refactor(lexicon): use bytes instead of base64 strings

deno.lock

···
     "npm:@atcute/atproto@^3.1.9": "3.1.9",
     "npm:@atcute/client@^4.0.5": "4.0.5",
     "npm:@atcute/jetstream@^1.1.2": "1.1.2",
+    "npm:@atcute/lex-cli@*": "2.3.1",
     "npm:@atcute/lex-cli@^2.3.1": "2.3.1",
     "npm:@atcute/lexicons@^1.2.2": "1.2.2",
     "npm:@atcute/tid@^1.0.3": "1.0.3",

packages/consumer/mod.test.ts

···
 import type { Client, CredentialManager } from "@atcute/client";
 import type { Did, Handle, ResourceUri } from "@atcute/lexicons";
 import { now } from "@atcute/tid";
+import type { AppCisternLexiconItem } from "@cistern/lexicon";
 
 // Helper to create a mock Consumer instance
 function createMockConsumer(
···
                   value: {
                     $type: "app.cistern.lexicon.item",
                     tid: testTid,
-                    ciphertext: encrypted.cipherText,
-                    nonce: encrypted.nonce,
+                    ciphertext: { $bytes: encrypted.cipherText },
+                    nonce: { $bytes: encrypted.nonce },
                     algorithm: "x_wing-xchacha20_poly1305-sha3_512",
                     pubkey: "at://did:plc:test/app.cistern.lexicon.pubkey/key1",
-                    payload: encrypted.content,
+                    payload: { $bytes: encrypted.content },
                     contentLength: encrypted.length,
-                    contentHash: encrypted.hash,
-                  },
+                    contentHash: { $bytes: encrypted.hash },
+                  } as AppCisternLexiconItem.Main,
                 },
               ],
               cursor: undefined,
···
                   value: {
                     $type: "app.cistern.lexicon.item",
                     tid: testTid,
-                    ciphertext: encrypted.cipherText,
-                    nonce: encrypted.nonce,
+                    ciphertext: { $bytes: encrypted.cipherText },
+                    nonce: { $bytes: encrypted.nonce },
                     algorithm: "x_wing-xchacha20_poly1305-sha3_512",
                     pubkey:
                       "at://did:plc:test/app.cistern.lexicon.pubkey/different-key",
-                    payload: encrypted.content,
+                    payload: { $bytes: encrypted.content },
                     contentLength: encrypted.length,
-                    contentHash: encrypted.hash,
-                  },
+                    contentHash: { $bytes: encrypted.hash },
+                  } as AppCisternLexiconItem.Main,
                 },
               ],
               cursor: undefined,
···
                     value: {
                       $type: "app.cistern.lexicon.item",
                       tid: tid1,
-                      ciphertext: encrypted1.cipherText,
-                      nonce: encrypted1.nonce,
+                      ciphertext: { $bytes: encrypted1.cipherText },
+                      nonce: { $bytes: encrypted1.nonce },
                       algorithm: "x_wing-xchacha20_poly1305-sha3_512",
                       pubkey:
                         "at://did:plc:test/app.cistern.lexicon.pubkey/key1",
-                      payload: encrypted1.content,
+                      payload: { $bytes: encrypted1.content },
                       contentLength: encrypted1.length,
-                      contentHash: encrypted1.hash,
-                    },
+                      contentHash: { $bytes: encrypted1.hash },
+                    } as AppCisternLexiconItem.Main,
                   },
                 ],
                 cursor: "next-page",
···
                     value: {
                       $type: "app.cistern.lexicon.item",
                       tid: tid2,
-                      ciphertext: encrypted2.cipherText,
-                      nonce: encrypted2.nonce,
+                      ciphertext: { $bytes: encrypted2.cipherText },
+                      nonce: { $bytes: encrypted2.nonce },
                       algorithm: "x_wing-xchacha20_poly1305-sha3_512",
                       pubkey:
                         "at://did:plc:test/app.cistern.lexicon.pubkey/key1",
-                      payload: encrypted2.content,
+                      payload: { $bytes: encrypted2.content },
                       contentLength: encrypted2.length,
-                      contentHash: encrypted2.hash,
-                    },
+                      contentHash: { $bytes: encrypted2.hash },
+                    } as AppCisternLexiconItem.Main,
                   },
                 ],
                 cursor: undefined,

