@atproto/bsky 0.0.103 → 0.0.104

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @atproto/bsky
 
+## 0.0.104
+
+### Patch Changes
+
+- [#3177](https://github.com/bluesky-social/atproto/pull/3177) [`72eba67af`](https://github.com/bluesky-social/atproto/commit/72eba67af1af8320b5400bcb9319d5c3c8407d99) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Improve performance when serving blobs
+
+- [#3177](https://github.com/bluesky-social/atproto/pull/3177) [`72eba67af`](https://github.com/bluesky-social/atproto/commit/72eba67af1af8320b5400bcb9319d5c3c8407d99) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Remove dependency on Axios
+
+- Updated dependencies [[`72eba67af`](https://github.com/bluesky-social/atproto/commit/72eba67af1af8320b5400bcb9319d5c3c8407d99), [`72eba67af`](https://github.com/bluesky-social/atproto/commit/72eba67af1af8320b5400bcb9319d5c3c8407d99)]:
+  - @atproto-labs/xrpc-utils@0.0.1
+  - @atproto/identity@0.4.4
+  - @atproto/api@0.13.26
+  - @atproto/common@0.4.6
+  - @atproto/lexicon@0.4.5
+  - @atproto/repo@0.6.1
+  - @atproto/sync@0.1.8
+  - @atproto/crypto@0.4.2
+  - @atproto/xrpc-server@0.7.5
+
 ## 0.0.103
 
 ### Patch Changes

package/dist/api/blob-dispatcher.d.ts

@@ -0,0 +1,4 @@
+import { Dispatcher } from 'undici';
+import { ServerConfig } from '../config';
+export declare function createBlobDispatcher(cfg: ServerConfig): Dispatcher;
+//# sourceMappingURL=blob-dispatcher.d.ts.map

package/dist/api/blob-dispatcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"blob-dispatcher.d.ts","sourceRoot":"","sources":["../../src/api/blob-dispatcher.ts"],"names":[],"mappings":"AACA,OAAO,EAAS,UAAU,EAAoB,MAAM,QAAQ,CAAA;AAE5D,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAGxC,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,YAAY,GAAG,UAAU,CA+BlE"}

package/dist/api/blob-dispatcher.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createBlobDispatcher = createBlobDispatcher;
+const fetch_node_1 = require("@atproto-labs/fetch-node");
+const undici_1 = require("undici");
+const retry_1 = require("../util/retry");
+function createBlobDispatcher(cfg) {
+    const baseDispatcher = new undici_1.Agent({
+        allowH2: cfg.proxyAllowHTTP2, // This is experimental
+        headersTimeout: cfg.proxyHeadersTimeout,
+        maxResponseSize: cfg.proxyMaxResponseSize,
+        bodyTimeout: cfg.proxyBodyTimeout,
+        factory: cfg.disableSsrfProtection
+            ? undefined
+            : (origin, opts) => {
+                const { protocol, hostname } = origin instanceof URL ? origin : new URL(origin);
+                if (protocol !== 'https:') {
+                    throw new Error(`Forbidden protocol "${protocol}"`);
+                }
+                if ((0, fetch_node_1.isUnicastIp)(hostname) === false) {
+                    throw new Error('Hostname resolved to non-unicast address');
+                }
+                return new undici_1.Pool(origin, opts);
+            },
+        connect: {
+            lookup: cfg.disableSsrfProtection ? undefined : fetch_node_1.unicastLookup,
+        },
+    });
+    return cfg.proxyMaxRetries > 0
+        ? new undici_1.RetryAgent(baseDispatcher, {
+            statusCodes: [...retry_1.RETRYABLE_HTTP_STATUS_CODES],
+            methods: ['GET', 'HEAD'],
+            maxRetries: cfg.proxyMaxRetries,
+        })
+        : baseDispatcher;
+}
+//# sourceMappingURL=blob-dispatcher.js.map

package/dist/api/blob-dispatcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"blob-dispatcher.js","sourceRoot":"","sources":["../../src/api/blob-dispatcher.ts"],"names":[],"mappings":";;AAMA,oDA+BC;AArCD,yDAAqE;AACrE,mCAA4D;AAG5D,yCAA2D;AAE3D,SAAgB,oBAAoB,CAAC,GAAiB;IACpD,MAAM,cAAc,GAAG,IAAI,cAAK,CAAC;QAC/B,OAAO,EAAE,GAAG,CAAC,eAAe,EAAE,uBAAuB;QACrD,cAAc,EAAE,GAAG,CAAC,mBAAmB;QACvC,eAAe,EAAE,GAAG,CAAC,oBAAoB;QACzC,WAAW,EAAE,GAAG,CAAC,gBAAgB;QACjC,OAAO,EAAE,GAAG,CAAC,qBAAqB;YAChC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;gBACf,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAC1B,MAAM,YAAY,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;gBAClD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;oBAC1B,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,GAAG,CAAC,CAAA;gBACrD,CAAC;gBACD,IAAI,IAAA,wBAAW,EAAC,QAAQ,CAAC,KAAK,KAAK,EAAE,CAAC;oBACpC,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;gBAC7D,CAAC;gBACD,OAAO,IAAI,aAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;YAC/B,CAAC;QACL,OAAO,EAAE;YACP,MAAM,EAAE,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,0BAAa;SAC9D;KACF,CAAC,CAAA;IAEF,OAAO,GAAG,CAAC,eAAe,GAAG,CAAC;QAC5B,CAAC,CAAC,IAAI,mBAAU,CAAC,cAAc,EAAE;YAC7B,WAAW,EAAE,CAAC,GAAG,mCAA2B,CAAC;YAC7C,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;YACxB,UAAU,EAAE,GAAG,CAAC,eAAe;SAChC,CAAC;QACJ,CAAC,CAAC,cAAc,CAAA;AACpB,CAAC"}

