@hatk/hatk 0.0.1-alpha.85 → 0.0.1-alpha.86

package/dist/oauth/db.js

@@ -146,6 +146,18 @@ export async function getSession(did) {
     const rows = await querySQL('SELECT * FROM _oauth_sessions WHERE did = $1', [did]);
     return rows.length > 0 ? rows[0] : null;
 }
+/**
+ * Every DID this instance holds a PDS session for, most recently refreshed
+ * first.
+ *
+ * Space indexing reads as a member rather than as itself, so this is the set of
+ * people it could borrow a delegation from. Ordered by recency because a
+ * session refreshed lately is the one most likely to still work.
+ */
+export async function listSessionDids() {
+    const rows = (await querySQL('SELECT did FROM _oauth_sessions ORDER BY updated_at DESC, created_at DESC'));
+    return rows.map((r) => r.did);
+}
 export async function deleteSession(did) {
     await runSQL('DELETE FROM _oauth_sessions WHERE did = $1', [did]);
 }

package/dist/private-collections.d.ts

@@ -1,8 +1,13 @@
 export declare function setPrivateCollections(list: string[]): void;
 export declare function isPrivateCollection(nsid: string | null | undefined): boolean;
 /**
- * The collection segment of an AT-URI: at://{did}/{collection}/{rkey}.
- * Splitting yields ['at:', '', did, collection, rkey].
+ * The collection segment of a record AT-URI, in either shape.
+ *
+ * A repo record is `at://{did}/{collection}/{rkey}`; a space record is
+ * `at://{authority}/space/{type}/{skey}/{writer}/{collection}/{rkey}`, where
+ * the position a collection used to occupy holds the literal 'space'. Reading
+ * it positionally without that distinction reports every space record as
+ * belonging to a collection named 'space', which no guard would match.
  */
 export declare function collectionFromUri(uri: string): string | undefined;
 //# sourceMappingURL=private-collections.d.ts.map

package/dist/private-collections.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"private-collections.d.ts","sourceRoot":"","sources":["../src/private-collections.ts"],"names":[],"mappings":"AASA,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAE1D;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAE5E;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGjE"}
+{"version":3,"file":"private-collections.d.ts","sourceRoot":"","sources":["../src/private-collections.ts"],"names":[],"mappings":"AAWA,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAE1D;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAE5E;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEjE"}

package/dist/private-collections.js

@@ -1,3 +1,4 @@
+import { collectionFromRecordUri } from "./spaces/uri.js";
 /**
  * Collections that are indexed and queryable in-process but must never be
  * served by the built-in dev.hatk.* record endpoints.
@@ -13,10 +14,14 @@ export function isPrivateCollection(nsid) {
     return nsid != null && privateCollections.has(nsid);
 }
 /**
- * The collection segment of an AT-URI: at://{did}/{collection}/{rkey}.
- * Splitting yields ['at:', '', did, collection, rkey].
+ * The collection segment of a record AT-URI, in either shape.
+ *
+ * A repo record is `at://{did}/{collection}/{rkey}`; a space record is
+ * `at://{authority}/space/{type}/{skey}/{writer}/{collection}/{rkey}`, where
+ * the position a collection used to occupy holds the literal 'space'. Reading
+ * it positionally without that distinction reports every space record as
+ * belonging to a collection named 'space', which no guard would match.
  */
 export function collectionFromUri(uri) {
-    const parts = uri.split('/');
-    return parts.length > 4 ? parts[3] : undefined;
+    return collectionFromRecordUri(uri);
 }

package/dist/server.d.ts

@@ -4,6 +4,12 @@ import type { OAuthConfig } from './config.ts';
  * This makes them available to callXrpc() for use in SSR and server code.
  */
 export declare function registerCoreHandlers(collections: string[], oauth: OAuthConfig | null): void;
+export interface SpaceHandlerConfig {
+    serviceDid?: string;
+    serviceFragment?: string;
+    /** The origin an authority should deliver to, when it is not the request's own. */
+    publicUrl?: string;
+}
 export interface HandlerConfig {
     collections: string[];
     publicDir: string | null;
@@ -17,6 +23,8 @@ export interface HandlerConfig {
         did: string;
     } | null;
     onResync?: () => void;
+    /** Permissioned-space notice delivery. Absent on an instance that indexes none. */
+    spaces?: SpaceHandlerConfig;
 }
 /**
  * Create a Web Standard request handler for all hatk routes.

