@hatk/hatk 0.0.1-alpha.4 → 0.0.1-alpha.40

package/dist/oauth/db.js

@@ -1,5 +1,5 @@
 // packages/hatk/src/oauth/db.ts
-import { querySQL, runSQL } from "../db.js";
+import { querySQL, runSQL } from "../database/db.js";
 // --- DDL ---
 export const OAUTH_DDL = `
 CREATE TABLE IF NOT EXISTS _oauth_keys (
@@ -62,18 +62,38 @@ CREATE TABLE IF NOT EXISTS _oauth_dpop_jtis (
 `;
 // --- Key Management ---
 export async function getServerKey(kid) {
-    const rows = await querySQL('SELECT private_key, public_key FROM _oauth_keys WHERE kid = $1', [kid]);
+    const rows = (await querySQL('SELECT private_key, public_key FROM _oauth_keys WHERE kid = $1', [kid]));
     if (rows.length === 0)
         return null;
     return { privateKey: rows[0].private_key, publicKey: rows[0].public_key };
 }
 export async function storeServerKey(kid, privateKey, publicKey) {
-    await runSQL('INSERT OR REPLACE INTO _oauth_keys (kid, private_key, public_key) VALUES ($1, $2, $3)', kid, privateKey, publicKey);
+    await runSQL('INSERT OR REPLACE INTO _oauth_keys (kid, private_key, public_key) VALUES ($1, $2, $3)', [
+        kid,
+        privateKey,
+        publicKey,
+    ]);
 }
 // --- OAuth Request Storage ---
 export async function storeOAuthRequest(requestUri, data) {
     await runSQL(`INSERT INTO _oauth_requests (request_uri, client_id, redirect_uri, scope, state, code_challenge, code_challenge_method, dpop_jkt, pds_request_uri, pds_auth_server, pds_code_verifier, pds_state, did, login_hint, expires_at)
-     VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15)`, requestUri, data.clientId, data.redirectUri, data.scope || null, data.state || null, data.codeChallenge, data.codeChallengeMethod || 'S256', data.dpopJkt, data.pdsRequestUri || null, data.pdsAuthServer || null, data.pdsCodeVerifier || null, data.pdsState || null, data.did || null, data.loginHint || null, data.expiresAt);
+     VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15)`, [
+        requestUri,
+        data.clientId,
+        data.redirectUri,
+        data.scope || null,
+        data.state || null,
+        data.codeChallenge,
+        data.codeChallengeMethod || 'S256',
+        data.dpopJkt,
+        data.pdsRequestUri || null,
+        data.pdsAuthServer || null,
+        data.pdsCodeVerifier || null,
+        data.pdsState || null,
+        data.did || null,
+        data.loginHint || null,
+        data.expiresAt,
+    ]);
 }
 export async function getOAuthRequest(requestUri) {
     const rows = await querySQL('SELECT * FROM _oauth_requests WHERE request_uri = $1 AND expires_at > $2', [
@@ -83,57 +103,63 @@ export async function getOAuthRequest(requestUri) {
     return rows.length > 0 ? rows[0] : null;
 }
 export async function deleteOAuthRequest(requestUri) {
-    await runSQL('DELETE FROM _oauth_requests WHERE request_uri = $1', requestUri);
+    await runSQL('DELETE FROM _oauth_requests WHERE request_uri = $1', [requestUri]);
 }
 // --- Authorization Codes ---
 export async function storeAuthCode(code, requestUri) {
-    await runSQL('INSERT INTO _oauth_codes (code, request_uri, created_at) VALUES ($1, $2, $3)', code, requestUri, Math.floor(Date.now() / 1000));
+    await runSQL('INSERT INTO _oauth_codes (code, request_uri, created_at) VALUES ($1, $2, $3)', [
+        code,
+        requestUri,
+        Math.floor(Date.now() / 1000),
+    ]);
 }
 export async function consumeAuthCode(code) {
-    const rows = await querySQL('SELECT request_uri FROM _oauth_codes WHERE code = $1', [code]);
