malachite v0.11.0 / malachite-web v0.4.0

- add did:web support to identity resolution (CLI + web)
- expose @ewanc26/malachite/core subpath export
- malachite-web now depends on @ewanc26/malachite via workspace rather than aliasing raw source
- remove $core svelte alias and vite resolve overrides
- drop direct @ipld/car, @ipld/dag-cbor, multiformats deps from malachite-web (now transitive)

packages/malachite-web/package.json

···
 {
   "name": "@ewanc26/malachite-web",
   "private": true,
-  "version": "0.3.3",
+  "version": "0.4.0",
   "type": "module",
   "scripts": {
     "dev": "vite dev",
-    "prebuild": "pnpm --filter @ewanc26/tid build",
+    "prebuild": "pnpm --filter @ewanc26/malachite build",
     "build": "vite build",
     "preview": "vite preview",
     "prepare": "svelte-kit sync || echo ''",
···
     "format": "prettier --write ."
   },
   "dependencies": {
+    "@ewanc26/malachite": "workspace:*",
     "@atproto/api": "^0.18.13",
     "@atproto/common-web": "^0.4.12",
     "@atproto/oauth-client-browser": "^0.3.41",
-    "@ipld/car": "^5.3.2",
-    "@ipld/dag-cbor": "^9.2.2",
-    "@lucide/svelte": "^0.575.0",
-    "multiformats": "^13.3.1"
+    "@lucide/svelte": "^0.575.0"
   },
   "devDependencies": {
     "@sveltejs/adapter-vercel": "^6.3.1",

packages/malachite-web/src/lib/components/steps/AuthStep.svelte

···
         <input
           type="text"
           bind:value={oauthHandle}
-          placeholder="you.bsky.social"
+          placeholder="you.bsky.social or did:web:example.com"
           autocomplete="username"
           spellcheck="false"
           onkeydown={(e) => e.key === 'Enter' && !oauthLoading && oauthHandle && doOAuth()}
···
 
     <div class="form">
       <label class="field">
-        <span class="field-label">Handle</span>
+        <span class="field-label">Handle or DID</span>
         <input
           type="text"
           bind:value={handle}
-          placeholder="you.bsky.social"
+          placeholder="you.bsky.social or did:web:example.com"
           autocomplete="username"
           spellcheck="false"
         />

packages/malachite-web/src/lib/config.ts

···
-// Re-export shared constants from the environment-agnostic core.
+// Re-export shared constants from the @ewanc26/malachite package.
 // Keep this file free of side-effects so it stays tree-shakeable.
-export { RECORD_TYPE, SLINGSHOT_RESOLVER, MAX_PDS_BATCH_SIZE, POINTS_PER_RECORD } from '$core/config.js';
+export { RECORD_TYPE, SLINGSHOT_RESOLVER, MAX_PDS_BATCH_SIZE, POINTS_PER_RECORD } from '@ewanc26/malachite/core';
 
 // __WEB_VERSION__ is injected at build time by vite.config.ts → define.__WEB_VERSION__
 declare const __WEB_VERSION__: string;

packages/malachite-web/src/lib/core/auth.ts

···
 /**
- * Browser-compatible ATProto authentication.
- * No CLI prompts — credentials come from the web form.
+ * ATProto authentication — web layer.
+ * Re-exports the shared core logic (including did:web support) from
+ * @ewanc26/malachite. No browser-specific additions needed here.
  */
-
-import { Agent, AtpAgent } from '@atproto/api';
-import { SLINGSHOT_RESOLVER } from '../config.js';
-
-interface ResolvedIdentity {
-  did: string;
-  handle: string;
-  pds: string;
-}
-
-export async function resolveIdentity(identifier: string): Promise<ResolvedIdentity> {
-  const url = `${SLINGSHOT_RESOLVER}/xrpc/com.bad-example.identity.resolveMiniDoc?identifier=${encodeURIComponent(identifier)}`;
-  const res = await fetch(url);
-  if (!res.ok) {
-    throw new Error(`Failed to resolve identity: ${res.status} ${res.statusText}`);
-  }
-  const data = (await res.json()) as ResolvedIdentity;
-  if (!data.did || !data.pds) {
-    throw new Error('Invalid response from identity resolver');
-  }
-  return data;
-}
-
-export async function login(
-  identifier: string,
-  password: string,
-  pdsOverride?: string
-): Promise<Agent> {
-  if (pdsOverride) {
-    const agent = new AtpAgent({ service: pdsOverride });
-    await agent.login({ identifier, password });
-    return agent;
-  }
-
-  const identity = await resolveIdentity(identifier);
-  const agent = new AtpAgent({ service: identity.pds });
-  await agent.login({ identifier: identity.did, password });
-  return agent;
-}
+export { resolveIdentity, login } from '@ewanc26/malachite/core';
+export type { ResolvedIdentity } from '@ewanc26/malachite/core';

