@hatk/hatk 0.0.1-alpha.94 → 0.0.1-alpha.96

package/dist/spaces/blob.js

@@ -8,9 +8,12 @@
  * public URL would turn that URL into the capability the credential exists to
  * replace.
  *
- * So the bytes come through here, fetched on the viewer's own behalf with the
- * viewer's own credential, and go no further: `private, no-store` keeps them
- * out of every shared cache between this server and that browser.
+ * So the bytes come through here, and every request is authorized before any
+ * of them move: the viewer's credential for the space, or the same 404 a
+ * missing blob gets. What that authorization guards is served two ways —
+ * `private` so the viewer's own browser may hold it and no shared cache may,
+ * and out of a bounded in-memory cache so the same photo is fetched from its
+ * repo once rather than once per member looking at it.
  */
 import { emit } from "../logger.js";
 import { repoEndpoint } from "./identity.js";
@@ -24,15 +27,74 @@ import { viewerCredential } from "./viewer.js";
  * what a browser executes in this origin.
  */
 const SERVABLE = new Set(['image/jpeg', 'image/png', 'image/webp', 'image/avif', 'image/gif']);
+/**
+ * How long a browser may reuse a blob it has before it asks again.
+ *
+ * Every request that does arrive is authorized, so this is the window in which
+ * a viewer who has just lost access still sees what they had. A minute is
+ * small against what the surrounding design already accepts: the readable set
+ * is cached for five, and the space host lets a minted credential outlive a
+ * revocation by up to two hours.
+ */
+const MAX_AGE_S = 60;
+/**
+ * Bytes held across every cached blob, and the largest single one worth
+ * holding. A blob past the entry limit streams straight through instead —
+ * caching it would evict a great many small ones to save one fetch.
+ */
+const CACHE_BYTES = 64 * 1024 * 1024;
+const MAX_ENTRY_BYTES = 4 * 1024 * 1024;
+/**
+ * How much of an original we will read in order to make a smaller one.
+ *
+ * Larger than what we hold, and deliberately: a photograph straight off a
+ * camera is exactly the case where resizing pays, and refusing to read it
+ * would be refusing the request that needs answering most. What comes back out
+ * is a derivative small enough to keep.
+ */
+const MAX_SOURCE_BYTES = 20 * 1024 * 1024;
+/**
+ * The sizes a space blob is served at.
+ *
+ * The same words hatk's public path uses for imgproxy, with the same numbers,
+ * so an app naming a size says it once and means it either side of the line
+ * between a public blob and a permissioned one. What differs is who resizes:
+ * a space blob may not pass through an image CDN, so it happens here.
+ *
+ * A request naming none gets the original, which is what every caller written
+ * before presets existed asks for.
+ */
+const PRESETS = {
+    avatar: { width: 1000, height: 1000, fit: 'cover', quality: 85 },
+    avatar_thumbnail: { width: 128, height: 128, fit: 'cover', quality: 70 },
+    feed_thumbnail: { width: 1000, fit: 'inside', quality: 70 },
+    feed_fullsize: { quality: 90 },
+    banner: { width: 3000, height: 1000, fit: 'cover', quality: 85 },
+};
+/**
+ * Only a name from that list is a preset.
+ *
+ * Free-form dimensions would let anyone mint unlimited distinct cache keys and
+ * evict everything real, and would put the cost of an arbitrary resize behind
+ * a URL. An unrecognised name is treated as none rather than refused: a broken
+ * image is a worse answer than a large one.
+ */
+export function asPreset(name) {
+    return name && name in PRESETS ? name : undefined;
+}
+/** Resizing is skipped for these: one frame of an animation is not the animation. */
+const ANIMATED = new Set(['image/gif']);
 /**
  * The URL this appview serves a space blob at, for whoever is asking.
  *
  * Built here rather than by the app, because the route is hatk's: a blob in a
  * space has no public address by design, and this is the one address it does
- * have — answered per viewer, with that viewer's credential, uncacheable.
+ * have — answered only to a viewer who may read the space it names.
  */
-export function spaceBlobUrl(space, repo, cid) {
+export function spaceBlobUrl(space, repo, cid, preset) {
     const params = new URLSearchParams({ space, repo, cid });
+    if (preset)
+        params.set('preset', preset);
     return `/space-blob?${params}`;
 }
 /**
@@ -61,7 +123,114 @@ export function parseSpaceBlobRequest(params) {
         return null;
     if (!parseSpaceRef(space) || !repo.startsWith('did:'))
         return null;
-    return { space, repo, cid };
+    const preset = asPreset(params.get('preset'));
+    return { space, repo, cid, ...(preset ? { preset } : {}) };
+}
+/**
+ * Blobs held in memory, least recently used first.
