@atproto/bsky 0.0.230 → 0.0.232

package/dist/api/app/bsky/unspecced/initAgeAssurance.js

@@ -1,37 +1,31 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.default = default_1;
-const node_crypto_1 = __importDefault(require("node:crypto"));
-const address_1 = require("@hapi/address");
-const disposable_email_domains_js_1 = require("disposable-email-domains-js");
-const xrpc_server_1 = require("@atproto/xrpc-server");
-const kws_1 = require("../../../../kws");
-const index_js_1 = require("../../../../lexicons/index.js");
-const logger_1 = require("../../../../logger");
-const util_1 = require("../../../kws/util");
-function default_1(server, ctx) {
-    server.add(index_js_1.app.bsky.unspecced.initAgeAssurance, {
+import crypto from 'node:crypto';
+import { isEmailValid } from '@hapi/address';
+import { isDisposableEmail } from 'disposable-email-domains-js';
+import { InvalidRequestError, MethodNotImplementedError, } from '@atproto/xrpc-server';
+import { KwsExternalPayloadError } from '../../../../kws.js';
+import { app } from '../../../../lexicons/index.js';
+import { httpLogger as log } from '../../../../logger.js';
+import { createStashEvent, getClientUa } from '../../../kws/util.js';
+export default function (server, ctx) {
+    server.add(app.bsky.unspecced.initAgeAssurance, {
         auth: ctx.authVerifier.standard,
         handler: async ({ auth, input, req }) => {
             if (!ctx.kwsClient) {
-                throw new xrpc_server_1.MethodNotImplementedError('This service is not configured to support age assurance.');
+                throw new MethodNotImplementedError('This service is not configured to support age assurance.');
             }
             const actorDid = auth.credentials.iss;
             const actorInfo = await getAgeVerificationState(ctx, actorDid);
             if (actorInfo?.ageAssuranceStatus) {
                 if (actorInfo.ageAssuranceStatus.status !== 'unknown' &&
                     actorInfo.ageAssuranceStatus.status !== 'pending') {
-                    throw new xrpc_server_1.InvalidRequestError(`Cannot initiate age assurance flow from current state: ${actorInfo.ageAssuranceStatus.status}`, 'InvalidInitiation');
+                    throw new InvalidRequestError(`Cannot initiate age assurance flow from current state: ${actorInfo.ageAssuranceStatus.status}`, 'InvalidInitiation');
                 }
             }
             const { countryCode, email, language } = validateInput(input.body);
-            const attemptId = node_crypto_1.default.randomUUID();
+            const attemptId = crypto.randomUUID();
             // Assumes `app.set('trust proxy', ...)` configured with `true` or specific values.
             const initIp = req.ip;
-            const initUa = (0, util_1.getClientUa)(req);
+            const initUa = getClientUa(req);
             const externalPayload = { actorDid, attemptId };
             try {
                 await ctx.kwsClient.sendEmail({
@@ -42,13 +36,13 @@ function default_1(server, ctx) {
                 });
             }
             catch (err) {
-                if (err instanceof kws_1.KwsExternalPayloadError) {
-                    logger_1.httpLogger.error({ externalPayload }, 'Age Assurance flow failed because external payload got too long, which is caused by the DID being too long');
-                    throw new xrpc_server_1.InvalidRequestError('Age Assurance flow failed because DID is too long', 'DidTooLong');
+                if (err instanceof KwsExternalPayloadError) {
+                    log.error({ externalPayload }, 'Age Assurance flow failed because external payload got too long, which is caused by the DID being too long');
+                    throw new InvalidRequestError('Age Assurance flow failed because DID is too long', 'DidTooLong');
                 }
                 throw err;
             }
-            const event = await (0, util_1.createStashEvent)(ctx, {
+            const event = await createStashEvent(ctx, {
                 actorDid,
                 attemptId,
                 email,
@@ -91,8 +85,8 @@ const kwsAvSupportedLanguages = [
 ];
 const validateInput = (input) => {
     const { countryCode, email, language } = input;
-    if (!(0, address_1.isEmailValid)(email) || (0, disposable_email_domains_js_1.isDisposableEmail)(email)) {
-        throw new xrpc_server_1.InvalidRequestError('This email address is not supported, please use a different email.', 'InvalidEmail');
+    if (!isEmailValid(email) || isDisposableEmail(email)) {
+        throw new InvalidRequestError('This email address is not supported, please use a different email.', 'InvalidEmail');
     }
     return {
         countryCode,

