@graffiti-garden/implementation-decentralized 0.1.1 → 0.1.3

package/dist/esm/3-protocol/login-dialog.html.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/3-protocol/login-dialog.html.ts"],
-  "sourcesContent": ["export const template = `<template id=\"graffiti-login-welcome\">\n  <h1>\n    <a target=\"_blank\" href=\"https://graffiti.garden\">Graffiti Log&nbsp;In</a>\n  </h1>\n\n  <ul>\n    <li><a type=\"button\" id=\"graffiti-login-new\">Create&nbsp;new Graffiti&nbsp;identity</a></li>\n    <li><button class=\"secondary\" id=\"graffiti-login-existing\">Use&nbsp;existing Graffiti&nbsp;identity</button></li>\n  </ul>\n\n  <aside>\n    This application is built with\n    <a target=\"_blank\" href=\"https://graffiti.garden\">Graffiti</a>.\n  </aside>\n</template>\n\n<template id=\"graffiti-login-handle\">\n<h1>\n  <a target=\"_blank\" href=\"https://graffiti.garden\">Graffiti Log&nbsp;In</a>\n</h1>\n\n  <form id=\"graffiti-login-handle-form\">\n    <label for=\"username\">Graffiti handle:</label>\n    <input\n      type=\"text\"\n      name=\"username\"\n      id=\"username\"\n      autocomplete=\"username\"\n      autocapitalize=\"none\"\n      spellcheck=\"false\"\n      inputmode=\"url\"\n      placeholder=\"you.graffiti.actor\"\n      required\n    >\n    <button id=\"graffiti-login-handle-submit\" type=\"submit\">\n      Log In\n    </button>\n  </form>\n\n  <p>\n    Don't&nbsp;have&nbsp;a Graffiti&nbsp;handle? <a id=\"graffiti-login-new\">Create&nbsp;one</a>.\n  </p>\n</template>`;\n"],
-  "mappings": "AAAO,MAAM,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;",
+  "sourcesContent": ["export const template = `<template id=\"graffiti-login-welcome\">\n  <h1>\n    <a target=\"_blank\" href=\"https://graffiti.garden\">Graffiti Log&nbsp;In</a>\n  </h1>\n\n  <ul>\n    <li><a type=\"button\" id=\"graffiti-login-new\">Create&nbsp;new Graffiti&nbsp;identity</a></li>\n    <li><button class=\"secondary\" id=\"graffiti-login-existing\">Use&nbsp;existing Graffiti&nbsp;identity</button></li>\n  </ul>\n\n  <aside>\n    This application is built with\n    <a target=\"_blank\" href=\"https://graffiti.garden\">Graffiti</a>.\n  </aside>\n</template>\n\n<template id=\"graffiti-login-handle\">\n<h1>\n  <a target=\"_blank\" href=\"https://graffiti.garden\">Graffiti Log&nbsp;In</a>\n</h1>\n\n  <form id=\"graffiti-login-handle-form\">\n    <label for=\"username\">Graffiti handle:</label>\n    <input\n      type=\"text\"\n      name=\"username\"\n      id=\"username\"\n      autocomplete=\"username\"\n      autocapitalize=\"none\"\n      spellcheck=\"false\"\n      inputmode=\"url\"\n      placeholder=\"you.graffiti.actor\"\n      required\n    >\n    <button id=\"graffiti-login-handle-submit\" type=\"submit\">\n      Log In\n    </button>\n  </form>\n\n  <div style=\"display: grid; gap: 0.5em\">\n    <p><a href=\"#\" id=\"graffiti-login-forgot\">Forgot your handle?</a></p>\n    <p>Don't&nbsp;have&nbsp;a Graffiti&nbsp;handle? <a id=\"graffiti-login-new\">Create&nbsp;one</a>.</p>\n  </div>\n</template>\n\n<template id=\"graffiti-login-provider\">\n  <h1>\n    <a target=\"_blank\" href=\"https://graffiti.garden\">Graffiti Log&nbsp;In</a>\n  </h1>\n\n  <form id=\"graffiti-login-provider-form\">\n    <label for=\"graffiti-provider\">Where did you create your Graffiti account?</label>\n    <input id=\"graffiti-provider\" type=\"text\" autocapitalize=\"none\" spellcheck=\"false\" required>\n    <button type=\"submit\">Continue to provider</button>\n  </form>\n  <p><a href=\"#\" id=\"graffiti-login-provider-back\">\u2190 Back</a></p>\n</template>`;\n"],
+  "mappings": "AAAO,MAAM,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;",
   "names": []
 }

package/dist/esm/index.spec.js

@@ -8,7 +8,8 @@ import { Authorization } from "./1-services/1-authorization";
 import { StorageBuckets } from "./1-services/3-storage-buckets";
 import { Inboxes } from "./1-services/4-inboxes";
 import { Sessions } from "./3-protocol/1-sessions";
-import { afterAll, beforeAll, describe } from "vitest";
+import { afterAll, beforeAll, describe, expect, test } from "vitest";
+import { decode as dagCborDecode, encode as dagCborEncode } from "@ipld/dag-cbor";
 import { Handles } from "./3-protocol/2-handles";
 import { didTests } from "./1-services/2-dids-tests";
 import { storageBucketTests } from "./1-services/3-storage-buckets-tests";
@@ -87,6 +88,94 @@ describe("GraffitiDecentralized Tests", () => {
     () => sessions[0],
     () => sessions[1]
   );
+  test("OAuth codes require approval from the selected account", async () => {
+    const account = decentralizedTestUsers[0];
+    const redirectUri = "https://client.example/callback";
+    const endpoint = "https://localhost:5173/app/oauth/authorize";
+    const cookie = `account_${account.accountId}=${account.token}`;
+    const headers = {
+      Cookie: cookie,
+      "X-Graffiti-Account": String(account.accountId),
+      "Content-Type": "application/json",
+      Origin: "https://localhost:5173"
+    };
+    const request = (scope, requestHeaders = headers) => fetch(endpoint, {
+      method: "POST",
+      headers: requestHeaders,
+      body: JSON.stringify({ redirect_uri: redirectUri, state: "test-state", scope })
+    });
+    const navigation = await fetch(
+      `${endpoint}?account=${account.accountId}&redirect_uri=${encodeURIComponent(redirectUri)}`,
+      { headers: { Cookie: cookie } }
+    );
+    expect(navigation.status).toBe(404);
+    expect((await request([account.bucketEndpoint], { Cookie: cookie })).status).toBe(401);
+    expect((await request([account.bucketEndpoint], {
+      ...headers,
+      Origin: "https://attacker.example"
+    })).status).toBe(403);
+    expect((await request([decentralizedTestUsers[1].bucketEndpoint])).status).toBe(403);
+    const approval = await request([account.bucketEndpoint]);
+    expect(approval.status).toBe(200);
+    const { redirectUri: callback } = await approval.json();
+    const code = new URL(callback).searchParams.get("code");
+    expect(code).toBeTruthy();
+    expect(new URL(callback).searchParams.get("state")).toBe("test-state");
+    const exchange = await fetch("https://localhost:5173/app/oauth/token", {
+      method: "POST",
+      body: new URLSearchParams({ code, redirect_uri: redirectUri })
+    });
+    expect(exchange.status).toBe(200);
+    expect((await exchange.json()).access_token).toBeTypeOf("string");
+  });
+  test("deleting a bucket removes its values and rejects requests to its old URL", async () => {
+    const account = decentralizedTestUsers[0];
+    const smallKey = crypto.randomUUID();
+    const largeKey = crypto.randomUUID();
+    const largeValue = new Uint8Array(32 * 1024 + 1).fill(7);
+    const authorization = { Authorization: `Bearer ${account.token}` };
+    for (const [key, value] of [
+      [smallKey, new Uint8Array([1, 2, 3])],
+      [largeKey, largeValue]
+    ]) {
+      const response = await fetch(`${account.bucketEndpoint}/value/${key}`, {
+        method: "PUT",
+        headers: authorization,
+        body: value
+      });
+      expect(response.status).toBe(201);
+    }
+    const r2Key = `${account.bucketId}/${largeKey}`;
+    expect(await environment.storedR2ObjectExists(r2Key)).toBe(true);
+    const deletion = await fetch(
+      `https://localhost:5173/app/service-instances/bucket/service/${account.bucketId}`,
+      {
+        method: "DELETE",
+        headers: {
+          Cookie: `account_${account.accountId}=${account.token}`,
+          "X-Graffiti-Account": String(account.accountId)
+        }
+      }
+    );
+    expect(deletion.status).toBe(200);
+    expect(await environment.storedR2ObjectExists(r2Key)).toBe(false);
+    for (const key of [smallKey, largeKey]) {
+      const response = await fetch(`${account.bucketEndpoint}/value/${key}`);
+      expect(response.status).toBe(404);
+    }
+    const batch = await fetch(`${account.bucketEndpoint}/values`, {
+      method: "POST",
+      headers: { "Content-Type": "application/cbor" },
+      body: dagCborEncode({ keys: [smallKey, largeKey], maxValueBytes: largeValue.length }).slice()
+    });
+    expect(dagCborDecode(await batch.arrayBuffer()).results).toEqual([{ status: 404 }, { status: 404 }]);
+    const putAfterDeletion = await fetch(`${account.bucketEndpoint}/value/${smallKey}`, {
+      method: "PUT",
+      headers: authorization,
+      body: new Uint8Array([4])
+    });
+    expect(putAfterDeletion.status).toBe(404);
+  });
   async function login(handle) {
     const actor = await handleMethods.handleToActor(handle);
     return await new Promise((resolve, reject) => {

