@atcute/xrpc-server 0.1.0

package/LICENSE

@@ -0,0 +1,17 @@
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,177 @@
+# @atcute/xrpc-server
+
+a small web framework for handling XRPC operations.
+
+## quick start
+
+this framework relies on schemas generated by `@atcute/lex-cli`, you'd need to follow its
+[quick start guide](../../lexicons/lex-cli/README.md#quick-start) on how to set it up.
+
+for this example, we'll define a very simple query operation, one that returns a message greeting
+the name that's provided to it:
+
+```json
+// file: lexicons/com/example/greet.json
+{
+	"lexicon": 1,
+	"id": "com.example.greet",
+	"defs": {
+		"main": {
+			"type": "query",
+			"parameters": {
+				"type": "params",
+				"required": ["name"],
+				"properties": {
+					"name": {
+						"type": "string"
+					}
+				}
+			},
+			"output": {
+				"encoding": "application/json",
+				"schema": {
+					"type": "object",
+					"required": ["message"],
+					"properties": {
+						"message": {
+							"type": "string"
+						}
+					}
+				}
+			}
+		}
+	}
+}
+```
+
+now we can build a server using the TypeScript schemas:
+
+```ts
+// file: src/index.js
+import { XRPCRouter, json } from '@atcute/xrpc-server';
+import { cors } from '@atucte/xrpc-server/middlewares/cors';
+
+import { ComExampleGreet } from './lexicons/index.js';
+
+const router = new XRPCRouter({ middlewares: [cors()] });
+
+router.add(ComExampleGreet.mainSchema, {
+	async handler({ params: { name } }) {
+		return json({ message: `hello ${name}!` });
+	},
+});
+
+export default router;
+```
+
+on Deno, Bun or Cloudflare Workers, you can export the router directly and expect it to work out of
+the box.
+
+but for Node.js, you'll need the [`@hono/node-server`][hono-node-server] adapter as the router works
+with standard Web Request/Response:
+
+[hono-node-server]: https://github.com/honojs/node-server
+
+```ts
+// file: src/index.js
+import { XRPCRouter } from '@atcute/xrpc-server';
+import { serve } from '@hono/node-server';
+
+const router = new XRPCRouter();
+
+// ... handler code ...
+
+serve(
+	{
+		fetch: router.fetch,
+		port: 3000,
+	},
+	(info) => {
+		console.log(`listening on port ${info.port}`);
+	},
+);
+```
+
+## kitchen sink
+
+### Bluesky feed generator example
+
+```ts
+import { parseCanonicalResourceUri, type Nsid } from '@atcute/lexicons';
+
+import { AuthRequiredError, InvalidRequestError, XRPCRouter, json } from '@atcute/xrpc-server';
+import { ServiceJwtVerifier, type VerifiedJwt } from '@atcute/xrpc-server/auth';
+import { cors } from '@atucte/xrpc-server/middlewares/cors';
+
+import {
+	CompositeDidDocumentResolver,
+	PlcDidDocumentResolver,
+	WebDidDocumentResolver,
+} from '@atcute/identity-resolver';
+
+import { AppBskyFeedGetFeedSkeleton } from '@atcute/bluesky';
+
+const SERVICE_DID = 'did:web:feedgen.example.com';
+
+const router = new XRPCRouter({
+	middlewares: [cors()],
+});
+
+const jwtVerifier = new ServiceJwtVerifier({
+	serviceDid: SERVICE_DID,
+	resolver: new CompositeDidDocumentResolver({
+		methods: {
+			plc: new PlcDidDocumentResolver(),
+			web: new WebDidDocumentResolver(),
+		},
+	}),
+});
+
+const requireAuth = async (request: Request, lxm: Nsid): Promise<VerifiedJwt> => {
+	const auth = request.headers.get('authorization');
+	if (auth === null) {
+		throw new AuthRequiredError({ description: `missing authorization header` });
+	}
+	if (!auth.startsWith('Bearer ')) {
+		throw new AuthRequiredError({ description: `invalid authorization scheme` });
+	}
+
+	const jwtString = auth.slice('Bearer '.length).trim();
+
+	const result = await jwtVerifier.verify(jwtString, { lxm });
+	if (!result.ok) {
+		throw new AuthRequiredError(result.error);
+	}
+
+	return result.value;
+};
+
+router.add(AppBskyFeedGetFeedSkeleton.mainSchema, {
+	async handler({ params: { feed }, request }) {
+		await requireAuth(request, 'app.bsky.feed.getFeedSkeleton');
+
+		const feedUri = parseCanonicalResourceUri(feed);
+
+		if (
+			!feedUri.ok ||
+			feedUri.value.collection !== 'app.bsky.feed.generator' ||
+			feedUri.value.repo !== SERVICE_DID ||
+			feedUri.value.rkey !== 'feed'
+		) {
+			throw new InvalidRequestError({
+				error: 'InvalidFeed',
+				description: `invalid feed`,
+			});
+		}
+
+		return json({
+			feed: [
+				{ post: 'at://did:plc:z72i7hdynmk6r22z27h6tvur/app.bsky.feed.post/3l6oveex3ii2l' },
+				{ post: 'at://did:plc:z72i7hdynmk6r22z27h6tvur/app.bsky.feed.post/3lpk2lf7k6k2t' },
+			],
+		});
+	},
+});
+
+export default router;
+```

