@hatk/hatk 0.0.1-alpha.9 → 0.0.1-alpha.92

package/dist/oauth/service-describe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-describe.d.ts","sourceRoot":"","sources":["../../src/oauth/service-describe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAkD/C;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,GAAE,MAAM,EAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CA+B1G;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,UAAU,EAAE,OAAO,GAClB,OAAO,CAAC,MAAM,CAAC,CAajB;AAED,+CAA+C;AAC/C,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC"}

package/dist/oauth/service-describe.js

@@ -0,0 +1,108 @@
+import { emit } from "../logger.js";
+const DESCRIBE_NSID = 'community.lexicon.service.describe';
+const PROBE_TIMEOUT_MS = 5000;
+const CACHE_TTL_MS = 60 * 60 * 1000;
+/** Answers are a property of the server, so one entry covers every account on it. */
+const cache = new Map();
+/** An NSID no server routes, for learning how one says "no such method". */
+const CONTROL_NSID = 'dev.hatk.unspecced.methodThatDoesNotExist';
+/** How a server answered, as a comparable string: status and error code. */
+async function signature(pdsEndpoint, nsid) {
+    try {
+        const res = await fetch(`${pdsEndpoint.replace(/\/$/, '')}/xrpc/${nsid}`, {
+            headers: { accept: 'application/json' },
+            signal: AbortSignal.timeout(PROBE_TIMEOUT_MS),
+        });
+        const body = (await res.json().catch(() => null));
+        return `${res.status}:${body?.error ?? ''}`;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Which of `candidates` this server appears to route, judged against how it
+ * answers for a method that does not exist.
+ *
+ * Conservative by construction. A server that answers identically either way —
+ * bsky.social returns `401 AuthMissing` for both — yields nothing, so a feature
+ * it does not have is never claimed. The cost is failing to see support that
+ * cannot be distinguished, which is where this started anyway.
+ */
+async function probeMethods(pdsEndpoint, candidates) {
+    const control = await signature(pdsEndpoint, CONTROL_NSID);
+    // Unreachable is not evidence about the server, so claim nothing.
+    if (control === null)
+        return new Set();
+    const answers = await Promise.all(candidates.map((n) => signature(pdsEndpoint, n)));
+    const found = new Set();
+    candidates.forEach((nsid, i) => {
+        const a = answers[i];
+        if (a !== null && a !== control)
+            found.add(nsid);
+    });
+    return found;
+}
+/**
+ * Every XRPC method a PDS serves, as far as it can be established.
+ *
+ * `candidates` are the methods the caller needs an answer about. They are only
+ * used when describe says nothing — an explicit list is always preferred to
+ * inference, and a server that answers describe is taken at its word.
+ */
+export async function describeMethods(pdsEndpoint, candidates = []) {
+    const cached = cache.get(pdsEndpoint);
+    if (cached && cached.expires > Date.now())
+        return cached.methods;
+    let methods = new Set();
+    try {
+        const res = await fetch(`${pdsEndpoint.replace(/\/$/, '')}/xrpc/${DESCRIBE_NSID}`, {
+            headers: { accept: 'application/json' },
+            signal: AbortSignal.timeout(PROBE_TIMEOUT_MS),
+        });
+        if (res.ok) {
+            const body = (await res.json().catch(() => null));
+            if (Array.isArray(body?.methods)) {
+                for (const m of body.methods) {
+                    if (typeof m?.value === 'string')
+                        methods.add(m.value);
+                }
+            }
+        }
+    }
+    catch {
+        methods = new Set();
+    }
+    // No describe, or one that listed nothing: fall back to asking about the
+    // methods this caller actually needs. Only those — a probe per method is a
+    // request per method, and the conditional sets name two.
+    if (methods.size === 0 && candidates.length > 0) {
+        methods = await probeMethods(pdsEndpoint, candidates);
+    }
+    cache.set(pdsEndpoint, { methods, expires: Date.now() + CACHE_TTL_MS });
+    return methods;
+}
+/**
+ * The scope string to request from this PDS: `base`, plus any conditional set
+ * whose `whenMethod` the server serves.
+ *
+ * Loopback clients are left alone. Their client_id encodes the scope they may
+ * request, and the token exchange rebuilds that client_id from config — vary
+ * the request and the two disagree. A local setup that needs the extra scopes
+ * lists them in its client's own `scope` instead.
+ */
+export async function negotiateScope(config, base, pdsEndpoint, isLoopback) {
+    const conditional = config.conditionalScopes ?? [];
+    if (conditional.length === 0 || !pdsEndpoint || isLoopback)
+        return base;
+    const methods = await describeMethods(pdsEndpoint, conditional.map((c) => c.whenMethod));
+    const granted = conditional.filter((c) => methods.has(c.whenMethod)).flatMap((c) => c.scopes);
+    if (granted.length === 0)
+        return base;
+    emit('oauth', 'conditional_scopes', { pds: pdsEndpoint, scopes: granted });
+    return [base, ...granted].join(' ');
+}
+/** Drop cached describe answers. For tests. */
+export function clearDescribeCache() {
+    cache.clear();
+}

