@atproto/syntax 0.1.0

package/dist/index.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/index.ts", "../src/handle.ts", "../src/did.ts", "../src/nsid.ts", "../src/aturi_validation.ts", "../src/aturi.ts"],
+  "sourcesContent": ["export * from './handle'\nexport * from './did'\nexport * from './nsid'\nexport * from './aturi'\n", "export const INVALID_HANDLE = 'handle.invalid'\n\n// Currently these are registration-time restrictions, not protocol-level\n// restrictions. We have a couple accounts in the wild that we need to clean up\n// before hard-disallow.\n// See also: https://en.wikipedia.org/wiki/Top-level_domain#Reserved_domains\nexport const DISALLOWED_TLDS = [\n  '.local',\n  '.arpa',\n  '.invalid',\n  '.localhost',\n  '.internal',\n  // policy could concievably change on \".onion\" some day\n  '.onion',\n  // NOTE: .test is allowed in testing and devopment. In practical terms\n  // \"should\" \"never\" actually resolve and get registered in production\n]\n\n// Handle constraints, in English:\n//  - must be a possible domain name\n//    - RFC-1035 is commonly referenced, but has been updated. eg, RFC-3696,\n//      section 2. and RFC-3986, section 3. can now have leading numbers (eg,\n//      4chan.org)\n//    - \"labels\" (sub-names) are made of ASCII letters, digits, hyphens\n//    - can not start or end with a hyphen\n//    - TLD (last component) should not start with a digit\n//    - can't end with a hyphen (can end with digit)\n//    - each segment must be between 1 and 63 characters (not including any periods)\n//    - overall length can't be more than 253 characters\n//    - separated by (ASCII) periods; does not start or end with period\n//    - case insensitive\n//    - domains (handles) are equal if they are the same lower-case\n//    - punycode allowed for internationalization\n//  - no whitespace, null bytes, joining chars, etc\n//  - does not validate whether domain or TLD exists, or is a reserved or\n//    special TLD (eg, .onion or .local)\n//  - does not validate punycode\nexport const ensureValidHandle = (handle: string): void => {\n  // check that all chars are boring ASCII\n  if (!/^[a-zA-Z0-9.-]*$/.test(handle)) {\n    throw new InvalidHandleError(\n      'Disallowed characters in handle (ASCII letters, digits, dashes, periods only)',\n    )\n  }\n\n  if (handle.length > 253) {\n    throw new InvalidHandleError('Handle is too long (253 chars max)')\n  }\n  const labels = handle.split('.')\n  if (labels.length < 2) {\n    throw new InvalidHandleError('Handle domain needs at least two parts')\n  }\n  for (let i = 0; i < labels.length; i++) {\n    const l = labels[i]\n    if (l.length < 1) {\n      throw new InvalidHandleError('Handle parts can not be empty')\n    }\n    if (l.length > 63) {\n      throw new InvalidHandleError('Handle part too long (max 63 chars)')\n    }\n    if (l.endsWith('-') || l.startsWith('-')) {\n      throw new InvalidHandleError(\n        'Handle parts can not start or end with hyphens',\n      )\n    }\n    if (i + 1 == labels.length && !/^[a-zA-Z]/.test(l)) {\n      throw new InvalidHandleError(\n        'Handle final component (TLD) must start with ASCII letter',\n      )\n    }\n  }\n}\n\n// simple regex translation of above constraints\nexport const ensureValidHandleRegex = (handle: string): void => {\n  if (\n    !/^([a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\\.)+[a-zA-Z]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?$/.test(\n      handle,\n    )\n  ) {\n    throw new InvalidHandleError(\"Handle didn't validate via regex\")\n  }\n  if (handle.length > 253) {\n    throw new InvalidHandleError('Handle is too long (253 chars max)')\n  }\n}\n\nexport const normalizeHandle = (handle: string): string => {\n  return handle.toLowerCase()\n}\n\nexport const normalizeAndEnsureValidHandle = (handle: string): string => {\n  const normalized = normalizeHandle(handle)\n  ensureValidHandle(normalized)\n  return normalized\n}\n\nexport const isValidHandle = (handle: string): boolean => {\n  try {\n    ensureValidHandle(handle)\n  } catch (err) {\n    if (err instanceof InvalidHandleError) {\n      return false\n    }\n    throw err\n  }\n\n  return true\n}\n\nexport const isValidTld = (handle: string): boolean => {\n  return !DISALLOWED_TLDS.some((domain) => handle.endsWith(domain))\n}\n\nexport class InvalidHandleError extends Error {}\nexport class ReservedHandleError extends Error {}\nexport class UnsupportedDomainError extends Error {}\nexport class DisallowedDomainError extends Error {}\n", "// Human-readable constraints:\n//   - valid W3C DID (https://www.w3.org/TR/did-core/#did-syntax)\n//      - entire URI is ASCII: [a-zA-Z0-9._:%-]\n//      - always starts \"did:\" (lower-case)\n//      - method name is one or more lower-case letters, followed by \":\"\n//      - remaining identifier can have any of the above chars, but can not end in \":\"\n//      - it seems that a bunch of \":\" can be included, and don't need spaces between\n//      - \"%\" is used only for \"percent encoding\" and must be followed by two hex characters (and thus can't end in \"%\")\n//      - query (\"?