package/dist/api/blob-resolver.d.ts

@@ -1,11 +1,20 @@
-import express from 'express';
+import { AtprotoDid } from '@atproto/did';
 import { CID } from 'multiformats/cid';
-import { VerifyCidTransform } from '@atproto/common';
+import { Writable } from 'node:stream';
+import { Dispatcher } from 'undici';
 import AppContext from '../context';
-export declare const createRouter: (ctx: AppContext) => express.Router;
-export declare function resolveBlob(ctx: AppContext, did: string, cid: CID): Promise<{
-    pds: string;
-    contentType: string;
-    stream: VerifyCidTransform;
-}>;
+import { Middleware } from '../util/http';
+export declare function createMiddleware(ctx: AppContext): Middleware;
+export type StreamBlobOptions = {
+    cid: string;
+    did: string;
+    acceptEncoding?: string;
+    signal?: AbortSignal;
+};
+export type StreamBlobFactory = (data: Dispatcher.StreamFactoryData, info: {
+    url: URL;
+    did: AtprotoDid;
+    cid: CID;
+}) => Writable;
+export declare function streamBlob(ctx: AppContext, options: StreamBlobOptions, factory: StreamBlobFactory): Promise<Dispatcher.StreamData>;
 //# sourceMappingURL=blob-resolver.d.ts.map

package/dist/api/blob-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"blob-resolver.d.ts","sourceRoot":"","sources":["../../src/api/blob-resolver.ts"],"names":[],"mappings":"AACA,OAAO,OAAO,MAAM,SAAS,CAAA;AAG7B,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAA;AAEtC,OAAO,EAAuB,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AAEzE,OAAO,UAAU,MAAM,YAAY,CAAA;AAYnC,eAAO,MAAM,YAAY,QAAS,UAAU,KAAG,OAAO,CAAC,MA4DtD,CAAA;AAED,wBAAsB,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG;;;;GAuCvE"}
+{"version":3,"file":"blob-resolver.d.ts","sourceRoot":"","sources":["../../src/api/blob-resolver.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAA;AAEvD,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,EAAqB,QAAQ,EAAE,MAAM,aAAa,CAAA;AAEzD,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AAGnC,OAAO,UAAU,MAAM,YAAY,CAAA;AAUnC,OAAO,EAAE,UAAU,EAAwC,MAAM,cAAc,CAAA;AAE/E,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,UAAU,GAAG,UAAU,CAoH5D;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,MAAM,CAAC,EAAE,WAAW,CAAA;CACrB,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG,CAC9B,IAAI,EAAE,UAAU,CAAC,iBAAiB,EAClC,IAAI,EAAE;IACJ,GAAG,EAAE,GAAG,CAAA;IACR,GAAG,EAAE,UAAU,CAAA;IACf,GAAG,EAAE,GAAG,CAAA;CACT,KACE,QAAQ,CAAA;AAEb,wBAAsB,UAAU,CAC9B,GAAG,EAAE,UAAU,EACf,OAAO,EAAE,iBAAiB,EAC1B,OAAO,EAAE,iBAAiB,kCAgE3B"}

