@takosjp/yurucommu-core 3.0.3 → 3.2.1

package/src/backend/routes/auth.ts

@@ -40,6 +40,7 @@ import {
   rotateSession,
 } from "./auth-helpers.ts";
 import { logger } from "../lib/logger.ts";
+import { rawSessionCredential } from "../lib/session-actor.ts";
 
 const log = logger.child({ component: "auth" });
 
@@ -75,12 +76,20 @@ auth.get("/providers", async (c) => {
   });
 });
 
+function mobileSessionResponse(sessionId: string) {
+  return {
+    access_token: sessionId,
+    token_type: "Bearer",
+    expires_in: 30 * 24 * 60 * 60,
+  };
+}
+
 // 現在のユーザー情報
 auth.get("/me", async (c) => {
   const actor = c.get("actor");
   if (!actor) return c.json({ error: "Not authenticated" }, 401);
 
-  const sessionId = getCookie(c, "session");
+  const sessionId = rawSessionCredential(c);
   let provider: string | null = null;
   let hasTakosAccess = false;
 
@@ -206,6 +215,119 @@ auth.post("/login", async (c) => {
   return c.json({ success: true });
 });
 
+// Native password authentication. The credential is a host-owned session,
+// not the password itself and not a browser cookie, so Tauri/native clients can
+// call the same API safely from any app origin.
+auth.post("/mobile/login", async (c) => {
+  const config = getAuthConfig(c.env);
+  if (!config.passwordEnabled) {
+    return c.json({ error: "Password auth not enabled" }, 400);
+  }
+
+  const clientIp = getClientIP(c);
+  const lockoutKey = `password:${clientIp}`;
+  const lockoutStatus = await getLoginLockoutStatus(c.env.KV, lockoutKey);
+  if (lockoutStatus.locked) {
+    c.header("Retry-After", String(lockoutStatus.retryAfterSeconds));
+    return c.json(lockoutErrorResponse(lockoutStatus.retryAfterSeconds), 429);
+  }
+
+  const body = await parseJsonObject(c);
+  const password = body ? parseNonEmptyString(body.password) : undefined;
+  if (!password) {
+    return c.json({ error: "password is required", code: "BAD_REQUEST" }, 400);
+  }
+  const isValid = c.env.AUTH_PASSWORD_HASH?.trim()
+    ? await verifyBootstrapOrPassword(password, c.env.AUTH_PASSWORD_HASH)
+    : false;
+  if (!isValid) {
+    const failedStatus = await recordFailedLoginAttempt(c.env.KV, lockoutKey);
+    if (failedStatus.locked) {
+      c.header("Retry-After", String(failedStatus.retryAfterSeconds));
+      return c.json(lockoutErrorResponse(failedStatus.retryAfterSeconds), 429);
+    }
+    return c.json({ error: "Invalid password" }, 401);
+  }
+
+  const db = c.get("db");
+  const actorData =
+    (await db
+      .select()
+      .from(actors)
+      .where(and(eq(actors.role, "owner"), notDeleted(actors)))
+      .get()) ??
+    (await createActor(db, c.env, {
+      username: "tako",
+      name: "tako",
+      takosUserId: "password:owner",
+      role: "owner",
+    }));
+  const sessionId = await rotateSession(
+    c,
+    actorData.apId,
+    null,
+    null,
+    c.env.ENCRYPTION_KEY,
+    "mobile password login rotation",
+    { setCookie: false },
+  );
+  await clearLoginLockout(c.env.KV, lockoutKey);
+  return c.json(mobileSessionResponse(sessionId));
+});
+
+// Exchange a verified native OIDC ID token for the same host-owned session
+// used by password login. This keeps product APIs independent from the
+// operator's token format and makes session revocation host-local.
+auth.post("/mobile/oidc", async (c) => {
+  const provider = getProvider(c.env, "takos");
+  if (!provider?.issuer || !provider.jwksUrl) {
+    return c.json({ error: "OIDC auth not enabled" }, 400);
+  }
+  const body = await parseJsonObject(c);
+  const idToken = body ? parseNonEmptyString(body.id_token) : undefined;
+  if (!idToken) {
+    return c.json({ error: "id_token is required", code: "BAD_REQUEST" }, 400);
+  }
+
+  try {
+    const { clientId } = getClientCredentials(c.env, "takos");
+    const claims = await verifyOidcIdToken(idToken, {
+      issuer: provider.issuer,
+      clientId,
+      jwksUrl: provider.jwksUrl,
+    });
+    const actorData = await findOrCreateOAuthActor(
+      c.get("db"),
+      c.env,
+      "takos",
+      {
+        id: claims.sub,
+        name:
+          claims.name ?? claims.preferred_username ?? claims.email ?? "user",
+        email: claims.email,
+        username: claims.preferred_username,
+      },
+    );
+    if (!actorData) return c.json({ error: "actor_creation_failed" }, 403);
+    const sessionId = await rotateSession(
+      c,
+      actorData.apId,
+      "takos",
+      null,
+      c.env.ENCRYPTION_KEY,
+      "mobile oidc login rotation",
+      { setCookie: false },
+    );
+    return c.json(mobileSessionResponse(sessionId));
+  } catch (error) {
+    log.warn("Mobile OIDC exchange failed", {
+      event: "auth.mobile.oidc_exchange_failed",
+      error,
+    });
+    return c.json({ error: "invalid_id_token" }, 401);
+  }
+});
+
 // OAuth: 認証開始
 auth.get("/login/:provider", async (c) => {
   const providerId = c.req.param("provider");
@@ -388,7 +510,7 @@ auth.get("/callback/:provider", async (c) => {
 