packages/consumer/mod.ts

···
       $type: "app.cistern.lexicon.pubkey",
       name,
       algorithm: "x_wing",
-      content: keys.publicKey.toBase64(),
+      content: { $bytes: keys.publicKey.toBase64() },
       createdAt: new Date().toISOString(),
     };
     const res = await this.rpc.post("com.atproto.repo.createRecord", {
···
         if (item.pubkey !== this.keypair.publicKey) continue;
 
         const decrypted = decryptText(this.keypair.privateKey, {
-          nonce: item.nonce,
-          cipherText: item.ciphertext,
-          content: item.payload,
-          hash: item.contentHash,
+          nonce: item.nonce.$bytes,
+          cipherText: item.ciphertext.$bytes,
+          content: item.payload.$bytes,
+          hash: item.contentHash.$bytes,
           length: item.contentLength,
         });
 
···
         }
 
         const decrypted = decryptText(this.keypair.privateKey, {
-          nonce: record.nonce,
-          cipherText: record.ciphertext,
-          content: record.payload,
-          hash: record.contentHash,
+          nonce: record.nonce.$bytes,
+          cipherText: record.ciphertext.$bytes,
+          content: record.payload.$bytes,
+          hash: record.contentHash.$bytes,
           length: record.contentLength,
         });
 

packages/lexicon/lexicons/app/cistern/lexicon/item.json

···
             "format": "tid"
           },
           "ciphertext": {
-            "type": "string",
-            "description": "Encapsulated shared ciphertext",
-            "maxLength": 2000
+            "type": "bytes",
+            "description": "Encapsulated shared ciphertext"
           },
           "nonce": {
-            "type": "string",
-            "description": "Base64-encoded nonce used for content encryption",
-            "maxLength": 32
+            "type": "bytes",
+            "description": "Nonce used for content encryption"
           },
           "algorithm": {
             "type": "string",
···
             "format": "at-uri"
           },
           "payload": {
-            "type": "string",
-            "description": "Base64-encoded encrypted item contents"
+            "type": "bytes",
+            "description": "Encrypted item contents"
           },
           "contentLength": {
             "type": "integer",
             "description": "Original content length in bytes"
           },
           "contentHash": {
-            "type": "string",
-            "description": "Base64-encoded hash of the decrypted contents. Verify this before accepting the decrypted message. The algorithm is identified under `algorithm`"
+            "type": "bytes",
+            "description": "Hash of the decrypted contents. Verify this before accepting the decrypted message. The algorithm is identified under `algorithm`"
           }
         }
       }

packages/lexicon/lexicons/app/cistern/lexicon/pubkey.json

···
             "description": "KEM algorithm used to generate this key"
           },
           "content": {
-            "type": "string",
-            "description": "Contents of the public key, encoded in base64"
+            "type": "bytes",
+            "description": "Contents of the public key"
           },
           "createdAt": {
             "type": "string",

packages/lexicon/src/types/app/cistern/lexicon/item.ts

···
     >(),
     /**
      * Encapsulated shared ciphertext
-     * @maxLength 2000
      */
-    ciphertext: /*#__PURE__*/ v.constrain(/*#__PURE__*/ v.string(), [
-      /*#__PURE__*/ v.stringLength(0, 2000),
-    ]),
+    ciphertext: /*#__PURE__*/ v.bytes(),
     /**
-     * Base64-encoded hash of the decrypted contents. Verify this before accepting the decrypted message. The algorithm is identified under `algorithm`
+     * Hash of the decrypted contents. Verify this before accepting the decrypted message. The algorithm is identified under `algorithm`
      */
-    contentHash: /*#__PURE__*/ v.string(),
+    contentHash: /*#__PURE__*/ v.bytes(),
     /**
      * Original content length in bytes
      */
     contentLength: /*#__PURE__*/ v.integer(),
     /**
-     * Base64-encoded nonce used for content encryption
-     * @maxLength 32
+     * Nonce used for content encryption
      */
-    nonce: /*#__PURE__*/ v.constrain(/*#__PURE__*/ v.string(), [
-      /*#__PURE__*/ v.stringLength(0, 32),
-    ]),
+    nonce: /*#__PURE__*/ v.bytes(),
     /**
-     * Base64-encoded encrypted item contents
+     * Encrypted item contents
      */
-    payload: /*#__PURE__*/ v.string(),
+    payload: /*#__PURE__*/ v.bytes(),
     /**
      * URI to the public key used to encrypt this item
      */

