@hatk/hatk 0.0.1-alpha.100 → 0.0.1-alpha.102

package/dist/server.js

@@ -1252,7 +1252,7 @@ export function createHandler(config) {
                     return withCors(jsonError(404, 'This instance receives no space notices', acceptEncoding));
                 const notice = parseWriteNotice(await request.json().catch(() => null));
                 if (!notice)
-                    return withCors(jsonError(400, 'Expected space, repo and rev', acceptEncoding));
+                    return withCors(jsonError(400, 'Expected space, repo and repoRev', acceptEncoding));
                 try {
                     await verifyNotice(request.headers.get('authorization'), {
                         iss: parseSpaceRef(notice.space).authority,

package/dist/spaces/blob.js

@@ -34,7 +34,7 @@ const SERVABLE = new Set(['image/jpeg', 'image/png', 'image/webp', 'image/avif',
  * a viewer who has just lost access still sees what they had. A minute is
  * small against what the surrounding design already accepts: the readable set
  * is cached for five, and the space host lets a minted credential outlive a
- * revocation by up to two hours.
+ * revocation by up to ten minutes unless the authority revokes it early.
  */
 const MAX_AGE_S = 60;
 /**

package/dist/spaces/credential.d.ts

@@ -13,12 +13,13 @@
  *   the reader's PDS signs a delegation token   (60s, single-use, addressed to
  *                                                the authority's space host)
  *   the authority checks it, checks the reader against the space's policy, and
- *   returns a credential bound to the key that signed our DPoP proof   (2h)
+ *   returns a credential bound to the key that signed the exchange   (10 min)
  *
  * — and the credential is then presented to every writer's host in the space.
  * It carries no audience, which is why it must be bound to a key rather than
- * held as a bearer token: a host handed a bearer credential to serve its own
- * repo could replay it against every other host in the space.
+ * held as a bearer token: each request signs the credential together with the
+ * DID it is addressed to, so a host handed one to serve its own repo cannot
+ * replay it against any other account. See signature.ts.
  *
  * The consequence to be honest about: a space is only readable while somebody
  * who can read it has a live session here. That is the same bound the data has
@@ -40,7 +41,10 @@ export interface SpaceCredential {
     /** The account whose delegation bought it. */
     readerDid: string;
     expiresAt: number;
-    /** A fetch that presents the credential with a fresh DPoP proof per request. */
+    /**
+     * A fetch that presents the credential, signed for whoever the request is
+     * addressed to: the `repo` it names, or else the space's authority.
+     */
     fetch: (input: string | URL, init?: RequestInit) => Promise<Response>;
 }
 /** Mint a credential for `space` using `readerDid`'s stored session. */
@@ -57,6 +61,22 @@ export declare function getSpaceCredential(oauthConfig: OAuthConfig, space: stri
     refresh?: boolean;
 }): Promise<SpaceCredential>;
 export declare function forgetSpaceCredential(space: string): void;
-/** For tests: drop every cached credential and the process binding key. */
+/**
+ * `readerDid`'s own credential for `space`, minted with their stored session.
+ *
+ * Throws a {@link SpaceCredentialError} when they may not read it, carrying the
+ * authority's status and code, and caches only successes — a refusal is asked
+ * again next time rather than remembered. `refresh` mints anew, for a read the
+ * host refused despite a credential that had not expired by our clock.
+ */
+export declare function readerSpaceCredential(oauthConfig: OAuthConfig, readerDid: string, space: string, opts?: {
+    refresh?: boolean;
+}): Promise<SpaceCredential>;
+/**
+ * Drop `readerDid`'s cached credential for `space`, after something that may
+ * have changed their standing in it — leaving it, say. The next read mints anew.
+ */
+export declare function forgetReaderSpaceCredential(readerDid: string, space: string): void;
+/** For tests: drop every cached credential. */
 export declare function resetSpaceCredentials(): void;
 //# sourceMappingURL=credential.d.ts.map

package/dist/spaces/credential.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential.d.ts","sourceRoot":"","sources":["../../src/spaces/credential.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAsB/C,qBAAa,oBAAqB,SAAQ,KAAK;IAE3C,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM;gBADZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM;CAIlB;AAED,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAErD;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEjD;AAED,MAAM,WAAW,eAAe;IAC9B,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAA;IACb,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,gFAAgF;IAChF,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CACtE;AAiDD,wEAAwE;AACxE,wBAAsB,mBAAmB,CACvC,WAAW,EAAE,WAAW,EACxB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,eAAe,CAAC,CAiC1B;AAUD;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,WAAW,EACxB,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAAE,EACpB,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GAC/B,OAAO,CAAC,eAAe,CAAC,CAwB1B;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAEzD;AAED,2EAA2E;AAC3E,wBAAgB,qBAAqB,IAAI,IAAI,CAG5C"}
+{"version":3,"file":"credential.d.ts","sourceRoot":"","sources":["../../src/spaces/credential.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAa/C,qBAAa,oBAAqB,SAAQ,KAAK;IAE3C,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM;gBADZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM;CAIlB;AAED,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAErD;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEjD;AAED,MAAM,WAAW,eAAe;IAC9B,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAA;IACb,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB;;;OAGG;IACH,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CACtE;AA4CD,wEAAwE;AACxE,wBAAsB,mBAAmB,CACvC,WAAW,EAAE,WAAW,EACxB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,eAAe,CAAC,CAwC1B;AAUD;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,WAAW,EACxB,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAAE,EACpB,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GAC/B,OAAO,CAAC,eAAe,CAAC,CAwB1B;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAEzD;AAgBD;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,WAAW,EAAE,WAAW,EACxB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GAC/B,OAAO,CAAC,eAAe,CAAC,CAgB1B;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAElF;AAED,+CAA+C;AAC/C,wBAAgB,qBAAqB,IAAI,IAAI,CAG5C"}

