@atproto/aws 0.1.2 → 0.1.4

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # @atproto/aws
 
+## 0.1.4
+
+### Patch Changes
+
+- Updated dependencies [[`84e2d4d2`](https://github.com/bluesky-social/atproto/commit/84e2d4d2b6694f344d80c18672c78b650189d423)]:
+  - @atproto/common@0.3.3
+  - @atproto/crypto@0.2.3
+  - @atproto/repo@0.3.4
+
+## 0.1.3
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @atproto/repo@0.3.3
+  - @atproto/common@0.3.2
+
 ## 0.1.2
 
 ### Patch Changes

package/LICENSE.txt

@@ -0,0 +1,7 @@
+Dual MIT/Apache-2.0 License
+
+Copyright (c) 2022-2023 Bluesky PBC, and Contributors
+
+Except as otherwise noted in individual files, this software is licensed under the MIT license (<http://opensource.org/licenses/MIT>), or the Apache License, Version 2.0 (<http://www.apache.org/licenses/LICENSE-2.0>).
+
+Downstream projects and end users may chose either license individually, or both together, at their discretion. The motivation for this dual-licensing is the additional software patent assurance provided by Apache 2.0.

package/dist/bunny.d.ts

@@ -0,0 +1,11 @@
+import { ImageInvalidator } from './types';
+export declare type BunnyConfig = {
+    accessKey: string;
+    urlPrefix: string;
+};
+export declare class BunnyInvalidator implements ImageInvalidator {
+    cfg: BunnyConfig;
+    constructor(cfg: BunnyConfig);
+    invalidate(_subject: string, paths: string[]): Promise<void>;
+}
+export default BunnyInvalidator;

package/dist/cloudfront.d.ts

@@ -1,4 +1,5 @@
 import * as aws from '@aws-sdk/client-cloudfront';
+import { ImageInvalidator } from './types';
 export declare type CloudfrontConfig = {
     distributionId: string;
     pathPrefix?: string;
@@ -11,6 +12,3 @@ export declare class CloudfrontInvalidator implements ImageInvalidator {
     invalidate(subject: string, paths: string[]): Promise<void>;
 }
 export default CloudfrontInvalidator;
-interface ImageInvalidator {
-    invalidate(subject: string, paths: string[]): Promise<void>;
-}

package/dist/index.d.ts

@@ -1,3 +1,6 @@
 export * from './kms';
 export * from './s3';
 export * from './cloudfront';
+export * from './bunny';
+export * from './util';
+export * from './types';