 // ログアウト
 auth.post("/logout", async (c) => {
-  const sessionId = getCookie(c, "session");
+  const sessionId = rawSessionCredential(c);
   if (sessionId) {
     await deleteSessionSafely(c.get("db"), c.env, sessionId, "logout");
     deleteCookie(c, "session");

package/src/backend/routes/communities/messages.ts

@@ -1,15 +1,26 @@
 import { Hono } from "hono";
-import { and, desc, eq, isNull, sql } from "drizzle-orm";
+import { and, desc, eq, isNull, ne, sql } from "drizzle-orm";
 import {
   activities,
   communities,
   communityMembers,
+  dmCommunityReadStatus,
+  notificationPushers,
+  notificationPushJobs,
   objectRecipients,
   objects,
 } from "../../../db/index.ts";
 import type { Env, Variables } from "../../types.ts";
-import { formatUsername, generateId } from "../../federation-helpers.ts";
+import {
+  formatUsername,
+  generateId,
+  safeJsonParse,
+} from "../../federation-helpers.ts";
 import { feedCursorWhere } from "../../lib/feed-cursor.ts";
+import {
+  type ChatAttachment,
+  validateChatAttachments,
+} from "../../lib/attachments.ts";
 import { communityRequiresMembership } from "../../lib/community-visibility.ts";
 import { rateLimit, RateLimitConfigs } from "../../middleware/rate-limit.ts";
 import {
@@ -27,6 +38,9 @@ import {
 
 const MAX_COMMUNITY_MESSAGE_LENGTH = 5000;
 const MAX_COMMUNITY_MESSAGES_LIMIT = 100;
+// Cap the per-member read receipts returned alongside a page so a very large
+// community's chat reader stays bounded regardless of local-member count.
+const MAX_COMMUNITY_READ_STATES = 200;
 
 // D1's batch() (atomic multi-statement) is only on the concrete D1/libsql
 // driver, not the shared `Database` union; reach it through a narrow cast.
@@ -151,6 +165,7 @@ messagesRouter.get("/:identifier/messages", async (c) => {
       apId: objects.apId,
       attributedTo: objects.attributedTo,
       content: objects.content,
+      attachmentsJson: objects.attachmentsJson,
       published: objects.published,
     })
     .from(objectRecipients)
@@ -176,11 +191,42 @@ messagesRouter.get("/:identifier/messages", async (c) => {
         icon_url: senderInfo?.iconUrl || null,
       },
       content: msg.content,
+      attachments: safeJsonParse<ChatAttachment[]>(msg.attachmentsJson, []),
       created_at: msg.published,
     };
   });
 