\") and fragment (\"#\") stuff is defined for \"DID URIs\", but not as part of identifier itself\n//      - \"The current specification does not take a position on the maximum length of a DID\"\n//   - in current atproto, only allowing did:plc and did:web. But not *forcing* this at lexicon layer\n//   - hard length limit of 8KBytes\n//   - not going to validate \"percent encoding\" here\nexport const ensureValidDid = (did: string): void => {\n  // check that all chars are boring ASCII\n  if (!/^[a-zA-Z0-9._:%-]*$/.test(did)) {\n    throw new InvalidDidError(\n      'Disallowed characters in DID (ASCII letters, digits, and a couple other characters only)',\n    )\n  }\n\n  const parts = did.split(':')\n  if (parts.length < 3) {\n    throw new InvalidDidError(\n      'DID requires prefix, method, and method-specific content',\n    )\n  }\n\n  if (parts[0] != 'did') {\n    throw new InvalidDidError('DID requires \"did:\" prefix')\n  }\n\n  if (!/^[a-z]+$/.test(parts[1])) {\n    throw new InvalidDidError('DID method must be lower-case letters')\n  }\n\n  if (did.endsWith(':') || did.endsWith('%')) {\n    throw new InvalidDidError('DID can not end with \":\" or \"%\"')\n  }\n\n  if (did.length > 2 * 1024) {\n    throw new InvalidDidError('DID is too long (2048 chars max)')\n  }\n}\n\nexport const ensureValidDidRegex = (did: string): void => {\n  // simple regex to enforce most constraints via just regex and length.\n  // hand wrote this regex based on above constraints\n  if (!/^did:[a-z]+:[a-zA-Z0-9._:%-]*[a-zA-Z0-9._-]$/.test(did)) {\n    throw new InvalidDidError(\"DID didn't validate via regex\")\n  }\n\n  if (did.length > 2 * 1024) {\n    throw new InvalidDidError('DID is too long (2048 chars max)')\n  }\n}\n\nexport class InvalidDidError extends Error {}\n", "/*\nGrammar:\n\nalpha     = \"a\" / \"b\" / \"c\" / \"d\" / \"e\" / \"f\" / \"g\" / \"h\" / \"i\" / \"j\" / \"k\" / \"l\" / \"m\" / \"n\" / \"o\" / \"p\" / \"q\" / \"r\" / \"s\" / \"t\" / \"u\" / \"v\" / \"w\" / \"x\" / \"y\" / \"z\" / \"A\" / \"B\" / \"C\" / \"D\" / \"E\" / \"F\" / \"G\" / \"H\" / \"I\" / \"J\" / \"K\" / \"L\" / \"M\" / \"N\" / \"O\" / \"P\" / \"Q\" / \"R\" / \"S\" / \"T\" / \"U\" / \"V\" / \"W\" / \"X\" / \"Y\" / \"Z\"\nnumber    = \"1\" / \"2\" / \"3\" / \"4\" / \"5\" / \"6\" / \"7\" / \"8\" / \"9\" / \"0\"\ndelim     = \".\"\nsegment   = alpha *( alpha / number / \"-\" )\nauthority = segment *( delim segment )\nname      = alpha *( alpha )\nnsid      = authority delim name\n\n*/\n\nexport class NSID {\n  segments: string[] = []\n\n  static parse(nsid: string): NSID {\n    return new NSID(nsid)\n  }\n\n  static create(authority: string, name: string): NSID {\n    const segments = [...authority.split('.').reverse(), name].join('.')\n    return new NSID(segments)\n  }\n\n  static isValid(nsid: string): boolean {\n    try {\n      NSID.parse(nsid)\n      return true\n    } catch (e) {\n      return false\n    }\n  }\n\n  constructor(nsid: string) {\n    ensureValidNsid(nsid)\n    this.segments = nsid.split('.')\n  }\n\n  get authority() {\n    return this.segments\n      .slice(0, this.segments.length - 1)\n      .reverse()\n      .join('.')\n  }\n\n  get name() {\n    return this.segments.at(this.segments.length - 1)\n  }\n\n  toString() {\n    return this.segments.join('.')\n  }\n}\n\n// Human readable constraints on NSID:\n// - a valid domain in reversed notation\n// - followed by an additional period-separated name, which is camel-case letters\nexport const ensureValidNsid = (nsid: string): void => {\n  const toCheck = nsid\n\n  // check that all chars are boring ASCII\n  if (!/^[a-zA-Z0-9.-]*$/.test(toCheck)) {\n    throw new InvalidNsidError(\n      'Disallowed characters in NSID (ASCII letters, digits, dashes, periods only)',\n    )\n  }\n\n  if (toCheck.length > 253 + 1 + 63) {\n    throw new InvalidNsidError('NSID is too long (317 chars max)')\n  }\n  const labels = toCheck.split('.')\n  if (labels.length < 3) {\n    throw new InvalidNsidError('NSID needs at least three parts')\n  }\n  for (let i = 0; i < labels.length; i++) {\n    const l = labels[i]\n    if (l.length < 1) {\n      throw new InvalidNsidError('NSID parts can not be empty')\n    }\n    if (l.length > 63) {\n      throw new InvalidNsidError('NSID part too long (max 63 chars)')\n    }\n    if (l.endsWith('-') || l.startsWith('-')) {\n      throw new InvalidNsidError('NSID parts can not start or end with hyphen')\n    }\n    if (/^[0-9]/.test(l) && i == 0) {\n      throw new InvalidNsidError('NSID first part may not start with a digit')\n    }\n    if (!/^[a-zA-Z]+$/.test(l) && i + 1 == labels.length) {\n      throw new InvalidNsidError('NSID name part must be only letters')\n    }\n  }\n}\n\nexport const ensureValidNsidRegex = (nsid: string): void => {\n  // simple regex to enforce most constraints via just regex and length.\n  // hand wrote this regex based on above constraints\n  if (\n    !/^[a-zA-Z]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)+(\\.[a-zA-Z]([a-zA-Z]{0,61}[a-zA-Z])?)