@hatk/hatk 0.0.1-alpha.1 → 0.0.1-alpha.100

package/dist/xrpc.js

@@ -6,12 +6,42 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
     }
     return path;
 };
+/**
+ * XRPC method handler system for serving AT Protocol endpoints.
+ *
+ * Place handler modules in the `xrpc/` directory, nested by NSID segments
+ * (e.g. `xrpc/app/bsky/feed/getAuthorFeed.ts` → `app.bsky.feed.getAuthorFeed`).
+ * Each module default-exports a `{ handler }` function that receives an
+ * {@link XrpcContext} with database access, query params, pagination, and
+ * viewer auth.
+ *
+ * @example
+ * ```ts
+ * // xrpc/xyz/statusphere/getStatuses.ts
+ * import { defineXrpc } from '../../hatk.generated.ts'
+ *
+ * export default defineXrpc('xyz.statusphere.getStatuses', async (ctx) => {
+ *   const rows = await ctx.db.query('SELECT * FROM statusphere_status LIMIT ?', [ctx.limit])
+ *   return { statuses: rows }
+ * })
+ * ```
+ */
+import { guardedQuerySQL, unfilteredQuerySQL } from "./spaces/guard.js";
 import { resolve, relative } from 'node:path';
 import { readdirSync, statSync } from 'node:fs';
-import { log } from "./logger.js";
-import { querySQL, runSQL, packCursor, unpackCursor, isTakendownDid, filterTakendownDids, searchRecords, findUriByFields, lookupByFieldBatch, countByFieldBatch, queryLabelsForUris, } from "./db.js";
-import { resolveRecords } from "./hydrate.js";
-import { getLexicon } from "./schema.js";
+import { log, emit, timer } from "./logger.js";
+import { runSQL, packCursor, unpackCursor, isTakendownDid, filterTakendownDids, searchRecords, findUriByFields, } from "./database/db.js";
+import { resolveRecords, buildBaseContext } from "./hydrate.js";
+import { getLexicon } from "./database/schema.js";
+import { createHmac } from 'node:crypto';
+import { pdsCreateRecord, pdsPutRecord, pdsDeleteRecord, pdsApplyWrites, pdsXrpc } from "./pds-proxy.js";
+import { obtainSession, ObtainSessionError } from "./oauth/server.js";
+let _oauthConfig = null;
+/** Set the OAuth config used for record write helpers. Called once during boot. */
+export function configureOAuth(config) {
+    _oauthConfig = config;
+}
+/** Thrown from XRPC handlers to return a 400 response with an error message. */
 export class InvalidRequestError extends Error {
     status = 400;
     errorName;
@@ -20,6 +50,7 @@ export class InvalidRequestError extends Error {
         this.errorName = errorName;
     }
 }
+/** Thrown from XRPC handlers to return a 404 response. */
 export class NotFoundError extends InvalidRequestError {
     status = 404;
     constructor(message = 'Not found') {
@@ -27,21 +58,138 @@ export class NotFoundError extends InvalidRequestError {
     }
 }
 let _relayUrl = '';
+let _cdn = null;
+/** Set the relay URL used for blob URL generation. Called once during boot. */
+/** True when the relay is a loopback URL — a dev PDS rather than the network. */
+export function isLocalRelay() {
+    try {
+        const host = new URL(_relayUrl).hostname;
+        return (host === 'localhost' || host === '127.0.0.1' || host === '[::1]' || host === '::1' || host.endsWith('.localhost'));
+    }
+    catch {
+        return false;
+    }
+}
 export function configureRelay(relay) {
     _relayUrl = relay;
 }
+/** Set the CDN config for imgproxy URL signing. Called once during boot. */
+export function configureCdn(cdn) {
+    if (cdn) {
+        _cdn = {
+            url: cdn.url.replace(/\/$/, ''),
+            key: Buffer.from(cdn.key, 'hex'),
+            salt: Buffer.from(cdn.salt, 'hex'),
+        };
+    }
+    else {
+        _cdn = null;
+    }
+}
+/** Sign an imgproxy path with HMAC-SHA256 (URL-safe base64). */
+function signPath(path) {
+    const hmac = createHmac('sha256', _cdn.key);
+    hmac.update(_cdn.salt);
+    hmac.update(path);
+    const sig = hmac.digest('base64url');
+    return `/${sig}${path}`;
+}
+/**
+ * Generate a CDN URL for a blob ref. Uses the PDS directly in local dev,
+ * a configured imgproxy CDN if available, or the Bluesky CDN as fallback.
