@hatk/hatk 0.0.1-alpha.6 → 0.0.1-alpha.60

package/dist/oauth/session.d.ts

@@ -0,0 +1,11 @@
+export type SessionData = {
+    did: string;
+    handle: string;
+};
+export declare function getSessionCookieName(): string;
+export declare function initSession(privateJwk: JsonWebKey, cookieName?: string): void;
+export declare function createSessionCookie(data: SessionData): Promise<string>;
+export declare function sessionCookieHeader(value: string, secure: boolean): string;
+export declare function clearSessionCookieHeader(): string;
+export declare function parseSessionCookie(request: Request): Promise<SessionData | null>;
+//# sourceMappingURL=session.d.ts.map

package/dist/oauth/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/oauth/session.ts"],"names":[],"mappings":"AASA,MAAM,MAAM,WAAW,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAEzD,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED,wBAAgB,WAAW,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAG7E;AAcD,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAM5E;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,MAAM,CAI1E;AAED,wBAAgB,wBAAwB,IAAI,MAAM,CAEjD;AAED,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAuBtF"}

package/dist/oauth/session.js

@@ -0,0 +1,65 @@
+// SSR session cookie — AES-GCM encrypted HttpOnly cookie for server-side viewer resolution.
+// Separate from OAuth protocol flows but uses the same server keypair for key derivation.
+import { base64UrlEncode, base64UrlDecode } from "./crypto.js";
+let _privateJwk;
+let _cookieName = '__hatk_session';
+const MAX_AGE = 30 * 24 * 60 * 60; // 30 days in seconds
+export function getSessionCookieName() {
+    return _cookieName;
+}
+export function initSession(privateJwk, cookieName) {
+    _privateJwk = privateJwk;
+    if (cookieName)
+        _cookieName = cookieName;
+}
+async function aesKey() {
+    const raw = new TextEncoder().encode(JSON.stringify(_privateJwk, Object.keys(_privateJwk).sort()));
+    const keyMaterial = await crypto.subtle.importKey('raw', raw, 'HKDF', false, ['deriveKey']);
+    return crypto.subtle.deriveKey({ name: 'HKDF', hash: 'SHA-256', salt: new Uint8Array(0), info: new TextEncoder().encode('hatk-session-cookie') }, keyMaterial, { name: 'AES-GCM', length: 256 }, false, ['encrypt', 'decrypt']);
+}
+export async function createSessionCookie(data) {
+    const payload = JSON.stringify({ ...data, ts: Math.floor(Date.now() / 1000) });
+    const iv = crypto.getRandomValues(new Uint8Array(12));
+    const key = await aesKey();
+    const ciphertext = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, key, new TextEncoder().encode(payload));
+    return `${base64UrlEncode(iv)}.${base64UrlEncode(new Uint8Array(ciphertext))}`;
+}
+export function sessionCookieHeader(value, secure) {
+    const parts = [`${_cookieName}=${value}`, 'HttpOnly', 'SameSite=Lax', 'Path=/', `Max-Age=${MAX_AGE}`];
+    if (secure)
+        parts.push('Secure');
+    return parts.join('; ');
+}
+export function clearSessionCookieHeader() {
+    return `${_cookieName}=; HttpOnly; SameSite=Lax; Path=/; Max-Age=0`;
+}
+export async function parseSessionCookie(request) {
+    const cookieHeader = request.headers.get('cookie');
+    if (!cookieHeader)
+        return null;
+    const match = cookieHeader
+        .split(';')
+        .map((c) => c.trim())
+        .find((c) => c.startsWith(`${_cookieName}=`));
+    if (!match)
+        return null;
+    const value = match.slice(_cookieName.length + 1);
+    const parts = value.split('.');
+    if (parts.length !== 2)
+        return null;
+    try {
+        const iv = base64UrlDecode(parts[0]);
+        const ciphertext = base64UrlDecode(parts[1]);
+        const key = await aesKey();
+        const plaintext = await crypto.subtle.decrypt({ name: 'AES-GCM', iv }, key, ciphertext);
+        const data = JSON.parse(new TextDecoder().decode(plaintext));
+        if (!data.did || !data.handle || !data.ts)
+            return null;
+        if (Date.now() / 1000 - data.ts > MAX_AGE)
+            return null;
+        return { did: data.did, handle: data.handle };
+    }
+    catch {
+        return null;
+    }
+}