package/dist/index.js

@@ -618,13 +618,13 @@ var require_s3 = __commonJS({
     var isDnsCompatibleBucketName = (bucketName) => DOMAIN_PATTERN.test(bucketName) && !IP_ADDRESS_PATTERN.test(bucketName) && !DOTS_PATTERN.test(bucketName);
     exports.isDnsCompatibleBucketName = isDnsCompatibleBucketName;
     var isArnBucketName = (bucketName) => {
-      const [arn, partition, service, region, account, typeOrId] = bucketName.split(":");
+      const [arn, partition, service2, region, account, typeOrId] = bucketName.split(":");
       const isArn = arn === "arn" && bucketName.split(":").length >= 6;
-      const isValidArn = [arn, partition, service, account, typeOrId].filter(Boolean).length === 5;
+      const isValidArn = [arn, partition, service2, account, typeOrId].filter(Boolean).length === 5;
       if (isArn && !isValidArn) {
         throw new Error(`Invalid ARN: ${bucketName} was an invalid ARN.`);
       }
-      return arn === "arn" && !!partition && !!service && !!account && !!typeOrId;
+      return arn === "arn" && !!partition && !!service2 && !!account && !!typeOrId;
     };
     exports.isArnBucketName = isArnBucketName;
   }
@@ -12118,11 +12118,11 @@ var require_credentialDerivation = __commonJS({
     var constants_1 = require_constants4();
     var signingKeyCache = {};
     var cacheQueue = [];
-    var createScope = (shortDate, region, service) => `${shortDate}/${region}/${service}/${constants_1.KEY_TYPE_IDENTIFIER}`;
+    var createScope = (shortDate, region, service2) => `${shortDate}/${region}/${service2}/${constants_1.KEY_TYPE_IDENTIFIER}`;
     exports.createScope = createScope;
-    var getSigningKey = async (sha256Constructor, credentials, shortDate, region, service) => {
+    var getSigningKey = async (sha256Constructor, credentials, shortDate, region, service2) => {
       const credsHash = await hmac2(sha256Constructor, credentials.secretAccessKey, credentials.accessKeyId);
-      const cacheKey = `${shortDate}:${region}:${service}:${(0, util_hex_encoding_1.toHex)(credsHash)}:${credentials.sessionToken}`;
+      const cacheKey = `${shortDate}:${region}:${service2}:${(0, util_hex_encoding_1.toHex)(credsHash)}:${credentials.sessionToken}`;
       if (cacheKey in signingKeyCache) {
         return signingKeyCache[cacheKey];
       }
@@ -12131,7 +12131,7 @@ var require_credentialDerivation = __commonJS({
         delete signingKeyCache[cacheQueue.shift()];
       }
       let key = `AWS4${credentials.secretAccessKey}`;
-      for (const signable of [shortDate, region, service, constants_1.KEY_TYPE_IDENTIFIER]) {
+      for (const signable of [shortDate, region, service2, constants_1.KEY_TYPE_IDENTIFIER]) {
         key = await hmac2(sha256Constructor, key, signable);
       }
       return signingKeyCache[cacheKey] = key;
@@ -12433,8 +12433,8 @@ var require_SignatureV4 = __commonJS({
     var prepareRequest_1 = require_prepareRequest();
     var utilDate_1 = require_utilDate();
     var SignatureV4 = class {
-      constructor({ applyChecksum, credentials, region, service, sha256: sha2564, uriEscapePath = true }) {
-        this.service = service;
+      constructor({ applyChecksum, credentials, region, service: service2, sha256: sha2564, uriEscapePath = true }) {
+        this.service = service2;
         this.sha256 = sha2564;
         this.uriEscapePath = uriEscapePath;
         this.applyChecksum = typeof applyChecksum === "boolean" ? applyChecksum : true;
@@ -12565,8 +12565,8 @@ ${(0, util_hex_encoding_1.toHex)(hashedRequest)}`;
         hash2.update(stringToSign);
         return (0, util_hex_encoding_1.toHex)(await hash2.digest());
       }
-      getSigningKey(credentials, region, shortDate, service) {
-        return (0, credentialDerivation_1.getSigningKey)(this.sha256, credentials, shortDate, region, service || this.service);
+      getSigningKey(credentials, region, shortDate, service2) {
+        return (0, credentialDerivation_1.getSigningKey)(this.sha256, credentials, shortDate, region, service2 || this.service);
       }
       validateResolvedCredentials(credentials) {
         if (typeof credentials !== "object" || typeof credentials.accessKeyId !== "string" || typeof credentials.secretAccessKey !== "string") {
@@ -19305,12 +19305,12 @@ var require_parseArn = __commonJS({
       const segments = value.split(":");