+ */
 export function blobUrl(did, ref, preset = 'avatar') {
     if (!ref)
         return undefined;
     const p = typeof ref === 'string' ? JSON.parse(ref) : ref;
     if (!p?.ref?.$link)
         return undefined;
-    if (_relayUrl.includes('localhost:2583')) {
-        return `http://localhost:2583/xrpc/com.atproto.sync.getBlob?did=${did}&cid=${p.ref.$link}`;
+    // A local network has no image CDN. Serve blobs through the dev proxy
+    // (see /blob/ in server.ts), which fetches from each repo's own PDS — on a
+    // multi-PDS dev stack the repos are not all behind the relay being tailed.
+    if (isLocalRelay()) {
+        return `/blob/${did}/${p.ref.$link}`;
+    }
+    if (_cdn) {
+        const path = `/${preset}/plain/${did}/${p.ref.$link}`;
+        return `${_cdn.url}${signPath(path)}`;
     }
     return `https://cdn.bsky.app/img/${preset}/plain/${did}/${p.ref.$link}@jpeg`;
 }
+/** Build a full XrpcContext from request parameters. Reuses buildBaseContext for shared fields. */
+export function buildXrpcContext(params, cursor, limit, viewer, input) {
+    const base = buildBaseContext(viewer);
+    return {
+        ...base,
+        db: { query: guardedQuerySQL, run: runSQL, unfiltered: unfilteredQuerySQL },
+        params,
+        input: input || {},
+        cursor,
+        limit,
+        packCursor,
+        unpackCursor,
+        isTakendown: isTakendownDid,
+        filterTakendownDids,
+        search: searchRecords,
+        resolve: resolveRecords,
+        exists: async (collection, filters) => {
+            const conditions = Object.entries(filters).map(([field, value]) => ({ field, value }));
+            const uri = await findUriByFields(collection, conditions);
+            return uri !== null;
+        },
+        ...accountHelpers(viewer),
+        asAccount: (did) => accountHelpers({ did }),
+        obtainSession: async (url, body, opts) => {
+            if (!_oauthConfig)
+                throw new Error('No OAuth config — cannot obtain a session');
+            try {
+                return await obtainSession(_oauthConfig, url, body, opts);
+            }
+            catch (err) {
+                if (err instanceof ObtainSessionError)
+                    throw new InvalidRequestError(err.message, err.error);
+                throw err;
+            }
+        },
+    };
+}
+/**
+ * The PDS helpers for one account, with the session this app holds for it: the
+ * viewer's, or another account's through {@link XrpcContext.asAccount}.
+ */
+function accountHelpers(account) {
+    const ready = (what) => {
+        if (!_oauthConfig)
+            throw new Error(`No OAuth config — cannot ${what}`);
+        if (!account)
+            throw new Error(`Authentication required to ${what}`);
+        return { config: _oauthConfig, account };
+    };
+    return {
+        createRecord: async (collection, record, opts) => {
+            const { config, account } = ready('write records');
+            return pdsCreateRecord(config, account, { collection, record, rkey: opts?.rkey });
+        },
+        putRecord: async (collection, rkey, record) => {
+            const { config, account } = ready('write records');
+            return pdsPutRecord(config, account, { collection, rkey, record });
+        },
+        deleteRecord: async (collection, rkey) => {
+            const { config, account } = ready('write records');
+            await pdsDeleteRecord(config, account, { collection, rkey });
+        },
+        applyWrites: async (writes) => {
+            const { config, account } = ready('write records');
+            return pdsApplyWrites(config, account, { writes });
+        },
+        pds: async (nsid, options) => {
+            const { config, account } = ready('call the PDS');
+            return pdsXrpc(config, account, nsid, options);
+        },
+    };
+}
 const handlers = new Map();
+/** Recursively collect .ts/.js files in a directory, skipping files prefixed with `_`. */
 function walkDir(dir) {
     const results = [];
     try {
@@ -58,6 +206,11 @@ function walkDir(dir) {
     catch { }
     return results.sort();
 }
+/**
+ * Discover and load XRPC handler modules from the `xrpc/` directory.
+ * Directory nesting maps to NSID segments. Parameters are validated and
+ * coerced against the matching lexicon definition.