$/.test(\n      nsid,\n    )\n  ) {\n    throw new InvalidNsidError(\"NSID didn't validate via regex\")\n  }\n  if (nsid.length > 253 + 1 + 63) {\n    throw new InvalidNsidError('NSID is too long (317 chars max)')\n  }\n}\n\nexport class InvalidNsidError extends Error {}\n", "import { ensureValidHandle, ensureValidHandleRegex } from './handle'\nimport { ensureValidDid, ensureValidDidRegex } from './did'\nimport { ensureValidNsid, ensureValidNsidRegex } from './nsid'\n\n// Human-readable constraints on ATURI:\n//   - following regular URLs, a 8KByte hard total length limit\n//   - follows ATURI docs on website\n//      - all ASCII characters, no whitespace. non-ASCII could be URL-encoded\n//      - starts \"at://\"\n//      - \"authority\" is a valid DID or a valid handle\n//      - optionally, follow \"authority\" with \"/\" and valid NSID as start of path\n//      - optionally, if NSID given, follow that with \"/\" and rkey\n//      - rkey path component can include URL-encoded (\"percent encoded\"), or:\n//          ALPHA / DIGIT / \"-\" / \".\" / \"_\" / \"~\" / \":\" / \"@\" / \"!\" / \"$\" / \"&\" / \"'\" / \"(\" / \")\" / \"*\" / \"+\" / \",\" / \";\" / \"=\"\n//          [a-zA-Z0-9._~:@!$&'\\(\\)*+,;=-]\n//      - rkey must have at least one char\n//      - regardless of path component, a fragment can follow  as \"#\" and then a JSON pointer (RFC-6901)\nexport const ensureValidAtUri = (uri: string) => {\n  // JSON pointer is pretty different from rest of URI, so split that out first\n  const uriParts = uri.split('#')\n  if (uriParts.length > 2) {\n    throw new Error('ATURI can have at most one \"#\", separating fragment out')\n  }\n  const fragmentPart = uriParts[1] || null\n  uri = uriParts[0]\n\n  // check that all chars are boring ASCII\n  if (!/^[a-zA-Z0-9._~:@!$&')(*+,;=%/-]*$/.test(uri)) {\n    throw new Error('Disallowed characters in ATURI (ASCII)')\n  }\n\n  const parts = uri.split('/')\n  if (parts.length >= 3 && (parts[0] != 'at:' || parts[1].length != 0)) {\n    throw new Error('ATURI must start with \"at://\"')\n  }\n  if (parts.length < 3) {\n    throw new Error('ATURI requires at least method and authority sections')\n  }\n\n  try {\n    ensureValidHandle(parts[2])\n  } catch {\n    try {\n      ensureValidDid(parts[2])\n    } catch {\n      throw new Error('ATURI authority must be a valid handle or DID')\n    }\n  }\n\n  if (parts.length >= 4) {\n    if (parts[3].length == 0) {\n      throw new Error(\n        'ATURI can not have a slash after authority without a path segment',\n      )\n    }\n    try {\n      ensureValidNsid(parts[3])\n    } catch {\n      throw new Error(\n        'ATURI requires first path segment (if supplied) to be valid NSID',\n      )\n    }\n  }\n\n  if (parts.length >= 5) {\n    if (parts[4].length == 0) {\n      throw new Error(\n        'ATURI can not have a slash after collection, unless record key is provided',\n      )\n    }\n    // would validate rkey here, but there are basically no constraints!\n  }\n\n  if (parts.length >= 6) {\n    throw new Error(\n      'ATURI path can have at most two parts, and no trailing slash',\n    )\n  }\n\n  if (uriParts.length >= 2 && fragmentPart == null) {\n    throw new Error('ATURI fragment must be non-empty and start with slash')\n  }\n\n  if (fragmentPart != null) {\n    if (fragmentPart.length == 0 || fragmentPart[0] != '/') {\n      throw new Error('ATURI fragment must be non-empty and start with slash')\n    }\n    // NOTE: enforcing *some* checks here for sanity. Eg, at least no whitespace\n    if (!/^\\/[a-zA-Z0-9._~:@!$&')(*+,;=%[\\]/-]*$/.test(fragmentPart)) {\n      throw new Error('Disallowed characters in ATURI fragment (ASCII)')\n    }\n  }\n\n  if (uri.length > 8 * 1024) {\n    throw new Error('ATURI is far too long')\n  }\n}\n\nexport const ensureValidAtUriRegex = (uri: string): void => {\n  // simple regex to enforce most constraints via just regex and length.\n  // hand wrote this regex based on above constraints. whew!\n  const aturiRegex =\n    /^at:\\/\\/(?<authority>[a-zA-Z0-9._:%-]+)(\\/(?<collection>[a-zA-Z0-9-.]+)(\\/(?<rkey>[a-zA-Z0-9._~:@!$&%')(*+,;=-]+))?)?(#(?<fragment>\\/[a-zA-Z0-9._~:@!$&%')(*+,;=\\-[\\]/\\\\]*))?$/\n  const rm = uri.match(aturiRegex)\n  if (!rm || !rm.groups) {\n    throw new Error(\"ATURI didn't validate via regex\")\n  }\n  const groups = rm.groups\n\n  try {\n    ensureValidHandleRegex(groups.authority)\n  } catch {\n    try {\n      ensureValidDidRegex(groups.authority)\n    } catch {\n      throw new Error('ATURI authority must be a valid handle or DID')\n    }\n  }\n\n  if (groups.collection) {\n    try {\n      ensureValidNsidRegex(groups.collection)\n    } catch {\n      throw new Error('ATURI collection path segment must be a valid NSID')\n    }\n  }\n\n  if (uri.length > 8 * 1024) {\n    throw new Error('ATURI is far too long')\n  }\n}\n", "export * from './aturi_validation'\n\nexport const ATP_URI_REGEX =\n  // proto-    --did--------------   --name----------------   --path----   --query--   --hash--\n  /^(at:\\/\\/)?((?:did:[a-z0-9:%-]+)|(?:[a-z0-9][a-z0-9.:-]*))(\\/[^?#\\s]*)?(\\?[^#\\s]+)?(#[^\\s]+)?$/i\n//                       --path-----   --query--  --hash--\nconst RELATIVE_REGEX = /^(\\/[^?#\\s]*)?(\\?[^#\\s]+)?(#[^\\s]+)?