+    const rows = (await querySQL('SELECT request_uri FROM _oauth_codes WHERE code = $1', [code]));
     if (rows.length === 0)
         return null;
-    await runSQL('DELETE FROM _oauth_codes WHERE code = $1', code);
+    await runSQL('DELETE FROM _oauth_codes WHERE code = $1', [code]);
     return rows[0].request_uri;
 }
 // --- Sessions ---
 export async function storeSession(did, data) {
     await runSQL(`INSERT OR REPLACE INTO _oauth_sessions (did, pds_endpoint, access_token, refresh_token, dpop_jkt, token_expires_at, updated_at)
-     VALUES ($1,$2,$3,$4,$5,$6,CURRENT_TIMESTAMP)`, did, data.pdsEndpoint, data.accessToken, data.refreshToken || null, data.dpopJkt, data.tokenExpiresAt || null);
+     VALUES ($1,$2,$3,$4,$5,$6,CURRENT_TIMESTAMP)`, [did, data.pdsEndpoint, data.accessToken, data.refreshToken || null, data.dpopJkt, data.tokenExpiresAt || null]);
 }
 export async function getSession(did) {
     const rows = await querySQL('SELECT * FROM _oauth_sessions WHERE did = $1', [did]);
     return rows.length > 0 ? rows[0] : null;
 }
 export async function deleteSession(did) {
-    await runSQL('DELETE FROM _oauth_sessions WHERE did = $1', did);
+    await runSQL('DELETE FROM _oauth_sessions WHERE did = $1', [did]);
 }
 // --- Refresh Tokens ---
 export async function storeRefreshToken(token, data) {
     const now = Math.floor(Date.now() / 1000);
     const expiresAt = data.expiresAt ?? now + 14 * 86400; // 14 days default
     await runSQL(`INSERT INTO _oauth_refresh_tokens (token, client_id, did, dpop_jkt, scope, created_at, expires_at)
-     VALUES ($1,$2,$3,$4,$5,$6,$7)`, token, data.clientId, data.did, data.dpopJkt, data.scope || null, now, expiresAt);
+     VALUES ($1,$2,$3,$4,$5,$6,$7)`, [token, data.clientId, data.did, data.dpopJkt, data.scope || null, now, expiresAt]);
 }
 export async function getRefreshToken(token) {
     const rows = await querySQL('SELECT * FROM _oauth_refresh_tokens WHERE token = $1', [token]);
     return rows.length > 0 ? rows[0] : null;
 }
 export async function revokeRefreshToken(token) {
-    await runSQL('UPDATE _oauth_refresh_tokens SET revoked = 1 WHERE token = $1', token);
+    await runSQL('UPDATE _oauth_refresh_tokens SET revoked = 1 WHERE token = $1', [token]);
 }
 // --- DPoP JTI Replay Protection ---
 export async function checkAndStoreDpopJti(jti, expiresAt) {
     const rows = await querySQL('SELECT 1 FROM _oauth_dpop_jtis WHERE jti = $1', [jti]);
     if (rows.length > 0)
         return false;
-    await runSQL('INSERT INTO _oauth_dpop_jtis (jti, expires_at) VALUES ($1, $2)', jti, expiresAt);
+    await runSQL('INSERT INTO _oauth_dpop_jtis (jti, expires_at) VALUES ($1, $2)', [jti, expiresAt]);
     return true;
 }
 export async function cleanupExpiredOAuth() {
     const now = Math.floor(Date.now() / 1000);
-    await runSQL('DELETE FROM _oauth_dpop_jtis WHERE expires_at < $1', now);
-    await runSQL('DELETE FROM _oauth_requests WHERE expires_at < $1', now);
-    await runSQL('DELETE FROM _oauth_codes WHERE created_at < $1', now - 600);
-    await runSQL('DELETE FROM _oauth_refresh_tokens WHERE revoked = 1 OR (expires_at IS NOT NULL AND expires_at < $1)', now);
+    await runSQL('DELETE FROM _oauth_dpop_jtis WHERE expires_at < $1', [now]);
+    await runSQL('DELETE FROM _oauth_requests WHERE expires_at < $1', [now]);
+    await runSQL('DELETE FROM _oauth_codes WHERE created_at < $1', [now - 600]);
+    await runSQL('DELETE FROM _oauth_refresh_tokens WHERE revoked = 1 OR (expires_at IS NOT NULL AND expires_at < $1)', [
+        now,
+    ]);
 }