       if (segments.length < 6)
         return null;
-      const [arn, partition, service, region, accountId, ...resourceId] = segments;
-      if (arn !== "arn" || partition === "" || service === "" || resourceId[0] === "")
+      const [arn, partition, service2, region, accountId, ...resourceId] = segments;
+      if (arn !== "arn" || partition === "" || service2 === "" || resourceId[0] === "")
         return null;
       return {
         partition,
-        service,
+        service: service2,
         region,
         accountId,
         resourceId: resourceId[0].includes("/") ? resourceId[0].split("/") : resourceId
@@ -33760,13 +33760,13 @@ var require_s32 = __commonJS({
     var isDnsCompatibleBucketName = (bucketName) => DOMAIN_PATTERN.test(bucketName) && !IP_ADDRESS_PATTERN.test(bucketName) && !DOTS_PATTERN.test(bucketName);
     exports.isDnsCompatibleBucketName = isDnsCompatibleBucketName;
     var isArnBucketName = (bucketName) => {
-      const [arn, partition, service, region, account, typeOrId] = bucketName.split(":");
+      const [arn, partition, service2, region, account, typeOrId] = bucketName.split(":");
       const isArn = arn === "arn" && bucketName.split(":").length >= 6;
-      const isValidArn = [arn, partition, service, account, typeOrId].filter(Boolean).length === 5;
+      const isValidArn = [arn, partition, service2, account, typeOrId].filter(Boolean).length === 5;
       if (isArn && !isValidArn) {
         throw new Error(`Invalid ARN: ${bucketName} was an invalid ARN.`);
       }
-      return arn === "arn" && !!partition && !!service && !!account && !!typeOrId;
+      return arn === "arn" && !!partition && !!service2 && !!account && !!typeOrId;
     };
     exports.isArnBucketName = isArnBucketName;
   }
@@ -47437,10 +47437,10 @@ var require_dist_cjs57 = __commonJS({
       const segments = arn.split(":");
       if (segments.length < 6 || segments[0] !== "arn")
         throw new Error("Malformed ARN");
-      const [, partition, service, region, accountId, ...resource] = segments;
+      const [, partition, service2, region, accountId, ...resource] = segments;
       return {
         partition,
-        service,
+        service: service2,
         region,
         accountId,
         resource: resource.join(":")
@@ -47448,11 +47448,11 @@ var require_dist_cjs57 = __commonJS({
     };
     exports.parse = parse;
     var build = (arnObject) => {
-      const { partition = "aws", service, region, accountId, resource } = arnObject;
-      if ([service, region, accountId, resource].some((segment) => typeof segment !== "string")) {
+      const { partition = "aws", service: service2, region, accountId, resource } = arnObject;
+      if ([service2, region, accountId, resource].some((segment) => typeof segment !== "string")) {
         throw new Error("Input ARN object is invalid");
       }
-      return `arn:${partition}:${service}:${region}:${accountId}:${resource}`;
+      return `arn:${partition}:${service2}:${region}:${accountId}:${resource}`;
     };
     exports.build = build;
   }
@@ -47597,20 +47597,20 @@ var require_bucketHostnameUtils = __commonJS({
       }
     };
     exports.validateArnEndpointOptions = validateArnEndpointOptions;
-    var validateService = (service) => {
-      if (service !== "s3" && service !== "s3-outposts" && service !== "s3-object-lambda") {
+    var validateService = (service2) => {
+      if (service2 !== "s3" && service2 !== "s3-outposts" && service2 !== "s3-object-lambda") {
         throw new Error("Expect 's3' or 's3-outposts' or 's3-object-lambda' in ARN service component");
       }
     };
     exports.validateService = validateService;
-    var validateS3Service = (service) => {
-      if (service !== "s3") {
+    var validateS3Service = (service2) => {
+      if (service2 !== "s3") {
         throw new Error("Expect 's3' in Accesspoint ARN service component");
       }
     };
     exports.validateS3Service = validateS3Service;
-    var validateOutpostService = (service) => {
-      if (service !== "s3-outposts") {
+    var validateOutpostService = (service2) => {
+      if (service2 !== "s3-outposts") {
         throw new Error("Expect 's3-posts' in Outpost ARN service component");
       }
     };
@@ -47742,12 +47742,12 @@ var require_bucketHostname = __commonJS({