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAsEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAyD9C;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,GAAG,IAAI,CAuM3F;AAgDD,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,KAAK,EAAE,WAAW,GAAG,IAAI,CAAA;IACzB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACxF,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;IAC5D,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAA;CACtB;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAwkC5F;AAGD,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EAAE,EACrB,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,KAAK,EAAE,WAAW,GAAG,IAAI,EACzB,MAAM,GAAE,MAAM,EAAO,EACrB,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAC5D,QAAQ,CAAC,EAAE,MAAM,IAAI,GACpB,OAAO,WAAW,EAAE,MAAM,CAG5B"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAsEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAuE9C;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,GAAG,IAAI,CA2M3F;AAgDD,MAAM,WAAW,kBAAkB;IACjC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,mFAAmF;IACnF,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,KAAK,EAAE,WAAW,GAAG,IAAI,CAAA;IACzB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACxF,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;IAC5D,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAA;IACrB,mFAAmF;IACnF,MAAM,CAAC,EAAE,kBAAkB,CAAA;CAC5B;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CA6pC5F;AAGD,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EAAE,EACrB,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,KAAK,EAAE,WAAW,GAAG,IAAI,EACzB,MAAM,GAAE,MAAM,EAAO,EACrB,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAC5D,QAAQ,CAAC,EAAE,MAAM,IAAI,GACpB,OAAO,WAAW,EAAE,MAAM,CAG5B"}

