chadtmiller.com/pds.js
An atproto PDS in JavaScript, for Cloudflare Workers and Node
'@pdsjs/core': minor '@pdsjs/cloudflare': patch '@pdsjs/storage-sqlite': patch '@pdsjs/readonly': patch '@pdsjs/node': patch '@pdsjs/deno': patch
Every account has an #atproto_kem key: a P-256 key published in its DID
document beside #atproto, which a space syncer uses to agree a per-request
secret with the repo host. It never signs.
New accounts get one in their genesis PLC operation, from onboarding,
scripts/setup.js and the start wizard. /init takes an optional kemKey
(32 bytes of hex) and generates one when it is left out. Migrating in stores a
fresh key for the owner to publish.
Existing accounts are backfilled at startup and hourly (Cloudflare: on the
hourly alarm). When this server's key is a rotation key and the DID's
atproto_pds endpoint is this server, the PDS publishes the key with a PLC
update; otherwise it stores the key and logs a warning to publish it by hand.
A key is kept only after it is published, so a failed publish is retried.
getRecommendedDidCredentials includes atproto_kem, and
submitPlcOperation refuses an operation whose atproto_kem is not the stored
key (Incorrect KEM key). describeServer reports spacesAlpha: true when
spaces are enabled.
ActorStoragePort gains getKemKey()/setKemKey(), and ExtensionHost
gains getKemKey(). @pdsjs/core/kem exports generateKemKey and
kemDidKey, and buildPlcOperation takes a kemDidKey.