@hatk/hatk 0.0.1-alpha.0

package/dist/lexicon-resolve.js

@@ -0,0 +1,280 @@
+// Lexicon resolver — fetches lexicons from the AT Protocol registry via DNS → DID → PDS chain
+// and recursively resolves all $ref dependencies.
+import { isValidDid } from '@bigmoves/lexicon';
+// --- Authority ---
+function nsidToDomain(nsid) {
+    const parts = nsid.split('.');
+    return parts.slice(0, 2).reverse().join('.');
+}
+function domainToLexiconDns(domain) {
+    return `_lexicon.${domain}`;
+}
+// --- DNS ---
+function parseDidFromTxt(txt) {
+    if (!txt)
+        return null;
+    const unquoted = txt.replace(/^"|"$/g, '');
+    const match = unquoted.match(/^did=(.+)$/);
+    if (!match)
+        return null;
+    const did = match[1];
+    return isValidDid(did) ? did : null;
+}
+async function lookupTxt(domain, opts = {}) {
+    const dohUrl = opts.dohUrl ?? 'https://cloudflare-dns.com/dns-query';
+    const fetchFn = opts.fetch ?? globalThis.fetch;
+    try {
+        const url = `${dohUrl}?name=${encodeURIComponent(domain)}&type=TXT`;
+        const response = await fetchFn(url, {
+            headers: { Accept: 'application/dns-json' },
+        });
+        if (!response.ok)
+            return [];
+        const data = await response.json();
+        if (!data.Answer)
+            return [];
+        return data.Answer.filter((record) => record.type === 16).map((record) => record.data?.replace(/^"|"$/g, '') ?? '');
+    }
+    catch {
+        return [];
+    }
+}
+// --- DID ---
+function extractPdsEndpoint(didDoc) {
+    if (!didDoc?.service || !Array.isArray(didDoc.service))
+        return null;
+    const pdsService = didDoc.service.find((s) => s.id === '#atproto_pds' || s.type === 'AtprotoPersonalDataServer');
+    return pdsService?.serviceEndpoint ?? null;
+}
+async function resolveDid(did, opts = {}) {
+    const plcUrl = opts.plcUrl ?? 'https://plc.directory';
+    const fetchFn = opts.fetch ?? globalThis.fetch;
+    try {
+        let didDocUrl;
+        if (did.startsWith('did:plc:')) {
+            didDocUrl = `${plcUrl}/${did}`;
+        }
+        else if (did.startsWith('did:web:')) {
+            const domain = did.slice('did:web:'.length);
+            didDocUrl = `https://${domain}/.well-known/did.json`;
+        }
+        else {
+            return null;
+        }
+        const response = await fetchFn(didDocUrl);
+        if (!response.ok)
+            return null;
+        const didDoc = await response.json();
+        return extractPdsEndpoint(didDoc);
+    }
+    catch {
+        return null;
+    }
+}
+// --- Built-in core schemas (not published via DNS) ---
+const coreSchemas = {
+    'com.atproto.repo.strongRef': {
+        lexicon: 1,
+        id: 'com.atproto.repo.strongRef',
+        description: 'A URI with a content-hash fingerprint.',
+        defs: {
+            main: {
+                type: 'object',
+                required: ['uri', 'cid'],
+                properties: { uri: { type: 'string', format: 'at-uri' }, cid: { type: 'string', format: 'cid' } },
+            },
+        },
+    },
+    'com.atproto.label.defs': {
+        lexicon: 1,
+        id: 'com.atproto.label.defs',
+        defs: {
+            label: {
+                type: 'object',
+                description: 'Metadata tag on an atproto resource (eg, repo or record).',
+                required: ['src', 'uri', 'val', 'cts'],
+                properties: {
+                    ver: { type: 'integer' },
+                    src: { type: 'string', format: 'did' },
+                    uri: { type: 'string', format: 'uri' },
+                    cid: { type: 'string', format: 'cid' },
+                    val: { type: 'string', maxLength: 128 },