package/dist/server.js

@@ -5,7 +5,7 @@ import { join, extname } from 'node:path';
 import { gzipSync } from 'node:zlib';
 import { queryRecords, getRecordByUri, searchRecords, getSchema, reshapeRow, setRepoStatus, getRepoStatus, getRepoRetryInfo, queryLabelsForUris, insertLabels, searchAccounts, listReposPaginated, getCollectionCounts, getRepoStatusCounts, getDatabaseSize, deleteLabels, getRecentRecords, listActiveRepoDids, removeRepo, getRepoHandle, getPreferences, putPreference, insertReport, queryReports, resolveReport, getOpenReportCount, } from "./database/db.js";
 import { executeFeed, listFeeds } from "./feeds.js";
-import { executeXrpc, InvalidRequestError, NotFoundError, registerCoreXrpcHandler, isLocalRelay } from "./xrpc.js";
+import { executeXrpc, InvalidRequestError, NotFoundError, registerCoreXrpcHandler, isLocalRelay, paramsFromSearch } from "./xrpc.js";
 import { pdsFor } from "./backfill.js";
 import { resolveRecords } from "./hydrate.js";
 import { handleOpengraphRequest, buildOgMeta } from "./opengraph.js";
@@ -18,6 +18,11 @@ import { getOAuthRequest, getSession } from "./oauth/db.js";
 import { pdsCreateRecord, pdsDeleteRecord, pdsPutRecord, pdsApplyWrites, pdsUploadBlob, ProxyError, ScopeMissingProxyError, } from "./pds-proxy.js";
 import { json, jsonError, cors, withCors, file, notFound } from "./response.js";
 import { collectionFromUri, isPrivateCollection } from "./private-collections.js";
+import { enterReadableSpaces } from "./spaces/visibility.js";
+import { readableSpacesFor } from "./spaces/viewer.js";
+import { parseSpaceBlobRequest, serveSpaceBlob } from "./spaces/blob.js";
+import { handleWriteNotice, NoticeError, parseWriteNotice, scheduleNoticeSync, spaceDidDocument, spaceServiceId, unwatchSpace, verifyNotice, } from "./spaces/index.js";
+import { parseSpaceRef } from "./spaces/uri.js";
 import { serve } from "./adapter.js";
 import { renderPage } from "./renderer.js";
 /**
@@ -253,7 +258,11 @@ export function registerCoreHandlers(collections, oauth) {
                 subjectDid = match[1];
             }
             else if (body.subject.did) {
-                subjectUri = `at://${body.subject.did}`;
+                // The bare DID, not `at://<did>`: resolving this report labels
+                // `subjectUri`, and an account label is keyed by DID alone. Ozone
+                // writes it that way and every appview reads it that way, so the
+                // `at://` form would apply a label nothing ever looks up.
+                subjectUri = body.subject.did;
                 subjectDid = body.subject.did;
             }
             else {
@@ -382,6 +391,19 @@ export function createHandler(config) {
             }
             catch { }
         }
+        // Which permissioned spaces this request may be shown, established once and
+        // read by every query below. A signed-out visitor gets none — there is no
+        // anonymous read path into a space — and so does an instance that indexes
+        // none, which is every deployment that has not configured `spaces`.
+        try {
+            enterReadableSpaces(await readableSpacesFor(oauth, viewer));
+        }
+        catch (err) {
+            // Failing to establish the scope must not widen it: the default is to
+            // serve no space row, and that is what an unresolved viewer gets.
+            enterReadableSpaces([]);
+            emit('spaces', 'viewer_resolve_error', { error: err.message });
+        }
         try {
             // GET /xrpc/dev.hatk.getRecords?collection=<nsid>&limit=N&cursor=C&<field>=<value>
             if (url.pathname === coreXrpc('getRecords')) {
@@ -449,10 +471,7 @@ export function createHandler(config) {
                     return withCors(jsonError(400, 'Missing feed parameter', acceptEncoding));
                 const limit = parseInt(url.searchParams.get('limit') || '30');
                 const cursor = url.searchParams.get('cursor') || undefined;
-                const params = {};
-                for (const [key, value] of url.searchParams) {
-                    params[key] = value;
-                }
+                const params = paramsFromSearch(url.searchParams);
                 const result = await executeFeed(feedName, params, cursor, limit, viewer);
                 if (!result)
                     return withCors(jsonError(404, `Unknown feed: ${feedName}`, acceptEncoding));
@@ -862,6 +881,12 @@ export function createHandler(config) {
                 }, 200, acceptEncoding));
             }
             // --- OAuth Endpoints ---
+            // GET /.well-known/did.json — this instance's own DID document, so a space
+            // authority can resolve where to deliver notices. Published only when a
+            // service DID is configured; it carries a service entry and no key.
+            if (url.pathname === '/.well-known/did.json' && config.spaces?.serviceDid) {
+                return withCors(json(spaceDidDocument(config.spaces.serviceDid, config.spaces.publicUrl ?? requestOrigin, config.spaces.serviceFragment ?? 'atproto_space_syncer'), 200, acceptEncoding));
+            }
             // OAuth well-known endpoints
             if (url.pathname === '/.well-known/oauth-authorization-server' && oauth) {
                 return withCors(json(getAuthServerMetadata(oauth.issuer, oauth), 200, acceptEncoding));