-  return c.json({ messages: result, has_more: hasMore });
+  // Per-member read positions (LOCAL-ONLY read receipts): rows exist only for
+  // local members that marked the chat read — read state is never federated,
+  // so remote members simply never appear here. Restricted to CURRENT members
+  // so a kicked member's stale row doesn't leak into the read count, and capped
+  // (most-recently-read first) so a huge community can't return an unbounded
+  // receipt list on every page fetch.
+  const readStates = await db
+    .select({
+      actorApId: dmCommunityReadStatus.actorApId,
+      lastReadAt: dmCommunityReadStatus.lastReadAt,
+    })
+    .from(dmCommunityReadStatus)
+    .innerJoin(
+      communityMembers,
+      and(
+        eq(communityMembers.communityApId, dmCommunityReadStatus.communityApId),
+        eq(communityMembers.actorApId, dmCommunityReadStatus.actorApId),
+      ),
+    )
+    .where(eq(dmCommunityReadStatus.communityApId, community.apId))
+    .orderBy(desc(dmCommunityReadStatus.lastReadAt))
+    .limit(MAX_COMMUNITY_READ_STATES);
+
+  return c.json({
+    messages: result,
+    has_more: hasMore,
+    read_states: readStates.map((r) => ({
+      actor_ap_id: r.actorApId,
+      last_read_at: r.lastReadAt,
+    })),
+  });
 });
 
 // POST /api/communities/:name/messages - Send a chat message
@@ -196,14 +242,31 @@ messagesRouter.post(
     const db = c.get("db");
     const baseUrl = c.env.APP_URL;
     const apId = resolveCommunityApId(baseUrl, identifier);
-    const body = await c.req.json<{ content: string }>();
-
-    // Guard non-string content before .trim() (else TypeError → 500).
-    if (typeof body.content !== "string") {
+    const body = await c.req.json<{
+      content?: string;
+      attachments?: unknown;
+    }>();
+
+    const attachmentsResult = validateChatAttachments(body.attachments);
+    if (!attachmentsResult.ok) {
+      return c.json({ error: attachmentsResult.error }, 400);
+    }
+    const attachments = attachmentsResult.attachments;
+
+    // Guard non-string content before .trim() (else TypeError → 500). An
+    // attachment-only message (image send) carries no text.
+    const rawContent = body.content;
+    if (
+      typeof rawContent !== "string" &&
+      !(
+        attachments.length > 0 &&
+        (rawContent === undefined || rawContent === null)
+      )
+    ) {
       return c.json({ error: "Message content is required" }, 400);
     }
-    const content = body.content.trim();
-    if (!content) {
+    const content = typeof rawContent === "string" ? rawContent.trim() : "";
+    if (!content && attachments.length === 0) {
       return c.json({ error: "Message content is required" }, 400);
     }
     if (content.length > MAX_COMMUNITY_MESSAGE_LENGTH) {
@@ -257,6 +320,54 @@ messagesRouter.post(
     const activityId = generateId();
     const activityApIdVal = `${baseUrl}/ap/activities/${activityId}`;
 
+    // Community talk deliberately has no social-inbox row, so its durable push
+    // jobs must commit with the message itself. Resolve only members that own a
+    // Yurume pusher at event time; delivery re-checks membership before egress.
+    const pushRecipients = await db
+      .selectDistinct({ actorApId: notificationPushers.actorApId })
+      .from(notificationPushers)
+      .innerJoin(
+        communityMembers,
+        eq(communityMembers.actorApId, notificationPushers.actorApId),
+      )
+      .where(
+        and(
+          eq(communityMembers.communityApId, community.apId),
+          eq(notificationPushers.product, "yurume"),
+          ne(notificationPushers.actorApId, actor.ap_id),
+        ),
+      );
+    const pushJobStatements: unknown[] = [];
+    // D1 caps bound parameters at 100. Keep each multi-row insert below that
+    // limit while retaining every insert in the same atomic batch.
+    const pushJobBatchSize = 8;
+    for (
+      let offset = 0;
+      offset < pushRecipients.length;
+      offset += pushJobBatchSize
+    ) {
+      pushJobStatements.push(
+        db
+          .insert(notificationPushJobs)
+          .values(
+            pushRecipients
+              .slice(offset, offset + pushJobBatchSize)
+              .map(({ actorApId }) => ({
+                id: `${actorApId}\n${activityApIdVal}`,
+                actorApId,
+                activityApId: activityApIdVal,
+                product: "yurume",
+                status: "pending",
+                attempts: 0,
+                nextAttemptAt: now,
+                createdAt: now,
+                updatedAt: now,
+              })),
+          )
+          .onConflictDoNothing(),
+      );
+    }
+
     // Persist the chat message atomically: the Note, its community-audience
     // recipient row (which the GET-messages reader joins on), the Create
     // activity, and the community's lastMessageAt. D1 has no interactive
@@ -270,6 +381,7 @@ messagesRouter.post(
         type: "Note",
         attributedTo: actor.ap_id,
         content,
+        attachmentsJson: JSON.stringify(attachments),
         toJson,
         audienceJson,
         visibility: "unlisted",
@@ -293,6 +405,7 @@ messagesRouter.post(
         .update(communities)
         .set({ lastMessageAt: now })
         .where(eq(communities.apId, community.apId)),
+      ...pushJobStatements,
     ]);
 