package/dist/spaces/credential.js

@@ -13,36 +13,29 @@
  *   the reader's PDS signs a delegation token   (60s, single-use, addressed to
  *                                                the authority's space host)
  *   the authority checks it, checks the reader against the space's policy, and
- *   returns a credential bound to the key that signed our DPoP proof   (2h)
+ *   returns a credential bound to the key that signed the exchange   (10 min)
  *
  * — and the credential is then presented to every writer's host in the space.
  * It carries no audience, which is why it must be bound to a key rather than
- * held as a bearer token: a host handed a bearer credential to serve its own
- * repo could replay it against every other host in the space.
+ * held as a bearer token: each request signs the credential together with the
+ * DID it is addressed to, so a host handed one to serve its own repo cannot
+ * replay it against any other account. See signature.ts.
  *
  * The consequence to be honest about: a space is only readable while somebody
  * who can read it has a live session here. That is the same bound the data has
  * anyway — nobody outside the space's audience was ever entitled to this — but
  * it does mean indexing lapses when the last member logs out.
  */
-import { computeJwkThumbprint, generateKeyPair } from "../oauth/crypto.js";
-import { createDpopProof } from "../oauth/dpop.js";
 import { pdsXrpc } from "../pds-proxy.js";
 import { emit } from "../logger.js";
 import { spaceHostEndpoint } from "./identity.js";
+import { generateSpaceSigKey, spaceSigHeaders } from "./signature.js";
 import { parseSpaceRef } from "./uri.js";
-/** Re-mint this long before the credential's own expiry rather than racing it. */
-const RENEW_LEAD_MS = 5 * 60 * 1000;
 /**
- * The key credentials are bound to, generated once per process and never
- * persisted. It is registered nowhere, so a restart costs one round trip to
- * mint fresh credentials and nothing else.
+ * Re-mint this long before the credential's own expiry rather than racing it.
+ * Credentials live ten minutes, so this keeps nine of them.
  */
-let bindingKey = null;
-function getBindingKey() {
-    bindingKey ??= generateKeyPair();
-    return bindingKey;
-}
+const RENEW_LEAD_MS = 60 * 1000;
 export class SpaceCredentialError extends Error {
     status;
     code;
@@ -71,28 +64,19 @@ function expiryOf(jwt) {
     }
 }
 /**
- * Exchange a delegation token for a credential at the authority.
- *
- * The proof sent here carries no `ath`: a delegation token is an authorization
- * grant rather than an access token, so there is nothing to hash yet, and a
- * server that checks will refuse a proof that includes one. `dpopJkt` is sent
- * alongside because implementations differ on which they read — the reference
- * reads the proof, others read the field — and they agree here by construction.
+ * Exchange a delegation token for a credential at the authority, binding it to
+ * `key` by signing the token with it.
  */
-async function exchange(authorityHost, space, delegationToken) {
-    const { privateJwk, publicJwk } = await getBindingKey();
+async function exchange(authorityHost, space, delegationToken, key) {
     const url = `${authorityHost}/xrpc/com.atproto.space.getSpaceCredential`;
-    const proof = await createDpopProof(privateJwk, publicJwk, 'POST', url);
-    const dpopJkt = await computeJwkThumbprint(publicJwk);
     const res = await fetch(url, {
         method: 'POST',
         headers: {
             'Content-Type': 'application/json',
             Accept: 'application/json',
-            Authorization: `Bearer ${delegationToken}`,
-            DPoP: proof,
+            ...(await spaceSigHeaders(key, `Bearer ${delegationToken}`)),
         },
-        body: JSON.stringify({ space, dpopJkt }),
+        body: JSON.stringify({ space }),
     });
     const body = (await res.json().catch(() => ({})));
     if (!res.ok || !body.credential) {
@@ -120,17 +104,25 @@ export async function mintSpaceCredential(oauthConfig, space, readerDid) {
     catch (err) {
         throw new SpaceCredentialError(err?.status ?? 502, 'DelegationFailed', err?.message ?? 'delegation failed');
     }
+    // A key per credential, held only as long as the credential is.
+    const key = await generateSpaceSigKey();
     const authorityHost = await spaceHostEndpoint(ref.authority);
-    const credential = await exchange(authorityHost, space, token);
-    const { privateJwk, publicJwk } = await getBindingKey();
+    const credential = await exchange(authorityHost, space, token, key);
+    // Signatures depend only on the credential and the audience, so each is made
+    // once and reused for as long as the credential lives.
+    const signed = new Map();
     const credentialFetch = async (input, init) => {
         const url = typeof input === 'string' ? input : input.toString();
-        const method = (init?.method ?? 'GET').toUpperCase();
-        const proof = await createDpopProof(privateJwk, publicJwk, method, url, credential);
+        const audience = new URL(url).searchParams.get('repo') ?? ref.authority;
+        let sig = signed.get(audience);
+        if (!sig) {
+            sig = spaceSigHeaders(key, `Atproto-Space ${credential}`, audience);
+            signed.set(audience, sig);
+        }
         const headers = new Headers(init?.headers);
-        headers.set('Authorization', `DPoP ${credential}`);
-        headers.set('DPoP', proof);
-        return fetch(url, { ...init, method, headers });
+        for (const [name, value] of Object.entries(await sig))
+            headers.set(name, value);
+        return fetch(url, { ...init, headers });
     };
     return { space, readerDid, expiresAt: expiryOf(credential), fetch: credentialFetch };
 }
@@ -177,8 +169,52 @@ export async function getSpaceCredential(oauthConfig, space, candidates, opts =
 export function forgetSpaceCredential(space) {
     cache.delete(space);
 }
-/** For tests: drop every cached credential and the process binding key. */
+// --- Per reader ---
+/**
+ * Credentials minted as one particular reader, for reads made on their behalf.
+ *
+ * Kept apart from the cache above, which holds whichever session works for a
+ * space and is right for indexing it. A read made for a viewer has to be made
+ * as that viewer: the authority's answer is the authorization.
+ */
+const readerCache = new Map();
+/** Pairs held at once. Past this the least recently used goes. */
+const MAX_READER_CREDENTIALS = 5000;
+/**
+ * `readerDid`'s own credential for `space`, minted with their stored session.
+ *
+ * Throws a {@link SpaceCredentialError} when they may not read it, carrying the
+ * authority's status and code, and caches only successes — a refusal is asked
+ * again next time rather than remembered. `refresh` mints anew, for a read the
+ * host refused despite a credential that had not expired by our clock.
+ */
+export async function readerSpaceCredential(oauthConfig, readerDid, space, opts = {}) {
+    const key = `${readerDid} ${space}`;
+    const cached = readerCache.get(key);
+    readerCache.delete(key);
+    if (!opts.refresh && fresh(cached)) {
+        readerCache.set(key, cached);
+        return cached;
+    }
+    const credential = await mintSpaceCredential(oauthConfig, space, readerDid);
+    readerCache.set(key, credential);
+    while (readerCache.size > MAX_READER_CREDENTIALS) {
+        const oldest = readerCache.keys().next();
+        if (oldest.done)
+            break;
+        readerCache.delete(oldest.value);
+    }
+    return credential;
+}
+/**
+ * Drop `readerDid`'s cached credential for `space`, after something that may
+ * have changed their standing in it — leaving it, say. The next read mints anew.
+ */
+export function forgetReaderSpaceCredential(readerDid, space) {
+    readerCache.delete(`${readerDid} ${space}`);
+}
+/** For tests: drop every cached credential. */
 export function resetSpaceCredentials() {
     cache.clear();
-    bindingKey = null;
+    readerCache.clear();
 }