@@ -1214,14 +1239,68 @@ export function createHandler(config) {
                     return withCors(file(png, 'image/png', 'public, max-age=300'));
             }
             // GET/POST /xrpc/{nsid} — custom XRPC handlers (matched by full NSID from folder structure)
+            // POST /xrpc/com.atproto.space.notifyWrite — a space authority telling us
+            // one of its repos moved. Carries no records: it says look again, and the
+            // read that follows uses our own credential like any other.
+            //
+            // Best-effort by protocol, so this answers before syncing and never lets
+            // a sync failure become the authority's problem. A missed notice is
+            // recovered by the reconcile sweep.
+            if (url.pathname === '/xrpc/com.atproto.space.notifyWrite' && request.method === 'POST') {
+                const serviceId = spaceServiceId();
+                if (!serviceId)
+                    return withCors(jsonError(404, 'This instance receives no space notices', acceptEncoding));
+                const notice = parseWriteNotice(await request.json().catch(() => null));
+                if (!notice)
+                    return withCors(jsonError(400, 'Expected space, repo and rev', acceptEncoding));
+                try {
+                    await verifyNotice(request.headers.get('authorization'), {
+                        iss: parseSpaceRef(notice.space).authority,
+                        aud: serviceId,
+                        lxm: 'com.atproto.space.notifyWrite',
+                    });
+                }
+                catch (err) {
+                    if (err instanceof NoticeError)
+                        return withCors(jsonError(err.status, err.message, acceptEncoding));
+                    throw err;
+                }
+                // Debounced per repo: one member writing a gallery sends a notice per
+                // record, and each is an invitation to read the same repo again.
+                scheduleNoticeSync(`${notice.space}|${notice.repo}`, () => handleWriteNotice(notice).then(() => { }));
+                return withCors(json({}, 200, acceptEncoding));
+            }
+            // POST /xrpc/com.atproto.space.notifySpaceDeleted — the authority saying a
+            // space is gone and every copy of it should go too.
+            if (url.pathname === '/xrpc/com.atproto.space.notifySpaceDeleted' && request.method === 'POST') {
+                const serviceId = spaceServiceId();
+                if (!serviceId)
+                    return withCors(jsonError(404, 'This instance receives no space notices', acceptEncoding));
+                const body = (await request.json().catch(() => null));
+                const space = typeof body?.space === 'string' ? body.space : null;
+                const ref = space ? parseSpaceRef(space) : null;
+                if (!space || !ref)
+                    return withCors(jsonError(400, 'Expected a space', acceptEncoding));
+                try {
+                    await verifyNotice(request.headers.get('authorization'), {
+                        iss: ref.authority,
+                        aud: serviceId,
+                        lxm: 'com.atproto.space.notifySpaceDeleted',
+                    });
+                }
+                catch (err) {
+                    if (err instanceof NoticeError)
+                        return withCors(jsonError(err.status, err.message, acceptEncoding));
+                    throw err;
+                }
+                await unwatchSpace(space);
+                return withCors(json({}, 200, acceptEncoding));
+            }
             if (url.pathname.startsWith('/xrpc/')) {
                 const method = url.pathname.slice('/xrpc/'.length);
                 const limit = parseInt(url.searchParams.get('limit') || '20');
                 const cursor = url.searchParams.get('cursor') || undefined;
-                const params = {};
-                for (const [key, value] of url.searchParams) {
-                    params[key] = value;
-                }
+                const params = paramsFromSearch(url.searchParams);
                 // Parse request body for POST (procedures)
                 let input;
                 if (request.method === 'POST') {
@@ -1252,6 +1331,16 @@ export function createHandler(config) {
                     throw err;
                 }
             }
+            // GET /space-blob?space=&repo=&cid= — a blob inside a permissioned space,
+            // fetched with the viewer's own credential. Unlike /blob/ below it is not
+            // dev-only and not cacheable: a space blob has no public URL by design,
+            // and this response belongs to one viewer.
+            if (url.pathname === '/space-blob') {
+                const parsed = parseSpaceBlobRequest(url.searchParams);
+                if (!parsed)
+                    return withCors(jsonError(400, 'Expected space, repo and cid', acceptEncoding));
+                return withCors(await serveSpaceBlob(oauth, viewer, parsed));
+            }
             // GET /blob/:did/:cid — dev-only image proxy (see blobUrl in xrpc.ts).
             // A PDS serves getBlob as an attachment with nosniff, which a browser
             // refuses to render in <img>; re-serving it from here drops that and

