$ show mary-ext/atcute
This monorepo provides a comprehensive TypeScript SDK for the AT Protocol (Bluesky), including client libraries, server frameworks, OAuth authentication, identity resolution, data serialization (CBOR, CAR, CID), and lexicon-driven code generation. The architecture is modular, with ~50 packages organized by domain (clients, servers, utilities, definitions, OAuth, identity, bluesky-specific features). Key entry points include the generic XRPC client (`@atcute/client`), the OAuth browser and node clients, the XRPC server framework with WebSocket support, and the lexicon CLI for generating TypeScript bindings from AT Protocol schema definitions. Data flows involve typed API calls over HTTP/WebSocket, with automatic validation, rate limiting, and caching. External dependencies include `valibot` for runtime validation, `@noble/curves` for cryptography, and platform-specific WebSocket/Fetch implementations.
The LLM identified 4 files worth highlighting for reuse:
Implements canonical CBOR encoding with deterministic key ordering (by UTF-8 byte length then bytewise comparison) and support for CID links. This is a self-contained, performance-optimized encoder that can be extracted for any project requiring deterministic CBOR output, such as content-addressed data or cryptographic hashing.
Implements canonical CBOR decoding that rejects non-canonical input (e.g., indefinite-length items, non-minimal integer encodings). Includes zero-copy retention for large byte strings and CID link detection. This decoder is reusable for any AT Protocol or IPLD-compatible data processing pipeline.
Provides a generic XRPC client with typed query/procedure/subscription calls, automatic request serialization, response parsing, and validation via `@atcute/lexicons/validations`. The `FetchHandler` abstraction decouples transport (fetch, custom handlers) and supports rate limiting, proxy headers, and multiple response formats (json, blob, bytes, stream). This pattern is reusable for any schema-driven API client.
Implements DPoP proof JWT verification, including `alg` validation, JWK thumbprint checking, nonce replay protection, and clock skew tolerance. This is a self-contained module that can be reused in any OAuth 2.0 DPoP implementation, independent of the rest of the OAuth client code.