package/dist/api/blob-resolver.js

@@ -22,87 +22,190 @@ var __importStar = (this && this.__importStar) || function (mod) {
     __setModuleDefault(result, mod);
     return result;
 };
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createRouter = void 0;
-exports.resolveBlob = resolveBlob;
-const stream_1 = require("stream");
-const express_1 = __importDefault(require("express"));
-const http_errors_1 = __importDefault(require("http-errors"));
-const axios_1 = __importStar(require("axios"));
-const cid_1 = require("multiformats/cid");
-const syntax_1 = require("@atproto/syntax");
+exports.createMiddleware = createMiddleware;
+exports.streamBlob = streamBlob;
+const xrpc_utils_1 = require("@atproto-labs/xrpc-utils");
 const common_1 = require("@atproto/common");
-const identity_1 = require("@atproto/identity");
-const logger_1 = require("../logger");
-const retry_1 = require("../util/retry");
+const did_1 = require("@atproto/did");
+const http_errors_1 = __importStar(require("http-errors"));
+const node_stream_1 = require("node:stream");
+const promises_1 = require("node:stream/promises");
 const data_plane_1 = require("../data-plane");
-// Resolve and verify blob from its origin host
-const createRouter = (ctx) => {
-    const router = express_1.default.Router();
-    router.get('/blob/:did/:cid', async function (req, res, next) {
+const util_1 = require("../hydration/util");
+const logger_1 = require("../logger");
+const http_1 = require("../util/http");
+function createMiddleware(ctx) {
+    return async (req, res, next) => {
+        if (req.method !== 'GET' && req.method !== 'HEAD')
+            return next();
+        if (!req.url?.startsWith('/blob/'))
+            return next();
+        const { length, 2: didParam, 3: cidParam } = req.url.split('/');
+        if (length !== 4 || !didParam || !cidParam)
+            return next();
+        // @TODO Check sec-fetch-* headers (e.g. to prevent files from being
+        // displayed as a web page) ?
         try {
-            const { did, cid: cidStr } = req.params;
-            try {
-                (0, syntax_1.ensureValidDid)(did);
-            }
-            catch (err) {
-                return next((0, http_errors_1.default)(400, 'Invalid did'));
-            }
-            let cid;
-            try {
-                cid = cid_1.CID.parse(cidStr);
-            }
-            catch (err) {
-                return next((0, http_errors_1.default)(400, 'Invalid cid'));
-            }
-            const verifiedImage = await resolveBlob(ctx, did, cid);
-            // Send chunked response, destroying stream early (before
-            // closing chunk) if the bytes don't match the expected cid.
-            res.statusCode = 200;
-            res.setHeader('content-type', verifiedImage.contentType);
-            res.setHeader('x-content-type-options', 'nosniff');
-            res.setHeader('content-security-policy', `default-src 'none'; sandbox`);
-            (0, stream_1.pipeline)(verifiedImage.stream, res, (err) => {
-                if (err) {
-                    logger_1.httpLogger.warn({ err, did, cid: cidStr, pds: verifiedImage.pds }, 'blob resolution failed during transmission');
-                }
+            const streamOptions = {
+                did: didParam,
+                cid: cidParam,
+                signal: (0, http_1.responseSignal)(res),
+                // Because we will be verifying the CID, we need to ensure that the
+                // upstream response can be de-compressed. We do this by negotiating the
+                // "accept-encoding" header based on the downstream client's capabilities.
+                acceptEncoding: (0, xrpc_utils_1.buildProxiedContentEncoding)(req.headers['accept-encoding'], ctx.cfg.proxyPreferCompressed),
+            };
+            await streamBlob(ctx, streamOptions, (upstream, { cid, did, url }) => {
+                const encoding = upstream.headers['content-encoding'];
+                const verifier = createCidVerifier(cid, encoding);
+                const logError = (err) => {
+                    logger_1.httpLogger.warn({ err, did, cid: cid.toString(), pds: url.origin }, 'blob resolution failed during transmission');
+                };
+                const onError = (err) => {
+                    // No need to pipe the data (verifier) into the response, as it is
+                    // "errored". The response processing will continue in the "catch"
+                    // block below (because streamBlob() will reject the promise in case
+                    // of "error" event on the writable stream returned by the factory).
+                    clearTimeout(graceTimer);
+                    logError(err);
+                };
+                // Catch any error that occurs before the timer bellow is triggered.
+                // The promise returned by streamBlob() will be rejected as soon as
+                // the verifier errors.
+                verifier.on('error', onError);
+                // The way I/O work, it is likely that, in case of small payloads, the
+                // full upstream response is already buffered at this point. In order to
+                // return a 404 instead of a broken response stream, we allow the event
+                // loop to to process any pending I/O events before we start piping the
+                // bytes to the response. For larger payloads, the response will look
+                // like a 200 with a broken chunked response stream. The only way around
+                // that would be to buffer the entire response before piping it to the
+                // response, which will hurt latency (need the full payload) and memory
+                // usage (either RAM or DISK). Since this is more of an edge case, we
+                // allow the broken response stream to be sent.
+                const graceTimer = setTimeout(() => {
+                    verifier.off('error', onError);
+                    // Make sure that the content served from the bsky api domain cannot
+                    // be used to perform XSS attacks (by serving HTML pages)
+                    res.setHeader('Content-Security-Policy', `default-src 'none'; sandbox`);
+                    res.setHeader('X-Content-Type-Options', 'nosniff');
+                    res.setHeader('X-Frame-Options', 'DENY');
+                    res.setHeader('X-XSS-Protection', '0');
+                    // @TODO Add a cache-control header ?
+                    // @TODO Add content-disposition header (to force download) ?
+                    (0, http_1.proxyResponseHeaders)(upstream, res);
+                    // Force chunked encoding. This is required because the verifier will
+                    // trigger an error *after* the last chunk has been passed through.
+                    // Because the number of bytes sent will match the content-length, the
+                    // HTTP response will be considered "complete" by the HTTP server. At
+                    // this point, only trailers headers could indicate that an error
+                    // occurred, but that is not the behavior we expect.
+                    res.removeHeader('content-length');
+                    // From this point on, triggering the next middleware (including any
+                    // error handler) can be problematic because content-type,
+                    // content-enconding, etc. headers have already been set. Because of
+                    // this, we make sure that res.headersSent is set to true, preventing
+                    // another error handler middleware from being called (from the catch
+                    // block bellow). Not flushing the headers here would require to
+                    // revert the headers set from this middleware (which we don't do for
+                    // now).
+                    res.flushHeaders();
+                    // Pipe the verifier output into the HTTP response
+                    void (0, promises_1.pipeline)([verifier, res]).catch(logError);
+                }, 10); // 0 works too. Allow for additional data to come in for 10ms.
+                // Write the upstream response into the verifier.
+                return verifier;
             });
         }
         catch (err) {
-            if (err instanceof axios_1.AxiosError) {
-                if (err.code === axios_1.AxiosError.ETIMEDOUT) {
-                    logger_1.httpLogger.warn({ host: err.request?.host, path: err.request?.path }, 'blob resolution timeout');
-                    return next((0, http_errors_1.default)(504)); // Gateway timeout
-                }
-                if (!err.response || err.response.status >= 500) {
-                    logger_1.httpLogger.warn({ host: err.request?.host, path: err.request?.path }, 'blob resolution failed upstream');
-                    return next((0, http_errors_1.default)(502));
-                }
-                return next((0, http_errors_1.default)(404, 'Blob not found'));
+            if (res.headersSent || res.destroyed) {
+                res.destroy();
+            }
+            else if (err instanceof common_1.VerifyCidError) {
+                // @NOTE This only works because of the graceTimer above. It will also
+                // only be triggered for small payloads.
