refactor: adopt zat SDK for DID resolution and XRPC

- replace manual DID resolution with zat.DidResolver
- replace raw HTTP/TLS code with zat.XrpcClient
- use zat.json helpers for nested JSON navigation
- atproto.zig: 898 → 454 lines (50% reduction)

remaining in atproto.zig: JWT parsing and ECDSA signature verification

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <[e-mail]>

build.zig.zon

···
         },
         .zat = .{
             .url = "https://github.com/zzstoatzz/zat/archive/refs/heads/main.tar.gz",
-            .hash = "zat-0.0.1-alpha-5PuC7uWMAAAd0ujX65-3KFbr3IsEaH8PWExoW9rHkJmU",
+            .hash = "zat-0.0.1-alpha-5PuC7inqAAD6Sj8RCKLcLzUKnYgMPM_aGduBokzzLSRS",
         },
     },
     .paths = .{

src/atproto.zig

···
 const std = @import("std");
 const mem = std.mem;
-const json = std.json;
 const base64 = std.base64;
-const net = std.net;
-const tls = std.crypto.tls;
 const Allocator = mem.Allocator;
 const zat = @import("zat");
 
 // =============================================================================
 // atproto utilities
 //
-// JWT verification, DID resolution, and other atproto primitives.
-// could be extracted as a standalone library later.
+// JWT verification and API helpers.
+// DID resolution and XRPC now handled by zat.
 // =============================================================================
 
 pub const ServiceJwtPayload = struct {
···
 };
 
 /// parse a JWT without verifying the signature.
-/// use this only for extracting claims before verification,
-/// or when you trust the transport (not recommended).
 pub fn parseJwtUnsafe(allocator: Allocator, jwt: []const u8) !ServiceJwtPayload {
     var parts = mem.splitScalar(u8, jwt, '.');
 
···
     defer allocator.free(payload_json);
 
     // parse JSON
-    const parsed = json.parseFromSlice(json.Value, allocator, payload_json, .{}) catch {
+    const parsed = std.json.parseFromSlice(std.json.Value, allocator, payload_json, .{}) catch {
         return JwtError.InvalidJson;
     };
     defer parsed.deinit();
···
     const lxm: ?[]const u8 = if (obj.get("lxm")) |v| if (v == .string) v.string else null else null;
     const jti: ?[]const u8 = if (obj.get("jti")) |v| if (v == .string) v.string else null else null;
 
-    // dupe strings to avoid dangling pointers after parsed.deinit()
     return .{
         .iss = try allocator.dupe(u8, iss.string),
         .aud = try allocator.dupe(u8, aud.string),
···
 }
 
 /// verify a JWT's claims (expiration, audience) without signature verification.
-/// returns the payload if valid.
 pub fn verifyJwtClaims(
     allocator: Allocator,
     jwt: []const u8,
···
 ) !ServiceJwtPayload {
     const payload = try parseJwtUnsafe(allocator, jwt);
 
-    // check expiration
-    const now = std.time.timestamp();
-    if (payload.exp < now) {
+    if (payload.exp < std.time.timestamp()) {
         return JwtError.Expired;
     }
 
-    // check audience
     if (!mem.eql(u8, payload.aud, expected_audience)) {
         return JwtError.InvalidAudience;
     }
···
 }
 
 /// verify a JWT fully, including cryptographic signature.
-/// requires resolving the issuer's DID to get their public key.
 pub fn verifyJwt(
     allocator: Allocator,
     jwt: []const u8,
     expected_audience: []const u8,
 ) !ServiceJwtPayload {
-    // first verify claims
     const payload = try verifyJwtClaims(allocator, jwt, expected_audience);
 
-    // resolve DID to get public key
-    const public_key = getSigningKeyMultibase(allocator, payload.iss) catch {
-        return JwtError.DidResolutionFailed;
-    };
-    defer allocator.free(public_key);
+    // resolve DID using zat
+    const did = zat.Did.parse(payload.iss) orelse return JwtError.DidResolutionFailed;
+    var resolver = zat.DidResolver.init(allocator);
+    defer resolver.deinit();
 
-    // verify signature
-    verifyJwtSignature(allocator, jwt, public_key) catch {
+    var doc = resolver.resolve(did) catch return JwtError.DidResolutionFailed;
+    defer doc.deinit();
+
+    const signing_key = doc.signingKey() orelse return JwtError.DidResolutionFailed;
+
+    verifyJwtSignature(allocator, jwt, signing_key.public_key_multibase) catch {
         return JwtError.InvalidSignature;
     };
 