package/dist/oauth/server.d.ts

@@ -64,10 +64,12 @@ export declare function handlePar(config: OAuthConfig, body: Record<string, stri
     expires_in: number;
 }>;
 export declare function buildAuthorizeRedirect(config: OAuthConfig, request: any): string;
+export declare function serverLogin(config: OAuthConfig, handle: string): Promise<string>;
 export declare function handleCallback(config: OAuthConfig, code: string, state: string | null, iss: string | null): Promise<{
     requestUri: string;
     clientRedirectUri: string;
     clientState: string | null;
+    did: string;
 }>;
 export declare function handleToken(config: OAuthConfig, body: Record<string, string>, dpopHeader: string, requestUrl: string): Promise<any>;
 export declare function refreshPdsSession(config: OAuthConfig, session: {

package/dist/oauth/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/oauth/server.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AA0E/C,wBAAsB,SAAS,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBrG;AAID,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW;;;;;;;;;;;;;;;;;;;EAqBxE;AAED,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW;;;;;EAO/E;AAED,wBAAgB,OAAO;;;;;;;;;;;;;;;;;;;;;;EAWtB;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW;;;;;;;;;EAcpE;AAID,wBAAsB,SAAS,CAC7B,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAuItD;AAID,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,GAAG,MAAM,CAShF;AAID,wBAAsB,cAAc,CAClC,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,GAAG,EAAE,MAAM,GAAG,IAAI,GACjB,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAyHxF;AAID,wBAAsB,WAAW,CAC/B,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,GAAG,CAAC,CAUd;AA0JD,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACtF,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAmEpF;AAID,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CA0BjC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/oauth/server.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AA2E/C,wBAAsB,SAAS,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBrG;AAID,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW;;;;;;;;;;;;;;;;;;;EAqBxE;AAED,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW;;;;;EAO/E;AAED,wBAAgB,OAAO;;;;;;;;;;;;;;;;;;;;;;EAWtB;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW;;;;;;;;;EAcpE;AAID,wBAAsB,SAAS,CAC7B,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CA2ItD;AAID,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,GAAG,MAAM,CAShF;AAID,wBAAsB,WAAW,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAoGtF;AAID,wBAAsB,cAAc,CAClC,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,GAAG,EAAE,MAAM,GAAG,IAAI,GACjB,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAyHrG;AAID,wBAAsB,WAAW,CAC/B,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,GAAG,CAAC,CAUd;AA0JD,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACtF,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAmEpF;AAID,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CA0BjC"}