package/dist/spaces/engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/spaces/engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAQ/C,OAAO,EAA0D,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAE9G,OAAO,EAUL,KAAK,UAAU,EAChB,MAAM,YAAY,CAAA;AAMnB,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,WAAW,CAAA;IAClB,4EAA4E;IAC5E,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAClB,mFAAmF;IACnF,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IACxB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAaD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAEnE;AAOD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAQnE;AAoUD,iFAAiF;AACjF,wBAAsB,aAAa,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBjH;AAkED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAwCrE;AAID,oDAAoD;AACpD,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAUnE;AAED,kEAAkE;AAClE,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAW/D;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAKjG;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAclD"}
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/spaces/engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAQ/C,OAAO,EAA0D,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAE9G,OAAO,EAUL,KAAK,UAAU,EAChB,MAAM,YAAY,CAAA;AAMnB,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,WAAW,CAAA;IAClB,4EAA4E;IAC5E,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAClB,mFAAmF;IACnF,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IACxB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAaD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAEnE;AAOD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAQnE;AAqUD,iFAAiF;AACjF,wBAAsB,aAAa,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBjH;AAqED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAwCrE;AAID,oDAAoD;AACpD,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAUnE;AAED,kEAAkE;AAClE,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAW/D;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAKjG;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAclD"}

package/dist/spaces/engine.js

@@ -128,9 +128,10 @@ function codeOf(err) {
 /**
  * Run a credentialed read, re-minting once on a 401.
  *
- * A credential lives two hours and a sweep can outlive one. Re-minting costs a
- * round trip; treating the expiry as a failure costs the whole sync and leaves
- * the space looking unreadable when nothing about the membership changed.
+ * A credential lives ten minutes and a sweep can outlive one; an authority can
+ * also revoke one early. Re-minting costs a round trip; treating the refusal as
+ * a failure costs the whole sync and leaves the space looking unreadable when
+ * nothing about the membership changed.
  */
 async function withCredential(watch, operation) {
     let credential = await credentialFor(watch);
@@ -430,14 +431,17 @@ async function listWriters(watch, credential) {
             cursor,
             limit: 1000,
         });
+        // Ordered by space revision, and a repo updated mid-walk can turn up twice;
+        // the later entry is the newer state. The walk ends on an empty page, the
+        // only one without a cursor.
         for (const repo of (out.repos ?? [])) {
-            writers.push({ did: repo.did, rev: typeof repo.rev === 'string' ? repo.rev : null });
+            writers.push({ did: repo.did, rev: typeof repo.repoRev === 'string' ? repo.repoRev : null });
         }
         cursor = typeof out.cursor === 'string' ? out.cursor : undefined;
         if (!cursor)
             break;
     }
-    return writers;
+    return [...new Map(writers.map((w) => [w.did, w])).values()];
 }
 /**
  * Compare the authority's writer set against what the index holds, and close