···
 }
 
 /// extract requester DID from an HTTP Authorization header.
-/// only verifies claims (expiration, audience), not signature.
-/// returns null if no valid auth header present.
 pub fn getRequesterDid(allocator: Allocator, auth_header: ?[]const u8, service_did: []const u8) ?[]const u8 {
     const auth = auth_header orelse return null;
     if (!mem.startsWith(u8, auth, "Bearer ")) return null;
···
 }
 
 /// extract requester DID with full signature verification.
-/// resolves the issuer's DID and verifies the JWT signature.
-/// returns null if verification fails.
 pub fn getRequesterDidVerified(allocator: Allocator, auth_header: ?[]const u8, service_did: []const u8) ?[]const u8 {
     const auth = auth_header orelse return null;
     if (!mem.startsWith(u8, auth, "Bearer ")) return null;
···
 }
 
 // -----------------------------------------------------------------------------
-// DID resolution
+// JWT signature verification (crypto)
 // -----------------------------------------------------------------------------
 
-pub const DidDocument = struct {
-    id: []const u8,
-    verification_method: ?[]const VerificationMethod = null,
-    service: ?[]const Service = null,
-};
-
-pub const VerificationMethod = struct {
-    id: []const u8,
-    type: []const u8,
-    controller: []const u8,
-    public_key_multibase: ?[]const u8 = null,
-};
-
-pub const Service = struct {
-    id: []const u8,
-    type: []const u8,
-    service_endpoint: []const u8,
-};
-
-/// resolve a did:web identifier to its DID document.
-/// did:web:example.com -> https://example.com/.well-known/did.json
-pub fn resolveDidWeb(allocator: Allocator, did: []const u8) !DidDocument {
-    if (!mem.startsWith(u8, did, "did:web:")) {
-        return error.InvalidDid;
-    }
-
-    const host = did[8..];
-
-    // build URL
-    var url_buf: [512]u8 = undefined;
-    const url = std.fmt.bufPrint(&url_buf, "https://{s}/.well-known/did.json", .{host}) catch {
-        return error.DidResolutionFailed;
-    };
-
-    return fetchDidDocument(allocator, url);
-}
-
-/// resolve a did:plc identifier via plc.directory.
-/// did:plc:abc123 -> https://plc.directory/did:plc:abc123
-pub fn resolveDidPlc(allocator: Allocator, did: []const u8) !DidDocument {
-    if (!mem.startsWith(u8, did, "did:plc:")) {
-        return error.InvalidDid;
-    }
-
-    // build URL
-    var url_buf: [512]u8 = undefined;
-    const url = std.fmt.bufPrint(&url_buf, "https://plc.directory/{s}", .{did}) catch {
-        return error.DidResolutionFailed;
-    };
-
-    return fetchDidDocument(allocator, url);
-}
-
-/// resolve any supported DID type.
-pub fn resolveDid(allocator: Allocator, did: []const u8) !DidDocument {
-    if (mem.startsWith(u8, did, "did:web:")) {
-        return resolveDidWeb(allocator, did);
-    } else if (mem.startsWith(u8, did, "did:plc:")) {
-        return resolveDidPlc(allocator, did);
-    } else {
-        return error.UnsupportedDidMethod;
-    }
-}
-
-/// fetch a DID document from a URL and return the raw JSON body.
-fn fetchDidDocumentRaw(allocator: Allocator, url: []const u8) ![]u8 {
-    // parse URL to extract host and path
-    if (!mem.startsWith(u8, url, "https://")) {
-        return error.DidResolutionFailed;
-    }
-
-    const rest = url[8..];
-    const path_start = mem.indexOf(u8, rest, "/") orelse rest.len;
-    const host = rest[0..path_start];
-    const path = if (path_start < rest.len) rest[path_start..] else "/";
-
-    // connect via TCP
-    const stream = net.tcpConnectToHost(allocator, host, 443) catch {
-        return error.DidResolutionFailed;
-    };
-    defer stream.close();
-
-    // setup TLS
-    var arena = std.heap.ArenaAllocator.init(allocator);
-    defer arena.deinit();
-    const aa = arena.allocator();
-
-    var ca_bundle: std.crypto.Certificate.Bundle = .{};
-    ca_bundle.rescan(aa) catch return error.DidResolutionFailed;
-
-    const buf_len = std.crypto.tls.max_ciphertext_record_len;
-    const buf = aa.alloc(u8, buf_len * 4) catch return error.DidResolutionFailed;
-
-    var stream_writer = stream.writer(buf.ptr[0..buf_len][0..buf_len]);
-    var stream_reader = stream.reader(buf.ptr[buf_len .. 2 * buf_len][0..buf_len]);
-
-    var tls_client = tls.Client.init(
-        stream_reader.interface(),
-        &stream_writer.interface,
-        .{
-            .ca = .{ .bundle = ca_bundle },
-            .host = .{ .explicit = host },
-            .read_buffer = buf.ptr[2 * buf_len .. 3 * buf_len][0..buf_len],
-            .write_buffer = buf.ptr[3 * buf_len .. 4 * buf_len][0..buf_len],
-        },
