ?? (ctx.locals as any) ?? (globalThis as any);
-  const db = env.DB;
+  const db = env.ALTERAN_DB;
   await db.exec("CREATE TABLE IF NOT EXISTS record (uri TEXT PRIMARY KEY, cid TEXT NOT NULL, json TEXT NOT NULL, created_at INTEGER DEFAULT (strftime('%s','now')));");
   await db.exec("CREATE TABLE IF NOT EXISTS blob (cid TEXT PRIMARY KEY, key TEXT NOT NULL, mime TEXT NOT NULL, size INTEGER NOT NULL);");
   await db.exec("CREATE TABLE IF NOT EXISTS blob_usage (record_uri TEXT NOT NULL, key TEXT NOT NULL);");

package/src/handlers/ready.ts

@@ -2,7 +2,7 @@ import type { APIContext } from 'astro';
 
 export async function GET(ctx: APIContext) {
   try {
-    const db = (ctx.locals as any).runtime?.env?.DB ?? (ctx.locals as any).DB ?? (globalThis as any).DB;
+    const db = (ctx.locals as any).runtime?.env?.ALTERAN_DB ?? (ctx.locals as any).ALTERAN_DB ?? (globalThis as any).ALTERAN_DB;
     if (db) {
       await db.prepare('select 1').first();
     }

package/src/handlers/root.ts

@@ -81,7 +81,7 @@ const HTML_TEMPLATE = (
         <strong>DID:</strong>
         <span class="pill">${did}</span>
       </p>
-      <a href="https://github.com/alteran-dev/alteran" target="_blank" rel="noopener noreferrer">
+      <a href="https://github.com/alteran-social/alteran" target="_blank" rel="noopener noreferrer">
         <svg viewBox="0 0 24 24" role="img" aria-hidden="true" focusable="false">
           <path
             fill="currentColor"

package/src/handlers/xrpc.server.refreshSession.ts

@@ -23,9 +23,9 @@ export async function POST(ctx: APIContext) {
   if (!ver || ver.payload.t !== 'refresh') return Response.json({ error: 'InvalidToken' }, { status: 401 });
 
   const jtiOld = String(ver.payload.jti || '');
-  if (jtiOld && env.DB) {
-    await env.DB.exec('CREATE TABLE IF NOT EXISTS token_revocation (refresh_jti TEXT PRIMARY KEY, exp INTEGER NOT NULL);');
-    const row: any = await env.DB.prepare('SELECT refresh_jti FROM token_revocation WHERE refresh_jti=?').bind(jtiOld).first();
+  if (jtiOld && env.ALTERAN_DB) {
+    await env.ALTERAN_DB.exec('CREATE TABLE IF NOT EXISTS token_revocation (refresh_jti TEXT PRIMARY KEY, exp INTEGER NOT NULL);');
+    const row: any = await env.ALTERAN_DB.prepare('SELECT refresh_jti FROM token_revocation WHERE refresh_jti=?').bind(jtiOld).first();
     if (row?.refresh_jti) return Response.json({ error: 'InvalidToken' }, { status: 401 });
   }
 
@@ -34,9 +34,9 @@ export async function POST(ctx: APIContext) {
   const jtiNew = crypto.randomUUID();
   const accessJwt = await signJwt(ctx, { sub: did, handle, t: 'access' }, 'access');
   const refreshJwt = await signJwt(ctx, { sub: did, handle, t: 'refresh', jti: jtiNew }, 'refresh');
-  if (jtiOld && ver.payload.exp && env.DB) {
-    await env.DB.exec('CREATE TABLE IF NOT EXISTS token_revocation (refresh_jti TEXT PRIMARY KEY, exp INTEGER NOT NULL);');
-    await env.DB.prepare('INSERT OR REPLACE INTO token_revocation (refresh_jti, exp) VALUES (?,?)').bind(jtiOld, Number(ver.payload.exp)).run();
+  if (jtiOld && ver.payload.exp && env.ALTERAN_DB) {
+    await env.ALTERAN_DB.exec('CREATE TABLE IF NOT EXISTS token_revocation (refresh_jti TEXT PRIMARY KEY, exp INTEGER NOT NULL);');
+    await env.ALTERAN_DB.prepare('INSERT OR REPLACE INTO token_revocation (refresh_jti, exp) VALUES (?,?)').bind(jtiOld, Number(ver.payload.exp)).run();
   }
   return Response.json({ did, handle, accessJwt, refreshJwt });
 }

package/src/lib/actor.ts

@@ -53,7 +53,7 @@ export async function fetchProfileRecord(env: Env, did: string): Promise<Profile
   const upperBound = `at://~`; // '~' sorts after all valid DIDs
 