package/dist/api/app/bsky/unspecced/initAgeAssurance.js.map

@@ -1 +1 @@
-{"version":3,"file":"initAgeAssurance.js","sourceRoot":"","sources":["../../../../../src/api/app/bsky/unspecced/initAgeAssurance.ts"],"names":[],"mappings":";;;;;AAkBA,4BAyEC;AA3FD,8DAAgC;AAChC,2CAA4C;AAC5C,6EAA+D;AAC/D,sDAI6B;AAE7B,yCAAyD;AACzD,4DAAmD;AACnD,+CAAsD;AAGtD,4CAAiE;AAIjE,mBAAyB,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,cAAG,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE;QAC9C,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,QAAQ;QAC/B,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE;YACtC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;gBACnB,MAAM,IAAI,uCAAyB,CACjC,0DAA0D,CAC3D,CAAA;YACH,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAA;YAErC,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;YAE9D,IAAI,SAAS,EAAE,kBAAkB,EAAE,CAAC;gBAClC,IACE,SAAS,CAAC,kBAAkB,CAAC,MAAM,KAAK,SAAS;oBACjD,SAAS,CAAC,kBAAkB,CAAC,MAAM,KAAK,SAAS,EACjD,CAAC;oBACD,MAAM,IAAI,iCAAmB,CAC3B,0DAA0D,SAAS,CAAC,kBAAkB,CAAC,MAAM,EAAE,EAC/F,mBAAmB,CACpB,CAAA;gBACH,CAAC;YACH,CAAC;YAED,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YAElE,MAAM,SAAS,GAAG,qBAAM,CAAC,UAAU,EAAE,CAAA;YACrC,mFAAmF;YACnF,MAAM,MAAM,GAAG,GAAG,CAAC,EAAE,CAAA;YACrB,MAAM,MAAM,GAAG,IAAA,kBAAW,EAAC,GAAG,CAAC,CAAA;YAC/B,MAAM,eAAe,GAAuB,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAA;YAEnE,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC;oBAC5B,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE;oBACtC,KAAK;oBACL,eAAe;oBACf,QAAQ;iBACT,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,6BAAuB,EAAE,CAAC;oBAC3C,mBAAG,CAAC,KAAK,CACP,EAAE,eAAe,EAAE,EACnB,4GAA4G,CAC7G,CAAA;oBACD,MAAM,IAAI,iCAAmB,CAC3B,mDAAmD,EACnD,YAAY,CACb,CAAA;gBACH,CAAC;gBACD,MAAM,GAAG,CAAA;YACX,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,IAAA,uBAAgB,EAAC,GAAG,EAAE;gBACxC,QAAQ;gBACR,SAAS;gBACT,KAAK;gBACL,MAAM;gBACN,MAAM;gBACN,MAAM,EAAE,SAAS;aAClB,CAAC,CAAA;YAEF,OAAO;gBACL,QAAQ,EAAE,kBAAkB;gBAC5B,IAAI,EAAE;oBACJ,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,eAAe,EAAE,KAAK,CAAC,SAAS;iBACjC;aACF,CAAA;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,kDAAkD;AAClD,yDAAyD;AACzD,MAAM,uBAAuB,GAAG;IAC9B,IAAI;IACJ,IAAI;IACJ,SAAS;IACT,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,OAAO;IACP,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;CACL,CAAA;AAED,MAAM,aAAa,GAAG,CAAC,KAAkB,EAAe,EAAE;IACxD,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAA;IAE9C,IAAI,CAAC,IAAA,sBAAY,EAAC,KAAK,CAAC,IAAI,IAAA,+CAAiB,EAAC,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,iCAAmB,CAC3B,oEAAoE,EACpE,cAAc,CACf,CAAA;IACH,CAAC;IAED,OAAO;QACL,WAAW;QACX,KAAK;QACL,QAAQ,EAAE,uBAAuB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;KACvE,CAAA;AACH,CAAC,CAAA;AAED,MAAM,uBAAuB,GAAG,KAAK,EACnC,GAAe,EACf,QAAgB,EACgB,EAAE;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC;YACxC,IAAI,EAAE,CAAC,QAAQ,CAAC;YAChB,yBAAyB,EAAE,CAAC,QAAQ,CAAC;YACrC,gBAAgB,EAAE,CAAC,QAAQ,CAAC;SAC7B,CAAC,CAAA;QAEF,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC,CAAA","sourcesContent":["import crypto from 'node:crypto'\nimport { isEmailValid } from '@hapi/address'\nimport { isDisposableEmail } from 'disposable-email-domains-js'\nimport {\n  InvalidRequestError,\n  MethodNotImplementedError,\n  Server,\n} from '@atproto/xrpc-server'\nimport { AppContext } from '../../../../context'\nimport { KwsExternalPayloadError } from '../../../../kws'\nimport { app } from '../../../../lexicons/index.js'\nimport { httpLogger as log } from '../../../../logger'\nimport { ActorInfo } from '../../../../proto/bsky_pb'\nimport { KwsExternalPayload } from '../../../kws/types'\nimport { createStashEvent, getClientUa } from '../../../kws/util'\n\ntype InputSchema = app.bsky.unspecced.initAgeAssurance.$InputBody\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(app.bsky.unspecced.initAgeAssurance, {\n    auth: ctx.authVerifier.standard,\n    handler: async ({ auth, input, req }) => {\n      if (!ctx.kwsClient) {\n        throw new MethodNotImplementedError(\n          'This service is not configured to support age assurance.',\n        )\n      }\n\n      const actorDid = auth.credentials.iss\n\n      const actorInfo = await getAgeVerificationState(ctx, actorDid)\n\n      if (actorInfo?.ageAssuranceStatus) {\n        if (\n          actorInfo.ageAssuranceStatus.status !== 'unknown' &&\n          actorInfo.ageAssuranceStatus.status !== 'pending'\n        ) {\n          throw new InvalidRequestError(\n            `Cannot initiate age assurance flow from current state: ${actorInfo.ageAssuranceStatus.status}`,\n            'InvalidInitiation',\n          )\n        }\n      }\n\n      const { countryCode, email, language } = validateInput(input.body)\n\n      const attemptId = crypto.randomUUID()\n      // Assumes `app.set('trust proxy', ...)` configured with `true` or specific values.\n      const initIp = req.ip\n      const initUa = getClientUa(req)\n      const externalPayload: KwsExternalPayload = { actorDid, attemptId }\n\n      try {\n        await ctx.kwsClient.sendEmail({\n          countryCode: countryCode.toUpperCase(),\n          email,\n          externalPayload,\n          language,\n        })\n      } catch (err) {\n        if (err instanceof KwsExternalPayloadError) {\n          log.error(\n            { externalPayload },\n            'Age Assurance flow failed because external payload got too long, which is caused by the DID being too long',\n          )\n          throw new InvalidRequestError(\n            'Age Assurance flow failed because DID is too long',\n            'DidTooLong',\n          )\n        }\n        throw err\n      }\n\n      const event = await createStashEvent(ctx, {\n        actorDid,\n        attemptId,\n        email,\n        initIp,\n        initUa,\n        status: 'pending',\n      })\n\n      return {\n        encoding: 'application/json',\n        body: {\n          status: event.status,\n          lastInitiatedAt: event.createdAt,\n        },\n      }\n    },\n  })\n}\n\n// Supported languages for KWS Adult Verification.\n// This list comes from KWS's AV Developer Guide PDF doc.\nconst kwsAvSupportedLanguages = [\n  'en',\n  'ar',\n  'zh-Hans',\n  'nl',\n  'tl',\n  'fr',\n  'de',\n  'id',\n  'it',\n  'ja',\n  'ko',\n  'pl',\n  'pt-BR',\n  'pt',\n  'ru',\n  'es',\n  'th',\n  'tr',\n  'vi',\n]\n\nconst validateInput = (input: InputSchema): InputSchema => {\n  const { countryCode, email, language } = input\n\n  if (!isEmailValid(email) || isDisposableEmail(email)) {\n    throw new InvalidRequestError(\n      'This email address is not supported, please use a different email.',\n      'InvalidEmail',\n    )\n  }\n\n  return {\n    countryCode,\n    email,\n    language: kwsAvSupportedLanguages.includes(language) ? language : 'en',\n  }\n}\n\nconst getAgeVerificationState = async (\n  ctx: AppContext,\n  actorDid: string,\n): Promise<ActorInfo | undefined> => {\n  try {\n    const res = await ctx.dataplane.getActors({\n      dids: [actorDid],\n      returnAgeAssuranceForDids: [actorDid],\n      skipCacheForDids: [actorDid],\n    })\n\n    return res.actors[0]\n  } catch (err) {\n    return undefined\n  }\n}\n"]}
+{"version":3,"file":"initAgeAssurance.js","sourceRoot":"","sources":["../../../../../src/api/app/bsky/unspecced/initAgeAssurance.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAA;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AAC/D,OAAO,EACL,mBAAmB,EACnB,yBAAyB,GAE1B,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAA;AAC5D,OAAO,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAA;AACnD,OAAO,EAAE,UAAU,IAAI,GAAG,EAAE,MAAM,uBAAuB,CAAA;AAGzD,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAIpE,MAAM,CAAC,OAAO,WAAW,MAAc,EAAE,GAAe;IACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE;QAC9C,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,QAAQ;QAC/B,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE;YACtC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;gBACnB,MAAM,IAAI,yBAAyB,CACjC,0DAA0D,CAC3D,CAAA;YACH,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAA;YAErC,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;YAE9D,IAAI,SAAS,EAAE,kBAAkB,EAAE,CAAC;gBAClC,IACE,SAAS,CAAC,kBAAkB,CAAC,MAAM,KAAK,SAAS;oBACjD,SAAS,CAAC,kBAAkB,CAAC,MAAM,KAAK,SAAS,EACjD,CAAC;oBACD,MAAM,IAAI,mBAAmB,CAC3B,0DAA0D,SAAS,CAAC,kBAAkB,CAAC,MAAM,EAAE,EAC/F,mBAAmB,CACpB,CAAA;gBACH,CAAC;YACH,CAAC;YAED,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YAElE,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;YACrC,mFAAmF;YACnF,MAAM,MAAM,GAAG,GAAG,CAAC,EAAE,CAAA;YACrB,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;YAC/B,MAAM,eAAe,GAAuB,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAA;YAEnE,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC;oBAC5B,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE;oBACtC,KAAK;oBACL,eAAe;oBACf,QAAQ;iBACT,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;oBAC3C,GAAG,CAAC,KAAK,CACP,EAAE,eAAe,EAAE,EACnB,4GAA4G,CAC7G,CAAA;oBACD,MAAM,IAAI,mBAAmB,CAC3B,mDAAmD,EACnD,YAAY,CACb,CAAA;gBACH,CAAC;gBACD,MAAM,GAAG,CAAA;YACX,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE;gBACxC,QAAQ;gBACR,SAAS;gBACT,KAAK;gBACL,MAAM;gBACN,MAAM;gBACN,MAAM,EAAE,SAAS;aAClB,CAAC,CAAA;YAEF,OAAO;gBACL,QAAQ,EAAE,kBAAkB;gBAC5B,IAAI,EAAE;oBACJ,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,eAAe,EAAE,KAAK,CAAC,SAAS;iBACjC;aACF,CAAA;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,kDAAkD;AAClD,yDAAyD;AACzD,MAAM,uBAAuB,GAAG;IAC9B,IAAI;IACJ,IAAI;IACJ,SAAS;IACT,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,OAAO;IACP,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;CACL,CAAA;AAED,MAAM,aAAa,GAAG,CAAC,KAAkB,EAAe,EAAE;IACxD,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAA;IAE9C,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,mBAAmB,CAC3B,oEAAoE,EACpE,cAAc,CACf,CAAA;IACH,CAAC;IAED,OAAO;QACL,WAAW;QACX,KAAK;QACL,QAAQ,EAAE,uBAAuB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;KACvE,CAAA;AACH,CAAC,CAAA;AAED,MAAM,uBAAuB,GAAG,KAAK,EACnC,GAAe,EACf,QAAgB,EACgB,EAAE;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC;YACxC,IAAI,EAAE,CAAC,QAAQ,CAAC;YAChB,yBAAyB,EAAE,CAAC,QAAQ,CAAC;YACrC,gBAAgB,EAAE,CAAC,QAAQ,CAAC;SAC7B,CAAC,CAAA;QAEF,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC,CAAA","sourcesContent":["import crypto from 'node:crypto'\nimport { isEmailValid } from '@hapi/address'\nimport { isDisposableEmail } from 'disposable-email-domains-js'\nimport {\n  InvalidRequestError,\n  MethodNotImplementedError,\n  Server,\n} from '@atproto/xrpc-server'\nimport { AppContext } from '../../../../context.js'\nimport { KwsExternalPayloadError } from '../../../../kws.js'\nimport { app } from '../../../../lexicons/index.js'\nimport { httpLogger as log } from '../../../../logger.js'\nimport { ActorInfo } from '../../../../proto/bsky_pb.js'\nimport { KwsExternalPayload } from '../../../kws/types.js'\nimport { createStashEvent, getClientUa } from '../../../kws/util.js'\n\ntype InputSchema = app.bsky.unspecced.initAgeAssurance.$InputBody\n\nexport default function (server: Server, ctx: AppContext) {\n  server.add(app.bsky.unspecced.initAgeAssurance, {\n    auth: ctx.authVerifier.standard,\n    handler: async ({ auth, input, req }) => {\n      if (!ctx.kwsClient) {\n        throw new MethodNotImplementedError(\n          'This service is not configured to support age assurance.',\n        )\n      }\n\n      const actorDid = auth.credentials.iss\n\n      const actorInfo = await getAgeVerificationState(ctx, actorDid)\n\n      if (actorInfo?.ageAssuranceStatus) {\n        if (\n          actorInfo.ageAssuranceStatus.status !== 'unknown' &&\n          actorInfo.ageAssuranceStatus.status !== 'pending'\n        ) {\n          throw new InvalidRequestError(\n            `Cannot initiate age assurance flow from current state: ${actorInfo.ageAssuranceStatus.status}`,\n            'InvalidInitiation',\n          )\n        }\n      }\n\n      const { countryCode, email, language } = validateInput(input.body)\n\n      const attemptId = crypto.randomUUID()\n      // Assumes `app.set('trust proxy', ...)` configured with `true` or specific values.\n      const initIp = req.ip\n      const initUa = getClientUa(req)\n      const externalPayload: KwsExternalPayload = { actorDid, attemptId }\n\n      try {\n        await ctx.kwsClient.sendEmail({\n          countryCode: countryCode.toUpperCase(),\n          email,\n          externalPayload,\n          language,\n        })\n      } catch (err) {\n        if (err instanceof KwsExternalPayloadError) {\n          log.error(\n            { externalPayload },\n            'Age Assurance flow failed because external payload got too long, which is caused by the DID being too long',\n          )\n          throw new InvalidRequestError(\n            'Age Assurance flow failed because DID is too long',\n            'DidTooLong',\n          )\n        }\n        throw err\n      }\n\n      const event = await createStashEvent(ctx, {\n        actorDid,\n        attemptId,\n        email,\n        initIp,\n        initUa,\n        status: 'pending',\n      })\n\n      return {\n        encoding: 'application/json',\n        body: {\n          status: event.status,\n          lastInitiatedAt: event.createdAt,\n        },\n      }\n    },\n  })\n}\n\n// Supported languages for KWS Adult Verification.\n// This list comes from KWS's AV Developer Guide PDF doc.\nconst kwsAvSupportedLanguages = [\n  'en',\n  'ar',\n  'zh-Hans',\n  'nl',\n  'tl',\n  'fr',\n  'de',\n  'id',\n  'it',\n  'ja',\n  'ko',\n  'pl',\n  'pt-BR',\n  'pt',\n  'ru',\n  'es',\n  'th',\n  'tr',\n  'vi',\n]\n\nconst validateInput = (input: InputSchema): InputSchema => {\n  const { countryCode, email, language } = input\n\n  if (!isEmailValid(email) || isDisposableEmail(email)) {\n    throw new InvalidRequestError(\n      'This email address is not supported, please use a different email.',\n      'InvalidEmail',\n    )\n  }\n\n  return {\n    countryCode,\n    email,\n    language: kwsAvSupportedLanguages.includes(language) ? language : 'en',\n  }\n}\n\nconst getAgeVerificationState = async (\n  ctx: AppContext,\n  actorDid: string,\n): Promise<ActorInfo | undefined> => {\n  try {\n    const res = await ctx.dataplane.getActors({\n      dids: [actorDid],\n      returnAgeAssuranceForDids: [actorDid],\n      skipCacheForDids: [actorDid],\n    })\n\n    return res.actors[0]\n  } catch (err) {\n    return undefined\n  }\n}\n"]}

package/dist/api/blob-dispatcher.d.ts

@@ -1,4 +1,4 @@
 import { Dispatcher } from 'undici';
-import { ServerConfig } from '../config';
+import { ServerConfig } from '../config.js';
 export declare function createBlobDispatcher(cfg: ServerConfig): Dispatcher;
 //# sourceMappingURL=blob-dispatcher.d.ts.map

package/dist/api/blob-dispatcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"blob-dispatcher.d.ts","sourceRoot":"","sources":["../../src/api/blob-dispatcher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAS,UAAU,EAAoB,MAAM,QAAQ,CAAA;AAE5D,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAGxC,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,YAAY,GAAG,UAAU,CA+BlE"}
+{"version":3,"file":"blob-dispatcher.d.ts","sourceRoot":"","sources":["../../src/api/blob-dispatcher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAS,UAAU,EAAoB,MAAM,QAAQ,CAAA;AAE5D,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAG3C,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,YAAY,GAAG,UAAU,CA+BlE"}

package/dist/api/blob-dispatcher.js

@@ -1,11 +1,8 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createBlobDispatcher = createBlobDispatcher;
-const undici_1 = require("undici");
-const fetch_node_1 = require("@atproto-labs/fetch-node");
-const retry_1 = require("../util/retry");
-function createBlobDispatcher(cfg) {
-    const baseDispatcher = new undici_1.Agent({
+import { Agent, Pool, RetryAgent } from 'undici';
+import { isUnicastIp, unicastLookup } from '@atproto-labs/fetch-node';
+import { RETRYABLE_HTTP_STATUS_CODES } from '../util/retry.js';
+export function createBlobDispatcher(cfg) {
+    const baseDispatcher = new Agent({
         allowH2: cfg.proxyAllowHTTP2, // This is experimental
         headersTimeout: cfg.proxyHeadersTimeout,
         maxResponseSize: cfg.proxyMaxResponseSize,
@@ -17,18 +14,18 @@ function createBlobDispatcher(cfg) {
                 if (protocol !== 'https:') {
                     throw new Error(`Forbidden protocol "${protocol}"`);
                 }
-                if ((0, fetch_node_1.isUnicastIp)(hostname) === false) {
+                if (isUnicastIp(hostname) === false) {
                     throw new Error('Hostname resolved to non-unicast address');
                 }
-                return new undici_1.Pool(origin, opts);
+                return new Pool(origin, opts);
             },
         connect: {
-            lookup: cfg.disableSsrfProtection ? undefined : fetch_node_1.unicastLookup,
+            lookup: cfg.disableSsrfProtection ? undefined : unicastLookup,
         },
     });
     return cfg.proxyMaxRetries > 0
-        ? new undici_1.RetryAgent(baseDispatcher, {
-            statusCodes: [...retry_1.RETRYABLE_HTTP_STATUS_CODES],
+        ? new RetryAgent(baseDispatcher, {
+            statusCodes: [...RETRYABLE_HTTP_STATUS_CODES],
             methods: ['GET', 'HEAD'],
             maxRetries: cfg.proxyMaxRetries,
         })