+ *
+ * In memory and not on disk on purpose. These are members' private photos, and
+ * a cache that survives a restart is a store of them: this one is bounded,
+ * forgotten when the process ends, and never written anywhere a backup would
+ * find it.
+ */
+const cache = new Map();
+let cachedBytes = 0;
+/**
+ * Fetches in flight, so a page opening with the same image in it twenty times
+ * fetches it once. Keyed like the cache.
+ */
+const inFlight = new Map();
+/**
+ * The space is part of the key, and has to be.
+ *
+ * A CID names bytes, so caching by CID alone would hit across spaces — and the
+ * check that a blob is actually referenced from the space being named lives
+ * upstream, in `com.atproto.space.getBlob`. A viewer who may read one space
+ * could then name any CID they had heard of and be served it out of the cache
+ * without that check ever running.
+ */
+const keyFor = (request) => `${request.space}\n${request.cid}\n${request.preset ?? ''}`;
+function cacheGet(key) {
+    const entry = cache.get(key);
+    if (!entry)
+        return undefined;
+    // Re-inserted so iteration order is least-recently-used first.
+    cache.delete(key);
+    cache.set(key, entry);
+    return entry;
+}
+function cachePut(key, entry) {
+    if (entry.bytes.byteLength > MAX_ENTRY_BYTES)
+        return;
+    const existing = cache.get(key);
+    if (existing)
+        cachedBytes -= existing.bytes.byteLength;
+    cache.set(key, entry);
+    cachedBytes += entry.bytes.byteLength;
+    while (cachedBytes > CACHE_BYTES) {
+        const oldest = cache.keys().next();
+        if (oldest.done)
+            break;
+        cachedBytes -= cache.get(oldest.value).bytes.byteLength;
+        cache.delete(oldest.value);
+    }
+}
+/** Drop everything held. For tests, and for an operator who wants it gone. */
+export function resetSpaceBlobCache() {
+    cache.clear();
+    inFlight.clear();
+    cachedBytes = 0;
+}
+/**
+ * A CID is a hash of the bytes it names, which is exactly what an ETag is for.
+ * Strong, free, and stable for as long as the blob exists. The preset is part
+ * of it because it is part of what comes back.
+ */
+const etagFor = (request) => request.preset ? `"${request.cid}-${request.preset}"` : `"${request.cid}"`;
+/** Whether the browser already holds this blob. `*` matches anything it has. */
+function matches(ifNoneMatch, etag) {
+    if (!ifNoneMatch)
+        return false;
+    return ifNoneMatch
+        .split(',')
+        .map((candidate) => candidate.trim().replace(/^W\//, ''))
+        .some((candidate) => candidate === '*' || candidate === etag);
+}
+/**
+ * Headers every answer carries, whether it has a body or not.
+ *
+ * `private` is the whole of the caching posture: the viewer's own browser may
+ * keep what it was shown, and no cache between here and there may. `vary`
+ * keeps it honest on a browser where two people sign in — the response turns
+ * on who asked, and who asked is the cookie or the token.
+ */
+function cacheHeaders(request) {
+    return {
+        etag: etagFor(request),
+        'cache-control': `private, max-age=${MAX_AGE_S}, must-revalidate`,
+        vary: 'cookie, authorization',
+    };
+}
+function serve(entry, request) {
+    return new Response(entry.bytes, {
+        status: 200,
+        headers: {
+            'content-type': entry.contentType,
+            ...cacheHeaders(request),
+            'content-disposition': 'inline',
+            'content-security-policy': "default-src 'none'; sandbox",
+            'x-content-type-options': 'nosniff',
+        },
+    });
+}
+/** A refusal from the repo host, carried out through the in-flight promise. */
+class UpstreamRefusal extends Error {
+    status;
+    constructor(status) {
+        super(`upstream refused with ${status}`);
+        this.status = status;
+    }
 }
 /**
  * Fetch a space blob as this viewer, or answer why not.
@@ -70,42 +239,222 @@ export function parseSpaceBlobRequest(params) {
  * there. The distinction between "you may not" and "it does not exist" is
  * itself information about a private space, and the space host draws the line
  * the same way when it reports a non-member's repo as simply absent.
+ *
+ * The credential is checked on every request, including the ones answered from
+ * the cache and the ones answered with a 304. Nothing here is ever served to
+ * somebody the authority has not just said yes to.