package/dist/spaces/index.d.ts

@@ -8,7 +8,7 @@
 import type { OAuthConfig, SpacesConfig } from '../config.ts';
 import { unwatchSpace, watchSpace } from './engine.ts';
 export { collectionsForSpaceType, reconcileAll, reconcileSpace, syncSpaceRepo, unwatchSpace, watchSpace, } from './engine.ts';
-export { getSpaceCredential, mintSpaceCredential, isNotAuthorized, isSpaceGone } from './credential.ts';
+export { getSpaceCredential, mintSpaceCredential, readerSpaceCredential, forgetReaderSpaceCredential, isNotAuthorized, isSpaceGone, SpaceCredentialError, type SpaceCredential, } from './credential.ts';
 export { listSpaceRepos, listSpaceWatches, type SpaceWatch } from './store.ts';
 export { isSpaceReadable, readableSpaces, withReadableSpaces } from './visibility.ts';
 export { UngatedSpaceQueryError, spaceBackedCollections } from './guard.ts';
@@ -21,6 +21,7 @@ export { forgetViewerSpaces, readableSpacesFor, viewerCredential } from './viewe
 export declare function serverDpopProof(method: string, url: string, accessToken?: string, nonce?: string): Promise<string>;
 export { handleWriteNotice } from './engine.ts';
 export { clearPendingNotices, NoticeError, parseWriteNotice, scheduleNoticeSync, verifyNotice, type WriteNotice, } from './notify.ts';
+export { generateSpaceSigKey, spaceSigHeaders, type SpaceSigKey } from './signature.ts';
 export * from './uri.ts';
 export { asPreset, blobCid, resetSpaceBlobCache, type SpaceBlobPreset, spaceBlobUrl } from './blob.ts';
 export { records, requireSpace, spaceRecords } from './records.ts';

package/dist/spaces/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/spaces/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAG7D,OAAO,EAA+D,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAOnH,OAAO,EACL,uBAAuB,EACvB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,YAAY,EACZ,UAAU,GACX,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AACvG,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAA;AAC9E,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACrF,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AAC3E,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAErF;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,WAAW,CAAC,EAAE,MAAM,EACpB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAIjB;AACD,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAC/C,OAAO,EACL,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,KAAK,WAAW,GACjB,MAAM,aAAa,CAAA;AACpB,cAAc,UAAU,CAAA;AACxB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,mBAAmB,EAAE,KAAK,eAAe,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AACtG,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAWlE,wBAAgB,cAAc,IAAI,MAAM,GAAG,IAAI,CAE9C;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAYzG;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,YAAY,CAAA;IACpB,KAAK,EAAE,WAAW,GAAG,IAAI,CAAA;IACzB,GAAG,EAAE,MAAM,CAAA;IACX,6CAA6C;IAC7C,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CACzB;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAqD1D;AAED,wBAAgB,UAAU,IAAI,IAAI,CAMjC;AAED,+FAA+F;AAC/F,OAAO,EAAE,UAAU,IAAI,WAAW,EAAE,YAAY,IAAI,aAAa,EAAE,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/spaces/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAG7D,OAAO,EAA+D,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAOnH,OAAO,EACL,uBAAuB,EACvB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,YAAY,EACZ,UAAU,GACX,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,2BAA2B,EAC3B,eAAe,EACf,WAAW,EACX,oBAAoB,EACpB,KAAK,eAAe,GACrB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAA;AAC9E,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACrF,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AAC3E,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAErF;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,WAAW,CAAC,EAAE,MAAM,EACpB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAIjB;AACD,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAC/C,OAAO,EACL,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,KAAK,WAAW,GACjB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAA;AACvF,cAAc,UAAU,CAAA;AACxB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,mBAAmB,EAAE,KAAK,eAAe,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AACtG,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAWlE,wBAAgB,cAAc,IAAI,MAAM,GAAG,IAAI,CAE9C;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAYzG;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,YAAY,CAAA;IACpB,KAAK,EAAE,WAAW,GAAG,IAAI,CAAA;IACzB,GAAG,EAAE,MAAM,CAAA;IACX,6CAA6C;IAC7C,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CACzB;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAqD1D;AAED,wBAAgB,UAAU,IAAI,IAAI,CAMjC;AAED,+FAA+F;AAC/F,OAAO,EAAE,UAAU,IAAI,WAAW,EAAE,YAAY,IAAI,aAAa,EAAE,CAAA"}

package/dist/spaces/index.js

@@ -14,7 +14,7 @@ import { clearPendingNotices } from "./notify.js";
 import { getServerKey } from "../oauth/db.js";
 import { createDpopProof } from "../oauth/dpop.js";
 export { collectionsForSpaceType, reconcileAll, reconcileSpace, syncSpaceRepo, unwatchSpace, watchSpace, } from "./engine.js";
-export { getSpaceCredential, mintSpaceCredential, isNotAuthorized, isSpaceGone } from "./credential.js";
+export { getSpaceCredential, mintSpaceCredential, readerSpaceCredential, forgetReaderSpaceCredential, isNotAuthorized, isSpaceGone, SpaceCredentialError, } from "./credential.js";
 export { listSpaceRepos, listSpaceWatches } from "./store.js";
 export { isSpaceReadable, readableSpaces, withReadableSpaces } from "./visibility.js";
 export { UngatedSpaceQueryError, spaceBackedCollections } from "./guard.js";
@@ -32,6 +32,7 @@ export async function serverDpopProof(method, url, accessToken, nonce) {
 }
 export { handleWriteNotice } from "./engine.js";
 export { clearPendingNotices, NoticeError, parseWriteNotice, scheduleNoticeSync, verifyNotice, } from "./notify.js";
+export { generateSpaceSigKey, spaceSigHeaders } from "./signature.js";
 export * from "./uri.js";
 export { asPreset, blobCid, resetSpaceBlobCache, spaceBlobUrl } from "./blob.js";
 export { records, requireSpace, spaceRecords } from "./records.js";