-    ) catch return error.DidResolutionFailed;
-
-    // send HTTP request
-    var req_buf: [512]u8 = undefined;
-    const request = std.fmt.bufPrint(&req_buf, "GET {s} HTTP/1.1\r\nHost: {s}\r\nConnection: close\r\n\r\n", .{ path, host }) catch {
-        return error.DidResolutionFailed;
-    };
-
-    tls_client.writer.writeAll(request) catch return error.DidResolutionFailed;
-    tls_client.writer.flush() catch return error.DidResolutionFailed;
-    stream_writer.interface.flush() catch return error.DidResolutionFailed;
-
-    // read response
-    var response_buf: [16384]u8 = undefined;
-    var total_read: usize = 0;
-
-    outer: while (total_read < response_buf.len) {
-        var w: std.Io.Writer = .fixed(response_buf[total_read..]);
-        while (true) {
-            const n = tls_client.reader.stream(&w, .limited(response_buf.len - total_read)) catch {
-                break :outer;
-            };
-            if (n != 0) {
-                total_read += n;
-                break;
-            }
-        }
-    }
-
-    const response = response_buf[0..total_read];
-
-    // find body (after \r\n\r\n)
-    const header_end = mem.indexOf(u8, response, "\r\n\r\n") orelse {
-        return error.DidResolutionFailed;
-    };
-
-    const body = response[header_end + 4 ..];
-    return allocator.dupe(u8, body);
-}
-
-/// fetch and parse a DID document from a URL.
-fn fetchDidDocument(allocator: Allocator, url: []const u8) !DidDocument {
-    const body = try fetchDidDocumentRaw(allocator, url);
-    defer allocator.free(body);
-
-    // parse JSON
-    const parsed = json.parseFromSlice(json.Value, allocator, body, .{}) catch {
-        return error.DidResolutionFailed;
-    };
-    defer parsed.deinit();
-
-    const obj = parsed.value.object;
-
-    // extract id (required)
-    const id = obj.get("id") orelse return error.DidResolutionFailed;
-    if (id != .string) return error.DidResolutionFailed;
-
-    return .{
-        .id = id.string,
-    };
-}
-
-/// extract the signing key (publicKeyMultibase) from a DID document.
-/// looks for the atproto verification method.
-pub fn getSigningKeyMultibase(allocator: Allocator, did: []const u8) ![]const u8 {
-    // build URL based on DID type
-    var url_buf: [512]u8 = undefined;
-    const url = if (mem.startsWith(u8, did, "did:plc:"))
-        std.fmt.bufPrint(&url_buf, "https://plc.directory/{s}", .{did}) catch return error.DidResolutionFailed
-    else if (mem.startsWith(u8, did, "did:web:"))
-        std.fmt.bufPrint(&url_buf, "https://{s}/.well-known/did.json", .{did[8..]}) catch return error.DidResolutionFailed
-    else
-        return error.UnsupportedDidMethod;
-
-    // fetch DID document
-    const body = try fetchDidDocumentRaw(allocator, url);
-    defer allocator.free(body);
-
-    // parse JSON
-    const parsed = json.parseFromSlice(json.Value, allocator, body, .{}) catch {
-        return error.DidResolutionFailed;
-    };
-    defer parsed.deinit();
-
-    const obj = parsed.value.object;
-
-    // get verificationMethod array
-    const vm_val = obj.get("verificationMethod") orelse return error.DidResolutionFailed;
-    if (vm_val != .array) return error.DidResolutionFailed;
-
-    // find the #atproto verification method
-    for (vm_val.array.items) |item| {
-        if (item != .object) continue;
-        const method = item.object;
-
-        // check if this is the atproto signing key
-        const id = method.get("id") orelse continue;
-        if (id != .string) continue;
-
-        if (mem.endsWith(u8, id.string, "#atproto")) {
-            // found it - extract publicKeyMultibase
-            const key = method.get("publicKeyMultibase") orelse continue;
-            if (key != .string) continue;
-            return allocator.dupe(u8, key.string);
-        }
-    }
-
-    // fallback: use first verification method
-    if (vm_val.array.items.len > 0) {
-        const first = vm_val.array.items[0];
-        if (first == .object) {
-            const key = first.object.get("publicKeyMultibase") orelse return error.DidResolutionFailed;
-            if (key == .string) {
-                return allocator.dupe(u8, key.string);
-            }
-        }
-    }
-
-    return error.DidResolutionFailed;
-}
-
-// -----------------------------------------------------------------------------
-// base58btc decoding (for multibase keys)
-// -----------------------------------------------------------------------------
-
+const ecdsa = std.crypto.sign.ecdsa;
 const BASE58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
 