package/dist/oauth/server.js

@@ -1,12 +1,13 @@
 // packages/hatk/src/oauth/server.ts
 import { generateKeyPair, importPrivateKey, computeJwkThumbprint, signJwt, parseJwt, verifyEs256, importPublicKey, randomToken, sha256, base64UrlEncode, } from "./crypto.js";
 import { parseDpopProof, createDpopProof } from "./dpop.js";
+import { initSession } from "./session.js";
 import { resolveClient, validateRedirectUri, isLoopbackClient } from "./client.js";
 import { discoverAuthServer, resolveHandle } from "./discovery.js";
 import { getServerKey, storeServerKey, storeOAuthRequest, getOAuthRequest, deleteOAuthRequest, storeAuthCode, consumeAuthCode, storeSession, checkAndStoreDpopJti, cleanupExpiredOAuth, storeRefreshToken, getRefreshToken, revokeRefreshToken, } from "./db.js";
 import { emit } from "../logger.js";
-import { querySQL } from "../db.js";
-import { fireOnLoginHook } from "./hooks.js";
+import { querySQL } from "../database/db.js";
+import { fireOnLoginHook } from "../hooks.js";
 const SERVER_KEY_KID = 'appview-oauth-key';
 async function resolveHandleForDid(did) {
     const rows = (await querySQL('SELECT handle FROM _repos WHERE did = $1', [did]));
@@ -57,6 +58,8 @@ export async function initOAuth(_config, plcUrl, relayUrl) {
     }
     serverPrivateKey = await importPrivateKey(serverPrivateJwk);
     serverJkt = await computeJwkThumbprint(serverPublicJwk);
+    // Initialize SSR session cookie signing
+    initSession(serverPrivateJwk, _config.cookieName);
     // Periodic cleanup of expired OAuth data
     setInterval(() => cleanupExpiredOAuth().catch(() => { }), 60_000);
 }
@@ -146,7 +149,12 @@ export async function handlePar(config, body, dpopHeader, requestUrl) {
     // Resolve DID from login_hint
     let did = body.login_hint;
     if (did && !did.startsWith('did:')) {
-        did = await resolveHandle(did, _relayUrl);
+        try {
+            did = await resolveHandle(did, _relayUrl);
+        }
+        catch {
+            throw new Error('Handle not found');
+        }
     }
     // Discover user's PDS auth server
     let pdsRequestUri;
@@ -253,10 +261,97 @@ export function buildAuthorizeRedirect(config, request) {
     });
     return `${request.pds_auth_server}/oauth/authorize?${params}`;
 }
+// --- Server-initiated login (no DPoP required from browser) ---
+export async function serverLogin(config, handle) {
+    // Resolve handle to DID
+    let did = handle;
+    if (!did.startsWith('did:')) {
+        did = await resolveHandle(handle, _relayUrl);
+    }
+    // Discover PDS auth server
+    const discovery = await discoverAuthServer(did, _plcUrl);
+    const pdsAuthServer = discovery.authServerEndpoint;
+    // Create PKCE for PAR to PDS
+    const pdsCodeVerifier = randomToken();
+    const pdsCodeChallenge = base64UrlEncode(await sha256(pdsCodeVerifier));
+    const pdsState = randomToken();
+    // PAR to the PDS
+    const parEndpoint = discovery.authServerMetadata.pushed_authorization_request_endpoint || `${pdsAuthServer}/oauth/par`;
+    const serverDpopProof = await createDpopProof(serverPrivateJwk, serverPublicJwk, 'POST', parEndpoint);
+    const scope = config.scopes?.join(' ') || 'atproto transition:generic';
+    const pdsParBody = new URLSearchParams({
+        client_id: pdsClientId(config.issuer, config),
+        redirect_uri: pdsRedirectUri(config.issuer),
+        response_type: 'code',
+        code_challenge: pdsCodeChallenge,
+        code_challenge_method: 'S256',
+        scope,
+        login_hint: handle,
+        state: pdsState,
+    });
+    let pdsRequestUri;
+    const pdsParRes = await fetch(parEndpoint, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', DPoP: serverDpopProof },
+        body: pdsParBody.toString(),
+    });
+    if (!pdsParRes.ok) {
+        const errBody = await pdsParRes.json().catch(() => ({}));
+        if (errBody.error === 'use_dpop_nonce') {
+            const nonce = pdsParRes.headers.get('DPoP-Nonce');
+            if (nonce) {
+                const retryProof = await createDpopProof(serverPrivateJwk, serverPublicJwk, 'POST', parEndpoint, undefined, nonce);
+                const retryRes = await fetch(parEndpoint, {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/x-www-form-urlencoded', DPoP: retryProof },
+                    body: pdsParBody.toString(),
+                });
+                if (!retryRes.ok) {
+                    const retryErr = await retryRes.json().catch(() => ({}));
+                    throw new Error(`PDS PAR failed: ${retryRes.status} ${retryErr.error_description || retryErr.error || ''}`);
+                }
+                const retryData = await retryRes.json();
+                pdsRequestUri = retryData.request_uri;
+            }
+        }
+        else {
+            throw new Error(`PDS PAR failed: ${pdsParRes.status} ${errBody.error_description || errBody.error || ''}`);
+        }
+    }
+    else {
+        const pdsParData = await pdsParRes.json();
+        pdsRequestUri = pdsParData.request_uri;
+    }
+    // Store the request so the callback can find it
+    const requestUri = `urn:ietf:params:oauth:request_uri:${randomToken()}`;
+    const expiresAt = Math.floor(Date.now() / 1000) + 600;
+    await storeOAuthRequest(requestUri, {
+        clientId: pdsClientId(config.issuer, config),
+        redirectUri: '/',
+        scope,
+        state: pdsState,
+        codeChallenge: '',
+        codeChallengeMethod: 'S256',
+        dpopJkt: serverJkt,
+        pdsRequestUri,
+        pdsAuthServer,
+        pdsCodeVerifier,
+        pdsState,
+        did,
+        loginHint: handle,
+        expiresAt,
+    });
+    // Build redirect URL to PDS
+    const params = new URLSearchParams({
+        request_uri: pdsRequestUri,
+        client_id: pdsClientId(config.issuer, config),
+    });
+    return `${pdsAuthServer}/oauth/authorize?${params}`;
+}
 // --- OAuth Callback (PDS redirects here) ---
 export async function handleCallback(config, code, state, iss) {
     // Find the matching OAuth request by pds_state (unique per PAR)
-    const { querySQL } = await import("../db.js");
+    const { querySQL } = await import("../database/db.js");
     let request = null;
     if (state) {
         const rows = await querySQL(`SELECT * FROM _oauth_requests WHERE pds_state = $1 AND expires_at > $2`, [
@@ -343,15 +438,15 @@ export async function handleCallback(config, code, state, iss) {
     await storeAuthCode(clientCode, request.request_uri);
     // Update the request with the DID (in case it wasn't set during PAR)
     if (!request.did && did) {
-        const { runSQL } = await import("../db.js");
-        await runSQL('UPDATE _oauth_requests SET did = $1 WHERE request_uri = $2', did, request.request_uri);
+        const { runSQL } = await import("../database/db.js");
+        await runSQL('UPDATE _oauth_requests SET did = $1 WHERE request_uri = $2', [did, request.request_uri]);
     }
     // Build redirect back to client
     const params = new URLSearchParams({ code: clientCode, iss: config.issuer });
     if (request.state)
         params.set('state', request.state);
     const clientRedirectUri = `${request.redirect_uri}?${params}`;
-    return { requestUri: request.request_uri, clientRedirectUri, clientState: request.state };
+    return { requestUri: request.request_uri, clientRedirectUri, clientState: request.state, did };
 }
 // --- Token Endpoint ---
 export async function handleToken(config, body, dpopHeader, requestUrl) {