package/dist/spaces/blob.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Serving a blob that lives in a permissioned space.
+ *
+ * Every other image hatk hands out has a public URL — a CDN path, or the
+ * repo's own `com.atproto.sync.getBlob`. A space's blob has neither, by
+ * design: `com.atproto.space.getBlob` serves it only to a credential holder,
+ * and only for a space the blob is actually referenced from. Giving one a
+ * public URL would turn that URL into the capability the credential exists to
+ * replace.
+ *
+ * So the bytes come through here, fetched on the viewer's own behalf with the
+ * viewer's own credential, and go no further: `private, no-store` keeps them
+ * out of every shared cache between this server and that browser.
+ */
+import type { OAuthConfig } from '../config.ts';
+/**
+ * The URL this appview serves a space blob at, for whoever is asking.
+ *
+ * Built here rather than by the app, because the route is hatk's: a blob in a
+ * space has no public address by design, and this is the one address it does
+ * have — answered per viewer, with that viewer's credential, uncacheable.
+ */
+export declare function spaceBlobUrl(space: string, repo: string, cid: string): string;
+/**
+ * The CID a blob reference names, in whichever spelling the read used.
+ *
+ * A repo read gives the lexicon's `{ ref: { $link } }`; a space read comes
+ * back through a lex client that decodes the same field into a CID object
+ * whose `/` is the string. One blob, two spellings, and no caller should have
+ * to know which it got.
+ */
+export declare function blobCid(blob: unknown): string | undefined;
+export interface SpaceBlobRequest {
+    space: string;
+    /** The repo holding the blob — the writer's, not the authority's. */
+    repo: string;
+    cid: string;
+}
+export declare function parseSpaceBlobRequest(params: URLSearchParams): SpaceBlobRequest | null;
+/**
+ * Fetch a space blob as this viewer, or answer why not.
+ *
+ * A viewer who cannot read the space gets the same 404 as a blob that is not
+ * there. The distinction between "you may not" and "it does not exist" is
+ * itself information about a private space, and the space host draws the line
+ * the same way when it reports a non-member's repo as simply absent.
+ */
+export declare function serveSpaceBlob(oauth: OAuthConfig | null, viewer: {
+    did: string;
+} | null, request: SpaceBlobRequest): Promise<Response>;
+//# sourceMappingURL=blob.d.ts.map