package/dist/auth/index.d.ts

@@ -0,0 +1,2 @@
+export * from './jwt-creator.js';
+export * from './jwt-verifier.js';

package/dist/auth/index.js

@@ -0,0 +1,3 @@
+export * from './jwt-creator.js';
+export * from './jwt-verifier.js';
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../lib/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC"}

package/dist/auth/jwt-creator.d.ts

@@ -0,0 +1,11 @@
+import type { PrivateKey } from '@atcute/crypto';
+import type { Did, Nsid } from '@atcute/lexicons';
+export interface CreateServiceJwtOptions {
+    keypair: PrivateKey;
+    issuer: Did;
+    audience: Did;
+    lxm: Nsid | null;
+    issuedAt?: number;
+    expiresIn?: number;
+}
+export declare const createServiceJwt: (options: CreateServiceJwtOptions) => Promise<string>;

package/dist/auth/jwt-creator.js

@@ -0,0 +1,30 @@
+import { toBase64Url } from '@atcute/multibase';
+import { encodeUtf8 } from '@atcute/uint8array';
+import { nanoid } from 'nanoid';
+export const createServiceJwt = async (options) => {
+    const keypair = options.keypair;
+    const issuedAt = Math.floor(options.issuedAt ?? Date.now() / 1_000);
+    const expiresIn = Math.floor(options.expiresIn ?? 60);
+    const header = {
+        typ: 'JWT',
+        alg: keypair.jwtAlg,
+    };
+    const payload = {
+        aud: options.audience,
+        exp: issuedAt + expiresIn,
+        iat: issuedAt,
+        iss: options.issuer,
+        jti: nanoid(24),
+        lxm: options.lxm ?? undefined,
+    };
+    const headerB64 = encodeJwtPortion(header);
+    const payloadB64 = encodeJwtPortion(payload);
+    const message = `${headerB64}.${payloadB64}`;
+    const signature = await keypair.sign(encodeUtf8(message));
+    const signatureB64 = toBase64Url(signature);
+    return `${message}.${signatureB64}`;
+};
+const encodeJwtPortion = (data) => {
+    return toBase64Url(encodeUtf8(JSON.stringify(data)));
+};
+//# sourceMappingURL=jwt-creator.js.map

package/dist/auth/jwt-creator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-creator.js","sourceRoot":"","sources":["../../lib/auth/jwt-creator.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAahC,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EAAE,OAAgC,EAAmB,EAAE;IAC3F,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAEhC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;IACpE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAEtD,MAAM,MAAM,GAAc;QACzB,GAAG,EAAE,KAAK;QACV,GAAG,EAAE,OAAO,CAAC,MAAM;KACnB,CAAC;IAEF,MAAM,OAAO,GAAe;QAC3B,GAAG,EAAE,OAAO,CAAC,QAAQ;QACrB,GAAG,EAAE,QAAQ,GAAG,SAAS;QACzB,GAAG,EAAE,QAAQ;QACb,GAAG,EAAE,OAAO,CAAC,MAAM;QACnB,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;QACf,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,SAAS;KAC7B,CAAC;IAEF,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;IAE7C,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAE5C,OAAO,GAAG,OAAO,IAAI,YAAY,EAAE,CAAC;AACrC,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC,IAAa,EAAU,EAAE;IAClD,OAAO,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACtD,CAAC,CAAC"}

