nix: add PLC, PDS, and Jetstream packages

Add Nix package definitions for the three AT Protocol services needed
for fully offline local development:
- did-plc-server: DID PLC directory server (Node.js)
- pds: AT Protocol Personal Data Server (Node.js)
- jetstream: AT Protocol event stream service (Go binary)

AI-assisted: GitLab Duo Agentic Chat (Claude Opus 4.6)
Signed-off-by: Alessio Caiazza <[e-mail]>

nix/pkgs/did-plc-server.nix

···
+# did-plc-server: DID PLC directory server for local development.
+#
+# Builds @did-plc/server from the did-method-plc monorepo source.
+# The server stores and resolves did:plc identity operations.
+#
+# When DATABASE_URL is set, uses PostgreSQL for persistent storage.
+# When DATABASE_URL is unset, uses an in-memory mock database.
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchYarnDeps,
+  nodejs,
+  yarn,
+  fixup-yarn-lock,
+  cacert,
+  makeBinaryWrapper,
+}: let
+  src = fetchFromGitHub {
+    owner = "did-method-plc";
+    repo = "did-method-plc";
+    rev = "1e301e5e29dd419c4dfc7d3100a2a614f9286ebe";
+    hash = "sha256-9GEMvxSOf6aR6YJhKre47x8sNUVASmjhzC9zq+ZS9ig=";
+  };
+in
+  stdenv.mkDerivation {
+    pname = "did-plc-server";
+    version = "0-unstable-2026-02-03";
+
+    inherit src;
+
+    offlineCache = fetchYarnDeps {
+      yarnLock = "${src}/yarn.lock";
+      hash = "sha256-XLJKRg/1nCzYM4uodCEBKXOal2sq8O6lx5MPPCZCXGw=";
+    };
+
+    nativeBuildInputs = [
+      nodejs
+      yarn
+      fixup-yarn-lock
+      makeBinaryWrapper
+    ];
+
+    configurePhase = ''
+      runHook preConfigure
+
+      export HOME=$TMPDIR
+      fixup-yarn-lock yarn.lock
+      yarn config --offline set yarn-offline-mirror $offlineCache
+      yarn install --frozen-lockfile --offline --no-progress --non-interactive --ignore-scripts
+
+      runHook postConfigure
+    '';
+
+    buildPhase = ''
+      runHook preBuild
+
+      # Build the lib package first (server depends on it)
+      pushd packages/lib
+      node ../../node_modules/.bin/esbuild src/index.ts --bundle --platform=node --outdir=dist --format=cjs || \
+        yarn run build
+      popd
+
+      # Build the server package
+      pushd packages/server
+      node ../../node_modules/.bin/esbuild src/bin.ts --bundle --platform=node --outdir=dist --format=cjs --external:pg --external:pg-native || \
+        yarn run build
+      popd
+
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/lib/plc-server
+      cp -r node_modules $out/lib/plc-server/
+      cp -r packages $out/lib/plc-server/
+
+      makeWrapper "${nodejs}/bin/node" "$out/bin/plc-server" \
+        --add-flags "--enable-source-maps" \
+        --add-flags "$out/lib/plc-server/packages/server/dist/bin.js" \
+        --set-default NODE_ENV production
+
+      runHook postInstall
+    '';
+
+    meta = {
+      description = "DID PLC Directory Service for local development";
+      homepage = "https://github.com/did-method-plc/did-method-plc";
+      license = lib.licenses.mit;
+      platforms = lib.platforms.unix;
+      mainProgram = "plc-server";
+    };
+  }