package/dist/esm/index.spec.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/index.spec.ts"],
-  "sourcesContent": ["import type {\n  GraffitiLoginEvent,\n  GraffitiLogoutEvent,\n  GraffitiSession,\n} from \"@graffiti-garden/api\";\nimport {\n  graffitiCRUDTests,\n  graffitiDiscoverTests,\n  graffitiMediaTests,\n} from \"@graffiti-garden/api/tests\";\nimport { DecentralizedIdentifiers } from \"./1-services/2-dids\";\nimport { Authorization } from \"./1-services/1-authorization\";\nimport { StorageBuckets } from \"./1-services/3-storage-buckets\";\nimport { Inboxes } from \"./1-services/4-inboxes\";\nimport { Sessions } from \"./3-protocol/1-sessions\";\nimport { afterAll, beforeAll, describe } from \"vitest\";\nimport { Handles } from \"./3-protocol/2-handles\";\nimport { didTests } from \"./1-services/2-dids-tests\";\nimport { storageBucketTests } from \"./1-services/3-storage-buckets-tests\";\nimport { inboxTests } from \"./1-services/4-inboxes-tests\";\nimport { stringEncodingTests } from \"./2-primitives/1-string-encoding-tests\";\nimport { contentAddressesTests } from \"./2-primitives/2-content-addresses-tests\";\nimport { channelAttestationTests } from \"./2-primitives/3-channel-attestations-tests\";\nimport { allowedAttestationTests } from \"./2-primitives/4-allowed-attestations-tests\";\nimport { handleTests } from \"./3-protocol/2-handles-tests\";\nimport { objectEncodingTests } from \"./3-protocol/3-object-encoding-tests\";\nimport { GraffitiDecentralized } from \"./3-protocol/4-graffiti\";\nimport {\n  DecentralizedTestEnvironment,\n  decentralizedSharedInbox,\n  decentralizedTestUsers,\n} from \"../test/environment\";\n\ndescribe(\"GraffitiDecentralized Tests\", () => {\n  const environment = new DecentralizedTestEnvironment();\n  const handles = decentralizedTestUsers.map((user) => user.handle);\n  let sessions: GraffitiSession[] = [];\n  let sessionMethods: Sessions;\n  let handleMethods: Handles;\n\n  beforeAll(async () => {\n    await environment.start();\n\n    const dids = new DecentralizedIdentifiers();\n    sessionMethods = new Sessions({\n      dids,\n      authorization: new Authorization(),\n      inboxes: new Inboxes(),\n      storageBuckets: new StorageBuckets(),\n    });\n    handleMethods = new Handles({ dids });\n\n    for (const handle of handles) {\n      sessions.push(await login(handle));\n    }\n  });\n\n  afterAll(async () => {\n    try {\n      for (const session of sessions) {\n        await logout(session.actor);\n      }\n    } finally {\n      await environment.stop();\n    }\n  });\n\n  // Service tests\n  didTests();\n  storageBucketTests(\n    decentralizedTestUsers[0].bucketEndpoint,\n    decentralizedTestUsers[0].token,\n  );\n  inboxTests(\n    decentralizedTestUsers[0].inboxEndpoint,\n    decentralizedTestUsers[0].token,\n  );\n\n  // Primitive tests\n  stringEncodingTests();\n  contentAddressesTests();\n  channelAttestationTests();\n  allowedAttestationTests();\n\n  // Protocol tests\n  handleTests(handles[0]);\n  objectEncodingTests();\n\n  const useGraffiti = () =>\n    new GraffitiDecentralized({\n      defaultInboxEndpoints: [decentralizedSharedInbox],\n    });\n  graffitiCRUDTests(\n    useGraffiti,\n    () => sessions[0],\n    () => sessions[1],\n  );\n  graffitiMediaTests(\n    useGraffiti,\n    () => sessions[0],\n    () => sessions[1],\n  );\n  graffitiDiscoverTests(\n    useGraffiti,\n    () => sessions[0],\n    () => sessions[1],\n  );\n\n  // How to log in/out vvv\n  async function login(handle: string) {\n    const actor = await handleMethods.handleToActor(handle);\n\n    return await new Promise<GraffitiSession>((resolve, reject) => {\n      let timeout: ReturnType<typeof setTimeout>;\n      const cleanup = () => {\n        clearTimeout(timeout);\n        sessionMethods.sessionEvents.removeEventListener(\"login\", listener);\n      };\n      const listener = (e: unknown) => {\n        if (!(e instanceof CustomEvent)) return;\n        const detail = e.detail as GraffitiLoginEvent[\"detail\"];\n        if (detail.session?.actor !== actor) return;\n        cleanup();\n        if (detail.error) {\n          reject(detail.error);\n        } else {\n          resolve(detail.session);\n        }\n      };\n      sessionMethods.sessionEvents.addEventListener(\"login\", listener);\n\n      timeout = setTimeout(\n        () => {\n          cleanup();\n          reject(new Error(\"Authorization timed out\"));\n        },\n        30 * 1000,\n      );\n\n      void sessionMethods.login(actor);\n    });\n  }\n\n  async function logout(actor: string) {\n    return await new Promise<void>((resolve, reject) => {\n      let timeout: ReturnType<typeof setTimeout>;\n      const cleanup = () => {\n        clearTimeout(timeout);\n        sessionMethods.sessionEvents.removeEventListener(\"logout\", listener);\n      };\n      const listener = (e: unknown) => {\n        if (!(e instanceof CustomEvent)) return;\n        const detail = e.detail as GraffitiLogoutEvent[\"detail\"];\n        if (detail.actor !== actor) return;\n        cleanup();\n\n        if (detail.error) {\n          reject(detail.error);\n        } else {\n          resolve();\n        }\n      };\n      sessionMethods.sessionEvents.addEventListener(\"logout\", listener);\n\n      timeout = setTimeout(\n        () => {\n          cleanup();\n          reject(new Error(\"Logout timed out\"));\n        },\n        30 * 1000,\n      );\n\n      void sessionMethods.logout(actor);\n    });\n  }\n});\n"],