   // Find any profile record - scan from "at://" to "at://~" and filter in app
-  const fallback = await env.DB.prepare(
+  const fallback = await env.ALTERAN_DB.prepare(
     'SELECT json FROM record WHERE uri >= ? AND uri < ? ORDER BY rowid DESC LIMIT 50'
   )
     .bind(prefix, upperBound)

package/src/lib/blockstore-gc.ts

@@ -11,7 +11,7 @@ import * as dagCbor from '@ipld/dag-cbor';
  * This traverses the MST structure to find all blocks that are still in use
  */
 async function collectReferencedCids(env: Env, keepCommits: number = 10000): Promise<Set<string>> {
-  const db = drizzle(env.DB);
+  const db = drizzle(env.ALTERAN_DB);
   const referenced = new Set<string>();
 
   // Get recent commits
@@ -60,7 +60,7 @@ async function collectReferencedCids(env: Env, keepCommits: number = 10000): Pro
  * Recursively traverse MST nodes to collect all CIDs
  */
 async function traverseMst(env: Env, rootCid: string, referenced: Set<string>): Promise<void> {
-  const db = drizzle(env.DB);
+  const db = drizzle(env.ALTERAN_DB);
   const visited = new Set<string>();
   const queue = [rootCid];
 
@@ -128,7 +128,7 @@ async function traverseMst(env: Env, rootCid: string, referenced: Set<string>):
  * @returns Number of blocks removed
  */
 export async function pruneOrphanedBlocks(env: Env, keepCommits: number = 10000): Promise<number> {
-  const db = drizzle(env.DB);
+  const db = drizzle(env.ALTERAN_DB);
 
   // Collect all CIDs referenced by recent commits
   const referenced = await collectReferencedCids(env, keepCommits);
@@ -181,7 +181,7 @@ export async function getBlockstoreStats(env: Env): Promise<{
   total: number;
   totalSize: number;
 }> {
-  const db = drizzle(env.DB);
+  const db = drizzle(env.ALTERAN_DB);
   const blocks = await db.select().from(blockstore).all();
 
   const totalSize = blocks.reduce((sum, block) => {

package/src/lib/chat.ts

@@ -33,7 +33,7 @@ export async function ensureChatTables(env: Env) {
   if (tablesEnsured) return;
 
   // Create chat_convo table
-  await env.DB.prepare(
+  await env.ALTERAN_DB.prepare(
     'CREATE TABLE IF NOT EXISTS chat_convo (' +
     'id TEXT PRIMARY KEY, ' +
     'rev TEXT NOT NULL, ' +
@@ -48,7 +48,7 @@ export async function ensureChatTables(env: Env) {
   ).run();
 
   // Create chat_convo_member table
-  await env.DB.prepare(
+  await env.ALTERAN_DB.prepare(
     'CREATE TABLE IF NOT EXISTS chat_convo_member (' +
     'convo_id TEXT NOT NULL, ' +
     'did TEXT NOT NULL, ' +
@@ -61,7 +61,7 @@ export async function ensureChatTables(env: Env) {
   ).run();
 
   // Create index
-  await env.DB.prepare(
+  await env.ALTERAN_DB.prepare(
     'CREATE INDEX IF NOT EXISTS chat_convo_member_did_idx ON chat_convo_member (did)'
   ).run();
 
@@ -103,7 +103,7 @@ export async function listChatConvos(
   query += ' ORDER BY rowid DESC LIMIT ?';
   params.push(limit);
 
-  const result = await env.DB.prepare(query).bind(...params).all<{
+  const result = await env.ALTERAN_DB.prepare(query).bind(...params).all<{
     rowid: number;
     id: string;
     rev: string;
@@ -119,7 +119,7 @@ export async function listChatConvos(
 
   if (result.results) {
     for (const row of result.results) {
-      const members = await env.DB.prepare(
+      const members = await env.ALTERAN_DB.prepare(
         `SELECT did, handle, display_name, avatar FROM chat_convo_member WHERE convo_id = ? ORDER BY position ASC`
       )
         .bind(row.id)
@@ -186,7 +186,7 @@ export async function listChatConvoLogs(env: Env, did: string, cursor?: number,
   query += ' ORDER BY rowid DESC LIMIT ?';
   params.push(limit);
 