nix/pkgs/jetstream.nix

···
+# jetstream: AT Protocol event firehose proxy for local development.
+#
+# Subscribes to a PDS's com.atproto.sync.subscribeRepos and re-broadcasts
+# events over WebSocket in a simplified JSON format.
+#
+# Key env vars:
+#   JETSTREAM_WS_URL        — upstream ATProto firehose URL
+#   JETSTREAM_LISTEN_ADDR   — WebSocket listen address (default :6008)
+#   JETSTREAM_DATA_DIR      — PebbleDB cursor storage directory
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+buildGoModule {
+  pname = "jetstream";
+  version = "0-unstable-2024-06-18";
+
+  src = fetchFromGitHub {
+    owner = "bluesky-social";
+    repo = "jetstream";
+    rev = "a003f34cdb510c37d7245f0965814a6168243812";
+    hash = "sha256-VMSOHTTLr+wFI0NQthGJvlj1oQkTlFSjWkfbRRLqM0A=";
+  };
+
+  vendorHash = "sha256-UvJQ27BZ9Pri8zhY+T40qvH+g5ZInENQqSby+Z+lReg=";
+
+  proxyVendor = true;
+
+  subPackages = ["cmd/jetstream"];
+
+  # CGO is needed for PebbleDB's zstd compression (DataDog/czstd)
+  env.CGO_ENABLED = 1;
+
+  # Disable the 15-second liveness checker that kills Jetstream when idle.
+  # It's designed for Docker (restart on crash) but we run natively.
+  # In local dev there may be long periods with no events.
+  postPatch = ''
+    substituteInPlace cmd/jetstream/main.go \
+      --replace-fail 'close(livenessKill)' '// disabled for local-dev: close(livenessKill)'
+  '';
+
+  # The go.sum needs updating for newer Go toolchains
+  overrideModAttrs = _: {
+    preBuild = ''
+      go mod tidy
+    '';
+  };
+
+  preBuild = ''
+    go mod tidy
+  '';
+
+  meta = {
+    description = "AT Protocol event firehose proxy";
+    homepage = "https://github.com/bluesky-social/jetstream";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.unix;
+    mainProgram = "jetstream";
+  };
+}

nix/pkgs/pds-local-dev.nix

···
+# pds-local-dev: Patched bluesky-pds for local HTTP development.
+#
+# The upstream PDS assumes HTTPS for its OAuth UI. Four things break on
+# plain http://localhost:
+#
+#   1. CSP `upgrade-insecure-requests` tells browsers to load all sub-resources
+#      over https://, so the OAuth React UI never loads.
+#   2. Device/session cookies are set with `Secure`, so browsers never send
+#      them back over HTTP → CSRF mismatch on the login form.
+#   3. The CSRF cookie itself is hardcoded `secure: true`.
+#   4. The OAuth authorize endpoint validates `sec-fetch-site` and only accepts
+#      `cross-site` or `none`. When both the appview and PDS run on localhost
+#      (different ports), browsers send `same-site`, which gets rejected.
+#
+# This derivation copies the stock bluesky-pds and patches all four.
+{
+  lib,
+  bluesky-pds,
+  makeBinaryWrapper,
+  nodejs,
+  runCommand,
+}:
+runCommand "pds-local-dev-${bluesky-pds.version}" {
+  nativeBuildInputs = [makeBinaryWrapper];
+  inherit (bluesky-pds) meta;
+} ''
+  mkdir -p $out/{bin,lib}
+
+  # Copy the lib directory (node_modules + index.js) and make writable
+  cp -r ${bluesky-pds}/lib/pds $out/lib/pds
+  chmod -R u+w $out/lib/pds
+
+  # 1. Remove upgrade-insecure-requests from the default CSP.
+  find $out/lib/pds -name 'send-web-page.js' -path '*/oauth-provider/dist/*' | while read -r f; do
+    substituteInPlace "$f" \
+      --replace-fail "'upgrade-insecure-requests': true," "'upgrade-insecure-requests': false,"
+  done
+
+  # 2. Allow device/session cookies over plain HTTP.
+  find $out/lib/pds -name 'device-manager.js' -path '*/oauth-provider/dist/*' | while read -r f; do
+    substituteInPlace "$f" \
+      --replace-fail "secure: zod_1.z.boolean().default(true)," "secure: zod_1.z.boolean().default(false),"
+  done
+
+  # 3. Allow CSRF cookie over plain HTTP.
+  find $out/lib/pds -name 'csrf.js' -path '*/oauth-provider/dist/*' | while read -r f; do
+    substituteInPlace "$f" \
+      --replace-fail "secure: true," "secure: false,"
+  done
+
+  # 4. Accept same-site sec-fetch-site header on the authorize endpoint.
+  #    When appview (localhost:3000) redirects to PDS (localhost:2583),
+  #    browsers send sec-fetch-site: same-site instead of cross-site.
+  find $out/lib/pds -name 'create-authorization-page-middleware.js' -path '*/oauth-provider/dist/*' | while read -r f; do
+    substituteInPlace "$f" \
+      --replace-fail "['cross-site', 'none']" "['cross-site', 'same-site', 'none']"
+  done
+
+  # Create a new wrapper binary pointing to our patched lib
+  makeBinaryWrapper ${nodejs}/bin/node $out/bin/pds \
+    --add-flags --enable-source-maps \
+    --add-flags "$out/lib/pds/index.js" \
+    --set-default NODE_ENV production
+''