@hatk/hatk 0.0.1-alpha.87 → 0.0.1-alpha.88

package/dist/oauth/discovery.d.ts

@@ -18,5 +18,15 @@ export declare function discoverAuthServer(did: string, plcUrl: string): Promise
     authServerEndpoint: string;
     authServerMetadata: AuthServerMetadata;
 }>;
+/**
+ * A handle to its DID.
+ *
+ * The protocol defines two ways, and both are asked first: the DNS TXT record
+ * and the well-known document. Either answers for a handle on any PDS, which
+ * is what lets somebody from another host sign in here. A handle neither
+ * method knows — a dev network's `.test` names, which have no DNS and no TLS
+ * — falls back to asking a PDS: the local one in dev, the one behind a
+ * self-hosted relay, or bsky.social.
+ */
 export declare function resolveHandle(handle: string, relayUrl?: string): Promise<string>;
 //# sourceMappingURL=discovery.d.ts.map

package/dist/oauth/discovery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../src/oauth/discovery.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAA;IACd,sBAAsB,EAAE,MAAM,CAAA;IAC9B,cAAc,EAAE,MAAM,CAAA;IACtB,qCAAqC,CAAC,EAAE,MAAM,CAAA;IAC9C,QAAQ,EAAE,MAAM,CAAA;IAChB,iCAAiC,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,wBAAsB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAU1E;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,GAAG,GAAG,MAAM,GAAG,IAAI,CAGzD;AAED,wBAAsB,8BAA8B,CAClD,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;IAAE,qBAAqB,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAI9C;AAED,wBAAsB,uBAAuB,CAAC,kBAAkB,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAIrG;AAED,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IACT,WAAW,EAAE,MAAM,CAAA;IACnB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,kBAAkB,EAAE,kBAAkB,CAAA;CACvC,CAAC,CAWD;AAED,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBtF"}
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../src/oauth/discovery.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAA;IACd,sBAAsB,EAAE,MAAM,CAAA;IAC9B,cAAc,EAAE,MAAM,CAAA;IACtB,qCAAqC,CAAC,EAAE,MAAM,CAAA;IAC9C,QAAQ,EAAE,MAAM,CAAA;IAChB,iCAAiC,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,wBAAsB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAU1E;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,GAAG,GAAG,MAAM,GAAG,IAAI,CAGzD;AAED,wBAAsB,8BAA8B,CAClD,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;IAAE,qBAAqB,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAI9C;AAED,wBAAsB,uBAAuB,CAAC,kBAAkB,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAIrG;AAED,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IACT,WAAW,EAAE,MAAM,CAAA;IACnB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,kBAAkB,EAAE,kBAAkB,CAAA;CACvC,CAAC,CAWD;AA+BD;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBtF"}

package/dist/oauth/discovery.js

@@ -1,4 +1,4 @@
-// packages/hatk/src/oauth/discovery.ts
+import { resolveTxt } from 'node:dns/promises';
 export async function resolveDid(did, plcUrl) {
     if (did.startsWith('did:web:')) {
         const domain = did.slice('did:web:'.length);
@@ -40,10 +40,50 @@ export async function discoverAuthServer(did, plcUrl) {
     const authServerMetadata = await fetchAuthServerMetadata(authServerEndpoint);
     return { pdsEndpoint, authServerEndpoint, authServerMetadata };
 }
+const HANDLE_RESOLVE_TIMEOUT_MS = 5000;
+/** The DNS method: a `_atproto.<handle>` TXT record carrying `did=...`. */
+async function resolveHandleViaDns(handle) {
+    try {
+        for (const chunks of await resolveTxt(`_atproto.${handle}`)) {
+            const txt = chunks.join('');
+            if (txt.startsWith('did='))
+                return txt.slice('did='.length).trim();
+        }
+    }
+    catch {
+        // No record, or not a resolvable name: not this method.
+    }
+    return null;
+}
+/** The HTTPS method: `https://<handle>/.well-known/atproto-did`, the DID as plain text. */
+async function resolveHandleViaWellKnown(handle) {
+    try {
+        const res = await fetch(`https://${handle}/.well-known/atproto-did`, {
+            signal: AbortSignal.timeout(HANDLE_RESOLVE_TIMEOUT_MS),
+        });
+        if (!res.ok)
+            return null;
+        const did = (await res.text()).trim().split('\n')[0].trim();
+        return did.startsWith('did:') ? did : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * A handle to its DID.
+ *
+ * The protocol defines two ways, and both are asked first: the DNS TXT record
+ * and the well-known document. Either answers for a handle on any PDS, which
+ * is what lets somebody from another host sign in here. A handle neither
+ * method knows — a dev network's `.test` names, which have no DNS and no TLS
+ * — falls back to asking a PDS: the local one in dev, the one behind a
+ * self-hosted relay, or bsky.social.
+ */
 export async function resolveHandle(handle, relayUrl) {
-    // Resolve against the configured network: the localhost PDS in dev, the public
-    // AppView in prod, or a self-hosted PDS (e.g. preview environments) derived
-    // from its relay/firehose URL — otherwise self-hosted handles 400 against bsky.
+    const direct = (await resolveHandleViaDns(handle)) ?? (await resolveHandleViaWellKnown(handle));
+    if (direct)
+        return direct;
     let baseUrl;
     if (relayUrl?.includes('localhost:2583')) {
         baseUrl = 'http://localhost:2583';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hatk/hatk",
-  "version": "0.0.1-alpha.87",
+  "version": "0.0.1-alpha.88",
   "license": "MIT",
   "bin": {
     "hatk": "dist/cli.js"