package/dist/auth/jwt-verifier.d.ts

@@ -0,0 +1,23 @@
+import { type DidDocumentResolver } from '@atcute/identity-resolver';
+import type { Did, Nsid } from '@atcute/lexicons';
+import type { Result } from '../types/misc.js';
+import type { AuthError } from './types.js';
+export interface ServiceJwtVerifierOptions {
+    serviceDid: Did | null;
+    resolver: DidDocumentResolver;
+}
+export interface VerifyJwtOptions {
+    lxm: Nsid | Nsid[] | null;
+}
+export interface VerifiedJwt {
+    issuer: Did;
+    audience: Did;
+    lxm: string | undefined;
+}
+export declare class ServiceJwtVerifier {
+    #private;
+    didDocResolver: DidDocumentResolver;
+    serviceDid: Did | null;
+    constructor(options: ServiceJwtVerifierOptions);
+    verify(jwtString: string, options?: VerifyJwtOptions): Promise<Result<VerifiedJwt, AuthError>>;
+}

package/dist/auth/jwt-verifier.js

@@ -0,0 +1,173 @@
+import { getPublicKeyFromDidController, verifySig } from '@atcute/crypto';
+import { getAtprotoVerificationMaterial } from '@atcute/identity';
+import {} from '@atcute/identity-resolver';
+import * as uint8arrays from '@atcute/uint8array';
+import { parseJwt } from './jwt.js';
+export class ServiceJwtVerifier {
+    didDocResolver;
+    serviceDid;
+    constructor(options) {
+        this.didDocResolver = options.resolver;
+        this.serviceDid = options.serviceDid;
+    }
+    async #getSigningKey(issuer, noCache) {
+        let didDocument;
+        let key;
+        try {
+            didDocument = await this.didDocResolver.resolve(issuer, { noCache });
+        }
+        catch {
+            return {
+                ok: false,
+                error: {
+                    error: 'UnresolvedDidDocument',
+                    description: `failed to retrieve did document for ${issuer}`,
+                },
+            };
+        }
+        const controller = getAtprotoVerificationMaterial(didDocument);
+        if (!controller) {
+            return {
+                ok: false,
+                error: {
+                    error: 'BadJwtIssuer',
+                    description: `${issuer} does not have an atproto verification material`,
+                },
+            };
+        }
+        try {
+            key = getPublicKeyFromDidController(controller);
+        }
+        catch {
+            return {
+                ok: false,
+                error: {
+                    error: 'BadJwtIssuer',
+                    description: `${issuer} has invalid atproto verification material`,
+                },
+            };
+        }
+        return { ok: true, value: key };
+    }
+    async #verifySignature(key, jwt) {
+        try {
+            return {
+                ok: true,
+                value: await verifySig(key, jwt.signature, jwt.message, { allowMalleableSig: true }),
+            };
+        }
+        catch {
+            return {
+                ok: false,
+                error: {
+                    error: 'BadJwtSignature',
+                    description: `could not verify jwt signature`,
+                },
+            };
+        }
+    }
+    async verify(jwtString, options) {
+        const parsed = parseJwt(jwtString);
+        if (!parsed.ok) {
+            return parsed;
+        }
+        const { header, payload } = parsed.value;
+        switch (header.typ) {
+            case 'at+jwt':
+            case 'refresh+jwt':
+            case 'dpop+jwt': {
+                return {
+                    ok: false,
+                    error: {
+                        error: 'BadJwtType',
+                        description: `invalid jwt type`,
+                    },
+                };
+            }
+        }
+        if (Date.now() / 1_000 > payload.exp) {
+            return {
+                ok: false,
+                error: {
+                    error: 'JwtExpired',
+                    description: `jwt is expired`,
+                },
+            };
+        }
+        if (this.serviceDid !== undefined && this.serviceDid !== payload.aud) {
+            return {
+                ok: false,
+                error: {
+                    error: 'BadJwtAudience',
+                    description: `jwt audience does not match (expected ${this.serviceDid})`,
+                },
+            };
+        }
+        if (options?.lxm != null &&
+            (typeof options.lxm === 'string' ? options.lxm !== payload.lxm : !options.lxm.includes(payload.lxm))) {
+            return {
+                ok: false,
+                error: {
+                    error: `BadJwtLexiconMethod`,
+                    description: `jwt lexicon method does not match (expected ${options.lxm})`,
+                },
+            };
+        }
+        const key = await this.#getSigningKey(payload.iss, false);
+        if (!key.ok) {
+            return key;
+        }
+        let isValid = false;
+        if (key.value.jwtAlg === header.alg) {
+            const result = await this.#verifySignature(key.value, parsed.value);
+            if (!result.ok) {
+                return result;
+            }
+            isValid = result.value;
+        }
+        if (!isValid) {
+            // try again, uncached
+            const freshKey = await this.#getSigningKey(payload.iss, true);
+            if (!freshKey.ok) {
+                return freshKey;
+            }
+            // at this point we can't ignore the jwt alg difference
+            if (freshKey.value.jwtAlg !== header.alg) {
+                return {
+                    ok: false,
+                    error: {
+                        error: 'BadJwtIssuer',
+                        description: `mismatching cryptographic key format (jwt is ${header.alg})`,
+                    },
+                };
+            }
+            // only revalidate if it's a different key
+            if (!uint8arrays.equals(freshKey.value.publicKeyBytes, key.value.publicKeyBytes)) {
+                const result = await this.#verifySignature(key.value, parsed.value);
+                if (!result.ok) {
+                    return result;
+                }
+                isValid = result.value;
+            }
+        }
+        if (!isValid) {
+            // too bad
+            return {
+                ok: false,
+                error: {
+                    error: 'BadJwtSignature',
+                    description: `invalid jwt signature`,
+                },
+            };
+        }
+        return {
+            ok: true,
+            value: {
+                issuer: payload.iss,
+                audience: payload.aud,
+                lxm: payload.lxm,
+            },
+        };
+    }
+}
+//# sourceMappingURL=jwt-verifier.js.map