$/i\n\nexport class AtUri {\n  hash: string\n  host: string\n  pathname: string\n  searchParams: URLSearchParams\n\n  constructor(uri: string, base?: string) {\n    let parsed\n    if (base) {\n      parsed = parse(base)\n      if (!parsed) {\n        throw new Error(`Invalid at uri: ${base}`)\n      }\n      const relativep = parseRelative(uri)\n      if (!relativep) {\n        throw new Error(`Invalid path: ${uri}`)\n      }\n      Object.assign(parsed, relativep)\n    } else {\n      parsed = parse(uri)\n      if (!parsed) {\n        throw new Error(`Invalid at uri: ${uri}`)\n      }\n    }\n\n    this.hash = parsed.hash\n    this.host = parsed.host\n    this.pathname = parsed.pathname\n    this.searchParams = parsed.searchParams\n  }\n\n  static make(handleOrDid: string, collection?: string, rkey?: string) {\n    let str = handleOrDid\n    if (collection) str += '/' + collection\n    if (rkey) str += '/' + rkey\n    return new AtUri(str)\n  }\n\n  get protocol() {\n    return 'at:'\n  }\n\n  get origin() {\n    return `at://${this.host}`\n  }\n\n  get hostname() {\n    return this.host\n  }\n\n  set hostname(v: string) {\n    this.host = v\n  }\n\n  get search() {\n    return this.searchParams.toString()\n  }\n\n  set search(v: string) {\n    this.searchParams = new URLSearchParams(v)\n  }\n\n  get collection() {\n    return this.pathname.split('/').filter(Boolean)[0] || ''\n  }\n\n  set collection(v: string) {\n    const parts = this.pathname.split('/').filter(Boolean)\n    parts[0] = v\n    this.pathname = parts.join('/')\n  }\n\n  get rkey() {\n    return this.pathname.split('/').filter(Boolean)[1] || ''\n  }\n\n  set rkey(v: string) {\n    const parts = this.pathname.split('/').filter(Boolean)\n    if (!parts[0]) parts[0] = 'undefined'\n    parts[1] = v\n    this.pathname = parts.join('/')\n  }\n\n  get href() {\n    return this.toString()\n  }\n\n  toString() {\n    let path = this.pathname || '/'\n    if (!path.startsWith('/')) {\n      path = `/${path}`\n    }\n    let qs = this.searchParams.toString()\n    if (qs && !qs.startsWith('?')) {\n      qs = `?${qs}`\n    }\n    let hash = this.hash\n    if (hash && !hash.startsWith('#')) {\n      hash = `#${hash}`\n    }\n    return `at://${this.host}${path}${qs}${hash}`\n  }\n}\n\nfunction parse(str: string) {\n  const match = ATP_URI_REGEX.exec(str)\n  if (match) {\n    return {\n      hash: match[5] || '',\n      host: match[2] || '',\n      pathname: match[3] || '',\n      searchParams: new URLSearchParams(match[4] || ''),\n    }\n  }\n  return undefined\n}\n\nfunction parseRelative(str: string) {\n  const match = RELATIVE_REGEX.exec(str)\n  if (match) {\n    return {\n      hash: match[3] || '',\n      pathname: match[1] || '',\n      searchParams: new URLSearchParams(match[2] || ''),\n    }\n  }\n  return undefined\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAO,IAAM,iBAAiB;AAMvB,IAAM,kBAAkB;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAGF;AAqBO,IAAM,oBAAoB,CAAC,WAAyB;AAEzD,MAAI,CAAC,mBAAmB,KAAK,MAAM,GAAG;AACpC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,MAAI,OAAO,SAAS,KAAK;AACvB,UAAM,IAAI,mBAAmB,oCAAoC;AAAA,EACnE;AACA,QAAM,SAAS,OAAO,MAAM,GAAG;AAC/B,MAAI,OAAO,SAAS,GAAG;AACrB,UAAM,IAAI,mBAAmB,wCAAwC;AAAA,EACvE;AACA,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,UAAM,IAAI,OAAO;AACjB,QAAI,EAAE,SAAS,GAAG;AAChB,YAAM,IAAI,mBAAmB,+BAA+B;AAAA,IAC9D;AACA,QAAI,EAAE,SAAS,IAAI;AACjB,YAAM,IAAI,mBAAmB,qCAAqC;AAAA,IACpE;AACA,QAAI,EAAE,SAAS,GAAG,KAAK,EAAE,WAAW,GAAG,GAAG;AACxC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,IAAI,KAAK,OAAO,UAAU,CAAC,YAAY,KAAK,CAAC,GAAG;AAClD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAGO,IAAM,yBAAyB,CAAC,WAAyB;AAC9D,MACE,CAAC,6FAA6F;AAAA,IAC5F;AAAA,EACF,GACA;AACA,UAAM,IAAI,mBAAmB,kCAAkC;AAAA,EACjE;AACA,MAAI,OAAO,SAAS,KAAK;AACvB,UAAM,IAAI,mBAAmB,oCAAoC;AAAA,EACnE;AACF;AAEO,IAAM,kBAAkB,CAAC,WAA2B;AACzD,SAAO,OAAO,YAAY;AAC5B;AAEO,IAAM,gCAAgC,CAAC,WAA2B;AACvE,QAAM,aAAa,gBAAgB,MAAM;AACzC,oBAAkB,UAAU;AAC5B,SAAO;AACT;AAEO,IAAM,gBAAgB,CAAC,WAA4B;AACxD,MAAI;AACF,sBAAkB,MAAM;AAAA,EAC1B,SAAS,KAAP;AACA,QAAI,eAAe,oBAAoB;AACrC,aAAO;AAAA,IACT;AACA,UAAM;AAAA,EACR;AAEA,SAAO;AACT;AAEO,IAAM,aAAa,CAAC,WAA4B;AACrD,SAAO,CAAC,gBAAgB,KAAK,CAAC,WAAW,OAAO,SAAS,MAAM,CAAC;AAClE;AAEO,IAAM,qBAAN,cAAiC,MAAM;AAAC;AACxC,IAAM,sBAAN,cAAkC,MAAM;AAAC;AACzC,IAAM,yBAAN,cAAqC,MAAM;AAAC;AAC5C,IAAM,wBAAN,cAAoC,MAAM;AAAC;;;ACxG3C,IAAM,iBAAiB,CAAC,QAAsB;AAEnD,MAAI,CAAC,sBAAsB,KAAK,GAAG,GAAG;AACpC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,QAAQ,IAAI,MAAM,GAAG;AAC3B,MAAI,MAAM,SAAS,GAAG;AACpB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,MAAI,MAAM,MAAM,OAAO;AACrB,UAAM,IAAI,gBAAgB,4BAA4B;AAAA,EACxD;AAEA,MAAI,CAAC,WAAW,KAAK,MAAM,EAAE,GAAG;AAC9B,UAAM,IAAI,gBAAgB,uCAAuC;AAAA,EACnE;AAEA,MAAI,IAAI,SAAS,GAAG,KAAK,IAAI,SAAS,GAAG,GAAG;AAC1C,UAAM,IAAI,gBAAgB,iCAAiC;AAAA,EAC7D;AAEA,MAAI,IAAI,SAAS,IAAI,MAAM;AACzB,UAAM,IAAI,gBAAgB,kCAAkC;AAAA,EAC9D;AACF;AAEO,IAAM,sBAAsB,CAAC,QAAsB;AAGxD,MAAI,CAAC,+CAA+C,KAAK,GAAG,GAAG;AAC7D,UAAM,IAAI,gBAAgB,+BAA+B;AAAA,EAC3D;AAEA,MAAI,IAAI,SAAS,IAAI,MAAM;AACzB,UAAM,IAAI,gBAAgB,kCAAkC;AAAA,EAC9D;AACF;AAEO,IAAM,kBAAN,cAA8B,MAAM;AAAC;;;AC5CrC,IAAM,OAAN,MAAW;AAAA,EAqBhB,YAAY,MAAc;AApB1B,oBAAqB,CAAC;AAqBpB,oBAAgB,IAAI;AACpB,SAAK,WAAW,KAAK,MAAM,GAAG;AAAA,EAChC;AAAA,EArBA,OAAO,MAAM,MAAoB;AAC/B,WAAO,IAAI,KAAK,IAAI;AAAA,EACtB;AAAA,EAEA,OAAO,OAAO,WAAmB,MAAoB;AACnD,UAAM,WAAW,CAAC,GAAG,UAAU,MAAM,GAAG,EAAE,QAAQ,GAAG,IAAI,EAAE,KAAK,GAAG;AACnE,WAAO,IAAI,KAAK,QAAQ;AAAA,EAC1B;AAAA,EAEA,OAAO,QAAQ,MAAuB;AACpC,QAAI;AACF,WAAK,MAAM,IAAI;AACf,aAAO;AAAA,IACT,SAAS,GAAP;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAOA,IAAI,YAAY;AACd,WAAO,KAAK,SACT,MAAM,GAAG,KAAK,SAAS,SAAS,CAAC,EACjC,QAAQ,EACR,KAAK,GAAG;AAAA,EACb;AAAA,EAEA,IAAI,OAAO;AACT,WAAO,KAAK,SAAS,GAAG,KAAK,SAAS,SAAS,CAAC;AAAA,EAClD;AAAA,EAEA,WAAW;AACT,WAAO,KAAK,SAAS,KAAK,GAAG;AAAA,EAC/B;AACF;AAKO,IAAM,kBAAkB,CAAC,SAAuB;AACrD,QAAM,UAAU;AAGhB,MAAI,CAAC,mBAAmB,KAAK,OAAO,GAAG;AACrC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,MAAI,QAAQ,SAAS,MAAM,IAAI,IAAI;AACjC,UAAM,IAAI,iBAAiB,kCAAkC;AAAA,EAC/D;AACA,QAAM,SAAS,QAAQ,MAAM,GAAG;AAChC,MAAI,OAAO,SAAS,GAAG;AACrB,UAAM,IAAI,iBAAiB,iCAAiC;AAAA,EAC9D;AACA,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,UAAM,IAAI,OAAO;AACjB,QAAI,EAAE,SAAS,GAAG;AAChB,YAAM,IAAI,iBAAiB,6BAA6B;AAAA,IAC1D;AACA,QAAI,EAAE,SAAS,IAAI;AACjB,YAAM,IAAI,iBAAiB,mCAAmC;AAAA,IAChE;AACA,QAAI,EAAE,SAAS,GAAG,KAAK,EAAE,WAAW,GAAG,GAAG;AACxC,YAAM,IAAI,iBAAiB,6CAA6C;AAAA,IAC1E;AACA,QAAI,SAAS,KAAK,CAAC,KAAK,KAAK,GAAG;AAC9B,YAAM,IAAI,iBAAiB,4CAA4C;AAAA,IACzE;AACA,QAAI,CAAC,cAAc,KAAK,CAAC,KAAK,IAAI,KAAK,OAAO,QAAQ;AACpD,YAAM,IAAI,iBAAiB,qCAAqC;AAAA,IAClE;AAAA,EACF;AACF;AAEO,IAAM,uBAAuB,CAAC,SAAuB;AAG1D,MACE,CAAC,kIAAkI;AAAA,IACjI;AAAA,EACF,GACA;AACA,UAAM,IAAI,iBAAiB,gCAAgC;AAAA,EAC7D;AACA,MAAI,KAAK,SAAS,MAAM,IAAI,IAAI;AAC9B,UAAM,IAAI,iBAAiB,kCAAkC;AAAA,EAC/D;AACF;AAEO,IAAM,mBAAN,cAA+B,MAAM;AAAC;;;AC7FtC,IAAM,mBAAmB,CAAC,QAAgB;AAE/C,QAAM,WAAW,IAAI,MAAM,GAAG;AAC9B,MAAI,SAAS,SAAS,GAAG;AACvB,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACA,QAAM,eAAe,SAAS,MAAM;AACpC,QAAM,SAAS;AAGf,MAAI,CAAC,oCAAoC,KAAK,GAAG,GAAG;AAClD,UAAM,IAAI,MAAM,wCAAwC;AAAA,EAC1D;AAEA,QAAM,QAAQ,IAAI,MAAM,GAAG;AAC3B,MAAI,MAAM,UAAU,MAAM,MAAM,MAAM,SAAS,MAAM,GAAG,UAAU,IAAI;AACpE,UAAM,IAAI,MAAM,+BAA+B;AAAA,EACjD;AACA,MAAI,MAAM,SAAS,GAAG;AACpB,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AAEA,MAAI;AACF,sBAAkB,MAAM,EAAE;AAAA,EAC5B,QAAE;AACA,QAAI;AACF,qBAAe,MAAM,EAAE;AAAA,IACzB,QAAE;AACA,YAAM,IAAI,MAAM,+CAA+C;AAAA,IACjE;AAAA,EACF;AAEA,MAAI,MAAM,UAAU,GAAG;AACrB,QAAI,MAAM,GAAG,UAAU,GAAG;AACxB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI;AACF,sBAAgB,MAAM,EAAE;AAAA,IAC1B,QAAE;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,MAAI,MAAM,UAAU,GAAG;AACrB,QAAI,MAAM,GAAG,UAAU,GAAG;AACxB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EAEF;AAEA,MAAI,MAAM,UAAU,GAAG;AACrB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,MAAI,SAAS,UAAU,KAAK,gBAAgB,MAAM;AAChD,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AAEA,MAAI,gBAAgB,MAAM;AACxB,QAAI,aAAa,UAAU,KAAK,aAAa,MAAM,KAAK;AACtD,YAAM,IAAI,MAAM,uDAAuD;AAAA,IACzE;AAEA,QAAI,CAAC,yCAAyC,KAAK,YAAY,GAAG;AAChE,YAAM,IAAI,MAAM,iDAAiD;AAAA,IACnE;AAAA,EACF;AAEA,MAAI,IAAI,SAAS,IAAI,MAAM;AACzB,UAAM,IAAI,MAAM,uBAAuB;AAAA,EACzC;AACF;AAEO,IAAM,wBAAwB,CAAC,QAAsB;AAG1D,QAAM,aACJ;AACF,QAAM,KAAK,IAAI,MAAM,UAAU;AAC/B,MAAI,CAAC,MAAM,CAAC,GAAG,QAAQ;AACrB,UAAM,IAAI,MAAM,iCAAiC;AAAA,EACnD;AACA,QAAM,SAAS,GAAG;AAElB,MAAI;AACF,2BAAuB,OAAO,SAAS;AAAA,EACzC,QAAE;AACA,QAAI;AACF,0BAAoB,OAAO,SAAS;AAAA,IACtC,QAAE;AACA,YAAM,IAAI,MAAM,+CAA+C;AAAA,IACjE;AAAA,EACF;AAEA,MAAI,OAAO,YAAY;AACrB,QAAI;AACF,2BAAqB,OAAO,UAAU;AAAA,IACxC,QAAE;AACA,YAAM,IAAI,MAAM,oDAAoD;AAAA,IACtE;AAAA,EACF;AAEA,MAAI,IAAI,SAAS,IAAI,MAAM;AACzB,UAAM,IAAI,MAAM,uBAAuB;AAAA,EACzC;AACF;;;AChIO,IAAM,gBAEX;AAEF,IAAM,iBAAiB;AAEhB,IAAM,QAAN,MAAY;AAAA,EAMjB,YAAY,KAAa,MAAe;AACtC,QAAI;AACJ,QAAI,MAAM;AACR,eAAS,MAAM,IAAI;AACnB,UAAI,CAAC,QAAQ;AACX,cAAM,IAAI,MAAM,mBAAmB,MAAM;AAAA,MAC3C;AACA,YAAM,YAAY,cAAc,GAAG;AACnC,UAAI,CAAC,WAAW;AACd,cAAM,IAAI,MAAM,iBAAiB,KAAK;AAAA,MACxC;AACA,aAAO,OAAO,QAAQ,SAAS;AAAA,IACjC,OAAO;AACL,eAAS,MAAM,GAAG;AAClB,UAAI,CAAC,QAAQ;AACX,cAAM,IAAI,MAAM,mBAAmB,KAAK;AAAA,MAC1C;AAAA,IACF;AAEA,SAAK,OAAO,OAAO;AACnB,SAAK,OAAO,OAAO;AACnB,SAAK,WAAW,OAAO;AACvB,SAAK,eAAe,OAAO;AAAA,EAC7B;AAAA,EAEA,OAAO,KAAK,aAAqB,YAAqB,MAAe;AACnE,QAAI,MAAM;AACV,QAAI;AAAY,aAAO,MAAM;AAC7B,QAAI;AAAM,aAAO,MAAM;AACvB,WAAO,IAAI,MAAM,GAAG;AAAA,EACtB;AAAA,EAEA,IAAI,WAAW;AACb,WAAO;AAAA,EACT;AAAA,EAEA,IAAI,SAAS;AACX,WAAO,QAAQ,KAAK;AAAA,EACtB;AAAA,EAEA,IAAI,WAAW;AACb,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,IAAI,SAAS,GAAW;AACtB,SAAK,OAAO;AAAA,EACd;AAAA,EAEA,IAAI,SAAS;AACX,WAAO,KAAK,aAAa,SAAS;AAAA,EACpC;AAAA,EAEA,IAAI,OAAO,GAAW;AACpB,SAAK,eAAe,IAAI,gBAAgB,CAAC;AAAA,EAC3C;AAAA,EAEA,IAAI,aAAa;AACf,WAAO,KAAK,SAAS,MAAM,GAAG,EAAE,OAAO,OAAO,EAAE,MAAM;AAAA,EACxD;AAAA,EAEA,IAAI,WAAW,GAAW;AACxB,UAAM,QAAQ,KAAK,SAAS,MAAM,GAAG,EAAE,OAAO,OAAO;AACrD,UAAM,KAAK;AACX,SAAK,WAAW,MAAM,KAAK,GAAG;AAAA,EAChC;AAAA,EAEA,IAAI,OAAO;AACT,WAAO,KAAK,SAAS,MAAM,GAAG,EAAE,OAAO,OAAO,EAAE,MAAM;AAAA,EACxD;AAAA,EAEA,IAAI,KAAK,GAAW;AAClB,UAAM,QAAQ,KAAK,SAAS,MAAM,GAAG,EAAE,OAAO,OAAO;AACrD,QAAI,CAAC,MAAM;AAAI,YAAM,KAAK;AAC1B,UAAM,KAAK;AACX,SAAK,WAAW,MAAM,KAAK,GAAG;AAAA,EAChC;AAAA,EAEA,IAAI,OAAO;AACT,WAAO,KAAK,SAAS;AAAA,EACvB;AAAA,EAEA,WAAW;AACT,QAAI,OAAO,KAAK,YAAY;AAC5B,QAAI,CAAC,KAAK,WAAW,GAAG,GAAG;AACzB,aAAO,IAAI;AAAA,IACb;AACA,QAAI,KAAK,KAAK,aAAa,SAAS;AACpC,QAAI,MAAM,CAAC,GAAG,WAAW,GAAG,GAAG;AAC7B,WAAK,IAAI;AAAA,IACX;AACA,QAAI,OAAO,KAAK;AAChB,QAAI,QAAQ,CAAC,KAAK,WAAW,GAAG,GAAG;AACjC,aAAO,IAAI;AAAA,IACb;AACA,WAAO,QAAQ,KAAK,OAAO,OAAO,KAAK;AAAA,EACzC;AACF;AAEA,SAAS,MAAM,KAAa;AAC1B,QAAM,QAAQ,cAAc,KAAK,GAAG;AACpC,MAAI,OAAO;AACT,WAAO;AAAA,MACL,MAAM,MAAM,MAAM;AAAA,MAClB,MAAM,MAAM,MAAM;AAAA,MAClB,UAAU,MAAM,MAAM;AAAA,MACtB,cAAc,IAAI,gBAAgB,MAAM,MAAM,EAAE;AAAA,IAClD;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,cAAc,KAAa;AAClC,QAAM,QAAQ,eAAe,KAAK,GAAG;AACrC,MAAI,OAAO;AACT,WAAO;AAAA,MACL,MAAM,MAAM,MAAM;AAAA,MAClB,UAAU,MAAM,MAAM;AAAA,MACtB,cAAc,IAAI,gBAAgB,MAAM,MAAM,EAAE;AAAA,IAClD;AAAA,EACF;AACA,SAAO;AACT;",
+  "names": []
+}