-  "mappings": "AAKA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,gCAAgC;AACzC,SAAS,qBAAqB;AAC9B,SAAS,sBAAsB;AAC/B,SAAS,eAAe;AACxB,SAAS,gBAAgB;AACzB,SAAS,UAAU,WAAW,gBAAgB;AAC9C,SAAS,eAAe;AACxB,SAAS,gBAAgB;AACzB,SAAS,0BAA0B;AACnC,SAAS,kBAAkB;AAC3B,SAAS,2BAA2B;AACpC,SAAS,6BAA6B;AACtC,SAAS,+BAA+B;AACxC,SAAS,+BAA+B;AACxC,SAAS,mBAAmB;AAC5B,SAAS,2BAA2B;AACpC,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,SAAS,+BAA+B,MAAM;AAC5C,QAAM,cAAc,IAAI,6BAA6B;AACrD,QAAM,UAAU,uBAAuB,IAAI,CAAC,SAAS,KAAK,MAAM;AAChE,MAAI,WAA8B,CAAC;AACnC,MAAI;AACJ,MAAI;AAEJ,YAAU,YAAY;AACpB,UAAM,YAAY,MAAM;AAExB,UAAM,OAAO,IAAI,yBAAyB;AAC1C,qBAAiB,IAAI,SAAS;AAAA,MAC5B;AAAA,MACA,eAAe,IAAI,cAAc;AAAA,MACjC,SAAS,IAAI,QAAQ;AAAA,MACrB,gBAAgB,IAAI,eAAe;AAAA,IACrC,CAAC;AACD,oBAAgB,IAAI,QAAQ,EAAE,KAAK,CAAC;AAEpC,eAAW,UAAU,SAAS;AAC5B,eAAS,KAAK,MAAM,MAAM,MAAM,CAAC;AAAA,IACnC;AAAA,EACF,CAAC;AAED,WAAS,YAAY;AACnB,QAAI;AACF,iBAAW,WAAW,UAAU;AAC9B,cAAM,OAAO,QAAQ,KAAK;AAAA,MAC5B;AAAA,IACF,UAAE;AACA,YAAM,YAAY,KAAK;AAAA,IACzB;AAAA,EACF,CAAC;AAGD,WAAS;AACT;AAAA,IACE,uBAAuB,CAAC,EAAE;AAAA,IAC1B,uBAAuB,CAAC,EAAE;AAAA,EAC5B;AACA;AAAA,IACE,uBAAuB,CAAC,EAAE;AAAA,IAC1B,uBAAuB,CAAC,EAAE;AAAA,EAC5B;AAGA,sBAAoB;AACpB,wBAAsB;AACtB,0BAAwB;AACxB,0BAAwB;AAGxB,cAAY,QAAQ,CAAC,CAAC;AACtB,sBAAoB;AAEpB,QAAM,cAAc,MAClB,IAAI,sBAAsB;AAAA,IACxB,uBAAuB,CAAC,wBAAwB;AAAA,EAClD,CAAC;AACH;AAAA,IACE;AAAA,IACA,MAAM,SAAS,CAAC;AAAA,IAChB,MAAM,SAAS,CAAC;AAAA,EAClB;AACA;AAAA,IACE;AAAA,IACA,MAAM,SAAS,CAAC;AAAA,IAChB,MAAM,SAAS,CAAC;AAAA,EAClB;AACA;AAAA,IACE;AAAA,IACA,MAAM,SAAS,CAAC;AAAA,IAChB,MAAM,SAAS,CAAC;AAAA,EAClB;AAGA,iBAAe,MAAM,QAAgB;AACnC,UAAM,QAAQ,MAAM,cAAc,cAAc,MAAM;AAEtD,WAAO,MAAM,IAAI,QAAyB,CAAC,SAAS,WAAW;AAC7D,UAAI;AACJ,YAAM,UAAU,MAAM;AACpB,qBAAa,OAAO;AACpB,uBAAe,cAAc,oBAAoB,SAAS,QAAQ;AAAA,MACpE;AACA,YAAM,WAAW,CAAC,MAAe;AAC/B,YAAI,EAAE,aAAa,aAAc;AACjC,cAAM,SAAS,EAAE;AACjB,YAAI,OAAO,SAAS,UAAU,MAAO;AACrC,gBAAQ;AACR,YAAI,OAAO,OAAO;AAChB,iBAAO,OAAO,KAAK;AAAA,QACrB,OAAO;AACL,kBAAQ,OAAO,OAAO;AAAA,QACxB;AAAA,MACF;AACA,qBAAe,cAAc,iBAAiB,SAAS,QAAQ;AAE/D,gBAAU;AAAA,QACR,MAAM;AACJ,kBAAQ;AACR,iBAAO,IAAI,MAAM,yBAAyB,CAAC;AAAA,QAC7C;AAAA,QACA,KAAK;AAAA,MACP;AAEA,WAAK,eAAe,MAAM,KAAK;AAAA,IACjC,CAAC;AAAA,EACH;AAEA,iBAAe,OAAO,OAAe;AACnC,WAAO,MAAM,IAAI,QAAc,CAAC,SAAS,WAAW;AAClD,UAAI;AACJ,YAAM,UAAU,MAAM;AACpB,qBAAa,OAAO;AACpB,uBAAe,cAAc,oBAAoB,UAAU,QAAQ;AAAA,MACrE;AACA,YAAM,WAAW,CAAC,MAAe;AAC/B,YAAI,EAAE,aAAa,aAAc;AACjC,cAAM,SAAS,EAAE;AACjB,YAAI,OAAO,UAAU,MAAO;AAC5B,gBAAQ;AAER,YAAI,OAAO,OAAO;AAChB,iBAAO,OAAO,KAAK;AAAA,QACrB,OAAO;AACL,kBAAQ;AAAA,QACV;AAAA,MACF;AACA,qBAAe,cAAc,iBAAiB,UAAU,QAAQ;AAEhE,gBAAU;AAAA,QACR,MAAM;AACJ,kBAAQ;AACR,iBAAO,IAAI,MAAM,kBAAkB,CAAC;AAAA,QACtC;AAAA,QACA,KAAK;AAAA,MACP;AAEA,WAAK,eAAe,OAAO,KAAK;AAAA,IAClC,CAAC;AAAA,EACH;AACF,CAAC;",
+  "sourcesContent": ["import type {\n  GraffitiLoginEvent,\n  GraffitiLogoutEvent,\n  GraffitiSession,\n} from \"@graffiti-garden/api\";\nimport {\n  graffitiCRUDTests,\n  graffitiDiscoverTests,\n  graffitiMediaTests,\n} from \"@graffiti-garden/api/tests\";\nimport { DecentralizedIdentifiers } from \"./1-services/2-dids\";\nimport { Authorization } from \"./1-services/1-authorization\";\nimport { StorageBuckets } from \"./1-services/3-storage-buckets\";\nimport { Inboxes } from \"./1-services/4-inboxes\";\nimport { Sessions } from \"./3-protocol/1-sessions\";\nimport { afterAll, beforeAll, describe, expect, test } from \"vitest\";\nimport { decode as dagCborDecode, encode as dagCborEncode } from \"@ipld/dag-cbor\";\nimport { Handles } from \"./3-protocol/2-handles\";\nimport { didTests } from \"./1-services/2-dids-tests\";\nimport { storageBucketTests } from \"./1-services/3-storage-buckets-tests\";\nimport { inboxTests } from \"./1-services/4-inboxes-tests\";\nimport { stringEncodingTests } from \"./2-primitives/1-string-encoding-tests\";\nimport { contentAddressesTests } from \"./2-primitives/2-content-addresses-tests\";\nimport { channelAttestationTests } from \"./2-primitives/3-channel-attestations-tests\";\nimport { allowedAttestationTests } from \"./2-primitives/4-allowed-attestations-tests\";\nimport { handleTests } from \"./3-protocol/2-handles-tests\";\nimport { objectEncodingTests } from \"./3-protocol/3-object-encoding-tests\";\nimport { GraffitiDecentralized } from \"./3-protocol/4-graffiti\";\nimport {\n  DecentralizedTestEnvironment,\n  decentralizedSharedInbox,\n  decentralizedTestUsers,\n} from \"../test/environment\";\n\ndescribe(\"GraffitiDecentralized Tests\", () => {\n  const environment = new DecentralizedTestEnvironment();\n  const handles = decentralizedTestUsers.map((user) => user.handle);\n  let sessions: GraffitiSession[] = [];\n  let sessionMethods: Sessions;\n  let handleMethods: Handles;\n\n  beforeAll(async () => {\n    await environment.start();\n\n    const dids = new DecentralizedIdentifiers();\n    sessionMethods = new Sessions({\n      dids,\n      authorization: new Authorization(),\n      inboxes: new Inboxes(),\n      storageBuckets: new StorageBuckets(),\n    });\n    handleMethods = new Handles({ dids });\n\n    for (const handle of handles) {\n      sessions.push(await login(handle));\n    }\n  });\n\n  afterAll(async () => {\n    try {\n      for (const session of sessions) {\n        await logout(session.actor);\n      }\n    } finally {\n      await environment.stop();\n    }\n  });\n\n  // Service tests\n  didTests();\n  storageBucketTests(\n    decentralizedTestUsers[0].bucketEndpoint,\n    decentralizedTestUsers[0].token,\n  );\n  inboxTests(\n    decentralizedTestUsers[0].inboxEndpoint,\n    decentralizedTestUsers[0].token,\n  );\n\n  // Primitive tests\n  stringEncodingTests();\n  contentAddressesTests();\n  channelAttestationTests();\n  allowedAttestationTests();\n\n  // Protocol tests\n  handleTests(handles[0]);\n  objectEncodingTests();\n\n  const useGraffiti = () =>\n    new GraffitiDecentralized({\n      defaultInboxEndpoints: [decentralizedSharedInbox],\n    });\n  graffitiCRUDTests(\n    useGraffiti,\n    () => sessions[0],\n    () => sessions[1],\n  );\n  graffitiMediaTests(\n    useGraffiti,\n    () => sessions[0],\n    () => sessions[1],\n  );\n  graffitiDiscoverTests(\n    useGraffiti,\n    () => sessions[0],\n    () => sessions[1],\n  );\n\n  test(\"OAuth codes require approval from the selected account\", async () => {\n    const account = decentralizedTestUsers[0];\n    const redirectUri = \"https://client.example/callback\";\n    const endpoint = \"https://localhost:5173/app/oauth/authorize\";\n    