+ */
 export async function initXrpc(xrpcDir) {
     const files = walkDir(xrpcDir);
     if (files.length === 0)
@@ -65,7 +218,7 @@ export async function initXrpc(xrpcDir) {
     for (const scriptPath of files) {
         const rel = relative(xrpcDir, scriptPath).replace(/\.(ts|js)$/, '');
         const name = rel.replace(/[\\/]/g, '.');
-        const mod = await import(__rewriteRelativeImportExtension(scriptPath));
+        const mod = await import(__rewriteRelativeImportExtension(/* @vite-ignore */ `${scriptPath}?t=${Date.now()}`));
         const handler = mod.default;
         // Extract param schema from lexicon for validation and defaults
         const lexicon = getLexicon(name);
@@ -75,65 +228,127 @@ export async function initXrpc(xrpcDir) {
         handlers.set(name, {
             name,
             execute: async (params, cursor, limit, viewer, input) => {
-                // Apply defaults and coerce types from lexicon
-                for (const [key, def] of Object.entries(paramProperties)) {
-                    if (params[key] == null && def.default != null) {
-                        params[key] = String(def.default);
-                    }
-                    if (params[key] != null && def.type === 'integer') {
-                        params[key] = Number(params[key]);
-                    }
-                }
-                for (const param of requiredParams) {
-                    if (!params[param]) {
-                        throw new InvalidRequestError(`Missing required parameter: ${param}`, 'InvalidRequest');
-                    }
-                }
-                const ctx = {
-                    db: { query: querySQL, run: runSQL },
-                    params,
-                    input: input || {},
-                    cursor,
-                    limit,
-                    viewer,
-                    packCursor,
-                    unpackCursor,
-                    isTakendown: isTakendownDid,
-                    filterTakendownDids,
-                    search: searchRecords,
-                    resolve: resolveRecords,
-                    lookup: async (collection, field, values) => {
-                        if (values.length === 0)
-                            return new Map();
-                        const unique = [...new Set(values.filter(Boolean))];
-                        return lookupByFieldBatch(collection, field, unique);
-                    },
-                    count: async (collection, field, values) => {
-                        if (values.length === 0)
-                            return new Map();
-                        const unique = [...new Set(values.filter(Boolean))];
-                        return countByFieldBatch(collection, field, unique);
-                    },
-                    exists: async (collection, filters) => {
-                        const conditions = Object.entries(filters).map(([field, value]) => ({ field, value }));
-                        const uri = await findUriByFields(collection, conditions);
-                        return uri !== null;
-                    },
-                    labels: queryLabelsForUris,
-                    blobUrl,
-                };
+                coerceParams(params, paramProperties, requiredParams);
+                const ctx = buildXrpcContext(params, cursor, limit, viewer, input);
                 return handler.handler(ctx);
             },
         });
         log(`[xrpc] discovered: ${name}`);
     }
 }
+/** Register a single XRPC handler from a scanned server/ module. */
+export function registerXrpcHandler(nsid, handlerModule) {
+    const lexicon = getLexicon(nsid);
+    const paramsDef = lexicon?.defs?.main?.parameters;
+    const requiredParams = paramsDef?.required || [];
+    const paramProperties = paramsDef?.properties || {};
+    handlers.set(nsid, {
+        name: nsid,
+        execute: async (params, cursor, limit, viewer, input) => {
+            coerceParams(params, paramProperties, requiredParams);
+            const ctx = buildXrpcContext(params, cursor, limit, viewer, input);
+            return handlerModule.handler(ctx);
+        },
+    });
+}
+/** Collect a query string into params, keeping every value of a repeated key. */
+export function paramsFromSearch(search) {
+    const params = {};
+    for (const [key, value] of search) {
+        const prior = params[key];
+        if (prior === undefined)
+            params[key] = value;
+        else if (Array.isArray(prior))
+            prior.push(value);
+        else
+            params[key] = [prior, value];
+    }
+    return params;
+}
+function coerceScalar(value, def) {
+    // Only integers, as before: a boolean still reaches the handler as the
+    // string it was sent as, and handlers written against that keep working.
+    return def?.type === 'integer' ? Number(value) : value;
+}
+/**
+ * Apply the lexicon's parameter schema before a handler runs: defaults,
+ * integer coercion, and arrays. A query string cannot say whether
+ * `dids=x` is one string or a one-element list, so the schema decides: a
+ * parameter declared `array` always reaches the handler as one, or a handler
+ * that spreads it would spread the characters of a DID instead.
+ */
+export function coerceParams(params, properties, required) {
+    for (const [key, def] of Object.entries(properties)) {
+        if (params[key] == null && def.default != null) {
+            params[key] = def.type === 'array' ? [...def.default] : def.type === 'string' ? String(def.default) : def.default;
+        }
+        if (params[key] == null)
+            continue;
+        if (def.type === 'array') {
+            const list = Array.isArray(params[key]) ? params[key] : [params[key]];
+            params[key] = list.map((v) => coerceScalar(v, def.items));
+        }
+        else if (Array.isArray(params[key])) {
+            // A scalar given twice: the last one wins, as a form submission would.
