@hatk/hatk 0.0.1-alpha.100 → 0.0.1-alpha.101

package/dist/server.js

@@ -1252,7 +1252,7 @@ export function createHandler(config) {
                     return withCors(jsonError(404, 'This instance receives no space notices', acceptEncoding));
                 const notice = parseWriteNotice(await request.json().catch(() => null));
                 if (!notice)
-                    return withCors(jsonError(400, 'Expected space, repo and rev', acceptEncoding));
+                    return withCors(jsonError(400, 'Expected space, repo and repoRev', acceptEncoding));
                 try {
                     await verifyNotice(request.headers.get('authorization'), {
                         iss: parseSpaceRef(notice.space).authority,

package/dist/spaces/blob.js

@@ -34,7 +34,7 @@ const SERVABLE = new Set(['image/jpeg', 'image/png', 'image/webp', 'image/avif',
  * a viewer who has just lost access still sees what they had. A minute is
  * small against what the surrounding design already accepts: the readable set
  * is cached for five, and the space host lets a minted credential outlive a
- * revocation by up to two hours.
+ * revocation by up to ten minutes unless the authority revokes it early.
  */
 const MAX_AGE_S = 60;
 /**

package/dist/spaces/credential.d.ts

@@ -13,12 +13,13 @@
  *   the reader's PDS signs a delegation token   (60s, single-use, addressed to
  *                                                the authority's space host)
  *   the authority checks it, checks the reader against the space's policy, and
- *   returns a credential bound to the key that signed our DPoP proof   (2h)
+ *   returns a credential bound to the key that signed the exchange   (10 min)
  *
  * — and the credential is then presented to every writer's host in the space.
  * It carries no audience, which is why it must be bound to a key rather than
- * held as a bearer token: a host handed a bearer credential to serve its own
- * repo could replay it against every other host in the space.
+ * held as a bearer token: each request signs the credential together with the
+ * DID it is addressed to, so a host handed one to serve its own repo cannot
+ * replay it against any other account. See signature.ts.
  *
  * The consequence to be honest about: a space is only readable while somebody
  * who can read it has a live session here. That is the same bound the data has
@@ -40,7 +41,10 @@ export interface SpaceCredential {
     /** The account whose delegation bought it. */
     readerDid: string;
     expiresAt: number;
-    /** A fetch that presents the credential with a fresh DPoP proof per request. */
+    /**
+     * A fetch that presents the credential, signed for whoever the request is
+     * addressed to: the `repo` it names, or else the space's authority.
+     */
     fetch: (input: string | URL, init?: RequestInit) => Promise<Response>;
 }
 /** Mint a credential for `space` using `readerDid`'s stored session. */
@@ -57,6 +61,6 @@ export declare function getSpaceCredential(oauthConfig: OAuthConfig, space: stri
     refresh?: boolean;
 }): Promise<SpaceCredential>;
 export declare function forgetSpaceCredential(space: string): void;
-/** For tests: drop every cached credential and the process binding key. */
+/** For tests: drop every cached credential. */
 export declare function resetSpaceCredentials(): void;
 //# sourceMappingURL=credential.d.ts.map

package/dist/spaces/credential.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential.d.ts","sourceRoot":"","sources":["../../src/spaces/credential.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAsB/C,qBAAa,oBAAqB,SAAQ,KAAK;IAE3C,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM;gBADZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM;CAIlB;AAED,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAErD;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEjD;AAED,MAAM,WAAW,eAAe;IAC9B,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAA;IACb,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,gFAAgF;IAChF,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CACtE;AAiDD,wEAAwE;AACxE,wBAAsB,mBAAmB,CACvC,WAAW,EAAE,WAAW,EACxB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,eAAe,CAAC,CAiC1B;AAUD;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,WAAW,EACxB,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAAE,EACpB,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GAC/B,OAAO,CAAC,eAAe,CAAC,CAwB1B;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAEzD;AAED,2EAA2E;AAC3E,wBAAgB,qBAAqB,IAAI,IAAI,CAG5C"}
+{"version":3,"file":"credential.d.ts","sourceRoot":"","sources":["../../src/spaces/credential.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAa/C,qBAAa,oBAAqB,SAAQ,KAAK;IAE3C,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM;gBADZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM;CAIlB;AAED,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAErD;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEjD;AAED,MAAM,WAAW,eAAe;IAC9B,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAA;IACb,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB;;;OAGG;IACH,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CACtE;AA4CD,wEAAwE;AACxE,wBAAsB,mBAAmB,CACvC,WAAW,EAAE,WAAW,EACxB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,eAAe,CAAC,CAwC1B;AAUD;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,WAAW,EACxB,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAAE,EACpB,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GAC/B,OAAO,CAAC,eAAe,CAAC,CAwB1B;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAEzD;AAED,+CAA+C;AAC/C,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C"}