  */
-export async function serveSpaceBlob(oauth, viewer, request) {
+export async function serveSpaceBlob(oauth, viewer, request, ifNoneMatch) {
     if (!viewer)
         return new Response('Unauthorized', { status: 401 });
     const credential = await viewerCredential(oauth, viewer, request.space);
     if (!credential)
         return new Response('Not found', { status: 404 });
+    // The browser has it already. Authorized above, so this is a viewer who may
+    // go on looking at what they hold — and it costs neither of us the bytes.
+    if (matches(ifNoneMatch, etagFor(request))) {
+        return new Response(null, { status: 304, headers: cacheHeaders(request) });
+    }
+    const key = keyFor(request);
+    const hit = cacheGet(key);
+    if (hit)
+        return serve(hit, request);
+    let entry;
+    try {
+        entry = await (inFlight.get(key) ?? fetchOnce(key, credential, request));
+    }
+    catch (err) {
+        if (err instanceof UpstreamRefusal)
+            return new Response('Not found', { status: err.status });
+        emit('spaces', 'blob_error', { space: request.space, repo: request.repo, error: err.message });
+        return new Response('Blob unavailable', { status: 502 });
+    }
+    // Too large to hold, which the read above discovered from its headers and
+    // then dropped. Asking again costs a round trip and no bytes, and buys a
+    // body that is streamed rather than gathered into memory to be served once.
+    if (!entry)
+        return streamThrough(credential, request);
+    return serve(entry, request);
+}
+function blobUrlFor(endpoint, request) {
+    const url = new URL(`${endpoint}/xrpc/com.atproto.space.getBlob`);
+    url.searchParams.set('space', request.space);
+    // `repo`, not `did`: a space read names the repo holding the record the
+    // same way everywhere. A server hosting one account falls back to it,
+    // which is what makes `did` ever appear to work.
+    url.searchParams.set('repo', request.repo);
+    url.searchParams.set('cid', request.cid);
+    return url;
+}
+/**
+ * The upstream read, shared by everyone who asked for this blob at once.
+ *
+ * Resolves to null for a blob too large to hold, which the caller streams
+ * instead. A failure rejects, and rejects for all of them: one refusal is
+ * every caller's refusal, because the credential each of them presented had
+ * already been accepted for this space.
+ */
+function fetchOnce(key, credential, request) {
+    const task = (async () => {
+        const upstream = await credential.fetch(blobUrlFor(await repoEndpoint(request.repo), request));
+        if (!upstream.ok) {
+            // A credential the repo host rejects reads as absent, not as
+            // unauthorized: the viewer holds one, so what they are being told is
+            // that this blob is not theirs to see.
+            throw new UpstreamRefusal(upstream.status === 401 ? 404 : upstream.status);
+        }
+        const contentType = servableType(upstream);
+        const limit = request.preset ? MAX_SOURCE_BYTES : MAX_ENTRY_BYTES;
+        const declared = Number(upstream.headers.get('content-length') ?? NaN);
+        if (declared > limit) {
+            await upstream.body?.cancel();
+            return null;
+        }
+        // Read against the limit rather than trusting the length, which a repo host
+        // is free not to send and free to get wrong.
+        const source = await readBounded(upstream, limit);
+        if (!source)
+            return null;
+        // A resize that cannot happen is not a failure to serve. Sharp missing, an
+        // animation, or an image it cannot read all end here with the original,
+        // which is the answer this route gave before presets existed.
+        const bytes = request.preset ? ((await resize(source, contentType, request.preset)) ?? source) : source;
+        const entry = { bytes, contentType };
+        cachePut(key, entry);
+        return entry;
+    })().finally(() => {
+        if (inFlight.get(key) === task)
+            inFlight.delete(key);
+    });
+    inFlight.set(key, task);
+    return task;
+}
+/**
+ * The whole body, or null once it is plainly too big to hold.
+ *
+ * Bounded as it reads: a body that goes past the limit is abandoned there, so
+ * the most this ever holds is one blob's worth over the limit by one chunk.
+ */
+async function readBounded(upstream, limit) {
+    if (!upstream.body)
+        return new Uint8Array(0);
+    const reader = upstream.body.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            total += value.byteLength;
+            if (total > limit) {
+                await reader.cancel();
+                return null;
+            }
+            chunks.push(value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    const bytes = new Uint8Array(total);
+    let at = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, at);
+        at += chunk.byteLength;
+    }
+    return bytes;
+}
+/**
+ * Sharp, if this deployment has it.
+ *
+ * An optional peer dependency: hatk is a library, and most of what installs it
+ * never serves a permissioned space at all. Resolved once — a missing module
+ * is answered from the same settled promise rather than re-attempted per
+ * image.