+            params[key] = coerceScalar(params[key][params[key].length - 1], def);
+        }
+        else {
+            params[key] = coerceScalar(params[key], def);
+        }
+    }
+    for (const param of required) {
+        const v = params[param];
+        if (v == null || v === '' || (Array.isArray(v) && v.length === 0)) {
+            throw new InvalidRequestError(`Missing required parameter: ${param}`, 'InvalidRequest');
+        }
+    }
+}
+/** Execute a registered XRPC handler by name. Returns null if no handler matches. */
 export async function executeXrpc(name, params, cursor, limit, viewer, input) {
     const handler = handlers.get(name);
     if (!handler)
         return null;
-    return handler.execute(params, cursor, limit, viewer || null, input);
+    const elapsed = timer();
+    try {
+        const result = await handler.execute(params, cursor, limit, viewer || null, input);
+        emit('xrpc', name, { duration_ms: elapsed(), params, cursor, limit, viewer: viewer?.did });
+        return result;
+    }
+    catch (err) {
+        emit('xrpc', name, { duration_ms: elapsed(), params, cursor, limit, viewer: viewer?.did, error: err.message });
+        throw err;
+    }
+}
+/** Call a registered XRPC handler directly (no HTTP). For use in SSR renderers. */
+export async function callXrpc(nsid, params = {}, input) {
+    const viewer = globalThis.__hatk_viewer ?? null;
+    // In externalized module context (e.g. SSR), delegate to the runner's callXrpc via globalThis.
+    // The runner's module instance has all registered handlers; this (Node's) instance may not.
+    if (handlers.size === 0 && globalThis.__hatk_callXrpc) {
+        return globalThis.__hatk_callXrpc(nsid, params, input);
+    }
+    const stringParams = {};
+    for (const [k, v] of Object.entries(params)) {
+        if (v == null)
+            continue;
+        // A list stays a list, as the query string would have carried it.
+        stringParams[k] = Array.isArray(v) ? v.map(String) : String(v);
+    }
+    const limit = params.limit ? Number(params.limit) : 20;
+    const cursor = params.cursor ?? undefined;
+    const result = await executeXrpc(nsid, stringParams, cursor, limit, viewer, input);
+    if (result === null)
+        throw new Error(`No XRPC handler registered for ${nsid}`);
+    return result;
+}
+/**
+ * Register a core XRPC handler directly (no XrpcContext wrapping).
+ * Used for built-in dev.hatk.* handlers that manage their own dependencies.
+ */
+export function registerCoreXrpcHandler(nsid, fn) {
+    handlers.set(nsid, { name: nsid, execute: fn });
 }
+/** Return all registered XRPC method names. */
 export function listXrpc() {
     return Array.from(handlers.keys());
 }

package/package.json

@@ -1,9 +1,15 @@
 {
   "name": "@hatk/hatk",
-  "version": "0.0.1-alpha.1",
+  "version": "0.0.1-alpha.100",
+  "license": "MIT",
   "bin": {
     "hatk": "dist/cli.js"
   },
+  "files": [
+    "dist",
+    "fonts",
+    "public"
+  ],
   "type": "module",
   "exports": {
     "./feeds": "./dist/feeds.js",
@@ -14,28 +20,46 @@
     "./xrpc-client": "./dist/xrpc-client.js",
     "./views": "./dist/views.js",
     "./seed": "./dist/seed.js",
+    "./hooks": "./dist/hooks.js",
     "./setup": "./dist/setup.js",
     "./test": "./dist/test.js",
-    "./test/browser": "./dist/test-browser.js",
-    "./vite-plugin": "./dist/vite-plugin.js"
+    "./config": "./dist/config.js",
+    "./vite-plugin": "./dist/vite-plugin.js",
+    "./renderer": "./dist/renderer.js",
+    "./spaces": "./dist/spaces/index.js"
   },
-  "files": ["dist", "fonts", "public"],
   "scripts": {
-    "build": "tsc -p tsconfig.build.json",
-    "prepublishOnly": "npm run build"
+    "clean": "rm -rf dist",
+    "build": "npm run clean && tsc -p tsconfig.build.json && cp -r src/templates dist/templates && cp -r src/lexicons dist/lexicons",
+    "prepublishOnly": "npm run build",
+    "test": "vitest run --coverage",
+    "test:watch": "vitest"
   },
   "dependencies": {
-    "@bigmoves/lexicon": "^0.2.1",
+    "@bigmoves/lexicon": "^0.2.4",
     "@duckdb/node-api": "^1.4.4-r.1",
     "@hatk/oauth-client": "*",
+    "@noble/curves": "^2.4.0",
     "@resvg/resvg-js": "^2.6.2",
-    "satori": "^0.19.2",
+    "better-sqlite3": "^12.6.2",
+    "satori": "^0.28.1",
     "vitest": "^4",
     "yaml": "^2.7.0"
   },
   "devDependencies": {
-    "@playwright/test": "^1.58.2",
+    "@types/better-sqlite3": "^7.6.13",
     "@types/react": "^19.2.14",
-    "vite": "^6"
+    "@vitest/coverage-v8": "^4.1.11",
+    "sharp": "^0.35.4",
+    "vite": "^8.0.0"
+  },
+  "peerDependencies": {
+    "sharp": "^0.35.4",
+    "vite": "^8.0.0"
+  },
+  "peerDependenciesMeta": {
+    "sharp": {
+      "optional": true
+    }
   }
 }