package/dist/api/blob-dispatcher.js.map

@@ -1 +1 @@
-{"version":3,"file":"blob-dispatcher.js","sourceRoot":"","sources":["../../src/api/blob-dispatcher.ts"],"names":[],"mappings":";;AAKA,oDA+BC;AApCD,mCAA4D;AAC5D,yDAAqE;AAErE,yCAA2D;AAE3D,SAAgB,oBAAoB,CAAC,GAAiB;IACpD,MAAM,cAAc,GAAG,IAAI,cAAK,CAAC;QAC/B,OAAO,EAAE,GAAG,CAAC,eAAe,EAAE,uBAAuB;QACrD,cAAc,EAAE,GAAG,CAAC,mBAAmB;QACvC,eAAe,EAAE,GAAG,CAAC,oBAAoB;QACzC,WAAW,EAAE,GAAG,CAAC,gBAAgB;QACjC,OAAO,EAAE,GAAG,CAAC,qBAAqB;YAChC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;gBACf,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAC1B,MAAM,YAAY,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;gBAClD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;oBAC1B,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,GAAG,CAAC,CAAA;gBACrD,CAAC;gBACD,IAAI,IAAA,wBAAW,EAAC,QAAQ,CAAC,KAAK,KAAK,EAAE,CAAC;oBACpC,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;gBAC7D,CAAC;gBACD,OAAO,IAAI,aAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;YAC/B,CAAC;QACL,OAAO,EAAE;YACP,MAAM,EAAE,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,0BAAa;SAC9D;KACF,CAAC,CAAA;IAEF,OAAO,GAAG,CAAC,eAAe,GAAG,CAAC;QAC5B,CAAC,CAAC,IAAI,mBAAU,CAAC,cAAc,EAAE;YAC7B,WAAW,EAAE,CAAC,GAAG,mCAA2B,CAAC;YAC7C,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;YACxB,UAAU,EAAE,GAAG,CAAC,eAAe;SAChC,CAAC;QACJ,CAAC,CAAC,cAAc,CAAA;AACpB,CAAC","sourcesContent":["import { Agent, Dispatcher, Pool, RetryAgent } from 'undici'\nimport { isUnicastIp, unicastLookup } from '@atproto-labs/fetch-node'\nimport { ServerConfig } from '../config'\nimport { RETRYABLE_HTTP_STATUS_CODES } from '../util/retry'\n\nexport function createBlobDispatcher(cfg: ServerConfig): Dispatcher {\n  const baseDispatcher = new Agent({\n    allowH2: cfg.proxyAllowHTTP2, // This is experimental\n    headersTimeout: cfg.proxyHeadersTimeout,\n    maxResponseSize: cfg.proxyMaxResponseSize,\n    bodyTimeout: cfg.proxyBodyTimeout,\n    factory: cfg.disableSsrfProtection\n      ? undefined\n      : (origin, opts) => {\n          const { protocol, hostname } =\n            origin instanceof URL ? origin : new URL(origin)\n          if (protocol !== 'https:') {\n            throw new Error(`Forbidden protocol \"${protocol}\"`)\n          }\n          if (isUnicastIp(hostname) === false) {\n            throw new Error('Hostname resolved to non-unicast address')\n          }\n          return new Pool(origin, opts)\n        },\n    connect: {\n      lookup: cfg.disableSsrfProtection ? undefined : unicastLookup,\n    },\n  })\n\n  return cfg.proxyMaxRetries > 0\n    ? new RetryAgent(baseDispatcher, {\n        statusCodes: [...RETRYABLE_HTTP_STATUS_CODES],\n        methods: ['GET', 'HEAD'],\n        maxRetries: cfg.proxyMaxRetries,\n      })\n    : baseDispatcher\n}\n"]}
+{"version":3,"file":"blob-dispatcher.js","sourceRoot":"","sources":["../../src/api/blob-dispatcher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAc,IAAI,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AAC5D,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAErE,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAA;AAE9D,MAAM,UAAU,oBAAoB,CAAC,GAAiB;IACpD,MAAM,cAAc,GAAG,IAAI,KAAK,CAAC;QAC/B,OAAO,EAAE,GAAG,CAAC,eAAe,EAAE,uBAAuB;QACrD,cAAc,EAAE,GAAG,CAAC,mBAAmB;QACvC,eAAe,EAAE,GAAG,CAAC,oBAAoB;QACzC,WAAW,EAAE,GAAG,CAAC,gBAAgB;QACjC,OAAO,EAAE,GAAG,CAAC,qBAAqB;YAChC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;gBACf,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAC1B,MAAM,YAAY,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;gBAClD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;oBAC1B,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,GAAG,CAAC,CAAA;gBACrD,CAAC;gBACD,IAAI,WAAW,CAAC,QAAQ,CAAC,KAAK,KAAK,EAAE,CAAC;oBACpC,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;gBAC7D,CAAC;gBACD,OAAO,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;YAC/B,CAAC;QACL,OAAO,EAAE;YACP,MAAM,EAAE,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa;SAC9D;KACF,CAAC,CAAA;IAEF,OAAO,GAAG,CAAC,eAAe,GAAG,CAAC;QAC5B,CAAC,CAAC,IAAI,UAAU,CAAC,cAAc,EAAE;YAC7B,WAAW,EAAE,CAAC,GAAG,2BAA2B,CAAC;YAC7C,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;YACxB,UAAU,EAAE,GAAG,CAAC,eAAe;SAChC,CAAC;QACJ,CAAC,CAAC,cAAc,CAAA;AACpB,CAAC","sourcesContent":["import { Agent, Dispatcher, Pool, RetryAgent } from 'undici'\nimport { isUnicastIp, unicastLookup } from '@atproto-labs/fetch-node'\nimport { ServerConfig } from '../config.js'\nimport { RETRYABLE_HTTP_STATUS_CODES } from '../util/retry.js'\n\nexport function createBlobDispatcher(cfg: ServerConfig): Dispatcher {\n  const baseDispatcher = new Agent({\n    allowH2: cfg.proxyAllowHTTP2, // This is experimental\n    headersTimeout: cfg.proxyHeadersTimeout,\n    maxResponseSize: cfg.proxyMaxResponseSize,\n    bodyTimeout: cfg.proxyBodyTimeout,\n    factory: cfg.disableSsrfProtection\n      ? undefined\n      : (origin, opts) => {\n          const { protocol, hostname } =\n            origin instanceof URL ? origin : new URL(origin)\n          if (protocol !== 'https:') {\n            throw new Error(`Forbidden protocol \"${protocol}\"`)\n          }\n          if (isUnicastIp(hostname) === false) {\n            throw new Error('Hostname resolved to non-unicast address')\n          }\n          return new Pool(origin, opts)\n        },\n    connect: {\n      lookup: cfg.disableSsrfProtection ? undefined : unicastLookup,\n    },\n  })\n\n  return cfg.proxyMaxRetries > 0\n    ? new RetryAgent(baseDispatcher, {\n        statusCodes: [...RETRYABLE_HTTP_STATUS_CODES],\n        methods: ['GET', 'HEAD'],\n        maxRetries: cfg.proxyMaxRetries,\n      })\n    : baseDispatcher\n}\n"]}

package/dist/api/blob-resolver.d.ts

@@ -2,8 +2,8 @@ import { Writable } from 'node:stream';
 import { Dispatcher } from 'undici';
 import { AtprotoDid } from '@atproto/did';
 import { Cid } from '@atproto/lex';
-import { AppContext } from '../context';
-import { Middleware } from '../util/http';
+import { AppContext } from '../context.js';
+import { Middleware } from '../util/http.js';
 export declare function createMiddleware(ctx: AppContext): Middleware;
 export type StreamBlobOptions = {
     cid: string;

package/dist/api/blob-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"blob-resolver.d.ts","sourceRoot":"","sources":["../../src/api/blob-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,QAAQ,EAAE,MAAM,aAAa,CAAA;AAGzD,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AAMnC,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAA;AACvD,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAQlC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAUvC,OAAO,EAAE,UAAU,EAAwC,MAAM,cAAc,CAAA;AAG/E,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,UAAU,GAAG,UAAU,CAoH5D;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,MAAM,CAAC,EAAE,WAAW,CAAA;CACrB,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG,CAC9B,IAAI,EAAE,UAAU,CAAC,iBAAiB,EAClC,IAAI,EAAE;IACJ,GAAG,EAAE,GAAG,CAAA;IACR,GAAG,EAAE,UAAU,CAAA;IACf,GAAG,EAAE,GAAG,CAAA;CACT,KACE,QAAQ,CAAA;AAEb,wBAAsB,UAAU,CAC9B,GAAG,EAAE,UAAU,EACf,OAAO,EAAE,iBAAiB,EAC1B,OAAO,EAAE,iBAAiB,kCAiE3B"}
+{"version":3,"file":"blob-resolver.d.ts","sourceRoot":"","sources":["../../src/api/blob-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,QAAQ,EAAE,MAAM,aAAa,CAAA;AAGzD,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AAMnC,OAAO,EAAE,UAAU,EAAgB,MAAM,cAAc,CAAA;AACvD,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAQlC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAU1C,OAAO,EACL,UAAU,EAGX,MAAM,iBAAiB,CAAA;AAGxB,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,UAAU,GAAG,UAAU,CAoH5D;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,MAAM,CAAC,EAAE,WAAW,CAAA;CACrB,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG,CAC9B,IAAI,EAAE,UAAU,CAAC,iBAAiB,EAClC,IAAI,EAAE;IACJ,GAAG,EAAE,GAAG,CAAA;IACR,GAAG,EAAE,UAAU,CAAA;IACf,GAAG,EAAE,GAAG,CAAA;CACT,KACE,QAAQ,CAAA;AAEb,wBAAsB,UAAU,CAC9B,GAAG,EAAE,UAAU,EACf,OAAO,EAAE,iBAAiB,EAC1B,OAAO,EAAE,iBAAiB,kCAiE3B"}