package/dist/opengraph.d.ts

@@ -28,7 +28,17 @@ export interface OpengraphResult {
         description?: string;
     };
 }
+export declare function defineOG(path: string, generate: (ctx: OpengraphContext) => Promise<OpengraphResult>): {
+    __type: "og";
+    path: string;
+    generate: (ctx: OpengraphContext) => Promise<OpengraphResult>;
+};
 export declare function initOpengraph(ogDir: string): Promise<void>;
+/** Register a single OG handler from a scanned server/ module. */
+export declare function registerOgHandler(ogMod: {
+    path: string;
+    generate: (ctx: OpengraphContext) => Promise<OpengraphResult>;
+}): void;
 export declare function handleOpengraphRequest(pathname: string): Promise<Buffer | null>;
 export declare function buildOgMeta(pathname: string, origin: string): string | null;
 //# sourceMappingURL=opengraph.d.ts.map

package/dist/opengraph.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"opengraph.d.ts","sourceRoot":"","sources":["../src/opengraph.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAE5C,4CAA4C;AAC5C,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAC3B,QAAQ,CAAC,EAAE,CAAC,UAAU,GAAG,MAAM,CAAC,EAAE,GAAG,MAAM,CAAA;QAC3C,GAAG,CAAC,EAAE,MAAM,CAAA;QACZ,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KACnB,CAAA;CACF;AAED,uDAAuD;AACvD,MAAM,WAAW,gBAAiB,SAAQ,WAAW;IACnD,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;CACpD;AAED,qDAAqD;AACrD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,UAAU,CAAA;IACnB,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAA;KAAE,CAAA;IAC5D,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAChD;AAkCD,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAoGhE;AAED,wBAAsB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA8BrF;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAyC3E"}
+{"version":3,"file":"opengraph.d.ts","sourceRoot":"","sources":["../src/opengraph.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAE5C,4CAA4C;AAC5C,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAC3B,QAAQ,CAAC,EAAE,CAAC,UAAU,GAAG,MAAM,CAAC,EAAE,GAAG,MAAM,CAAA;QAC3C,GAAG,CAAC,EAAE,MAAM,CAAA;QACZ,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KACnB,CAAA;CACF;AAED,uDAAuD;AACvD,MAAM,WAAW,gBAAiB,SAAQ,WAAW;IACnD,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;CACpD;AAED,qDAAqD;AACrD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,UAAU,CAAA;IACnB,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAA;KAAE,CAAA;IAC5D,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAChD;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,OAAO,CAAC,eAAe,CAAC;;;oBAA7C,gBAAgB,KAAK,OAAO,CAAC,eAAe,CAAC;EAEnG;AAkCD,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA0EhE;AAED,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,OAAO,CAAC,eAAe,CAAC,CAAA;CAC9D,GAAG,IAAI,CAsDP;AAED,wBAAsB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA+BrF;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAyC3E"}