       const hostnameSuffix = isCustomEndpoint ? baseHostname : (0, bucketHostnameUtils_1.getSuffixForArnEndpoint)(baseHostname)[1];
       const { pathStyleEndpoint, accelerateEndpoint = false, fipsEndpoint = false, tlsCompatible = true, bucketName, clientPartition = "aws" } = options;
       (0, bucketHostnameUtils_1.validateArnEndpointOptions)({ pathStyleEndpoint, accelerateEndpoint, tlsCompatible });
-      const { service, partition, accountId, region, resource } = bucketName;
-      (0, bucketHostnameUtils_1.validateService)(service);
+      const { service: service2, partition, accountId, region, resource } = bucketName;
+      (0, bucketHostnameUtils_1.validateService)(service2);
       (0, bucketHostnameUtils_1.validatePartition)(partition, { clientPartition });
       (0, bucketHostnameUtils_1.validateAccountId)(accountId);
       const { accesspointName, outpostId } = (0, bucketHostnameUtils_1.getArnResources)(resource);
-      if (service === "s3-object-lambda") {
+      if (service2 === "s3-object-lambda") {
         return getEndpointFromObjectLambdaArn({ ...options, tlsCompatible, bucketName, accesspointName, hostnameSuffix });
       }
       if (region === "") {
@@ -47759,7 +47759,7 @@ var require_bucketHostname = __commonJS({
       return getEndpointFromAccessPointArn({ ...options, clientRegion, accesspointName, hostnameSuffix });
     };
     var getEndpointFromObjectLambdaArn = ({ dualstackEndpoint = false, fipsEndpoint = false, tlsCompatible = true, useArnRegion, clientRegion, clientSigningRegion = clientRegion, accesspointName, bucketName, hostnameSuffix }) => {
-      const { accountId, region, service } = bucketName;
+      const { accountId, region, service: service2 } = bucketName;
       (0, bucketHostnameUtils_1.validateRegionalClient)(clientRegion);
       (0, bucketHostnameUtils_1.validateRegion)(region, {
         useArnRegion,
@@ -47775,9 +47775,9 @@ var require_bucketHostname = __commonJS({
       const signingRegion = useArnRegion ? region : clientSigningRegion;
       return {
         bucketEndpoint: true,
-        hostname: `${DNSHostLabel}.${service}${fipsEndpoint ? "-fips" : ""}.${endpointRegion}.${hostnameSuffix}`,
+        hostname: `${DNSHostLabel}.${service2}${fipsEndpoint ? "-fips" : ""}.${endpointRegion}.${hostnameSuffix}`,
         signingRegion,
-        signingService: service
+        signingService: service2
       };
     };
     var getEndpointFromMRAPArn = ({ disableMultiregionAccessPoints, dualstackEndpoint = false, isCustomEndpoint, mrapAlias, hostnameSuffix }) => {
@@ -56676,11 +56676,11 @@ var require_credentialDerivation2 = __commonJS({
     var constants_1 = require_constants13();
     var signingKeyCache = {};
     var cacheQueue = [];
-    var createScope = (shortDate, region, service) => `${shortDate}/${region}/${service}/${constants_1.KEY_TYPE_IDENTIFIER}`;
+    var createScope = (shortDate, region, service2) => `${shortDate}/${region}/${service2}/${constants_1.KEY_TYPE_IDENTIFIER}`;
     exports.createScope = createScope;
-    var getSigningKey = async (sha256Constructor, credentials, shortDate, region, service) => {
+    var getSigningKey = async (sha256Constructor, credentials, shortDate, region, service2) => {
       const credsHash = await hmac2(sha256Constructor, credentials.secretAccessKey, credentials.accessKeyId);
-      const cacheKey = `${shortDate}:${region}:${service}:${(0, util_hex_encoding_1.toHex)(credsHash)}:${credentials.sessionToken}`;
+      const cacheKey = `${shortDate}:${region}:${service2}:${(0, util_hex_encoding_1.toHex)(credsHash)}:${credentials.sessionToken}`;
       if (cacheKey in signingKeyCache) {
         return signingKeyCache[cacheKey];
       }
@@ -56689,7 +56689,7 @@ var require_credentialDerivation2 = __commonJS({
         delete signingKeyCache[cacheQueue.shift()];
       }
       let key = `AWS4${credentials.secretAccessKey}`;
-      for (const signable of [shortDate, region, service, constants_1.KEY_TYPE_IDENTIFIER]) {
+      for (const signable of [shortDate, region, service2, constants_1.KEY_TYPE_IDENTIFIER]) {
         key = await hmac2(sha256Constructor, key, signable);
       }
       return signingKeyCache[cacheKey] = key;
@@ -56980,8 +56980,8 @@ var require_SignatureV42 = __commonJS({
     var prepareRequest_1 = require_prepareRequest2();