+                    neg: { type: 'boolean' },
+                    cts: { type: 'string', format: 'datetime' },
+                    exp: { type: 'string', format: 'datetime' },
+                    sig: { type: 'bytes' },
+                },
+            },
+            selfLabels: {
+                type: 'object',
+                description: 'Metadata tags on an atproto record, published by the author within the record.',
+                required: ['values'],
+                properties: { values: { type: 'array', items: { type: 'ref', ref: '#selfLabel' }, maxLength: 10 } },
+            },
+            selfLabel: { type: 'object', required: ['val'], properties: { val: { type: 'string', maxLength: 128 } } },
+            labelValueDefinition: {
+                type: 'object',
+                description: 'Declares a label value and its expected interpretations and behaviors.',
+                required: ['identifier', 'severity', 'blurs', 'locales'],
+                properties: {
+                    identifier: { type: 'string', maxLength: 100 },
+                    severity: { type: 'string', knownValues: ['inform', 'alert', 'none'] },
+                    blurs: { type: 'string', knownValues: ['content', 'media', 'none'] },
+                    defaultSetting: { type: 'string', knownValues: ['ignore', 'warn', 'hide'] },
+                    adultOnly: { type: 'boolean' },
+                    locales: { type: 'array', items: { type: 'ref', ref: '#labelValueDefinitionStrings' } },
+                },
+            },
+            labelValueDefinitionStrings: {
+                type: 'object',
+                required: ['lang', 'name', 'description'],
+                properties: {
+                    lang: { type: 'string', format: 'language' },
+                    name: { type: 'string', maxLength: 640 },
+                    description: { type: 'string', maxLength: 100000 },
+                },
+            },
+            labelValue: {
+                type: 'string',
+                knownValues: [
+                    '!hide',
+                    '!no-promote',
+                    '!warn',
+                    '!no-unauthenticated',
+                    'dmca-violation',
+                    'doxxing',
+                    'porn',
+                    'sexual',
+                    'nudity',
+                    'nsfl',
+                    'gore',
+                ],
+            },
+        },
+    },
+    'com.atproto.moderation.defs': {
+        lexicon: 1,
+        id: 'com.atproto.moderation.defs',
+        defs: {
+            reasonType: {
+                type: 'string',
+                knownValues: [
+                    'com.atproto.moderation.defs#reasonSpam',
+                    'com.atproto.moderation.defs#reasonViolation',
+                    'com.atproto.moderation.defs#reasonMisleading',
+                    'com.atproto.moderation.defs#reasonSexual',
+                    'com.atproto.moderation.defs#reasonRude',
+                    'com.atproto.moderation.defs#reasonOther',
+                    'com.atproto.moderation.defs#reasonAppeal',
+                ],
+            },
+            reasonSpam: { type: 'token', description: 'Spam: frequent unwanted promotion, replies, mentions.' },
+            reasonViolation: { type: 'token', description: 'Direct violation of server rules, laws, terms of service.' },
+            reasonMisleading: { type: 'token', description: 'Misleading identity, affiliation, or content.' },
+            reasonSexual: { type: 'token', description: 'Unwanted or mislabeled sexual content.' },