+ */
+let sharpModule;
+function loadSharp() {
+    sharpModule ??= import('sharp')
+        .then((m) => m.default)
+        .catch(() => {
+        emit('spaces', 'resize_unavailable', { reason: 'sharp is not installed' });
+        return null;
+    });
+    return sharpModule;
+}
+/**
+ * The blob at the size it is drawn, or null to serve the original instead.
+ *
+ * Orientation is applied before the resize and the metadata that carried it is
+ * dropped with everything else — which also means the GPS in a ride photo's
+ * EXIF stops being served to everyone the space admits.
+ *
+ * The format is kept rather than normalised to JPEG. Re-encoding a PNG that
+ * way silently flattens its transparency, and no size is worth that.
+ *
+ * Null when the original is the better answer — an animation, an image sharp
+ * cannot read, sharp absent, or a derivative that came out no smaller.
+ */
+async function resize(source, contentType, preset) {
+    if (ANIMATED.has(contentType))
+        return null;
+    const sharp = await loadSharp();
+    if (!sharp)
+        return null;
+    const { width, height, fit, quality } = PRESETS[preset];
+    try {
+        let pipeline = sharp(source).rotate();
+        if (width)
+            pipeline = pipeline.resize({ width, height, fit, withoutEnlargement: true });
+        // Named explicitly rather than left to sharp, which keeps the input format
+        // but not the quality — without this a preset that only sets quality, like
+        // a full-size one, would re-encode at sharp's default and do nothing.
+        if (contentType === 'image/jpeg')
+            pipeline = pipeline.jpeg({ quality, mozjpeg: true });
+        else if (contentType === 'image/webp')
+            pipeline = pipeline.webp({ quality });
+        else if (contentType === 'image/avif')
+            pipeline = pipeline.avif({ quality });
+        else if (contentType === 'image/png')
+            pipeline = pipeline.png({ compressionLevel: 9 });
+        const out = await pipeline.toBuffer();
+        // A derivative bigger than what it came from is a worse answer than the
+        // original — small images re-encoded at a higher quality can land there.
+        if (out.byteLength >= source.byteLength)
+            return null;
+        return new Uint8Array(out.buffer, out.byteOffset, out.byteLength);
+    }
+    catch (err) {
+        emit('spaces', 'resize_failed', { preset, content_type: contentType, error: err?.message ?? String(err) });
+        return null;
+    }
+}
+/** A blob too large to cache, passed through as it arrives. */
+async function streamThrough(credential, request) {
     let upstream;
     try {
-        const url = new URL(`${await repoEndpoint(request.repo)}/xrpc/com.atproto.space.getBlob`);
-        url.searchParams.set('space', request.space);
-        // `repo`, not `did`: a space read names the repo holding the record the
-        // same way everywhere. A server hosting one account falls back to it,
-        // which is what makes `did` ever appear to work.
-        url.searchParams.set('repo', request.repo);
-        url.searchParams.set('cid', request.cid);
-        upstream = await credential.fetch(url);
+        upstream = await credential.fetch(blobUrlFor(await repoEndpoint(request.repo), request));
     }
     catch (err) {
         emit('spaces', 'blob_error', { space: request.space, repo: request.repo, error: err.message });
         return new Response('Blob unavailable', { status: 502 });
     }
-    if (!upstream.ok)
+    if (!upstream.ok) {
         return new Response('Not found', { status: upstream.status === 401 ? 404 : upstream.status });
-    const claimed = (upstream.headers.get('content-type') ?? '').split(';')[0].trim();
-    const contentType = SERVABLE.has(claimed) ? claimed : 'application/octet-stream';
+    }
     return new Response(upstream.body, {
         status: 200,
         headers: {
-            'content-type': contentType,
-            // Not a public cache: this response is one viewer's, and the next
-            // request for the same URL may be somebody with no right to it.