package/dist/opengraph.js

@@ -9,11 +9,23 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
 import { resolve } from 'node:path';
 import { readFileSync, readdirSync } from 'node:fs';
 import { log } from "./logger.js";
-import satori from 'satori';
-import { Resvg } from '@resvg/resvg-js';
-import { querySQL, runSQL, packCursor, unpackCursor, isTakendownDid, filterTakendownDids, searchRecords, findUriByFields, lookupByFieldBatch, countByFieldBatch, queryLabelsForUris, } from "./db.js";
-import { resolveRecords } from "./hydrate.js";
-import { blobUrl } from "./xrpc.js";
+// Lazy-imported to avoid CJS require() issues in Vite's module runner
+let _satori = null;
+let _Resvg = null;
+async function getSatori() {
+    if (!_satori)
+        _satori = (await import('satori')).default;
+    return _satori;
+}
+async function getResvg() {
+    if (!_Resvg)
+        _Resvg = (await import('@resvg/resvg-js')).Resvg;
+    return _Resvg;
+}
+import { buildXrpcContext } from "./xrpc.js";
+export function defineOG(path, generate) {
+    return { __type: 'og', path, generate };
+}
 const handlers = [];
 const pageRoutes = [];
 let defaultFont = null;
@@ -51,7 +63,7 @@ export async function initOpengraph(ogDir) {
     for (const file of files) {
         const name = file.replace(/\.(ts|js)$/, '');
         const scriptPath = resolve(ogDir, file);
-        const mod = await import(__rewriteRelativeImportExtension(scriptPath));
+        const mod = await import(__rewriteRelativeImportExtension(/* @vite-ignore */ `${scriptPath}?t=${Date.now()}`));
         const handler = mod.default;
         if (!handler.path) {
             console.warn(`[opengraph] ${file} missing 'path' export, skipping`);
@@ -64,38 +76,10 @@ export async function initOpengraph(ogDir) {
             pattern,
             paramNames,
             execute: async (params) => {
-                const ctx = {
-                    db: { query: querySQL, run: runSQL },
-                    params,
-                    input: {},
-                    limit: 1,
-                    viewer: null,
-                    packCursor,
-                    unpackCursor,
-                    isTakendown: isTakendownDid,
-                    filterTakendownDids,
-                    search: searchRecords,
-                    resolve: resolveRecords,
-                    lookup: async (collection, field, values) => {
-                        if (values.length === 0)
-                            return new Map();
-                        const unique = [...new Set(values.filter(Boolean))];
-                        return lookupByFieldBatch(collection, field, unique);
-                    },
-                    count: async (collection, field, values) => {
-                        if (values.length === 0)
-                            return new Map();
-                        const unique = [...new Set(values.filter(Boolean))];
-                        return countByFieldBatch(collection, field, unique);
-                    },
-                    exists: async (collection, filters) => {
-                        const conditions = Object.entries(filters).map(([field, value]) => ({ field, value }));
-                        const uri = await findUriByFields(collection, conditions);
-                        return uri !== null;
-                    },
-                    labels: queryLabelsForUris,
-                    blobUrl,
-                };
+                const ctx = buildXrpcContext(params, undefined, 1, null);
+                // Override blobUrl to use _og presets (jpeg) — satori doesn't support webp
+                const origBlobUrl = ctx.blobUrl;
+                ctx.blobUrl = (did, ref, preset = 'avatar') => origBlobUrl(did, ref, `${preset}_og`);
                 ctx.fetchImage = async (url) => {
                     try {
                         const resp = await fetch(url, { redirect: 'follow' });
@@ -117,7 +101,7 @@ export async function initOpengraph(ogDir) {
                     ...result.options,
                     fonts: [...(defaultFont ? [defaultFont] : []), ...(result.options?.fonts || [])],
                 };
-                const svg = await satori(element, options);
+                const svg = await (await getSatori())(element, options);
                 return { svg, meta: result.meta };
             },
         });
@@ -129,6 +113,61 @@ export async function initOpengraph(ogDir) {
         }
     }
 }
+/** Register a single OG handler from a scanned server/ module. */
+export function registerOgHandler(ogMod) {
+    const { pattern, paramNames } = compilePath(ogMod.path);
+    const name = ogMod.path.replace(/^\//, '').replace(/\//g, '-').replace(/:/g, '');
+    // Load default font if not already loaded
+    if (!defaultFont) {
+        try {
+            const fontPath = resolve(import.meta.dirname, '..', 'fonts', 'Inter-Regular.woff');
+            const fontData = readFileSync(fontPath);
+            defaultFont = { name: 'Inter', data: fontData.buffer, weight: 400, style: 'normal' };
+        }
+        catch { }
+    }
+    handlers.push({
+        name,
+        path: ogMod.path,
+        pattern,
+        paramNames,
+        execute: async (params) => {
+            const ctx = buildXrpcContext(params, undefined, 1, null);
+            // Override blobUrl to use _og presets (jpeg) — satori doesn't support webp
+            const origBlobUrl = ctx.blobUrl;
+            ctx.blobUrl = (did, ref, preset = 'avatar') => origBlobUrl(did, ref, `${preset}_og`);
+            ctx.fetchImage = async (url) => {
+                try {
+                    const resp = await fetch(url, { redirect: 'follow' });
+                    if (!resp.ok)
+                        return null;
+                    const buf = Buffer.from(await resp.arrayBuffer());
+                    const contentType = resp.headers.get('content-type') || 'image/jpeg';
+                    return `data:${contentType};base64,${buf.toString('base64')}`;
+                }
+                catch {
+                    return null;
+                }
+            };
+            const result = await ogMod.generate(ctx);
+            const element = result.element;
+            const options = {
+                width: 1200,
+                height: 630,
+                ...result.options,
+                fonts: [...(defaultFont ? [defaultFont] : []), ...(result.options?.fonts || [])],
+            };
+            const svg = await (await getSatori())(element, options);
+            return { svg, meta: result.meta };
+        },
+    });
+    const pagePath = ogMod.path.replace(/^\/og/, '');
+    if (pagePath !== ogMod.path) {
+        const compiled = compilePath(pagePath);
+        pageRoutes.push({ ogPath: ogMod.path, pattern: compiled.pattern, paramNames: compiled.paramNames, name });
+    }
+    log(`[opengraph] registered: ${name} → ${ogMod.path}`);
+}
 export async function handleOpengraphRequest(pathname) {
     const cached = cache.get(pathname);
     if (cached && cached.expires > Date.now())
@@ -143,6 +182,7 @@ export async function handleOpengraphRequest(pathname) {
         });
         try {
             const { svg, meta } = await handler.execute(params);
+            const Resvg = await getResvg();
             const png = new Resvg(svg, { fitTo: { mode: 'width', value: 1200 } }).render().asPng();
             if (cache.size >= CACHE_MAX) {
                 const oldest = cache.keys().next().value;
@@ -153,7 +193,7 @@ export async function handleOpengraphRequest(pathname) {
             return png;
         }
         catch (err) {
-            console.error(`[opengraph] error in ${handler.name}:`, err.message);
+            console.error(`[opengraph] error in ${handler.name}:`, err.message, err.stack);
             return null;
         }
     }