package/dist/nsid.d.ts

@@ -0,0 +1,14 @@
+export declare class NSID {
+    segments: string[];
+    static parse(nsid: string): NSID;
+    static create(authority: string, name: string): NSID;
+    static isValid(nsid: string): boolean;
+    constructor(nsid: string);
+    get authority(): string;
+    get name(): string | undefined;
+    toString(): string;
+}
+export declare const ensureValidNsid: (nsid: string) => void;
+export declare const ensureValidNsidRegex: (nsid: string) => void;
+export declare class InvalidNsidError extends Error {
+}

package/jest.config.js

@@ -0,0 +1,6 @@
+const base = require('../../jest.config.base.js')
+
+module.exports = {
+  ...base,
+  displayName: 'Identifier',
+}

package/package.json

@@ -0,0 +1,32 @@
+{
+  "name": "@atproto/syntax",
+  "version": "0.1.0",
+  "main": "dist/index.js",
+  "scripts": {
+    "test": "jest",
+    "prettier": "prettier --check src/ tests/",
+    "prettier:fix": "prettier --write src/ tests/",
+    "lint": "eslint . --ext .ts,.tsx",
+    "lint:fix": "yarn lint --fix",
+    "verify": "run-p prettier lint",
+    "verify:fix": "yarn prettier:fix && yarn lint:fix",
+    "build": "node ./build.js",
+    "postbuild": "tsc --build tsconfig.build.json",
+    "update-main-to-dist": "node ./update-pkg.js --update-main-to-dist",
+    "update-main-to-src": "node ./update-pkg.js --update-main-to-src",
+    "prepublish": "npm run update-main-to-dist",
+    "postpublish": "npm run update-main-to-src"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/bluesky-social/atproto.git",
+    "directory": "packages/syntax"
+  },
+  "dependencies": {
+    "@atproto/common-web": "*"
+  },
+  "browser": {
+    "dns/promises": false
+  }
+}

package/src/aturi.ts

@@ -0,0 +1,136 @@
+export * from './aturi_validation'
+
+export const ATP_URI_REGEX =
+  // proto-    --did--------------   --name----------------   --path----   --query--   --hash--
+  /^(at:\/\/)?((?:did:[a-z0-9:%-]+)|(?:[a-z0-9][a-z0-9.:-]*))(\/[^?#\s]*)?(\?[^#\s]+)?(#[^\s]+)?$/i
+//                       --path-----   --query--  --hash--
+const RELATIVE_REGEX = /^(\/[^?#\s]*)?(\?[^#\s]+)?(#[^\s]+)?$/i
+
+export class AtUri {
+  hash: string
+  host: string
+  pathname: string
+  searchParams: URLSearchParams
+
+  constructor(uri: string, base?: string) {
+    let parsed
+    if (base) {
+      parsed = parse(base)
+      if (!parsed) {
+        throw new Error(`Invalid at uri: ${base}`)
+      }
+      const relativep = parseRelative(uri)
+      if (!relativep) {
+        throw new Error(`Invalid path: ${uri}`)
+      }
+      Object.assign(parsed, relativep)
+    } else {
+      parsed = parse(uri)
+      if (!parsed) {
+        throw new Error(`Invalid at uri: ${uri}`)
+      }
+    }
+
+    this.hash = parsed.hash
+    this.host = parsed.host
+    this.pathname = parsed.pathname
+    this.searchParams = parsed.searchParams
+  }
+
+  static make(handleOrDid: string, collection?: string, rkey?: string) {
+    let str = handleOrDid
+    if (collection) str += '/' + collection
+    if (rkey) str += '/' + rkey
+    return new AtUri(str)
+  }
+
+  get protocol() {
+    return 'at:'
+  }
+
+  get origin() {
+    return `at://${this.host}`
+  }
+
+  get hostname() {
+    return this.host
+  }
+
+  set hostname(v: string) {
+    this.host = v
+  }
+
+  get search() {
+    return this.searchParams.toString()
+  }
+
+  set search(v: string) {
+    this.searchParams = new URLSearchParams(v)
+  }
+
+  get collection() {
+    return this.pathname.split('/').filter(Boolean)[0] || ''
+  }
+
+  set collection(v: string) {
+    const parts = this.pathname.split('/').filter(Boolean)
+    parts[0] = v
+    this.pathname = parts.join('/')
+  }
+
+  get rkey() {
+    return this.pathname.split('/').filter(Boolean)[1] || ''
+  }
+
+  set rkey(v: string) {
+    const parts = this.pathname.split('/').filter(Boolean)
+    if (!parts[0]) parts[0] = 'undefined'
+    parts[1] = v
+    this.pathname = parts.join('/')
+  }
+
+  get href() {
+    return this.toString()
+  }
+
+  toString() {
+    let path = this.pathname || '/'
+    if (!path.startsWith('/')) {
+      path = `/${path}`
+    }
+    let qs = this.searchParams.toString()
+    if (qs && !qs.startsWith('?')) {
+      qs = `?${qs}`
+    }
+    let hash = this.hash
+    if (hash && !hash.startsWith('#')) {
+      hash = `#${hash}`
+    }
+    return `at://${this.host}${path}${qs}${hash}`
+  }
+}
+
+function parse(str: string) {
+  const match = ATP_URI_REGEX.exec(str)
+  if (match) {
+    return {
+      hash: match[5] || '',
+      host: match[2] || '',
+      pathname: match[3] || '',
+      searchParams: new URLSearchParams(match[4] || ''),
+    }
+  }
+  return undefined
+}
+
+function parseRelative(str: string) {
+  const match = RELATIVE_REGEX.exec(str)
+  if (match) {
+    return {
+      hash: match[3] || '',
+      pathname: match[1] || '',
+      searchParams: new URLSearchParams(match[2] || ''),
+    }
+  }
+  return undefined
+}