+            reasonRude: { type: 'token', description: 'Rude, harassing, explicit, or otherwise unwelcoming behavior.' },
+            reasonOther: { type: 'token', description: 'Reports not falling under another report category.' },
+            reasonAppeal: { type: 'token', description: 'Appeal a previously taken moderation action.' },
+            subjectType: {
+                type: 'string',
+                description: 'Tag describing a type of subject that might be reported.',
+                knownValues: ['account', 'record', 'chat'],
+            },
+        },
+    },
+};
+function refToNsid(ref) {
+    let nsid = ref.startsWith('lex:') ? ref.slice(4) : ref;
+    const hashIndex = nsid.indexOf('#');
+    if (hashIndex !== -1)
+        nsid = nsid.slice(0, hashIndex);
+    const parts = nsid.split('.');
+    return parts.length >= 3 ? nsid : null;
+}
+function extractRefs(schema) {
+    const refs = new Set();
+    const walk = (obj) => {
+        if (!obj || typeof obj !== 'object')
+            return;
+        if (Array.isArray(obj)) {
+            for (const item of obj)
+                walk(item);
+            return;
+        }
+        const record = obj;
+        if (record.type === 'ref' && typeof record.ref === 'string') {
+            const nsid = refToNsid(record.ref);
+            if (nsid)
+                refs.add(nsid);
+        }
+        if (record.type === 'union' && Array.isArray(record.refs)) {
+            for (const ref of record.refs) {
+                if (typeof ref === 'string') {
+                    const nsid = refToNsid(ref);
+                    if (nsid)
+                        refs.add(nsid);
+                }
+            }
+        }
+        for (const value of Object.values(record))
+            walk(value);
+    };
+    walk(schema);
+    return Array.from(refs);
+}
+async function fetchLexicon(nsid) {
+    const domain = nsidToDomain(nsid);
+    const dnsName = domainToLexiconDns(domain);
+    const txtRecords = await lookupTxt(dnsName);
+    let did = null;
+    for (const txt of txtRecords) {
+        did = parseDidFromTxt(txt);
+        if (did)
+            break;
+    }
+    if (!did)
+        return null;
+    const pdsEndpoint = await resolveDid(did);
+    if (!pdsEndpoint)
+        return null;
+    const url = `${pdsEndpoint}/xrpc/com.atproto.repo.getRecord?repo=${encodeURIComponent(did)}&collection=com.atproto.lexicon.schema&rkey=${encodeURIComponent(nsid)}`;
+    const response = await fetch(url);
+    if (!response.ok)
+        return null;
+    const data = await response.json();
+    return data.value ?? null;
+}
+/**
+ * Resolve a lexicon by NSID from the AT Protocol registry,
+ * recursively fetching all referenced lexicons.
+ * Returns a map of NSID → Lexicon for all resolved schemas.
+ */
+export async function resolveLexicon(nsid) {
+    const resolved = new Map();
+    async function resolve(nsid) {
+        if (resolved.has(nsid))
+            return;
+        // Check built-in core schemas first
+        if (coreSchemas[nsid]) {
+            console.log(`  ${nsid} (built-in)`);
+            resolved.set(nsid, coreSchemas[nsid]);
+            const refs = extractRefs(coreSchemas[nsid]);
+            for (const ref of refs)
+                await resolve(ref);
+            return;
+        }
+        console.log(`  resolving ${nsid}...`);
+        const lexicon = await fetchLexicon(nsid);
+        if (!lexicon) {
+            console.log(`  could not resolve ${nsid}`);
+            return;
+        }
+        resolved.set(nsid, lexicon);
+        const refs = extractRefs(lexicon);
+        for (const ref of refs) {
+            await resolve(ref);
+        }
+    }
+    await resolve(nsid);
+    return resolved;
+}