package/dist/spaces/notify.d.ts

@@ -42,8 +42,17 @@ export declare function verifyNotice(authorization: string | null, expected: {
 export interface WriteNotice {
     space: string;
     repo: string;
-    rev: string;
+    /** The revision the repo reached. */
+    repoRev: string;
+    /** Where the authority sequenced the write across the whole space. */
+    spaceRev?: string;
 }
+/**
+ * A forwarded notice is `{ space, repo, repoRev, hash, spaceRev, prevSpaceRev? }`.
+ * An authority on a release before the space-revision split sends `rev` in
+ * place of `repoRev` and no `spaceRev`; that is read too, since nothing here
+ * depends on either beyond knowing which repo to look at.
+ */
 export declare function parseWriteNotice(body: unknown): WriteNotice | null;
 export declare function scheduleNoticeSync(key: string, run: () => Promise<void>, delay?: number): void;
 /** Drop every pending sync. For shutdown, and for tests. */

package/dist/spaces/notify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"notify.d.ts","sourceRoot":"","sources":["../../src/spaces/notify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAUH,qBAAa,WAAY,SAAQ,KAAK;IAElC,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM,EACvB,OAAO,EAAE,MAAM;CAIlB;AAcD;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,QAAQ,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAClD,OAAO,CAAC,IAAI,CAAC,CAiCf;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,GAAG,WAAW,GAAG,IAAI,CAMlE;AAcD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,SAAc,GAAG,IAAI,CASnG;AAED,4DAA4D;AAC5D,wBAAgB,mBAAmB,IAAI,IAAI,CAG1C"}
+{"version":3,"file":"notify.d.ts","sourceRoot":"","sources":["../../src/spaces/notify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAUH,qBAAa,WAAY,SAAQ,KAAK;IAElC,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM,EACvB,OAAO,EAAE,MAAM;CAIlB;AAcD;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,QAAQ,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAClD,OAAO,CAAC,IAAI,CAAC,CAiCf;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,qCAAqC;IACrC,OAAO,EAAE,MAAM,CAAA;IACf,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,GAAG,WAAW,GAAG,IAAI,CAOlE;AAcD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,SAAc,GAAG,IAAI,CASnG;AAED,4DAA4D;AAC5D,wBAAgB,mBAAmB,IAAI,IAAI,CAG1C"}

package/dist/spaces/notify.js

@@ -82,15 +82,22 @@ export async function verifyNotice(authorization, expected) {
         throw new NoticeError(403, 'Notice signature does not verify');
     }
 }
+/**
+ * A forwarded notice is `{ space, repo, repoRev, hash, spaceRev, prevSpaceRev? }`.
+ * An authority on a release before the space-revision split sends `rev` in
+ * place of `repoRev` and no `spaceRev`; that is read too, since nothing here
+ * depends on either beyond knowing which repo to look at.
+ */
 export function parseWriteNotice(body) {
     if (!body || typeof body !== 'object')
         return null;
-    const { space, repo, rev } = body;
-    if (typeof space !== 'string' || typeof repo !== 'string' || typeof rev !== 'string')
+    const { space, repo, repoRev, rev, spaceRev } = body;
+    const at = typeof repoRev === 'string' ? repoRev : rev;
+    if (typeof space !== 'string' || typeof repo !== 'string' || typeof at !== 'string')
         return null;
     if (!parseSpaceRef(space) || !repo.startsWith('did:'))
         return null;
-    return { space, repo, rev };
+    return { space, repo, repoRev: at, ...(typeof spaceRev === 'string' ? { spaceRev } : {}) };
 }
 /**
  * Collapse a burst of notices for the same repo into one sync.

package/dist/spaces/signature.d.ts

@@ -0,0 +1,36 @@
+/**
+ * The HTTP message signature a space credential travels with.
+ *
+ * RFC 9421, under the label `atproto-space`, signed ecdsa-p256-sha256 by a key
+ * made for one credential and named by its did:key. Two shapes:
+ *
+ *   exchange   the delegation token is signed alone, and the signature names
+ *              its key — that key is what the authority binds the credential
+ *              to (`cnf.kid`)
+ *   use        the credential is signed together with the DID the request is
+ *              addressed to, so a credential lifted off one request cannot be
+ *              replayed at another account by anyone without the key
+ *
+ * The signature is the raw 64-byte r || s, normalized to low-S: the reference
+ * verifier accepts either, but a stricter one (noble's default) only low-S.
+ */
+/** Encode base58btc. The inverse of `decodeBase58btc` in verify.ts. */
+export declare function encodeBase58btc(bytes: Uint8Array): string;
+export interface SpaceSigKey {
+    /** The public key as a P-256 did:key. */
+    did: string;
+    sign: (data: Uint8Array) => Promise<Uint8Array>;
+}
+/** A fresh P-256 key, held in memory only and never exported. */
+export declare function generateSpaceSigKey(): Promise<SpaceSigKey>;
+/**
+ * The bytes a signature covers: one line per covered field, then the
+ * signature parameters, joined by LF with no trailing newline.
+ */
+export declare function signatureBase(authorization: string, params: string, audience?: string): Uint8Array;
+/**
+ * Authorization, audience and signature headers for a space request. Without
+ * an audience this is the exchange; with one, a use of the credential.
+ */
+export declare function spaceSigHeaders(key: SpaceSigKey, authorization: string, audience?: string): Promise<Record<string, string>>;
+//# sourceMappingURL=signature.d.ts.map