 fn decodeBase58(allocator: Allocator, input: []const u8) ![]u8 {
     if (input.len == 0) return allocator.alloc(u8, 0);
 
-    // count leading '1's (zeros in output)
     var leading_zeros: usize = 0;
     for (input) |c| {
         if (c == '1') {
···
         }
     }
 
-    // allocate output buffer (input.len is upper bound)
     const output_size = input.len;
     var output = try allocator.alloc(u8, output_size);
     @memset(output, 0);
···
     var output_len: usize = 0;
 
     for (input) |c| {
-        // find character in alphabet
         const val: u8 = for (BASE58_ALPHABET, 0..) |a, i| {
             if (a == c) break @intCast(i);
         } else return error.InvalidBase58;
 
-        // multiply existing output by 58 and add new value
         var carry: u32 = val;
         var i: usize = 0;
         while (i < output_len or carry != 0) : (i += 1) {
···
         output_len = @max(output_len, i);
     }
 
-    // trim leading zeros from computation, add back original leading zeros
     const start = output.len - output_len;
     const result_len = leading_zeros + output_len;
     const result = try allocator.alloc(u8, result_len);
···
     return result;
 }
 
-// multicodec prefixes for key types
-const MULTICODEC_P256_PUB: u16 = 0x1200; // varint: 0x80 0x24
-const MULTICODEC_SECP256K1_PUB: u16 = 0xe7; // varint: 0xe7
-
 const KeyType = enum { p256, secp256k1 };
 
-/// decode a multibase key and return the raw public key bytes and type
 fn decodeMultibaseKey(allocator: Allocator, multibase: []const u8) !struct { key: []u8, key_type: KeyType } {
     if (multibase.len == 0) return error.InvalidMultibase;
-
-    // check multibase prefix ('z' = base58btc)
     if (multibase[0] != 'z') return error.UnsupportedMultibase;
 
-    // decode base58
     const decoded = try decodeBase58(allocator, multibase[1..]);
     errdefer allocator.free(decoded);
 
     if (decoded.len < 2) return error.InvalidMulticodec;
 
-    // parse multicodec varint prefix
-    // multicodec uses unsigned LEB128 (varint) encoding
-    // secp256k1-pub (0xe7 = 231) encodes as: 0xe7 0x01 (2 bytes)
-    // p256-pub (0x1200 = 4608) encodes as: 0x80 0x24 (2 bytes)
     if (decoded.len >= 2 and decoded[0] == 0xe7 and decoded[1] == 0x01) {
         const key = try allocator.dupe(u8, decoded[2..]);
         allocator.free(decoded);
···
     }
 }
 
-// -----------------------------------------------------------------------------
-// JWT signature verification
-// -----------------------------------------------------------------------------
-
-const ecdsa = std.crypto.sign.ecdsa;
-
-/// verify a JWT signature against a public key.
-/// the public key should be in multibase format (from DID document).
 pub fn verifyJwtSignature(allocator: Allocator, jwt: []const u8, public_key_multibase: []const u8) !void {
-    // split JWT into parts
     var parts = mem.splitScalar(u8, jwt, '.');
     const header_b64 = parts.next() orelse return error.MalformedJwt;
     const payload_b64 = parts.next() orelse return error.MalformedJwt;
     const sig_b64 = parts.next() orelse return error.MalformedJwt;
 
-    // the message to verify is "header.payload"
     const header_end = @intFromPtr(header_b64.ptr) - @intFromPtr(jwt.ptr) + header_b64.len;
     const payload_end = header_end + 1 + payload_b64.len;
     const message = jwt[0..payload_end];
 
-    // decode signature from base64url
     const sig_bytes = try decodeBase64Url(allocator, sig_b64);
     defer allocator.free(sig_bytes);
 