packages/malachite-web/src/lib/core/car-fetch.ts

···
-// Shared implementation lives in src/core/ — no duplication.
-export * from '$core/car-fetch.js';
+// Shared implementation — re-exported from the @ewanc26/malachite npm package.
+export * from '@ewanc26/malachite/core';

packages/malachite-web/src/lib/core/csv.ts

···
  * Last.fm CSV — web layer.
  * Re-exports the shared core logic and adds a browser File API loader.
  */
-import type { LastFmCsvRecord } from '$core/types.js';
-import { parseLastFmCsvContent, convertToPlayRecord } from '$core/csv.js';
+import type { LastFmCsvRecord } from '@ewanc26/malachite/core';
+import { parseLastFmCsvContent, convertToPlayRecord } from '@ewanc26/malachite/core';
 
 export { parseLastFmCsvContent, convertToPlayRecord };
 
 /** Read a browser File object and parse it as a Last.fm CSV export. */
 export async function parseLastFmFile(file: File): Promise<LastFmCsvRecord[]> {
-  const text = await file.text();
-  return parseLastFmCsvContent(text);
+  return parseLastFmCsvContent(await file.text());
 }

packages/malachite-web/src/lib/core/import.ts

···
  */
 
 import type { Agent } from '@atproto/api';
-import type { ImportMode, LogEntry, PlayRecord } from '$core/types.js';
+import type { ImportMode, LogEntry, PlayRecord } from '$lib/types.js';
 import { CLIENT_AGENT } from '../config.js';
 import { parseLastFmFile, convertToPlayRecord } from './csv.js';
 import { parseSpotifyFiles, convertSpotifyToPlayRecord } from './spotify.js';
-import { mergePlayRecords, deduplicateInputRecords, sortRecords } from '$core/merge.js';
+import { mergePlayRecords, deduplicateInputRecords, sortRecords } from '$lib/core/merge.js';
 import {
   fetchExistingRecords,
   filterNewRecords,
···
   findDuplicateGroups,
   removeDuplicateRecords,
   type ExistingRecord,
-} from '$core/sync.js';
-import { publishRecords, type PublishProgress } from '$core/publisher.js';
+} from '$lib/core/sync.js';
+import { publishRecords, type PublishProgress } from '$lib/core/publisher.js';
 
 export type { PublishProgress };
 

packages/malachite-web/src/lib/core/merge.ts

···
-// Shared implementation lives in src/core/ — no duplication.
-export * from '$core/merge.js';
+// Shared implementation — re-exported from the @ewanc26/malachite npm package.
+export * from '@ewanc26/malachite/core';

packages/malachite-web/src/lib/core/publisher.ts

···
-// Shared implementation lives in src/core/ — no duplication.
-export * from '$core/publisher.js';
+// Shared implementation — re-exported from the @ewanc26/malachite npm package.
+export * from '@ewanc26/malachite/core';

packages/malachite-web/src/lib/core/spotify.ts

···
  * Spotify JSON — web layer.
  * Re-exports the shared core logic and adds a browser File API loader.
  */
-import type { SpotifyRecord } from '$core/types.js';
-import { parseSpotifyJsonContent, convertSpotifyToPlayRecord } from '$core/spotify.js';
+import type { SpotifyRecord } from '@ewanc26/malachite/core';
+import { parseSpotifyJsonContent, convertSpotifyToPlayRecord } from '@ewanc26/malachite/core';
 
 export { parseSpotifyJsonContent, convertSpotifyToPlayRecord };
 