package/dist/oauth/session.d.ts

@@ -0,0 +1,32 @@
+export type SessionData = {
+    did: string;
+    handle: string;
+};
+export declare function getSessionCookieName(): string;
+/**
+ * Companion cookie listing every account this browser has signed in as.
+ *
+ * The session cookie names the *active* account; this one is the set the
+ * browser is entitled to switch between without going back to the PDS. It's
+ * encrypted with the same key, so a client can't add a DID to it and assume
+ * that identity — which is the whole security gate on `/auth/switch`.
+ */
+export declare function getAccountsCookieName(): string;
+export declare function initSession(privateJwk: JsonWebKey, cookieName?: string): void;
+export declare function createSessionCookie(data: SessionData): Promise<string>;
+export declare function sessionCookieHeader(value: string, secure: boolean): string;
+export declare function clearSessionCookieHeader(): string;
+export declare function parseSessionCookie(request: Request): Promise<SessionData | null>;
+export declare function createAccountsCookie(accounts: SessionData[]): Promise<string>;
+export declare function accountsCookieHeader(value: string, secure: boolean): string;
+export declare function clearAccountsCookieHeader(): string;
+/** Every account this browser has signed in as, oldest first. */
+export declare function parseAccountsCookie(request: Request): Promise<SessionData[]>;
+/**
+ * Add (or refresh) an account in the browser's list. Existing entries keep
+ * their position so the switcher doesn't reshuffle; a re-login just updates
+ * the handle.
+ */
+export declare function withAccount(accounts: SessionData[], account: SessionData): SessionData[];
+export declare function withoutAccount(accounts: SessionData[], did: string): SessionData[];
+//# sourceMappingURL=session.d.ts.map

package/dist/oauth/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/oauth/session.ts"],"names":[],"mappings":"AAYA,MAAM,MAAM,WAAW,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAEzD,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C;AAED,wBAAgB,WAAW,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAG7E;AAoDD,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAE5E;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,MAAM,CAE1E;AAED,wBAAgB,wBAAwB,IAAI,MAAM,CAEjD;AAED,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAOtF;AAID,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAEnF;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,MAAM,CAE3E;AAED,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAED,iEAAiE;AACjE,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAUlF;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,WAAW,GAAG,WAAW,EAAE,CAMxF;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,WAAW,EAAE,CAElF"}