package/dist/pds-proxy.d.ts

@@ -0,0 +1,60 @@
+import type { OAuthConfig } from './config.ts';
+export declare class ProxyError extends Error {
+    status: number;
+    constructor(status: number, message: string);
+}
+export declare class ScopeMissingProxyError extends ProxyError {
+    constructor();
+}
+export declare function pdsCreateRecord(oauthConfig: OAuthConfig, viewer: {
+    did: string;
+}, input: {
+    collection: string;
+    repo?: string;
+    rkey?: string;
+    record: Record<string, unknown>;
+}): Promise<{
+    uri?: string;
+    cid?: string;
+}>;
+export declare function pdsDeleteRecord(oauthConfig: OAuthConfig, viewer: {
+    did: string;
+}, input: {
+    collection: string;
+    rkey: string;
+}): Promise<Record<string, unknown>>;
+export declare function pdsPutRecord(oauthConfig: OAuthConfig, viewer: {
+    did: string;
+}, input: {
+    collection: string;
+    rkey: string;
+    record: Record<string, unknown>;
+    repo?: string;
+}): Promise<{
+    uri?: string;
+    cid?: string;
+}>;
+export interface ApplyWritesOp {
+    $type: string;
+    collection: string;
+    rkey?: string;
+    value?: Record<string, unknown>;
+}
+export interface ApplyWritesResult {
+    $type: string;
+    uri?: string;
+    cid?: string;
+}
+export declare function pdsApplyWrites(oauthConfig: OAuthConfig, viewer: {
+    did: string;
+}, input: {
+    writes: ApplyWritesOp[];
+}): Promise<{
+    results?: ApplyWritesResult[];
+}>;
+export declare function pdsUploadBlob(oauthConfig: OAuthConfig, viewer: {
+    did: string;
+}, body: Uint8Array, contentType: string): Promise<{
+    blob: unknown;
+}>;
+//# sourceMappingURL=pds-proxy.d.ts.map