···
 export async function parseSpotifyFiles(files: File[]): Promise<SpotifyRecord[]> {
   let all: SpotifyRecord[] = [];
   for (const file of files) {
-    const text = await file.text();
-    const parsed = JSON.parse(text) as SpotifyRecord[];
-    all = all.concat(parsed);
+    all = all.concat(JSON.parse(await file.text()) as SpotifyRecord[]);
   }
   return parseSpotifyJsonContent(all);
 }

packages/malachite-web/src/lib/core/sync.ts

···
-// Shared implementation lives in src/core/ — no duplication.
-export * from '$core/sync.js';
+// Shared implementation — re-exported from the @ewanc26/malachite npm package.
+export * from '@ewanc26/malachite/core';

packages/malachite-web/src/lib/core/tid.ts

···
-// Shared implementation lives in src/core/ — no duplication.
+// Shared implementation — re-exported from the @ewanc26/malachite npm package.
 // src/core/tid.ts already uses globalThis.crypto which works in both Node 20+
 // and browsers, so no browser-specific shim is needed.
-export * from '$core/tid.js';
+export * from '@ewanc26/malachite/core';

packages/malachite-web/src/lib/types.ts

···
-// All shared types live in src/core/types.ts — single source of truth.
+// All shared types live in @ewanc26/malachite/core — single source of truth.
 // Re-export everything from there so the rest of the web app can import
 // from '$lib/types.js' as before without any path changes.
 export type {
···
   SpotifyRecord,
   LogLevel,
   LogEntry,
-} from '$core/types.js';
+} from '@ewanc26/malachite/core';

packages/malachite-web/svelte.config.js

···
 const config = {
   kit: {
     adapter: adapter({ runtime: 'nodejs22.x' }),
-    alias: {
-      // Shared, environment-agnostic core — single source of truth.
-      // CLI uses src/core/ directly; web imports via this alias so there is
-      // no duplicated logic.
-      $core: resolve(__dirname, '../malachite/src/core'),
-    },
   },
 };
 

packages/malachite-web/vite.config.ts

···
 import { sveltekit } from '@sveltejs/kit/vite';
 import { defineConfig } from 'vite';
 import { readFileSync } from 'fs';
-import { resolve } from 'path';
+import { resolve } from 'path'; // used for package.json reads below
 
 const webPkg = JSON.parse(readFileSync(resolve('package.json'), 'utf-8'));
 const cliPkg = JSON.parse(readFileSync(resolve('../malachite/package.json'), 'utf-8'));
···
 export default defineConfig({
 	plugins: [tailwindcss(), sveltekit()],
 
-	resolve: {
-		alias: {
-			// src/core/ files import these packages, but they live in web/node_modules.
-			// Without explicit aliases, Rollup resolves bare specifiers relative to the
-			// importing file (../src/core/) and never finds web/node_modules on Vercel.
-			'@ipld/car':      resolve('node_modules/@ipld/car'),
-			'@ipld/dag-cbor': resolve('node_modules/@ipld/dag-cbor'),
-			'@ewanc26/tid':   resolve('../tid/dist/index.js'),
-		},
-	},
-
 	server: {
 		host: '127.0.0.1',
 		port: 5173,
-		fs: {
-			allow: [
-				resolve('..') // allow workspace root
-			]
-		}
 	},
 
 	define: {
···
 
 	build: {
 		target: 'es2022',
-		chunkSizeWarningLimit: 1000
+		// The /import page chunk is large because it bundles @atproto/api, the OAuth
+		// client, and the IPLD/CAR parser — all unavoidable for an ATProto import tool.
+		// The page is client-only (ssr=false, prerender=false) so it's never on the
+		// critical path; gzipped it's ~350 kB which is acceptable.
+		chunkSizeWarningLimit: 2000
 	}
 });

packages/malachite/package.json

···
 {
   "name": "@ewanc26/malachite",
-  "version": "0.10.5",
+  "version": "0.11.0",
   "description": "Malachite - Import Last.fm and Spotify listening history to ATProto with intelligent deduplication and rate limiting",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
+  "exports": {
+    ".": "./dist/index.js",
+    "./core": {
+      "types": "./dist/core/index.d.ts",
+      "import": "./dist/core/index.js"
+    }
+  },
   "bin": {
     "malachite": "./dist/index.js"
   },