-            'cache-control': 'private, no-store',
+            'content-type': servableType(upstream),
+            ...cacheHeaders(request),
             'content-disposition': 'inline',
             'content-security-policy': "default-src 'none'; sandbox",
             'x-content-type-options': 'nosniff',
         },
     });
 }
+function servableType(upstream) {
+    const claimed = (upstream.headers.get('content-type') ?? '').split(';')[0].trim();
+    return SERVABLE.has(claimed) ? claimed : 'application/octet-stream';
+}

package/dist/spaces/index.d.ts

@@ -22,7 +22,7 @@ export declare function serverDpopProof(method: string, url: string, accessToken
 export { handleWriteNotice } from './engine.ts';
 export { clearPendingNotices, NoticeError, parseWriteNotice, scheduleNoticeSync, verifyNotice, type WriteNotice, } from './notify.ts';
 export * from './uri.ts';
-export { blobCid, spaceBlobUrl } from './blob.ts';
+export { asPreset, blobCid, resetSpaceBlobCache, type SpaceBlobPreset, spaceBlobUrl } from './blob.ts';
 export { records, requireSpace, spaceRecords } from './records.ts';
 export declare function spaceServiceId(): string | null;
 /**

package/dist/spaces/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/spaces/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAG7D,OAAO,EAA+D,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAOnH,OAAO,EACL,uBAAuB,EACvB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,YAAY,EACZ,UAAU,GACX,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AACvG,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAA;AAC9E,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACrF,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AAC3E,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAErF;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,WAAW,CAAC,EAAE,MAAM,EACpB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAIjB;AACD,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAC/C,OAAO,EACL,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,KAAK,WAAW,GACjB,MAAM,aAAa,CAAA;AACpB,cAAc,UAAU,CAAA;AACxB,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AACjD,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAWlE,wBAAgB,cAAc,IAAI,MAAM,GAAG,IAAI,CAE9C;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAYzG;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,YAAY,CAAA;IACpB,KAAK,EAAE,WAAW,GAAG,IAAI,CAAA;IACzB,GAAG,EAAE,MAAM,CAAA;IACX,6CAA6C;IAC7C,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CACzB;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAqD1D;AAED,wBAAgB,UAAU,IAAI,IAAI,CAMjC;AAED,+FAA+F;AAC/F,OAAO,EAAE,UAAU,IAAI,WAAW,EAAE,YAAY,IAAI,aAAa,EAAE,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/spaces/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAG7D,OAAO,EAA+D,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAOnH,OAAO,EACL,uBAAuB,EACvB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,YAAY,EACZ,UAAU,GACX,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AACvG,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAA;AAC9E,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACrF,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AAC3E,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAErF;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,WAAW,CAAC,EAAE,MAAM,EACpB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAIjB;AACD,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAC/C,OAAO,EACL,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,KAAK,WAAW,GACjB,MAAM,aAAa,CAAA;AACpB,cAAc,UAAU,CAAA;AACxB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,mBAAmB,EAAE,KAAK,eAAe,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AACtG,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAWlE,wBAAgB,cAAc,IAAI,MAAM,GAAG,IAAI,CAE9C;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAYzG;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,YAAY,CAAA;IACpB,KAAK,EAAE,WAAW,GAAG,IAAI,CAAA;IACzB,GAAG,EAAE,MAAM,CAAA;IACX,6CAA6C;IAC7C,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CACzB;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAqD1D;AAED,wBAAgB,UAAU,IAAI,IAAI,CAMjC;AAED,+FAA+F;AAC/F,OAAO,EAAE,UAAU,IAAI,WAAW,EAAE,YAAY,IAAI,aAAa,EAAE,CAAA"}

package/dist/spaces/index.js

@@ -33,7 +33,7 @@ export async function serverDpopProof(method, url, accessToken, nonce) {
 export { handleWriteNotice } from "./engine.js";
 export { clearPendingNotices, NoticeError, parseWriteNotice, scheduleNoticeSync, verifyNotice, } from "./notify.js";
 export * from "./uri.js";
-export { blobCid, spaceBlobUrl } from "./blob.js";
+export { asPreset, blobCid, resetSpaceBlobCache, spaceBlobUrl } from "./blob.js";
 export { records, requireSpace, spaceRecords } from "./records.js";
 let sweepTimer = null;
 /**

package/dist/xrpc.d.ts

@@ -2,6 +2,7 @@ import type { BaseContext } from './hydrate.ts';
 import type { Row, FlatRow } from './lex-types.ts';
 import type { OAuthConfig, CdnConfig } from './config.ts';
 import type { PdsXrpcOptions } from './pds-proxy.ts';
+import { type ObtainedSession } from './oauth/server.ts';
 export type { Row, FlatRow };
 /** Set the OAuth config used for record write helpers. Called once during boot. */
 export declare function configureOAuth(config: OAuthConfig | null): void;
@@ -81,7 +82,27 @@ export interface XrpcContext<P = Record<string, string>, Records extends Record<
      * the granted scopes still apply. See {@link pdsXrpc}.
      */
     pds: (nsid: string, options?: PdsXrpcOptions) => Promise<Record<string, unknown>>;
+    /**
+     * The record helpers and `pds` above, acting as another account this app
+     * holds a session for — one it obtained with {@link obtainSession}, say.
+     * Nothing here checks that the viewer may act for that account: that is the
+     * app's decision, made before calling.
