@hatk/hatk 0.0.1-alpha.94 → 0.0.1-alpha.96

package/dist/hydrate.d.ts

@@ -1,3 +1,4 @@
+import { type SpaceBlobPreset } from './spaces/blob.ts';
 import type { Row } from './lex-types.ts';
 export type { Row };
 export interface BaseContext {
@@ -53,8 +54,13 @@ export interface BaseContext {
     records: <R = unknown>(collection: string, field: string, values: string[]) => Promise<Row<R>[]>;
     /** Throw `NotAuthorized` unless the viewer may read this space. */
     requireSpace: (space: string) => void;
-    /** The URL this appview serves a space blob at, for the viewer asking. */
-    spaceBlobUrl: (space: string, repo: string, cid: string) => string;
+    /**
+     * The URL this appview serves a space blob at, for the viewer asking.
+     *
+     * The preset names the size it is drawn at, from the same list the public
+     * path uses. Left out, the original comes back.
+     */
+    spaceBlobUrl: (space: string, repo: string, cid: string, preset?: SpaceBlobPreset) => string;
 }
 /** Fetch records for URIs, reshape them, and filter out taken-down DIDs. */
 export declare function resolveRecords(uris: string[]): Promise<Row<unknown>[]>;

package/dist/hydrate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hydrate.d.ts","sourceRoot":"","sources":["../src/hydrate.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAA;AAEzC,YAAY,EAAE,GAAG,EAAE,CAAA;AAInB,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;IAC/C,EAAE,EAAE;QACF,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;QAC9D;;;;WAIG;QACH,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;KACpE,CAAA;IACD,UAAU,EAAE,CAAC,CAAC,GAAG,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC7F,MAAM,EAAE,CAAC,CAAC,GAAG,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1G,KAAK,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAC5F,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAA;IAC3D,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAA;IAC3E;;;;;;;;;;;;;;;;;;;OAmBG;IACH,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IACpG;;;OAGG;IACH,YAAY,EAAE,CAAC,CAAC,GAAG,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IACnF,6FAA6F;IAC7F,OAAO,EAAE,CAAC,CAAC,GAAG,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAChG,mEAAmE;IACnE,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAA;IACrC,0EAA0E;IAC1E,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,MAAM,CAAA;CACnE;AAID,4EAA4E;AAC5E,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAsC5E;AAID,yCAAyC;AACzC,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,GAAG,WAAW,CAuB7F"}
+{"version":3,"file":"hydrate.d.ts","sourceRoot":"","sources":["../src/hydrate.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,KAAK,eAAe,EAAgB,MAAM,kBAAkB,CAAA;AACrE,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAA;AAEzC,YAAY,EAAE,GAAG,EAAE,CAAA;AAInB,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;IAC/C,EAAE,EAAE;QACF,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;QAC9D;;;;WAIG;QACH,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;KACpE,CAAA;IACD,UAAU,EAAE,CAAC,CAAC,GAAG,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC7F,MAAM,EAAE,CAAC,CAAC,GAAG,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1G,KAAK,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAC5F,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAA;IAC3D,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAA;IAC3E;;;;;;;;;;;;;;;;;;;OAmBG;IACH,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IACpG;;;OAGG;IACH,YAAY,EAAE,CAAC,CAAC,GAAG,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IACnF,6FAA6F;IAC7F,OAAO,EAAE,CAAC,CAAC,GAAG,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAChG,mEAAmE;IACnE,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAA;IACrC;;;;;OAKG;IACH,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,eAAe,KAAK,MAAM,CAAA;CAC7F;AAID,4EAA4E;AAC5E,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAsC5E;AAID,yCAAyC;AACzC,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,GAAG,WAAW,CAuB7F"}