-    // decode public key
     const key_info = try decodeMultibaseKey(allocator, public_key_multibase);
     defer allocator.free(key_info.key);
 
-    // verify based on key type
     switch (key_info.key_type) {
         .p256 => {
             const pubkey = ecdsa.EcdsaP256Sha256.PublicKey.fromSec1(key_info.key) catch {
···
     }
 }
 
-// -----------------------------------------------------------------------------
-// base64url decoding (JWT uses base64url, not standard base64)
-// -----------------------------------------------------------------------------
-
 fn decodeBase64Url(allocator: Allocator, input: []const u8) ![]u8 {
-    // convert base64url to standard base64
     var buf = try allocator.alloc(u8, input.len + 4);
     defer allocator.free(buf);
 
···
         i += 1;
     }
 
-    // add padding if needed
     const padding = (4 - (i % 4)) % 4;
     for (0..padding) |_| {
         buf[i] = '=';
···
 }
 
 // -----------------------------------------------------------------------------
-// tests
-// -----------------------------------------------------------------------------
-
-test "parseJwtUnsafe" {
-    // example JWT (not a real one, just for structure testing)
-    const jwt = "eyJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJkaWQ6cGxjOnRlc3QiLCJhdWQiOiJkaWQ6d2ViOmZlZWQuZXhhbXBsZSIsImV4cCI6OTk5OTk5OTk5OX0.fake_signature";
-
-    var arena = std.heap.ArenaAllocator.init(std.heap.page_allocator);
-    defer arena.deinit();
-
-    const payload = try parseJwtUnsafe(arena.allocator(), jwt);
-    try std.testing.expectEqualStrings("did:plc:test", payload.iss);
-    try std.testing.expectEqualStrings("did:web:feed.example", payload.aud);
-}
-
-test "getSigningKeyMultibase" {
-    var arena = std.heap.ArenaAllocator.init(std.heap.page_allocator);
-    defer arena.deinit();
-
-    // test with a real DID (bsky.app's DID)
-    const key = try getSigningKeyMultibase(arena.allocator(), "did:plc:z72i7hdynmk6r22z27h6tvur");
-    // should start with 'z' (multibase prefix for base58btc)
-    try std.testing.expect(key[0] == 'z');
-    try std.testing.expect(key.len > 10);
-}
-
-test "decodeBase58" {
-    var arena = std.heap.ArenaAllocator.init(std.heap.page_allocator);
-    defer arena.deinit();
-
-    // "1" encodes to 0x00
-    const result1 = try decodeBase58(arena.allocator(), "1");
-    try std.testing.expectEqual(@as(usize, 1), result1.len);
-    try std.testing.expectEqual(@as(u8, 0), result1[0]);
-
-    // "2" encodes to 0x01
-    const result2 = try decodeBase58(arena.allocator(), "2");
-    try std.testing.expectEqual(@as(usize, 1), result2.len);
-    try std.testing.expectEqual(@as(u8, 1), result2[0]);
-}
-
-test "getFollows" {
-    var arena = std.heap.ArenaAllocator.init(std.heap.page_allocator);
-    defer arena.deinit();
-
-    // test with bsky.app's DID - should have some follows
-    const follows = try getFollows(arena.allocator(), "did:plc:z72i7hdynmk6r22z27h6tvur");
-    // should return newline-separated DIDs
-    try std.testing.expect(follows.len > 0);
-    try std.testing.expect(mem.indexOf(u8, follows, "did:") != null);
-}
-
-// -----------------------------------------------------------------------------
-// social graph API
+// social graph API (using zat.XrpcClient)
 // -----------------------------------------------------------------------------
 
-const BSKY_PUBLIC_API = "public.api.bsky.app";
+const BSKY_PUBLIC_API = "https://public.api.bsky.app";
 
 /// fetch all DIDs that a user follows (with pagination).
 /// returns newline-separated DIDs.
 pub fn getFollows(allocator: Allocator, actor_did: []const u8) ![]u8 {
+    var client = zat.XrpcClient.init(allocator, BSKY_PUBLIC_API);
+    defer client.deinit();
+
     var result: std.ArrayList(u8) = .empty;
     errdefer result.deinit(allocator);
 
     var cursor: ?[]const u8 = null;
     defer if (cursor) |c| allocator.free(c);
+
+    const nsid = zat.Nsid.parse("app.bsky.graph.getFollows") orelse return error.InvalidNsid;
 