package/dist/logger.d.ts

@@ -0,0 +1,4 @@
+export declare function log(...args: unknown[]): void;
+export declare function emit(module: string, op: string, fields: Record<string, unknown>): void;
+export declare function timer(): () => number;
+//# sourceMappingURL=logger.d.ts.map

package/dist/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA,wBAAgB,GAAG,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAG5C;AAED,wBAAgB,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAWtF;AAED,wBAAgB,KAAK,IAAI,MAAM,MAAM,CAGpC"}

package/dist/logger.js

@@ -0,0 +1,23 @@
+export function log(...args) {
+    if (process.env.DEBUG === '0')
+        return;
+    console.log(...args);
+}
+export function emit(module, op, fields) {
+    if (process.env.DEBUG === '0')
+        return;
+    const entry = {
+        ts: new Date().toISOString(),
+        module,
+        op,
+    };
+    for (const [k, v] of Object.entries(fields)) {
+        if (v !== undefined)
+            entry[k] = v;
+    }
+    process.stdout.write(JSON.stringify(entry) + '\n');
+}
+export function timer() {
+    const start = performance.now();
+    return () => Math.round(performance.now() - start);
+}

package/dist/main.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=main.d.ts.map

package/dist/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":""}

package/dist/main.js

@@ -0,0 +1,148 @@
+#!/usr/bin/env node
+import { mkdirSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { log } from "./logger.js";
+import { loadConfig } from "./config.js";
+import { loadLexicons, storeLexicons, discoverCollections, generateTableSchema, generateCreateTableSQL, } from "./schema.js";
+import { discoverViews } from "./views.js";
+import { initDatabase, getCursor, querySQL, backfillChildTables } from "./db.js";
+import { initFeeds, listFeeds } from "./feeds.js";
+import { initXrpc, listXrpc, configureRelay } from "./xrpc.js";
+import { initOpengraph } from "./opengraph.js";
+import { initLabels, getLabelDefinitions } from "./labels.js";
+import { startIndexer } from "./indexer.js";
+import { rebuildAllIndexes } from "./fts.js";
+import { startServer } from "./server.js";
+import { validateLexicons } from '@bigmoves/lexicon';
+import { relayHttpUrl } from "./config.js";
+import { runBackfill } from "./backfill.js";
+import { initOAuth } from "./oauth/server.js";
+import { loadOnLoginHook } from "./oauth/hooks.js";
+import { initSetup } from "./setup.js";
+const configPath = process.argv[2] || 'config.yaml';
+const configDir = dirname(resolve(configPath));
+// 1. Load config
+const config = loadConfig(configPath);
+configureRelay(config.relay);
+// 2. Load lexicons, validate schemas, and discover collections
+const lexicons = loadLexicons(resolve(configDir, 'lexicons'));
+const lexiconErrors = validateLexicons([...lexicons.values()]);
+if (lexiconErrors) {
+    for (const [nsid, errors] of Object.entries(lexiconErrors)) {
+        for (const err of errors) {
+            console.error(`[main] Invalid lexicon ${nsid}: ${err}`);
+        }
+    }
+    process.exit(1);
+}
+storeLexicons(lexicons);
+// Auto-discover collections from record-type lexicons, fall back to config
+const collections = config.collections.length > 0 ? config.collections : discoverCollections(lexicons);
+if (collections.length === 0) {
+    log(`[main] No record collections found — running in API-only mode. Add record lexicons to start indexing.`);
+}
+log(`[main] Loaded config: ${collections.length} collections`);
+// Discover view defs from lexicons
+discoverViews();
+await loadOnLoginHook(resolve(configDir, 'hooks'));
+const schemas = [];
+const ddlStatements = [];
+for (const nsid of collections) {
+    const lexicon = lexicons.get(nsid);
+    if (!lexicon) {
+        log(`[main] No lexicon found for ${nsid}, using generic JSON storage`);
+        const genericDDL = `CREATE TABLE IF NOT EXISTS "${nsid}" (
+      uri TEXT PRIMARY KEY,
+      cid TEXT,
+      did TEXT NOT NULL,
+      indexed_at TIMESTAMP NOT NULL,