     return c.json(
@@ -307,6 +420,7 @@ messagesRouter.post(
             icon_url: actor.icon_url,
           },
           content,
+          attachments,
           created_at: now,
         },
       },

package/src/backend/routes/dm/contacts.ts

@@ -23,6 +23,7 @@ import {
 } from "../../../db/index.ts";
 import { formatUsername } from "../../federation-helpers.ts";
 import { chunkForInClause } from "../../lib/chunk.ts";
+import { yurumeUnreadCounts } from "../../lib/unread-counts.ts";
 import {
   buildActorInfoMap,
   byTimeDesc,
@@ -476,50 +477,11 @@ contacts.get("/unread/count", async (c) => {
   const actor = c.get("actor");
   if (!actor) return c.json({ error: "Unauthorized" }, 401);
   const db = c.get("db");
-  const me = actor.ap_id;
-
-  const dmRow = await db.get<{ c: number }>(sql`
-    SELECT COUNT(*) AS c
-    FROM objects o
-    JOIN object_recipients orp
-      ON orp.object_ap_id = o.ap_id
-      AND orp.recipient_ap_id = ${me}
-      AND orp.type = 'to'
-    LEFT JOIN dm_read_status r
-      ON r.conversation_id = o.conversation
-      AND r.actor_ap_id = ${me}
-    WHERE o.visibility = 'direct'
-      AND o.type = 'Note'
-      AND o.conversation IS NOT NULL
-      AND o.attributed_to != ${me}
-      AND o.published > COALESCE(r.last_read_at, '1970-01-01T00:00:00Z')
-      AND o.conversation NOT IN (
-        SELECT conversation_id FROM dm_archived_conversations
-        WHERE actor_ap_id = ${me}
-      )
-  `);
-
-  const communityRow = await db.get<{ c: number }>(sql`
-    SELECT COUNT(*) AS c
-    FROM community_members cm
-    JOIN object_recipients orp
-      ON orp.recipient_ap_id = cm.community_ap_id
-      AND orp.type = 'audience'
-    JOIN objects o
-      ON o.ap_id = orp.object_ap_id
-      AND o.type = 'Note'
-      AND o.community_ap_id IS NULL
-      AND o.attributed_to != ${me}
-    LEFT JOIN dm_community_read_status r
-      ON r.community_ap_id = cm.community_ap_id
-      AND r.actor_ap_id = ${me}
-    WHERE cm.actor_ap_id = ${me}
-      AND o.published > COALESCE(r.last_read_at, cm.joined_at, '1970-01-01T00:00:00Z')
-  `);
-
-  const dm = Number(dmRow?.c ?? 0);
-  const community = Number(communityRow?.c ?? 0);
-  return c.json({ total: dm + community, dm, community });
+
+  // Single owner of the DM + community-chat unread SQL (lib/unread-counts.ts),
+  // shared with the notification push payload's badge so the two cannot drift.
+  const { total, dm, community } = await yurumeUnreadCounts(db, actor.ap_id);
+  return c.json({ total, dm, community });
 });
 
 export default contacts;

package/src/backend/routes/dm/messages.ts

@@ -10,6 +10,7 @@ import {
   actorCache,
   actors,
   blocks,
+  dmReadStatus,
   inbox as inboxTable,
   objectRecipients,
   objects,
@@ -35,6 +36,8 @@ import {
 } from "./query-helpers.ts";
 import { enqueueDeliveryToActor } from "../../lib/delivery/queue.ts";
 import { feedCursorWhere } from "../../lib/feed-cursor.ts";
+import { toApAttachments } from "../../lib/activitypub-helpers.ts";
+import { validateChatAttachments } from "../../lib/attachments.ts";
 import { logger } from "../../lib/logger.ts";
 
 const log = logger.child({ component: "dm.messages" });
@@ -90,19 +93,28 @@ type DmMessageResponse = {
   created_at: string | null;
 };
 