-  const result = await env.DB.prepare(query).bind(...params).all<{
+  const result = await env.ALTERAN_DB.prepare(query).bind(...params).all<{
     rowid: number;
     id: string;
     rev: string;

package/src/lib/commit-log-pruning.ts

@@ -18,7 +18,7 @@ import { logger } from './logger';
  * @returns Number of commits pruned
  */
 export async function pruneOldCommits(env: Env, keepCount: number = 10000): Promise<number> {
-  const db = drizzle(env.DB);
+  const db = drizzle(env.ALTERAN_DB);
 
   // Get the sequence number of the Nth most recent commit
   const threshold = await db
@@ -60,7 +60,7 @@ export async function getCommitLogStats(env: Env): Promise<{
   oldest: number | null;
   newest: number | null;
 }> {
-  const db = drizzle(env.DB);
+  const db = drizzle(env.ALTERAN_DB);
 
   const [oldest, newest, count] = await Promise.all([
     db.select({ seq: commit_log.seq }).from(commit_log).orderBy(commit_log.seq).limit(1).get(),

package/src/lib/feed.ts

@@ -71,7 +71,7 @@ export async function listPosts(env: Env, limit: number, cursor?: string): Promi
   }
   params.push(safeLimit);
 
-  const response = await env.DB.prepare(
+  const response = await env.ALTERAN_DB.prepare(
     `SELECT rowid, uri, cid, json FROM record WHERE ${where} ORDER BY rowid DESC LIMIT ?`
   )
     .bind(...params)
@@ -84,7 +84,7 @@ export async function listPosts(env: Env, limit: number, cursor?: string): Promi
 export async function getPostsByUris(env: Env, uris: string[]): Promise<ParsedPost[]> {
   if (!uris.length) return [];
   const placeholders = uris.map(() => '?').join(',');
-  const response = await env.DB.prepare(
+  const response = await env.ALTERAN_DB.prepare(
     `SELECT rowid, uri, cid, json FROM record WHERE uri IN (${placeholders})`
   )
     .bind(...uris)
@@ -142,7 +142,7 @@ export async function countPosts(env: Env): Promise<number> {
   const actor = await getPrimaryActor(env);
   const prefix = `at://${actor.did}/${POST_COLLECTION}/`;
   const upperBound = `${prefix}{`; // '{' sorts after 'z', safely bounding rkeys
-  const response = await env.DB.prepare(
+  const response = await env.ALTERAN_DB.prepare(
     'SELECT COUNT(*) as count FROM record WHERE uri >= ? AND uri < ?'
   )
     .bind(prefix, upperBound)
@@ -151,7 +151,7 @@ export async function countPosts(env: Env): Promise<number> {
 }
 
 export async function getPostByUri(env: Env, uri: string): Promise<ParsedPost | null> {
-  const response = await env.DB.prepare(
+  const response = await env.ALTERAN_DB.prepare(
     'SELECT rowid, uri, cid, json FROM record WHERE uri = ? LIMIT 1'
   )
     .bind(uri)

package/src/lib/mst/blockstore.ts

@@ -31,7 +31,7 @@ export class D1Blockstore implements WritableBlockstore {
   constructor(private env: Env) {}
 
   async get(cid: CID): Promise<Uint8Array | null> {
-    const row = await this.env.DB.prepare(
+    const row = await this.env.ALTERAN_DB.prepare(
       `SELECT bytes FROM blockstore WHERE cid = ? LIMIT 1`
     ).bind(cid.toString()).first();
 
@@ -43,7 +43,7 @@ export class D1Blockstore implements WritableBlockstore {
 
   async has(cid: CID): Promise<boolean> {
     // Treat rows with NULL or empty bytes as missing
-    const row = await this.env.DB.prepare(
+    const row = await this.env.ALTERAN_DB.prepare(
       `SELECT bytes FROM blockstore WHERE cid = ? LIMIT 1`
     ).bind(cid.toString()).first();
 
@@ -65,7 +65,7 @@ export class D1Blockstore implements WritableBlockstore {
     for (let i = 0; i < cids.length; i += BATCH) {
       const chunk = cids.slice(i, i + BATCH);
       const placeholders = new Array(chunk.length).fill('?').join(',');
-      const stmt = this.env.DB.prepare(`SELECT cid, bytes FROM blockstore WHERE cid IN (${placeholders})`);
+      const stmt = this.env.ALTERAN_DB.prepare(`SELECT cid, bytes FROM blockstore WHERE cid IN (${placeholders})`);
       const binds = chunk.map((c) => c.toString());
       const response = await stmt.bind(...binds).all();
       const rows = (response.results ?? []) as Array<{ cid: string; bytes: string }>;
@@ -97,7 +97,7 @@ export class D1Blockstore implements WritableBlockstore {
 