+                next((0, http_errors_1.default)(404, err.message));
             }
-            if (err instanceof identity_1.DidNotFoundError) {
-                return next((0, http_errors_1.default)(404, 'Blob not found'));
+            else if ((0, http_errors_1.isHttpError)(err)) {
+                next(err);
             }
-            return next(err);
+            else {
+                next((0, http_errors_1.default)(502, 'Upstream Error', { cause: err }));
+            }
+        }
+    };
+}
+async function streamBlob(ctx, options, factory) {
+    const { did, cid } = parseBlobParams(options);
+    const url = await getBlobUrl(ctx.dataplane, did, cid);
+    const headers = getBlobHeaders(ctx.cfg, url);
+    headers.set('accept-encoding', options.acceptEncoding ||
+        (0, xrpc_utils_1.formatAcceptHeader)(ctx.cfg.proxyPreferCompressed
+            ? xrpc_utils_1.ACCEPT_ENCODING_COMPRESSED
+            : xrpc_utils_1.ACCEPT_ENCODING_UNCOMPRESSED));
+    let headersReceived = false;
+    return ctx.blobDispatcher
+        .stream({
+        method: 'GET',
+        origin: url.origin,
+        path: url.pathname + url.search,
+        headers,
+        signal: options.signal,
+    }, (upstream) => {
+        headersReceived = true;
+        if (upstream.statusCode !== 200) {
+            logger_1.httpLogger.warn({
+                did,
+                cid: cid.toString(),
+                pds: url.origin,
+                status: upstream.statusCode,
+            }, `blob resolution failed upstream`);
+            throw upstream.statusCode >= 400 && upstream.statusCode < 500
+                ? (0, http_errors_1.default)(404, 'Blob not found', { cause: upstream }) // 4xx => 404
+                : (0, http_errors_1.default)(502, 'Upstream Error', { cause: upstream }); // !200 && !4xx => 502
         }
+        return factory(upstream, { url, did, cid });
+    })
+        .catch((err) => {
+        // Is this a connection error, or a stream error ?
+        if (!headersReceived) {
+            // connection error, dns error, headers timeout, ...
+            logger_1.httpLogger.warn({ err, did, cid: cid.toString(), pds: url.origin }, 'blob resolution failed during connection');
+            throw (0, http_errors_1.default)(502, 'Upstream Error', { cause: err });
+        }
+        throw err;
     });
-    return router;
-};
-exports.createRouter = createRouter;
-async function resolveBlob(ctx, did, cid) {
-    const cidStr = cid.toString();
+}
+function parseBlobParams(params) {
+    const { cid, did } = params;
+    if (!(0, did_1.isAtprotoDid)(did))
+        throw (0, http_errors_1.default)(400, 'Invalid did');
+    const cidObj = (0, util_1.parseCid)(cid);
+    if (!cidObj)
+        throw (0, http_errors_1.default)(400, 'Invalid cid');
+    return { cid: cidObj, did };
+}
+async function getBlobUrl(dataplane, did, cid) {
+    const pds = await getBlobPds(dataplane, did, cid);
+    const url = new URL(`/xrpc/com.atproto.sync.getBlob`, pds);
+    url.searchParams.set('did', did);
+    url.searchParams.set('cid', cid.toString());
+    return url;
+}
+async function getBlobPds(dataplane, did, cid) {
     const [identity, { takenDown }] = await Promise.all([
-        ctx.dataplane.getIdentityByDid({ did }).catch((err) => {
+        dataplane.getIdentityByDid({ did }).catch((err) => {
             if ((0, data_plane_1.isDataplaneError)(err, data_plane_1.Code.NotFound)) {
                 return undefined;
             }
             throw err;
         }),
-        ctx.dataplane.getBlobTakedown({ did, cid: cid.toString() }),
+        dataplane.getBlobTakedown({ did, cid: cid.toString() }),
     ]);
+    if (takenDown) {
+        throw (0, http_errors_1.default)(404, 'Blob not found');
+    }
     const services = identity && (0, data_plane_1.unpackIdentityServices)(identity.services);
     const pds = services &&
         (0, data_plane_1.getServiceEndpoint)(services, {
@@ -112,45 +215,89 @@ async function resolveBlob(ctx, did, cid) {
     if (!pds) {
         throw (0, http_errors_1.default)(404, 'Origin not found');
     }
-    if (takenDown) {
-        throw (0, http_errors_1.default)(404, 'Blob not found');
+    return pds;
+}
+function getBlobHeaders({ blobRateLimitBypassKey: bypassKey, blobRateLimitBypassHostname: bypassHostname, }, url) {
+    const headers = new Map();
+    if (bypassKey && bypassHostname) {
+        const matchesUrl = bypassHostname.startsWith('.')
+            ? url.hostname.endsWith(bypassHostname)
+            : url.hostname === bypassHostname;
+        if (matchesUrl) {
+            headers.set('x-ratelimit-bypass', bypassKey);
+        }
     }
-    const blobResult = await (0, retry_1.retryHttp)(() => getBlob(ctx, { pds, did, cid: cidStr }));
-    const imageStream = blobResult.data;
-    const verifyCid = new common_1.VerifyCidTransform(cid);
-    (0, common_1.forwardStreamErrors)(imageStream, verifyCid);
-    return {
-        pds,
-        contentType: blobResult.headers['content-type'] || 'application/octet-stream',
-        stream: imageStream.pipe(verifyCid),
-    };
+    return headers;
 }
-async function getBlob(ctx, opts) {
-    const { pds, did, cid } = opts;
-    return axios_1.default.get(`${pds}/xrpc/com.atproto.sync.getBlob`, {
-        params: { did, cid },
-        decompress: true,
-        responseType: 'stream',
-        timeout: 5000, // 5sec of inactivity on the connection
-        headers: getRateLimitBypassHeaders(ctx, pds),
+/**
+ * This function creates a passthrough stream that will decompress (if needed)
+ * and verify the CID of the input stream. The output data will be identical to
+ * the input data.
+ *
+ * If you need the un-compressed data, you should use a decompress + verify
+ * pipeline instead.
+ */
+function createCidVerifier(cid, encoding) {
+    // If the upstream content is compressed, we do not want to return a
+    // de-compressed stream here. Indeed, the "compression" middleware will
+    // compress the response before it is sent downstream, if it is not already
+    // compressed. Because of this, it is preferable to return the content as-is
+    // to avoid re-compressing it.
+    //
+    // We do still want to be able to verify the CID, which requires decompressing
+    // the input bytes.
+    //
+    // To that end, we create a passthrough in order to "tee" the stream into two
+    // streams: one that will be sent, unaltered, downstream, and a pipeline that
+    // will be used to decompress & verify the CID (discarding de-compressed
+    // data).
+    const decoders = (0, common_1.createDecoders)(encoding);
+    const verifier = new common_1.VerifyCidTransform(cid);
+    // Optimization: If the content is not compressed, we don't need to "tee" the
+    // stream, we can use the verifier as simple passthrough.
+    if (!decoders.length)
+        return verifier;
+    const pipelineController = new AbortController();
+    const pipelineStreams = [...decoders, verifier];
+    const pipelineInput = pipelineStreams[0];
+    // Create a promise that will resolve if, and only if, the decoding and
+    // verification succeed.
+    const pipelinePromise = (0, promises_1.pipeline)(pipelineStreams, {
+        signal: pipelineController.signal,
+    }).then(() => null, (err) => {
+        const error = asError(err);
+        // the data being processed by the pipeline is invalid (e.g. invalid
+        // compressed content, non-matching the CID, ...). If that occurs, we can
+        // destroy the passthrough (this allows not to wait for the "flush" event
+        // to propagate the error).
+        passthrough.destroy(error);
+        return error;
+    });
+    // We don't care about the un-compressed data, we only use the verifier to
+    // detect any error through the pipelinePromise. We still need to pass the
+    // verifier into flowing mode to ensure that the pipelinePromise resolves.
+    verifier.resume();
+    const passthrough = new node_stream_1.Transform({
+        transform(chunk, encoding, callback) {
+            pipelineInput.write(chunk, encoding);
+            callback(null, chunk);
+        },
+        flush(callback) {
+            // End the input stream, which will resolve the pipeline promise
+            pipelineInput.end();
+            // End the pass-through stream according to the result of the pipeline
+            pipelinePromise.then(callback);
+        },
+        destroy(err, callback) {
+            pipelineController.abort(); // Causes pipeline() to destroy all streams
+            callback(err);
+        },
     });
+    return passthrough;
 }
-function getRateLimitBypassHeaders(ctx, pds) {
-    const { blobRateLimitBypassKey: bypassKey, blobRateLimitBypassHostname: bypassHostname, } = ctx.cfg;
-    if (!bypassKey || !bypassHostname) {
-        return {};
-    }
-    const url = new URL(pds);
-    if (bypassHostname.startsWith('.')) {
-        if (url.hostname.endsWith(bypassHostname)) {
-            return { 'x-ratelimit-bypass': bypassKey };
-        }
-    }
-    else {
-        if (url.hostname === bypassHostname) {
-            return { 'x-ratelimit-bypass': bypassKey };
-        }
-    }
-    return {};
+function asError(err) {
+    return err instanceof Error
+        ? err
+        : new Error('Processing failed', { cause: err });
 }
 //# sourceMappingURL=blob-resolver.js.map