     var utilDate_1 = require_utilDate2();
     var SignatureV4 = class {
-      constructor({ applyChecksum, credentials, region, service, sha256: sha2564, uriEscapePath = true }) {
-        this.service = service;
+      constructor({ applyChecksum, credentials, region, service: service2, sha256: sha2564, uriEscapePath = true }) {
+        this.service = service2;
         this.sha256 = sha2564;
         this.uriEscapePath = uriEscapePath;
         this.applyChecksum = typeof applyChecksum === "boolean" ? applyChecksum : true;
@@ -57112,8 +57112,8 @@ ${(0, util_hex_encoding_1.toHex)(hashedRequest)}`;
         hash2.update(stringToSign);
         return (0, util_hex_encoding_1.toHex)(await hash2.digest());
       }
-      getSigningKey(credentials, region, shortDate, service) {
-        return (0, credentialDerivation_1.getSigningKey)(this.sha256, credentials, shortDate, region, service || this.service);
+      getSigningKey(credentials, region, shortDate, service2) {
+        return (0, credentialDerivation_1.getSigningKey)(this.sha256, credentials, shortDate, region, service2 || this.service);
       }
       validateResolvedCredentials(credentials) {
         if (typeof credentials !== "object" || typeof credentials.accessKeyId !== "string" || typeof credentials.secretAccessKey !== "string") {
@@ -62482,12 +62482,12 @@ var require_parseArn2 = __commonJS({
       const segments = value.split(":");
       if (segments.length < 6)
         return null;
-      const [arn, partition, service, region, accountId, ...resourceId] = segments;
-      if (arn !== "arn" || partition === "" || service === "" || resourceId[0] === "")
+      const [arn, partition, service2, region, accountId, ...resourceId] = segments;
+      if (arn !== "arn" || partition === "" || service2 === "" || resourceId[0] === "")
         return null;
       return {
         partition,
-        service,
+        service: service2,
         region,
         accountId,
         resourceId: resourceId[0].includes("/") ? resourceId[0].split("/") : resourceId
@@ -81004,13 +81004,13 @@ var require_s33 = __commonJS({
     var isDnsCompatibleBucketName = (bucketName) => DOMAIN_PATTERN.test(bucketName) && !IP_ADDRESS_PATTERN.test(bucketName) && !DOTS_PATTERN.test(bucketName);
     exports.isDnsCompatibleBucketName = isDnsCompatibleBucketName;
     var isArnBucketName = (bucketName) => {
-      const [arn, partition, service, region, account, typeOrId] = bucketName.split(":");
+      const [arn, partition, service2, region, account, typeOrId] = bucketName.split(":");
       const isArn = arn === "arn" && bucketName.split(":").length >= 6;
-      const isValidArn = [arn, partition, service, account, typeOrId].filter(Boolean).length === 5;
+      const isValidArn = [arn, partition, service2, account, typeOrId].filter(Boolean).length === 5;
       if (isArn && !isValidArn) {
         throw new Error(`Invalid ARN: ${bucketName} was an invalid ARN.`);
       }
-      return arn === "arn" && !!partition && !!service && !!account && !!typeOrId;
+      return arn === "arn" && !!partition && !!service2 && !!account && !!typeOrId;
     };
     exports.isArnBucketName = isArnBucketName;
   }
@@ -96694,13 +96694,13 @@ var require_s34 = __commonJS({
     var isDnsCompatibleBucketName = (bucketName) => DOMAIN_PATTERN.test(bucketName) && !IP_ADDRESS_PATTERN.test(bucketName) && !DOTS_PATTERN.test(bucketName);
     exports.isDnsCompatibleBucketName = isDnsCompatibleBucketName;
     var isArnBucketName = (bucketName) => {
-      const [arn, partition, service, region, account, typeOrId] = bucketName.split(":");
+      const [arn, partition, service2, region, account, typeOrId] = bucketName.split(":");
       const isArn = arn === "arn" && bucketName.split(":").length >= 6;
-      const isValidArn = [arn, partition, service, account, typeOrId].filter(Boolean).length === 5;
+      const isValidArn = [arn, partition, service2, account, typeOrId].filter(Boolean).length === 5;
       if (isArn && !isValidArn) {
         throw new Error(`Invalid ARN: ${bucketName} was an invalid ARN.`);
       }
-      return arn === "arn" && !!partition && !!service && !!account && !!typeOrId;
+      return arn === "arn" && !!partition && !!service2 && !!account && !!typeOrId;
     };
     exports.isArnBucketName = isArnBucketName;
   }