package/dist/spaces/signature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature.d.ts","sourceRoot":"","sources":["../../src/spaces/signature.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAQH,uEAAuE;AACvE,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAqBzD;AAED,MAAM,WAAW,WAAW;IAC1B,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC,UAAU,CAAC,CAAA;CAChD;AAED,iEAAiE;AACjE,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,WAAW,CAAC,CAYhE;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,UAAU,CAKlG;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,WAAW,EAChB,aAAa,EAAE,MAAM,EACrB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAUjC"}

package/dist/spaces/signature.js

@@ -0,0 +1,83 @@
+/**
+ * The HTTP message signature a space credential travels with.
+ *
+ * RFC 9421, under the label `atproto-space`, signed ecdsa-p256-sha256 by a key
+ * made for one credential and named by its did:key. Two shapes:
+ *
+ *   exchange   the delegation token is signed alone, and the signature names
+ *              its key — that key is what the authority binds the credential
+ *              to (`cnf.kid`)
+ *   use        the credential is signed together with the DID the request is
+ *              addressed to, so a credential lifted off one request cannot be
+ *              replayed at another account by anyone without the key
+ *
+ * The signature is the raw 64-byte r || s, normalized to low-S: the reference
+ * verifier accepts either, but a stricter one (noble's default) only low-S.
+ */
+import { signEs256 } from "../oauth/crypto.js";
+const LABEL = 'atproto-space';
+const B58 = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
+/** Encode base58btc. The inverse of `decodeBase58btc` in verify.ts. */
+export function encodeBase58btc(bytes) {
+    const digits = [0];
+    for (const byte of bytes) {
+        let carry = byte;
+        for (let i = 0; i < digits.length; i++) {
+            carry += digits[i] << 8;
+            digits[i] = carry % 58;
+            carry = (carry / 58) | 0;
+        }
+        while (carry) {
+            digits.push(carry % 58);
+            carry = (carry / 58) | 0;
+        }
+    }
+    let out = '';
+    for (const byte of bytes) {
+        if (byte !== 0)
+            break;
+        out += '1';
+    }
+    for (let i = digits.length - 1; i >= 0; i--)
+        out += B58[digits[i]];
+    return out;
+}
+/** A fresh P-256 key, held in memory only and never exported. */
+export async function generateSpaceSigKey() {
+    const pair = await crypto.subtle.generateKey({ name: 'ECDSA', namedCurve: 'P-256' }, false, ['sign', 'verify']);
+    // 0x04 || x || y. A did:key carries the compressed point behind the
+    // p256-pub multicodec prefix (0x1200, varint 0x80 0x24).
+    const raw = new Uint8Array(await crypto.subtle.exportKey('raw', pair.publicKey));
+    const compressed = new Uint8Array(33);
+    compressed[0] = raw[64] & 1 ? 0x03 : 0x02;
+    compressed.set(raw.subarray(1, 33), 1);
+    return {
+        did: `did:key:z${encodeBase58btc(new Uint8Array([0x80, 0x24, ...compressed]))}`,
+        sign: (data) => signEs256(pair.privateKey, data),
+    };
+}
+/**
+ * The bytes a signature covers: one line per covered field, then the
+ * signature parameters, joined by LF with no trailing newline.
+ */
+export function signatureBase(authorization, params, audience) {
+    const lines = [`"authorization": ${authorization}`];
+    if (audience !== undefined)
+        lines.push(`"atproto-space-audience": ${audience}`);
+    lines.push(`"@signature-params": ${params}`);
+    return new TextEncoder().encode(lines.join('\n'));
+}
+/**
+ * Authorization, audience and signature headers for a space request. Without
+ * an audience this is the exchange; with one, a use of the credential.
+ */
+export async function spaceSigHeaders(key, authorization, audience) {
+    const params = audience === undefined ? `("authorization");keyid="${key.did}"` : '("authorization" "atproto-space-audience")';
+    const signature = await key.sign(signatureBase(authorization, params, audience));
+    return {
+        Authorization: authorization,
+        ...(audience !== undefined ? { 'Atproto-Space-Audience': audience } : {}),
+        'Signature-Input': `${LABEL}=${params}`,
+        Signature: `${LABEL}=:${Buffer.from(signature).toString('base64')}:`,
+    };
+}

package/dist/spaces/viewer.d.ts

@@ -20,7 +20,7 @@
  * somebody ejected from a community may still be served that community's rows
  * for a few minutes. The alternative is two round trips on every request, and
  * the space host itself already lets a minted credential outlive a revocation
- * by up to two hours.
+ * by up to ten minutes.
  */
 import type { OAuthConfig } from '../config.ts';
 import { type SpaceCredential } from './credential.ts';

package/dist/spaces/viewer.js

@@ -20,7 +20,7 @@
  * somebody ejected from a community may still be served that community's rows
  * for a few minutes. The alternative is two round trips on every request, and
  * the space host itself already lets a minted credential outlive a revocation
- * by up to two hours.
+ * by up to ten minutes.
  */
 import { emit } from "../logger.js";
 import { mintSpaceCredential, isSpaceGone } from "./credential.js";