     // Always upsert: replace rows with NULL/empty bytes
     try {
-      await this.env.DB.prepare(
+      await this.env.ALTERAN_DB.prepare(
         `INSERT OR REPLACE INTO blockstore (cid, bytes) VALUES (?, ?)`
       ).bind(cidStr, base64).run();
     } catch (error) {
@@ -117,7 +117,7 @@ export class D1Blockstore implements WritableBlockstore {
     const entries = Array.from(blocks.entries());
     for (let i = 0; i < entries.length; i += BATCH_SIZE) {
       const batch = entries.slice(i, i + BATCH_SIZE);
-      const stmts = [] as Array<ReturnType<typeof this.env.DB['prepare']>>;
+      const stmts = [] as Array<ReturnType<typeof this.env.ALTERAN_DB['prepare']>>;
       for (const [cid, bytes] of batch) {
         const cidStr = cid.toString();
         let binary = '';
@@ -127,12 +127,12 @@ export class D1Blockstore implements WritableBlockstore {
         }
         const base64 = btoa(binary);
         stmts.push(
-          this.env.DB.prepare(`INSERT OR REPLACE INTO blockstore (cid, bytes) VALUES (?, ?)`)
+          this.env.ALTERAN_DB.prepare(`INSERT OR REPLACE INTO blockstore (cid, bytes) VALUES (?, ?)`)
             .bind(cidStr, base64)
         );
       }
       if (stmts.length > 0) {
-        await this.env.DB.batch(stmts);
+        await this.env.ALTERAN_DB.batch(stmts);
       }
     }
   }

package/src/lib/preferences.ts

@@ -6,7 +6,7 @@ let tableEnsured = false;
 
 async function ensureTable(env: Env) {
   if (tableEnsured) return;
-  await env.DB.exec(
+  await env.ALTERAN_DB.exec(
     'CREATE TABLE IF NOT EXISTS actor_preferences (did TEXT PRIMARY KEY, json TEXT NOT NULL, updated_at INTEGER NOT NULL)'
   );
   tableEnsured = true;
@@ -18,7 +18,7 @@ export async function getActorPreferences(env: Env): Promise<{ did: string; pref
   await ensureTable(env);
   const did = await resolveSecret(env.PDS_DID);
   if (!did) throw new ServerMisconfigured('PDS_DID is not configured');
-  const row = await env.DB.prepare('SELECT json FROM actor_preferences WHERE did = ?')
+  const row = await env.ALTERAN_DB.prepare('SELECT json FROM actor_preferences WHERE did = ?')
     .bind(did)
     .first<{ json: string }>();
 
@@ -40,7 +40,7 @@ export async function setActorPreferences(env: Env, preferences: any[]): Promise
   const did = await resolveSecret(env.PDS_DID);
   if (!did) throw new ServerMisconfigured('PDS_DID is not configured');
   const now = Date.now();
-  await env.DB.prepare(
+  await env.ALTERAN_DB.prepare(
     'INSERT INTO actor_preferences (did, json, updated_at) VALUES (?, ?, ?) ON CONFLICT(did) DO UPDATE SET json = excluded.json, updated_at = excluded.updated_at'
   )
     .bind(did, JSON.stringify(preferences ?? []), now)

package/src/lib/ratelimit.ts

@@ -8,14 +8,14 @@ export async function checkRate(env: Env, request: Request, bucket: 'writes' | '
     const windowMs = 60_000;
     const win = Math.floor(now / windowMs);
     const ip = request.headers.get('cf-connecting-ip') ?? request.headers.get('x-forwarded-for') ?? '127.0.0.1';
-    await env.DB.exec("CREATE TABLE IF NOT EXISTS rate_limit (ip TEXT NOT NULL, bucket TEXT NOT NULL, window INTEGER NOT NULL, count INTEGER NOT NULL, PRIMARY KEY (ip,bucket,window))");
-    const row: any = await env.DB.prepare('SELECT count FROM rate_limit WHERE ip=? AND bucket=? AND window=?').bind(ip, bucket, win).first();
+    await env.ALTERAN_DB.exec("CREATE TABLE IF NOT EXISTS rate_limit (ip TEXT NOT NULL, bucket TEXT NOT NULL, window INTEGER NOT NULL, count INTEGER NOT NULL, PRIMARY KEY (ip,bucket,window))");
+    const row: any = await env.ALTERAN_DB.prepare('SELECT count FROM rate_limit WHERE ip=? AND bucket=? AND window=?').bind(ip, bucket, win).first();
     const count = row?.count ? Number(row.count) : 0;
     if (count >= limit) return rateLimited();
     if (count === 0) {
-      await env.DB.prepare('INSERT OR REPLACE INTO rate_limit (ip,bucket,window,count) VALUES (?,?,?,1)').bind(ip, bucket, win).run();
+      await env.ALTERAN_DB.prepare('INSERT OR REPLACE INTO rate_limit (ip,bucket,window,count) VALUES (?,?,?,1)').bind(ip, bucket, win).run();
     } else {
-      await env.DB.prepare('UPDATE rate_limit SET count=count+1 WHERE ip=? AND bucket=? AND window=?').bind(ip, bucket, win).run();
+      await env.ALTERAN_DB.prepare('UPDATE rate_limit SET count=count+1 WHERE ip=? AND bucket=? AND window=?').bind(ip, bucket, win).run();
     }
 