package/dist/auth/jwt-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-verifier.js","sourceRoot":"","sources":["../../lib/auth/jwt-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,SAAS,EAAuB,MAAM,gBAAgB,CAAC;AAC/F,OAAO,EAAE,8BAA8B,EAAoB,MAAM,kBAAkB,CAAC;AACpF,OAAO,EAA4B,MAAM,2BAA2B,CAAC;AAErE,OAAO,KAAK,WAAW,MAAM,oBAAoB,CAAC;AAIlD,OAAO,EAAE,QAAQ,EAAkB,MAAM,UAAU,CAAC;AAkBpD,MAAM,OAAO,kBAAkB;IAC9B,cAAc,CAAsB;IACpC,UAAU,CAAa;IAEvB,YAAY,OAAkC;QAC7C,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC;QACvC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAW,EAAE,OAAgB;QACjD,IAAI,WAAwB,CAAC;QAC7B,IAAI,GAAmB,CAAC;QAExB,IAAI,CAAC;YACJ,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACtE,CAAC;QAAC,MAAM,CAAC;YACR,OAAO;gBACN,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE;oBACN,KAAK,EAAE,uBAAuB;oBAC9B,WAAW,EAAE,uCAAuC,MAAM,EAAE;iBAC5D;aACD,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,8BAA8B,CAAC,WAAW,CAAC,CAAC;QAC/D,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,OAAO;gBACN,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE;oBACN,KAAK,EAAE,cAAc;oBACrB,WAAW,EAAE,GAAG,MAAM,iDAAiD;iBACvE;aACD,CAAC;QACH,CAAC;QAED,IAAI,CAAC;YACJ,GAAG,GAAG,6BAA6B,CAAC,UAAU,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACR,OAAO;gBACN,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE;oBACN,KAAK,EAAE,cAAc;oBACrB,WAAW,EAAE,GAAG,MAAM,4CAA4C;iBAClE;aACD,CAAC;QACH,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,GAAmB,EAAE,GAAc;QACzD,IAAI,CAAC;YACJ,OAAO;gBACN,EAAE,EAAE,IAAI;gBACR,KAAK,EAAE,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;aACpF,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACR,OAAO;gBACN,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE;oBACN,KAAK,EAAE,iBAAiB;oBACxB,WAAW,EAAE,gCAAgC;iBAC7C;aACD,CAAC;QACH,CAAC;IACF,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,OAA0B;QACzD,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,MAAM,CAAC;QACf,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC;QAEzC,QAAQ,MAAM,CAAC,GAAG,EAAE,CAAC;YACpB,KAAK,QAAQ,CAAC;YACd,KAAK,aAAa,CAAC;YACnB,KAAK,UAAU,CAAC,CAAC,CAAC;gBACjB,OAAO;oBACN,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE;wBACN,KAAK,EAAE,YAAY;wBACnB,WAAW,EAAE,kBAAkB;qBAC/B;iBACD,CAAC;YACH,CAAC;QACF,CAAC;QAED,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;YACtC,OAAO;gBACN,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE;oBACN,KAAK,EAAE,YAAY;oBACnB,WAAW,EAAE,gBAAgB;iBAC7B;aACD,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;YACtE,OAAO;gBACN,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE;oBACN,KAAK,EAAE,gBAAgB;oBACvB,WAAW,EAAE,yCAAyC,IAAI,CAAC,UAAU,GAAG;iBACxE;aACD,CAAC;QACH,CAAC;QAED,IACC,OAAO,EAAE,GAAG,IAAI,IAAI;YACpB,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAI,CAAC,CAAC,EACpG,CAAC;YACF,OAAO;gBACN,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE;oBACN,KAAK,EAAE,qBAAqB;oBAC5B,WAAW,EAAE,+CAA+C,OAAO,CAAC,GAAG,GAAG;iBAC1E;aACD,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC1D,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACb,OAAO,GAAG,CAAC;QACZ,CAAC;QAED,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YACpE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBAChB,OAAO,MAAM,CAAC;YACf,CAAC;YAED,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC;QACxB,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,sBAAsB;YACtB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC9D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAClB,OAAO,QAAQ,CAAC;YACjB,CAAC;YAED,uDAAuD;YACvD,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC;gBAC1C,OAAO;oBACN,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE;wBACN,KAAK,EAAE,cAAc;wBACrB,WAAW,EAAE,gDAAgD,MAAM,CAAC,GAAG,GAAG;qBAC1E;iBACD,CAAC;YACH,CAAC;YAED,0CAA0C;YAC1C,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,EAAE,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;gBAClF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBACpE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;oBAChB,OAAO,MAAM,CAAC;gBACf,CAAC;gBAED,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC;YACxB,CAAC;QACF,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,UAAU;YACV,OAAO;gBACN,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE;oBACN,KAAK,EAAE,iBAAiB;oBACxB,WAAW,EAAE,uBAAuB;iBACpC;aACD,CAAC;QACH,CAAC;QAED,OAAO;YACN,EAAE,EAAE,IAAI;YACR,KAAK,EAAE;gBACN,MAAM,EAAE,OAAO,CAAC,GAAG;gBACnB,QAAQ,EAAE,OAAO,CAAC,GAAG;gBACrB,GAAG,EAAE,OAAO,CAAC,GAAG;aAChB;SACD,CAAC;IACH,CAAC;CACD"}