package/dist/xrpc.d.ts

@@ -1,3 +1,4 @@
+import { type SpaceCredential } from './spaces/credential.ts';
 import type { BaseContext } from './hydrate.ts';
 import type { Row, FlatRow } from './lex-types.ts';
 import type { OAuthConfig, CdnConfig } from './config.ts';
@@ -82,6 +83,26 @@ export interface XrpcContext<P = Record<string, string>, Records extends Record<
      * the granted scopes still apply. See {@link pdsXrpc}.
      */
     pds: (nsid: string, options?: PdsXrpcOptions) => Promise<Record<string, unknown>>;
+    /**
+     * The viewer's own credential for a space, minted with their session and
+     * cached until shortly before it expires. Its `fetch` presents it to any
+     * host in the space, signed for the repo a request names (or the authority).
+     *
+     * For reads an app makes itself, as the viewer, that the index does not
+     * serve. Throws a `SpaceCredentialError` — `status` and `code` are the
+     * authority's — when the viewer may not read the space, and with status 401
+     * when there is no viewer. Pass `refresh` after a host refuses a credential
+     * that had not yet expired.
+     */
+    spaceCredential: (space: string, opts?: {
+        refresh?: boolean;
+    }) => Promise<SpaceCredential>;
+    /**
+     * Drop the viewer's cached credential for a space, after something that may
+     * have changed their standing in it, such as leaving. Does nothing without a
+     * viewer.
+     */
+    forgetSpaceCredential: (space: string) => void;
     /**
      * The record helpers and `pds` above, acting as another account this app
      * holds a session for — one it obtained with {@link obtainSession}, say.

package/dist/xrpc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"xrpc.d.ts","sourceRoot":"","sources":["../src/xrpc.ts"],"names":[],"mappings":"AAuCA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAE/C,OAAO,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AAElD,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAEzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AACpD,OAAO,EAAqC,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAE3F,YAAY,EAAE,GAAG,EAAE,OAAO,EAAE,CAAA;AAI5B,mFAAmF;AACnF,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,QAExD;AAED,gFAAgF;AAChF,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,MAAM,SAAM;IACZ,SAAS,CAAC,EAAE,MAAM,CAAA;gBACN,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM;CAIhD;AACD,0DAA0D;AAC1D,qBAAa,aAAc,SAAQ,mBAAmB;IACpD,MAAM,SAAM;gBACA,OAAO,SAAc;CAGlC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW,CAC1B,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC1B,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzD,CAAC,GAAG,OAAO,CACX,SAAQ,WAAW;IACnB,EAAE,EAAE;QACF,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;QAC9D,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;QACvD,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;KACpE,CAAA;IACD,MAAM,EAAE,CAAC,CAAA;IACT,KAAK,EAAE,CAAC,CAAA;IACR,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,MAAM,CAAA;IAC7D,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;IACzE,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IAC9C,mBAAmB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;IAC7D,MAAM,EAAE,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,OAAO,EACvC,UAAU,EAAE,CAAC,EACb,CAAC,EAAE,MAAM,EACT,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,KACxD,OAAO,CAAC;QAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC7D,OAAO,EAAE,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAC3D,MAAM,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IACjF,YAAY,EAAE,CACZ,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,KACrB,OAAO,CAAC;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC5C,SAAS,EAAE,CACT,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,OAAO,CAAC;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC5C,YAAY,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACjE,WAAW,EAAE,CACX,MAAM,EAAE,KAAK,CAAC;QACZ,KAAK,EAAE,MAAM,CAAA;QACb,UAAU,EAAE,MAAM,CAAA;QAClB,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAChC,CAAC,KACC,OAAO,CAAC;QAAE,OAAO,CAAC,EAAE,KAAK,CAAC;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,GAAG,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC,CAAA;IAChF;;;;OAIG;IACH,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IACjF;;;;;OAKG;IACH,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,cAAc,CAAA;IAC1C;;;;;;;OAOG;IACH,aAAa,EAAE,CACb,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,KACxC,OAAO,CAAC,eAAe,CAAC,CAAA;CAC9B;AAED,+DAA+D;AAC/D,MAAM,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,EAAE,cAAc,GAAG,WAAW,GAAG,cAAc,GAAG,aAAa,GAAG,KAAK,CAAC,CAAA;AAiBrH,+EAA+E;AAC/E,iFAAiF;AACjF,wBAAgB,YAAY,IAAI,OAAO,CAStC;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,QAE3C;AAED,4EAA4E;AAC5E,wBAAgB,YAAY,CAAC,GAAG,EAAE,SAAS,GAAG,IAAI,QAUjD;AAWD;;;GAGG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,MAAiB,GAAG,MAAM,GAAG,SAAS,CAehG;AAED,mGAAmG;AACnG,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAC/C,KAAK,CAAC,EAAE,OAAO,GACd,WAAW,CAgCb;AAsDD;;;;GAIG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA2B7D;AAED,oEAAoE;AACpE,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE;IAAE,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,CAAA;CAAE,GAAG,IAAI,CAe9G;AAED;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;AAE5C,iFAAiF;AACjF,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,eAAe,GAAG,UAAU,CASpE;AAQD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAsB1G;AAED,qFAAqF;AACrF,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAC/B,KAAK,CAAC,EAAE,OAAO,GACd,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAYrB;AAED,mFAAmF;AACnF,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAM,EAAE,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAkB5G;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,CACF,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAC/C,KAAK,CAAC,EAAE,OAAO,KACZ,OAAO,CAAC,GAAG,CAAC,GAChB,IAAI,CAEN;AAED,+CAA+C;AAC/C,wBAAgB,QAAQ,IAAI,MAAM,EAAE,CAEnC"}
+{"version":3,"file":"xrpc.d.ts","sourceRoot":"","sources":["../src/xrpc.ts"],"names":[],"mappings":"AAqBA,OAAO,EAIL,KAAK,eAAe,EACrB,MAAM,wBAAwB,CAAA;AAmB/B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAE/C,OAAO,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AAElD,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAEzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AACpD,OAAO,EAAqC,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAE3F,YAAY,EAAE,GAAG,EAAE,OAAO,EAAE,CAAA;AAI5B,mFAAmF;AACnF,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,QAExD;AAED,gFAAgF;AAChF,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,MAAM,SAAM;IACZ,SAAS,CAAC,EAAE,MAAM,CAAA;gBACN,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM;CAIhD;AACD,0DAA0D;AAC1D,qBAAa,aAAc,SAAQ,mBAAmB;IACpD,MAAM,SAAM;gBACA,OAAO,SAAc;CAGlC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW,CAC1B,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC1B,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzD,CAAC,GAAG,OAAO,CACX,SAAQ,WAAW;IACnB,EAAE,EAAE;QACF,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;QAC9D,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;QACvD,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;KACpE,CAAA;IACD,MAAM,EAAE,CAAC,CAAA;IACT,KAAK,EAAE,CAAC,CAAA;IACR,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,MAAM,CAAA;IAC7D,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;IACzE,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IAC9C,mBAAmB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;IAC7D,MAAM,EAAE,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,OAAO,EACvC,UAAU,EAAE,CAAC,EACb,CAAC,EAAE,MAAM,EACT,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,KACxD,OAAO,CAAC;QAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC7D,OAAO,EAAE,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAC3D,MAAM,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IACjF,YAAY,EAAE,CACZ,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,KACrB,OAAO,CAAC;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC5C,SAAS,EAAE,CACT,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,OAAO,CAAC;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC5C,YAAY,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACjE,WAAW,EAAE,CACX,MAAM,EAAE,KAAK,CAAC;QACZ,KAAK,EAAE,MAAM,CAAA;QACb,UAAU,EAAE,MAAM,CAAA;QAClB,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAChC,CAAC,KACC,OAAO,CAAC;QAAE,OAAO,CAAC,EAAE,KAAK,CAAC;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,GAAG,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC,CAAA;IAChF;;;;OAIG;IACH,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IACjF;;;;;;;;;;OAUG;IACH,eAAe,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,eAAe,CAAC,CAAA;IAC1F;;;;OAIG;IACH,qBAAqB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAA;IAC9C;;;;;OAKG;IACH,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,cAAc,CAAA;IAC1C;;;;;;;OAOG;IACH,aAAa,EAAE,CACb,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,KACxC,OAAO,CAAC,eAAe,CAAC,CAAA;CAC9B;AAED,+DAA+D;AAC/D,MAAM,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,EAAE,cAAc,GAAG,WAAW,GAAG,cAAc,GAAG,aAAa,GAAG,KAAK,CAAC,CAAA;AAiBrH,+EAA+E;AAC/E,iFAAiF;AACjF,wBAAgB,YAAY,IAAI,OAAO,CAStC;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,QAE3C;AAED,4EAA4E;AAC5E,wBAAgB,YAAY,CAAC,GAAG,EAAE,SAAS,GAAG,IAAI,QAUjD;AAWD;;;GAGG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,MAAiB,GAAG,MAAM,GAAG,SAAS,CAehG;AAED,mGAAmG;AACnG,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAC/C,KAAK,CAAC,EAAE,OAAO,GACd,WAAW,CAwCb;AAsDD;;;;GAIG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA2B7D;AAED,oEAAoE;AACpE,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE;IAAE,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,CAAA;CAAE,GAAG,IAAI,CAe9G;AAED;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;AAE5C,iFAAiF;AACjF,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,eAAe,GAAG,UAAU,CASpE;AAQD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAsB1G;AAED,qFAAqF;AACrF,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAC/B,KAAK,CAAC,EAAE,OAAO,GACd,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAYrB;AAED,mFAAmF;AACnF,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAM,EAAE,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAkB5G;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,CACF,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAC/C,KAAK,CAAC,EAAE,OAAO,KACZ,OAAO,CAAC,GAAG,CAAC,GAChB,IAAI,CAEN;AAED,+CAA+C;AAC/C,wBAAgB,QAAQ,IAAI,MAAM,EAAE,CAEnC"}