package/dist/spaces/credential.js

@@ -13,36 +13,29 @@
  *   the reader's PDS signs a delegation token   (60s, single-use, addressed to
  *                                                the authority's space host)
  *   the authority checks it, checks the reader against the space's policy, and
- *   returns a credential bound to the key that signed our DPoP proof   (2h)
+ *   returns a credential bound to the key that signed the exchange   (10 min)
  *
  * — and the credential is then presented to every writer's host in the space.
  * It carries no audience, which is why it must be bound to a key rather than
- * held as a bearer token: a host handed a bearer credential to serve its own
- * repo could replay it against every other host in the space.
+ * held as a bearer token: each request signs the credential together with the
+ * DID it is addressed to, so a host handed one to serve its own repo cannot
+ * replay it against any other account. See signature.ts.
  *
  * The consequence to be honest about: a space is only readable while somebody
  * who can read it has a live session here. That is the same bound the data has
  * anyway — nobody outside the space's audience was ever entitled to this — but
  * it does mean indexing lapses when the last member logs out.
  */
-import { computeJwkThumbprint, generateKeyPair } from "../oauth/crypto.js";
-import { createDpopProof } from "../oauth/dpop.js";
 import { pdsXrpc } from "../pds-proxy.js";
 import { emit } from "../logger.js";
 import { spaceHostEndpoint } from "./identity.js";
+import { generateSpaceSigKey, spaceSigHeaders } from "./signature.js";
 import { parseSpaceRef } from "./uri.js";
-/** Re-mint this long before the credential's own expiry rather than racing it. */
-const RENEW_LEAD_MS = 5 * 60 * 1000;
 /**
- * The key credentials are bound to, generated once per process and never
- * persisted. It is registered nowhere, so a restart costs one round trip to
- * mint fresh credentials and nothing else.
+ * Re-mint this long before the credential's own expiry rather than racing it.
+ * Credentials live ten minutes, so this keeps nine of them.
  */
-let bindingKey = null;
-function getBindingKey() {
-    bindingKey ??= generateKeyPair();
-    return bindingKey;
-}
+const RENEW_LEAD_MS = 60 * 1000;
 export class SpaceCredentialError extends Error {
     status;
     code;
@@ -71,28 +64,19 @@ function expiryOf(jwt) {
     }
 }
 /**
- * Exchange a delegation token for a credential at the authority.
- *
- * The proof sent here carries no `ath`: a delegation token is an authorization
- * grant rather than an access token, so there is nothing to hash yet, and a
- * server that checks will refuse a proof that includes one. `dpopJkt` is sent
- * alongside because implementations differ on which they read — the reference
- * reads the proof, others read the field — and they agree here by construction.
+ * Exchange a delegation token for a credential at the authority, binding it to
+ * `key` by signing the token with it.
  */
-async function exchange(authorityHost, space, delegationToken) {
-    const { privateJwk, publicJwk } = await getBindingKey();
+async function exchange(authorityHost, space, delegationToken, key) {
     const url = `${authorityHost}/xrpc/com.atproto.space.getSpaceCredential`;
-    const proof = await createDpopProof(privateJwk, publicJwk, 'POST', url);
-    const dpopJkt = await computeJwkThumbprint(publicJwk);
     const res = await fetch(url, {
         method: 'POST',
         headers: {
             'Content-Type': 'application/json',
             Accept: 'application/json',
-            Authorization: `Bearer ${delegationToken}`,
-            DPoP: proof,
+            ...(await spaceSigHeaders(key, `Bearer ${delegationToken}`)),
         },
-        body: JSON.stringify({ space, dpopJkt }),
+        body: JSON.stringify({ space }),
     });
     const body = (await res.json().catch(() => ({})));
     if (!res.ok || !body.credential) {
@@ -120,17 +104,25 @@ export async function mintSpaceCredential(oauthConfig, space, readerDid) {
     catch (err) {
         throw new SpaceCredentialError(err?.status ?? 502, 'DelegationFailed', err?.message ?? 'delegation failed');
     }
+    // A key per credential, held only as long as the credential is.
+    const key = await generateSpaceSigKey();
     const authorityHost = await spaceHostEndpoint(ref.authority);
-    const credential = await exchange(authorityHost, space, token);
-    const { privateJwk, publicJwk } = await getBindingKey();
+    const credential = await exchange(authorityHost, space, token, key);
+    // Signatures depend only on the credential and the audience, so each is made
+    // once and reused for as long as the credential lives.
+    const signed = new Map();
     const credentialFetch = async (input, init) => {
         const url = typeof input === 'string' ? input : input.toString();
-        const method = (init?.method ?? 'GET').toUpperCase();
-        const proof = await createDpopProof(privateJwk, publicJwk, method, url, credential);
+        const audience = new URL(url).searchParams.get('repo') ?? ref.authority;
+        let sig = signed.get(audience);
+        if (!sig) {
+            sig = spaceSigHeaders(key, `Atproto-Space ${credential}`, audience);
+            signed.set(audience, sig);
+        }
         const headers = new Headers(init?.headers);
-        headers.set('Authorization', `DPoP ${credential}`);
-        headers.set('DPoP', proof);
-        return fetch(url, { ...init, method, headers });
+        for (const [name, value] of Object.entries(await sig))
+            headers.set(name, value);
+        return fetch(url, { ...init, headers });
     };
     return { space, readerDid, expiresAt: expiryOf(credential), fetch: credentialFetch };
 }
@@ -177,8 +169,7 @@ export async function getSpaceCredential(oauthConfig, space, candidates, opts =
 export function forgetSpaceCredential(space) {
     cache.delete(space);
 }
-/** For tests: drop every cached credential and the process binding key. */
+/** For tests: drop every cached credential. */
 export function resetSpaceCredentials() {
     cache.clear();
-    bindingKey = null;
 }