packages/malachite/src/core/auth.ts

···
 }
 
 /**
- * Resolve an AT Protocol handle or DID to its PDS URL via the Slingshot resolver.
+ * Resolve a did:web DID by fetching its DID document directly.
+ *
+ * did:web:example.com        → https://example.com/.well-known/did.json
+ * did:web:example.com:a:b   → https://example.com/a/b/did.json
+ */
+async function resolveDidWeb(did: string): Promise<ResolvedIdentity> {
+  const withoutPrefix = did.slice('did:web:'.length);
+  const parts = withoutPrefix.split(':').map(decodeURIComponent);
+  const domain = parts[0];
+
+  const url =
+    parts.length === 1
+      ? `https://${domain}/.well-known/did.json`
+      : `https://${domain}/${parts.slice(1).join('/')}/did.json`;
+
+  const res = await fetch(url);
+  if (!res.ok) {
+    throw new Error(`Failed to fetch did:web document at ${url}: ${res.status} ${res.statusText}`);
+  }
+
+  const doc = (await res.json()) as {
+    id: string;
+    alsoKnownAs?: string[];
+    service?: Array<{ id: string; type: string; serviceEndpoint: string }>;
+  };
+
+  const pdsService = doc.service?.find((s) => s.id === '#atproto_pds');
+  if (!pdsService) {
+    throw new Error(`No ATProto PDS service (#atproto_pds) found in DID document for ${did}`);
+  }
+
+  // Prefer the at:// alias as the canonical handle; fall back to the DID itself.
+  const handle =
+    doc.alsoKnownAs?.find((aka) => aka.startsWith('at://'))?.slice('at://'.length) ?? did;
+
+  return { did, handle, pds: pdsService.serviceEndpoint };
+}
+
+/**
+ * Resolve an AT Protocol handle or DID to its PDS URL.
+ *
+ * - did:web identifiers are resolved by fetching the DID document directly.
+ * - Everything else (handles and did:plc DIDs) is resolved via the Slingshot resolver.
  */
 export async function resolveIdentity(
   identifier: string,
   resolverBase = SLINGSHOT_RESOLVER
 ): Promise<ResolvedIdentity> {
+  if (identifier.startsWith('did:web:')) {
+    return resolveDidWeb(identifier);
+  }
+
   const url = `${resolverBase}/xrpc/com.bad-example.identity.resolveMiniDoc?identifier=${encodeURIComponent(identifier)}`;
   const res = await fetch(url);
   if (!res.ok) {

packages/malachite/src/core/config.ts

···
 export const MAX_PDS_BATCH_SIZE = 200;
 export const POINTS_PER_RECORD = 3;
 // Single source of truth for the version string — keep in sync with package.json.
-export const VERSION = '0.10.0';
+export const VERSION = '0.11.0';

packages/malachite/src/core/index.ts

···
+/**
+ * Public library surface for @ewanc26/malachite/core.
+ *
+ * Re-exports everything environment-agnostic from the core so that consumers
+ * (e.g. malachite-web) can import a single subpath instead of reaching into
+ * individual source modules.
+ *
+ * Note: SpotifyRecord is intentionally exported only via types.ts — spotify.ts
+ * re-declares it as a convenience export but types.ts is the canonical source,
+ * so we only pull the functions from spotify.ts to avoid a duplicate export.
+ */
+
+export * from './auth.js';
+export * from './car-fetch.js';
+export * from './config.js';
+export * from './csv.js';
+export * from './merge.js';
+export * from './publisher.js';
+export * from './rate-limit-headers.js';
+export * from './rate-limiter.js';
+export { parseSpotifyJsonContent, convertSpotifyToPlayRecord } from './spotify.js';
+export * from './sync.js';
+export * from './tid.js';
+export * from './types.js';

packages/malachite/src/lib/auth.ts

···
   ui.header('ATProto Login');
 
   if (!identifier) {
-    identifier = await prompt('Handle or DID: ');
+    identifier = await prompt('Handle, DID (did:plc or did:web): ');
   } else {
     ui.keyValue('Handle or DID', identifier);
   }

pnpm-lock.yaml

···
       '@atproto/oauth-client-browser':
         specifier: ^0.3.41
         version: 0.3.41
-      '@ipld/car':
-        specifier: ^5.3.2
-        version: 5.4.2
-      '@ipld/dag-cbor':
-        specifier: ^9.2.2
-        version: 9.2.5
+      '@ewanc26/malachite':
+        specifier: workspace:*
+        version: link:../malachite
       '@lucide/svelte':
         specifier: ^0.575.0
         version: 0.575.0(svelte@5.53.11)
-      multiformats:
-        specifier: ^13.3.1
-        version: 13.4.2
     devDependencies:
       '@sveltejs/adapter-vercel':
         specifier: ^6.3.1