     while (true) {
-        // build path with optional cursor
-        var path_buf: [1024]u8 = undefined;
-        const path = if (cursor) |c|
-            std.fmt.bufPrint(&path_buf, "/xrpc/app.bsky.graph.getFollows?actor={s}&limit=100&cursor={s}", .{ actor_did, c }) catch return error.PathTooLong
-        else
-            std.fmt.bufPrint(&path_buf, "/xrpc/app.bsky.graph.getFollows?actor={s}&limit=100", .{actor_did}) catch return error.PathTooLong;
+        var params = std.StringHashMap([]const u8).init(allocator);
+        defer params.deinit();
+
+        try params.put("actor", actor_did);
+        try params.put("limit", "100");
+        if (cursor) |c| {
+            try params.put("cursor", c);
+        }
 
-        // fetch
-        const response = fetchApiResponse(allocator, BSKY_PUBLIC_API, path) catch |err| {
+        var response = client.query(nsid, params) catch |err| {
             std.debug.print("getFollows API error: {}\n", .{err});
             return error.ApiFailed;
         };
-        defer allocator.free(response);
+        defer response.deinit();
 
-        // parse JSON
-        const parsed = json.parseFromSlice(json.Value, allocator, response, .{}) catch {
-            return error.InvalidJson;
-        };
+        if (!response.ok()) {
+            return error.ApiFailed;
+        }
+
+        var parsed = response.json() catch return error.InvalidJson;
         defer parsed.deinit();
 
-        const obj = parsed.value.object;
+        // extract follows array using zat.json helpers
+        const follows = zat.json.getArray(parsed.value, "follows") orelse break;
 
-        // extract follows array
-        const follows_val = obj.get("follows") orelse return error.MissingField;
-        if (follows_val != .array) return error.InvalidJson;
-
-        for (follows_val.array.items) |item| {
-            if (item != .object) continue;
-            const follow_obj = item.object;
-
-            // get the DID of the followed user
-            const did_val = follow_obj.get("did") orelse continue;
-            if (did_val != .string) continue;
-
-            try result.appendSlice(allocator, did_val.string);
+        for (follows) |item| {
+            const did = zat.json.getString(item, "did") orelse continue;
+            try result.appendSlice(allocator, did);
             try result.append(allocator, '\n');
         }
 
···
         if (cursor) |c| allocator.free(c);
         cursor = null;
 
-        if (obj.get("cursor")) |cursor_val| {
-            if (cursor_val == .string and cursor_val.string.len > 0) {
-                cursor = try allocator.dupe(u8, cursor_val.string);
+        if (zat.json.getString(parsed.value, "cursor")) |c| {
+            if (c.len > 0) {
+                cursor = try allocator.dupe(u8, c);
             }
         }
 