package/dist/api/blob-resolver.js

@@ -1,52 +1,15 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createMiddleware = createMiddleware;
-exports.streamBlob = streamBlob;
-const node_stream_1 = require("node:stream");
-const promises_1 = require("node:stream/promises");
-const http_errors_1 = __importStar(require("http-errors"));
-const common_1 = require("@atproto/common");
-const did_1 = require("@atproto/did");
-const xrpc_utils_1 = require("@atproto-labs/xrpc-utils");
-const data_plane_1 = require("../data-plane");
-const util_1 = require("../hydration/util");
-const logger_1 = require("../logger");
-const http_1 = require("../util/http");
-const util_2 = require("./util");
-function createMiddleware(ctx) {
+import { Transform } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+import createError, { isHttpError } from 'http-errors';
+import { VerifyCidError, VerifyCidTransform, createDecoders, } from '@atproto/common';
+import { isAtprotoDid } from '@atproto/did';
+import { ACCEPT_ENCODING_COMPRESSED, ACCEPT_ENCODING_UNCOMPRESSED, buildProxiedContentEncoding, formatAcceptHeader, } from '@atproto-labs/xrpc-utils';
+import { Code, getServiceEndpoint, isDataplaneError, unpackIdentityServices, } from '../data-plane/index.js';
+import { parseCid } from '../hydration/util.js';
+import { httpLogger as log } from '../logger.js';
+import { proxyResponseHeaders, responseSignal, } from '../util/http.js';
+import { BSKY_USER_AGENT } from './util.js';
+export function createMiddleware(ctx) {
     return async (req, res, next) => {
         if (req.method !== 'GET' && req.method !== 'HEAD')
             return next();
@@ -61,17 +24,17 @@ function createMiddleware(ctx) {
             const streamOptions = {
                 did: didParam,
                 cid: cidParam,
-                signal: (0, http_1.responseSignal)(res),
+                signal: responseSignal(res),
                 // Because we will be verifying the CID, we need to ensure that the
                 // upstream response can be de-compressed. We do this by negotiating the
                 // "accept-encoding" header based on the downstream client's capabilities.
-                acceptEncoding: (0, xrpc_utils_1.buildProxiedContentEncoding)(req.headers['accept-encoding'], ctx.cfg.proxyPreferCompressed),
+                acceptEncoding: buildProxiedContentEncoding(req.headers['accept-encoding'], ctx.cfg.proxyPreferCompressed),
             };
             await streamBlob(ctx, streamOptions, (upstream, { cid, did, url }) => {
                 const encoding = upstream.headers['content-encoding'];
                 const verifier = createCidVerifier(cid, encoding);
                 const logError = (err) => {
-                    logger_1.httpLogger.warn({ err, did, cid: cid.toString(), pds: url.origin }, 'blob resolution failed during transmission');
+                    log.warn({ err, did, cid: cid.toString(), pds: url.origin }, 'blob resolution failed during transmission');
                 };
                 const onError = (err) => {
                     // No need to pipe the data (verifier) into the response, as it is
@@ -105,7 +68,7 @@ function createMiddleware(ctx) {
                     res.setHeader('X-XSS-Protection', '0');
                     // @TODO Add a cache-control header ?
                     // @TODO Add content-disposition header (to force download) ?
-                    (0, http_1.proxyResponseHeaders)(upstream, res);
+                    proxyResponseHeaders(upstream, res);
                     // Force chunked encoding. This is required because the verifier will
                     // trigger an error *after* the last chunk has been passed through.
                     // Because the number of bytes sent will match the content-length, the
@@ -123,7 +86,7 @@ function createMiddleware(ctx) {
                     // now).
                     res.flushHeaders();
                     // Pipe the verifier output into the HTTP response
-                    void (0, promises_1.pipeline)([verifier, res]).catch(logError);
+                    void pipeline([verifier, res]).catch(logError);
                 }, 10); // 0 works too. Allow for additional data to come in for 10ms.
                 // Write the upstream response into the verifier.
                 return verifier;
@@ -133,28 +96,28 @@ function createMiddleware(ctx) {
             if (res.headersSent || res.destroyed) {
                 res.destroy();
             }
-            else if (err instanceof common_1.VerifyCidError) {
+            else if (err instanceof VerifyCidError) {
                 // @NOTE This only works because of the graceTimer above. It will also
                 // only be triggered for small payloads.
-                next((0, http_errors_1.default)(404, err.message));
+                next(createError(404, err.message));
             }
-            else if ((0, http_errors_1.isHttpError)(err)) {
+            else if (isHttpError(err)) {
                 next(err);
             }
             else {
-                next((0, http_errors_1.default)(502, 'Upstream Error', { cause: err }));
+                next(createError(502, 'Upstream Error', { cause: err }));
             }
         }
     };
 }
-async function streamBlob(ctx, options, factory) {
+export async function streamBlob(ctx, options, factory) {
     const { did, cid } = parseBlobParams(options);
     const url = await getBlobUrl(ctx.dataplane, did, cid);
     const headers = getBlobHeaders(ctx.cfg, url);
     headers.set('accept-encoding', options.acceptEncoding ||
-        (0, xrpc_utils_1.formatAcceptHeader)(ctx.cfg.proxyPreferCompressed
-            ? xrpc_utils_1.ACCEPT_ENCODING_COMPRESSED
-            : xrpc_utils_1.ACCEPT_ENCODING_UNCOMPRESSED));
+        formatAcceptHeader(ctx.cfg.proxyPreferCompressed
+            ? ACCEPT_ENCODING_COMPRESSED
+            : ACCEPT_ENCODING_UNCOMPRESSED));
     let headersReceived = false;
     return ctx.blobDispatcher
         .stream({
@@ -167,15 +130,15 @@ async function streamBlob(ctx, options, factory) {
     }, (upstream) => {
         headersReceived = true;
         if (upstream.statusCode !== 200) {
-            logger_1.httpLogger.warn({
+            log.warn({
                 did,
                 cid: cid.toString(),
                 pds: url.origin,
                 status: upstream.statusCode,
             }, `blob resolution failed upstream`);
             throw upstream.statusCode >= 400 && upstream.statusCode < 500
-                ? (0, http_errors_1.default)(404, 'Blob not found', { cause: upstream }) // 4xx => 404
-                : (0, http_errors_1.default)(502, 'Upstream Error', { cause: upstream }); // !200 && !4xx => 502
+                ? createError(404, 'Blob not found', { cause: upstream }) // 4xx => 404
+                : createError(502, 'Upstream Error', { cause: upstream }); // !200 && !4xx => 502
         }
         return factory(upstream, { url, did, cid });
     })
@@ -183,19 +146,19 @@ async function streamBlob(ctx, options, factory) {
         // Is this a connection error, or a stream error ?
         if (!headersReceived) {
             // connection error, dns error, headers timeout, ...
-            logger_1.httpLogger.warn({ err, did, cid: cid.toString(), pds: url.origin }, 'blob resolution failed during connection');
-            throw (0, http_errors_1.default)(502, 'Upstream Error', { cause: err });
+            log.warn({ err, did, cid: cid.toString(), pds: url.origin }, 'blob resolution failed during connection');
+            throw createError(502, 'Upstream Error', { cause: err });
         }
         throw err;
     });
 }
 function parseBlobParams(params) {
     const { cid, did } = params;
-    if (!(0, did_1.isAtprotoDid)(did))
-        throw (0, http_errors_1.default)(400, 'Invalid did');
-    const cidObj = (0, util_1.parseCid)(cid);
+    if (!isAtprotoDid(did))
+        throw createError(400, 'Invalid did');
+    const cidObj = parseCid(cid);
     if (!cidObj)
-        throw (0, http_errors_1.default)(400, 'Invalid cid');
+        throw createError(400, 'Invalid cid');
     return { cid: cidObj, did };
 }
 async function getBlobUrl(dataplane, did, cid) {
@@ -208,7 +171,7 @@ async function getBlobUrl(dataplane, did, cid) {
 async function getBlobPds(dataplane, did, cid) {
     const [identity, { takenDown }] = await Promise.all([
         dataplane.getIdentityByDid({ did }).catch((err) => {
-            if ((0, data_plane_1.isDataplaneError)(err, data_plane_1.Code.NotFound)) {
+            if (isDataplaneError(err, Code.NotFound)) {
                 return undefined;
             }
             throw err;
@@ -216,22 +179,22 @@ async function getBlobPds(dataplane, did, cid) {
         dataplane.getBlobTakedown({ did, cid: cid.toString() }),
     ]);
     if (takenDown) {
-        throw (0, http_errors_1.default)(404, 'Blob not found');
+        throw createError(404, 'Blob not found');
     }
-    const services = identity && (0, data_plane_1.unpackIdentityServices)(identity.services);
+    const services = identity && unpackIdentityServices(identity.services);
     const pds = services &&
-        (0, data_plane_1.getServiceEndpoint)(services, {
+        getServiceEndpoint(services, {
             id: 'atproto_pds',
             type: 'AtprotoPersonalDataServer',
         });
     if (!pds) {
-        throw (0, http_errors_1.default)(404, 'Origin not found');
+        throw createError(404, 'Origin not found');
     }
     return pds;
 }
 function getBlobHeaders({ blobRateLimitBypassKey: bypassKey, blobRateLimitBypassHostname: bypassHostname, }, url) {
     const headers = new Map();
-    headers.set('user-agent', util_2.BSKY_USER_AGENT);
+    headers.set('user-agent', BSKY_USER_AGENT);
     if (bypassKey && bypassHostname) {
         const matchesUrl = bypassHostname.startsWith('.')
             ? url.hostname.endsWith(bypassHostname)
@@ -264,8 +227,8 @@ function createCidVerifier(cid, encoding) {
     // streams: one that will be sent, unaltered, downstream, and a pipeline that
     // will be used to decompress & verify the CID (discarding de-compressed
     // data).
-    const decoders = (0, common_1.createDecoders)(encoding);
-    const verifier = new common_1.VerifyCidTransform(cid);
+    const decoders = createDecoders(encoding);
+    const verifier = new VerifyCidTransform(cid);
     // Optimization: If the content is not compressed, we don't need to "tee" the
     // stream, we can use the verifier as simple passthrough.
     if (!decoders.length)
@@ -275,7 +238,7 @@ function createCidVerifier(cid, encoding) {
     const pipelineInput = pipelineStreams[0];
     // Create a promise that will resolve if, and only if, the decoding and
     // verification succeed.
-    const pipelinePromise = (0, promises_1.pipeline)(pipelineStreams, {
+    const pipelinePromise = pipeline(pipelineStreams, {
         signal: pipelineController.signal,
     }).then(() => null, (err) => {
         const error = asError(err);
@@ -290,7 +253,7 @@ function createCidVerifier(cid, encoding) {
     // detect any error through the pipelinePromise. We still need to pass the
     // verifier into flowing mode to ensure that the pipelinePromise resolves.
     verifier.resume();
-    const passthrough = new node_stream_1.Transform({
+    const passthrough = new Transform({
         transform(chunk, encoding, callback) {
             pipelineInput.write(chunk, encoding);
             callback(null, chunk);