@@ -98356,11 +98356,11 @@ var require_credentialDerivation3 = __commonJS({
     var constants_1 = require_constants21();
     var signingKeyCache = {};
     var cacheQueue = [];
-    var createScope = (shortDate, region, service) => `${shortDate}/${region}/${service}/${constants_1.KEY_TYPE_IDENTIFIER}`;
+    var createScope = (shortDate, region, service2) => `${shortDate}/${region}/${service2}/${constants_1.KEY_TYPE_IDENTIFIER}`;
     exports.createScope = createScope;
-    var getSigningKey = async (sha256Constructor, credentials, shortDate, region, service) => {
+    var getSigningKey = async (sha256Constructor, credentials, shortDate, region, service2) => {
       const credsHash = await hmac2(sha256Constructor, credentials.secretAccessKey, credentials.accessKeyId);
-      const cacheKey = `${shortDate}:${region}:${service}:${(0, util_hex_encoding_1.toHex)(credsHash)}:${credentials.sessionToken}`;
+      const cacheKey = `${shortDate}:${region}:${service2}:${(0, util_hex_encoding_1.toHex)(credsHash)}:${credentials.sessionToken}`;
       if (cacheKey in signingKeyCache) {
         return signingKeyCache[cacheKey];
       }
@@ -98369,7 +98369,7 @@ var require_credentialDerivation3 = __commonJS({
         delete signingKeyCache[cacheQueue.shift()];
       }
       let key = `AWS4${credentials.secretAccessKey}`;
-      for (const signable of [shortDate, region, service, constants_1.KEY_TYPE_IDENTIFIER]) {
+      for (const signable of [shortDate, region, service2, constants_1.KEY_TYPE_IDENTIFIER]) {
         key = await hmac2(sha256Constructor, key, signable);
       }
       return signingKeyCache[cacheKey] = key;
@@ -98627,8 +98627,8 @@ var require_SignatureV43 = __commonJS({
     var prepareRequest_1 = require_prepareRequest3();
     var utilDate_1 = require_utilDate3();
     var SignatureV4 = class {
-      constructor({ applyChecksum, credentials, region, service, sha256: sha2564, uriEscapePath = true }) {
-        this.service = service;
+      constructor({ applyChecksum, credentials, region, service: service2, sha256: sha2564, uriEscapePath = true }) {
+        this.service = service2;
         this.sha256 = sha2564;
         this.uriEscapePath = uriEscapePath;
         this.applyChecksum = typeof applyChecksum === "boolean" ? applyChecksum : true;
@@ -98759,8 +98759,8 @@ ${(0, util_hex_encoding_1.toHex)(hashedRequest)}`;
         hash2.update((0, util_utf8_1.toUint8Array)(stringToSign));
         return (0, util_hex_encoding_1.toHex)(await hash2.digest());
       }
-      getSigningKey(credentials, region, shortDate, service) {
-        return (0, credentialDerivation_1.getSigningKey)(this.sha256, credentials, shortDate, region, service || this.service);
+      getSigningKey(credentials, region, shortDate, service2) {
+        return (0, credentialDerivation_1.getSigningKey)(this.sha256, credentials, shortDate, region, service2 || this.service);
       }
       validateResolvedCredentials(credentials) {
         if (typeof credentials !== "object" || typeof credentials.accessKeyId !== "string" || typeof credentials.secretAccessKey !== "string") {
@@ -105253,12 +105253,12 @@ var require_parseArn3 = __commonJS({
       const segments = value.split(":");
       if (segments.length < 6)
         return null;
-      const [arn, partition, service, region, accountId, ...resourceId] = segments;
-      if (arn !== "arn" || partition === "" || service === "" || resourceId[0] === "")
+      const [arn, partition, service2, region, accountId, ...resourceId] = segments;
+      if (arn !== "arn" || partition === "" || service2 === "" || resourceId[0] === "")
         return null;
       return {
         partition,
-        service,
+        service: service2,
         region,
         accountId,
         resourceId: resourceId[0].includes("/") ? resourceId[0].split("/") : resourceId
@@ -135549,8 +135549,10 @@ var require_dist_cjs167 = __commonJS({
 // src/index.ts
 var src_exports4 = {};
 __export(src_exports4, {
+  BunnyInvalidator: () => BunnyInvalidator,
   CloudfrontInvalidator: () => CloudfrontInvalidator,
   KmsKeypair: () => KmsKeypair,
+  MultiImageInvalidator: () => MultiImageInvalidator,
   S3BlobStore: () => S3BlobStore
 });
 module.exports = __toCommonJS(src_exports4);
@@ -138550,16 +138552,18 @@ var decompressPubkey2 = (compressed) => {
 };
 