package/dist/api/blob-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"blob-resolver.js","sourceRoot":"","sources":["../../src/api/blob-resolver.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkFA,kCAuCC;AAzHD,mCAA2C;AAC3C,sDAA6B;AAC7B,8DAAqC;AACrC,+CAAyC;AACzC,0CAAsC;AACtC,4CAAgD;AAChD,4CAAyE;AACzE,gDAAoD;AAEpD,sCAA6C;AAC7C,yCAAyC;AACzC,8CAKsB;AAEtB,+CAA+C;AAExC,MAAM,YAAY,GAAG,CAAC,GAAe,EAAkB,EAAE;IAC9D,MAAM,MAAM,GAAG,iBAAO,CAAC,MAAM,EAAE,CAAA;IAE/B,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,WAAW,GAAG,EAAE,GAAG,EAAE,IAAI;QAC1D,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAA;YACvC,IAAI,CAAC;gBACH,IAAA,uBAAc,EAAC,GAAG,CAAC,CAAA;YACrB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC,IAAA,qBAAW,EAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAA;YAC9C,CAAC;YACD,IAAI,GAAQ,CAAA;YACZ,IAAI,CAAC;gBACH,GAAG,GAAG,SAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;YACzB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC,IAAA,qBAAW,EAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAA;YAC9C,CAAC;YAED,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YAEtD,yDAAyD;YACzD,4DAA4D;YAC5D,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;YACpB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,aAAa,CAAC,WAAW,CAAC,CAAA;YACxD,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAA;YAClD,GAAG,CAAC,SAAS,CAAC,yBAAyB,EAAE,6BAA6B,CAAC,CAAA;YACvE,IAAA,iBAAQ,EAAC,aAAa,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE;gBAC1C,IAAI,GAAG,EAAE,CAAC;oBACR,mBAAG,CAAC,IAAI,CACN,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,CAAC,GAAG,EAAE,EACjD,4CAA4C,CAC7C,CAAA;gBACH,CAAC;YACH,CAAC,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,kBAAU,EAAE,CAAC;gBAC9B,IAAI,GAAG,CAAC,IAAI,KAAK,kBAAU,CAAC,SAAS,EAAE,CAAC;oBACtC,mBAAG,CAAC,IAAI,CACN,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,EACpD,yBAAyB,CAC1B,CAAA;oBACD,OAAO,IAAI,CAAC,IAAA,qBAAW,EAAC,GAAG,CAAC,CAAC,CAAA,CAAC,kBAAkB;gBAClD,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;oBAChD,mBAAG,CAAC,IAAI,CACN,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,EACpD,iCAAiC,CAClC,CAAA;oBACD,OAAO,IAAI,CAAC,IAAA,qBAAW,EAAC,GAAG,CAAC,CAAC,CAAA;gBAC/B,CAAC;gBACD,OAAO,IAAI,CAAC,IAAA,qBAAW,EAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,CAAA;YACjD,CAAC;YACD,IAAI,GAAG,YAAY,2BAAgB,EAAE,CAAC;gBACpC,OAAO,IAAI,CAAC,IAAA,qBAAW,EAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,CAAA;YACjD,CAAC;YACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAA;QAClB,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AA5DY,QAAA,YAAY,gBA4DxB;AAEM,KAAK,UAAU,WAAW,CAAC,GAAe,EAAE,GAAW,EAAE,GAAQ;IACtE,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAA;IAE7B,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAClD,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACpD,IAAI,IAAA,6BAAgB,EAAC,GAAG,EAAE,iBAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzC,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC,CAAC;QACF,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;KAC5D,CAAC,CAAA;IACF,MAAM,QAAQ,GAAG,QAAQ,IAAI,IAAA,mCAAsB,EAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACtE,MAAM,GAAG,GACP,QAAQ;QACR,IAAA,+BAAkB,EAAC,QAAQ,EAAE;YAC3B,EAAE,EAAE,aAAa;YACjB,IAAI,EAAE,2BAA2B;SAClC,CAAC,CAAA;IACJ,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAA,qBAAW,EAAC,GAAG,EAAE,kBAAkB,CAAC,CAAA;IAC5C,CAAC;IACD,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAA,qBAAW,EAAC,GAAG,EAAE,gBAAgB,CAAC,CAAA;IAC1C,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,IAAA,iBAAS,EAAC,GAAG,EAAE,CACtC,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CACxC,CAAA;IACD,MAAM,WAAW,GAAa,UAAU,CAAC,IAAI,CAAA;IAC7C,MAAM,SAAS,GAAG,IAAI,2BAAkB,CAAC,GAAG,CAAC,CAAA;IAE7C,IAAA,4BAAmB,EAAC,WAAW,EAAE,SAAS,CAAC,CAAA;IAC3C,OAAO;QACL,GAAG;QACH,WAAW,EACT,UAAU,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,0BAA0B;QAClE,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC;KACpC,CAAA;AACH,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,GAAe,EACf,IAA+C;IAE/C,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;IAC9B,OAAO,eAAK,CAAC,GAAG,CAAC,GAAG,GAAG,gCAAgC,EAAE;QACvD,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE;QACpB,UAAU,EAAE,IAAI;QAChB,YAAY,EAAE,QAAQ;QACtB,OAAO,EAAE,IAAI,EAAE,uCAAuC;QACtD,OAAO,EAAE,yBAAyB,CAAC,GAAG,EAAE,GAAG,CAAC;KAC7C,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,GAAe,EACf,GAAW;IAEX,MAAM,EACJ,sBAAsB,EAAE,SAAS,EACjC,2BAA2B,EAAE,cAAc,GAC5C,GAAG,GAAG,CAAC,GAAG,CAAA;IACX,IAAI,CAAC,SAAS,IAAI,CAAC,cAAc,EAAE,CAAC;QAClC,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IACxB,IAAI,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YAC1C,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,CAAA;QAC5C,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;YACpC,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,CAAA;QAC5C,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC"}