package/dist/pds-proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pds-proxy.d.ts","sourceRoot":"","sources":["../src/pds-proxy.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAU9C,qBAAa,UAAW,SAAQ,KAAK;IAE1B,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM;CAIlB;AAED,qBAAa,sBAAuB,SAAQ,UAAU;;CAIrD;AAuHD,wBAAsB,eAAe,CACnC,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACvB,KAAK,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAC3F,OAAO,CAAC;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAwCzC;AAED,wBAAsB,eAAe,CACnC,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACvB,KAAK,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC1C,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAyBlC;AAED,wBAAsB,YAAY,CAChC,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACvB,KAAK,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1F,OAAO,CAAC;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAqCzC;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAChC;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAYD,wBAAsB,cAAc,CAClC,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACvB,KAAK,EAAE;IAAE,MAAM,EAAE,aAAa,EAAE,CAAA;CAAE,GACjC,OAAO,CAAC;IAAE,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAA;CAAE,CAAC,CAgE5C;AAED,wBAAsB,aAAa,CACjC,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACvB,IAAI,EAAE,UAAU,EAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,CAS5B"}

package/dist/pds-proxy.js

@@ -0,0 +1,277 @@
+// Shared PDS proxy functions — used by both HTTP route handlers and XRPC handlers.
+import { getSession, getServerKey, deleteSession } from "./oauth/db.js";
+import { createDpopProof } from "./oauth/dpop.js";
+import { refreshPdsSession } from "./oauth/server.js";
+import { validateRecord } from '@bigmoves/lexicon';
+import { getLexiconArray } from "./database/schema.js";
+import { insertRecord, deleteRecord as dbDeleteRecord } from "./database/db.js";
+import { emit } from "./logger.js";
+import { runLabelRules } from "./labels.js";
+export class ProxyError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
+export class ScopeMissingProxyError extends ProxyError {
+    constructor() {
+        super(401, 'ScopeMissingError');
+    }
+}
+/** Shared retry logic: DPoP nonce handling + token refresh. */
+async function withDpopRetry(oauthConfig, session, doFetch) {
+    let accessToken = session.access_token;
+    let result = await doFetch(accessToken);
+    if (result.ok)
+        return result;
+    let nonce;
+    // Step 1: handle DPoP nonce requirement
+    if (result.body.error === 'use_dpop_nonce') {
+        nonce = result.headers.get('DPoP-Nonce') || undefined;
+        if (nonce) {
+            result = await doFetch(accessToken, nonce);
+            if (result.ok)
+                return result;
+        }
+    }
+    // Step 2: handle insufficient scope — clear session so user re-authenticates with updated scopes
+    if (result.body.error === 'ScopeMissingError') {
+        await deleteSession(session.did);
+        throw new ScopeMissingProxyError();
+    }
+    // Step 3: handle expired PDS token — refresh and retry
+    // The PDS returns 'InvalidToken' or 'ExpiredToken' (AT Proto PascalCase convention)
+    // while the OAuth spec uses 'invalid_token' (RFC 6750 snake_case)
+    const err = result.body.error;
+    if (err === 'invalid_token' || err === 'InvalidToken' || err === 'ExpiredToken') {
+        const refreshed = await refreshPdsSession(oauthConfig, session);
+        if (refreshed) {
+            accessToken = refreshed.accessToken;
+            result = await doFetch(accessToken, nonce);
+            if (result.ok)
+                return result;
+            if (result.body.error === 'use_dpop_nonce') {
+                nonce = result.headers.get('DPoP-Nonce') || undefined;
+                if (nonce)
+                    result = await doFetch(accessToken, nonce);
+            }
+        }
+    }
+    return result;
+}
+async function proxyToPds(oauthConfig, session, method, pdsUrl, body) {
+    const serverKey = await getServerKey('appview-oauth-key');
+    const privateJwk = JSON.parse(serverKey.privateKey);
+    const publicJwk = JSON.parse(serverKey.publicKey);
+    return withDpopRetry(oauthConfig, session, async (token, nonce) => {
+        const proof = await createDpopProof(privateJwk, publicJwk, method, pdsUrl, token, nonce);
+        const res = await fetch(pdsUrl, {
+            method,
+            headers: {
+                'Content-Type': 'application/json',
+                Authorization: `DPoP ${token}`,