package/dist/oauth/session.js

@@ -0,0 +1,131 @@
+// SSR session cookie — AES-GCM encrypted HttpOnly cookie for server-side viewer resolution.
+// Separate from OAuth protocol flows but uses the same server keypair for key derivation.
+import { base64UrlEncode, base64UrlDecode } from "./crypto.js";
+let _privateJwk;
+let _cookieName = '__hatk_session';
+const MAX_AGE = 30 * 24 * 60 * 60; // 30 days in seconds
+/** Most accounts one browser can keep signed in at once. */
+const MAX_ACCOUNTS = 10;
+export function getSessionCookieName() {
+    return _cookieName;
+}
+/**
+ * Companion cookie listing every account this browser has signed in as.
+ *
+ * The session cookie names the *active* account; this one is the set the
+ * browser is entitled to switch between without going back to the PDS. It's
+ * encrypted with the same key, so a client can't add a DID to it and assume
+ * that identity — which is the whole security gate on `/auth/switch`.
+ */
+export function getAccountsCookieName() {
+    return `${_cookieName}_accounts`;
+}
+export function initSession(privateJwk, cookieName) {
+    _privateJwk = privateJwk;
+    if (cookieName)
+        _cookieName = cookieName;
+}
+async function aesKey() {
+    const raw = new TextEncoder().encode(JSON.stringify(_privateJwk, Object.keys(_privateJwk).sort()));
+    const keyMaterial = await crypto.subtle.importKey('raw', raw, 'HKDF', false, ['deriveKey']);
+    return crypto.subtle.deriveKey({ name: 'HKDF', hash: 'SHA-256', salt: new Uint8Array(0), info: new TextEncoder().encode('hatk-session-cookie') }, keyMaterial, { name: 'AES-GCM', length: 256 }, false, ['encrypt', 'decrypt']);
+}
+async function encrypt(payload) {
+    const iv = crypto.getRandomValues(new Uint8Array(12));
+    const key = await aesKey();
+    const plaintext = new TextEncoder().encode(JSON.stringify(payload));
+    const ciphertext = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, key, plaintext);
+    return `${base64UrlEncode(iv)}.${base64UrlEncode(new Uint8Array(ciphertext))}`;
+}
+async function decrypt(value) {
+    const parts = value.split('.');
+    if (parts.length !== 2)
+        return null;
+    try {
+        const iv = base64UrlDecode(parts[0]);
+        const ciphertext = base64UrlDecode(parts[1]);
+        const key = await aesKey();
+        const plaintext = await crypto.subtle.decrypt({ name: 'AES-GCM', iv }, key, ciphertext);
+        return JSON.parse(new TextDecoder().decode(plaintext));
+    }
+    catch {
+        return null;
+    }
+}
+function readCookie(request, name) {
+    const cookieHeader = request.headers.get('cookie');
+    if (!cookieHeader)
+        return null;
+    const match = cookieHeader
+        .split(';')
+        .map((c) => c.trim())
+        .find((c) => c.startsWith(`${name}=`));
+    return match ? match.slice(name.length + 1) : null;
+}
+function cookieHeader(name, value, secure) {
+    const parts = [`${name}=${value}`, 'HttpOnly', 'SameSite=Lax', 'Path=/', `Max-Age=${MAX_AGE}`];
+    if (secure)
+        parts.push('Secure');
+    return parts.join('; ');
+}
+export async function createSessionCookie(data) {
+    return encrypt({ ...data, ts: Math.floor(Date.now() / 1000) });
+}
+export function sessionCookieHeader(value, secure) {
+    return cookieHeader(_cookieName, value, secure);
+}
+export function clearSessionCookieHeader() {
+    return `${_cookieName}=; HttpOnly; SameSite=Lax; Path=/; Max-Age=0`;
+}
+export async function parseSessionCookie(request) {
+    const value = readCookie(request, _cookieName);
+    if (!value)
+        return null;
+    const data = await decrypt(value);
+    if (!data?.did || !data.handle || !data.ts)
+        return null;
+    if (Date.now() / 1000 - data.ts > MAX_AGE)
+        return null;
+    return { did: data.did, handle: data.handle };
+}
+// --- Accounts cookie ---
+export async function createAccountsCookie(accounts) {
+    return encrypt({ accounts: accounts.slice(-MAX_ACCOUNTS), ts: Math.floor(Date.now() / 1000) });
+}
+export function accountsCookieHeader(value, secure) {
+    return cookieHeader(getAccountsCookieName(), value, secure);
+}
+export function clearAccountsCookieHeader() {
+    return `${getAccountsCookieName()}=; HttpOnly; SameSite=Lax; Path=/; Max-Age=0`;
+}
+/** Every account this browser has signed in as, oldest first. */
+export async function parseAccountsCookie(request) {
+    const value = readCookie(request, getAccountsCookieName());
+    if (!value)
+        return [];
+    const data = await decrypt(value);
+    if (!data?.ts || !Array.isArray(data.accounts))
+        return [];
+    if (Date.now() / 1000 - data.ts > MAX_AGE)
+        return [];
+    return data.accounts.filter((a) => {
+        const account = a;
+        return !!account && typeof account.did === 'string' && typeof account.handle === 'string';
+    });
+}
+/**
+ * Add (or refresh) an account in the browser's list. Existing entries keep
+ * their position so the switcher doesn't reshuffle; a re-login just updates
+ * the handle.
+ */
+export function withAccount(accounts, account) {
+    const index = accounts.findIndex((a) => a.did === account.did);
+    if (index === -1)
+        return [...accounts, account];
+    const next = [...accounts];
+    next[index] = account;
+    return next;
+}
+export function withoutAccount(accounts, did) {
+    return accounts.filter((a) => a.did !== did);
+}

