refactor: perform service proxying after local handlers

packages/danaus/src/api/com.atproto/identity.resolveHandle.ts

···
  * @param context app context
  */
 export const resolveHandle = (router: XRPCRouter, context: AppContext) => {
-	const { accountManager, config, handleResolver } = context;
+	const { accountManager, config, handleResolver, proxy } = context;
 
 	router.addQuery(ComAtprotoIdentityResolveHandle, {
-		async handler({ params }) {
+		async handler({ params, request }) {
+			await proxy.passthrough(request);
+
 			const handle = params.handle.toLowerCase();
 
 			if (!isHandle(handle)) {

packages/danaus/src/api/com.atproto/repo.getRecord.ts

···
  * @param context app context
  */
 export const getRecord = (router: XRPCRouter, context: AppContext) => {
-	const { accountManager, actorManager } = context;
+	const { accountManager, actorManager, proxy } = context;
 
 	router.addQuery(ComAtprotoRepoGetRecord, {
-		async handler({ params }) {
+		async handler({ params, request }) {
+			await proxy.passthrough(request);
+
 			const { repo, collection, rkey, cid } = params;
 
 			const did = accountManager.getAccountDid(repo);

packages/danaus/src/bin/pds.ts

···
 
 	targets.set('did:web:api.bsky.app#bsky_appview', {
 		to: `did:web:localhost%3A${BSKY_PORT}#bsky_appview`,
-		exclude: [
-			'app.bsky.actor.getPreferences',
-			'app.bsky.actor.putPreferences',
-			'com.atproto.repo.applyWrites',
-			'com.atproto.repo.createRecord',
-			'com.atproto.repo.putRecord',
-			'com.atproto.server.getSession',
-		],
+		exclude: ['app.bsky.actor.getPreferences', 'app.bsky.actor.putPreferences'],
 	});
 
 	const pds = await TestPds.create({

packages/danaus/src/context.ts

···
 import { CachedDidDocumentResolver } from './identity/cached-did-document-resolver';
 import { CachedHandleResolver } from './identity/cached-handle-resolver';
 import { IdentityCache } from './identity/manager';
+import { createServiceProxy, type ServiceProxy } from './proxy/index';
 import { Sequencer } from './sequencer/sequencer';
 
 export interface AppContext {
···
 	authVerifier: AuthVerifier;
 
 	sequencer: Sequencer;
+
+	/** service proxy for forwarding requests to atproto-proxy targets */
+	proxy: ServiceProxy;
 }
 
 export const createAppContext = (config: AppConfig): AppContext => {
···
 		didDocumentResolver: didDocumentResolver,
 	});
 
+	const proxy = createServiceProxy({
+		targets: config.proxy.targets,
+		authVerifier: authVerifier,
+		actorManager: actorManager,
+		didDocumentResolver: didDocumentResolver,
+	});
+
 	return {
 		config: config,
 
···
 		authVerifier: authVerifier,
 
 		sequencer: sequencer,
+
+		proxy: proxy,
 	};
 };

packages/danaus/src/pds-server.ts

···
 import { localDanaus } from './api/local.danaus/index.ts';
 import type { AppConfig } from './config.ts';
 import { createAppContext, type AppContext } from './context.ts';
-import { createProxyMiddleware } from './proxy/index.ts';
 import { createWebRouter } from './web/router.ts';
 import styles from './web/styles/main.out.css' with { type: 'file' };
 
···
 					allowedHeaders: ['x-bsky-topics'],
 					allowPrivateNetwork: true,
 				}),
-				createProxyMiddleware(context),
 			],
+			handleNotFound: context.proxy.handleNotFound,
 			handleException(err, request) {
 				return defaultExceptionHandler(err, request);
 			},

packages/danaus/src/proxy/index.ts

···
-import { InvalidRequestError, type FetchMiddleware } from '@atcute/xrpc-server';
+import type { DidDocumentResolver } from '@atcute/identity-resolver';
+import { defaultNotFoundHandler, InvalidRequestError, type NotFoundHandler } from '@atcute/xrpc-server';
 import { createServiceJwt } from '@atcute/xrpc-server/auth';
 