···
     return try result.toOwnedSlice(allocator);
 }
 
-/// fetch a response from the Bluesky public API.
-fn fetchApiResponse(allocator: Allocator, host: []const u8, path: []const u8) ![]u8 {
-    // connect via TCP
-    const stream = net.tcpConnectToHost(allocator, host, 443) catch {
-        return error.ConnectionFailed;
-    };
-    defer stream.close();
-
-    // setup TLS
-    var arena = std.heap.ArenaAllocator.init(allocator);
-    defer arena.deinit();
-    const aa = arena.allocator();
-
-    var ca_bundle: std.crypto.Certificate.Bundle = .{};
-    ca_bundle.rescan(aa) catch return error.TlsFailed;
-
-    const buf_len = std.crypto.tls.max_ciphertext_record_len;
-    const buf = aa.alloc(u8, buf_len * 4) catch return error.OutOfMemory;
-
-    var stream_writer = stream.writer(buf.ptr[0..buf_len][0..buf_len]);
-    var stream_reader = stream.reader(buf.ptr[buf_len .. 2 * buf_len][0..buf_len]);
-
-    var tls_client = tls.Client.init(
-        stream_reader.interface(),
-        &stream_writer.interface,
-        .{
-            .ca = .{ .bundle = ca_bundle },
-            .host = .{ .explicit = host },
-            .read_buffer = buf.ptr[2 * buf_len .. 3 * buf_len][0..buf_len],
-            .write_buffer = buf.ptr[3 * buf_len .. 4 * buf_len][0..buf_len],
-        },
-    ) catch return error.TlsFailed;
-
-    // send HTTP request
-    var req_buf: [1024]u8 = undefined;
-    const request = std.fmt.bufPrint(&req_buf, "GET {s} HTTP/1.1\r\nHost: {s}\r\nAccept: application/json\r\nConnection: close\r\n\r\n", .{ path, host }) catch {
-        return error.RequestTooLong;
-    };
-
-    tls_client.writer.writeAll(request) catch return error.WriteFailed;
-    tls_client.writer.flush() catch return error.WriteFailed;
-    stream_writer.interface.flush() catch return error.WriteFailed;
-
-    // read response - use dynamic buffer for large responses
-    var response_list: std.ArrayList(u8) = .empty;
-    defer response_list.deinit(allocator);
-
-    var temp_buf: [16384]u8 = undefined;
-
-    outer: while (true) {
-        var w: std.Io.Writer = .fixed(&temp_buf);
-
-        while (true) {
-            const n = tls_client.reader.stream(&w, .limited(temp_buf.len)) catch {
-                break :outer;
-            };
-            if (n != 0) {
-                try response_list.appendSlice(allocator, temp_buf[0..n]);
-                break;
-            }
-        }
-    }
-
-    const response = response_list.items;
-
-    // find body (after \r\n\r\n)
-    const header_end = mem.indexOf(u8, response, "\r\n\r\n") orelse {
-        return error.InvalidResponse;
-    };
-
-    // check for chunked transfer encoding
-    const headers = response[0..header_end];
-    const body_start = header_end + 4;
-
-    if (mem.indexOf(u8, headers, "Transfer-Encoding: chunked") != null) {
-        // decode chunked body
-        return decodeChunkedBody(allocator, response[body_start..]);
-    }
-
-    return allocator.dupe(u8, response[body_start..]);
-}
-
-/// decode a chunked transfer-encoding body
-fn decodeChunkedBody(allocator: Allocator, chunked: []const u8) ![]u8 {
-    var result: std.ArrayList(u8) = .empty;
-    errdefer result.deinit(allocator);
-
-    var pos: usize = 0;
-    while (pos < chunked.len) {
-        // find chunk size line
-        const line_end = mem.indexOf(u8, chunked[pos..], "\r\n") orelse break;
-        const size_str = chunked[pos .. pos + line_end];
-
-        // parse hex size
-        const chunk_size = std.fmt.parseInt(usize, size_str, 16) catch break;
-        if (chunk_size == 0) break;
-
-        pos += line_end + 2; // skip size line and CRLF
-
-        // read chunk data
-        if (pos + chunk_size > chunked.len) break;
-        try result.appendSlice(allocator, chunked[pos .. pos + chunk_size]);
-
-        pos += chunk_size + 2; // skip data and trailing CRLF
-    }
-
-    return try result.toOwnedSlice(allocator);
-}
-
 /// a post from getAuthorFeed
 pub const AuthorPost = struct {
     uri: []const u8,
···
 };
 
 /// fetch recent posts from an author's feed.
-/// returns up to `limit` posts (max 100 per API call).
 pub fn getAuthorFeed(allocator: Allocator, actor_did: []const u8, limit: usize) ![]AuthorPost {
-    var posts: std.ArrayList(AuthorPost) = .{};
+    var client = zat.XrpcClient.init(allocator, BSKY_PUBLIC_API);
+    defer client.deinit();
+
+    var posts: std.ArrayList(AuthorPost) = .empty;
     errdefer {
         for (posts.items) |p| {
             allocator.free(p.uri);
···
         posts.deinit(allocator);
     }
 
-    // build path
-    var path_buf: [512]u8 = undefined;
-    const actual_limit = @min(limit, 100);
-    const path = std.fmt.bufPrint(&path_buf, "/xrpc/app.bsky.feed.getAuthorFeed?actor={s}&limit={d}&filter=posts_no_replies", .{ actor_did, actual_limit }) catch return error.PathTooLong;
+    const nsid = zat.Nsid.parse("app.bsky.feed.getAuthorFeed") orelse return error.InvalidNsid;
 
-    // fetch
-    const response = fetchApiResponse(allocator, BSKY_PUBLIC_API, path) catch |err| {
+    var params = std.StringHashMap([]const u8).init(allocator);
+    defer params.deinit();
+
+    var limit_buf: [8]u8 = undefined;
+    const limit_str = std.fmt.bufPrint(&limit_buf, "{d}", .{@min(limit, 100)}) catch return error.FormatError;
+
+    try params.put("actor", actor_did);
+    try params.put("limit", limit_str);
+    try params.put("filter", "posts_no_replies");
+
+    var response = client.query(nsid, params) catch |err| {
         std.debug.print("getAuthorFeed API error for {s}: {}\n", .{ actor_did, err });
         return error.ApiFailed;
     };
-    defer allocator.free(response);
+    defer response.deinit();
 
