merge

.changeset/stale-waves-protect.md

@@ -0,0 +1,5 @@
+---
+"@atproto/api": patch
+---
+
+new com.atproto.identity endpoints: resolveDid, resolveIdentity, refreshIdentity

.eslintrc

@@ -1,24 +1,48 @@
 {
   "root": true,
-  // parse TypeScript files
-  // https://github.com/typescript-eslint/typescript-eslint/tree/master/packages/parser
-  "parser": "@typescript-eslint/parser",
-  // configure eslint using options described at
-  // https://github.com/typescript-eslint/typescript-eslint/tree/master/packages/eslint-plugin
-  "plugins": ["@typescript-eslint"],
   "extends": [
     "eslint:recommended",
+    "plugin:@typescript-eslint/base",
     "plugin:@typescript-eslint/eslint-recommended",
     "plugin:@typescript-eslint/recommended",
     "plugin:prettier/recommended",
-    "prettier"
+    "plugin:import/recommended",
+    "plugin:import/typescript"
   ],
+  "plugins": ["n"],
   "ignorePatterns": ["dist", "node_modules"],
   "rules": {
     "no-var": "error",
     "prefer-const": "warn",
     "no-misleading-character-class": "warn",
     "eqeqeq": ["error", "always", { "null": "ignore" }],
+    "n/global-require": "error",
+    "n/no-extraneous-import": "error",
+    "n/prefer-node-protocol": "error",
+    "import/extensions": ["off", "ignorePackages"],
+    "import/export": "off",
+    "import/namespace": "off",
+    "import/no-deprecated": "error",
+    "import/no-absolute-path": "error",
+    "import/no-dynamic-require": "error",
+    "import/no-self-import": "error",
+    "import/order": [
+      "error",
+      {
+        "named": true,
+        "distinctGroup": true,
+        "alphabetize": { "order": "asc" },
+        "newlines-between": "never",
+        "groups": [
+          "builtin",
+          "external",
+          "internal",
+          "parent",
+          ["index", "sibling"],
+          "object"
+        ]
+      }
+    ],
     "@typescript-eslint/no-unused-vars": [
       "warn",
       { "argsIgnorePattern": "^_", "varsIgnorePattern": "^_" }
@@ -43,6 +67,33 @@
       "rules": {
         "@typescript-eslint/no-var-requires": "off"
       }
+    },
+    {
+      "files": ["**/*.test.ts", "**/tests/**/*.ts"],
+      "rules": {
+        "n/no-extraneous-import": [
+          "error",
+          { "allowModules": ["@atproto/dev-env"] }
+        ]
+      }
+    }
+  ],
+  "settings": {
+    "node": { "version": ">=18.7.0" },
+    "import/internal-regex": "^@atproto(?:-labs)?/",
+    "import/parsers": { "@typescript-eslint/parser": [".ts", ".tsx"] },
+    "import/resolver": {
+      "typescript": {
+        "project": [
+          "tsconfig.json",
+          "packages/oauth/*/tsconfig.json",
+          "packages/internal/*/tsconfig.json",
+          "packages/*/tsconfig.json"
+        ]
+      },
+      "node": {
+        "extensions": [".js", ".jsx", ".json"]
+      }
     }
-  ]
+  }
 }

.github/workflows/build-and-push-bsky-aws.yaml

@@ -12,7 +12,7 @@ env:
 jobs:
   bsky-container-aws:
     if: github.repository == 'bluesky-social/atproto'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     permissions:
       contents: read
       packages: write

.github/workflows/build-and-push-bsky-ghcr.yaml

@@ -3,6 +3,7 @@ on:
   push:
     branches:
       - main
+      - divy/etcd-dp-host-list
 env:
   REGISTRY: ghcr.io
   USERNAME: ${{ github.actor }}
@@ -14,7 +15,7 @@ env:
 jobs:
   bsky-container-ghcr:
     if: github.repository == 'bluesky-social/atproto'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     permissions:
       contents: read
       packages: write

.github/workflows/build-and-push-bsync-aws.yaml

@@ -12,7 +12,7 @@ env:
 jobs:
   bsync-container-aws:
     if: github.repository == 'bluesky-social/atproto'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     permissions:
       contents: read
       packages: write

.github/workflows/build-and-push-bsync-ghcr.yaml

@@ -14,7 +14,7 @@ env:
 jobs:
   bsync-container-ghcr:
     if: github.repository == 'bluesky-social/atproto'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     permissions:
       contents: read
       packages: write

.github/workflows/build-and-push-ozone-aws.yaml

@@ -13,7 +13,7 @@ env:
 jobs:
   ozone-container-aws:
     if: github.repository == 'bluesky-social/atproto'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     permissions:
       contents: read
       packages: write

.github/workflows/build-and-push-ozone-ghcr.yaml

@@ -14,7 +14,7 @@ env:
 jobs:
   ozone-container-ghcr:
     if: github.repository == 'bluesky-social/atproto'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     permissions:
       contents: read
       packages: write

.github/workflows/build-and-push-pds-aws.yaml

@@ -12,7 +12,7 @@ env:
 jobs:
   pds-container-aws:
     if: github.repository == 'bluesky-social/atproto'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     permissions:
       contents: read
       packages: write

.github/workflows/build-and-push-pds-ghcr.yaml

@@ -15,7 +15,7 @@ env:
 jobs:
   pds-container-ghcr:
     if: github.repository == 'bluesky-social/atproto'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     permissions:
       contents: read
       packages: write