package/dist/opengraph.d.ts

@@ -28,7 +28,17 @@ export interface OpengraphResult {
         description?: string;
     };
 }
+export declare function defineOG(path: string, generate: (ctx: OpengraphContext) => Promise<OpengraphResult>): {
+    __type: "og";
+    path: string;
+    generate: (ctx: OpengraphContext) => Promise<OpengraphResult>;
+};
 export declare function initOpengraph(ogDir: string): Promise<void>;
+/** Register a single OG handler from a scanned server/ module. */
+export declare function registerOgHandler(ogMod: {
+    path: string;
+    generate: (ctx: OpengraphContext) => Promise<OpengraphResult>;
+}): void;
 export declare function handleOpengraphRequest(pathname: string): Promise<Buffer | null>;
 export declare function buildOgMeta(pathname: string, origin: string): string | null;
 //# sourceMappingURL=opengraph.d.ts.map

package/dist/opengraph.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"opengraph.d.ts","sourceRoot":"","sources":["../src/opengraph.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAE5C,4CAA4C;AAC5C,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAC3B,QAAQ,CAAC,EAAE,CAAC,UAAU,GAAG,MAAM,CAAC,EAAE,GAAG,MAAM,CAAA;QAC3C,GAAG,CAAC,EAAE,MAAM,CAAA;QACZ,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KACnB,CAAA;CACF;AAED,uDAAuD;AACvD,MAAM,WAAW,gBAAiB,SAAQ,WAAW;IACnD,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;CACpD;AAED,qDAAqD;AACrD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,UAAU,CAAA;IACnB,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAA;KAAE,CAAA;IAC5D,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAChD;AAkCD,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAoGhE;AAED,wBAAsB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA8BrF;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAyC3E"}
+{"version":3,"file":"opengraph.d.ts","sourceRoot":"","sources":["../src/opengraph.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAE5C,4CAA4C;AAC5C,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAC3B,QAAQ,CAAC,EAAE,CAAC,UAAU,GAAG,MAAM,CAAC,EAAE,GAAG,MAAM,CAAA;QAC3C,GAAG,CAAC,EAAE,MAAM,CAAA;QACZ,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KACnB,CAAA;CACF;AAED,uDAAuD;AACvD,MAAM,WAAW,gBAAiB,SAAQ,WAAW;IACnD,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;CACpD;AAED,qDAAqD;AACrD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,UAAU,CAAA;IACnB,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAA;KAAE,CAAA;IAC5D,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAChD;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,OAAO,CAAC,eAAe,CAAC;;;oBAA7C,gBAAgB,KAAK,OAAO,CAAC,eAAe,CAAC;EAEnG;AAiDD,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAyEhE;AAED,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,OAAO,CAAC,eAAe,CAAC,CAAA;CAC9D,GAAG,IAAI,CAqDP;AAED,wBAAsB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA+BrF;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAyC3E"}