+{"version":3,"file":"blob-resolver.js","sourceRoot":"","sources":["../../src/api/blob-resolver.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,4CAoHC;AAkBD,gCAmEC;AAxOD,yDAKiC;AACjC,4CAIwB;AACxB,sCAAuD;AACvD,2DAAsD;AAEtD,6CAAyD;AACzD,mDAA+C;AAK/C,8CAMsB;AACtB,4CAA4C;AAC5C,sCAA6C;AAC7C,uCAA+E;AAE/E,SAAgB,gBAAgB,CAAC,GAAe;IAC9C,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC9B,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO,IAAI,EAAE,CAAA;QAChE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,EAAE,CAAA;QACjD,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC/D,IAAI,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,EAAE,CAAA;QAEzD,oEAAoE;QACpE,6BAA6B;QAE7B,IAAI,CAAC;YACH,MAAM,aAAa,GAAsB;gBACvC,GAAG,EAAE,QAAQ;gBACb,GAAG,EAAE,QAAQ;gBACb,MAAM,EAAE,IAAA,qBAAc,EAAC,GAAG,CAAC;gBAC3B,mEAAmE;gBACnE,wEAAwE;gBACxE,0EAA0E;gBAC1E,cAAc,EAAE,IAAA,wCAA2B,EACzC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAC9B,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAC9B;aACF,CAAA;YAED,MAAM,UAAU,CAAC,GAAG,EAAE,aAAa,EAAE,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE;gBACnE,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAA;gBACrD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;gBAEjD,MAAM,QAAQ,GAAG,CAAC,GAAY,EAAE,EAAE;oBAChC,mBAAG,CAAC,IAAI,CACN,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,EAClD,4CAA4C,CAC7C,CAAA;gBACH,CAAC,CAAA;gBAED,MAAM,OAAO,GAAG,CAAC,GAAY,EAAE,EAAE;oBAC/B,kEAAkE;oBAClE,kEAAkE;oBAClE,oEAAoE;oBACpE,oEAAoE;oBACpE,YAAY,CAAC,UAAU,CAAC,CAAA;oBACxB,QAAQ,CAAC,GAAG,CAAC,CAAA;gBACf,CAAC,CAAA;gBAED,oEAAoE;gBACpE,mEAAmE;gBACnE,uBAAuB;gBACvB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;gBAE7B,sEAAsE;gBACtE,wEAAwE;gBACxE,uEAAuE;gBACvE,uEAAuE;gBACvE,qEAAqE;gBACrE,wEAAwE;gBACxE,sEAAsE;gBACtE,uEAAuE;gBACvE,qEAAqE;gBACrE,+CAA+C;gBAC/C,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE;oBACjC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;oBAE9B,oEAAoE;oBACpE,yDAAyD;oBACzD,GAAG,CAAC,SAAS,CACX,yBAAyB,EACzB,6BAA6B,CAC9B,CAAA;oBACD,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAA;oBAClD,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAA;oBACxC,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAA;oBAEtC,qCAAqC;oBACrC,6DAA6D;oBAE7D,IAAA,2BAAoB,EAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;oBAEnC,qEAAqE;oBACrE,mEAAmE;oBACnE,sEAAsE;oBACtE,qEAAqE;oBACrE,iEAAiE;oBACjE,oDAAoD;oBACpD,GAAG,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAA;oBAElC,oEAAoE;oBACpE,0DAA0D;oBAC1D,oEAAoE;oBACpE,qEAAqE;oBACrE,qEAAqE;oBACrE,gEAAgE;oBAChE,qEAAqE;oBACrE,QAAQ;oBACR,GAAG,CAAC,YAAY,EAAE,CAAA;oBAElB,kDAAkD;oBAClD,KAAK,IAAA,mBAAQ,EAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;gBAChD,CAAC,EAAE,EAAE,CAAC,CAAA,CAAC,8DAA8D;gBAErE,iDAAiD;gBACjD,OAAO,QAAQ,CAAA;YACjB,CAAC,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;gBACrC,GAAG,CAAC,OAAO,EAAE,CAAA;YACf,CAAC;iBAAM,IAAI,GAAG,YAAY,uBAAc,EAAE,CAAC;gBACzC,sEAAsE;gBACtE,wCAAwC;gBACxC,IAAI,CAAC,IAAA,qBAAW,EAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAA;YACrC,CAAC;iBAAM,IAAI,IAAA,yBAAW,EAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B,IAAI,CAAC,GAAG,CAAC,CAAA;YACX,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAA,qBAAW,EAAC,GAAG,EAAE,gBAAgB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;YAC1D,CAAC;QACH,CAAC;IACH,CAAC,CAAA;AACH,CAAC;AAkBM,KAAK,UAAU,UAAU,CAC9B,GAAe,EACf,OAA0B,EAC1B,OAA0B;IAE1B,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;IAC7C,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IAErD,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAE5C,OAAO,CAAC,GAAG,CACT,iBAAiB,EACjB,OAAO,CAAC,cAAc;QACpB,IAAA,+BAAkB,EAChB,GAAG,CAAC,GAAG,CAAC,qBAAqB;YAC3B,CAAC,CAAC,uCAA0B;YAC5B,CAAC,CAAC,yCAA4B,CACjC,CACJ,CAAA;IAED,IAAI,eAAe,GAAG,KAAK,CAAA;IAE3B,OAAO,GAAG,CAAC,cAAc;SACtB,MAAM,CACL;QACE,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,IAAI,EAAE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM;QAC/B,OAAO;QACP,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,EACD,CAAC,QAAQ,EAAE,EAAE;QACX,eAAe,GAAG,IAAI,CAAA;QAEtB,IAAI,QAAQ,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;YAChC,mBAAG,CAAC,IAAI,CACN;gBACE,GAAG;gBACH,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE;gBACnB,GAAG,EAAE,GAAG,CAAC,MAAM;gBACf,MAAM,EAAE,QAAQ,CAAC,UAAU;aAC5B,EACD,iCAAiC,CAClC,CAAA;YAED,MAAM,QAAQ,CAAC,UAAU,IAAI,GAAG,IAAI,QAAQ,CAAC,UAAU,GAAG,GAAG;gBAC3D,CAAC,CAAC,IAAA,qBAAW,EAAC,GAAG,EAAE,gBAAgB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,aAAa;gBACvE,CAAC,CAAC,IAAA,qBAAW,EAAC,GAAG,EAAE,gBAAgB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA,CAAC,sBAAsB;QACpF,CAAC;QAED,OAAO,OAAO,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAA;IAC7C,CAAC,CACF;SACA,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACb,kDAAkD;QAClD,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,oDAAoD;YACpD,mBAAG,CAAC,IAAI,CACN,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,EAClD,0CAA0C,CAC3C,CAAA;YAED,MAAM,IAAA,qBAAW,EAAC,GAAG,EAAE,gBAAgB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QAC1D,CAAC;QAED,MAAM,GAAG,CAAA;IACX,CAAC,CAAC,CAAA;AACN,CAAC;AAED,SAAS,eAAe,CAAC,MAAoC;IAC3D,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAA;IAC3B,IAAI,CAAC,IAAA,kBAAY,EAAC,GAAG,CAAC;QAAE,MAAM,IAAA,qBAAW,EAAC,GAAG,EAAE,aAAa,CAAC,CAAA;IAC7D,MAAM,MAAM,GAAG,IAAA,eAAQ,EAAC,GAAG,CAAC,CAAA;IAC5B,IAAI,CAAC,MAAM;QAAE,MAAM,IAAA,qBAAW,EAAC,GAAG,EAAE,aAAa,CAAC,CAAA;IAClD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;AAC7B,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,SAA0B,EAC1B,GAAW,EACX,GAAQ;IAER,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IAEjD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,gCAAgC,EAAE,GAAG,CAAC,CAAA;IAC1D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IAChC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAA;IAE3C,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,SAA0B,EAC1B,GAAW,EACX,GAAQ;IAER,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAClD,SAAS,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAChD,IAAI,IAAA,6BAAgB,EAAC,GAAG,EAAE,iBAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzC,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC,CAAC;QACF,SAAS,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;KACxD,CAAC,CAAA;IAEF,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAA,qBAAW,EAAC,GAAG,EAAE,gBAAgB,CAAC,CAAA;IAC1C,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,IAAI,IAAA,mCAAsB,EAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACtE,MAAM,GAAG,GACP,QAAQ;QACR,IAAA,+BAAkB,EAAC,QAAQ,EAAE;YAC3B,EAAE,EAAE,aAAa;YACjB,IAAI,EAAE,2BAA2B;SAClC,CAAC,CAAA;IAEJ,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAA,qBAAW,EAAC,GAAG,EAAE,kBAAkB,CAAC,CAAA;IAC5C,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,cAAc,CACrB,EACE,sBAAsB,EAAE,SAAS,EACjC,2BAA2B,EAAE,cAAc,GAC9B,EACf,GAAQ;IAER,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAA;IAEzC,IAAI,SAAS,IAAI,cAAc,EAAE,CAAC;QAChC,MAAM,UAAU,GAAG,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC;YAC/C,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC;YACvC,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,cAAc,CAAA;QAEnC,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,SAAS,CAAC,CAAA;QAC9C,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,iBAAiB,CAAC,GAAQ,EAAE,QAA4B;IAC/D,oEAAoE;IACpE,uEAAuE;IACvE,2EAA2E;IAC3E,4EAA4E;IAC5E,8BAA8B;IAC9B,EAAE;IACF,8EAA8E;IAC9E,mBAAmB;IACnB,EAAE;IACF,6EAA6E;IAC7E,6EAA6E;IAC7E,wEAAwE;IACxE,SAAS;IAET,MAAM,QAAQ,GAAG,IAAA,uBAAc,EAAC,QAAQ,CAAC,CAAA;IACzC,MAAM,QAAQ,GAAG,IAAI,2BAAkB,CAAC,GAAG,CAAC,CAAA;IAE5C,6EAA6E;IAC7E,yDAAyD;IACzD,IAAI,CAAC,QAAQ,CAAC,MAAM;QAAE,OAAO,QAAQ,CAAA;IAErC,MAAM,kBAAkB,GAAG,IAAI,eAAe,EAAE,CAAA;IAChD,MAAM,eAAe,GAAa,CAAC,GAAG,QAAQ,EAAE,QAAQ,CAAC,CAAA;IACzD,MAAM,aAAa,GAAG,eAAe,CAAC,CAAC,CAAE,CAAA;IAEzC,uEAAuE;IACvE,wBAAwB;IACxB,MAAM,eAAe,GAA0B,IAAA,mBAAQ,EAAC,eAAe,EAAE;QACvE,MAAM,EAAE,kBAAkB,CAAC,MAAM;KAClC,CAAC,CAAC,IAAI,CACL,GAAG,EAAE,CAAC,IAAI,EACV,CAAC,GAAG,EAAE,EAAE;QACN,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;QAE1B,oEAAoE;QACpE,yEAAyE;QACzE,yEAAyE;QACzE,2BAA2B;QAC3B,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAE1B,OAAO,KAAK,CAAA;IACd,CAAC,CACF,CAAA;IAED,0EAA0E;IAC1E,0EAA0E;IAC1E,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,EAAE,CAAA;IAEjB,MAAM,WAAW,GAAG,IAAI,uBAAS,CAAC;QAChC,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ;YACjC,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;YACpC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QACvB,CAAC;QACD,KAAK,CAAC,QAAQ;YACZ,gEAAgE;YAChE,aAAa,CAAC,GAAG,EAAE,CAAA;YACnB,sEAAsE;YACtE,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAChC,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,QAAQ;YACnB,kBAAkB,CAAC,KAAK,EAAE,CAAA,CAAC,2CAA2C;YACtE,QAAQ,CAAC,GAAG,CAAC,CAAA;QACf,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,WAAW,CAAA;AACpB,CAAC;AAED,SAAS,OAAO,CAAC,GAAY;IAC3B,OAAO,GAAG,YAAY,KAAK;QACzB,CAAC,CAAC,GAAG;QACL,CAAC,CAAC,IAAI,KAAK,CAAC,mBAAmB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;AACpD,CAAC"}