.github/workflows/publish.yaml

@@ -13,7 +13,7 @@ jobs:
   build:
     name: Build & Publish
     if: github.repository == 'bluesky-social/atproto'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     permissions:
       contents: write
       pull-requests: write

.github/workflows/repo.yaml

@@ -12,7 +12,7 @@ concurrency:
 jobs:
   build:
     name: Build
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
       - run: corepack enable && corepack prepare --activate
@@ -42,7 +42,7 @@ jobs:
     strategy:
       matrix:
         shard: [1/8, 2/8, 3/8, 4/8, 5/8, 6/8, 7/8, 8/8]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
       - run: corepack enable && corepack prepare --activate
@@ -66,7 +66,7 @@ jobs:
   verify:
     name: Verify
     needs: build
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
       - run: corepack enable && corepack prepare --activate

.gitignore

@@ -5,12 +5,12 @@ yarn-error.log
 packages/**/dist
 .idea
 packages/*/coverage
-.vscode/
 test.sqlite
 .DS_Store
 *.log
 *.tsbuildinfo
 .*.env
+.env.*
 .env
 \#*\#
 *~

.prettierignore

@@ -1,12 +1,14 @@
 node_modules
 interop-test-files
+__snapshots__
 dist
-build
-.nyc_output
-coverage
 pnpm-lock.yaml
 .pnpm*
 .changeset
-*.d.ts
-packages/bsky/src/data-plane/gen
 CHANGELOG.md
+
+# Prettier is used to format the code during codegen
+packages/api/src/client
+packages/bsky/src/lexicon
+packages/pds/src/lexicon
+packages/ozone/src/lexicon

.prettierrc

@@ -9,6 +9,13 @@
       "options": {
         "singleQuote": false
       }
+    },
+    {
+      "files": [".eslintrc"],
+      "options": {
+        "parser": "json",
+        "trailingComma": "none"
+      }
     }
   ]
 }

.vscode/extensions.json

@@ -0,0 +1,8 @@
+{
+  "recommendations": [
+    "dbaeumer.vscode-eslint",
+    "wengerk.highlight-bad-chars",
+    "esbenp.prettier-vscode",
+    "streetsidesoftware.code-spell-checker"
+  ]
+}

.vscode/settings.json

@@ -0,0 +1,50 @@
+{
+  "cSpell.language": "en,en-US",
+  "cSpell.userWords": [
+    "algs",
+    "appview",
+    "atproto",
+    "blockstore",
+    "bluesky",
+    "bsky",
+    "bsync",
+    "clsx",
+    "consolas",
+    "dpop",
+    "googleusercontent",
+    "hexeditor",
+    "ingester",
+    "insertable",
+    "jwks",
+    "keypair",
+    "kysely",
+    "merkle",
+    "msid",
+    "multibase",
+    "multiformats",
+    "nameserver",
+    "oidc",
+    "pkce",
+    "ponyfill",
+    "proxied",
+    "ssrf",
+    "undici",
+    "webcrypto",
+    "whatwg",
+    "xrpc"
+  ],
+  "editor.codeActionsOnSave": {
+    "source.fixAll.eslint": "explicit",
+    "source.sortImports": "never"
+  },
+  "files.associations": {
+    "**/tsconfig/*.json": "jsonc"
+  },
+  "files.defaultLanguage": "ts",
+  "files.insertFinalNewline": true,
+  "files.trimTrailingWhitespace": true,
+  "prettier.semi": false,
+  "prettier.singleQuote": true,
+  "prettier.trailingComma": "es5",
+  "typescript.tsdk": "node_modules/typescript/lib"
+}

CONTRIBUTORS.md

@@ -19,3 +19,7 @@ ATProto receives so many contributions that we could never list everyone who des
 #### [goeo\_](https://bsky.app/profile/did:web:genco.me), Security disclosure, May 2024
 
 #### [DavidBuchanan314](https://github.com/DavidBuchanan314), Security disclosure, November 2024
+
+#### [daniel](https://hackerone.com/daniel), Security disclosure, November 2024
+
+#### [imax](https://github.com/imax9000), Security disclosure, January 2025

LICENSE.txt

@@ -1,6 +1,6 @@
 Dual MIT/Apache-2.0 License
 
-Copyright (c) 2022-2024 Bluesky PBC, and Contributors
+Copyright (c) 2022-2025 Bluesky PBC, and Contributors
 
 Except as otherwise noted in individual files, this software is licensed under the MIT license (<http://opensource.org/licenses/MIT>), or the Apache License, Version 2.0 (<http://www.apache.org/licenses/LICENSE-2.0>).
 

Makefile

@@ -28,12 +28,7 @@ run-dev-env-logged: ## Run a "development environment" shell (with logging)
 
 .PHONY: codegen
 codegen: ## Re-generate packages from lexicon/ files
-	cd packages/api; pnpm run codegen
-	cd packages/pds; pnpm run codegen
-	cd packages/bsky; pnpm run codegen
-	cd packages/ozone; pnpm run codegen
-	# clean up codegen output
-	pnpm format
+	pnpm codegen
 
 .PHONY: lint
 lint: ## Run style checks and verify syntax
@@ -43,6 +38,10 @@ lint: ## Run style checks and verify syntax
 fmt: ## Run syntax re-formatting
 	pnpm format
 
+.PHONY: fmt-lexicons
+fmt-lexicons: ## Run syntax re-formatting, just on .json files
+	pnpm exec eslint ./lexicons/ --ext .json --fix
+
 .PHONY: deps
 deps: ## Installs dependent libs using 'pnpm install'
 	pnpm install --frozen-lockfile