const cookie = `account_${account.accountId}=${account.token}`;\n    const headers = {\n      Cookie: cookie,\n      \"X-Graffiti-Account\": String(account.accountId),\n      \"Content-Type\": \"application/json\",\n      Origin: \"https://localhost:5173\",\n    };\n    const request = (scope: string[], requestHeaders: HeadersInit = headers) =>\n      fetch(endpoint, {\n        method: \"POST\",\n        headers: requestHeaders,\n        body: JSON.stringify({ redirect_uri: redirectUri, state: \"test-state\", scope }),\n      });\n\n    const navigation = await fetch(\n      `${endpoint}?account=${account.accountId}&redirect_uri=${encodeURIComponent(redirectUri)}`,\n      { headers: { Cookie: cookie } },\n    );\n    expect(navigation.status).toBe(404);\n\n    expect((await request([account.bucketEndpoint], { Cookie: cookie })).status).toBe(401);\n    expect((await request([account.bucketEndpoint], {\n      ...headers,\n      Origin: \"https://attacker.example\",\n    })).status).toBe(403);\n    expect((await request([decentralizedTestUsers[1].bucketEndpoint])).status).toBe(403);\n\n    const approval = await request([account.bucketEndpoint]);\n    expect(approval.status).toBe(200);\n    const { redirectUri: callback } = await approval.json() as { redirectUri: string };\n    const code = new URL(callback).searchParams.get(\"code\");\n    expect(code).toBeTruthy();\n    expect(new URL(callback).searchParams.get(\"state\")).toBe(\"test-state\");\n\n    const exchange = await fetch(\"https://localhost:5173/app/oauth/token\", {\n      method: \"POST\",\n      body: new URLSearchParams({ code: code!, redirect_uri: redirectUri }),\n    });\n    expect(exchange.status).toBe(200);\n    expect((await exchange.json()).access_token).toBeTypeOf(\"string\");\n  });\n\n  test(\"deleting a bucket removes its values and rejects requests to its old URL\", async () => {\n    const account = decentralizedTestUsers[0];\n    const smallKey = crypto.randomUUID();\n    const largeKey = crypto.randomUUID();\n    const largeValue = new Uint8Array(32 * 1024 + 1).fill(7);\n    const authorization = { Authorization: `Bearer ${account.token}` };\n\n    for (const [key, value] of [\n      [smallKey, new Uint8Array([1, 2, 3])],\n      [largeKey, largeValue],\n    ] as const) {\n      const response = await fetch(`${account.bucketEndpoint}/value/${key}`, {\n        method: \"PUT\",\n        headers: authorization,\n        body: value,\n      });\n      expect(response.status).toBe(201);\n    }\n\n    const r2Key = `${account.bucketId}/${largeKey}`;\n    expect(await environment.storedR2ObjectExists(r2Key)).toBe(true);\n\n    const deletion = await fetch(\n      `https://localhost:5173/app/service-instances/bucket/service/${account.bucketId}`,\n      {\n        method: \"DELETE\",\n        headers: {\n          Cookie: `account_${account.accountId}=${account.token}`,\n          \"X-Graffiti-Account\": String(account.accountId),\n        },\n      },\n    );\n    expect(deletion.status).toBe(200);\n\n    expect(await environment.storedR2ObjectExists(r2Key)).toBe(false);\n    for (const key of [smallKey, largeKey]) {\n      const response = await fetch(`${account.bucketEndpoint}/value/${key}`);\n      expect(response.status).toBe(404);\n    }\n    const batch = await fetch(`${account.bucketEndpoint}/values`, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/cbor\" },\n      body: dagCborEncode({ keys: [smallKey, largeKey], maxValueBytes: largeValue.length }).slice(),\n    });\n    expect((dagCborDecode(await batch.arrayBuffer()) as { results: { status: number }[] }).results)\n      .toEqual([{ status: 404 }, { status: 404 }]);\n\n    const putAfterDeletion = await fetch(`${account.bucketEndpoint}/value/${smallKey}`, {\n      method: \"PUT\",\n      headers: authorization,\n      body: new Uint8Array([4]),\n    });\n    expect(putAfterDeletion.status).toBe(404);\n  });\n\n  // How to log in/out vvv\n  async function login(handle: string) {\n    const actor = await handleMethods.handleToActor(handle);\n\n    return await new Promise<GraffitiSession>((resolve, reject) => {\n      let timeout: ReturnType<typeof setTimeout>;\n      const cleanup = () => {\n        clearTimeout(timeout);\n        sessionMethods.sessionEvents.removeEventListener(\"login\", listener);\n      };\n      const listener = (e: unknown) => {\n        if (!(e instanceof CustomEvent)) return;\n        const detail = e.detail as GraffitiLoginEvent[\"detail\"];\n        if (detail.session?.actor !== actor) return;\n        cleanup();\n        if (detail.error) {\n          reject(detail.error);\n        } else {\n          resolve(detail.session);\n        }\n      };\n      sessionMethods.sessionEvents.addEventListener(\"login\", listener);\n\n      timeout = setTimeout(\n        () => {\n          cleanup();\n          reject(new Error(\"Authorization timed out\"));\n        },\n        30 * 1000,\n      );\n\n      void sessionMethods.login(actor);\n    });\n  }\n\n  async function logout(actor: string) {\n    return await new Promise<void>((resolve, reject) => {\n      let timeout: ReturnType<typeof setTimeout>;\n      const cleanup = () => {\n        clearTimeout(timeout);\n        sessionMethods.sessionEvents.removeEventListener(\"logout\", listener);\n      };\n      const listener = (e: unknown) => {\n        if (!(e instanceof CustomEvent)) return;\n        const detail = e.detail as GraffitiLogoutEvent[\"detail\"];\n        if (detail.actor !== actor) return;\n        cleanup();\n\n        if (detail.error) {\n          reject(detail.error);\n        } else {\n          resolve();\n        }\n      };\n      sessionMethods.sessionEvents.addEventListener(\"logout\", listener);\n\n      timeout = setTimeout(\n        () => {\n          cleanup();\n          reject(new Error(\"Logout timed out\"));\n        },\n        30 * 1000,\n      );\n\n      void sessionMethods.logout(actor);\n    });\n  }\n});\n"],