package/dist/api/well-known.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"well-known.d.ts","sourceRoot":"","sources":["../../src/api/well-known.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAA;AAC7B,OAAO,UAAU,MAAM,YAAY,CAAA;AAEnC,eAAO,MAAM,YAAY,QAAS,UAAU,KAAG,OAAO,CAAC,MA8BtD,CAAA"}
+{"version":3,"file":"well-known.d.ts","sourceRoot":"","sources":["../../src/api/well-known.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAA;AAC7B,OAAO,UAAU,MAAM,YAAY,CAAA;AAEnC,eAAO,MAAM,YAAY,QAAS,UAAU,KAAG,OAAO,CAAC,MAqCtD,CAAA"}

package/dist/api/well-known.js

@@ -7,31 +7,37 @@ exports.createRouter = void 0;
 const express_1 = __importDefault(require("express"));
 const createRouter = (ctx) => {
     const router = express_1.default.Router();
-    router.get('/.well-known/did.json', (_req, res) => {
-        const hostname = ctx.cfg.publicUrl && new URL(ctx.cfg.publicUrl).hostname;
-        if (!hostname || ctx.cfg.serverDid !== `did:web:${hostname}`) {
-            return res.sendStatus(404);
-        }
-        res.json({
-            '@context': ['https://www.w3.org/ns/did/v1'],
-            id: ctx.cfg.serverDid,
-            verificationMethod: [
-                {
-                    id: `${ctx.cfg.serverDid}#atproto`,
-                    type: 'Multikey',
-                    controller: ctx.cfg.serverDid,
-                    publicKeyMultibase: ctx.signingKey.did().replace('did:key:', ''),
-                },
-            ],
-            service: [
-                {
-                    id: '#bsky_notif',
-                    type: 'BskyNotificationService',
-                    serviceEndpoint: `https://${hostname}`,
-                },
-            ],
+    const did = ctx.cfg.serverDid;
+    if (did.startsWith('did:web:')) {
+        const hostname = did.slice('did:web:'.length);
+        const serviceEndpoint = `https://${hostname}`;
+        router.get('/.well-known/did.json', (_req, res) => {
+            res.json({
+                '@context': ['https://www.w3.org/ns/did/v1'],
+                id: did,
+                verificationMethod: [
+                    {
+                        id: `${did}#atproto`,
+                        type: 'Multikey',
+                        controller: did,
+                        publicKeyMultibase: ctx.signingKey.did().replace('did:key:', ''),
+                    },
+                ],
+                service: [
+                    {
+                        id: '#bsky_notif',
+                        type: 'BskyNotificationService',
+                        serviceEndpoint,
+                    },
+                    {
+                        id: '#bsky_appview',
+                        type: 'BskyAppView',
+                        serviceEndpoint,
+                    },
+                ],
+            });
         });
-    });
+    }
     return router;
 };
 exports.createRouter = createRouter;

package/dist/api/well-known.js.map

@@ -1 +1 @@
-{"version":3,"file":"well-known.js","sourceRoot":"","sources":["../../src/api/well-known.ts"],"names":[],"mappings":";;;;;;AAAA,sDAA6B;AAGtB,MAAM,YAAY,GAAG,CAAC,GAAe,EAAkB,EAAE;IAC9D,MAAM,MAAM,GAAG,iBAAO,CAAC,MAAM,EAAE,CAAA;IAE/B,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAChD,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAA;QACzE,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC,GAAG,CAAC,SAAS,KAAK,WAAW,QAAQ,EAAE,EAAE,CAAC;YAC7D,OAAO,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;QAC5B,CAAC;QACD,GAAG,CAAC,IAAI,CAAC;YACP,UAAU,EAAE,CAAC,8BAA8B,CAAC;YAC5C,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS;YACrB,kBAAkB,EAAE;gBAClB;oBACE,EAAE,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,SAAS,UAAU;oBAClC,IAAI,EAAE,UAAU;oBAChB,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS;oBAC7B,kBAAkB,EAAE,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;iBACjE;aACF;YACD,OAAO,EAAE;gBACP;oBACE,EAAE,EAAE,aAAa;oBACjB,IAAI,EAAE,yBAAyB;oBAC/B,eAAe,EAAE,WAAW,QAAQ,EAAE;iBACvC;aACF;SACF,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AA9BY,QAAA,YAAY,gBA8BxB"}
+{"version":3,"file":"well-known.js","sourceRoot":"","sources":["../../src/api/well-known.ts"],"names":[],"mappings":";;;;;;AAAA,sDAA6B;AAGtB,MAAM,YAAY,GAAG,CAAC,GAAe,EAAkB,EAAE;IAC9D,MAAM,MAAM,GAAG,iBAAO,CAAC,MAAM,EAAE,CAAA;IAE/B,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,SAAS,CAAA;IAC7B,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QAC7C,MAAM,eAAe,GAAG,WAAW,QAAQ,EAAE,CAAA;QAE7C,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YAChD,GAAG,CAAC,IAAI,CAAC;gBACP,UAAU,EAAE,CAAC,8BAA8B,CAAC;gBAC5C,EAAE,EAAE,GAAG;gBACP,kBAAkB,EAAE;oBAClB;wBACE,EAAE,EAAE,GAAG,GAAG,UAAU;wBACpB,IAAI,EAAE,UAAU;wBAChB,UAAU,EAAE,GAAG;wBACf,kBAAkB,EAAE,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;qBACjE;iBACF;gBACD,OAAO,EAAE;oBACP;wBACE,EAAE,EAAE,aAAa;wBACjB,IAAI,EAAE,yBAAyB;wBAC/B,eAAe;qBAChB;oBACD;wBACE,EAAE,EAAE,eAAe;wBACnB,IAAI,EAAE,aAAa;wBACnB,eAAe;qBAChB;iBACF;aACF,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AArCY,QAAA,YAAY,gBAqCxB"}