 // ../crypto/src/p256/operations.ts
-var verifyDidSig = async (did2, data, sig) => {
+var verifyDidSig = async (did2, data, sig, opts) => {
   const { jwtAlg, keyBytes } = parseDidKey(did2);
   if (jwtAlg !== P256_JWT_ALG) {
     throw new Error(`Not a P-256 did:key: ${did2}`);
   }
-  return verifySig(keyBytes, data, sig);
+  return verifySig(keyBytes, data, sig, opts);
 };
-var verifySig = async (publicKey, data, sig) => {
+var verifySig = async (publicKey, data, sig, opts) => {
   const msgHash = await sha256(data);
-  return p256.verify(sig, msgHash, publicKey, { lowS: true });
+  return p256.verify(sig, msgHash, publicKey, {
+    lowS: opts?.lowS ?? true
+  });
 };
 
 // ../crypto/src/p256/plugin.ts
@@ -138571,16 +138575,18 @@ var p256Plugin = {
 var plugin_default = p256Plugin;
 
 // ../crypto/src/secp256k1/operations.ts
-var verifyDidSig2 = async (did2, data, sig) => {
+var verifyDidSig2 = async (did2, data, sig, opts) => {
   const { jwtAlg, keyBytes } = parseDidKey(did2);
   if (jwtAlg !== SECP256K1_JWT_ALG) {
     throw new Error(`Not a secp256k1 did:key: ${did2}`);
   }
-  return verifySig2(keyBytes, data, sig);
+  return verifySig2(keyBytes, data, sig, opts);
 };
-var verifySig2 = async (publicKey, data, sig) => {
+var verifySig2 = async (publicKey, data, sig, opts) => {
   const msgHash = await sha256(data);
-  return secp256k1.verify(sig, msgHash, publicKey, { lowS: true });
+  return secp256k1.verify(sig, msgHash, publicKey, {
+    lowS: opts?.lowS ?? true
+  });
 };
 
 // ../crypto/src/secp256k1/plugin.ts
@@ -142345,6 +142351,21 @@ var ensureValidNsid = (nsid2) => {
 var InvalidNsidError = class extends Error {
 };
 
+// ../common-web/src/async.ts
+var handleAllSettledErrors = (results) => {
+  const errors = results.filter(isRejected).map((res) => res.reason);
+  if (errors.length === 0) {
+    return;
+  }
+  if (errors.length === 1) {
+    throw errors[0];
+  }
+  throw new AggregateError(errors, "Multiple errors: " + errors.map((err) => err?.message).join("\n"));
+};
+var isRejected = (result) => {
+  return result.status === "rejected";
+};
+
 // ../common-web/src/types.ts
 var cidSchema = z.any().refine((obj) => CID.asCID(obj) !== null, {
   message: "Not a CID"
@@ -142389,6 +142410,25 @@ var DAY = HOUR * 24;
 // ../common-web/src/strings.ts
 var import_graphemer = __toESM(require_lib4());
 
+// ../common-web/src/did-doc.ts
+var verificationMethod = z.object({
+  id: z.string(),
+  type: z.string(),
+  controller: z.string(),
+  publicKeyMultibase: z.string().optional()
+});
+var service = z.object({
+  id: z.string(),
+  type: z.string(),
+  serviceEndpoint: z.union([z.string(), z.record(z.unknown())])
+});
+var didDocument = z.object({
+  id: z.string(),
+  alsoKnownAs: z.array(z.string()).optional(),
+  verificationMethod: z.array(verificationMethod).optional(),
+  service: z.array(service).optional()
+});
+
 // ../lexicon/src/validators/formats.ts
 var import_iso_datestring_validator = __toESM(require_dist2());
 
@@ -146449,10 +146489,47 @@ var CloudfrontInvalidator = class {
     });
   }
 };
+
+// src/bunny.ts
+var API_PURGE_URL = "https://api.bunny.net/purge";
+var BunnyInvalidator = class {
+  constructor(cfg) {
+    this.cfg = cfg;
+  }
+  async invalidate(_subject, paths) {
+    const results = await Promise.allSettled(paths.map(async (path) => purgeUrl({
+      url: this.cfg.urlPrefix + path,
+      accessKey: this.cfg.accessKey
+    })));
+    handleAllSettledErrors(results);
+  }
+};
+async function purgeUrl(opts) {
+  const search = new URLSearchParams();
+  search.set("async", "true");
+  search.set("url", opts.url);
+  await fetch(API_PURGE_URL + "?" + search.toString(), {
+    method: "post",
+    headers: { AccessKey: opts.accessKey }
+  });
+}
+
+// src/util.ts
+var MultiImageInvalidator = class {
+  constructor(invalidators) {
+    this.invalidators = invalidators;
+  }
+  async invalidate(subject, paths) {
+    const results = await Promise.allSettled(this.invalidators.map((invalidator) => invalidator.invalidate(subject, paths)));
+    handleAllSettledErrors(results);
+  }
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  BunnyInvalidator,
   CloudfrontInvalidator,
   KmsKeypair,
+  MultiImageInvalidator,
   S3BlobStore
 });
 /*! *****************************************************************************