+     */
+    asAccount: (did: string) => AccountHelpers;
+    /**
+     * Obtain a session for another account straight from its authorization
+     * server, outside the redirect flow — a group host creating an account for
+     * this app, for instance. POSTs `body` to `url` as this app's OAuth client,
+     * with DPoP, and stores the session the response carries for its `sub`, so
+     * {@link asAccount} works for it afterwards. See `obtainSession` in
+     * `oauth/server.ts`.
+     */
+    obtainSession: (url: string, body: Record<string, unknown>, opts?: {
+        headers?: Record<string, string>;
+    }) => Promise<ObtainedSession>;
 }
+/** The PDS helpers on {@link XrpcContext}, for one account. */
+export type AccountHelpers = Pick<XrpcContext, 'createRecord' | 'putRecord' | 'deleteRecord' | 'applyWrites' | 'pds'>;
 /** Set the relay URL used for blob URL generation. Called once during boot. */
 /** True when the relay is a loopback URL — a dev PDS rather than the network. */
 export declare function isLocalRelay(): boolean;

package/dist/xrpc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"xrpc.d.ts","sourceRoot":"","sources":["../src/xrpc.ts"],"names":[],"mappings":"AAuCA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAE/C,OAAO,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AAElD,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAEzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAEpD,YAAY,EAAE,GAAG,EAAE,OAAO,EAAE,CAAA;AAI5B,mFAAmF;AACnF,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,QAExD;AAED,gFAAgF;AAChF,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,MAAM,SAAM;IACZ,SAAS,CAAC,EAAE,MAAM,CAAA;gBACN,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM;CAIhD;AACD,0DAA0D;AAC1D,qBAAa,aAAc,SAAQ,mBAAmB;IACpD,MAAM,SAAM;gBACA,OAAO,SAAc;CAGlC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW,CAC1B,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC1B,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzD,CAAC,GAAG,OAAO,CACX,SAAQ,WAAW;IACnB,EAAE,EAAE;QACF,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;QAC9D,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;QACvD,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;KACpE,CAAA;IACD,MAAM,EAAE,CAAC,CAAA;IACT,KAAK,EAAE,CAAC,CAAA;IACR,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,MAAM,CAAA;IAC7D,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;IACzE,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IAC9C,mBAAmB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;IAC7D,MAAM,EAAE,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,OAAO,EACvC,UAAU,EAAE,CAAC,EACb,CAAC,EAAE,MAAM,EACT,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,KACxD,OAAO,CAAC;QAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC7D,OAAO,EAAE,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAC3D,MAAM,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IACjF,YAAY,EAAE,CACZ,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,KACrB,OAAO,CAAC;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC5C,SAAS,EAAE,CACT,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,OAAO,CAAC;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC5C,YAAY,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACjE,WAAW,EAAE,CACX,MAAM,EAAE,KAAK,CAAC;QACZ,KAAK,EAAE,MAAM,CAAA;QACb,UAAU,EAAE,MAAM,CAAA;QAClB,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAChC,CAAC,KACC,OAAO,CAAC;QAAE,OAAO,CAAC,EAAE,KAAK,CAAC;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,GAAG,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC,CAAA;IAChF;;;;OAIG;IACH,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAClF;AAiBD,+EAA+E;AAC/E,iFAAiF;AACjF,wBAAgB,YAAY,IAAI,OAAO,CAStC;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,QAE3C;AAED,4EAA4E;AAC5E,wBAAgB,YAAY,CAAC,GAAG,EAAE,SAAS,GAAG,IAAI,QAUjD;AAWD;;;GAGG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,MAAiB,GAAG,MAAM,GAAG,SAAS,CAehG;AAED,mGAAmG;AACnG,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAC/C,KAAK,CAAC,EAAE,OAAO,GACd,WAAW,CA8Cb;AAoBD;;;;GAIG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA2B7D;AAED,oEAAoE;AACpE,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE;IAAE,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,CAAA;CAAE,GAAG,IAAI,CAe9G;AAED;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;AAE5C,iFAAiF;AACjF,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,eAAe,GAAG,UAAU,CASpE;AAQD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAsB1G;AAED,qFAAqF;AACrF,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAC/B,KAAK,CAAC,EAAE,OAAO,GACd,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAYrB;AAED,mFAAmF;AACnF,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAM,EAAE,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAkB5G;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,CACF,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAC/C,KAAK,CAAC,EAAE,OAAO,KACZ,OAAO,CAAC,GAAG,CAAC,GAChB,IAAI,CAEN;AAED,+CAA+C;AAC/C,wBAAgB,QAAQ,IAAI,MAAM,EAAE,CAEnC"}