package/dist/spaces/blob.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"blob.d.ts","sourceRoot":"","sources":["../../src/spaces/blob.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAe/C;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAG7E;AAED;;;;;;;GAOG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAMzD;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAA;IACb,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,eAAe,GAAG,gBAAgB,GAAG,IAAI,CAOtF;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,WAAW,GAAG,IAAI,EACzB,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAC9B,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,QAAQ,CAAC,CAsCnB"}

package/dist/spaces/blob.js

@@ -0,0 +1,111 @@
+/**
+ * Serving a blob that lives in a permissioned space.
+ *
+ * Every other image hatk hands out has a public URL — a CDN path, or the
+ * repo's own `com.atproto.sync.getBlob`. A space's blob has neither, by
+ * design: `com.atproto.space.getBlob` serves it only to a credential holder,
+ * and only for a space the blob is actually referenced from. Giving one a
+ * public URL would turn that URL into the capability the credential exists to
+ * replace.
+ *
+ * So the bytes come through here, fetched on the viewer's own behalf with the
+ * viewer's own credential, and go no further: `private, no-store` keeps them
+ * out of every shared cache between this server and that browser.
+ */
+import { emit } from "../logger.js";
+import { repoEndpoint } from "./identity.js";
+import { parseSpaceRef } from "./uri.js";
+import { viewerCredential } from "./viewer.js";
+/**
+ * What we are willing to hand back, whatever the repo claims it is.
+ *
+ * The record naming this blob was written by an account hatk does not control,
+ * and so was its mime type. Echoing that unchecked would let a writer choose
+ * what a browser executes in this origin.
+ */
+const SERVABLE = new Set(['image/jpeg', 'image/png', 'image/webp', 'image/avif', 'image/gif']);
+/**
+ * The URL this appview serves a space blob at, for whoever is asking.
+ *
+ * Built here rather than by the app, because the route is hatk's: a blob in a
+ * space has no public address by design, and this is the one address it does
+ * have — answered per viewer, with that viewer's credential, uncacheable.
+ */
+export function spaceBlobUrl(space, repo, cid) {
+    const params = new URLSearchParams({ space, repo, cid });
+    return `/space-blob?${params}`;
+}
+/**
+ * The CID a blob reference names, in whichever spelling the read used.
+ *
+ * A repo read gives the lexicon's `{ ref: { $link } }`; a space read comes
+ * back through a lex client that decodes the same field into a CID object
+ * whose `/` is the string. One blob, two spellings, and no caller should have
+ * to know which it got.
+ */
+export function blobCid(blob) {
+    const ref = blob?.ref;
+    if (!ref || typeof ref !== 'object')
+        return undefined;
+    if (typeof ref.$link === 'string')
+        return ref.$link;
+    if (typeof ref['/'] === 'string')
+        return ref['/'];
+    return undefined;
+}
+export function parseSpaceBlobRequest(params) {
+    const space = params.get('space');
+    const repo = params.get('repo') ?? params.get('did');
+    const cid = params.get('cid');
+    if (!space || !repo || !cid)
+        return null;
+    if (!parseSpaceRef(space) || !repo.startsWith('did:'))
+        return null;
+    return { space, repo, cid };
+}
+/**
+ * Fetch a space blob as this viewer, or answer why not.
+ *
+ * A viewer who cannot read the space gets the same 404 as a blob that is not
+ * there. The distinction between "you may not" and "it does not exist" is
+ * itself information about a private space, and the space host draws the line
+ * the same way when it reports a non-member's repo as simply absent.
+ */
+export async function serveSpaceBlob(oauth, viewer, request) {
+    if (!viewer)
+        return new Response('Unauthorized', { status: 401 });
+    const credential = await viewerCredential(oauth, viewer, request.space);
+    if (!credential)
+        return new Response('Not found', { status: 404 });
+    let upstream;
+    try {
+        const url = new URL(`${await repoEndpoint(request.repo)}/xrpc/com.atproto.space.getBlob`);
+        url.searchParams.set('space', request.space);
+        // `repo`, not `did`: a space read names the repo holding the record the
+        // same way everywhere. A server hosting one account falls back to it,
+        // which is what makes `did` ever appear to work.
+        url.searchParams.set('repo', request.repo);
+        url.searchParams.set('cid', request.cid);
+        upstream = await credential.fetch(url);
+    }
+    catch (err) {
+        emit('spaces', 'blob_error', { space: request.space, repo: request.repo, error: err.message });
+        return new Response('Blob unavailable', { status: 502 });
+    }
+    if (!upstream.ok)
+        return new Response('Not found', { status: upstream.status === 401 ? 404 : upstream.status });
+    const claimed = (upstream.headers.get('content-type') ?? '').split(';')[0].trim();
+    const contentType = SERVABLE.has(claimed) ? claimed : 'application/octet-stream';
+    return new Response(upstream.body, {
+        status: 200,
+        headers: {
+            'content-type': contentType,
+            // Not a public cache: this response is one viewer's, and the next
+            // request for the same URL may be somebody with no right to it.
+            'cache-control': 'private, no-store',
+            'content-disposition': 'inline',
+            'content-security-policy': "default-src 'none'; sandbox",
+            'x-content-type-options': 'nosniff',
+        },
+    });
+}

package/dist/spaces/credential.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Getting into a space to read it.
+ *
+ * hatk is not a member of anything. It has no DID that any community has
+ * admitted, and asking every authority to admit an indexer would make indexing
+ * a per-community act of trust before a single record could be read.
+ *
+ * So it reads as somebody who is already inside: a viewer whose OAuth session
+ * it already holds, whose PDS will mint a delegation token for the space, and
+ * whom the authority already lets in. The exchange is the same one the
+ * community's own web app makes from the browser —
+ *
+ *   the reader's PDS signs a delegation token   (60s, single-use, addressed to
+ *                                                the authority's space host)
+ *   the authority checks it, checks the reader against the space's policy, and
+ *   returns a credential bound to the key that signed our DPoP proof   (2h)
+ *
+ * — and the credential is then presented to every writer's host in the space.
+ * It carries no audience, which is why it must be bound to a key rather than
+ * held as a bearer token: a host handed a bearer credential to serve its own
+ * repo could replay it against every other host in the space.
+ *
+ * The consequence to be honest about: a space is only readable while somebody
+ * who can read it has a live session here. That is the same bound the data has
+ * anyway — nobody outside the space's audience was ever entitled to this — but
+ * it does mean indexing lapses when the last member logs out.
+ */
+import type { OAuthConfig } from '../config.ts';
+export declare class SpaceCredentialError extends Error {
+    readonly status: number;
+    readonly code: string;
+    constructor(status: number, code: string, message: string);
+}
+/** A refusal about who is asking, rather than about the space or the network. */
+export declare function isNotAuthorized(err: unknown): boolean;
+export declare function isSpaceGone(err: unknown): boolean;
+export interface SpaceCredential {
+    /** The space this credential reads, and the only one it is accepted for. */
+    space: string;
+    /** The account whose delegation bought it. */
+    readerDid: string;
+    expiresAt: number;
+    /** A fetch that presents the credential with a fresh DPoP proof per request. */
+    fetch: (input: string | URL, init?: RequestInit) => Promise<Response>;
+}
+/** Mint a credential for `space` using `readerDid`'s stored session. */
+export declare function mintSpaceCredential(oauthConfig: OAuthConfig, space: string, readerDid: string): Promise<SpaceCredential>;
+/**
+ * A credential for `space`, minted with whichever candidate session works.
+ *
+ * Candidates are tried in order and the first that succeeds is cached. A
+ * refusal about the reader — they were ejected, or never belonged — moves on to
+ * the next candidate; a refusal about the space itself stops the whole attempt,
+ * since no other reader would fare better.
+ */
+export declare function getSpaceCredential(oauthConfig: OAuthConfig, space: string, candidates: string[], opts?: {
+    refresh?: boolean;
+}): Promise<SpaceCredential>;
+export declare function forgetSpaceCredential(space: string): void;
+/** For tests: drop every cached credential and the process binding key. */
+export declare function resetSpaceCredentials(): void;
+//# sourceMappingURL=credential.d.ts.map

package/dist/spaces/credential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential.d.ts","sourceRoot":"","sources":["../../src/spaces/credential.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAsB/C,qBAAa,oBAAqB,SAAQ,KAAK;IAE3C,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM;gBADZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM;CAIlB;AAED,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAErD;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEjD;AAED,MAAM,WAAW,eAAe;IAC9B,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAA;IACb,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,gFAAgF;IAChF,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CACtE;AAiDD,wEAAwE;AACxE,wBAAsB,mBAAmB,CACvC,WAAW,EAAE,WAAW,EACxB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,eAAe,CAAC,CAiC1B;AAUD;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,WAAW,EACxB,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAAE,EACpB,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GAC/B,OAAO,CAAC,eAAe,CAAC,CAwB1B;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAEzD;AAED,2EAA2E;AAC3E,wBAAgB,qBAAqB,IAAI,IAAI,CAG5C"}