package/src/aturi_validation.ts

@@ -0,0 +1,131 @@
+import { ensureValidHandle, ensureValidHandleRegex } from './handle'
+import { ensureValidDid, ensureValidDidRegex } from './did'
+import { ensureValidNsid, ensureValidNsidRegex } from './nsid'
+
+// Human-readable constraints on ATURI:
+//   - following regular URLs, a 8KByte hard total length limit
+//   - follows ATURI docs on website
+//      - all ASCII characters, no whitespace. non-ASCII could be URL-encoded
+//      - starts "at://"
+//      - "authority" is a valid DID or a valid handle
+//      - optionally, follow "authority" with "/" and valid NSID as start of path
+//      - optionally, if NSID given, follow that with "/" and rkey
+//      - rkey path component can include URL-encoded ("percent encoded"), or:
+//          ALPHA / DIGIT / "-" / "." / "_" / "~" / ":" / "@" / "!" / "$" / "&" / "'" / "(" / ")" / "*" / "+" / "," / ";" / "="
+//          [a-zA-Z0-9._~:@!$&'\(\)*+,;=-]
+//      - rkey must have at least one char
+//      - regardless of path component, a fragment can follow  as "#" and then a JSON pointer (RFC-6901)
+export const ensureValidAtUri = (uri: string) => {
+  // JSON pointer is pretty different from rest of URI, so split that out first
+  const uriParts = uri.split('#')
+  if (uriParts.length > 2) {
+    throw new Error('ATURI can have at most one "#", separating fragment out')
+  }
+  const fragmentPart = uriParts[1] || null
+  uri = uriParts[0]
+
+  // check that all chars are boring ASCII
+  if (!/^[a-zA-Z0-9._~:@!$&')(*+,;=%/-]*$/.test(uri)) {
+    throw new Error('Disallowed characters in ATURI (ASCII)')
+  }
+
+  const parts = uri.split('/')
+  if (parts.length >= 3 && (parts[0] != 'at:' || parts[1].length != 0)) {
+    throw new Error('ATURI must start with "at://"')
+  }
+  if (parts.length < 3) {
+    throw new Error('ATURI requires at least method and authority sections')
+  }
+
+  try {
+    ensureValidHandle(parts[2])
+  } catch {
+    try {
+      ensureValidDid(parts[2])
+    } catch {
+      throw new Error('ATURI authority must be a valid handle or DID')
+    }
+  }
+
+  if (parts.length >= 4) {
+    if (parts[3].length == 0) {
+      throw new Error(
+        'ATURI can not have a slash after authority without a path segment',
+      )
+    }
+    try {
+      ensureValidNsid(parts[3])
+    } catch {
+      throw new Error(
+        'ATURI requires first path segment (if supplied) to be valid NSID',
+      )
+    }
+  }
+
+  if (parts.length >= 5) {
+    if (parts[4].length == 0) {
+      throw new Error(
+        'ATURI can not have a slash after collection, unless record key is provided',
+      )
+    }
+    // would validate rkey here, but there are basically no constraints!
+  }
+
+  if (parts.length >= 6) {
+    throw new Error(
+      'ATURI path can have at most two parts, and no trailing slash',
+    )
+  }
+
+  if (uriParts.length >= 2 && fragmentPart == null) {
+    throw new Error('ATURI fragment must be non-empty and start with slash')
+  }
+
+  if (fragmentPart != null) {
+    if (fragmentPart.length == 0 || fragmentPart[0] != '/') {
+      throw new Error('ATURI fragment must be non-empty and start with slash')
+    }
+    // NOTE: enforcing *some* checks here for sanity. Eg, at least no whitespace
+    if (!/^\/[a-zA-Z0-9._~:@!$&')(*+,;=%[\]/-]*$/.test(fragmentPart)) {
+      throw new Error('Disallowed characters in ATURI fragment (ASCII)')
+    }
+  }
+
+  if (uri.length > 8 * 1024) {
+    throw new Error('ATURI is far too long')
+  }
+}
+
+export const ensureValidAtUriRegex = (uri: string): void => {
+  // simple regex to enforce most constraints via just regex and length.
+  // hand wrote this regex based on above constraints. whew!
+  const aturiRegex =
+    /^at:\/\/(?<authority>[a-zA-Z0-9._:%-]+)(\/(?<collection>[a-zA-Z0-9-.]+)(\/(?<rkey>[a-zA-Z0-9._~:@!$&%')(*+,;=-]+))?)?(#(?<fragment>\/[a-zA-Z0-9._~:@!$&%')(*+,;=\-[\]/\\]*))?$/
+  const rm = uri.match(aturiRegex)
+  if (!rm || !rm.groups) {
+    throw new Error("ATURI didn't validate via regex")
+  }
+  const groups = rm.groups
+
+  try {
+    ensureValidHandleRegex(groups.authority)
+  } catch {
+    try {
+      ensureValidDidRegex(groups.authority)
+    } catch {
+      throw new Error('ATURI authority must be a valid handle or DID')
+    }
+  }
+
+  if (groups.collection) {
+    try {
+      ensureValidNsidRegex(groups.collection)
+    } catch {
+      throw new Error('ATURI collection path segment must be a valid NSID')
+    }
+  }
+
+  if (uri.length > 8 * 1024) {
+    throw new Error('ATURI is far too long')
+  }
+}