-/** Validate trimmed DM content; returns the trimmed string or an error response. */
+/**
+ * Validate trimmed DM content; returns the trimmed string or an error response.
+ * With `allowEmpty` (an attachment-only message) an empty/absent content is
+ * accepted and normalized to "".
+ */
 function validateContent(
   raw: unknown,
+  allowEmpty = false,
 ): string | { error: string; status: 400 } {
   // The json<{content:string}>() cast is compile-time only; a client can send a
   // non-string. Guard before .trim() else TypeError → 500 (the global handler
   // deliberately does not mask TypeError as 400). Mirrors the profile/post/invite
   // validators.
   if (typeof raw !== "string") {
+    if (allowEmpty && (raw === undefined || raw === null)) return "";
     return { error: "Message content is required", status: 400 };
   }
   const content = raw.trim();
-  if (!content) return { error: "Message content is required", status: 400 };
+  if (!content) {
+    if (allowEmpty) return "";
+    return { error: "Message content is required", status: 400 };
+  }
   if (content.length > MAX_DM_CONTENT_LENGTH) {
     return {
       error: `Message too long (max ${MAX_DM_CONTENT_LENGTH} chars)`,
@@ -334,6 +346,7 @@ function dmNoteInsert(
     apId: string;
     actorApId: string;
     content: string;
+    attachments: Attachment[];
     toJson: string;
     conversationId: string;
     published: string;
@@ -344,6 +357,7 @@ function dmNoteInsert(
     type: "Note",
     attributedTo: data.actorApId,
     content: data.content,
+    attachmentsJson: JSON.stringify(data.attachments),
     visibility: "direct",
     toJson: data.toJson,
     ccJson: JSON.stringify([]),
@@ -380,10 +394,27 @@ dm.get("/user/:encodedApId/messages", async (c) => {
     limit,
     before,
   );
+
+  // The partner's read position (LOCAL-ONLY read receipt): the row only exists
+  // when the other participant is a local account that opened the thread —
+  // read state is never federated, so a remote partner stays null ("unknown")
+  // rather than "unread".
+  const partnerRead = await db
+    .select({ lastReadAt: dmReadStatus.lastReadAt })
+    .from(dmReadStatus)
+    .where(
+      and(
+        eq(dmReadStatus.actorApId, otherApId),
+        eq(dmReadStatus.conversationId, conversationId),
+      ),
+    )
+    .get();
+
   return c.json({
     messages,
     conversation_id: conversationId,
     has_more: hasMore,
+    partner_last_read_at: partnerRead?.lastReadAt ?? null,
   });
 });
 
@@ -394,10 +425,20 @@ dm.post("/user/:encodedApId/messages", async (c) => {
 
   const db = c.get("db");
   const otherApId = decodeURIComponent(c.req.param("encodedApId"));
-  const body = await c.req.json<{ content: string }>();
+  const body = await c.req.json<{
+    content?: string;
+    attachments?: unknown;
+  }>();
   const baseUrl = c.env.APP_URL;
 
-  const contentOrError = validateContent(body.content);
+  const attachmentsResult = validateChatAttachments(body.attachments);
+  if (!attachmentsResult.ok) {
+    return c.json({ error: attachmentsResult.error }, 400);
+  }
+  const attachments = attachmentsResult.attachments as Attachment[];
+
+  // An attachment-only message (LINE-style image send) carries no text.
+  const contentOrError = validateContent(body.content, attachments.length > 0);
   if (typeof contentOrError !== "string") {
     return c.json({ error: contentOrError.error }, contentOrError.status);
   }
@@ -466,6 +507,9 @@ dm.post("/user/:encodedApId/messages", async (c) => {
   const mentionTag = [
     { type: "Mention", href: otherApId, name: recipientName },
   ];
+  // Media is stored as an app-relative /media path; absolutize (and strip the
+  // internal r2_key) for the federated copy so the remote can fetch it.
+  const apAttachments = toApAttachments(attachments, baseUrl);
   const remoteCreateActivity = !isRecipientLocal
     ? {
         "@context": "https://www.w3.org/ns/activitystreams",
@@ -480,6 +524,7 @@ dm.post("/user/:encodedApId/messages", async (c) => {
           attributedTo: actor.ap_id,
           to: [otherApId],
           content,
+          ...(apAttachments.length > 0 ? { attachment: apAttachments } : {}),
           published: now,
           conversation: conversationId,
           tag: mentionTag,
@@ -498,6 +543,7 @@ dm.post("/user/:encodedApId/messages", async (c) => {
     apId,
     actorApId: actor.ap_id,
     content,
+    attachments,
     toJson,
     conversationId,
     published: now,
@@ -560,6 +606,7 @@ dm.post("/user/:encodedApId/messages", async (c) => {
         id: apId,
         sender: buildSenderFromActor(actor),
         content,
+        attachments,
         created_at: now,
       },
       conversation_id: conversationId,