+  "mappings": "AAKA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,gCAAgC;AACzC,SAAS,qBAAqB;AAC9B,SAAS,sBAAsB;AAC/B,SAAS,eAAe;AACxB,SAAS,gBAAgB;AACzB,SAAS,UAAU,WAAW,UAAU,QAAQ,YAAY;AAC5D,SAAS,UAAU,eAAe,UAAU,qBAAqB;AACjE,SAAS,eAAe;AACxB,SAAS,gBAAgB;AACzB,SAAS,0BAA0B;AACnC,SAAS,kBAAkB;AAC3B,SAAS,2BAA2B;AACpC,SAAS,6BAA6B;AACtC,SAAS,+BAA+B;AACxC,SAAS,+BAA+B;AACxC,SAAS,mBAAmB;AAC5B,SAAS,2BAA2B;AACpC,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,SAAS,+BAA+B,MAAM;AAC5C,QAAM,cAAc,IAAI,6BAA6B;AACrD,QAAM,UAAU,uBAAuB,IAAI,CAAC,SAAS,KAAK,MAAM;AAChE,MAAI,WAA8B,CAAC;AACnC,MAAI;AACJ,MAAI;AAEJ,YAAU,YAAY;AACpB,UAAM,YAAY,MAAM;AAExB,UAAM,OAAO,IAAI,yBAAyB;AAC1C,qBAAiB,IAAI,SAAS;AAAA,MAC5B;AAAA,MACA,eAAe,IAAI,cAAc;AAAA,MACjC,SAAS,IAAI,QAAQ;AAAA,MACrB,gBAAgB,IAAI,eAAe;AAAA,IACrC,CAAC;AACD,oBAAgB,IAAI,QAAQ,EAAE,KAAK,CAAC;AAEpC,eAAW,UAAU,SAAS;AAC5B,eAAS,KAAK,MAAM,MAAM,MAAM,CAAC;AAAA,IACnC;AAAA,EACF,CAAC;AAED,WAAS,YAAY;AACnB,QAAI;AACF,iBAAW,WAAW,UAAU;AAC9B,cAAM,OAAO,QAAQ,KAAK;AAAA,MAC5B;AAAA,IACF,UAAE;AACA,YAAM,YAAY,KAAK;AAAA,IACzB;AAAA,EACF,CAAC;AAGD,WAAS;AACT;AAAA,IACE,uBAAuB,CAAC,EAAE;AAAA,IAC1B,uBAAuB,CAAC,EAAE;AAAA,EAC5B;AACA;AAAA,IACE,uBAAuB,CAAC,EAAE;AAAA,IAC1B,uBAAuB,CAAC,EAAE;AAAA,EAC5B;AAGA,sBAAoB;AACpB,wBAAsB;AACtB,0BAAwB;AACxB,0BAAwB;AAGxB,cAAY,QAAQ,CAAC,CAAC;AACtB,sBAAoB;AAEpB,QAAM,cAAc,MAClB,IAAI,sBAAsB;AAAA,IACxB,uBAAuB,CAAC,wBAAwB;AAAA,EAClD,CAAC;AACH;AAAA,IACE;AAAA,IACA,MAAM,SAAS,CAAC;AAAA,IAChB,MAAM,SAAS,CAAC;AAAA,EAClB;AACA;AAAA,IACE;AAAA,IACA,MAAM,SAAS,CAAC;AAAA,IAChB,MAAM,SAAS,CAAC;AAAA,EAClB;AACA;AAAA,IACE;AAAA,IACA,MAAM,SAAS,CAAC;AAAA,IAChB,MAAM,SAAS,CAAC;AAAA,EAClB;AAEA,OAAK,0DAA0D,YAAY;AACzE,UAAM,UAAU,uBAAuB,CAAC;AACxC,UAAM,cAAc;AACpB,UAAM,WAAW;AACjB,UAAM,SAAS,WAAW,QAAQ,SAAS,IAAI,QAAQ,KAAK;AAC5D,UAAM,UAAU;AAAA,MACd,QAAQ;AAAA,MACR,sBAAsB,OAAO,QAAQ,SAAS;AAAA,MAC9C,gBAAgB;AAAA,MAChB,QAAQ;AAAA,IACV;AACA,UAAM,UAAU,CAAC,OAAiB,iBAA8B,YAC9D,MAAM,UAAU;AAAA,MACd,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,MAAM,KAAK,UAAU,EAAE,cAAc,aAAa,OAAO,cAAc,MAAM,CAAC;AAAA,IAChF,CAAC;AAEH,UAAM,aAAa,MAAM;AAAA,MACvB,GAAG,QAAQ,YAAY,QAAQ,SAAS,iBAAiB,mBAAmB,WAAW,CAAC;AAAA,MACxF,EAAE,SAAS,EAAE,QAAQ,OAAO,EAAE;AAAA,IAChC;AACA,WAAO,WAAW,MAAM,EAAE,KAAK,GAAG;AAElC,YAAQ,MAAM,QAAQ,CAAC,QAAQ,cAAc,GAAG,EAAE,QAAQ,OAAO,CAAC,GAAG,MAAM,EAAE,KAAK,GAAG;AACrF,YAAQ,MAAM,QAAQ,CAAC,QAAQ,cAAc,GAAG;AAAA,MAC9C,GAAG;AAAA,MACH,QAAQ;AAAA,IACV,CAAC,GAAG,MAAM,EAAE,KAAK,GAAG;AACpB,YAAQ,MAAM,QAAQ,CAAC,uBAAuB,CAAC,EAAE,cAAc,CAAC,GAAG,MAAM,EAAE,KAAK,GAAG;AAEnF,UAAM,WAAW,MAAM,QAAQ,CAAC,QAAQ,cAAc,CAAC;AACvD,WAAO,SAAS,MAAM,EAAE,KAAK,GAAG;AAChC,UAAM,EAAE,aAAa,SAAS,IAAI,MAAM,SAAS,KAAK;AACtD,UAAM,OAAO,IAAI,IAAI,QAAQ,EAAE,aAAa,IAAI,MAAM;AACtD,WAAO,IAAI,EAAE,WAAW;AACxB,WAAO,IAAI,IAAI,QAAQ,EAAE,aAAa,IAAI,OAAO,CAAC,EAAE,KAAK,YAAY;AAErE,UAAM,WAAW,MAAM,MAAM,0CAA0C;AAAA,MACrE,QAAQ;AAAA,MACR,MAAM,IAAI,gBAAgB,EAAE,MAAa,cAAc,YAAY,CAAC;AAAA,IACtE,CAAC;AACD,WAAO,SAAS,MAAM,EAAE,KAAK,GAAG;AAChC,YAAQ,MAAM,SAAS,KAAK,GAAG,YAAY,EAAE,WAAW,QAAQ;AAAA,EAClE,CAAC;AAED,OAAK,4EAA4E,YAAY;AAC3F,UAAM,UAAU,uBAAuB,CAAC;AACxC,UAAM,WAAW,OAAO,WAAW;AACnC,UAAM,WAAW,OAAO,WAAW;AACnC,UAAM,aAAa,IAAI,WAAW,KAAK,OAAO,CAAC,EAAE,KAAK,CAAC;AACvD,UAAM,gBAAgB,EAAE,eAAe,UAAU,QAAQ,KAAK,GAAG;AAEjE,eAAW,CAAC,KAAK,KAAK,KAAK;AAAA,MACzB,CAAC,UAAU,IAAI,WAAW,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;AAAA,MACpC,CAAC,UAAU,UAAU;AAAA,IACvB,GAAY;AACV,YAAM,WAAW,MAAM,MAAM,GAAG,QAAQ,cAAc,UAAU,GAAG,IAAI;AAAA,QACrE,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,MAAM;AAAA,MACR,CAAC;AACD,aAAO,SAAS,MAAM,EAAE,KAAK,GAAG;AAAA,IAClC;AAEA,UAAM,QAAQ,GAAG,QAAQ,QAAQ,IAAI,QAAQ;AAC7C,WAAO,MAAM,YAAY,qBAAqB,KAAK,CAAC,EAAE,KAAK,IAAI;AAE/D,UAAM,WAAW,MAAM;AAAA,MACrB,+DAA+D,QAAQ,QAAQ;AAAA,MAC/E;AAAA,QACE,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,QAAQ,WAAW,QAAQ,SAAS,IAAI,QAAQ,KAAK;AAAA,UACrD,sBAAsB,OAAO,QAAQ,SAAS;AAAA,QAChD;AAAA,MACF;AAAA,IACF;AACA,WAAO,SAAS,MAAM,EAAE,KAAK,GAAG;AAEhC,WAAO,MAAM,YAAY,qBAAqB,KAAK,CAAC,EAAE,KAAK,KAAK;AAChE,eAAW,OAAO,CAAC,UAAU,QAAQ,GAAG;AACtC,YAAM,WAAW,MAAM,MAAM,GAAG,QAAQ,cAAc,UAAU,GAAG,EAAE;AACrE,aAAO,SAAS,MAAM,EAAE,KAAK,GAAG;AAAA,IAClC;AACA,UAAM,QAAQ,MAAM,MAAM,GAAG,QAAQ,cAAc,WAAW;AAAA,MAC5D,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,cAAc,EAAE,MAAM,CAAC,UAAU,QAAQ,GAAG,eAAe,WAAW,OAAO,CAAC,EAAE,MAAM;AAAA,IAC9F,CAAC;AACD,WAAQ,cAAc,MAAM,MAAM,YAAY,CAAC,EAAwC,OAAO,EAC3F,QAAQ,CAAC,EAAE,QAAQ,IAAI,GAAG,EAAE,QAAQ,IAAI,CAAC,CAAC;AAE7C,UAAM,mBAAmB,MAAM,MAAM,GAAG,QAAQ,cAAc,UAAU,QAAQ,IAAI;AAAA,MAClF,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,MAAM,IAAI,WAAW,CAAC,CAAC,CAAC;AAAA,IAC1B,CAAC;AACD,WAAO,iBAAiB,MAAM,EAAE,KAAK,GAAG;AAAA,EAC1C,CAAC;AAGD,iBAAe,MAAM,QAAgB;AACnC,UAAM,QAAQ,MAAM,cAAc,cAAc,MAAM;AAEtD,WAAO,MAAM,IAAI,QAAyB,CAAC,SAAS,WAAW;AAC7D,UAAI;AACJ,YAAM,UAAU,MAAM;AACpB,qBAAa,OAAO;AACpB,uBAAe,cAAc,oBAAoB,SAAS,QAAQ;AAAA,MACpE;AACA,YAAM,WAAW,CAAC,MAAe;AAC/B,YAAI,EAAE,aAAa,aAAc;AACjC,cAAM,SAAS,EAAE;AACjB,YAAI,OAAO,SAAS,UAAU,MAAO;AACrC,gBAAQ;AACR,YAAI,OAAO,OAAO;AAChB,iBAAO,OAAO,KAAK;AAAA,QACrB,OAAO;AACL,kBAAQ,OAAO,OAAO;AAAA,QACxB;AAAA,MACF;AACA,qBAAe,cAAc,iBAAiB,SAAS,QAAQ;AAE/D,gBAAU;AAAA,QACR,MAAM;AACJ,kBAAQ;AACR,iBAAO,IAAI,MAAM,yBAAyB,CAAC;AAAA,QAC7C;AAAA,QACA,KAAK;AAAA,MACP;AAEA,WAAK,eAAe,MAAM,KAAK;AAAA,IACjC,CAAC;AAAA,EACH;AAEA,iBAAe,OAAO,OAAe;AACnC,WAAO,MAAM,IAAI,QAAc,CAAC,SAAS,WAAW;AAClD,UAAI;AACJ,YAAM,UAAU,MAAM;AACpB,qBAAa,OAAO;AACpB,uBAAe,cAAc,oBAAoB,UAAU,QAAQ;AAAA,MACrE;AACA,YAAM,WAAW,CAAC,MAAe;AAC/B,YAAI,EAAE,aAAa,aAAc;AACjC,cAAM,SAAS,EAAE;AACjB,YAAI,OAAO,UAAU,MAAO;AAC5B,gBAAQ;AAER,YAAI,OAAO,OAAO;AAChB,iBAAO,OAAO,KAAK;AAAA,QACrB,OAAO;AACL,kBAAQ;AAAA,QACV;AAAA,MACF;AACA,qBAAe,cAAc,iBAAiB,UAAU,QAAQ;AAEhE,gBAAU;AAAA,QACR,MAAM;AACJ,kBAAQ;AACR,iBAAO,IAAI,MAAM,kBAAkB,CAAC;AAAA,QACtC;AAAA,QACA,KAAK;AAAA,MACP;AAEA,WAAK,eAAe,OAAO,KAAK;AAAA,IAClC,CAAC;AAAA,EACH;AACF,CAAC;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@graffiti-garden/implementation-decentralized",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "A client for a decentralized implementation of the Graffiti API",
   "types": "./dist/index.d.ts",
   "module": "./dist/esm/index.js",