package/dist/main.js

@@ -14,7 +14,7 @@ import { log } from "./logger.js";
 import { loadConfig } from "./config.js";
 import { validatableLexicons, loadLexicons, storeLexicons, discoverCollections, buildSchemas, } from "./database/schema.js";
 import { discoverViews } from "./views.js";
-import { initDatabase, getCursor, querySQL, getSqlDialect, getSchemaDump, migrateSchema } from "./database/db.js";
+import { initDatabase, getCursor, querySQL, getSqlDialect, getSchemaDump } from "./database/db.js";
 import { createAdapter } from "./database/adapter-factory.js";
 import { getDialect } from "./database/dialect.js";
 import { setSearchPort } from "./database/fts.js";
@@ -22,6 +22,7 @@ import { initFeeds, listFeeds } from "./feeds.js";
 import { initXrpc, listXrpc, configureRelay, configureCdn, configureOAuth, callXrpc } from "./xrpc.js";
 import { initOpengraph } from "./opengraph.js";
 import { initLabels, getLabelDefinitions } from "./labels.js";
+import { initClassifiers, listClassifiers, configureSystemOne } from "./classifiers.js";
 import { auxCursorKey, jetstreamCursorKey, startAuxIndexer, startIndexer, sweepReferences } from "./indexer.js";
 import { startJetstreamIndexer } from "./jetstream.js";
 import { rebuildAllIndexes } from "./database/fts.js";
@@ -67,7 +68,7 @@ log(`[main] Loaded config: ${collections.length} collections`);
 // Discover view defs from lexicons
 discoverViews();
 const engineDialect = getDialect(config.databaseEngine);
-const { schemas, ddlStatements } = buildSchemas(lexicons, collections, engineDialect);
+const { schemas, ddlStatements, indexStatements } = buildSchemas(lexicons, collections, engineDialect);
 for (const s of schemas) {
     if (s.columns.length === 0) {
         log(`[main] No lexicon found for ${s.collection}, using generic JSON storage`);
@@ -82,10 +83,9 @@ if (config.database !== ':memory:') {
 }
 const { adapter, searchPort } = await createAdapter(config.databaseEngine);
 setSearchPort(searchPort);
-await initDatabase(adapter, config.database, schemas, ddlStatements);
+// Migrates as part of opening, between creating the tables and indexing them.
+const migrationChanges = await initDatabase(adapter, config.database, schemas, ddlStatements, indexStatements);
 log(`[main] Database initialized (${config.databaseEngine}, ${config.database === ':memory:' ? 'in-memory' : config.database})`);
-// Auto-migrate schema if lexicons changed
-const migrationChanges = await migrateSchema(schemas);
 if (migrationChanges.length > 0) {
     log(`[main] Applied ${migrationChanges.length} schema migration(s)`);
 }
@@ -109,8 +109,11 @@ else {
     log(`[main] OpenGraph initialized`);
     await initLabels(resolve(configDir, 'labels'));
     log(`[main] Labels initialized: ${getLabelDefinitions().length} definitions`);
+    await initClassifiers(resolve(configDir, 'classifiers'));
+    log(`[main] Classifiers initialized: ${listClassifiers().join(', ') || 'none'}`);
 }
 // Register built-in dev.hatk.* handlers so callXrpc() can find them
+configureSystemOne(config.typesafe);
 setPrivateCollections(config.privateCollections);
 registerCoreHandlers(collections, config.oauth);
 configureOAuth(config.oauth);

package/dist/oauth/server.d.ts

@@ -160,6 +160,42 @@ export declare function handleCallback(config: OAuthConfig, code: string, state:
  */
 export declare function handleCallbackError(config: OAuthConfig, error: string, errorDescription: string | null, state: string | null): Promise<string>;
 export declare function handleToken(config: OAuthConfig, body: Record<string, string>, dpopHeader: string, requestUrl: string): Promise<any>;
+/** A refusal from the endpoint {@link obtainSession} called, or an answer it cannot use. */
+export declare class ObtainSessionError extends Error {
+    /** The endpoint's error code, e.g. an XRPC error name. */
+    readonly error: string;
+    readonly status: number;
+    constructor(
+    /** The endpoint's error code, e.g. an XRPC error name. */
+    error: string, message: string, status: number);
+}
+/** What {@link obtainSession} returns: the endpoint's whole response, and whose session it held. */
+export interface ObtainedSession {
+    did: string;
+    response: Record<string, unknown>;
+}
+/**
+ * Obtain a session for another account straight from its authorization server,
+ * outside the redirect flow: a group host creating an account for this app and
+ * handing it a session, say.
+ *
+ * `body` is POSTed as JSON to `url` as this app's OAuth client, the way the
+ * token endpoint is called: `client_id` and, for a confidential client, a client
+ * assertion addressed to the endpoint's origin, are added to it, and the request
+ * carries a DPoP proof from the app's key, answering a nonce challenge once.
+ * `headers` are sent too, for whatever else the endpoint wants to know (service
+ * auth from the viewer, typically).
+ *
+ * The response must hold an OAuth token response, at `session` or as the whole
+ * body. That session is stored for its `sub` exactly as a login's is, bound to
+ * the same DPoP key, so refresh and the PDS helpers work for that DID from here
+ * on. It is only accepted if the account's own authorization server is the one
+ * that answered: an endpoint cannot hand over a session for an account it does
+ * not serve.
+ */
+export declare function obtainSession(config: OAuthConfig, url: string, body: Record<string, unknown>, opts?: {
+    headers?: Record<string, string>;
+}): Promise<ObtainedSession>;
 export declare function refreshPdsSession(config: OAuthConfig, session: {
     did: string;
     pds_endpoint: string;