package/dist/spaces/engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/spaces/engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAQ/C,OAAO,EAA0D,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAE9G,OAAO,EAUL,KAAK,UAAU,EAChB,MAAM,YAAY,CAAA;AAMnB,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,WAAW,CAAA;IAClB,4EAA4E;IAC5E,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAClB,mFAAmF;IACnF,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IACxB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAaD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAEnE;AAOD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAQnE;AAoUD,iFAAiF;AACjF,wBAAsB,aAAa,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBjH;AAkED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAwCrE;AAID,oDAAoD;AACpD,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAUnE;AAED,kEAAkE;AAClE,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAW/D;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAKjG;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAclD"}
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/spaces/engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAQ/C,OAAO,EAA0D,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAE9G,OAAO,EAUL,KAAK,UAAU,EAChB,MAAM,YAAY,CAAA;AAMnB,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,WAAW,CAAA;IAClB,4EAA4E;IAC5E,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAClB,mFAAmF;IACnF,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IACxB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAaD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAEnE;AAOD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAQnE;AAqUD,iFAAiF;AACjF,wBAAsB,aAAa,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBjH;AAqED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAwCrE;AAID,oDAAoD;AACpD,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAUnE;AAED,kEAAkE;AAClE,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAW/D;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAKjG;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAclD"}