package/dist/opengraph.js

@@ -9,17 +9,43 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
 import { resolve } from 'node:path';
 import { readFileSync, readdirSync } from 'node:fs';
 import { log } from "./logger.js";
-import satori from 'satori';
-import { Resvg } from '@resvg/resvg-js';
-import { querySQL, runSQL, packCursor, unpackCursor, isTakendownDid, filterTakendownDids, searchRecords, findUriByFields, lookupByFieldBatch, countByFieldBatch, queryLabelsForUris, } from "./db.js";
-import { resolveRecords } from "./hydrate.js";
-import { blobUrl } from "./xrpc.js";
+// Lazy-imported to avoid CJS require() issues in Vite's module runner
+let _satori = null;
+let _Resvg = null;
+async function getSatori() {
+    if (!_satori)
+        _satori = (await import('satori')).default;
+    return _satori;
+}
+async function getResvg() {
+    if (!_Resvg)
+        _Resvg = (await import('@resvg/resvg-js')).Resvg;
+    return _Resvg;
+}
+import { buildXrpcContext } from "./xrpc.js";
+export function defineOG(path, generate) {
+    return { __type: 'og', path, generate };
+}
 const handlers = [];
 const pageRoutes = [];
 let defaultFont = null;
 const cache = new Map();
 const CACHE_TTL = 5 * 60 * 1000;
 const CACHE_MAX = 200;
+/**
+ * Read a font file as an ArrayBuffer holding *only* that font's bytes.
+ *
+ * `readFileSync` returns a Buffer that, for small files, is a view into Node's
+ * shared 64 KB allocation pool — so `buffer.buffer` is the whole pool, not the
+ * font, and the font generally starts at a nonzero `byteOffset`. Handing that
+ * to satori makes it read whatever happened to be pooled before the font and
+ * reject the result with "Unsupported OpenType signature". Slice out the
+ * view's own range instead.
+ */
+function readFontData(fontPath) {
+    const fontData = readFileSync(fontPath);
+    return fontData.buffer.slice(fontData.byteOffset, fontData.byteOffset + fontData.byteLength);
+}
 function compilePath(path) {
     const paramNames = [];
     const re = path.replace(/:([^/]+)/g, (_, name) => {
@@ -32,8 +58,7 @@ export async function initOpengraph(ogDir) {
     // Load default font
     try {
         const fontPath = resolve(import.meta.dirname, '..', 'fonts', 'Inter-Regular.woff');
-        const fontData = readFileSync(fontPath);
-        defaultFont = { name: 'Inter', data: fontData.buffer, weight: 400, style: 'normal' };
+        defaultFont = { name: 'Inter', data: readFontData(fontPath), weight: 400, style: 'normal' };
         log('[opengraph] loaded default font: Inter');
     }
     catch {
@@ -51,7 +76,7 @@ export async function initOpengraph(ogDir) {
     for (const file of files) {
         const name = file.replace(/\.(ts|js)$/, '');
         const scriptPath = resolve(ogDir, file);
-        const mod = await import(__rewriteRelativeImportExtension(scriptPath));
+        const mod = await import(__rewriteRelativeImportExtension(/* @vite-ignore */ `${scriptPath}?t=${Date.now()}`));
         const handler = mod.default;
         if (!handler.path) {
             console.warn(`[opengraph] ${file} missing 'path' export, skipping`);
@@ -64,38 +89,10 @@ export async function initOpengraph(ogDir) {
             pattern,
             paramNames,
             execute: async (params) => {
-                const ctx = {
-                    db: { query: querySQL, run: runSQL },
-                    params,
-                    input: {},
-                    limit: 1,
-                    viewer: null,
-                    packCursor,
-                    unpackCursor,
-                    isTakendown: isTakendownDid,
-                    filterTakendownDids,
-                    search: searchRecords,
-                    resolve: resolveRecords,
-                    lookup: async (collection, field, values) => {
-                        if (values.length === 0)
-                            return new Map();
-                        const unique = [...new Set(values.filter(Boolean))];
-                        return lookupByFieldBatch(collection, field, unique);
-                    },
-                    count: async (collection, field, values) => {
-                        if (values.length === 0)
-                            return new Map();
-                        const unique = [...new Set(values.filter(Boolean))];
-                        return countByFieldBatch(collection, field, unique);
-                    },
-                    exists: async (collection, filters) => {
-                        const conditions = Object.entries(filters).map(([field, value]) => ({ field, value }));