+                DPoP: proof,
+            },
+            body: JSON.stringify(body),
+        });
+        const resBody = await res.json().catch(() => ({}));
+        return { ok: res.ok, status: res.status, body: resBody, headers: res.headers };
+    });
+}
+/** Proxy a raw binary request to the user's PDS with DPoP + nonce retry + token refresh. */
+async function proxyToPdsRaw(oauthConfig, session, pdsUrl, body, contentType) {
+    const serverKey = await getServerKey('appview-oauth-key');
+    const privateJwk = JSON.parse(serverKey.privateKey);
+    const publicJwk = JSON.parse(serverKey.publicKey);
+    return withDpopRetry(oauthConfig, session, async (token, nonce) => {
+        const proof = await createDpopProof(privateJwk, publicJwk, 'POST', pdsUrl, token, nonce);
+        const res = await fetch(pdsUrl, {
+            method: 'POST',
+            headers: {
+                'Content-Type': contentType,
+                'Content-Length': String(body.length),
+                Authorization: `DPoP ${token}`,
+                DPoP: proof,
+            },
+            body: Buffer.from(body),
+        });
+        const resBody = await res.json().catch(() => ({}));
+        return { ok: res.ok, status: res.status, body: resBody, headers: res.headers };
+    });
+}
+// --- High-level proxy functions ---
+export async function pdsCreateRecord(oauthConfig, viewer, input) {
+    const validationError = validateRecord(getLexiconArray(), input.collection, input.record);
+    if (validationError) {
+        throw new ProxyError(400, `InvalidRecord: ${validationError.path ? validationError.path + ': ' : ''}${validationError.message}`);
+    }
+    const session = await getSession(viewer.did);
+    if (!session)
+        throw new ProxyError(401, 'No PDS session for user');
+    const pdsUrl = `${session.pds_endpoint}/xrpc/com.atproto.repo.createRecord`;
+    const pdsBody = {
+        repo: viewer.did,
+        collection: input.collection,
+        rkey: input.rkey,
+        record: input.record,
+    };
+    const pdsRes = await proxyToPds(oauthConfig, session, 'POST', pdsUrl, pdsBody);
+    if (!pdsRes.ok)
+        throw new ProxyError(pdsRes.status, String(pdsRes.body.error || 'PDS write failed'));
+    try {
+        await insertRecord(input.collection, String(pdsRes.body.uri), String(pdsRes.body.cid), viewer.did, input.record);
+        await runLabelRules({
+            uri: String(pdsRes.body.uri),
+            cid: String(pdsRes.body.cid),
+            did: viewer.did,
+            collection: input.collection,
+            value: input.record,
+        });
+    }
+    catch (err) {
+        emit('pds-proxy', 'local_index_error', {
+            op: 'createRecord',
+            error: err instanceof Error ? err.message : String(err),
+        });
+    }
+    return pdsRes.body;
+}
+export async function pdsDeleteRecord(oauthConfig, viewer, input) {
+    const session = await getSession(viewer.did);
+    if (!session)
+        throw new ProxyError(401, 'No PDS session for user');
+    const pdsUrl = `${session.pds_endpoint}/xrpc/com.atproto.repo.deleteRecord`;
+    const pdsBody = {
+        repo: viewer.did,
+        collection: input.collection,
+        rkey: input.rkey,
+    };
+    const pdsRes = await proxyToPds(oauthConfig, session, 'POST', pdsUrl, pdsBody);
+    if (!pdsRes.ok)
+        throw new ProxyError(pdsRes.status, String(pdsRes.body.error || 'PDS delete failed'));
+    try {
+        const uri = `at://${viewer.did}/${input.collection}/${input.rkey}`;
+        await dbDeleteRecord(input.collection, uri);
+    }
+    catch (err) {
+        emit('pds-proxy', 'local_index_error', {
+            op: 'deleteRecord',
+            error: err instanceof Error ? err.message : String(err),
+        });
+    }
+    return pdsRes.body;
+}
+export async function pdsPutRecord(oauthConfig, viewer, input) {
+    const validationError = validateRecord(getLexiconArray(), input.collection, input.record);
+    if (validationError) {
+        throw new ProxyError(400, `InvalidRecord: ${validationError.path ? validationError.path + ': ' : ''}${validationError.message}`);
+    }
+    const session = await getSession(viewer.did);
+    if (!session)
+        throw new ProxyError(401, 'No PDS session for user');
+    const pdsUrl = `${session.pds_endpoint}/xrpc/com.atproto.repo.putRecord`;
+    const pdsBody = {
+        repo: viewer.did,
+        collection: input.collection,
+        rkey: input.rkey,
+        record: input.record,
+    };