-    // parse JSON
-    const parsed = json.parseFromSlice(json.Value, allocator, response, .{}) catch {
-        return error.InvalidJson;
-    };
+    if (!response.ok()) {
+        return error.ApiFailed;
+    }
+
+    var parsed = response.json() catch return error.InvalidJson;
     defer parsed.deinit();
 
-    const obj = parsed.value.object;
+    const feed = zat.json.getArray(parsed.value, "feed") orelse return try posts.toOwnedSlice(allocator);
 
-    // extract feed array
-    const feed_val = obj.get("feed") orelse return posts.toOwnedSlice(allocator);
-    if (feed_val != .array) return posts.toOwnedSlice(allocator);
+    for (feed) |item| {
+        const uri = zat.json.getString(item, "post.uri") orelse continue;
+        const cid = zat.json.getString(item, "post.cid") orelse continue;
+        const text = zat.json.getString(item, "post.record.text") orelse "";
+        const embed_uri = zat.json.getString(item, "post.record.embed.external.uri");
 
-    for (feed_val.array.items) |item| {
-        if (item != .object) continue;
-        const feed_item = item.object;
+        try posts.append(allocator, .{
+            .uri = try allocator.dupe(u8, uri),
+            .cid = try allocator.dupe(u8, cid),
+            .text = try allocator.dupe(u8, text),
+            .embed_uri = if (embed_uri) |eu| try allocator.dupe(u8, eu) else null,
+        });
+    }
 
-        // get post object
-        const post_val = feed_item.get("post") orelse continue;
-        if (post_val != .object) continue;
-        const post_obj = post_val.object;
+    return try posts.toOwnedSlice(allocator);
+}
 
-        // extract uri
-        const uri_val = post_obj.get("uri") orelse continue;
-        if (uri_val != .string) continue;
+// -----------------------------------------------------------------------------
+// tests
+// -----------------------------------------------------------------------------
 
-        // extract cid
-        const cid_val = post_obj.get("cid") orelse continue;
-        if (cid_val != .string) continue;
+test "parseJwtUnsafe" {
+    const jwt = "eyJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJkaWQ6cGxjOnRlc3QiLCJhdWQiOiJkaWQ6d2ViOmZlZWQuZXhhbXBsZSIsImV4cCI6OTk5OTk5OTk5OX0.fake_signature";
 
-        // extract record
-        const record_val = post_obj.get("record") orelse continue;
-        if (record_val != .object) continue;
+    var arena = std.heap.ArenaAllocator.init(std.heap.page_allocator);
+    defer arena.deinit();
 
-        // extract text (may be empty)
-        const text_val = record_val.object.get("text");
-        const text = if (text_val) |tv| (if (tv == .string) tv.string else "") else "";
+    const payload = try parseJwtUnsafe(arena.allocator(), jwt);
+    try std.testing.expectEqualStrings("did:plc:test", payload.iss);
+    try std.testing.expectEqualStrings("did:web:feed.example", payload.aud);
+}
 
-        // extract embed.external.uri if present
-        var embed_uri: ?[]const u8 = null;
-        if (record_val.object.get("embed")) |embed_val| {
-            if (embed_val == .object) {
-                if (embed_val.object.get("external")) |ext_val| {
-                    if (ext_val == .object) {
-                        if (ext_val.object.get("uri")) |eu_val| {
-                            if (eu_val == .string) {
-                                embed_uri = eu_val.string;
-                            }
-                        }
-                    }
-                }
-            }
-        }
+test "decodeBase58" {
+    var arena = std.heap.ArenaAllocator.init(std.heap.page_allocator);
+    defer arena.deinit();
 
-        try posts.append(allocator, .{
-            .uri = try allocator.dupe(u8, uri_val.string),
-            .cid = try allocator.dupe(u8, cid_val.string),
-            .text = try allocator.dupe(u8, text),
-            .embed_uri = if (embed_uri) |eu| try allocator.dupe(u8, eu) else null,
-        });
-    }
+    const result1 = try decodeBase58(arena.allocator(), "1");
+    try std.testing.expectEqual(@as(usize, 1), result1.len);
+    try std.testing.expectEqual(@as(u8, 0), result1[0]);
 
-    return posts.toOwnedSlice(allocator);
+    const result2 = try decodeBase58(arena.allocator(), "2");
+    try std.testing.expectEqual(@as(usize, 1), result2.len);
+    try std.testing.expectEqual(@as(u8, 1), result2[0]);
 }