package/dist/oauth/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/oauth/server.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAgD/C;;;;;;;GAOG;AACH,qBAAa,UAAW,SAAQ,KAAK;aAEjB,IAAI,EAChB,iBAAiB,GACjB,gBAAgB,GAChB,eAAe,GACf,qBAAqB,GACrB,wBAAwB,GACxB,eAAe;aACH,WAAW,EAAE,MAAM;aACnB,MAAM,EAAE,MAAM;gBARd,IAAI,EAChB,iBAAiB,GACjB,gBAAgB,GAChB,eAAe,GACf,qBAAqB,GACrB,wBAAwB,GACxB,eAAe,EACH,WAAW,EAAE,MAAM,EACnB,MAAM,GAAE,MAAY;CAKvC;AA4FD,wBAAsB,SAAS,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAwCrG;AAID,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW;;;;;;;;;;;;;;;;;;;EAqBxE;AAED,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW;;;;;EAO/E;AAED,wBAAgB,OAAO;;;;;;;;;;;;;;;;;;;;;;EAWtB;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED,sFAAsF;AACtF,wBAAgB,aAAa;;;;;;;;;;;;;;;;;;;;;;EAW5B;AA0CD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW;;;;;;;;;;;;;;;;;;;;EAuBpE;AAID;;;;;;;;;;GAUG;AACH,wBAAsB,SAAS,CAC7B,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAwLtD;AAID,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,GAAG,MAAM,CAYhF;AAID;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1C,OAAO,CAAC,MAAM,CAAC,CAuIjB;AAID,wBAAsB,cAAc,CAClC,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,GAAG,EAAE,MAAM,GAAG,IAAI,GACjB,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAmIrG;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,MAAM,EACb,gBAAgB,EAAE,MAAM,GAAG,IAAI,EAC/B,KAAK,EAAE,MAAM,GAAG,IAAI,GACnB,OAAO,CAAC,MAAM,CAAC,CAsBjB;AAID,wBAAsB,WAAW,CAC/B,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,GAAG,CAAC,CAUd;AA4JD,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE;IACP,GAAG,EAAE,MAAM,CAAA;IACX,YAAY,EAAE,MAAM,CAAA;IACpB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;CACjB,GACA,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAoFpF;AAID,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CA0BjC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/oauth/server.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAgD/C;;;;;;;GAOG;AACH,qBAAa,UAAW,SAAQ,KAAK;aAEjB,IAAI,EAChB,iBAAiB,GACjB,gBAAgB,GAChB,eAAe,GACf,qBAAqB,GACrB,wBAAwB,GACxB,eAAe;aACH,WAAW,EAAE,MAAM;aACnB,MAAM,EAAE,MAAM;gBARd,IAAI,EAChB,iBAAiB,GACjB,gBAAgB,GAChB,eAAe,GACf,qBAAqB,GACrB,wBAAwB,GACxB,eAAe,EACH,WAAW,EAAE,MAAM,EACnB,MAAM,GAAE,MAAY;CAKvC;AA4FD,wBAAsB,SAAS,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAwCrG;AAID,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW;;;;;;;;;;;;;;;;;;;EAqBxE;AAED,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW;;;;;EAO/E;AAED,wBAAgB,OAAO;;;;;;;;;;;;;;;;;;;;;;EAWtB;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED,sFAAsF;AACtF,wBAAgB,aAAa;;;;;;;;;;;;;;;;;;;;;;EAW5B;AA0CD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW;;;;;;;;;;;;;;;;;;;;EAuBpE;AAID;;;;;;;;;;GAUG;AACH,wBAAsB,SAAS,CAC7B,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAwLtD;AAID,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,GAAG,MAAM,CAYhF;AAID;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1C,OAAO,CAAC,MAAM,CAAC,CAuIjB;AAID,wBAAsB,cAAc,CAClC,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,GAAG,EAAE,MAAM,GAAG,IAAI,GACjB,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAmIrG;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,MAAM,EACb,gBAAgB,EAAE,MAAM,GAAG,IAAI,EAC/B,KAAK,EAAE,MAAM,GAAG,IAAI,GACnB,OAAO,CAAC,MAAM,CAAC,CAsBjB;AAID,wBAAsB,WAAW,CAC/B,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,GAAG,CAAC,CAUd;AA4JD,4FAA4F;AAC5F,qBAAa,kBAAmB,SAAQ,KAAK;IAEzC,0DAA0D;aAC1C,KAAK,EAAE,MAAM;aAEb,MAAM,EAAE,MAAM;;IAH9B,0DAA0D;IAC1C,KAAK,EAAE,MAAM,EAC7B,OAAO,EAAE,MAAM,EACC,MAAM,EAAE,MAAM;CAIjC;AAED,oGAAoG;AACpG,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAClC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,WAAW,EACnB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAO,GAC9C,OAAO,CAAC,eAAe,CAAC,CAmD1B;AAID,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE;IACP,GAAG,EAAE,MAAM,CAAA;IACX,YAAY,EAAE,MAAM,CAAA;IACpB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;CACjB,GACA,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAoFpF;AAID,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CA0BjC"}