package/dist/auth/jwt.d.ts

@@ -0,0 +1,27 @@
+import * as v from '@badrap/valita';
+import type { Result } from '../types/misc.js';
+import type { AuthError } from './types.js';
+declare const jwtHeader: v.ObjectType<{
+    typ: v.Optional<string>;
+    alg: v.Type<string>;
+}, undefined>;
+export interface JwtHeader extends v.Infer<typeof jwtHeader> {
+}
+declare const jwtPayload: v.Type<{
+    iat?: number | undefined;
+    lxm?: `${string}.${string}.${string}` | undefined;
+    jti?: string | undefined;
+    iss: `did:${string}:${string}`;
+    aud: `did:${string}:${string}`;
+    exp: number;
+}>;
+export interface JwtPayload extends v.Infer<typeof jwtPayload> {
+}
+export interface ParsedJwt {
+    header: JwtHeader;
+    payload: JwtPayload;
+    message: Uint8Array;
+    signature: Uint8Array;
+}
+export declare const parseJwt: (jwtString: string) => Result<ParsedJwt, AuthError>;
+export {};

package/dist/auth/jwt.js

@@ -0,0 +1,96 @@
+import * as v from '@badrap/valita';
+import { isDid, isNsid } from '@atcute/lexicons/syntax';
+import { fromBase64Url } from '@atcute/multibase';
+import { decodeUtf8From, encodeUtf8 } from '@atcute/uint8array';
+const didString = v.string().assert(isDid, `must be a did`);
+const nsidString = v.string().assert(isNsid, `must be an nsid`);
+const integer = v.number().assert((input) => input >= 0 && Number.isSafeInteger(input), `must be an integer`);
+const jwtHeader = v.object({
+    typ: v.string().optional(),
+    alg: v.string(),
+});
+const jwtPayload = v
+    .object({
+    /** issuer */
+    iss: didString,
+    /** target audience */
+    aud: didString,
+    /** expiration time */
+    exp: integer,
+    /** creation time */
+    iat: integer.optional(),
+    /** xrpc operation being invoked */
+    lxm: nsidString.optional(),
+    /** unique identifier */
+    jti: v.string().optional(),
+})
+    .assert(({ iat, exp }) => iat === undefined || exp > iat, {
+    message: `expiry time must be greater than issued time`,
+    path: ['exp'],
+});
+const readJwtPortion = (schema, input) => {
+    try {
+        const raw = decodeUtf8From(fromBase64Url(input));
+        const json = JSON.parse(raw);
+        const result = schema.try(json);
+        if (result.ok) {
+            return result;
+        }
+    }
+    catch { }
+    return {
+        ok: false,
+        error: {
+            error: `MalformedJwt`,
+            description: `jwt is malformed`,
+        },
+    };
+};
+const readJwtSignature = (input) => {
+    try {
+        return { ok: true, value: fromBase64Url(input) };
+    }
+    catch { }
+    return {
+        ok: false,
+        error: {
+            error: `MalformedJwt`,
+            description: `jwt is malformed`,
+        },
+    };
+};
+export const parseJwt = (jwtString) => {
+    const parts = jwtString.split('.');
+    if (parts.length !== 3) {
+        return {
+            ok: false,
+            error: {
+                error: `MalformedJwt`,
+                description: `jwt is malformed`,
+            },
+        };
+    }
+    const [headerString, payloadString, signatureString] = parts;