+      data JSON
+    );
+    CREATE INDEX IF NOT EXISTS idx_${nsid.replace(/\./g, '_')}_indexed ON "${nsid}"(indexed_at DESC);
+    CREATE INDEX IF NOT EXISTS idx_${nsid.replace(/\./g, '_')}_author ON "${nsid}"(did);`;
+        schemas.push({ collection: nsid, tableName: `"${nsid}"`, columns: [], refColumns: [], children: [], unions: [] });
+        ddlStatements.push(genericDDL);
+        continue;
+    }
+    const schema = generateTableSchema(nsid, lexicon, lexicons);
+    schemas.push(schema);
+    ddlStatements.push(generateCreateTableSQL(schema));
+    log(`[main] Schema for ${nsid}: ${schema.columns.length} columns, ${schema.unions.length} unions`);
+}
+// 3. Ensure data directory exists and initialize DuckDB
+if (config.database !== ':memory:') {
+    mkdirSync(dirname(config.database), { recursive: true });
+}
+await initDatabase(config.database, schemas, ddlStatements);
+log(`[main] DuckDB initialized (${config.database === ':memory:' ? 'in-memory' : config.database})`);
+// 3a. Backfill child tables for decomposed arrays (one-time migration)
+await backfillChildTables();
+// 3b. Run setup hooks (after DB init, before server)
+await initSetup(resolve(configDir, 'setup'));
+// Detect orphaned tables
+try {
+    const existingTables = await querySQL(`SELECT table_name FROM information_schema.tables WHERE table_schema = 'main' AND table_name NOT LIKE '\\_%' ESCAPE '\\'`);
+    for (const row of existingTables) {
+        const tableName = row.table_name;
+        const isChildTable = collections.some((c) => tableName.startsWith(c + '__'));
+        if (tableName.includes('.') && !collections.includes(tableName) && !isChildTable) {
+            console.warn(`[warn] Table "${tableName}" exists but has no lexicon. Run 'hatk destroy collection ${tableName}' to clean up.`);
+        }
+    }
+}
+catch { }
+// 4. Initialize feeds, xrpc handlers, og, labels from directories
+await initFeeds(resolve(configDir, 'feeds'));
+log(`[main] Feeds initialized: ${listFeeds()
+    .map((f) => f.name)
+    .join(', ') || 'none'}`);
+await initXrpc(resolve(configDir, 'xrpc'));
+log(`[main] XRPC handlers initialized: ${listXrpc().join(', ') || 'none'}`);
+await initOpengraph(resolve(configDir, 'og'));
+log(`[main] OpenGraph initialized`);
+await initLabels(resolve(configDir, 'labels'));
+log(`[main] Labels initialized: ${getLabelDefinitions().length} definitions`);
+if (config.oauth) {
+    await initOAuth(config.oauth, config.plc, config.relay);
+    log(`[main] OAuth initialized (issuer: ${config.oauth.issuer})`);
+}
+// 5. Start server immediately (don't wait for backfill)
+const collectionSet = new Set(collections);
+startServer(config.port, collections, config.publicDir, config.oauth, config.admins);
+log(`\nhatk running:`);
+log(`  Relay: ${config.relay}`);
+log(`  Database: ${config.database}`);
+log(`  API: http://localhost:${config.port}`);
+log(`  Collections: ${collections.join(', ')}`);
+log(`  Feeds: ${listFeeds()
+    .map((f) => f.name)
+    .join(', ')}`);
+// 6. Start indexer with cursor
+const cursor = await getCursor('relay');
+startIndexer({
+    relayUrl: config.relay,
+    collections: collectionSet,
+    signalCollections: config.backfill.signalCollections ? new Set(config.backfill.signalCollections) : undefined,
+    pinnedRepos: config.backfill.repos ? new Set(config.backfill.repos) : undefined,
+    cursor,
+    fetchTimeout: config.backfill.fetchTimeout,
+    maxRetries: config.backfill.maxRetries,
+    ftsRebuildInterval: config.ftsRebuildInterval,
+});
+// 7. Run backfill in background
+runBackfill({
+    pdsUrl: relayHttpUrl(config.relay),
+    plcUrl: config.plc,
+    collections: collectionSet,
+    config: config.backfill,
+})
+    .then(() => {
+    log('[main] Backfill complete, rebuilding FTS indexes...');
+    return rebuildAllIndexes(collections);
+})
+    .then(() => {
+    log('[main] FTS indexes ready');
+})
+    .catch((err) => {
+    console.error('[main] Backfill error:', err.message);
+});