package/dist/spaces/engine.js

@@ -128,9 +128,10 @@ function codeOf(err) {
 /**
  * Run a credentialed read, re-minting once on a 401.
  *
- * A credential lives two hours and a sweep can outlive one. Re-minting costs a
- * round trip; treating the expiry as a failure costs the whole sync and leaves
- * the space looking unreadable when nothing about the membership changed.
+ * A credential lives ten minutes and a sweep can outlive one; an authority can
+ * also revoke one early. Re-minting costs a round trip; treating the refusal as
+ * a failure costs the whole sync and leaves the space looking unreadable when
+ * nothing about the membership changed.
  */
 async function withCredential(watch, operation) {
     let credential = await credentialFor(watch);
@@ -430,14 +431,17 @@ async function listWriters(watch, credential) {
             cursor,
             limit: 1000,
         });
+        // Ordered by space revision, and a repo updated mid-walk can turn up twice;
+        // the later entry is the newer state. The walk ends on an empty page, the
+        // only one without a cursor.
         for (const repo of (out.repos ?? [])) {
-            writers.push({ did: repo.did, rev: typeof repo.rev === 'string' ? repo.rev : null });
+            writers.push({ did: repo.did, rev: typeof repo.repoRev === 'string' ? repo.repoRev : null });
         }
         cursor = typeof out.cursor === 'string' ? out.cursor : undefined;
         if (!cursor)
             break;
     }
-    return writers;
+    return [...new Map(writers.map((w) => [w.did, w])).values()];
 }
 /**
  * Compare the authority's writer set against what the index holds, and close

package/dist/spaces/notify.d.ts

@@ -42,8 +42,17 @@ export declare function verifyNotice(authorization: string | null, expected: {
 export interface WriteNotice {
     space: string;
     repo: string;
-    rev: string;
+    /** The revision the repo reached. */
+    repoRev: string;
+    /** Where the authority sequenced the write across the whole space. */
+    spaceRev?: string;
 }
+/**
+ * A forwarded notice is `{ space, repo, repoRev, hash, spaceRev, prevSpaceRev? }`.
+ * An authority on a release before the space-revision split sends `rev` in
+ * place of `repoRev` and no `spaceRev`; that is read too, since nothing here
+ * depends on either beyond knowing which repo to look at.
+ */
 export declare function parseWriteNotice(body: unknown): WriteNotice | null;
 export declare function scheduleNoticeSync(key: string, run: () => Promise<void>, delay?: number): void;
 /** Drop every pending sync. For shutdown, and for tests. */

package/dist/spaces/notify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"notify.d.ts","sourceRoot":"","sources":["../../src/spaces/notify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAUH,qBAAa,WAAY,SAAQ,KAAK;IAElC,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM,EACvB,OAAO,EAAE,MAAM;CAIlB;AAcD;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,QAAQ,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAClD,OAAO,CAAC,IAAI,CAAC,CAiCf;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,GAAG,WAAW,GAAG,IAAI,CAMlE;AAcD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,SAAc,GAAG,IAAI,CASnG;AAED,4DAA4D;AAC5D,wBAAgB,mBAAmB,IAAI,IAAI,CAG1C"}
+{"version":3,"file":"notify.d.ts","sourceRoot":"","sources":["../../src/spaces/notify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAUH,qBAAa,WAAY,SAAQ,KAAK;IAElC,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM,EACvB,OAAO,EAAE,MAAM;CAIlB;AAcD;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,QAAQ,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAClD,OAAO,CAAC,IAAI,CAAC,CAiCf;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,qCAAqC;IACrC,OAAO,EAAE,MAAM,CAAA;IACf,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,GAAG,WAAW,GAAG,IAAI,CAOlE;AAcD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,SAAc,GAAG,IAAI,CASnG;AAED,4DAA4D;AAC5D,wBAAgB,mBAAmB,IAAI,IAAI,CAG1C"}