+    const header = readJwtPortion(jwtHeader, headerString);
+    if (!header.ok) {
+        return header;
+    }
+    const payload = readJwtPortion(jwtPayload, payloadString);
+    if (!payload.ok) {
+        return payload;
+    }
+    const signature = readJwtSignature(signatureString);
+    if (!signature.ok) {
+        return signature;
+    }
+    return {
+        ok: true,
+        value: {
+            header: header.value,
+            payload: payload.value,
+            message: encodeUtf8(`${headerString}.${payloadString}`),
+            signature: signature.value,
+        },
+    };
+};
+//# sourceMappingURL=jwt.js.map

package/dist/auth/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../lib/auth/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,gBAAgB,CAAC;AAEpC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAMhE,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;AAC5D,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;AAEhE,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,oBAAoB,CAAC,CAAC;AAE9G,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;CACf,CAAC,CAAC;AAIH,MAAM,UAAU,GAAG,CAAC;KAClB,MAAM,CAAC;IACP,aAAa;IACb,GAAG,EAAE,SAAS;IACd,sBAAsB;IACtB,GAAG,EAAE,SAAS;IACd,sBAAsB;IACtB,GAAG,EAAE,OAAO;IACZ,oBAAoB;IACpB,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE;IACvB,mCAAmC;IACnC,GAAG,EAAE,UAAU,CAAC,QAAQ,EAAE;IAC1B,wBAAwB;IACxB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC1B,CAAC;KACD,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,GAAG,GAAG,EAAE;IACzD,OAAO,EAAE,8CAA8C;IACvD,IAAI,EAAE,CAAC,KAAK,CAAC;CACb,CAAC,CAAC;AAWJ,MAAM,cAAc,GAAG,CAAI,MAAiB,EAAE,KAAa,EAAwB,EAAE;IACpF,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,cAAc,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAE7B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,MAAM,CAAC;QACf,CAAC;IACF,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IAEV,OAAO;QACN,EAAE,EAAE,KAAK;QACT,KAAK,EAAE;YACN,KAAK,EAAE,cAAc;YACrB,WAAW,EAAE,kBAAkB;SAC/B;KACD,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC,KAAa,EAAiC,EAAE;IACzE,IAAI,CAAC;QACJ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IAEV,OAAO;QACN,EAAE,EAAE,KAAK;QACT,KAAK,EAAE;YACN,KAAK,EAAE,cAAc;YACrB,WAAW,EAAE,kBAAkB;SAC/B;KACD,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,SAAiB,EAAgC,EAAE;IAC3E,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO;YACN,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACN,KAAK,EAAE,cAAc;gBACrB,WAAW,EAAE,kBAAkB;aAC/B;SACD,CAAC;IACH,CAAC;IAED,MAAM,CAAC,YAAY,EAAE,aAAa,EAAE,eAAe,CAAC,GAAG,KAAK,CAAC;IAE7D,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IACvD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO,MAAM,CAAC;IACf,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,OAAO,CAAC;IAChB,CAAC;IAED,MAAM,SAAS,GAAG,gBAAgB,CAAC,eAAe,CAAC,CAAC;IACpD,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QACnB,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,OAAO;QACN,EAAE,EAAE,IAAI;QACR,KAAK,EAAE;YACN,MAAM,EAAE,MAAM,CAAC,KAAK;YACpB,OAAO,EAAE,OAAO,CAAC,KAAK;YACtB,OAAO,EAAE,UAAU,CAAC,GAAG,YAAY,IAAI,aAAa,EAAE,CAAC;YACvD,SAAS,EAAE,SAAS,CAAC,KAAK;SAC1B;KACD,CAAC;AACH,CAAC,CAAC"}