package/dist/api/blob-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"blob-resolver.js","sourceRoot":"","sources":["../../src/api/blob-resolver.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,4CAoHC;AAkBD,gCAoEC;AAzOD,6CAAyD;AACzD,mDAA+C;AAC/C,2DAAsD;AAEtD,4CAIwB;AACxB,sCAAuD;AAEvD,yDAKiC;AAGjC,8CAMsB;AACtB,4CAA4C;AAC5C,sCAA6C;AAC7C,uCAA+E;AAC/E,iCAAwC;AAExC,SAAgB,gBAAgB,CAAC,GAAe;IAC9C,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC9B,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO,IAAI,EAAE,CAAA;QAChE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,EAAE,CAAA;QACjD,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC/D,IAAI,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,EAAE,CAAA;QAEzD,oEAAoE;QACpE,6BAA6B;QAE7B,IAAI,CAAC;YACH,MAAM,aAAa,GAAsB;gBACvC,GAAG,EAAE,QAAQ;gBACb,GAAG,EAAE,QAAQ;gBACb,MAAM,EAAE,IAAA,qBAAc,EAAC,GAAG,CAAC;gBAC3B,mEAAmE;gBACnE,wEAAwE;gBACxE,0EAA0E;gBAC1E,cAAc,EAAE,IAAA,wCAA2B,EACzC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAC9B,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAC9B;aACF,CAAA;YAED,MAAM,UAAU,CAAC,GAAG,EAAE,aAAa,EAAE,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE;gBACnE,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAA;gBACrD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;gBAEjD,MAAM,QAAQ,GAAG,CAAC,GAAY,EAAE,EAAE;oBAChC,mBAAG,CAAC,IAAI,CACN,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,EAClD,4CAA4C,CAC7C,CAAA;gBACH,CAAC,CAAA;gBAED,MAAM,OAAO,GAAG,CAAC,GAAY,EAAE,EAAE;oBAC/B,kEAAkE;oBAClE,kEAAkE;oBAClE,oEAAoE;oBACpE,oEAAoE;oBACpE,YAAY,CAAC,UAAU,CAAC,CAAA;oBACxB,QAAQ,CAAC,GAAG,CAAC,CAAA;gBACf,CAAC,CAAA;gBAED,oEAAoE;gBACpE,mEAAmE;gBACnE,uBAAuB;gBACvB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;gBAE7B,sEAAsE;gBACtE,wEAAwE;gBACxE,uEAAuE;gBACvE,uEAAuE;gBACvE,qEAAqE;gBACrE,wEAAwE;gBACxE,sEAAsE;gBACtE,uEAAuE;gBACvE,qEAAqE;gBACrE,+CAA+C;gBAC/C,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE;oBACjC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;oBAE9B,oEAAoE;oBACpE,yDAAyD;oBACzD,GAAG,CAAC,SAAS,CACX,yBAAyB,EACzB,6BAA6B,CAC9B,CAAA;oBACD,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAA;oBAClD,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAA;oBACxC,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAA;oBAEtC,qCAAqC;oBACrC,6DAA6D;oBAE7D,IAAA,2BAAoB,EAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;oBAEnC,qEAAqE;oBACrE,mEAAmE;oBACnE,sEAAsE;oBACtE,qEAAqE;oBACrE,iEAAiE;oBACjE,oDAAoD;oBACpD,GAAG,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAA;oBAElC,oEAAoE;oBACpE,0DAA0D;oBAC1D,mEAAmE;oBACnE,qEAAqE;oBACrE,qEAAqE;oBACrE,gEAAgE;oBAChE,qEAAqE;oBACrE,QAAQ;oBACR,GAAG,CAAC,YAAY,EAAE,CAAA;oBAElB,kDAAkD;oBAClD,KAAK,IAAA,mBAAQ,EAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;gBAChD,CAAC,EAAE,EAAE,CAAC,CAAA,CAAC,8DAA8D;gBAErE,iDAAiD;gBACjD,OAAO,QAAQ,CAAA;YACjB,CAAC,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;gBACrC,GAAG,CAAC,OAAO,EAAE,CAAA;YACf,CAAC;iBAAM,IAAI,GAAG,YAAY,uBAAc,EAAE,CAAC;gBACzC,sEAAsE;gBACtE,wCAAwC;gBACxC,IAAI,CAAC,IAAA,qBAAW,EAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAA;YACrC,CAAC;iBAAM,IAAI,IAAA,yBAAW,EAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B,IAAI,CAAC,GAAG,CAAC,CAAA;YACX,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAA,qBAAW,EAAC,GAAG,EAAE,gBAAgB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;YAC1D,CAAC;QACH,CAAC;IACH,CAAC,CAAA;AACH,CAAC;AAkBM,KAAK,UAAU,UAAU,CAC9B,GAAe,EACf,OAA0B,EAC1B,OAA0B;IAE1B,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;IAC7C,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IAErD,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAE5C,OAAO,CAAC,GAAG,CACT,iBAAiB,EACjB,OAAO,CAAC,cAAc;QACpB,IAAA,+BAAkB,EAChB,GAAG,CAAC,GAAG,CAAC,qBAAqB;YAC3B,CAAC,CAAC,uCAA0B;YAC5B,CAAC,CAAC,yCAA4B,CACjC,CACJ,CAAA;IAED,IAAI,eAAe,GAAG,KAAK,CAAA;IAE3B,OAAO,GAAG,CAAC,cAAc;SACtB,MAAM,CACL;QACE,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,IAAI,EAAE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM;QAC/B,OAAO;QACP,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,eAAe,EAAE,EAAE;KACpB,EACD,CAAC,QAAQ,EAAE,EAAE;QACX,eAAe,GAAG,IAAI,CAAA;QAEtB,IAAI,QAAQ,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;YAChC,mBAAG,CAAC,IAAI,CACN;gBACE,GAAG;gBACH,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE;gBACnB,GAAG,EAAE,GAAG,CAAC,MAAM;gBACf,MAAM,EAAE,QAAQ,CAAC,UAAU;aAC5B,EACD,iCAAiC,CAClC,CAAA;YAED,MAAM,QAAQ,CAAC,UAAU,IAAI,GAAG,IAAI,QAAQ,CAAC,UAAU,GAAG,GAAG;gBAC3D,CAAC,CAAC,IAAA,qBAAW,EAAC,GAAG,EAAE,gBAAgB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,aAAa;gBACvE,CAAC,CAAC,IAAA,qBAAW,EAAC,GAAG,EAAE,gBAAgB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA,CAAC,sBAAsB;QACpF,CAAC;QAED,OAAO,OAAO,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAA;IAC7C,CAAC,CACF;SACA,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACb,kDAAkD;QAClD,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,oDAAoD;YACpD,mBAAG,CAAC,IAAI,CACN,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,EAClD,0CAA0C,CAC3C,CAAA;YAED,MAAM,IAAA,qBAAW,EAAC,GAAG,EAAE,gBAAgB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QAC1D,CAAC;QAED,MAAM,GAAG,CAAA;IACX,CAAC,CAAC,CAAA;AACN,CAAC;AAED,SAAS,eAAe,CAAC,MAAoC;IAC3D,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAA;IAC3B,IAAI,CAAC,IAAA,kBAAY,EAAC,GAAG,CAAC;QAAE,MAAM,IAAA,qBAAW,EAAC,GAAG,EAAE,aAAa,CAAC,CAAA;IAC7D,MAAM,MAAM,GAAG,IAAA,eAAQ,EAAC,GAAG,CAAC,CAAA;IAC5B,IAAI,CAAC,MAAM;QAAE,MAAM,IAAA,qBAAW,EAAC,GAAG,EAAE,aAAa,CAAC,CAAA;IAClD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;AAC7B,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,SAA0B,EAC1B,GAAW,EACX,GAAQ;IAER,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IAEjD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,gCAAgC,EAAE,GAAG,CAAC,CAAA;IAC1D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IAChC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAA;IAE3C,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,SAA0B,EAC1B,GAAW,EACX,GAAQ;IAER,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAClD,SAAS,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAChD,IAAI,IAAA,6BAAgB,EAAC,GAAG,EAAE,iBAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzC,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC,CAAC;QACF,SAAS,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;KACxD,CAAC,CAAA;IAEF,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAA,qBAAW,EAAC,GAAG,EAAE,gBAAgB,CAAC,CAAA;IAC1C,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,IAAI,IAAA,mCAAsB,EAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACtE,MAAM,GAAG,GACP,QAAQ;QACR,IAAA,+BAAkB,EAAC,QAAQ,EAAE;YAC3B,EAAE,EAAE,aAAa;YACjB,IAAI,EAAE,2BAA2B;SAClC,CAAC,CAAA;IAEJ,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAA,qBAAW,EAAC,GAAG,EAAE,kBAAkB,CAAC,CAAA;IAC5C,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,cAAc,CACrB,EACE,sBAAsB,EAAE,SAAS,EACjC,2BAA2B,EAAE,cAAc,GAC9B,EACf,GAAQ;IAER,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAA;IAEzC,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,sBAAe,CAAC,CAAA;IAE1C,IAAI,SAAS,IAAI,cAAc,EAAE,CAAC;QAChC,MAAM,UAAU,GAAG,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC;YAC/C,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC;YACvC,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,cAAc,CAAA;QAEnC,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,SAAS,CAAC,CAAA;QAC9C,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,iBAAiB,CAAC,GAAQ,EAAE,QAA4B;IAC/D,oEAAoE;IACpE,uEAAuE;IACvE,2EAA2E;IAC3E,4EAA4E;IAC5E,8BAA8B;IAC9B,EAAE;IACF,8EAA8E;IAC9E,mBAAmB;IACnB,EAAE;IACF,6EAA6E;IAC7E,6EAA6E;IAC7E,wEAAwE;IACxE,SAAS;IAET,MAAM,QAAQ,GAAG,IAAA,uBAAc,EAAC,QAAQ,CAAC,CAAA;IACzC,MAAM,QAAQ,GAAG,IAAI,2BAAkB,CAAC,GAAG,CAAC,CAAA;IAE5C,6EAA6E;IAC7E,yDAAyD;IACzD,IAAI,CAAC,QAAQ,CAAC,MAAM;QAAE,OAAO,QAAQ,CAAA;IAErC,MAAM,kBAAkB,GAAG,IAAI,eAAe,EAAE,CAAA;IAChD,MAAM,eAAe,GAAa,CAAC,GAAG,QAAQ,EAAE,QAAQ,CAAC,CAAA;IACzD,MAAM,aAAa,GAAG,eAAe,CAAC,CAAC,CAAE,CAAA;IAEzC,uEAAuE;IACvE,wBAAwB;IACxB,MAAM,eAAe,GAA0B,IAAA,mBAAQ,EAAC,eAAe,EAAE;QACvE,MAAM,EAAE,kBAAkB,CAAC,MAAM;KAClC,CAAC,CAAC,IAAI,CACL,GAAG,EAAE,CAAC,IAAI,EACV,CAAC,GAAG,EAAE,EAAE;QACN,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;QAE1B,oEAAoE;QACpE,yEAAyE;QACzE,yEAAyE;QACzE,2BAA2B;QAC3B,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAE1B,OAAO,KAAK,CAAA;IACd,CAAC,CACF,CAAA;IAED,0EAA0E;IAC1E,0EAA0E;IAC1E,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,EAAE,CAAA;IAEjB,MAAM,WAAW,GAAG,IAAI,uBAAS,CAAC;QAChC,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ;YACjC,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;YACpC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QACvB,CAAC;QACD,KAAK,CAAC,QAAQ;YACZ,gEAAgE;YAChE,aAAa,CAAC,GAAG,EAAE,CAAA;YACnB,sEAAsE;YACtE,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAChC,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,QAAQ;YACnB,kBAAkB,CAAC,KAAK,EAAE,CAAA,CAAC,2CAA2C;YACtE,QAAQ,CAAC,GAAG,CAAC,CAAA;QACf,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,WAAW,CAAA;AACpB,CAAC;AAED,SAAS,OAAO,CAAC,GAAY;IAC3B,OAAO,GAAG,YAAY,KAAK;QACzB,CAAC,CAAC,GAAG;QACL,CAAC,CAAC,IAAI,KAAK,CAAC,mBAAmB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;AACpD,CAAC","sourcesContent":["import { Duplex, Transform, Writable } from 'node:stream'\nimport { pipeline } from 'node:stream/promises'\nimport createError, { isHttpError } from 'http-errors'\nimport { Dispatcher } from 'undici'\nimport {\n  VerifyCidError,\n  VerifyCidTransform,\n  createDecoders,\n} from '@atproto/common'\nimport { AtprotoDid, isAtprotoDid } from '@atproto/did'\nimport { Cid } from '@atproto/lex'\nimport {\n  ACCEPT_ENCODING_COMPRESSED,\n  ACCEPT_ENCODING_UNCOMPRESSED,\n  buildProxiedContentEncoding,\n  formatAcceptHeader,\n} from '@atproto-labs/xrpc-utils'\nimport { ServerConfig } from '../config'\nimport { AppContext } from '../context'\nimport {\n  Code,\n  DataPlaneClient,\n  getServiceEndpoint,\n  isDataplaneError,\n  unpackIdentityServices,\n} from '../data-plane'\nimport { parseCid } from '../hydration/util'\nimport { httpLogger as log } from '../logger'\nimport { Middleware, proxyResponseHeaders, responseSignal } from '../util/http'\nimport { BSKY_USER_AGENT } from './util'\n\nexport function createMiddleware(ctx: AppContext): Middleware {\n  return async (req, res, next) => {\n    if (req.method !== 'GET' && req.method !== 'HEAD') return next()\n    if (!req.url?.startsWith('/blob/')) return next()\n    const { length, 2: didParam, 3: cidParam } = req.url.split('/')\n    if (length !== 4 || !didParam || !cidParam) return next()\n\n    // @TODO Check sec-fetch-* headers (e.g. to prevent files from being\n    // displayed as a web page) ?\n\n    try {\n      const streamOptions: StreamBlobOptions = {\n        did: didParam,\n        cid: cidParam,\n        signal: responseSignal(res),\n        // Because we will be verifying the CID, we need to ensure that the\n        // upstream response can be de-compressed. We do this by negotiating the\n        // \"accept-encoding\" header based on the downstream client's capabilities.\n        acceptEncoding: buildProxiedContentEncoding(\n          req.headers['accept-encoding'],\n          ctx.cfg.proxyPreferCompressed,\n        ),\n      }\n\n      await streamBlob(ctx, streamOptions, (upstream, { cid, did, url }) => {\n        const encoding = upstream.headers['content-encoding']\n        const verifier = createCidVerifier(cid, encoding)\n\n        const logError = (err: unknown) => {\n          log.warn(\n            { err, did, cid: cid.toString(), pds: url.origin },\n            'blob resolution failed during transmission',\n          )\n        }\n\n        const onError = (err: unknown) => {\n          // No need to pipe the data (verifier) into the response, as it is\n          // \"errored\". The response processing will continue in the \"catch\"\n          // block below (because streamBlob() will reject the promise in case\n          // of \"error\" event on the writable stream returned by the factory).