package/dist/oauth/server.js

@@ -859,6 +859,84 @@ async function handleRefreshTokenGrant(config, body, dpopHeader, requestUrl) {
         handle,
     };
 }
+// --- Sessions obtained outside the redirect flow ---
+/** A refusal from the endpoint {@link obtainSession} called, or an answer it cannot use. */
+export class ObtainSessionError extends Error {
+    error;
+    status;
+    constructor(
+    /** The endpoint's error code, e.g. an XRPC error name. */
+    error, message, status) {
+        super(message);
+        this.error = error;
+        this.status = status;
+    }
+}
+/**
+ * Obtain a session for another account straight from its authorization server,
+ * outside the redirect flow: a group host creating an account for this app and
+ * handing it a session, say.
+ *
+ * `body` is POSTed as JSON to `url` as this app's OAuth client, the way the
+ * token endpoint is called: `client_id` and, for a confidential client, a client
+ * assertion addressed to the endpoint's origin, are added to it, and the request
+ * carries a DPoP proof from the app's key, answering a nonce challenge once.
+ * `headers` are sent too, for whatever else the endpoint wants to know (service
+ * auth from the viewer, typically).
+ *
+ * The response must hold an OAuth token response, at `session` or as the whole
+ * body. That session is stored for its `sub` exactly as a login's is, bound to
+ * the same DPoP key, so refresh and the PDS helpers work for that DID from here
+ * on. It is only accepted if the account's own authorization server is the one
+ * that answered: an endpoint cannot hand over a session for an account it does
+ * not serve.
+ */
+export async function obtainSession(config, url, body, opts = {}) {
+    const origin = new URL(url).origin;
+    const payload = {
+        ...body,
+        ...(await withClientAuth({ client_id: pdsClientId(config.issuer, config) }, config.issuer, config, origin)),
+    };
+    const send = async (nonce) => fetch(url, {
+        method: 'POST',
+        headers: {
+            ...opts.headers,
+            'Content-Type': 'application/json',
+            DPoP: await createDpopProof(serverPrivateJwk, serverPublicJwk, 'POST', url, undefined, nonce),
+        },
+        body: JSON.stringify(payload),
+    });
+    let res = await send();
+    let out = (await res.json().catch(() => ({})));
+    const nonce = res.headers.get('DPoP-Nonce');
+    if (!res.ok && out.error === 'use_dpop_nonce' && nonce) {
+        res = await send(nonce);
+        out = (await res.json().catch(() => ({})));
+    }
+    if (!res.ok) {
+        throw new ObtainSessionError(typeof out.error === 'string' ? out.error : 'UpstreamFailure', String(out.message ?? out.error_description ?? `${url} failed (${res.status})`), res.status);
+    }
+    const token = (typeof out.session === 'object' && out.session ? out.session : out);
+    const did = token.sub;
+    if (typeof did !== 'string' || typeof token.access_token !== 'string') {
+        throw new ObtainSessionError('NoSession', `${url} returned no session`, 502);
+    }
+    const { pdsEndpoint, authServerEndpoint, authServerMetadata } = await discoverAuthServer(did, _plcUrl);
+    if (new URL(authServerEndpoint).origin !== origin) {
+        throw new ObtainSessionError('WrongAuthServer', `${origin} is not the authorization server for ${did}`, 502);
+    }
+    await storeSession(did, {
+        pdsEndpoint,
+        pdsAuthServer: authServerEndpoint,
+        pdsTokenEndpoint: authServerMetadata.token_endpoint,
+        accessToken: token.access_token,
+        refreshToken: typeof token.refresh_token === 'string' ? token.refresh_token : undefined,
+        dpopJkt: serverJkt,
+        tokenExpiresAt: typeof token.expires_in === 'number' ? Math.floor(Date.now() / 1000) + token.expires_in : undefined,
+    });
+    emit('oauth', 'session_obtained', { did, from: origin });
+    return { did, response: out };
+}
 // --- PDS Session Refresh ---
 export async function refreshPdsSession(config, session) {
     if (!session.refresh_token)