package/dist/spaces/notify.js

@@ -82,15 +82,22 @@ export async function verifyNotice(authorization, expected) {
         throw new NoticeError(403, 'Notice signature does not verify');
     }
 }
+/**
+ * A forwarded notice is `{ space, repo, repoRev, hash, spaceRev, prevSpaceRev? }`.
+ * An authority on a release before the space-revision split sends `rev` in
+ * place of `repoRev` and no `spaceRev`; that is read too, since nothing here
+ * depends on either beyond knowing which repo to look at.
+ */
 export function parseWriteNotice(body) {
     if (!body || typeof body !== 'object')
         return null;
-    const { space, repo, rev } = body;
-    if (typeof space !== 'string' || typeof repo !== 'string' || typeof rev !== 'string')
+    const { space, repo, repoRev, rev, spaceRev } = body;
+    const at = typeof repoRev === 'string' ? repoRev : rev;
+    if (typeof space !== 'string' || typeof repo !== 'string' || typeof at !== 'string')
         return null;
     if (!parseSpaceRef(space) || !repo.startsWith('did:'))
         return null;
-    return { space, repo, rev };
+    return { space, repo, repoRev: at, ...(typeof spaceRev === 'string' ? { spaceRev } : {}) };
 }
 /**
  * Collapse a burst of notices for the same repo into one sync.

package/dist/spaces/signature.d.ts

@@ -0,0 +1,36 @@
+/**
+ * The HTTP message signature a space credential travels with.
+ *
+ * RFC 9421, under the label `atproto-space`, signed ecdsa-p256-sha256 by a key
+ * made for one credential and named by its did:key. Two shapes:
+ *
+ *   exchange   the delegation token is signed alone, and the signature names
+ *              its key — that key is what the authority binds the credential
+ *              to (`cnf.kid`)
+ *   use        the credential is signed together with the DID the request is
+ *              addressed to, so a credential lifted off one request cannot be
+ *              replayed at another account by anyone without the key
+ *
+ * The signature is the raw 64-byte r || s, normalized to low-S: the reference
+ * verifier accepts either, but a stricter one (noble's default) only low-S.
+ */
+/** Encode base58btc. The inverse of `decodeBase58btc` in verify.ts. */
+export declare function encodeBase58btc(bytes: Uint8Array): string;
+export interface SpaceSigKey {
+    /** The public key as a P-256 did:key. */
+    did: string;
+    sign: (data: Uint8Array) => Promise<Uint8Array>;
+}
+/** A fresh P-256 key, held in memory only and never exported. */
+export declare function generateSpaceSigKey(): Promise<SpaceSigKey>;
+/**
+ * The bytes a signature covers: one line per covered field, then the
+ * signature parameters, joined by LF with no trailing newline.
+ */
+export declare function signatureBase(authorization: string, params: string, audience?: string): Uint8Array;
+/**
+ * Authorization, audience and signature headers for a space request. Without
+ * an audience this is the exchange; with one, a use of the credential.
+ */
+export declare function spaceSigHeaders(key: SpaceSigKey, authorization: string, audience?: string): Promise<Record<string, string>>;
+//# sourceMappingURL=signature.d.ts.map

package/dist/spaces/signature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature.d.ts","sourceRoot":"","sources":["../../src/spaces/signature.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAQH,uEAAuE;AACvE,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAqBzD;AAED,MAAM,WAAW,WAAW;IAC1B,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC,UAAU,CAAC,CAAA;CAChD;AAED,iEAAiE;AACjE,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,WAAW,CAAC,CAYhE;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,UAAU,CAKlG;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,WAAW,EAChB,aAAa,EAAE,MAAM,EACrB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAUjC"}