-import type { AppContext } from '#app/context.ts';
+import type { ActorManager } from '#app/actors/manager.ts';
+import type { AuthVerifier } from '#app/auth/verifier.ts';
+import type { ProxyTargetConfig } from '#app/config.ts';
 
 import {
 	buildProxyRequestHeaders,
+	buildProxyRequestHeadersWithInput,
 	filterResponseHeaders,
 	parseProxyHeader,
 	parseRequestNsid,
 } from './utils.ts';
+
+export type { ProxyTarget } from './utils.ts';
+
+export type PassthroughFn = (request: Request, input?: unknown) => Promise<void>;
+
+export interface ServiceProxy {
+	/** not-found handler for XRPCRouter that proxies unhandled requests */
+	handleNotFound: NotFoundHandler;
+	/**
+	 * proxy the request to an external service and throw the response.
+	 * use this in local handlers that want to delegate to the atproto-proxy target.
+	 * @param request original request
+	 * @param input parsed input body for POST requests (if body was already consumed)
+	 * @throws Response from the proxied request, or returns if no atproto-proxy header
+	 */
+	passthrough: PassthroughFn;
+}
+
+export interface ServiceProxyOptions {
+	targets: Map<string, ProxyTargetConfig>;
+	authVerifier: AuthVerifier;
+	actorManager: ActorManager;
+	didDocumentResolver: DidDocumentResolver<string>;
+}
 
 /**
- * create proxy middleware that forwards requests to external services.
- * the middleware activates when the `atproto-proxy` header is present.
- * @param ctx app context
- * @returns fetch middleware
+ * create service proxy handlers.
+ * @param options proxy dependencies
+ * @returns handleNotFound for XRPCRouter and passthrough for local handlers
  */
-export const createProxyMiddleware = (ctx: AppContext): FetchMiddleware => {
-	return async (request, next) => {
+export const createServiceProxy = (options: ServiceProxyOptions): ServiceProxy => {
+	const { targets, authVerifier, actorManager, didDocumentResolver } = options;
+
+	/**
+	 * core proxy logic - performs the actual proxying.
+	 */
+	const proxyRequest = async (request: Request, input?: unknown): Promise<Response> => {
 		const proxyHeader = request.headers.get('atproto-proxy');
 		if (!proxyHeader) {
-			return next(request);
+			throw new InvalidRequestError({ description: `missing atproto-proxy header` });
 		}
 
 		// only allow GET, HEAD, POST
···
 			throw new InvalidRequestError({ description: `XRPC requests only support GET, HEAD, and POST` });
 		}
 
+		// dev-only check: input should not be provided for GET requests
+		if (import.meta.env?.DEV && input !== undefined && request.method === 'GET') {
+			throw new Error(`passthrough: input provided for GET request`);
+		}
+
 		// parse NSID from request path
 		const lxm = parseRequestNsid(request);
 
 		// parse proxy header and resolve target
-		const target = await parseProxyHeader(ctx, proxyHeader, lxm);
+		const target = await parseProxyHeader(targets, didDocumentResolver, proxyHeader, lxm);
 		if (target === null) {
 			// NSID is excluded from proxying for this target
-			return next(request);
+			throw new InvalidRequestError({ description: `method not found` });
 		}
 
 		// verify authorization and get user DID
-		const auth = await ctx.authVerifier.authorization(request);
+		const auth = await authVerifier.authorization(request);
 
 		// load user's signing keypair
-		const keypair = await ctx.actorManager.importKeypair(auth.did);
+		const keypair = await actorManager.importKeypair(auth.did);
 
 		// create service auth JWT signed with user's key
 		const serviceJwt = await createServiceJwt({
···
 		upstreamUrl.protocol = new URL(target.url).protocol;
 		upstreamUrl.host = new URL(target.url).host;
 
-		const upstreamHeaders = buildProxyRequestHeaders(request, serviceJwt);
+		let upstreamHeaders: Headers;
+		let upstreamBody: Bun.BodyInit | null = null;
+
+		if (input !== undefined) {
+			// body was already consumed, reserialize from input
+			upstreamHeaders = buildProxyRequestHeadersWithInput(request, serviceJwt);
+			upstreamBody = JSON.stringify(input);
+		} else if (request.method === 'POST') {
+			// stream the original body
+			upstreamHeaders = buildProxyRequestHeaders(request, serviceJwt);
+			upstreamBody = request.body;
+		} else {
+			upstreamHeaders = buildProxyRequestHeaders(request, serviceJwt);
+		}
 
 		const upstreamRequest = new Request(upstreamUrl.toString(), {
 			method: request.method,
 			headers: upstreamHeaders,
-			body: request.method === 'POST' ? request.body : null,
-			duplex: request.method === 'POST' ? 'half' : undefined,
+			body: upstreamBody,
+			duplex: upstreamBody !== null ? 'half' : undefined,
 		});
 
 		// forward request
 		const upstreamResponse = await fetch(upstreamRequest);
 
-		upstreamResponse
-			.clone()
-			.text()
-			.then((text) => {
-				console.log(`${auth.did} -> ${upstreamUrl.toString()}`);
-				console.log(text);
-			});
-
 		// build response with filtered headers
 		const responseHeaders = filterResponseHeaders(upstreamResponse.headers);
 