\n          clearTimeout(graceTimer)\n          logError(err)\n        }\n\n        // Catch any error that occurs before the timer bellow is triggered.\n        // The promise returned by streamBlob() will be rejected as soon as\n        // the verifier errors.\n        verifier.on('error', onError)\n\n        // The way I/O work, it is likely that, in case of small payloads, the\n        // full upstream response is already buffered at this point. In order to\n        // return a 404 instead of a broken response stream, we allow the event\n        // loop to to process any pending I/O events before we start piping the\n        // bytes to the response. For larger payloads, the response will look\n        // like a 200 with a broken chunked response stream. The only way around\n        // that would be to buffer the entire response before piping it to the\n        // response, which will hurt latency (need the full payload) and memory\n        // usage (either RAM or DISK). Since this is more of an edge case, we\n        // allow the broken response stream to be sent.\n        const graceTimer = setTimeout(() => {\n          verifier.off('error', onError)\n\n          // Make sure that the content served from the bsky api domain cannot\n          // be used to perform XSS attacks (by serving HTML pages)\n          res.setHeader(\n            'Content-Security-Policy',\n            `default-src 'none'; sandbox`,\n          )\n          res.setHeader('X-Content-Type-Options', 'nosniff')\n          res.setHeader('X-Frame-Options', 'DENY')\n          res.setHeader('X-XSS-Protection', '0')\n\n          // @TODO Add a cache-control header ?\n          // @TODO Add content-disposition header (to force download) ?\n\n          proxyResponseHeaders(upstream, res)\n\n          // Force chunked encoding. This is required because the verifier will\n          // trigger an error *after* the last chunk has been passed through.\n          // Because the number of bytes sent will match the content-length, the\n          // HTTP response will be considered \"complete\" by the HTTP server. At\n          // this point, only trailers headers could indicate that an error\n          // occurred, but that is not the behavior we expect.\n          res.removeHeader('content-length')\n\n          // From this point on, triggering the next middleware (including any\n          // error handler) can be problematic because content-type,\n          // content-encoding, etc. headers have already been set. Because of\n          // this, we make sure that res.headersSent is set to true, preventing\n          // another error handler middleware from being called (from the catch\n          // block bellow). Not flushing the headers here would require to\n          // revert the headers set from this middleware (which we don't do for\n          // now).\n          res.flushHeaders()\n\n          // Pipe the verifier output into the HTTP response\n          void pipeline([verifier, res]).catch(logError)\n        }, 10) // 0 works too. Allow for additional data to come in for 10ms.\n\n        // Write the upstream response into the verifier.\n        return verifier\n      })\n    } catch (err) {\n      if (res.headersSent || res.destroyed) {\n        res.destroy()\n      } else if (err instanceof VerifyCidError) {\n        // @NOTE This only works because of the graceTimer above. It will also\n        // only be triggered for small payloads.\n        next(createError(404, err.message))\n      } else if (isHttpError(err)) {\n        next(err)\n      } else {\n        next(createError(502, 'Upstream Error', { cause: err }))\n      }\n    }\n  }\n}\n\nexport type StreamBlobOptions = {\n  cid: string\n  did: string\n  acceptEncoding?: string\n  signal?: AbortSignal\n}\n\nexport type StreamBlobFactory = (\n  data: Dispatcher.StreamFactoryData,\n  info: {\n    url: URL\n    did: AtprotoDid\n    cid: Cid\n  },\n) => Writable\n\nexport async function streamBlob(\n  ctx: AppContext,\n  options: StreamBlobOptions,\n  factory: StreamBlobFactory,\n) {\n  const { did, cid } = parseBlobParams(options)\n  const url = await getBlobUrl(ctx.dataplane, did, cid)\n\n  const headers = getBlobHeaders(ctx.cfg, url)\n\n  headers.set(\n    'accept-encoding',\n    options.acceptEncoding ||\n      formatAcceptHeader(\n        ctx.cfg.proxyPreferCompressed\n          ? ACCEPT_ENCODING_COMPRESSED\n          : ACCEPT_ENCODING_UNCOMPRESSED,\n      ),\n  )\n\n  let headersReceived = false\n\n  return ctx.blobDispatcher\n    .stream(\n      {\n        method: 'GET',\n        origin: url.origin,\n        path: url.pathname + url.search,\n        headers,\n        signal: options.signal,\n        maxRedirections: 10,\n      },\n      (upstream) => {\n        headersReceived = true\n\n        if (upstream.statusCode !== 200) {\n          log.warn(\n            {\n              did,\n              cid: cid.toString(),\n              pds: url.origin,\n              status: upstream.statusCode,\n            },\n            `blob resolution failed upstream`,\n          )\n\n          throw upstream.statusCode >= 400 && upstream.statusCode < 500\n            ? createError(404, 'Blob not found', { cause: upstream }) // 4xx => 404\n            : createError(502, 'Upstream Error', { cause: upstream }) // !200 && !4xx => 502\n        }\n\n        return factory(upstream, { url, did, cid })\n      },\n    )\n    .catch((err) => {\n      // Is this a connection error, or a stream error ?\n      if (!headersReceived) {\n        // connection error, dns error, headers timeout, ...\n        log.warn(\n          { err, did, cid: cid.toString(), pds: url.origin },\n          'blob resolution failed during connection',\n        )\n\n        throw createError(502, 'Upstream Error', { cause: err })\n      }\n\n      throw err\n    })\n}\n\nfunction parseBlobParams(params: { cid: string; did: string }) {\n  const { cid, did } = params\n  if (!isAtprotoDid(did)) throw createError(400, 'Invalid did')\n  const cidObj = parseCid(cid)\n  if (!cidObj) throw createError(400, 'Invalid cid')\n  return { cid: cidObj, did }\n}\n\nasync function getBlobUrl(\n  dataplane: DataPlaneClient,\n  did: string,\n  cid: Cid,\n): Promise<URL> {\n  const pds = await getBlobPds(dataplane, did, cid)\n\n  const url = new URL(`/xrpc/com.atproto.sync.getBlob`, pds)\n  url.searchParams.set('did', did)\n  url.searchParams.set('cid', cid.toString())\n\n  return url\n}\n\nasync function getBlobPds(\n  dataplane: DataPlaneClient,\n  did: string,\n  cid: Cid,\n): Promise<string> {\n  const [identity, { takenDown }] = await Promise.all([\n    dataplane.getIdentityByDid({ did }).catch((err) => {\n      if (isDataplaneError(err, Code.NotFound)) {\n        return undefined\n      }\n      throw err\n    }),\n    dataplane.getBlobTakedown({ did, cid: cid.toString() }),\n  ])\n\n  if (takenDown) {\n    throw createError(404, 'Blob not found')\n  }\n\n  const services = identity && unpackIdentityServices(identity.services)\n  const pds =\n    services &&\n    getServiceEndpoint(services, {\n      id: 'atproto_pds',\n      type: 'AtprotoPersonalDataServer',\n    })\n\n  if (!pds) {\n    throw createError(404, 'Origin not found')\n  }\n\n  return pds\n}\n\nfunction getBlobHeaders(\n  {\n    blobRateLimitBypassKey: bypassKey,\n    blobRateLimitBypassHostname: bypassHostname,\n  }: ServerConfig,\n  url: URL,\n): Map<string, string> {\n  const headers = new Map<string, string>()\n\n  headers.set('user-agent', BSKY_USER_AGENT)\n\n  if (bypassKey && bypassHostname) {\n    const matchesUrl = bypassHostname.startsWith('.')\n      ? url.hostname.endsWith(bypassHostname)\n      : url.hostname === bypassHostname\n\n    if (matchesUrl) {\n      headers.set('x-ratelimit-bypass', bypassKey)\n    }\n  }\n\n  return headers\n}\n\n/**\n * This function creates a passthrough stream that will decompress (if needed)\n * and verify the CID of the input stream. The output data will be identical to\n * the input data.\n *\n * If you need the un-compressed data, you should use a decompress + verify\n * pipeline instead.\n */\nfunction createCidVerifier(cid: Cid, encoding?: string | string[]): Duplex {\n  // If the upstream content is compressed, we do not want to return a\n  // de-compressed stream here. Indeed, the \"compression\" middleware will\n  // compress the response before it is sent downstream, if it is not already\n  // compressed. Because of this, it is preferable to return the content as-is\n  // to avoid re-compressing it.\n  //\n  // We do still want to be able to verify the CID, which requires decompressing\n  // the input bytes.\n  //\n  // To that end, we create a passthrough in order to \"tee\" the stream into two\n  // streams: one that will be sent, unaltered, downstream, and a pipeline that\n  // will be used to decompress & verify the CID (discarding de-compressed\n  // data).\n\n  const decoders = createDecoders(encoding)\n  const verifier = new VerifyCidTransform(cid)\n\n  // Optimization: If the content is not compressed, we don't need to \"tee\" the\n  // stream, we can use the verifier as simple passthrough.\n  if (!decoders.length) return verifier\n\n  const pipelineController = new AbortController()\n  const pipelineStreams: Duplex[] = [...decoders, verifier]\n  const pipelineInput = pipelineStreams[0]!\n\n  // Create a promise that will resolve if, and only if, the decoding and\n  // verification succeed.\n  const pipelinePromise: Promise<null | Error> = pipeline(pipelineStreams, {\n    signal: pipelineController.signal,\n  }).then(\n    () => null,\n    (err) => {\n      const error = asError(err)\n\n      // the data being processed by the pipeline is invalid (e.g. invalid\n      // compressed content, non-matching the CID, ...). If that occurs, we can\n      // destroy the passthrough (this allows not to wait for the \"flush\" event\n      // to propagate the error).\n      passthrough.destroy(error)\n\n      return error\n    },\n  )\n\n  // We don't care about the un-compressed data, we only use the verifier to\n  // detect any error through the pipelinePromise. We still need to pass the\n  // verifier into flowing mode to ensure that the pipelinePromise resolves.\n  verifier.resume()\n\n  const passthrough = new Transform({\n    transform(chunk, encoding, callback) {\n      pipelineInput.write(chunk, encoding)\n      callback(null, chunk)\n    },\n    flush(callback) {\n      // End the input stream, which will resolve the pipeline promise\n      pipelineInput.end()\n      // End the pass-through stream according to the result of the pipeline\n      pipelinePromise.then(callback)\n    },\n    destroy(err, callback) {\n      pipelineController.abort() // Causes pipeline() to destroy all streams\n      callback(err)\n    },\n  })\n\n  return passthrough\n}\n\nfunction asError(err: unknown): Error {\n  return err instanceof Error\n    ? err\n    : new Error('Processing failed', { cause: err })\n}\n"]}