package/dist/mst.d.ts

@@ -0,0 +1,6 @@
+export interface MstEntry {
+    path: string;
+    cid: string;
+}
+export declare function walkMst(blocks: Map<string, Uint8Array>, rootCid: string): MstEntry[];
+//# sourceMappingURL=mst.d.ts.map

package/dist/mst.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mst.d.ts","sourceRoot":"","sources":["../src/mst.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,wBAAgB,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,QAAQ,EAAE,CAiCpF"}

package/dist/mst.js

@@ -0,0 +1,30 @@
+import { cborDecode } from "./cbor.js";
+export function walkMst(blocks, rootCid) {
+    const entries = [];
+    function visit(cid, prefix) {
+        const data = blocks.get(cid);
+        if (!data)
+            return prefix;
+        const { value: node } = cborDecode(data);
+        // Visit left subtree
+        if (node.l?.$link)
+            visit(node.l.$link, prefix);
+        let lastKey = prefix;
+        for (const entry of node.e || []) {
+            const keySuffix = entry.k instanceof Uint8Array ? new TextDecoder().decode(entry.k) : entry.k;
+            const prefixLen = entry.p || 0;
+            const fullKey = lastKey.substring(0, prefixLen) + keySuffix;
+            lastKey = fullKey;
+            if (entry.v?.$link) {
+                entries.push({ path: fullKey, cid: entry.v.$link });
+            }
+            // Visit right subtree
+            if (entry.t?.$link) {
+                visit(entry.t.$link, lastKey);
+            }
+        }
+        return lastKey;
+    }
+    visit(rootCid, '');
+    return entries;
+}

package/dist/oauth/client.d.ts

@@ -0,0 +1,16 @@
+import type { OAuthClientConfig } from '../config.ts';
+export interface ClientMetadata {
+    client_id: string;
+    client_name: string;
+    redirect_uris: string[];
+    grant_types: string[];
+    response_types: string[];
+    token_endpoint_auth_method: string;
+    dpop_bound_access_tokens: boolean;
+    scope: string;
+}
+export declare function isLoopbackClient(clientId: string): boolean;
+export declare function getLoopbackClientMetadata(clientId: string): ClientMetadata;
+export declare function resolveClient(clientId: string, registeredClients: OAuthClientConfig[]): ClientMetadata | null;
+export declare function validateRedirectUri(clientMetadata: ClientMetadata, redirectUri: string): boolean;
+//# sourceMappingURL=client.d.ts.map

package/dist/oauth/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/oauth/client.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAErD,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,0BAA0B,EAAE,MAAM,CAAA;IAClC,wBAAwB,EAAE,OAAO,CAAA;IACjC,KAAK,EAAE,MAAM,CAAA;CACd;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAQ1D;AAED,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,CAW1E;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,GAAG,cAAc,GAAG,IAAI,CAgB7G;AAED,wBAAgB,mBAAmB,CAAC,cAAc,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAYhG"}

package/dist/oauth/client.js

@@ -0,0 +1,54 @@
+// packages/hatk/src/oauth/client.ts
+export function isLoopbackClient(clientId) {
+    try {
+        const url = new URL(clientId);
+        const host = url.hostname.toLowerCase();
+        return host === 'localhost' || host === '127.0.0.1' || host === '[::1]';
+    }
+    catch {
+        return false;
+    }
+}
+export function getLoopbackClientMetadata(clientId) {
+    return {
+        client_id: clientId,
+        client_name: 'Loopback Client',
+        redirect_uris: [clientId],
+        grant_types: ['authorization_code', 'refresh_token'],
+        response_types: ['code'],
+        token_endpoint_auth_method: 'none',
+        dpop_bound_access_tokens: true,
+        scope: 'atproto',
+    };
+}
+export function resolveClient(clientId, registeredClients) {
+    if (isLoopbackClient(clientId))
+        return getLoopbackClientMetadata(clientId);
+    const found = registeredClients.find((c) => c.client_id === clientId);
+    if (!found)
+        return null;
+    return {
+        client_id: found.client_id,
+        client_name: found.client_name,
+        redirect_uris: found.redirect_uris,
+        grant_types: ['authorization_code', 'refresh_token'],
+        response_types: ['code'],
+        token_endpoint_auth_method: 'none',
+        dpop_bound_access_tokens: true,
+        scope: 'atproto',
+    };
+}
+export function validateRedirectUri(clientMetadata, redirectUri) {
+    if (isLoopbackClient(clientMetadata.client_id)) {
+        // Loopback: match by origin only
+        try {
+            const clientOrigin = new URL(clientMetadata.client_id).origin;
+            const redirectOrigin = new URL(redirectUri).origin;
+            return clientOrigin === redirectOrigin;
+        }
+        catch {
+            return false;
+        }
+    }
+    return clientMetadata.redirect_uris.includes(redirectUri);
+}