···
 			headers: responseHeaders,
 		});
 	};
+
+	const handleNotFound: NotFoundHandler = async (request) => {
+		const proxyHeader = request.headers.get('atproto-proxy');
+		if (!proxyHeader) {
+			return defaultNotFoundHandler(request);
+		}
+
+		return proxyRequest(request);
+	};
+
+	const passthrough: PassthroughFn = async (request, input) => {
+		const proxyHeader = request.headers.get('atproto-proxy');
+		if (!proxyHeader) {
+			// no proxy header - continue with local handler logic
+			return;
+		}
+
+		// dev-only check: input should not be provided for GET requests
+		if (import.meta.env?.DEV && input !== undefined && request.method === 'GET') {
+			throw new Error(`passthrough: input provided for GET request`);
+		}
+
+		// parse NSID from request path
+		const lxm = parseRequestNsid(request);
+
+		// check if NSID is excluded for this target
+		const target = await parseProxyHeader(targets, didDocumentResolver, proxyHeader, lxm);
+		if (target === null) {
+			// NSID is excluded - continue with local handler logic
+			return;
+		}
+
+		const response = await proxyRequest(request, input);
+		throw response;
+	};
+
+	return { handleNotFound, passthrough };
 };

packages/danaus/src/proxy/utils.ts

···
 import { getAtprotoServiceEndpoint, isAtprotoAudience } from '@atcute/identity';
+import type { DidDocumentResolver } from '@atcute/identity-resolver';
 import type { Did, Nsid } from '@atcute/lexicons';
 import { isNsid, type AtprotoDid } from '@atcute/lexicons/syntax';
 import { InvalidRequestError } from '@atcute/xrpc-server';
 
-import type { AppContext } from '#app/context.ts';
+import type { ProxyTargetConfig } from '#app/config.ts';
 
 export interface ProxyTarget {
 	did: Did;
···
 
 /**
  * parse atproto-proxy header and resolve service endpoint.
- * @param ctx app context
+ * @param targets proxy target configurations
+ * @param didDocumentResolver DID document resolver
  * @param header proxy header value (format: `did#serviceId`)
  * @param nsid request NSID to check exclusions
  * @returns resolved proxy target with DID and URL, or null if NSID is excluded
  */
 export const parseProxyHeader = async (
-	ctx: AppContext,
+	targets: Map<string, ProxyTargetConfig>,
+	didDocumentResolver: DidDocumentResolver<string>,
 	header: string,
 	nsid: Nsid,
 ): Promise<ProxyTarget | null> => {
···
 		throw new InvalidRequestError({ description: `invalid atproto-proxy header` });
 	}
 
-	const targetConfig = ctx.config.proxy.targets.get(header);
+	const targetConfig = targets.get(header);
 
 	// check if NSID is excluded for this target
 	if (targetConfig?.exclude?.includes(nsid)) {
···
 	const did = audience.slice(0, hashIndex) as AtprotoDid;
 	const serviceId = audience.slice(hashIndex) as `#${string}`;
 
-	const didDoc = await ctx.didDocumentResolver.resolve(did);
+	const didDoc = await didDocumentResolver.resolve(did);
 	if (!didDoc) {
 		throw new InvalidRequestError({ description: `could not resolve proxy did` });
 	}
···
 			}
 		}
 	}
+
+	// set service auth
+	headers.set('authorization', `Bearer ${serviceJwt}`);
+
+	return headers;
+};
+
+/**
+ * build headers for upstream proxy request when input body was already consumed.
+ * sets content-type to application/json since the body will be reserialized.
+ * @param req original request
+ * @param serviceJwt service auth JWT
+ * @returns headers for upstream request
+ */
+export const buildProxyRequestHeadersWithInput = (req: Request, serviceJwt: string): Headers => {
+	const headers = new Headers();
+
+	// forward standard headers
+	for (const name of REQUEST_HEADERS_TO_FORWARD) {
+		const value = req.headers.get(name);
+		if (value) {
+			headers.set(name, value);
+		}
+	}
+
+	// ensure accept-encoding has a value
+	if (!headers.has('accept-encoding')) {
+		headers.set('accept-encoding', 'identity');
+	}
+
+	// forward all x-* headers
+	for (const [name, value] of req.headers) {
+		if (name.startsWith('x-')) {
+			headers.set(name, value);
+		}
+	}
+
+	// set content-type for reserialized JSON body
+	headers.set('content-type', 'application/json');
 
 	// set service auth
 	headers.set('authorization', `Bearer ${serviceJwt}`);