+{"version":3,"file":"xrpc.d.ts","sourceRoot":"","sources":["../src/xrpc.ts"],"names":[],"mappings":"AAuCA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAE/C,OAAO,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AAElD,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAEzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AACpD,OAAO,EAAqC,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAE3F,YAAY,EAAE,GAAG,EAAE,OAAO,EAAE,CAAA;AAI5B,mFAAmF;AACnF,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,QAExD;AAED,gFAAgF;AAChF,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,MAAM,SAAM;IACZ,SAAS,CAAC,EAAE,MAAM,CAAA;gBACN,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM;CAIhD;AACD,0DAA0D;AAC1D,qBAAa,aAAc,SAAQ,mBAAmB;IACpD,MAAM,SAAM;gBACA,OAAO,SAAc;CAGlC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW,CAC1B,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC1B,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzD,CAAC,GAAG,OAAO,CACX,SAAQ,WAAW;IACnB,EAAE,EAAE;QACF,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;QAC9D,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;QACvD,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;KACpE,CAAA;IACD,MAAM,EAAE,CAAC,CAAA;IACT,KAAK,EAAE,CAAC,CAAA;IACR,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,MAAM,CAAA;IAC7D,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;IACzE,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IAC9C,mBAAmB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;IAC7D,MAAM,EAAE,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,OAAO,EACvC,UAAU,EAAE,CAAC,EACb,CAAC,EAAE,MAAM,EACT,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,KACxD,OAAO,CAAC;QAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC7D,OAAO,EAAE,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAC3D,MAAM,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IACjF,YAAY,EAAE,CACZ,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,KACrB,OAAO,CAAC;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC5C,SAAS,EAAE,CACT,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,OAAO,CAAC;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC5C,YAAY,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACjE,WAAW,EAAE,CACX,MAAM,EAAE,KAAK,CAAC;QACZ,KAAK,EAAE,MAAM,CAAA;QACb,UAAU,EAAE,MAAM,CAAA;QAClB,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAChC,CAAC,KACC,OAAO,CAAC;QAAE,OAAO,CAAC,EAAE,KAAK,CAAC;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,GAAG,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC,CAAA;IAChF;;;;OAIG;IACH,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IACjF;;;;;OAKG;IACH,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,cAAc,CAAA;IAC1C;;;;;;;OAOG;IACH,aAAa,EAAE,CACb,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,KACxC,OAAO,CAAC,eAAe,CAAC,CAAA;CAC9B;AAED,+DAA+D;AAC/D,MAAM,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,EAAE,cAAc,GAAG,WAAW,GAAG,cAAc,GAAG,aAAa,GAAG,KAAK,CAAC,CAAA;AAiBrH,+EAA+E;AAC/E,iFAAiF;AACjF,wBAAgB,YAAY,IAAI,OAAO,CAStC;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,QAE3C;AAED,4EAA4E;AAC5E,wBAAgB,YAAY,CAAC,GAAG,EAAE,SAAS,GAAG,IAAI,QAUjD;AAWD;;;GAGG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,MAAiB,GAAG,MAAM,GAAG,SAAS,CAehG;AAED,mGAAmG;AACnG,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAC/C,KAAK,CAAC,EAAE,OAAO,GACd,WAAW,CAgCb;AAsDD;;;;GAIG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA2B7D;AAED,oEAAoE;AACpE,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE;IAAE,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,CAAA;CAAE,GAAG,IAAI,CAe9G;AAED;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;AAE5C,iFAAiF;AACjF,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,eAAe,GAAG,UAAU,CASpE;AAQD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAsB1G;AAED,qFAAqF;AACrF,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAC/B,KAAK,CAAC,EAAE,OAAO,GACd,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAYrB;AAED,mFAAmF;AACnF,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAM,EAAE,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAkB5G;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,CACF,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAC/C,KAAK,CAAC,EAAE,OAAO,KACZ,OAAO,CAAC,GAAG,CAAC,GAChB,IAAI,CAEN;AAED,+CAA+C;AAC/C,wBAAgB,QAAQ,IAAI,MAAM,EAAE,CAEnC"}

package/dist/xrpc.js

@@ -35,6 +35,7 @@ import { resolveRecords, buildBaseContext } from "./hydrate.js";
 import { getLexicon } from "./database/schema.js";
 import { createHmac } from 'node:crypto';
 import { pdsCreateRecord, pdsPutRecord, pdsDeleteRecord, pdsApplyWrites, pdsXrpc } from "./pds-proxy.js";
+import { obtainSession, ObtainSessionError } from "./oauth/server.js";
 let _oauthConfig = null;
 /** Set the OAuth config used for record write helpers. Called once during boot. */
 export function configureOAuth(config) {
@@ -136,40 +137,54 @@ export function buildXrpcContext(params, cursor, limit, viewer, input) {
             const uri = await findUriByFields(collection, conditions);
             return uri !== null;
         },
-        createRecord: async (collection, record, opts) => {
+        ...accountHelpers(viewer),
+        asAccount: (did) => accountHelpers({ did }),
+        obtainSession: async (url, body, opts) => {
             if (!_oauthConfig)
-                throw new Error('No OAuth config — cannot write to PDS');
-            if (!viewer)
-                throw new Error('Authentication required to write records');
-            return pdsCreateRecord(_oauthConfig, viewer, { collection, record, rkey: opts?.rkey });
+                throw new Error('No OAuth config — cannot obtain a session');
+            try {
+                return await obtainSession(_oauthConfig, url, body, opts);
+            }
+            catch (err) {
+                if (err instanceof ObtainSessionError)
+                    throw new InvalidRequestError(err.message, err.error);
+                throw err;
+            }
+        },
+    };
+}
+/**
+ * The PDS helpers for one account, with the session this app holds for it: the
+ * viewer's, or another account's through {@link XrpcContext.asAccount}.