     const headers = new Headers();

package/src/lib/sequencer.ts

@@ -1,13 +1,13 @@
 import type { Env } from '../env';
 
 export async function notifySequencer(env: Env, obj: unknown) {
-  if (!env.SEQUENCER) {
+  if (!env.ALTERAN_SEQUENCER) {
     console.warn('notifySequencer: SEQUENCER binding missing');
     return;
   }
   try {
-    const id = env.SEQUENCER.idFromName('default');
-    const stub = env.SEQUENCER.get(id);
+    const id = env.ALTERAN_SEQUENCER.idFromName('default');
+    const stub = env.ALTERAN_SEQUENCER.get(id);
     await stub.fetch('https://sequencer/commit', {
       method: 'POST',
       headers: { 'content-type': 'application/json' },

package/src/pages/debug/blob/[...key].ts

@@ -7,7 +7,7 @@ export async function GET({ locals, params }: APIContext) {
   const key = params.key;
   if (!key) return new Response('missing key', { status: 400 });
 
-  const obj = await env.BLOBS.get(key);
+  const obj = await env.ALTERAN_BLOBS.get(key);
   if (!obj) return new Response('not found', { status: 404 });
 
   const body = obj.body as unknown as BodyInit | null;
@@ -22,6 +22,6 @@ export async function PUT({ locals, request, params }: APIContext) {
   if (!key) return new Response('missing key', { status: 400 });
 
   const body = await request.arrayBuffer();
-  await env.BLOBS.put(key, body, { httpMetadata: { contentType: request.headers.get('content-type') ?? 'application/octet-stream' } });
+  await env.ALTERAN_BLOBS.put(key, body, { httpMetadata: { contentType: request.headers.get('content-type') ?? 'application/octet-stream' } });
   return new Response('uploaded');
 }

package/src/pages/debug/db/bootstrap.ts

@@ -11,7 +11,7 @@ export async function POST({ locals }: APIContext) {
   if (!isLocal) {
     return new Response('Not Found', { status: 404 });
   }
-  const db = env.DB;
+  const db = env.ALTERAN_DB;
   await db.exec("CREATE TABLE IF NOT EXISTS record (uri TEXT PRIMARY KEY, cid TEXT NOT NULL, json TEXT NOT NULL, created_at INTEGER DEFAULT (strftime('%s','now')));");
   await db.exec("CREATE TABLE IF NOT EXISTS blob (cid TEXT PRIMARY KEY, key TEXT NOT NULL, mime TEXT NOT NULL, size INTEGER NOT NULL);");
   await db.exec("CREATE TABLE IF NOT EXISTS blob_usage (record_uri TEXT NOT NULL, key TEXT NOT NULL);");

package/src/pages/debug/db/commits.ts

@@ -14,7 +14,7 @@ export async function GET({ locals, request }: APIContext) {
 
   const url = new URL(request.url);
   const n = Math.min(Number(url.searchParams.get('n') ?? '20') || 20, 200);
-  const db = drizzle(env.DB);
+  const db = drizzle(env.ALTERAN_DB);
   const rows = await db.select().from(commit_log).orderBy(desc(commit_log.seq)).limit(n).all();
   return new Response(JSON.stringify({ commits: rows }), { headers: { 'content-type': 'application/json' } });
 }

package/src/pages/debug/gc/blobs.ts

@@ -8,7 +8,7 @@ export async function POST({ locals }: APIContext) {
   const keys = await listOrphanBlobKeys(env);
   let deleted = 0;
   for (const key of keys) {
-    await env.BLOBS.delete(key).catch(() => {});
+    await env.ALTERAN_BLOBS.delete(key).catch(() => {});
     await deleteBlobByKey(env, key);
     deleted++;
   }

package/src/pages/debug/sequencer.ts

@@ -6,7 +6,7 @@ export const prerender = false;
 export async function GET({ locals }: APIContext) {
   const { env } = locals.runtime;
 