+    const pdsRes = await proxyToPds(oauthConfig, session, 'POST', pdsUrl, pdsBody);
+    if (!pdsRes.ok)
+        throw new ProxyError(pdsRes.status, String(pdsRes.body.error || 'PDS write failed'));
+    try {
+        await insertRecord(input.collection, String(pdsRes.body.uri), String(pdsRes.body.cid), viewer.did, input.record);
+        await runLabelRules({
+            uri: String(pdsRes.body.uri),
+            cid: String(pdsRes.body.cid),
+            did: viewer.did,
+            collection: input.collection,
+            value: input.record,
+        });
+    }
+    catch (err) {
+        emit('pds-proxy', 'local_index_error', { op: 'putRecord', error: err instanceof Error ? err.message : String(err) });
+    }
+    return pdsRes.body;
+}
+/** Map dev.hatk.applyWrites#* types to com.atproto.repo.applyWrites#* for PDS. */
+function toPdsWriteType($type) {
+    return $type.replace('dev.hatk.applyWrites#', 'com.atproto.repo.applyWrites#');
+}
+function isCreateOrUpdate($type) {
+    const mapped = toPdsWriteType($type);
+    return mapped === 'com.atproto.repo.applyWrites#create' || mapped === 'com.atproto.repo.applyWrites#update';
+}
+export async function pdsApplyWrites(oauthConfig, viewer, input) {
+    // Validate all create/update records before sending
+    for (const write of input.writes) {
+        if (isCreateOrUpdate(write.$type) && write.value) {
+            const validationError = validateRecord(getLexiconArray(), write.collection, write.value);
+            if (validationError) {
+                throw new ProxyError(400, `InvalidRecord: ${validationError.path ? validationError.path + ': ' : ''}${validationError.message}`);
+            }
+        }
+    }
+    const session = await getSession(viewer.did);
+    if (!session)
+        throw new ProxyError(401, 'No PDS session for user');
+    const pdsUrl = `${session.pds_endpoint}/xrpc/com.atproto.repo.applyWrites`;
+    const pdsBody = {
+        repo: viewer.did,
+        writes: input.writes.map((w) => ({ ...w, $type: toPdsWriteType(w.$type) })),
+    };
+    const pdsRes = await proxyToPds(oauthConfig, session, 'POST', pdsUrl, pdsBody);
+    if (!pdsRes.ok)
+        throw new ProxyError(pdsRes.status, String(pdsRes.body.error || 'PDS applyWrites failed'));
+    // Index results locally
+    const results = pdsRes.body.results ?? [];
+    for (let i = 0; i < input.writes.length; i++) {
+        const write = input.writes[i];
+        const result = results[i];
+        try {
+            const mapped = toPdsWriteType(write.$type);
+            if (mapped === 'com.atproto.repo.applyWrites#create' && result?.uri && result?.cid && write.value) {
+                await insertRecord(write.collection, result.uri, result.cid, viewer.did, write.value);
+                await runLabelRules({
+                    uri: result.uri,
+                    cid: result.cid,
+                    did: viewer.did,
+                    collection: write.collection,
+                    value: write.value,
+                });
+            }
+            else if (mapped === 'com.atproto.repo.applyWrites#update' && result?.uri && result?.cid && write.value) {
+                await insertRecord(write.collection, result.uri, result.cid, viewer.did, write.value);
+                await runLabelRules({
+                    uri: result.uri,
+                    cid: result.cid,
+                    did: viewer.did,
+                    collection: write.collection,
+                    value: write.value,
+                });
+            }
+            else if (mapped === 'com.atproto.repo.applyWrites#delete' && write.rkey) {
+                const uri = `at://${viewer.did}/${write.collection}/${write.rkey}`;
+                await dbDeleteRecord(write.collection, uri);
+            }
+        }
+        catch (err) {
+            emit('pds-proxy', 'local_index_error', {
+                op: 'applyWrites',
+                error: err instanceof Error ? err.message : String(err),
+            });
+        }
+    }
+    return pdsRes.body;
+}
+export async function pdsUploadBlob(oauthConfig, viewer, body, contentType) {
+    const session = await getSession(viewer.did);
+    if (!session)
+        throw new ProxyError(401, 'No PDS session for user');
+    const pdsUrl = `${session.pds_endpoint}/xrpc/com.atproto.repo.uploadBlob`;
+    const pdsRes = await proxyToPdsRaw(oauthConfig, session, pdsUrl, body, contentType);
+    if (!pdsRes.ok)
+        throw new ProxyError(pdsRes.status, String(pdsRes.body.error || 'PDS upload failed'));
+    return pdsRes.body;
+}