package/dist/spaces/signature.js

@@ -0,0 +1,83 @@
+/**
+ * The HTTP message signature a space credential travels with.
+ *
+ * RFC 9421, under the label `atproto-space`, signed ecdsa-p256-sha256 by a key
+ * made for one credential and named by its did:key. Two shapes:
+ *
+ *   exchange   the delegation token is signed alone, and the signature names
+ *              its key — that key is what the authority binds the credential
+ *              to (`cnf.kid`)
+ *   use        the credential is signed together with the DID the request is
+ *              addressed to, so a credential lifted off one request cannot be
+ *              replayed at another account by anyone without the key
+ *
+ * The signature is the raw 64-byte r || s, normalized to low-S: the reference
+ * verifier accepts either, but a stricter one (noble's default) only low-S.
+ */
+import { signEs256 } from "../oauth/crypto.js";
+const LABEL = 'atproto-space';
+const B58 = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
+/** Encode base58btc. The inverse of `decodeBase58btc` in verify.ts. */
+export function encodeBase58btc(bytes) {
+    const digits = [0];
+    for (const byte of bytes) {
+        let carry = byte;
+        for (let i = 0; i < digits.length; i++) {
+            carry += digits[i] << 8;
+            digits[i] = carry % 58;
+            carry = (carry / 58) | 0;
+        }
+        while (carry) {
+            digits.push(carry % 58);
+            carry = (carry / 58) | 0;
+        }
+    }
+    let out = '';
+    for (const byte of bytes) {
+        if (byte !== 0)
+            break;
+        out += '1';
+    }
+    for (let i = digits.length - 1; i >= 0; i--)
+        out += B58[digits[i]];
+    return out;
+}
+/** A fresh P-256 key, held in memory only and never exported. */
+export async function generateSpaceSigKey() {
+    const pair = await crypto.subtle.generateKey({ name: 'ECDSA', namedCurve: 'P-256' }, false, ['sign', 'verify']);
+    // 0x04 || x || y. A did:key carries the compressed point behind the
+    // p256-pub multicodec prefix (0x1200, varint 0x80 0x24).
+    const raw = new Uint8Array(await crypto.subtle.exportKey('raw', pair.publicKey));
+    const compressed = new Uint8Array(33);
+    compressed[0] = raw[64] & 1 ? 0x03 : 0x02;
+    compressed.set(raw.subarray(1, 33), 1);
+    return {
+        did: `did:key:z${encodeBase58btc(new Uint8Array([0x80, 0x24, ...compressed]))}`,
+        sign: (data) => signEs256(pair.privateKey, data),
+    };
+}
+/**
+ * The bytes a signature covers: one line per covered field, then the
+ * signature parameters, joined by LF with no trailing newline.
+ */
+export function signatureBase(authorization, params, audience) {
+    const lines = [`"authorization": ${authorization}`];
+    if (audience !== undefined)
+        lines.push(`"atproto-space-audience": ${audience}`);
+    lines.push(`"@signature-params": ${params}`);
+    return new TextEncoder().encode(lines.join('\n'));
+}
+/**
+ * Authorization, audience and signature headers for a space request. Without
+ * an audience this is the exchange; with one, a use of the credential.
+ */
+export async function spaceSigHeaders(key, authorization, audience) {
+    const params = audience === undefined ? `("authorization");keyid="${key.did}"` : '("authorization" "atproto-space-audience")';
+    const signature = await key.sign(signatureBase(authorization, params, audience));
+    return {
+        Authorization: authorization,
+        ...(audience !== undefined ? { 'Atproto-Space-Audience': audience } : {}),
+        'Signature-Input': `${LABEL}=${params}`,
+        Signature: `${LABEL}=:${Buffer.from(signature).toString('base64')}:`,
+    };
+}

package/dist/spaces/viewer.d.ts

@@ -20,7 +20,7 @@
  * somebody ejected from a community may still be served that community's rows
  * for a few minutes. The alternative is two round trips on every request, and
  * the space host itself already lets a minted credential outlive a revocation
- * by up to two hours.
+ * by up to ten minutes.
  */
 import type { OAuthConfig } from '../config.ts';
 import { type SpaceCredential } from './credential.ts';

package/dist/spaces/viewer.js

@@ -20,7 +20,7 @@
  * somebody ejected from a community may still be served that community's rows
  * for a few minutes. The alternative is two round trips on every request, and
  * the space host itself already lets a minted credential outlive a revocation
- * by up to two hours.
+ * by up to ten minutes.
  */
 import { emit } from "../logger.js";
 import { mintSpaceCredential, isSpaceGone } from "./credential.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hatk/hatk",
-  "version": "0.0.1-alpha.100",
+  "version": "0.0.1-alpha.101",
   "license": "MIT",
   "bin": {
     "hatk": "dist/cli.js"