+ */
+function accountHelpers(account) {
+    const ready = (what) => {
+        if (!_oauthConfig)
+            throw new Error(`No OAuth config — cannot ${what}`);
+        if (!account)
+            throw new Error(`Authentication required to ${what}`);
+        return { config: _oauthConfig, account };
+    };
+    return {
+        createRecord: async (collection, record, opts) => {
+            const { config, account } = ready('write records');
+            return pdsCreateRecord(config, account, { collection, record, rkey: opts?.rkey });
         },
         putRecord: async (collection, rkey, record) => {
-            if (!_oauthConfig)
-                throw new Error('No OAuth config — cannot write to PDS');
-            if (!viewer)
-                throw new Error('Authentication required to write records');
-            return pdsPutRecord(_oauthConfig, viewer, { collection, rkey, record });
+            const { config, account } = ready('write records');
+            return pdsPutRecord(config, account, { collection, rkey, record });
         },
         deleteRecord: async (collection, rkey) => {
-            if (!_oauthConfig)
-                throw new Error('No OAuth config — cannot write to PDS');
-            if (!viewer)
-                throw new Error('Authentication required to write records');
-            await pdsDeleteRecord(_oauthConfig, viewer, { collection, rkey });
+            const { config, account } = ready('write records');
+            await pdsDeleteRecord(config, account, { collection, rkey });
         },
         applyWrites: async (writes) => {
-            if (!_oauthConfig)
-                throw new Error('No OAuth config — cannot write to PDS');
-            if (!viewer)
-                throw new Error('Authentication required to write records');
-            return pdsApplyWrites(_oauthConfig, viewer, { writes });
+            const { config, account } = ready('write records');
+            return pdsApplyWrites(config, account, { writes });
         },
         pds: async (nsid, options) => {
-            if (!_oauthConfig)
-                throw new Error('No OAuth config — cannot call the PDS');
-            if (!viewer)
-                throw new Error('Authentication required to call the PDS');
-            return pdsXrpc(_oauthConfig, viewer, nsid, options);
+            const { config, account } = ready('call the PDS');
+            return pdsXrpc(config, account, nsid, options);
         },
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hatk/hatk",
-  "version": "0.0.1-alpha.94",
+  "version": "0.0.1-alpha.96",
   "license": "MIT",
   "bin": {
     "hatk": "dist/cli.js"
@@ -26,7 +26,8 @@
     "./config": "./dist/config.js",
     "./vite-plugin": "./dist/vite-plugin.js",
     "./renderer": "./dist/renderer.js",
-    "./spaces": "./dist/spaces/index.js"
+    "./spaces": "./dist/spaces/index.js",
+    "./classifiers": "./dist/classifiers.js"
   },
   "scripts": {
     "clean": "rm -rf dist",
@@ -50,9 +51,16 @@
     "@types/better-sqlite3": "^7.6.13",
     "@types/react": "^19.2.14",
     "@vitest/coverage-v8": "^4.1.11",
+    "sharp": "^0.35.4",
     "vite": "^8.0.0"
   },
   "peerDependencies": {
+    "sharp": "^0.35.4",
     "vite": "^8.0.0"
+  },
+  "peerDependenciesMeta": {
+    "sharp": {
+      "optional": true
+    }
   }
 }