package/dist/push.d.ts

@@ -0,0 +1,34 @@
+export interface ApnsConfig {
+    keyFile: string;
+    keyId: string;
+    teamId: string;
+    bundleId: string;
+    production?: boolean;
+}
+export interface PushConfig {
+    apns: ApnsConfig;
+}
+export interface PushPayload {
+    did: string;
+    title: string;
+    body: string;
+    data?: Record<string, string>;
+    collapseId?: string;
+    badge?: number;
+}
+export interface PushInterface {
+    send: (payload: PushPayload) => Promise<void>;
+}
+/** Initialize push with config. Must be called before send(). */
+export declare function initPush(config: PushConfig, configDir: string): void;
+/** Check if push is configured and available. */
+export declare function isPushEnabled(): boolean;
+/** Build the push interface injected into hook contexts. */
+export declare function buildPushInterface(): PushInterface;
+/** Register a push token for a DID. Upserts on conflict. */
+export declare function registerToken(did: string, token: string, platform: string): Promise<void>;
+/** Remove a push token. */
+export declare function removeToken(token: string): Promise<void>;
+/** Unregister a specific token for a DID. */
+export declare function unregisterToken(did: string, token: string): Promise<void>;
+//# sourceMappingURL=push.d.ts.map

package/dist/push.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"push.d.ts","sourceRoot":"","sources":["../src/push.ts"],"names":[],"mappings":"AAeA,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,OAAO,CAAA;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,UAAU,CAAA;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9C;AAOD,iEAAiE;AACjE,wBAAgB,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CASpE;AAED,iDAAiD;AACjD,wBAAgB,aAAa,IAAI,OAAO,CAEvC;AAED,4DAA4D;AAC5D,wBAAgB,kBAAkB,IAAI,aAAa,CAElD;AAoJD,4DAA4D;AAC5D,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO/F;AAED,2BAA2B;AAC3B,wBAAsB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9D;AAED,6CAA6C;AAC7C,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/E"}