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAsEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAuE9C;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,GAAG,IAAI,CA2M3F;AAgDD,MAAM,WAAW,kBAAkB;IACjC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,mFAAmF;IACnF,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,KAAK,EAAE,WAAW,GAAG,IAAI,CAAA;IACzB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACxF,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;IAC5D,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAA;IACrB,mFAAmF;IACnF,MAAM,CAAC,EAAE,kBAAkB,CAAA;CAC5B;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAyqC5F;AAGD,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EAAE,EACrB,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,KAAK,EAAE,WAAW,GAAG,IAAI,EACzB,MAAM,GAAE,MAAM,EAAO,EACrB,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAC5D,QAAQ,CAAC,EAAE,MAAM,IAAI,GACpB,OAAO,WAAW,EAAE,MAAM,CAG5B"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AA4EA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAuE9C;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,GAAG,IAAI,CA2M3F;AAgDD,MAAM,WAAW,kBAAkB;IACjC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,mFAAmF;IACnF,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,KAAK,EAAE,WAAW,GAAG,IAAI,CAAA;IACzB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACxF,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;IAC5D,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAA;IACrB,mFAAmF;IACnF,MAAM,CAAC,EAAE,kBAAkB,CAAA;CAC5B;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAmwC5F;AAGD,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EAAE,EACrB,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,KAAK,EAAE,WAAW,GAAG,IAAI,EACzB,MAAM,GAAE,MAAM,EAAO,EACrB,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAC5D,QAAQ,CAAC,EAAE,MAAM,IAAI,GACpB,OAAO,WAAW,EAAE,MAAM,CAG5B"}