package/src/1-services/3-storage-buckets-tests.ts

@@ -1,7 +1,8 @@
 import { describe, expect, test } from "vitest";
 import { StorageBuckets } from "./3-storage-buckets";
 import { GraffitiErrorUnauthorized } from "./utilities";
-import { GraffitiErrorNotFound } from "@graffiti-garden/api";
+import { GraffitiErrorNotFound, GraffitiErrorTooLarge } from "@graffiti-garden/api";
+import { encode as dagCborEncode, decode as dagCborDecode } from "@ipld/dag-cbor";
 
 export function storageBucketTests(
   storageBucketEndpoint: string,
@@ -62,6 +63,203 @@ export function storageBucketTests(
       ).rejects.toThrow();
     });
 
+    test("overwrites across the small and large storage cutoff", async () => {
+      const key = crypto.randomUUID();
+      const small = new Uint8Array([1, 2, 3]);
+      const large = new Uint8Array(32 * 1024 + 1).fill(42);
+      const otherLarge = new Uint8Array(32 * 1024 + 1).fill(43);
+
+      await storageBuckets.put(storageBucketEndpoint, key, large, storageBucketToken);
+      expect(await storageBuckets.get(storageBucketEndpoint, key)).toEqual(large);
+
+      await storageBuckets.put(storageBucketEndpoint, key, otherLarge, storageBucketToken);
+      expect(await storageBuckets.get(storageBucketEndpoint, key)).toEqual(otherLarge);
+
+      await storageBuckets.put(storageBucketEndpoint, key, small, storageBucketToken);
+      expect(await storageBuckets.get(storageBucketEndpoint, key)).toEqual(small);
+
+      await storageBuckets.put(storageBucketEndpoint, key, large, storageBucketToken);
+      expect(await storageBuckets.get(storageBucketEndpoint, key)).toEqual(large);
+
+      await storageBuckets.delete(storageBucketEndpoint, key, storageBucketToken);
+      await expect(storageBuckets.get(storageBucketEndpoint, key)).rejects.toThrow(
+        GraffitiErrorNotFound,
+      );
+    });
+
+    test("batch reads arbitrary keys from one bucket", async () => {
+      const first = crypto.randomUUID();
+      const second = crypto.randomUUID();
+      const missing = crypto.randomUUID();
+      const small = new Uint8Array([1, 2, 3]);
+      const large = new Uint8Array(32 * 1024 + 1).fill(7);
+      await storageBuckets.put(storageBucketEndpoint, first, small, storageBucketToken);
+      await storageBuckets.put(storageBucketEndpoint, second, large, storageBucketToken);
+      try {
+        const response = await fetch(`${storageBucketEndpoint}/values`, {
+          method: "POST",
+          headers: { "Content-Type": "application/cbor" },
+          body: dagCborEncode({
+            keys: [first, missing, second, first],
+            maxValueBytes: small.length,
+          }).slice(),
+        });
+        expect(response.status).toBe(200);
+        const decoded = dagCborDecode(await response.arrayBuffer()) as {
+          results: Array<{ status: number; value?: Uint8Array; etag?: string }>;
+        };
+        expect(decoded.results.map(({ status }) => status)).toEqual([200, 404, 413, 200]);
+        expect(decoded.results[0].value).toEqual(small);
+        expect(decoded.results[0].etag).toBeTypeOf("string");
+        expect(decoded.results[3].value).toEqual(small);
+        const largeResponse = await fetch(`${storageBucketEndpoint}/values`, {
+          method: "POST",
+          headers: { "Content-Type": "application/cbor" },
+          body: dagCborEncode({
+            keys: [second],
+            maxValueBytes: large.length,
+          }).slice(),
+        });
+        expect(largeResponse.status).toBe(200);
+        const largeDecoded = dagCborDecode(await largeResponse.arrayBuffer()) as {
+          results: Array<{ status: number; value?: Uint8Array }>;
+        };
+        expect(largeDecoded.results[0].value).toEqual(large);
+
+        const oversizedResponse = await fetch(`${storageBucketEndpoint}/values`, {
+          method: "POST",
+          headers: { "Content-Type": "application/cbor" },
+          body: dagCborEncode({
+            keys: [first, second],
+            maxValueBytes: 1024 * 1024,
+          }).slice(),
+        });
+        expect(oversizedResponse.status).toBe(400);
+
+        const settled = await Promise.allSettled([
+          storageBuckets.get(storageBucketEndpoint, first, small.length),
+          storageBuckets.get(storageBucketEndpoint, missing, small.length),
+          storageBuckets.get(storageBucketEndpoint, second, small.length),
+        ]);
+        expect(settled[0]).toEqual({ status: "fulfilled", value: small });
+        expect(settled[1].status).toBe("rejected");
+        expect((settled[1] as PromiseRejectedResult).reason).toBeInstanceOf(GraffitiErrorNotFound);
+        expect(settled[2].status).toBe("rejected");
+        expect((settled[2] as PromiseRejectedResult).reason).toBeInstanceOf(GraffitiErrorTooLarge);
+        expect(await storageBuckets.get(storageBucketEndpoint, second)).toEqual(large);
+      } finally {
+        await storageBuckets.delete(storageBucketEndpoint, first, storageBucketToken);
+        await storageBuckets.delete(storageBucketEndpoint, second, storageBucketToken);
+      }
+    });
+
+    test("accepts a full batch of maximum-length Unicode keys", async () => {
+      const key = "界".repeat(255);
+      const body = dagCborEncode({
+        keys: Array(32).fill(key),
+        maxValueBytes: 0,
+      }).slice();
+      expect(body.byteLength).toBeGreaterThan(16 * 1024);
+      const response = await fetch(`${storageBucketEndpoint}/values`, {
+        method: "POST",
+        headers: { "Content-Type": "application/cbor" },