package/dist/oauth/session.d.ts

@@ -0,0 +1,11 @@
+export type SessionData = {
+    did: string;
+    handle: string;
+};
+export declare function getSessionCookieName(): string;
+export declare function initSession(privateJwk: JsonWebKey, cookieName?: string): void;
+export declare function createSessionCookie(data: SessionData): Promise<string>;
+export declare function sessionCookieHeader(value: string, secure: boolean): string;
+export declare function clearSessionCookieHeader(): string;
+export declare function parseSessionCookie(request: Request): Promise<SessionData | null>;
+//# sourceMappingURL=session.d.ts.map

package/dist/oauth/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/oauth/session.ts"],"names":[],"mappings":"AASA,MAAM,MAAM,WAAW,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAEzD,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED,wBAAgB,WAAW,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAG7E;AAcD,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAM5E;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,MAAM,CAI1E;AAED,wBAAgB,wBAAwB,IAAI,MAAM,CAEjD;AAED,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAuBtF"}

package/dist/oauth/session.js

@@ -0,0 +1,65 @@
+// SSR session cookie — AES-GCM encrypted HttpOnly cookie for server-side viewer resolution.
+// Separate from OAuth protocol flows but uses the same server keypair for key derivation.
+import { base64UrlEncode, base64UrlDecode } from "./crypto.js";
+let _privateJwk;
+let _cookieName = '__hatk_session';
+const MAX_AGE = 30 * 24 * 60 * 60; // 30 days in seconds
+export function getSessionCookieName() {
+    return _cookieName;
+}
+export function initSession(privateJwk, cookieName) {
+    _privateJwk = privateJwk;
+    if (cookieName)
+        _cookieName = cookieName;
+}
+async function aesKey() {
+    const raw = new TextEncoder().encode(JSON.stringify(_privateJwk, Object.keys(_privateJwk).sort()));
+    const keyMaterial = await crypto.subtle.importKey('raw', raw, 'HKDF', false, ['deriveKey']);
+    return crypto.subtle.deriveKey({ name: 'HKDF', hash: 'SHA-256', salt: new Uint8Array(0), info: new TextEncoder().encode('hatk-session-cookie') }, keyMaterial, { name: 'AES-GCM', length: 256 }, false, ['encrypt', 'decrypt']);
+}
+export async function createSessionCookie(data) {
+    const payload = JSON.stringify({ ...data, ts: Math.floor(Date.now() / 1000) });
+    const iv = crypto.getRandomValues(new Uint8Array(12));
+    const key = await aesKey();
+    const ciphertext = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, key, new TextEncoder().encode(payload));
+    return `${base64UrlEncode(iv)}.${base64UrlEncode(new Uint8Array(ciphertext))}`;
+}
+export function sessionCookieHeader(value, secure) {
+    const parts = [`${_cookieName}=${value}`, 'HttpOnly', 'SameSite=Lax', 'Path=/', `Max-Age=${MAX_AGE}`];
+    if (secure)
+        parts.push('Secure');
+    return parts.join('; ');
+}
+export function clearSessionCookieHeader() {
+    return `${_cookieName}=; HttpOnly; SameSite=Lax; Path=/; Max-Age=0`;
+}
+export async function parseSessionCookie(request) {
+    const cookieHeader = request.headers.get('cookie');
+    if (!cookieHeader)
+        return null;
+    const match = cookieHeader
+        .split(';')
+        .map((c) => c.trim())
+        .find((c) => c.startsWith(`${_cookieName}=`));
+    if (!match)
+        return null;
+    const value = match.slice(_cookieName.length + 1);
+    const parts = value.split('.');
+    if (parts.length !== 2)
+        return null;
+    try {
+        const iv = base64UrlDecode(parts[0]);
+        const ciphertext = base64UrlDecode(parts[1]);
+        const key = await aesKey();
+        const plaintext = await crypto.subtle.decrypt({ name: 'AES-GCM', iv }, key, ciphertext);
+        const data = JSON.parse(new TextDecoder().decode(plaintext));
+        if (!data.did || !data.handle || !data.ts)
+            return null;
+        if (Date.now() / 1000 - data.ts > MAX_AGE)
+            return null;
+        return { did: data.did, handle: data.handle };
+    }
+    catch {
+        return null;
+    }
+}