+{"version":3,"file":"blob-resolver.js","sourceRoot":"","sources":["../../src/api/blob-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,SAAS,EAAY,MAAM,aAAa,CAAA;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,WAAW,EAAE,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEtD,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,cAAc,GACf,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAc,YAAY,EAAE,MAAM,cAAc,CAAA;AAEvD,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,0BAA0B,CAAA;AAGjC,OAAO,EACL,IAAI,EAEJ,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,EAAE,UAAU,IAAI,GAAG,EAAE,MAAM,cAAc,CAAA;AAChD,OAAO,EAEL,oBAAoB,EACpB,cAAc,GACf,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAE3C,MAAM,UAAU,gBAAgB,CAAC,GAAe;IAC9C,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC9B,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO,IAAI,EAAE,CAAA;QAChE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,EAAE,CAAA;QACjD,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC/D,IAAI,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,EAAE,CAAA;QAEzD,oEAAoE;QACpE,6BAA6B;QAE7B,IAAI,CAAC;YACH,MAAM,aAAa,GAAsB;gBACvC,GAAG,EAAE,QAAQ;gBACb,GAAG,EAAE,QAAQ;gBACb,MAAM,EAAE,cAAc,CAAC,GAAG,CAAC;gBAC3B,mEAAmE;gBACnE,wEAAwE;gBACxE,0EAA0E;gBAC1E,cAAc,EAAE,2BAA2B,CACzC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAC9B,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAC9B;aACF,CAAA;YAED,MAAM,UAAU,CAAC,GAAG,EAAE,aAAa,EAAE,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE;gBACnE,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAA;gBACrD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;gBAEjD,MAAM,QAAQ,GAAG,CAAC,GAAY,EAAE,EAAE;oBAChC,GAAG,CAAC,IAAI,CACN,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,EAClD,4CAA4C,CAC7C,CAAA;gBACH,CAAC,CAAA;gBAED,MAAM,OAAO,GAAG,CAAC,GAAY,EAAE,EAAE;oBAC/B,kEAAkE;oBAClE,kEAAkE;oBAClE,oEAAoE;oBACpE,oEAAoE;oBACpE,YAAY,CAAC,UAAU,CAAC,CAAA;oBACxB,QAAQ,CAAC,GAAG,CAAC,CAAA;gBACf,CAAC,CAAA;gBAED,oEAAoE;gBACpE,mEAAmE;gBACnE,uBAAuB;gBACvB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;gBAE7B,sEAAsE;gBACtE,wEAAwE;gBACxE,uEAAuE;gBACvE,uEAAuE;gBACvE,qEAAqE;gBACrE,wEAAwE;gBACxE,sEAAsE;gBACtE,uEAAuE;gBACvE,qEAAqE;gBACrE,+CAA+C;gBAC/C,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE;oBACjC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;oBAE9B,oEAAoE;oBACpE,yDAAyD;oBACzD,GAAG,CAAC,SAAS,CACX,yBAAyB,EACzB,6BAA6B,CAC9B,CAAA;oBACD,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAA;oBAClD,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAA;oBACxC,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAA;oBAEtC,qCAAqC;oBACrC,6DAA6D;oBAE7D,oBAAoB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;oBAEnC,qEAAqE;oBACrE,mEAAmE;oBACnE,sEAAsE;oBACtE,qEAAqE;oBACrE,iEAAiE;oBACjE,oDAAoD;oBACpD,GAAG,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAA;oBAElC,oEAAoE;oBACpE,0DAA0D;oBAC1D,mEAAmE;oBACnE,qEAAqE;oBACrE,qEAAqE;oBACrE,gEAAgE;oBAChE,qEAAqE;oBACrE,QAAQ;oBACR,GAAG,CAAC,YAAY,EAAE,CAAA;oBAElB,kDAAkD;oBAClD,KAAK,QAAQ,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;gBAChD,CAAC,EAAE,EAAE,CAAC,CAAA,CAAC,8DAA8D;gBAErE,iDAAiD;gBACjD,OAAO,QAAQ,CAAA;YACjB,CAAC,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;gBACrC,GAAG,CAAC,OAAO,EAAE,CAAA;YACf,CAAC;iBAAM,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;gBACzC,sEAAsE;gBACtE,wCAAwC;gBACxC,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAA;YACrC,CAAC;iBAAM,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B,IAAI,CAAC,GAAG,CAAC,CAAA;YACX,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,gBAAgB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;YAC1D,CAAC;QACH,CAAC;IACH,CAAC,CAAA;AACH,CAAC;AAkBD,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAe,EACf,OAA0B,EAC1B,OAA0B;IAE1B,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;IAC7C,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IAErD,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAE5C,OAAO,CAAC,GAAG,CACT,iBAAiB,EACjB,OAAO,CAAC,cAAc;QACpB,kBAAkB,CAChB,GAAG,CAAC,GAAG,CAAC,qBAAqB;YAC3B,CAAC,CAAC,0BAA0B;YAC5B,CAAC,CAAC,4BAA4B,CACjC,CACJ,CAAA;IAED,IAAI,eAAe,GAAG,KAAK,CAAA;IAE3B,OAAO,GAAG,CAAC,cAAc;SACtB,MAAM,CACL;QACE,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,IAAI,EAAE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM;QAC/B,OAAO;QACP,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,eAAe,EAAE,EAAE;KACpB,EACD,CAAC,QAAQ,EAAE,EAAE;QACX,eAAe,GAAG,IAAI,CAAA;QAEtB,IAAI,QAAQ,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;YAChC,GAAG,CAAC,IAAI,CACN;gBACE,GAAG;gBACH,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE;gBACnB,GAAG,EAAE,GAAG,CAAC,MAAM;gBACf,MAAM,EAAE,QAAQ,CAAC,UAAU;aAC5B,EACD,iCAAiC,CAClC,CAAA;YAED,MAAM,QAAQ,CAAC,UAAU,IAAI,GAAG,IAAI,QAAQ,CAAC,UAAU,GAAG,GAAG;gBAC3D,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,gBAAgB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,aAAa;gBACvE,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,gBAAgB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA,CAAC,sBAAsB;QACpF,CAAC;QAED,OAAO,OAAO,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAA;IAC7C,CAAC,CACF;SACA,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACb,kDAAkD;QAClD,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,oDAAoD;YACpD,GAAG,CAAC,IAAI,CACN,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,EAClD,0CAA0C,CAC3C,CAAA;YAED,MAAM,WAAW,CAAC,GAAG,EAAE,gBAAgB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QAC1D,CAAC;QAED,MAAM,GAAG,CAAA;IACX,CAAC,CAAC,CAAA;AACN,CAAC;AAED,SAAS,eAAe,CAAC,MAAoC;IAC3D,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAA;IAC3B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;QAAE,MAAM,WAAW,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;IAC7D,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAA;IAC5B,IAAI,CAAC,MAAM;QAAE,MAAM,WAAW,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;IAClD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;AAC7B,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,SAA0B,EAC1B,GAAW,EACX,GAAQ;IAER,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IAEjD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,gCAAgC,EAAE,GAAG,CAAC,CAAA;IAC1D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IAChC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAA;IAE3C,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,SAA0B,EAC1B,GAAW,EACX,GAAQ;IAER,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAClD,SAAS,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAChD,IAAI,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzC,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC,CAAC;QACF,SAAS,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;KACxD,CAAC,CAAA;IAEF,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,WAAW,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAA;IAC1C,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,IAAI,sBAAsB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACtE,MAAM,GAAG,GACP,QAAQ;QACR,kBAAkB,CAAC,QAAQ,EAAE;YAC3B,EAAE,EAAE,aAAa;YACjB,IAAI,EAAE,2BAA2B;SAClC,CAAC,CAAA;IAEJ,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,WAAW,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAA;IAC5C,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,cAAc,CACrB,EACE,sBAAsB,EAAE,SAAS,EACjC,2BAA2B,EAAE,cAAc,GAC9B,EACf,GAAQ;IAER,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAA;IAEzC,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC,CAAA;IAE1C,IAAI,SAAS,IAAI,cAAc,EAAE,CAAC;QAChC,MAAM,UAAU,GAAG,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC;YAC/C,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC;YACvC,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,cAAc,CAAA;QAEnC,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,SAAS,CAAC,CAAA;QAC9C,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,iBAAiB,CAAC,GAAQ,EAAE,QAA4B;IAC/D,oEAAoE;IACpE,uEAAuE;IACvE,2EAA2E;IAC3E,4EAA4E;IAC5E,8BAA8B;IAC9B,EAAE;IACF,8EAA8E;IAC9E,mBAAmB;IACnB,EAAE;IACF,6EAA6E;IAC7E,6EAA6E;IAC7E,wEAAwE;IACxE,SAAS;IAET,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAA;IACzC,MAAM,QAAQ,GAAG,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAA;IAE5C,6EAA6E;IAC7E,yDAAyD;IACzD,IAAI,CAAC,QAAQ,CAAC,MAAM;QAAE,OAAO,QAAQ,CAAA;IAErC,MAAM,kBAAkB,GAAG,IAAI,eAAe,EAAE,CAAA;IAChD,MAAM,eAAe,GAAa,CAAC,GAAG,QAAQ,EAAE,QAAQ,CAAC,CAAA;IACzD,MAAM,aAAa,GAAG,eAAe,CAAC,CAAC,CAAE,CAAA;IAEzC,uEAAuE;IACvE,wBAAwB;IACxB,MAAM,eAAe,GAA0B,QAAQ,CAAC,eAAe,EAAE;QACvE,MAAM,EAAE,kBAAkB,CAAC,MAAM;KAClC,CAAC,CAAC,IAAI,CACL,GAAG,EAAE,CAAC,IAAI,EACV,CAAC,GAAG,EAAE,EAAE;QACN,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;QAE1B,oEAAoE;QACpE,yEAAyE;QACzE,yEAAyE;QACzE,2BAA2B;QAC3B,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAE1B,OAAO,KAAK,CAAA;IACd,CAAC,CACF,CAAA;IAED,0EAA0E;IAC1E,0EAA0E;IAC1E,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,EAAE,CAAA;IAEjB,MAAM,WAAW,GAAG,IAAI,SAAS,CAAC;QAChC,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ;YACjC,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;YACpC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QACvB,CAAC;QACD,KAAK,CAAC,QAAQ;YACZ,gEAAgE;YAChE,aAAa,CAAC,GAAG,EAAE,CAAA;YACnB,sEAAsE;YACtE,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAChC,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,QAAQ;YACnB,kBAAkB,CAAC,KAAK,EAAE,CAAA,CAAC,2CAA2C;YACtE,QAAQ,CAAC,GAAG,CAAC,CAAA;QACf,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,WAAW,CAAA;AACpB,CAAC;AAED,SAAS,OAAO,CAAC,GAAY;IAC3B,OAAO,GAAG,YAAY,KAAK;QACzB,CAAC,CAAC,GAAG;QACL,CAAC,CAAC,IAAI,KAAK,CAAC,mBAAmB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;AACpD,CAAC","sourcesContent":["import { Duplex, Transform, Writable } from 'node:stream'\nimport { pipeline } from 'node:stream/promises'\nimport createError, { isHttpError } from 'http-errors'\nimport { Dispatcher } from 'undici'\nimport {\n  VerifyCidError,\n  VerifyCidTransform,\n  createDecoders,\n} from '@atproto/common'\nimport { AtprotoDid, isAtprotoDid } from '@atproto/did'\nimport { Cid } from '@atproto/lex'\nimport {\n  ACCEPT_ENCODING_COMPRESSED,\n  ACCEPT_ENCODING_UNCOMPRESSED,\n  buildProxiedContentEncoding,\n  formatAcceptHeader,\n} from '@atproto-labs/xrpc-utils'\nimport { ServerConfig } from '../config.js'\nimport { AppContext } from '../context.js'\nimport {\n  Code,\n  DataPlaneClient,\n  getServiceEndpoint,\n  isDataplaneError,\n  unpackIdentityServices,\n} from '../data-plane/index.js'\nimport { parseCid } from '../hydration/util.js'\nimport { httpLogger as log } from '../logger.js'\nimport {\n  Middleware,\n  proxyResponseHeaders,\n  responseSignal,\n} from '../util/http.js'\nimport { BSKY_USER_AGENT } from './util.js'\n\nexport function createMiddleware(ctx: AppContext): Middleware {\n  return async (req, res, next) => {\n    if (req.method !== 'GET' && req.method !== 'HEAD') return next()\n    if (!req.url?.startsWith('/blob/')) return next()\n    const { length, 2: didParam, 3: cidParam } = req.url.split('/')\n    if (length !== 4 || !didParam || !cidParam) return next()\n\n    // @TODO Check sec-fetch-* headers (e.g. to prevent files from being\n    // displayed as a web page) ?\n\n    try {\n      const streamOptions: StreamBlobOptions = {\n        did: didParam,\n        cid: cidParam,\n        signal: responseSignal(res),\n        // Because we will be verifying the CID, we need to ensure that the\n        // upstream response can be de-compressed. We do this by negotiating the\n        // \"accept-encoding\" header based on the downstream client's capabilities.\n        acceptEncoding: buildProxiedContentEncoding(\n          req.headers['accept-encoding'],\n          ctx.cfg.proxyPreferCompressed,\n        ),\n      }\n\n      await streamBlob(ctx, streamOptions, (upstream, { cid, did, url }) => {\n        const encoding = upstream.headers['content-encoding']\n        const verifier = createCidVerifier(cid, encoding)\n\n        const logError = (err: unknown) => {\n          log.warn(\n            { err, did, cid: cid.toString(), pds: url.origin },\n            'blob resolution failed during transmission',\n          )\n        }\n\n        const onError = (err: unknown) => {\n          // No need to pipe the data (verifier) into the response, as it is\n          // \"errored\". The response processing will continue in the \"catch\"\n          // block below (because streamBlob() will reject the promise in case\n          // of \"error\" event on the writable stream returned by the factory).