+        body,
+      });
+      expect(response.status).toBe(200);
+      const decoded = dagCborDecode(await response.arrayBuffer()) as {
+        results: Array<{ status: number }>;
+      };
+      expect(decoded.results.map(({ status }) => status)).toEqual(Array(32).fill(404));
+    });
+
+    test("concurrent bounded gets share one batch", async () => {
+      const keys = Array.from({ length: 3 }, () => crypto.randomUUID());
+      const values = keys.map((_, i) => new Uint8Array([i + 1]));
+      for (let i = 0; i < keys.length; i++) {
+        await storageBuckets.put(storageBucketEndpoint, keys[i], values[i], storageBucketToken);
+      }
+      const originalFetch = globalThis.fetch;
+      const calls: string[] = [];
+      globalThis.fetch = (input, init) => {
+        const request = new Request(input, init);
+        calls.push(`${request.method} ${request.url}`);
+        return originalFetch(input, init);
+      };
+      try {
+        expect(await Promise.all(keys.map((key) =>
+          storageBuckets.get(storageBucketEndpoint, key, 1),
+        ))).toEqual(values);
+        expect(calls.filter((call) => call === `POST ${storageBucketEndpoint}/values`)).toHaveLength(1);
+        expect(calls.filter((call) => call.includes("/value/"))).toHaveLength(0);
+      } finally {
+        globalThis.fetch = originalFetch;
+        for (const key of keys) {
+          await storageBuckets.delete(storageBucketEndpoint, key, storageBucketToken);
+        }
+      }
+    });
+
+    test("falls back to GET when a bucket server does not support batches", async () => {
+      const keys = Array.from({ length: 2 }, () => crypto.randomUUID());
+      const value = new Uint8Array([42]);
+      for (const key of keys) {
+        await storageBuckets.put(storageBucketEndpoint, key, value, storageBucketToken);
+      }
+      const originalFetch = globalThis.fetch;
+      let batchAttempts = 0;
+      globalThis.fetch = (input, init) => {
+        const request = new Request(input, init);
+        if (request.method === "POST" && request.url === `${storageBucketEndpoint}/values`) {
+          batchAttempts++;
+          return Promise.resolve(new Response("Not found", { status: 404 }));
+        }
+        return originalFetch(input, init);
+      };
+      try {
+        const legacyBuckets = new StorageBuckets();
+        expect(await Promise.all(keys.map((key) =>
+          legacyBuckets.get(storageBucketEndpoint, key, 1),
+        ))).toEqual([value, value]);
+        expect(await Promise.all(keys.map((key) =>
+          legacyBuckets.get(storageBucketEndpoint, key, 1),
+        ))).toEqual([value, value]);
+        expect(batchAttempts).toBe(1);
+      } finally {
+        globalThis.fetch = originalFetch;
+        for (const key of keys) {
+          await storageBuckets.delete(storageBucketEndpoint, key, storageBucketToken);
+        }
+      }
+    });
+
+    test("a batch error does not disable batching or fall back to GET", async () => {
+      const originalFetch = globalThis.fetch;
+      let batchAttempts = 0;
+      let getAttempts = 0;
+      globalThis.fetch = (input, init) => {
+        const request = new Request(input, init);
+        if (request.method === "POST") {
+          batchAttempts++;
+          return Promise.resolve(new Response("Batch limit exceeded", { status: 413 }));
+        }
+        getAttempts++;
+        return originalFetch(input, init);
+      };
+      try {
+        const buckets = new StorageBuckets();
+        const readPair = () => Promise.all([
+          buckets.get(storageBucketEndpoint, "a", 1),
+          buckets.get(storageBucketEndpoint, "b", 1),
+        ]);
+        await expect(readPair()).rejects.toThrow("Batch limit exceeded");
+        await expect(readPair()).rejects.toThrow("Batch limit exceeded");
+        expect(batchAttempts).toBe(2);
+        expect(getAttempts).toBe(0);
+      } finally {
+        globalThis.fetch = originalFetch;
+      }
+    });
+
     test("unauthorized", async () => {
       const key = Math.random().toString(36).substring(2, 15);
       const input = "Hello world";

package/src/1-services/3-storage-buckets.ts

@@ -4,10 +4,33 @@ import {
   verifyHTTPSEndpoint,
 } from "./utilities";
 import { string, array, object, optional, nullable } from "zod/mini";
-import { decode as dagCborDecode } from "@ipld/dag-cbor";
+import { encode as dagCborEncode, decode as dagCborDecode } from "@ipld/dag-cbor";
+import { GraffitiErrorNotFound, GraffitiErrorTooLarge } from "@graffiti-garden/api";
+
+// All batch-capable bucket servers accept these transport limits.
+const BATCH_KEYS = 32; // total number of keys in a batch request
+const BATCH_TOTAL_VALUE_BYTES = 1024 * 1024; // total response limit
+
+// This is a heuristic for how long to wait to fill a batch request
+// before sending it. Just enough waiting to capture a few more requests,
+// but not so long that it adds noticeable latency.
+const BATCH_WAIT_MS = 2;
+
+function batchWidth(maxBytes: number) {
+  return Math.min(BATCH_KEYS, Math.floor(BATCH_TOTAL_VALUE_BYTES / maxBytes));
+}
+
+type PendingGet = {
+  key: string;
+  resolve: (value: Uint8Array) => void;
+  reject: (reason: unknown) => void;
+};
+type BatchQueue = { requests: PendingGet[]; timer?: ReturnType<typeof setTimeout> };
 
 export class StorageBuckets {
   getAuthorizationEndpoint = getAuthorizationEndpoint;
+  private readonly queues = new Map<string, Map<number, BatchQueue>>();
+  private readonly unsupportedBatchEndpoints = new Set<string>();
 