package/dist/xrpc.js

@@ -27,6 +27,7 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
  * ```
  */
 import { guardedQuerySQL, unfilteredQuerySQL } from "./spaces/guard.js";
+import { forgetReaderSpaceCredential, readerSpaceCredential, SpaceCredentialError, } from "./spaces/credential.js";
 import { resolve, relative } from 'node:path';
 import { readdirSync, statSync } from 'node:fs';
 import { log, emit, timer } from "./logger.js";
@@ -138,6 +139,17 @@ export function buildXrpcContext(params, cursor, limit, viewer, input) {
             return uri !== null;
         },
         ...accountHelpers(viewer),
+        spaceCredential: async (space, opts) => {
+            if (!_oauthConfig)
+                throw new Error('No OAuth config — cannot read a space');
+            if (!viewer)
+                throw new SpaceCredentialError(401, 'AuthRequired', 'Authentication required to read a space');
+            return readerSpaceCredential(_oauthConfig, viewer.did, space, opts);
+        },
+        forgetSpaceCredential: (space) => {
+            if (viewer)
+                forgetReaderSpaceCredential(viewer.did, space);
+        },
         asAccount: (did) => accountHelpers({ did }),
         obtainSession: async (url, body, opts) => {
             if (!_oauthConfig)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hatk/hatk",
-  "version": "0.0.1-alpha.100",
+  "version": "0.0.1-alpha.102",
   "license": "MIT",
   "bin": {
     "hatk": "dist/cli.js"