package/src/did.ts

@@ -0,0 +1,58 @@
+// Human-readable constraints:
+//   - valid W3C DID (https://www.w3.org/TR/did-core/#did-syntax)
+//      - entire URI is ASCII: [a-zA-Z0-9._:%-]
+//      - always starts "did:" (lower-case)
+//      - method name is one or more lower-case letters, followed by ":"
+//      - remaining identifier can have any of the above chars, but can not end in ":"
+//      - it seems that a bunch of ":" can be included, and don't need spaces between
+//      - "%" is used only for "percent encoding" and must be followed by two hex characters (and thus can't end in "%")
+//      - query ("?") and fragment ("#") stuff is defined for "DID URIs", but not as part of identifier itself
+//      - "The current specification does not take a position on the maximum length of a DID"
+//   - in current atproto, only allowing did:plc and did:web. But not *forcing* this at lexicon layer
+//   - hard length limit of 8KBytes
+//   - not going to validate "percent encoding" here
+export const ensureValidDid = (did: string): void => {
+  // check that all chars are boring ASCII
+  if (!/^[a-zA-Z0-9._:%-]*$/.test(did)) {
+    throw new InvalidDidError(
+      'Disallowed characters in DID (ASCII letters, digits, and a couple other characters only)',
+    )
+  }
+
+  const parts = did.split(':')
+  if (parts.length < 3) {
+    throw new InvalidDidError(
+      'DID requires prefix, method, and method-specific content',
+    )
+  }
+
+  if (parts[0] != 'did') {
+    throw new InvalidDidError('DID requires "did:" prefix')
+  }
+
+  if (!/^[a-z]+$/.test(parts[1])) {
+    throw new InvalidDidError('DID method must be lower-case letters')
+  }
+
+  if (did.endsWith(':') || did.endsWith('%')) {
+    throw new InvalidDidError('DID can not end with ":" or "%"')
+  }
+
+  if (did.length > 2 * 1024) {
+    throw new InvalidDidError('DID is too long (2048 chars max)')
+  }
+}
+
+export const ensureValidDidRegex = (did: string): void => {
+  // simple regex to enforce most constraints via just regex and length.
+  // hand wrote this regex based on above constraints
+  if (!/^did:[a-z]+:[a-zA-Z0-9._:%-]*[a-zA-Z0-9._-]$/.test(did)) {
+    throw new InvalidDidError("DID didn't validate via regex")
+  }
+
+  if (did.length > 2 * 1024) {
+    throw new InvalidDidError('DID is too long (2048 chars max)')
+  }
+}
+
+export class InvalidDidError extends Error {}

package/src/handle.ts

@@ -0,0 +1,118 @@
+export const INVALID_HANDLE = 'handle.invalid'
+
+// Currently these are registration-time restrictions, not protocol-level
+// restrictions. We have a couple accounts in the wild that we need to clean up
+// before hard-disallow.
+// See also: https://en.wikipedia.org/wiki/Top-level_domain#Reserved_domains
+export const DISALLOWED_TLDS = [
+  '.local',
+  '.arpa',
+  '.invalid',
+  '.localhost',
+  '.internal',
+  // policy could concievably change on ".onion" some day
+  '.onion',
+  // NOTE: .test is allowed in testing and devopment. In practical terms
+  // "should" "never" actually resolve and get registered in production
+]
+
+// Handle constraints, in English:
+//  - must be a possible domain name
+//    - RFC-1035 is commonly referenced, but has been updated. eg, RFC-3696,
+//      section 2. and RFC-3986, section 3. can now have leading numbers (eg,
+//      4chan.org)
+//    - "labels" (sub-names) are made of ASCII letters, digits, hyphens
+//    - can not start or end with a hyphen
+//    - TLD (last component) should not start with a digit
+//    - can't end with a hyphen (can end with digit)
+//    - each segment must be between 1 and 63 characters (not including any periods)
+//    - overall length can't be more than 253 characters
+//    - separated by (ASCII) periods; does not start or end with period
+//    - case insensitive
+//    - domains (handles) are equal if they are the same lower-case
+//    - punycode allowed for internationalization
+//  - no whitespace, null bytes, joining chars, etc
+//  - does not validate whether domain or TLD exists, or is a reserved or
+//    special TLD (eg, .onion or .local)
+//  - does not validate punycode
+export const ensureValidHandle = (handle: string): void => {
+  // check that all chars are boring ASCII
+  if (!/^[a-zA-Z0-9.-]*$/.test(handle)) {
+    throw new InvalidHandleError(
+      'Disallowed characters in handle (ASCII letters, digits, dashes, periods only)',
+    )
+  }
+
+  if (handle.length > 253) {
+    throw new InvalidHandleError('Handle is too long (253 chars max)')
+  }
+  const labels = handle.split('.')
+  if (labels.length < 2) {
+    throw new InvalidHandleError('Handle domain needs at least two parts')
+  }
+  for (let i = 0; i < labels.length; i++) {
+    const l = labels[i]
+    if (l.length < 1) {
+      throw new InvalidHandleError('Handle parts can not be empty')
+    }
+    if (l.length > 63) {
+      throw new InvalidHandleError('Handle part too long (max 63 chars)')
+    }
+    if (l.endsWith('-') || l.startsWith('-')) {
+      throw new InvalidHandleError(
+        'Handle parts can not start or end with hyphens',
+      )
+    }
+    if (i + 1 == labels.length && !/^[a-zA-Z]/.test(l)) {
+      throw new InvalidHandleError(
+        'Handle final component (TLD) must start with ASCII letter',
+      )
+    }
+  }
+}
+
+// simple regex translation of above constraints
+export const ensureValidHandleRegex = (handle: string): void => {
+  if (
+    !/^([a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?$/.test(
+      handle,
+    )
+  ) {
+    throw new InvalidHandleError("Handle didn't validate via regex")
+  }
+  if (handle.length > 253) {
+    throw new InvalidHandleError('Handle is too long (253 chars max)')
+  }
+}
+
+export const normalizeHandle = (handle: string): string => {
+  return handle.toLowerCase()
+}
+
+export const normalizeAndEnsureValidHandle = (handle: string): string => {
+  const normalized = normalizeHandle(handle)
+  ensureValidHandle(normalized)
+  return normalized
+}
+
+export const isValidHandle = (handle: string): boolean => {
+  try {
+    ensureValidHandle(handle)
+  } catch (err) {
+    if (err instanceof InvalidHandleError) {
+      return false
+    }
+    throw err
+  }
+
+  return true
+}
+
+export const isValidTld = (handle: string): boolean => {
+  return !DISALLOWED_TLDS.some((domain) => handle.endsWith(domain))
+}
+
+export class InvalidHandleError extends Error {}
+export class ReservedHandleError extends Error {}
+export class UnsupportedDomainError extends Error {}
+export class DisallowedDomainError extends Error {}

package/src/index.ts

@@ -0,0 +1,4 @@
+export * from './handle'
+export * from './did'
+export * from './nsid'
+export * from './aturi'