-  if (!env.SEQUENCER) {
+  if (!env.ALTERAN_SEQUENCER) {
     return new Response(JSON.stringify({ error: 'SequencerNotConfigured' }), {
       status: 503,
       headers: { 'Content-Type': 'application/json' },
@@ -14,8 +14,8 @@ export async function GET({ locals }: APIContext) {
   }
 
   try {
-    const id = env.SEQUENCER.idFromName('default');
-    const stub = env.SEQUENCER.get(id);
+    const id = env.ALTERAN_SEQUENCER.idFromName('default');
+    const stub = env.ALTERAN_SEQUENCER.get(id);
     const response = await stub.fetch(new Request('http://internal/metrics') as any);
     const text = await response.text();
     return new Response(text, { status: response.status, headers: { 'Content-Type': 'application/json' } });

package/src/pages/health.ts

@@ -22,8 +22,8 @@ export async function GET({ locals }: APIContext) {
 
   // Check D1 database connectivity
   try {
-    if (env.DB) {
-      await env.DB.prepare('SELECT 1').first();
+    if (env.ALTERAN_DB) {
+      await env.ALTERAN_DB.prepare('SELECT 1').first();
       checks.database.status = 'ok';
     } else {
       checks.database.status = 'error';
@@ -38,9 +38,9 @@ export async function GET({ locals }: APIContext) {
 
   // Check R2 storage connectivity
   try {
-    if (env.BLOBS) {
+    if (env.ALTERAN_BLOBS) {
       // Simple list operation to verify connectivity
-      await env.BLOBS.list({ limit: 1 });
+      await env.ALTERAN_BLOBS.list({ limit: 1 });
       checks.storage.status = 'ok';
     } else {
       checks.storage.status = 'error';

package/src/pages/ready.ts

@@ -6,8 +6,8 @@ export async function GET({ locals }: APIContext) {
   const { env } = locals.runtime;
 
   try {
-    if (env.DB) {
-      await env.DB.prepare('select 1').first();
+    if (env.ALTERAN_DB) {
+      await env.ALTERAN_DB.prepare('select 1').first();
     }
     return new Response('ok');
   } catch (e) {

package/src/pages/xrpc/com.atproto.server.createSession.ts

@@ -18,7 +18,7 @@ export async function POST({ locals, request }: APIContext) {
   const { env } = locals.runtime;
   const clientIp = request.headers.get('cf-connecting-ip') || request.headers.get('x-forwarded-for') || 'unknown';
 
-  const db = drizzle(env.DB);
+  const db = drizzle(env.ALTERAN_DB);
   const now = Math.floor(Date.now() / 1000);
 
   // Check if IP is locked out

package/src/pages/xrpc/com.atproto.sync.getBlob.ts

@@ -88,7 +88,7 @@ export async function GET({ locals, url }: APIContext) {
     }
 
     // Fetch blob from R2
-    const r2 = env.BLOBS;
+    const r2 = env.ALTERAN_BLOBS;
     const object = await r2.get(key);
 
     if (!object) {

package/src/pages/xrpc/com.atproto.sync.listBlobs.ts

@@ -17,7 +17,7 @@ export async function GET({ locals, url }: APIContext) {
   const limit = parseInt(url.searchParams.get('limit') || '500', 10);
 
   try {
-    const db = drizzle(env.DB);
+    const db = drizzle(env.ALTERAN_DB);
 
     const blobs = since
       ? await db

package/src/services/car.ts

@@ -24,7 +24,7 @@ export async function encodeRecordBlock(value: unknown) {
 
 export async function buildRepoCar(env: Env, did: string): Promise<CarSnapshot> {
   // Prefer the latest signed commit from commit_log (authoritative root)
-  const db = drizzle(env.DB);
+  const db = drizzle(env.ALTERAN_DB);
   const tip = await db.select().from(commit_log).orderBy(desc(commit_log.seq)).limit(1).get();
 
   if (tip) {
@@ -99,7 +99,7 @@ export async function buildRepoCar(env: Env, did: string): Promise<CarSnapshot>
 }
 