package/dist/oauth/crypto.d.ts

@@ -0,0 +1,28 @@
+export declare function base64UrlEncode(bytes: Uint8Array): string;
+export declare function base64UrlDecode(str: string): Uint8Array;
+export declare function generateKeyPair(): Promise<{
+    privateJwk: JsonWebKey;
+    publicJwk: JsonWebKey;
+}>;
+export declare function importPrivateKey(jwk: JsonWebKey): Promise<CryptoKey>;
+export declare function importPublicKey(jwk: JsonWebKey): Promise<CryptoKey>;
+export declare function signEs256(privateKey: CryptoKey, data: Uint8Array): Promise<Uint8Array>;
+export declare function verifyEs256(publicKey: CryptoKey, signature: Uint8Array, data: Uint8Array): Promise<boolean>;
+export declare function computeJwkThumbprint(jwk: {
+    kty?: string;
+    crv?: string;
+    x?: string;
+    y?: string;
+}): Promise<string>;
+export declare function sha256(data: string): Promise<Uint8Array>;
+export declare function createJwt(header: Record<string, unknown>, payload: Record<string, unknown>, signature: Uint8Array): string;
+export declare function parseJwt(token: string): {
+    header: any;
+    payload: any;
+    signatureInput: Uint8Array;
+    signature: Uint8Array;
+};
+export declare function signJwt(header: Record<string, unknown>, payload: Record<string, unknown>, privateKey: CryptoKey): Promise<string>;
+export declare function randomBytes(length: number): Uint8Array;
+export declare function randomToken(): string;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/oauth/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/oauth/crypto.ts"],"names":[],"mappings":"AAKA,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAKzD;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAQvD;AAeD,wBAAsB,eAAe,IAAI,OAAO,CAAC;IAAE,UAAU,EAAE,UAAU,CAAC;IAAC,SAAS,EAAE,UAAU,CAAA;CAAE,CAAC,CAKlG;AAED,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAE1E;AAED,wBAAsB,eAAe,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAEzE;AAED,wBAAsB,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAe5F;AAED,wBAAsB,WAAW,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAOjH;AAED,wBAAsB,oBAAoB,CAAC,GAAG,EAAE;IAC9C,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,CAAC,CAAC,EAAE,MAAM,CAAA;IACV,CAAC,CAAC,EAAE,MAAM,CAAA;CACX,GAAG,OAAO,CAAC,MAAM,CAAC,CAIlB;AAED,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAE9D;AAED,wBAAgB,SAAS,CACvB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,SAAS,EAAE,UAAU,GACpB,MAAM,CAKR;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG;IACvC,MAAM,EAAE,GAAG,CAAA;IACX,OAAO,EAAE,GAAG,CAAA;IACZ,cAAc,EAAE,UAAU,CAAA;IAC1B,SAAS,EAAE,UAAU,CAAA;CACtB,CAQA;AAED,wBAAsB,OAAO,CAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,UAAU,EAAE,SAAS,GACpB,OAAO,CAAC,MAAM,CAAC,CAMjB;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAEtD;AAED,wBAAgB,WAAW,IAAI,MAAM,CAEpC"}