\n          clearTimeout(graceTimer)\n          logError(err)\n        }\n\n        // Catch any error that occurs before the timer bellow is triggered.\n        // The promise returned by streamBlob() will be rejected as soon as\n        // the verifier errors.\n        verifier.on('error', onError)\n\n        // The way I/O work, it is likely that, in case of small payloads, the\n        // full upstream response is already buffered at this point. In order to\n        // return a 404 instead of a broken response stream, we allow the event\n        // loop to to process any pending I/O events before we start piping the\n        // bytes to the response. For larger payloads, the response will look\n        // like a 200 with a broken chunked response stream. The only way around\n        // that would be to buffer the entire response before piping it to the\n        // response, which will hurt latency (need the full payload) and memory\n        // usage (either RAM or DISK). Since this is more of an edge case, we\n        // allow the broken response stream to be sent.\n        const graceTimer = setTimeout(() => {\n          verifier.off('error', onError)\n\n          // Make sure that the content served from the bsky api domain cannot\n          // be used to perform XSS attacks (by serving HTML pages)\n          res.setHeader(\n            'Content-Security-Policy',\n            `default-src 'none'; sandbox`,\n          )\n          res.setHeader('X-Content-Type-Options', 'nosniff')\n          res.setHeader('X-Frame-Options', 'DENY')\n          res.setHeader('X-XSS-Protection', '0')\n\n          // @TODO Add a cache-control header ?\n          // @TODO Add content-disposition header (to force download) ?\n\n          proxyResponseHeaders(upstream, res)\n\n          // Force chunked encoding. This is required because the verifier will\n          // trigger an error *after* the last chunk has been passed through.\n          // Because the number of bytes sent will match the content-length, the\n          // HTTP response will be considered \"complete\" by the HTTP server. At\n          // this point, only trailers headers could indicate that an error\n          // occurred, but that is not the behavior we expect.\n          res.removeHeader('content-length')\n\n          // From this point on, triggering the next middleware (including any\n          // error handler) can be problematic because content-type,\n          // content-encoding, etc. headers have already been set. Because of\n          // this, we make sure that res.headersSent is set to true, preventing\n          // another error handler middleware from being called (from the catch\n          // block bellow). Not flushing the headers here would require to\n          // revert the headers set from this middleware (which we don't do for\n          // now).\n          res.flushHeaders()\n\n          // Pipe the verifier output into the HTTP response\n          void pipeline([verifier, res]).catch(logError)\n        }, 10) // 0 works too. Allow for additional data to come in for 10ms.\n\n        // Write the upstream response into the verifier.\n        return verifier\n      })\n    } catch (err) {\n      if (res.headersSent || res.destroyed) {\n        res.destroy()\n      } else if (err instanceof VerifyCidError) {\n        // @NOTE This only works because of the graceTimer above. It will also\n        // only be triggered for small payloads.\n        next(createError(404, err.message))\n      } else if (isHttpError(err)) {\n        next(err)\n      } else {\n        next(createError(502, 'Upstream Error', { cause: err }))\n      }\n    }\n  }\n}\n\nexport type StreamBlobOptions = {\n  cid: string\n  did: string\n  acceptEncoding?: string\n  signal?: AbortSignal\n}\n\nexport type StreamBlobFactory = (\n  data: Dispatcher.StreamFactoryData,\n  info: {\n    url: URL\n    did: AtprotoDid\n    cid: Cid\n  },\n) => Writable\n\nexport async function streamBlob(\n  ctx: AppContext,\n  options: StreamBlobOptions,\n  factory: StreamBlobFactory,\n) {\n  const { did, cid } = parseBlobParams(options)\n  const url = await getBlobUrl(ctx.dataplane, did, cid)\n\n  const headers = getBlobHeaders(ctx.cfg, url)\n\n  headers.set(\n    'accept-encoding',\n    options.acceptEncoding ||\n      formatAcceptHeader(\n        ctx.cfg.proxyPreferCompressed\n          ? ACCEPT_ENCODING_COMPRESSED\n          : ACCEPT_ENCODING_UNCOMPRESSED,\n      ),\n  )\n\n  let headersReceived = false\n\n  return ctx.blobDispatcher\n    .stream(\n      {\n        method: 'GET',\n        origin: url.origin,\n        path: url.pathname + url.search,\n        headers,\n        signal: options.signal,\n        maxRedirections: 10,\n      },\n      (upstream) => {\n        headersReceived = true\n\n        if (upstream.statusCode !== 200) {\n          log.warn(\n            {\n              did,\n              cid: cid.toString(),\n              pds: url.origin,\n              status: upstream.statusCode,\n            },\n            `blob resolution failed upstream`,\n          )\n\n          throw upstream.statusCode >= 400 && upstream.statusCode < 500\n            ? createError(404, 'Blob not found', { cause: upstream }) // 4xx => 404\n            : createError(502, 'Upstream Error', { cause: upstream }) // !200 && !4xx => 502\n        }\n\n        return factory(upstream, { url, did, cid })\n      },\n    )\n    .catch((err) => {\n      // Is this a connection error, or a stream error ?\n      if (!headersReceived) {\n        // connection error, dns error, headers timeout, ...\n        log.warn(\n          { err, did, cid: cid.toString(), pds: url.origin },\n          'blob resolution failed during connection',\n        )\n\n        throw createError(502, 'Upstream Error', { cause: err })\n      }\n\n      throw err\n    })\n}\n\nfunction parseBlobParams(params: { cid: string; did: string }) {\n  const { cid, did } = params\n  if (!isAtprotoDid(did)) throw createError(400, 'Invalid did')\n  const cidObj = parseCid(cid)\n  if (!cidObj) throw createError(400, 'Invalid cid')\n  return { cid: cidObj, did }\n}\n\nasync function getBlobUrl(\n  dataplane: DataPlaneClient,\n  did: string,\n  cid: Cid,\n): Promise<URL> {\n  const pds = await getBlobPds(dataplane, did, cid)\n\n  const url = new URL(`/xrpc/com.atproto.sync.getBlob`, pds)\n  url.searchParams.set('did', did)\n  url.searchParams.set('cid', cid.toString())\n\n  return url\n}\n\nasync function getBlobPds(\n  dataplane: DataPlaneClient,\n  did: string,\n  cid: Cid,\n): Promise<string> {\n  const [identity, { takenDown }] = await Promise.all([\n    dataplane.getIdentityByDid({ did }).catch((err) => {\n      if (isDataplaneError(err, Code.NotFound)) {\n        return undefined\n      }\n      throw err\n    }),\n    dataplane.getBlobTakedown({ did, cid: cid.toString() }),\n  ])\n\n  if (takenDown) {\n    throw createError(404, 'Blob not found')\n  }\n\n  const services = identity && unpackIdentityServices(identity.services)\n  const pds =\n    services &&\n    getServiceEndpoint(services, {\n      id: 'atproto_pds',\n      type: 'AtprotoPersonalDataServer',\n    })\n\n  if (!pds) {\n    throw createError(404, 'Origin not found')\n  }\n\n  return pds\n}\n\nfunction getBlobHeaders(\n  {\n    blobRateLimitBypassKey: bypassKey,\n    blobRateLimitBypassHostname: bypassHostname,\n  }: ServerConfig,\n  url: URL,\n): Map<string, string> {\n  const headers = new Map<string, string>()\n\n  headers.set('user-agent', BSKY_USER_AGENT)\n\n  if (bypassKey && bypassHostname) {\n    const matchesUrl = bypassHostname.startsWith('.')\n      ? url.hostname.endsWith(bypassHostname)\n      : url.hostname === bypassHostname\n\n    if (matchesUrl) {\n      headers.set('x-ratelimit-bypass', bypassKey)\n    }\n  }\n\n  return headers\n}\n\n/**\n * This function creates a passthrough stream that will decompress (if needed)\n * and verify the CID of the input stream. The output data will be identical to\n * the input data.\n *\n * If you need the un-compressed data, you should use a decompress + verify\n * pipeline instead.\n */\nfunction createCidVerifier(cid: Cid, encoding?: string | string[]): Duplex {\n  // If the upstream content is compressed, we do not want to return a\n  // de-compressed stream here. Indeed, the \"compression\" middleware will\n  // compress the response before it is sent downstream, if it is not already\n  // compressed. Because of this, it is preferable to return the content as-is\n  // to avoid re-compressing it.\n  //\n  // We do still want to be able to verify the CID, which requires decompressing\n  // the input bytes.\n  //\n  // To that end, we create a passthrough in order to \"tee\" the stream into two\n  // streams: one that will be sent, unaltered, downstream, and a pipeline that\n  // will be used to decompress & verify the CID (discarding de-compressed\n  // data).\n\n  const decoders = createDecoders(encoding)\n  const verifier = new VerifyCidTransform(cid)\n\n  // Optimization: If the content is not compressed, we don't need to \"tee\" the\n  // stream, we can use the verifier as simple passthrough.\n  if (!decoders.length) return verifier\n\n  const pipelineController = new AbortController()\n  const pipelineStreams: Duplex[] = [...decoders, verifier]\n  const pipelineInput = pipelineStreams[0]!\n\n  // Create a promise that will resolve if, and only if, the decoding and\n  // verification succeed.\n  const pipelinePromise: Promise<null | Error> = pipeline(pipelineStreams, {\n    signal: pipelineController.signal,\n  }).then(\n    () => null,\n    (err) => {\n      const error = asError(err)\n\n      // the data being processed by the pipeline is invalid (e.g. invalid\n      // compressed content, non-matching the CID, ...). If that occurs, we can\n      // destroy the passthrough (this allows not to wait for the \"flush\" event\n      // to propagate the error).\n      passthrough.destroy(error)\n\n      return error\n    },\n  )\n\n  // We don't care about the un-compressed data, we only use the verifier to\n  // detect any error through the pipelinePromise. We still need to pass the\n  // verifier into flowing mode to ensure that the pipelinePromise resolves.\n  verifier.resume()\n\n  const passthrough = new Transform({\n    transform(chunk, encoding, callback) {\n      pipelineInput.write(chunk, encoding)\n      callback(null, chunk)\n    },\n    flush(callback) {\n      // End the input stream, which will resolve the pipeline promise\n      pipelineInput.end()\n      // End the pass-through stream according to the result of the pipeline\n      pipelinePromise.then(callback)\n    },\n    destroy(err, callback) {\n      pipelineController.abort() // Causes pipeline() to destroy all streams\n      callback(err)\n    },\n  })\n\n  return passthrough\n}\n\nfunction asError(err: unknown): Error {\n  return err instanceof Error\n    ? err\n    : new Error('Processing failed', { cause: err })\n}\n"]}

package/dist/api/com/atproto/admin/getAccountInfos.d.ts

@@ -1,4 +1,4 @@
 import { Server } from '@atproto/xrpc-server';
-import { AppContext } from '../../../../context';
+import { AppContext } from '../../../../context.js';
 export default function (server: Server, ctx: AppContext): void;
 //# sourceMappingURL=getAccountInfos.d.ts.map

package/dist/api/com/atproto/admin/getAccountInfos.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getAccountInfos.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/admin/getAccountInfos.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAGhD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QA0CvD"}
+{"version":3,"file":"getAccountInfos.d.ts","sourceRoot":"","sources":["../../../../../src/api/com/atproto/admin/getAccountInfos.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAGnD,MAAM,CAAC,OAAO,WAAW,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,QA0CvD"}