-                        const uri = await findUriByFields(collection, conditions);
-                        return uri !== null;
-                    },
-                    labels: queryLabelsForUris,
-                    blobUrl,
-                };
+                const ctx = buildXrpcContext(params, undefined, 1, null);
+                // Override blobUrl to use _og presets (jpeg) — satori doesn't support webp
+                const origBlobUrl = ctx.blobUrl;
+                ctx.blobUrl = (did, ref, preset = 'avatar') => origBlobUrl(did, ref, `${preset}_og`);
                 ctx.fetchImage = async (url) => {
                     try {
                         const resp = await fetch(url, { redirect: 'follow' });
@@ -117,7 +114,7 @@ export async function initOpengraph(ogDir) {
                     ...result.options,
                     fonts: [...(defaultFont ? [defaultFont] : []), ...(result.options?.fonts || [])],
                 };
-                const svg = await satori(element, options);
+                const svg = await (await getSatori())(element, options);
                 return { svg, meta: result.meta };
             },
         });
@@ -129,6 +126,60 @@ export async function initOpengraph(ogDir) {
         }
     }
 }
+/** Register a single OG handler from a scanned server/ module. */
+export function registerOgHandler(ogMod) {
+    const { pattern, paramNames } = compilePath(ogMod.path);
+    const name = ogMod.path.replace(/^\//, '').replace(/\//g, '-').replace(/:/g, '');
+    // Load default font if not already loaded
+    if (!defaultFont) {
+        try {
+            const fontPath = resolve(import.meta.dirname, '..', 'fonts', 'Inter-Regular.woff');
+            defaultFont = { name: 'Inter', data: readFontData(fontPath), weight: 400, style: 'normal' };
+        }
+        catch { }
+    }
+    handlers.push({
+        name,
+        path: ogMod.path,
+        pattern,
+        paramNames,
+        execute: async (params) => {
+            const ctx = buildXrpcContext(params, undefined, 1, null);
+            // Override blobUrl to use _og presets (jpeg) — satori doesn't support webp
+            const origBlobUrl = ctx.blobUrl;
+            ctx.blobUrl = (did, ref, preset = 'avatar') => origBlobUrl(did, ref, `${preset}_og`);
+            ctx.fetchImage = async (url) => {
+                try {
+                    const resp = await fetch(url, { redirect: 'follow' });
+                    if (!resp.ok)
+                        return null;
+                    const buf = Buffer.from(await resp.arrayBuffer());
+                    const contentType = resp.headers.get('content-type') || 'image/jpeg';
+                    return `data:${contentType};base64,${buf.toString('base64')}`;
+                }
+                catch {
+                    return null;
+                }
+            };
+            const result = await ogMod.generate(ctx);
+            const element = result.element;
+            const options = {
+                width: 1200,
+                height: 630,
+                ...result.options,
+                fonts: [...(defaultFont ? [defaultFont] : []), ...(result.options?.fonts || [])],
+            };
+            const svg = await (await getSatori())(element, options);
+            return { svg, meta: result.meta };
+        },
+    });
+    const pagePath = ogMod.path.replace(/^\/og/, '');
+    if (pagePath !== ogMod.path) {
+        const compiled = compilePath(pagePath);
+        pageRoutes.push({ ogPath: ogMod.path, pattern: compiled.pattern, paramNames: compiled.paramNames, name });
+    }
+    log(`[opengraph] registered: ${name} → ${ogMod.path}`);
+}
 export async function handleOpengraphRequest(pathname) {
     const cached = cache.get(pathname);
     if (cached && cached.expires > Date.now())
@@ -143,6 +194,7 @@ export async function handleOpengraphRequest(pathname) {
         });
         try {
             const { svg, meta } = await handler.execute(params);
+            const Resvg = await getResvg();
             const png = new Resvg(svg, { fitTo: { mode: 'width', value: 1200 } }).render().asPng();
             if (cache.size >= CACHE_MAX) {
                 const oldest = cache.keys().next().value;
@@ -153,7 +205,7 @@ export async function handleOpengraphRequest(pathname) {
             return png;
         }
         catch (err) {
-            console.error(`[opengraph] error in ${handler.name}:`, err.message);
+            console.error(`[opengraph] error in ${handler.name}:`, err.message, err.stack);
             return null;
         }
     }