package/dist/server.js

@@ -3,7 +3,8 @@ import { existsSync } from 'node:fs';
 import { readFile } from 'node:fs/promises';
 import { join, extname } from 'node:path';
 import { gzipSync } from 'node:zlib';
-import { queryRecords, getRecordByUri, searchRecords, getSchema, reshapeRow, setRepoStatus, getRepoStatus, getRepoRetryInfo, queryLabelsForUris, insertLabels, searchAccounts, listReposPaginated, getCollectionCounts, getRepoStatusCounts, getDatabaseSize, deleteLabels, getRecentRecords, listActiveRepoDids, removeRepo, getRepoHandle, getPreferences, putPreference, insertReport, queryReports, resolveReport, getOpenReportCount, } from "./database/db.js";
+import { queryRecords, getRecordByUri, searchRecords, getSchema, reshapeRow, setRepoStatus, getRepoStatus, getRepoRetryInfo, queryLabelsForUris, insertLabels, searchAccounts, listReposPaginated, getCollectionCounts, getRepoStatusCounts, getDatabaseSize, deleteLabels, getRecentRecords, listActiveRepoDids, removeRepo, getRepoHandle, getPreferences, putPreference, insertReport, queryReports, resolveReport, getOpenReportCount, queryClassifications, getClassificationStats, getRecordsByDid, getRecordCountsByDid, findOpenReportsForSubject, } from "./database/db.js";
+import { runScan, getScanProgress, listClassifiers, isSystemOneConfigured } from "./classifiers.js";
 import { executeFeed, listFeeds } from "./feeds.js";
 import { executeXrpc, InvalidRequestError, NotFoundError, registerCoreXrpcHandler, isLocalRelay, paramsFromSearch } from "./xrpc.js";
 import { pdsFor } from "./backfill.js";
@@ -825,6 +826,93 @@ export function createHandler(config) {
                 invalidateAdminStats();
                 return withCors(json({ ok: true }, 200, acceptEncoding));
             }
+            // GET /admin/review — the classifier review queue
+            if (url.pathname === '/admin/review' && request.method === 'GET') {
+                const denied = requireAdmin(viewer, acceptEncoding);
+                if (denied)
+                    return denied;
+                const result = await queryClassifications({
+                    classifier: url.searchParams.get('classifier') || undefined,
+                    signal: url.searchParams.get('signal') || undefined,
+                    minScore: url.searchParams.has('minScore') ? Number(url.searchParams.get('minScore')) : undefined,
+                    state: url.searchParams.get('state') || 'pending',
+                    limit: parseInt(url.searchParams.get('limit') || '25'),
+                    offset: parseInt(url.searchParams.get('offset') || '0'),
+                });
+                return withCors(json(result, 200, acceptEncoding));
+            }
+            // GET /admin/review/stats — rollups, classifier names, scan progress
+            if (url.pathname === '/admin/review/stats' && request.method === 'GET') {
+                const denied = requireAdmin(viewer, acceptEncoding);
+                if (denied)
+                    return denied;
+                const stats = await getClassificationStats();
+                return withCors(json({ ...stats, classifiers: listClassifiers(), configured: isSystemOneConfigured(), scan: getScanProgress() }, 200, acceptEncoding));
+            }
+            // POST /admin/review/scan — start a scan. Returns as soon as it is under
+            // way; a scan of a whole network outlives any sensible request timeout, so
+            // progress is polled from /admin/review/stats rather than awaited here.
+            if (url.pathname === '/admin/review/scan' && request.method === 'POST') {
+                const denied = requireAdmin(viewer, acceptEncoding);
+                if (denied)
+                    return denied;
+                if (!isSystemOneConfigured())
+                    return withCors(jsonError(400, 'System One is not configured — set `typesafe` in hatk.config.ts', acceptEncoding));
+                const body = JSON.parse((await request.text()) || '{}');
+                const running = getScanProgress();
+                if (running?.running)
+                    return withCors(jsonError(409, 'A scan is already running', acceptEncoding));
+                runScan({ classifier: body.classifier, force: body.force === true, limit: body.limit })
+                    .then(() => invalidateAdminStats())
+                    .catch(() => { });
+                return withCors(json({ ok: true, started: true }, 202, acceptEncoding));
+            }