package/dist/opengraph.d.ts

@@ -28,7 +28,17 @@ export interface OpengraphResult {
         description?: string;
     };
 }
+export declare function defineOG(path: string, generate: (ctx: OpengraphContext) => Promise<OpengraphResult>): {
+    __type: "og";
+    path: string;
+    generate: (ctx: OpengraphContext) => Promise<OpengraphResult>;
+};
 export declare function initOpengraph(ogDir: string): Promise<void>;
+/** Register a single OG handler from a scanned server/ module. */
+export declare function registerOgHandler(ogMod: {
+    path: string;
+    generate: (ctx: OpengraphContext) => Promise<OpengraphResult>;
+}): void;
 export declare function handleOpengraphRequest(pathname: string): Promise<Buffer | null>;
 export declare function buildOgMeta(pathname: string, origin: string): string | null;
 //# sourceMappingURL=opengraph.d.ts.map

package/dist/opengraph.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"opengraph.d.ts","sourceRoot":"","sources":["../src/opengraph.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAE5C,4CAA4C;AAC5C,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAC3B,QAAQ,CAAC,EAAE,CAAC,UAAU,GAAG,MAAM,CAAC,EAAE,GAAG,MAAM,CAAA;QAC3C,GAAG,CAAC,EAAE,MAAM,CAAA;QACZ,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KACnB,CAAA;CACF;AAED,uDAAuD;AACvD,MAAM,WAAW,gBAAiB,SAAQ,WAAW;IACnD,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;CACpD;AAED,qDAAqD;AACrD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,UAAU,CAAA;IACnB,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAA;KAAE,CAAA;IAC5D,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAChD;AAkCD,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAoGhE;AAED,wBAAsB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA8BrF;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAyC3E"}
+{"version":3,"file":"opengraph.d.ts","sourceRoot":"","sources":["../src/opengraph.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAE5C,4CAA4C;AAC5C,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAC3B,QAAQ,CAAC,EAAE,CAAC,UAAU,GAAG,MAAM,CAAC,EAAE,GAAG,MAAM,CAAA;QAC3C,GAAG,CAAC,EAAE,MAAM,CAAA;QACZ,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KACnB,CAAA;CACF;AAED,uDAAuD;AACvD,MAAM,WAAW,gBAAiB,SAAQ,WAAW;IACnD,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;CACpD;AAED,qDAAqD;AACrD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,UAAU,CAAA;IACnB,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAA;KAAE,CAAA;IAC5D,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAChD;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,OAAO,CAAC,eAAe,CAAC;;;oBAA7C,gBAAgB,KAAK,OAAO,CAAC,eAAe,CAAC;EAEnG;AAkCD,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAuEhE;AAED,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,OAAO,CAAC,eAAe,CAAC,CAAA;CAC9D,GAAG,IAAI,CAmDP;AAED,wBAAsB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA+BrF;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAyC3E"}