   async put(
     storageBucketEndpoint: string,
@@ -50,6 +73,111 @@ export class StorageBuckets {
     maxBytes?: number,
   ): Promise<Uint8Array> {
     verifyHTTPSEndpoint(storageBucketEndpoint);
+    if (
+      maxBytes !== undefined &&
+      Number.isSafeInteger(maxBytes) &&
+      maxBytes > 0 &&
+      batchWidth(maxBytes) >= 2 &&
+      !this.unsupportedBatchEndpoints.has(storageBucketEndpoint)
+    ) {
+      return new Promise<Uint8Array>((resolve, reject) => {
+        let queuesByMaxBytes = this.queues.get(storageBucketEndpoint);
+        if (!queuesByMaxBytes) {
+          queuesByMaxBytes = new Map();
+          this.queues.set(storageBucketEndpoint, queuesByMaxBytes);
+        }
+        let queue = queuesByMaxBytes.get(maxBytes);
+        if (!queue) {
+          queue = { requests: [] };
+          queuesByMaxBytes.set(maxBytes, queue);
+        }
+        queue.requests.push({ key, resolve, reject });
+        if (queue.requests.length === batchWidth(maxBytes)) {
+          this.flush(storageBucketEndpoint, maxBytes, queue);
+        } else if (queue.timer === undefined) {
+          queue.timer = setTimeout(
+            () => this.flush(storageBucketEndpoint, maxBytes, queue),
+            BATCH_WAIT_MS,
+          );
+        }
+      });
+    }
+    return this.getOne(storageBucketEndpoint, key, maxBytes);
+  }
+
+  private flush(endpoint: string, maxBytes: number, queue: BatchQueue) {
+    if (queue.timer !== undefined) clearTimeout(queue.timer);
+    const requests = queue.requests;
+    const queuesByMaxBytes = this.queues.get(endpoint)!;
+    queuesByMaxBytes.delete(maxBytes);
+    if (queuesByMaxBytes.size === 0) this.queues.delete(endpoint);
+    if (requests.length === 1 || this.unsupportedBatchEndpoints.has(endpoint)) {
+      requests.forEach(({ key, resolve, reject }) => {
+        void this.getOne(endpoint, key, maxBytes).then(resolve, reject);
+      });
+    } else {
+      void this.getBatch(endpoint, maxBytes, requests);
+    }
+  }
+
+  private async getBatch(endpoint: string, maxBytes: number, requests: PendingGet[]) {
+    try {
+      const response = await fetch(`${endpoint}/values`, {
+        method: "POST",
+        headers: { "Content-Type": "application/cbor", Accept: "application/cbor" },
+        body: dagCborEncode({
+          keys: requests.map(({ key }) => key),
+          maxValueBytes: maxBytes,
+        }).slice(),
+      });
+      if (response.status === 404) {
+        // An older bucket server has no /values route but still serves GETs.
+        this.unsupportedBatchEndpoints.add(endpoint);
+        await Promise.all(requests.map(async ({ key, resolve, reject }) => {
+          try {
+            resolve(await this.getOne(endpoint, key, maxBytes));
+          } catch (error) {
+            reject(error);
+          }
+        }));
+        return;
+      }
+      if (!response.ok) throw new Error(await response.text());
+      const decoded = dagCborDecode(await response.arrayBuffer());
+      if (
+        !decoded || typeof decoded !== "object" ||
+        !("results" in decoded) || !Array.isArray(decoded.results) ||
+        decoded.results.length !== requests.length
+      ) throw new Error("Invalid storage batch response");
+
+      decoded.results.forEach((result: unknown, index: number) => {
+        const { resolve, reject } = requests[index];
+        if (!result || typeof result !== "object" || !("status" in result)) {
+          reject(new Error("Invalid storage batch result"));
+        } else if (
+          result.status === 200 && "value" in result &&
+          result.value instanceof Uint8Array &&
+          result.value.byteLength <= maxBytes
+        ) {
+          resolve(result.value);
+        } else if (result.status === 404) {
+          reject(new GraffitiErrorNotFound("Value not found"));
+        } else if (result.status === 413) {
+          reject(new GraffitiErrorTooLarge("Value exceeds maximum byte limit"));
+        } else {
+          reject(new Error("Invalid storage batch result"));
+        }
+      });
+    } catch (error) {
+      requests.forEach(({ reject }) => reject(error));
+    }
+  }
+
+  private async getOne(
+    storageBucketEndpoint: string,
+    key: string,
+    maxBytes?: number,
+  ): Promise<Uint8Array> {
     const url = `${storageBucketEndpoint}/value/${encodeURIComponent(key)}`;
 
     const response = await fetchWithErrorHandling(url);

package/src/1-services/4-inboxes-tests.ts

@@ -3,6 +3,7 @@ import { Inboxes, LABELED_MESSAGE_LABEL_KEY } from "./4-inboxes";
 import { GraffitiErrorUnauthorized } from "./utilities";
 import { randomBytes } from "@noble/hashes/utils.js";
 import type { GraffitiObjectBase } from "@graffiti-garden/api";
+import { encode as dagCborEncode, decode as dagCborDecode } from "@ipld/dag-cbor";
 
 export function inboxTests(inboxEndpoint: string, inboxToken: string) {
   describe("Inboxes", async () => {
@@ -138,6 +139,30 @@ export function inboxTests(inboxEndpoint: string, inboxToken: string) {
         });
       }
 
+      let cursor: string | undefined;
+      for (const [page, expectedCount] of [10, 100, 101].entries()) {
+        const response = await fetch(
+          `${inboxEndpoint}/query${cursor ? `?cursor=${encodeURIComponent(cursor)}` : ""}`,
+          {
+            method: "POST",
+            headers: {
+              "Content-Type": "application/cbor",
+              Authorization: `Bearer ${inboxToken}`,
+            },
+            body: cursor ? undefined : dagCborEncode({ tags: [tags[1]], schema: {} }).slice(),
+          },
+        );
+        expect(response.status).toBe(200);
+        const pageResult = dagCborDecode(new Uint8Array(await response.arrayBuffer())) as {
+          results: unknown[];
+          hasMore: boolean;
+          cursor: string;
+        };
+        expect(pageResult.results).toHaveLength(expectedCount);
+        expect(pageResult.hasMore).toBe(page < 2);
+        cursor = pageResult.cursor;
+      }
+
       const iterator = inboxes.query(
         inboxEndpoint,
         [randomBytes(), tags[1], randomBytes()],

package/src/3-protocol/2-handles-tests.ts

@@ -13,5 +13,17 @@ export function handleTests(handle: string) {
       const resolvedHandle = await handles.actorToHandle(actor);
       expect(resolvedHandle).toBe(handle);
     });
+
+    test("actorToHandle uses the first did:web alias", async () => {
+      const actor = "did:plc:example";
+      const handleDid = "did:web:alice.example";
+      const dids = {
+        resolve: async (did: string) => did === actor
+          ? { alsoKnownAs: ["at://alice.example", handleDid, "did:web:other.example"] }
+          : { alsoKnownAs: [actor] },
+      } as DecentralizedIdentifiers;
+      expect(await new Handles({ dids }).actorToHandle(actor)).toBe("alice.example");
+    });
+
   });
 }

package/src/3-protocol/2-handles.ts

@@ -13,16 +13,14 @@ export class Handles {
   actorToHandle: Graffiti["actorToHandle"] = async (actor) => {
     const actorDocument = await this.services.dids.resolve(actor);
 
-    const handleDid = actorDocument.alsoKnownAs?.at(0);
+    const handleDid = actorDocument.alsoKnownAs?.find((alias) =>
+      alias.startsWith(HANDLE_DID_PREFIX),
+    );
     if (!handleDid) {
       throw new GraffitiErrorNotFound(
         `Handle for actor DID ${actor} not found`,
       );
     }
-    if (!handleDid.startsWith(HANDLE_DID_PREFIX)) {
-      throw new Error(`Handle DID ${handleDid} is not a valid handle`);
-    }
-
     const handle = handleDid.slice(HANDLE_DID_PREFIX.length);
 
     const handleDocument = await this.services.dids.resolve(handleDid);