+            // GET /admin/review/subject/:did — everything needed to judge one subject
+            if (url.pathname.startsWith('/admin/review/subject/')) {
+                const denied = requireAdmin(viewer, acceptEncoding);
+                if (denied)
+                    return denied;
+                const did = decodeURIComponent(url.pathname.slice('/admin/review/subject/'.length));
+                if (!did.startsWith('did:'))
+                    return withCors(jsonError(400, 'Expected a DID', acceptEncoding));
+                const [records, counts, handle, status, labels] = await Promise.all([
+                    getRecordsByDid(did, collections, 6),
+                    getRecordCountsByDid(did, collections),
+                    getRepoHandle(did),
+                    getRepoStatus(did),
+                    queryLabelsForUris([did]),
+                ]);
+                return withCors(json({ did, handle, status, records, counts, labels }, 200, acceptEncoding));
+            }
+            // POST /admin/review/act — resolve the report and act, in one step
+            if (url.pathname === '/admin/review/act' && request.method === 'POST') {
+                const denied = requireAdmin(viewer, acceptEncoding);
+                if (denied)
+                    return denied;
+                const { did, uri, action, label } = JSON.parse(await request.text());
+                const subjectUri = uri || did;
+                if (!subjectUri || !action)
+                    return withCors(jsonError(400, 'Missing subject or action', acceptEncoding));
+                if (!['takedown', 'label', 'dismiss'].includes(action))
+                    return withCors(jsonError(400, 'Action must be takedown, label or dismiss', acceptEncoding));
+                if (action === 'takedown') {
+                    if (!did)
+                        return withCors(jsonError(400, 'Takedown needs a did', acceptEncoding));
+                    await setRepoStatus(did, 'takendown');
+                }
+                else if (action === 'label') {
+                    if (!label)
+                        return withCors(jsonError(400, 'Label action needs a label', acceptEncoding));
+                    await insertLabels([{ src: 'admin', uri: subjectUri, val: label }]);
+                }
+                // Close whatever the classifier filed, so the subject leaves the queue
+                // whichever way it was decided.
+                for (const id of await findOpenReportsForSubject(subjectUri)) {
+                    await resolveReport(id, action === 'dismiss' ? 'dismissed' : 'resolved', viewer.did);
+                }
+                invalidateAdminStats();
+                return withCors(json({ ok: true }, 200, acceptEncoding));
+            }
             // GET /admin/info/:did — repo status info
             if (url.pathname.startsWith('/admin/info/did:')) {
                 const denied = requireAdmin(viewer, acceptEncoding);
@@ -1342,15 +1430,16 @@ export function createHandler(config) {
                     throw err;
                 }
             }
-            // GET /space-blob?space=&repo=&cid= — a blob inside a permissioned space,
-            // fetched with the viewer's own credential. Unlike /blob/ below it is not
-            // dev-only and not cacheable: a space blob has no public URL by design,
-            // and this response belongs to one viewer.
+            // GET /space-blob?space=&repo=&cid= — a blob inside a permissioned space.
+            // Unlike /blob/ below it is not dev-only, and every request is authorized
+            // with the viewer's own credential for the space: a space blob has no
+            // public URL by design. `if-none-match` is passed along because the
+            // answer may be that the viewer already holds it.
             if (url.pathname === '/space-blob') {
                 const parsed = parseSpaceBlobRequest(url.searchParams);
                 if (!parsed)
                     return withCors(jsonError(400, 'Expected space, repo and cid', acceptEncoding));
-                return withCors(await serveSpaceBlob(oauth, viewer, parsed));
+                return withCors(await serveSpaceBlob(oauth, viewer, parsed, request.headers.get('if-none-match')));
             }
             // GET /blob/:did/:cid — dev-only image proxy (see blobUrl in xrpc.ts).
             // A PDS serves getBlob as an attachment with nosniff, which a browser