package/dist/pds-proxy.d.ts

@@ -0,0 +1,82 @@
+import type { OAuthConfig } from './config.ts';
+export declare class ProxyError extends Error {
+    status: number;
+    constructor(status: number, message: string);
+}
+export declare class ScopeMissingProxyError extends ProxyError {
+    constructor();
+}
+export interface PdsXrpcOptions {
+    /** Defaults to GET, matching the XRPC convention for queries. */
+    method?: 'GET' | 'POST';
+    /** Query parameters. Undefined values are dropped; arrays repeat the key. */
+    params?: Record<string, string | number | boolean | string[] | undefined>;
+    /** JSON request body. Ignored for GET. */
+    body?: unknown;
+}
+/**
+ * Call any XRPC method on the user's PDS with their session.
+ *
+ * The escape hatch beside the typed record helpers above, for methods hatk has
+ * no opinion about — `com.atproto.space.*` and the rest of proposal 0016 being
+ * the case it was added for. Nothing is validated or indexed: the response is
+ * whatever the PDS sent, and it is the caller's job to know its shape.
+ *
+ * The session's granted scopes still apply. A method the user never authorized
+ * comes back as a 403 from the PDS, not from here.
+ */
+export declare function pdsXrpc(oauthConfig: OAuthConfig, viewer: {
+    did: string;
+}, nsid: string, options?: PdsXrpcOptions): Promise<Record<string, unknown>>;
+export declare function pdsCreateRecord(oauthConfig: OAuthConfig, viewer: {
+    did: string;
+}, input: {
+    collection: string;
+    repo?: string;
+    rkey?: string;
+    record: Record<string, unknown>;
+}): Promise<{
+    uri?: string;
+    cid?: string;
+}>;
+export declare function pdsDeleteRecord(oauthConfig: OAuthConfig, viewer: {
+    did: string;
+}, input: {
+    collection: string;
+    rkey: string;
+}): Promise<Record<string, unknown>>;
+export declare function pdsPutRecord(oauthConfig: OAuthConfig, viewer: {
+    did: string;
+}, input: {
+    collection: string;
+    rkey: string;
+    record: Record<string, unknown>;
+    repo?: string;
+}): Promise<{
+    uri?: string;
+    cid?: string;
+}>;
+export interface ApplyWritesOp {
+    $type: string;
+    collection: string;
+    rkey?: string;
+    value?: Record<string, unknown>;
+}
+export interface ApplyWritesResult {
+    $type: string;
+    uri?: string;
+    cid?: string;
+}
+export declare function pdsApplyWrites(oauthConfig: OAuthConfig, viewer: {
+    did: string;
+}, input: {
+    writes: ApplyWritesOp[];
+}): Promise<{
+    results?: ApplyWritesResult[];
+}>;
+export declare function pdsUploadBlob(oauthConfig: OAuthConfig, viewer: {
+    did: string;
+}, body: Uint8Array, contentType: string): Promise<{
+    blob: unknown;
+}>;
+//# sourceMappingURL=pds-proxy.d.ts.map

package/dist/pds-proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pds-proxy.d.ts","sourceRoot":"","sources":["../src/pds-proxy.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAU9C,qBAAa,UAAW,SAAQ,KAAK;IAE1B,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM;CAIlB;AAED,qBAAa,sBAAuB,SAAQ,UAAU;;CAIrD;AAuKD,MAAM,WAAW,cAAc;IAC7B,iEAAiE;IACjE,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;IACvB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAA;IACzE,0CAA0C;IAC1C,IAAI,CAAC,EAAE,OAAO,CAAA;CACf;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,OAAO,CAC3B,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACvB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAoBlC;AAED,wBAAsB,eAAe,CACnC,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACvB,KAAK,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAC3F,OAAO,CAAC;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAwCzC;AAED,wBAAsB,eAAe,CACnC,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACvB,KAAK,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC1C,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAyBlC;AAED,wBAAsB,YAAY,CAChC,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACvB,KAAK,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1F,OAAO,CAAC;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAqCzC;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAChC;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAYD,wBAAsB,cAAc,CAClC,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACvB,KAAK,EAAE;IAAE,MAAM,EAAE,aAAa,EAAE,CAAA;CAAE,GACjC,OAAO,CAAC;IAAE,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAA;CAAE,CAAC,CAgE5C;AAED,wBAAsB,aAAa,CACjC,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,EACvB,IAAI,EAAE,UAAU,EAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,CAS5B"}