package/dist/opengraph.js

@@ -9,11 +9,23 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
 import { resolve } from 'node:path';
 import { readFileSync, readdirSync } from 'node:fs';
 import { log } from "./logger.js";
-import satori from 'satori';
-import { Resvg } from '@resvg/resvg-js';
-import { querySQL, runSQL, packCursor, unpackCursor, isTakendownDid, filterTakendownDids, searchRecords, findUriByFields, lookupByFieldBatch, countByFieldBatch, queryLabelsForUris, } from "./db.js";
-import { resolveRecords } from "./hydrate.js";
-import { blobUrl } from "./xrpc.js";
+// Lazy-imported to avoid CJS require() issues in Vite's module runner
+let _satori = null;
+let _Resvg = null;
+async function getSatori() {
+    if (!_satori)
+        _satori = (await import('satori')).default;
+    return _satori;
+}
+async function getResvg() {
+    if (!_Resvg)
+        _Resvg = (await import('@resvg/resvg-js')).Resvg;
+    return _Resvg;
+}
+import { buildXrpcContext } from "./xrpc.js";
+export function defineOG(path, generate) {
+    return { __type: 'og', path, generate };
+}
 const handlers = [];
 const pageRoutes = [];
 let defaultFont = null;
@@ -51,7 +63,7 @@ export async function initOpengraph(ogDir) {
     for (const file of files) {
         const name = file.replace(/\.(ts|js)$/, '');
         const scriptPath = resolve(ogDir, file);
-        const mod = await import(__rewriteRelativeImportExtension(scriptPath));
+        const mod = await import(__rewriteRelativeImportExtension(/* @vite-ignore */ `${scriptPath}?t=${Date.now()}`));
         const handler = mod.default;
         if (!handler.path) {
             console.warn(`[opengraph] ${file} missing 'path' export, skipping`);
@@ -64,38 +76,7 @@ export async function initOpengraph(ogDir) {
             pattern,
             paramNames,
             execute: async (params) => {
-                const ctx = {
-                    db: { query: querySQL, run: runSQL },
-                    params,
-                    input: {},
-                    limit: 1,
-                    viewer: null,
-                    packCursor,
-                    unpackCursor,
-                    isTakendown: isTakendownDid,
-                    filterTakendownDids,
-                    search: searchRecords,
-                    resolve: resolveRecords,
-                    lookup: async (collection, field, values) => {
-                        if (values.length === 0)
-                            return new Map();
-                        const unique = [...new Set(values.filter(Boolean))];
-                        return lookupByFieldBatch(collection, field, unique);
-                    },
-                    count: async (collection, field, values) => {
-                        if (values.length === 0)
-                            return new Map();
-                        const unique = [...new Set(values.filter(Boolean))];
-                        return countByFieldBatch(collection, field, unique);
-                    },
-                    exists: async (collection, filters) => {
-                        const conditions = Object.entries(filters).map(([field, value]) => ({ field, value }));
-                        const uri = await findUriByFields(collection, conditions);
-                        return uri !== null;
-                    },
-                    labels: queryLabelsForUris,
-                    blobUrl,
-                };
+                const ctx = buildXrpcContext(params, undefined, 1, null);
                 ctx.fetchImage = async (url) => {
                     try {
                         const resp = await fetch(url, { redirect: 'follow' });
@@ -117,7 +98,7 @@ export async function initOpengraph(ogDir) {
                     ...result.options,
                     fonts: [...(defaultFont ? [defaultFont] : []), ...(result.options?.fonts || [])],
                 };
-                const svg = await satori(element, options);
+                const svg = await (await getSatori())(element, options);
                 return { svg, meta: result.meta };
             },
         });
@@ -129,6 +110,58 @@ export async function initOpengraph(ogDir) {
         }
     }
 }
+/** Register a single OG handler from a scanned server/ module. */
+export function registerOgHandler(ogMod) {
+    const { pattern, paramNames } = compilePath(ogMod.path);
+    const name = ogMod.path.replace(/^\//, '').replace(/\//g, '-').replace(/:/g, '');
+    // Load default font if not already loaded
+    if (!defaultFont) {
+        try {
+            const fontPath = resolve(import.meta.dirname, '..', 'fonts', 'Inter-Regular.woff');
+            const fontData = readFileSync(fontPath);
+            defaultFont = { name: 'Inter', data: fontData.buffer, weight: 400, style: 'normal' };
+        }
+        catch { }
+    }
+    handlers.push({
+        name,
+        path: ogMod.path,
+        pattern,
+        paramNames,
+        execute: async (params) => {
+            const ctx = buildXrpcContext(params, undefined, 1, null);
+            ctx.fetchImage = async (url) => {
+                try {
+                    const resp = await fetch(url, { redirect: 'follow' });
+                    if (!resp.ok)
+                        return null;
+                    const buf = Buffer.from(await resp.arrayBuffer());
+                    const contentType = resp.headers.get('content-type') || 'image/jpeg';
+                    return `data:${contentType};base64,${buf.toString('base64')}`;
+                }
+                catch {
+                    return null;
+                }
+            };
+            const result = await ogMod.generate(ctx);
+            const element = result.element;
+            const options = {
+                width: 1200,
+                height: 630,
+                ...result.options,
+                fonts: [...(defaultFont ? [defaultFont] : []), ...(result.options?.fonts || [])],
+            };
+            const svg = await (await getSatori())(element, options);
+            return { svg, meta: result.meta };
+        },
+    });
+    const pagePath = ogMod.path.replace(/^\/og/, '');
+    if (pagePath !== ogMod.path) {
+        const compiled = compilePath(pagePath);
+        pageRoutes.push({ ogPath: ogMod.path, pattern: compiled.pattern, paramNames: compiled.paramNames, name });
+    }
+    log(`[opengraph] registered: ${name} → ${ogMod.path}`);
+}
 export async function handleOpengraphRequest(pathname) {
     const cached = cache.get(pathname);
     if (cached && cached.expires > Date.now())
@@ -143,6 +176,7 @@ export async function handleOpengraphRequest(pathname) {
         });
         try {
             const { svg, meta } = await handler.execute(params);
+            const Resvg = await getResvg();
             const png = new Resvg(svg, { fitTo: { mode: 'width', value: 1200 } }).render().asPng();
             if (cache.size >= CACHE_MAX) {
                 const oldest = cache.keys().next().value;