package/dist/spaces/blob.d.ts

@@ -8,19 +8,71 @@
  * public URL would turn that URL into the capability the credential exists to
  * replace.
  *
- * So the bytes come through here, fetched on the viewer's own behalf with the
- * viewer's own credential, and go no further: `private, no-store` keeps them
- * out of every shared cache between this server and that browser.
+ * So the bytes come through here, and every request is authorized before any
+ * of them move: the viewer's credential for the space, or the same 404 a
+ * missing blob gets. What that authorization guards is served two ways —
+ * `private` so the viewer's own browser may hold it and no shared cache may,
+ * and out of a bounded in-memory cache so the same photo is fetched from its
+ * repo once rather than once per member looking at it.
  */
 import type { OAuthConfig } from '../config.ts';
+/**
+ * The sizes a space blob is served at.
+ *
+ * The same words hatk's public path uses for imgproxy, with the same numbers,
+ * so an app naming a size says it once and means it either side of the line
+ * between a public blob and a permissioned one. What differs is who resizes:
+ * a space blob may not pass through an image CDN, so it happens here.
+ *
+ * A request naming none gets the original, which is what every caller written
+ * before presets existed asks for.
+ */
+declare const PRESETS: {
+    readonly avatar: {
+        readonly width: 1000;
+        readonly height: 1000;
+        readonly fit: "cover";
+        readonly quality: 85;
+    };
+    readonly avatar_thumbnail: {
+        readonly width: 128;
+        readonly height: 128;
+        readonly fit: "cover";
+        readonly quality: 70;
+    };
+    readonly feed_thumbnail: {
+        readonly width: 1000;
+        readonly fit: "inside";
+        readonly quality: 70;
+    };
+    readonly feed_fullsize: {
+        readonly quality: 90;
+    };
+    readonly banner: {
+        readonly width: 3000;
+        readonly height: 1000;
+        readonly fit: "cover";
+        readonly quality: 85;
+    };
+};
+export type SpaceBlobPreset = keyof typeof PRESETS;
+/**
+ * Only a name from that list is a preset.
+ *
+ * Free-form dimensions would let anyone mint unlimited distinct cache keys and
+ * evict everything real, and would put the cost of an arbitrary resize behind
+ * a URL. An unrecognised name is treated as none rather than refused: a broken
+ * image is a worse answer than a large one.
+ */
+export declare function asPreset(name: string | null | undefined): SpaceBlobPreset | undefined;
 /**
  * The URL this appview serves a space blob at, for whoever is asking.
  *
  * Built here rather than by the app, because the route is hatk's: a blob in a
  * space has no public address by design, and this is the one address it does
- * have — answered per viewer, with that viewer's credential, uncacheable.
+ * have — answered only to a viewer who may read the space it names.
  */
-export declare function spaceBlobUrl(space: string, repo: string, cid: string): string;
+export declare function spaceBlobUrl(space: string, repo: string, cid: string, preset?: SpaceBlobPreset): string;
 /**
  * The CID a blob reference names, in whichever spelling the read used.
  *
@@ -35,8 +87,12 @@ export interface SpaceBlobRequest {
     /** The repo holding the blob — the writer's, not the authority's. */
     repo: string;
     cid: string;
+    /** The size to serve it at. Absent means the original. */
+    preset?: SpaceBlobPreset;
 }
 export declare function parseSpaceBlobRequest(params: URLSearchParams): SpaceBlobRequest | null;
+/** Drop everything held. For tests, and for an operator who wants it gone. */
+export declare function resetSpaceBlobCache(): void;
 /**
  * Fetch a space blob as this viewer, or answer why not.
  *
@@ -44,8 +100,13 @@ export declare function parseSpaceBlobRequest(params: URLSearchParams): SpaceBlo
  * there. The distinction between "you may not" and "it does not exist" is
  * itself information about a private space, and the space host draws the line
  * the same way when it reports a non-member's repo as simply absent.
+ *
+ * The credential is checked on every request, including the ones answered from
+ * the cache and the ones answered with a 304. Nothing here is ever served to
+ * somebody the authority has not just said yes to.
  */
 export declare function serveSpaceBlob(oauth: OAuthConfig | null, viewer: {
     did: string;
-} | null, request: SpaceBlobRequest): Promise<Response>;
+} | null, request: SpaceBlobRequest, ifNoneMatch?: string | null): Promise<Response>;
+export {};
 //# sourceMappingURL=blob.d.ts.map

package/dist/spaces/blob.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"blob.d.ts","sourceRoot":"","sources":["../../src/spaces/blob.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAe/C;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAG7E;AAED;;;;;;;GAOG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAMzD;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAA;IACb,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,eAAe,GAAG,gBAAgB,GAAG,IAAI,CAOtF;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,WAAW,GAAG,IAAI,EACzB,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAC9B,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,QAAQ,CAAC,CAsCnB"}
+{"version":3,"file":"blob.d.ts","sourceRoot":"","sources":["../../src/spaces/blob.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AA6C/C;;;;;;;;;;GAUG;AACH,QAAA,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;CAMsG,CAAA;AAEnH,MAAM,MAAM,eAAe,GAAG,MAAM,OAAO,OAAO,CAAA;AAElD;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,eAAe,GAAG,SAAS,CAErF;AAKD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,eAAe,GAAG,MAAM,CAIvG;AAED;;;;;;;GAOG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAMzD;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAA;IACb,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;IACX,0DAA0D;IAC1D,MAAM,CAAC,EAAE,eAAe,CAAA;CACzB;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,eAAe,GAAG,gBAAgB,GAAG,IAAI,CAQtF;AA0DD,8EAA8E;AAC9E,wBAAgB,mBAAmB,IAAI,IAAI,CAI1C;AAuDD;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,WAAW,GAAG,IAAI,EACzB,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAC9B,OAAO,EAAE,gBAAgB,EACzB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,GAC1B,OAAO,CAAC,QAAQ,CAAC,CA+BnB"}