packages/lexicon/src/types/app/cistern/lexicon/pubkey.ts

···
      */
     algorithm: /*#__PURE__*/ v.string<"x_wing" | (string & {})>(),
     /**
-     * Contents of the public key, encoded in base64
+     * Contents of the public key
      */
-    content: /*#__PURE__*/ v.string(),
+    content: /*#__PURE__*/ v.bytes(),
     createdAt: /*#__PURE__*/ v.datetimeString(),
     /**
      * A memorable name for this public key. Avoid using revealing names, such as "Graham's Macbook"

packages/producer/mod.test.ts

···
 import type { ProducerParams, PublicKeyOption } from "./types.ts";
 import type { Client, CredentialManager } from "@atcute/client";
 import type { Did, Handle, ResourceUri } from "@atcute/lexicons";
+import type { AppCisternLexiconPubkey } from "@cistern/lexicon";
 
 // Helper to create a mock Producer instance
 function createMockProducer(
···
                     $type: "app.cistern.lexicon.pubkey",
                     name: "Key 1",
                     algorithm: "x_wing",
-                    content: new Uint8Array(32).toBase64(),
+                    content: { $bytes: new Uint8Array(32).toBase64() },
                     createdAt: new Date().toISOString(),
-                  },
+                  } as AppCisternLexiconPubkey.Main,
                 },
                 {
                   uri: "at://did:plc:test/app.cistern.lexicon.pubkey/key2",
···
                     $type: "app.cistern.lexicon.pubkey",
                     name: "Key 2",
                     algorithm: "x_wing",
-                    content: new Uint8Array(32).toBase64(),
+                    content: { $bytes: new Uint8Array(32).toBase64() },
                     createdAt: new Date().toISOString(),
-                  },
+                  } as AppCisternLexiconPubkey.Main,
                 },
               ],
               cursor: undefined,
···
   async fn() {
     let callCount = 0;
     const mockRpc = {
-      get: (endpoint: string, params?: { params?: { cursor?: string } }) => {
+      get: (endpoint: string, _params?: { params?: { cursor?: string } }) => {
         if (endpoint === "com.atproto.repo.listRecords") {
           callCount++;
 
···
                       $type: "app.cistern.lexicon.pubkey",
                       name: "Key 1",
                       algorithm: "x_wing",
-                      content: new Uint8Array(32).toBase64(),
+                      content: { $bytes: new Uint8Array(32).toBase64() },
                       createdAt: new Date().toISOString(),
-                    },
+                    } as AppCisternLexiconPubkey.Main,
                   },
                 ],
                 cursor: "next-page",
···
                       $type: "app.cistern.lexicon.pubkey",
                       name: "Key 2",
                       algorithm: "x_wing",
-                      content: new Uint8Array(32).toBase64(),
+                      content: { $bytes: new Uint8Array(32).toBase64() },
                       createdAt: new Date().toISOString(),
-                    },
+                    } as AppCisternLexiconPubkey.Main,
                   },
                 ],
                 cursor: undefined,

packages/producer/mod.ts

···
     publicKey = {
       uri: res.data.uri,
       name: record.name,
-      content: record.content,
+      content: record.content.$bytes,
     };
   }
 
···
       $type: "app.cistern.lexicon.item",
       tid: now(),
       algorithm: "x_wing-xchacha20_poly1305-sha3_512",
-      ciphertext: payload.cipherText,
-      contentHash: payload.hash,
+      ciphertext: { $bytes: payload.cipherText },
+      contentHash: { $bytes: payload.hash },
       contentLength: payload.length,
-      nonce: payload.nonce,
-      payload: payload.content,
+      nonce: { $bytes: payload.nonce },
+      payload: { $bytes: payload.content },
       pubkey: this.publicKey.uri,
     };
 
···
 
         yield {
           uri: record.uri,
-          content: item.content,
+          content: item.content.$bytes,
           name: item.name,
         };
       }