package/dist/auth/types.d.ts

@@ -0,0 +1,4 @@
+export type AuthError = {
+    error: string;
+    description: string;
+};

package/dist/auth/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/auth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../lib/auth/types.ts"],"names":[],"mappings":""}

package/dist/main/index.d.ts

@@ -0,0 +1,3 @@
+export * from './response.js';
+export * from './router.js';
+export * from './xrpc-error.js';

package/dist/main/index.js

@@ -0,0 +1,4 @@
+export * from './response.js';
+export * from './router.js';
+export * from './xrpc-error.js';
+//# sourceMappingURL=index.js.map

package/dist/main/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../lib/main/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC"}

package/dist/main/response.d.ts

@@ -0,0 +1,8 @@
+declare const kJson: unique symbol;
+export type JSONResponse<TData> = Response & {
+    [kJson]: TData;
+};
+export declare const json: {
+    <TData>(data: NoInfer<TData>, init?: ResponseInit): JSONResponse<TData>;
+};
+export {};

package/dist/main/response.js

@@ -0,0 +1,4 @@
+export const json = (data, init) => {
+    return Response.json(data, init);
+};
+//# sourceMappingURL=response.js.map

package/dist/main/response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"response.js","sourceRoot":"","sources":["../../lib/main/response.ts"],"names":[],"mappings":"AAIA,MAAM,CAAC,MAAM,IAAI,GAEb,CAAC,IAAS,EAAE,IAAmB,EAAO,EAAE;IAC3C,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAClC,CAAC,CAAC"}

package/dist/main/router.d.ts

@@ -0,0 +1,21 @@
+import { type XRPCProcedureMetadata, type XRPCQueryMetadata } from '@atcute/lexicons/validations';
+import type { Promisable } from '../types/misc.js';
+import type { ProcedureConfig, QueryConfig } from './types/operation.js';
+import { type Middleware } from './utils/middlewares.js';
+export type FetchMiddleware = Middleware<[request: Request], Promise<Response>>;
+export type NotFoundHandler = (request: Request) => Promisable<Response>;
+export type ExceptionHandler = (error: unknown, request: Request) => Promisable<Response>;
+export declare const defaultExceptionHandler: ExceptionHandler;
+export declare const defaultNotFoundHandler: NotFoundHandler;
+export interface XRPCRouterOptions {
+    middlewares?: FetchMiddleware[];
+    handleNotFound?: NotFoundHandler;
+    handleException?: ExceptionHandler;
+}
+export declare class XRPCRouter {
+    #private;
+    fetch: (request: Request) => Promise<Response>;
+    constructor({ middlewares, handleException, handleNotFound, }?: XRPCRouterOptions);
+    add<TQuery extends XRPCQueryMetadata>(query: TQuery, config: QueryConfig<TQuery>): void;
+    add<TProcedure extends XRPCProcedureMetadata>(procedure: TProcedure, config: ProcedureConfig<TProcedure>): void;
+}