package/dist/pds-proxy.d.ts

@@ -0,0 +1,42 @@
+import type { OAuthConfig } from './config.ts';
+export declare class ProxyError extends Error {
+    status: number;
+    constructor(status: number, message: string);
+}
+export declare class ScopeMissingProxyError extends ProxyError {
+    constructor();
+}
+export declare function pdsCreateRecord(oauthConfig: OAuthConfig, viewer: {
+    did: string;
+}, input: {
+    collection: string;
+    repo?: string;
+    rkey?: string;
+    record: Record<string, unknown>;
+}): Promise<{
+    uri?: string;
+    cid?: string;
+}>;
+export declare function pdsDeleteRecord(oauthConfig: OAuthConfig, viewer: {
+    did: string;
+}, input: {
+    collection: string;
+    rkey: string;
+}): Promise<Record<string, unknown>>;
+export declare function pdsPutRecord(oauthConfig: OAuthConfig, viewer: {
+    did: string;
+}, input: {
+    collection: string;
+    rkey: string;
+    record: Record<string, unknown>;
+    repo?: string;
+}): Promise<{
+    uri?: string;
+    cid?: string;
+}>;
+export declare function pdsUploadBlob(oauthConfig: OAuthConfig, viewer: {
+    did: string;
+}, body: Uint8Array, contentType: string): Promise<{
+    blob: unknown;
+}>;
+//# sourceMappingURL=pds-proxy.d.ts.map

package/dist/pds-proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pds-proxy.d.ts","sourceRoot":"","sources":["../src/pds-proxy.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAS9C,qBAAa,UAAW,SAAQ,KAAK;IAE1B,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM;CAIlB;AAED,qBAAa,sBAAuB,SAAQ,UAAU;;CAIrD;AAoHD,wBAAsB,eAAe,CACnC,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACvB,KAAK,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAC3F,OAAO,CAAC;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAiCzC;AAED,wBAAsB,eAAe,CACnC,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACvB,KAAK,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC1C,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAyBlC;AAED,wBAAsB,YAAY,CAChC,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACvB,KAAK,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1F,OAAO,CAAC;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA8BzC;AAED,wBAAsB,aAAa,CACjC,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACvB,IAAI,EAAE,UAAU,EAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,CAS5B"}