package/src/backend/routes/notification-pushers.ts

@@ -0,0 +1,93 @@
+import { Hono } from "hono";
+
+import type { Env, Variables } from "../types.ts";
+import { requireActor } from "./actors-helpers.ts";
+import { parseJsonObject } from "../lib/parse-helpers.ts";
+import {
+  normalizeGatewayUrl,
+  parseNotificationPusherDeleteRequest,
+  parseNotificationPusherSetRequest,
+} from "../lib/notification-pusher-contract.ts";
+import {
+  deleteNotificationPusher,
+  isNotificationGatewayAllowed,
+  registerNotificationPusher,
+} from "../lib/notification-push.ts";
+
+const pushers = new Hono<{ Bindings: Env; Variables: Variables }>();
+
+pushers.get("/config", (c) => {
+  const actor = requireActor(c);
+  if (actor instanceof Response) return actor;
+
+  const configuredGateway = normalizeGatewayUrl(
+    c.env.YURUCOMMU_NOTIFICATION_PUSH_GATEWAY_URL,
+  );
+  const gatewayUrl =
+    configuredGateway && isNotificationGatewayAllowed(c.env, configuredGateway)
+      ? configuredGateway
+      : null;
+  const configuredPublicKey =
+    c.env.YURUCOMMU_NOTIFICATION_PUSH_WEB_PUSH_PUBLIC_KEY?.trim() ?? "";
+  const webPushPublicKey = normalizeWebPushPublicKey(configuredPublicKey);
+
+  return c.json({
+    gateway_url: gatewayUrl,
+    web_push_public_key: webPushPublicKey,
+  });
+});
+
+pushers.post("/", async (c) => {
+  const actor = requireActor(c);
+  if (actor instanceof Response) return actor;
+  const body = await parseJsonObject(c);
+  if (!body) {
+    return c.json({ code: "BAD_REQUEST", error: "Invalid request body" }, 400);
+  }
+  const parsed = parseNotificationPusherSetRequest(body);
+  if (!parsed.ok) return c.json(parsed.error, 400);
+  if (!isNotificationGatewayAllowed(c.env, parsed.value.gatewayUrl)) {
+    return c.json(
+      {
+        code: "BAD_REQUEST",
+        error: "pusher.data.url is not allowed by this server",
+        field: "pusher.data.url",
+      },
+      400,
+    );
+  }
+  const pusher = await registerNotificationPusher(
+    c.get("db"),
+    actor,
+    parsed.value,
+  );
+  return c.json({ pusher });
+});
+
+pushers.delete("/", async (c) => {
+  const actor = requireActor(c);
+  if (actor instanceof Response) return actor;
+  const body = await parseJsonObject(c);
+  if (!body) {
+    return c.json({ code: "BAD_REQUEST", error: "Invalid request body" }, 400);
+  }
+  const parsed = parseNotificationPusherDeleteRequest(body);
+  if (!parsed.ok) return c.json(parsed.error, 400);
+  await deleteNotificationPusher(c.get("db"), actor, parsed.value);
+  return c.json({ deleted: true as const });
+});
+
+export default pushers;
+
+function normalizeWebPushPublicKey(value: string): string | null {
+  if (!/^[A-Za-z0-9_-]{87}$/.test(value)) return null;
+  try {
+    const padded = value.replace(/-/g, "+").replace(/_/g, "/") + "=";
+    const decoded = Uint8Array.from(atob(padded), (character) =>
+      character.charCodeAt(0),
+    );
+    return decoded.byteLength === 65 && decoded[0] === 0x04 ? value : null;
+  } catch {
+    return null;
+  }
+}