 export async function buildRepoCarRange(env: Env, fromSeq: number, toSeq: number): Promise<CarSnapshot> {
-  const db = drizzle(env.DB);
+  const db = drizzle(env.ALTERAN_DB);
   const rows = await db.select().from(commit_log).where(and(gte(commit_log.seq, fromSeq), lte(commit_log.seq, toSeq))).all();
   const blocks: { cid: CID; bytes: Uint8Array }[] = [];
   for (const r of rows) {
@@ -189,7 +189,7 @@ export async function encodeBlocksForCommit(
       // Attempt to reconstruct commit block from commit_log if this is the commit cid
       if (cidStr === commitCid.toString()) {
         try {
-          const row = await (env.DB as any)
+          const row = await (env.ALTERAN_DB as any)
             .prepare('SELECT data, sig FROM commit_log WHERE cid = ? LIMIT 1')
             .bind(cidStr)
             .first();
@@ -260,7 +260,7 @@ export async function buildRecordProofCar(
   collection: string,
   rkey: string,
 ): Promise<{ bytes: Uint8Array }> {
-  const db = drizzle(env.DB);
+  const db = drizzle(env.ALTERAN_DB);
   const tip = await db.select().from(commit_log).orderBy(desc(commit_log.seq)).limit(1).get();
   if (!tip) {
     throw new NotFound('HeadNotFound');

package/src/services/r2-blob-store.ts

@@ -73,15 +73,15 @@ export class R2BlobStore {
     const shaB64 = R2BlobStore.b64url(sha);
     const key = R2BlobStore.cidKey(shaB64);
     const buffer = R2BlobStore.toArrayBuffer(view);
-    await this.env.BLOBS.put(key, buffer, { httpMetadata: { contentType } });
+    await this.env.ALTERAN_BLOBS.put(key, buffer, { httpMetadata: { contentType } });
     return { key, size, sha256: shaB64 };
   }
 
   async get(key: string): Promise<R2ObjectBody | null> {
-    return this.env.BLOBS.get(key);
+    return this.env.ALTERAN_BLOBS.get(key);
   }
 
   async delete(key: string): Promise<void> {
-    await this.env.BLOBS.delete(key);
+    await this.env.ALTERAN_BLOBS.delete(key);
   }
 }

package/src/services/repo-manager.ts

@@ -46,7 +46,7 @@ export class RepoManager {
 
   async getRoot(): Promise<MST | null> {
     try {
-      const db = drizzle(this.env.DB);
+      const db = drizzle(this.env.ALTERAN_DB);
       const did = await this.getDid();
 
       const rows = await db
@@ -58,7 +58,7 @@ export class RepoManager {
       const row = rows[0];
       if (!row) return null;
 
-      const commit = await this.env.DB.prepare(
+      const commit = await this.env.ALTERAN_DB.prepare(
         `SELECT data FROM commit_log WHERE cid = ? LIMIT 1`,
       )
         .bind(row.commitCid)
@@ -215,7 +215,7 @@ export class RepoManager {
     const did = await this.getDid();
     const uri = `at://${did}/${collection}/${rkey}`;
 
-    const result = await this.env.DB.prepare(`SELECT json FROM record WHERE uri = ?`)
+    const result = await this.env.ALTERAN_DB.prepare(`SELECT json FROM record WHERE uri = ?`)
       .bind(uri)
       .first();
 
@@ -265,10 +265,10 @@ export class RepoManager {
       String.fromCharCode(prefix.charCodeAt(prefix.length - 1) + 1);
 
     const stmt = cursor
-      ? this.env.DB.prepare(
+      ? this.env.ALTERAN_DB.prepare(
           `SELECT uri, cid FROM record WHERE uri >= ? AND uri < ? AND uri > ? ORDER BY uri LIMIT ?`,
         ).bind(prefix, rangeEnd, prefix + cursor, limit)
-      : this.env.DB.prepare(
+      : this.env.ALTERAN_DB.prepare(
           `SELECT uri, cid FROM record WHERE uri >= ? AND uri < ? ORDER BY uri LIMIT ?`,
         ).bind(prefix, rangeEnd, limit);
 
@@ -282,7 +282,7 @@ export class RepoManager {
   }
 
   async updateRoot(mst: MST, rev: number): Promise<void> {
-    const db = drizzle(this.env.DB);
+    const db = drizzle(this.env.ALTERAN_DB);
     const rootCid = await mst.getPointer();
     const did = await this.getDid();
     const revStr = String(rev);

package/src/worker/runtime.ts

@@ -75,7 +75,7 @@ export function createPdsFetchHandler(options?: CreatePdsFetchHandlerOptions): P
       return new Response(null, { status: 204, headers }) as unknown as WorkersResponse;
     }
 
-    await seed(resolvedEnv.DB, resolvedEnv.PDS_DID as string);
+    await seed(resolvedEnv.ALTERAN_DB, resolvedEnv.PDS_DID as string);
 
     // Fire-and-forget: let relays know this PDS exists and is reachable.
     // Throttled per isolate and safe to call frequently.
@@ -98,11 +98,11 @@ export function createPdsFetchHandler(options?: CreatePdsFetchHandlerOptions): P
     // Lightweight debug endpoint for Sequencer metrics
     if (url.pathname === '/debug/sequencer' && request.method === 'GET') {
       try {
-        if (!('SEQUENCER' in resolvedEnv) || !resolvedEnv.SEQUENCER) {
+        if (!('ALTERAN_SEQUENCER' in resolvedEnv) || !resolvedEnv.ALTERAN_SEQUENCER) {
           return new Response('Sequencer not configured', { status: 503 }) as unknown as WorkersResponse;
         }
-        const id = (resolvedEnv as any).SEQUENCER.idFromName('default');
-        const stub = (resolvedEnv as any).SEQUENCER.get(id);
+        const id = (resolvedEnv as any).ALTERAN_SEQUENCER.idFromName('default');
+        const stub = (resolvedEnv as any).ALTERAN_SEQUENCER.get(id);
         const proxyRequest = new Request(new URL('/metrics', request.url).toString(), { method: 'GET' });
         const response = await stub.fetch(proxyRequest as any);
         // Pass through JSON
@@ -130,21 +130,43 @@ export function createPdsFetchHandler(options?: CreatePdsFetchHandlerOptions): P
         }
         return new Response('This endpoint requires a WebSocket (wss://) upgrade', { status: 426 }) as unknown as WorkersResponse;
       }
-      if (!resolvedEnv.SEQUENCER) {
+      if (!resolvedEnv.ALTERAN_SEQUENCER) {
         return new Response('Sequencer not configured', { status: 503 }) as unknown as WorkersResponse;
       }
 
-      const id = resolvedEnv.SEQUENCER.idFromName('default');
-      const stub = resolvedEnv.SEQUENCER.get(id);
+      const id = resolvedEnv.ALTERAN_SEQUENCER.idFromName('default');
+      const stub = resolvedEnv.ALTERAN_SEQUENCER.get(id);
       return (await stub.fetch(request as any)) as unknown as WorkersResponse;
     }
 
     const astroFetch = await getAstroFetch(options);
-    const response = await astroFetch(request, resolvedEnv as any, ctx);
+    const response = await astroFetch(normalizeXrpcRequestForAstro(request), resolvedEnv as any, ctx);
     return response as unknown as WorkersResponse;
   };
 }
 
+export function normalizeXrpcRequestForAstro(request: WorkersRequest): WorkersRequest {
+  const url = new URL(request.url);
+  if (!url.pathname.startsWith('/xrpc/')) {
+    return request;
+  }
+
+  // Astro's SSR origin-check middleware rejects unsafe requests when Origin is
+  // absent or cross-origin. XRPC is a bearer-token API, not cookie/form auth,
+  // and atproto clients legitimately send bodyless POSTs from native runtimes.
+  if (request.headers.get('origin') === url.origin) {
+    return request;
+  }
+
+  const headerRecord: Record<string, string> = {};
+  request.headers.forEach((value, key) => {
+    headerRecord[key] = value;
+  });
+  headerRecord.origin = url.origin;
+
+  return new Request(request as any, { headers: headerRecord }) as unknown as WorkersRequest;
+}
+
 type AstroFetchHandler = (
   request: WorkersRequest,
   env: Env,

package/src/worker/sequencer.ts

@@ -46,7 +46,7 @@ export class Sequencer {
   constructor(state: DurableObjectState, env: Env) {
     this.state = state as HibernatableState;
     this.env = env;
-    this.db = env.DB;
+    this.db = env.ALTERAN_DB;
     this.maxWindow = parseInt(env.PDS_SEQ_WINDOW || '512', 10);
 
     // Reconcile nextSeq with DB on construction so replay and append agree

package/types/env.d.ts

@@ -16,9 +16,9 @@ export interface SecretsStoreSecret {
 
 declare global {
   interface Env {
-    DB: D1Database;
-    BLOBS: R2Bucket;
-    SEQUENCER?: DurableObjectNamespace;
+    ALTERAN_DB: D1Database;
+    ALTERAN_BLOBS: R2Bucket;
+    ALTERAN_SEQUENCER?: DurableObjectNamespace;
     ASSETS?: {
       fetch: (req: Request | string) => Promise<Response>;
     };