@hatk/hatk 0.0.1-alpha.11 → 0.0.1-alpha.111

package/dist/server.js

@@ -1,100 +1,453 @@
-import { createServer } from 'node:http';
-import { gzipSync } from 'node:zlib';
+import { createHash, timingSafeEqual } from 'node:crypto';
 import { existsSync } from 'node:fs';
 import { readFile } from 'node:fs/promises';
 import { join, extname } from 'node:path';
-import { queryRecords, getRecordByUri, searchRecords, getSchema, reshapeRow, setRepoStatus, getRepoStatus, getRepoRetryInfo, querySQL, insertRecord, deleteRecord, queryLabelsForUris, insertLabels, searchAccounts, listReposPaginated, getCollectionCounts, normalizeValue, getSchemaDump, getPreferences, putPreference, } from "./db.js";
+import { gzipSync } from 'node:zlib';
+import { queryRecords, getRecordByUri, searchRecords, getSchema, reshapeRow, setRepoStatus, getRepoStatus, getRepoRetryInfo, queryLabelsForUris, insertLabels, searchAccounts, listReposPaginated, getCollectionCounts, getRepoStatusCounts, getDatabaseSize, deleteLabels, getRecentRecords, listActiveRepoDids, removeRepo, getRepoHandle, getPreferences, putPreference, insertReport, queryReports, resolveReport, getOpenReportCount, queryClassifications, getClassificationStats, getRecordsByDid, getRecordCountsByDid, findOpenReportsForSubject, } from "./database/db.js";
+import { runScan, getScanProgress, listClassifiers, isClefConfigured } from "./classifiers.js";
 import { executeFeed, listFeeds } from "./feeds.js";
-import { executeXrpc, InvalidRequestError } from "./xrpc.js";
-import { getLexiconArray } from "./schema.js";
-import { validateRecord } from '@bigmoves/lexicon';
+import { executeXrpc, InvalidRequestError, NotFoundError, registerCoreXrpcHandler, isLocalRelay, paramsFromSearch, } from "./xrpc.js";
+import { pdsFor } from "./backfill.js";
 import { resolveRecords } from "./hydrate.js";
 import { handleOpengraphRequest, buildOgMeta } from "./opengraph.js";
 import { getLabelDefinitions, rescanLabels } from "./labels.js";
 import { triggerAutoBackfill } from "./indexer.js";
-import { log, emit, timer } from "./logger.js";
-import { getAuthServerMetadata, getProtectedResourceMetadata, getJwks, getClientMetadata, handlePar, buildAuthorizeRedirect, handleCallback, handleToken, authenticate, refreshPdsSession, } from "./oauth/server.js";
-import { getOAuthRequest } from "./oauth/db.js";
-import { createDpopProof } from "./oauth/dpop.js";
-import { getServerKey, getSession } from "./oauth/db.js";
+import { emit, timer } from "./logger.js";
+import { getAuthServerMetadata, getProtectedResourceMetadata, getJwks, getClientMetadata, getClientJwks, handlePar, buildAuthorizeRedirect, handleCallback, handleCallbackError, serverLogin, handleToken, authenticate, OAuthError, } from "./oauth/server.js";
+import { createSessionCookie, sessionCookieHeader, clearSessionCookieHeader, parseSessionCookie, createAccountsCookie, accountsCookieHeader, clearAccountsCookieHeader, parseAccountsCookie, withAccount, withoutAccount, } from "./oauth/session.js";
+import { getOAuthRequest, getSession } from "./oauth/db.js";
+import { pdsCreateRecord, pdsDeleteRecord, pdsPutRecord, pdsApplyWrites, pdsUploadBlob, ProxyError, ScopeMissingProxyError, } from "./pds-proxy.js";
+import { json, jsonError, cors, withCors, file, notFound } from "./response.js";
+import { collectionFromUri, isPrivateCollection } from "./private-collections.js";
+import { enterReadableSpaces } from "./spaces/visibility.js";
+import { readableSpacesFor } from "./spaces/viewer.js";
+import { parseSpaceBlobRequest, serveSpaceBlob } from "./spaces/blob.js";
+import { handleWriteNotice, NoticeError, parseWriteNotice, scheduleNoticeSync, spaceDidDocument, spaceServiceId, unwatchSpace, verifyNotice, } from "./spaces/index.js";
+import { parseSpaceRef } from "./spaces/uri.js";
+import { serve } from "./adapter.js";
+import { renderPage } from "./renderer.js";
+/**
+ * Parse a client-supplied `limit`, or null if it is not a usable one.
+ *
+ * `parseInt` alone lets `limit=abc` through as NaN and `limit=-5` through as a
+ * negative bound, both of which reach the database driver: the first as a
+ * datatype error, the second as "no limit at all" on SQLite. Neither is a
+ * server fault, so the caller turns a null into a 400.
+ */
+function parseLimit(raw, fallback) {
+    if (raw === null || raw === '')
+        return fallback;
+    if (!/^\d+$/.test(raw))
+        return null;
+    const value = Number(raw);
+    return value >= 1 ? value : null;
+}
+/** Whether `sort` names a column queryRecords can order this collection by. */
+function isSortableField(collection, sort) {
+    if (sort === 'indexed_at')
+        return true;
+    const schema = getSchema(collection);
+    return !!schema?.columns.some((c) => c.originalName === sort || c.name === sort);
+}
+/** Narrow a client-supplied `order` to the two values that may reach ORDER BY. */
+function parseOrder(raw) {
+    if (!raw)
+        return undefined;
+    const lowered = raw.toLowerCase();
+    return lowered === 'asc' || lowered === 'desc' ? lowered : null;
+}
+function scopeMissingResponse(acceptEncoding, handle) {
+    const res = withCors(json({ error: 'ScopeMissingError', ...(handle ? { handle } : {}) }, 401, acceptEncoding));
+    res.headers.append('Set-Cookie', clearSessionCookieHeader());
+    return res;
+}
 const MIME = {
     '.html': 'text/html',
     '.js': 'application/javascript',
     '.css': 'text/css',
     '.json': 'application/json',
 };
-function readBody(req) {
-    return new Promise((resolve, reject) => {
-        let body = '';
-        req.on('data', (chunk) => (body += chunk));
-        req.on('end', () => resolve(body));
-        req.on('error', reject);
+/**
+ * Register built-in dev.hatk.* XRPC handlers in the handler registry.
+ * This makes them available to callXrpc() for use in SSR and server code.
+ */
+export function registerCoreHandlers(collections, oauth) {
+    registerCoreXrpcHandler('dev.hatk.getRecords', async (params, cursor, limit) => {
+        const collection = params.collection;
+        if (!collection)
+            throw new InvalidRequestError('Missing collection parameter');
+        if (isPrivateCollection(collection))
+            throw new NotFoundError(`Unknown collection: ${collection}`);
+        if (!getSchema(collection))
+            throw new NotFoundError(`Unknown collection: ${collection}`);
+        const sort = params.sort || undefined;
+        if (sort && !isSortableField(collection, sort))
+            throw new InvalidRequestError(`Invalid sort field: ${sort}`);
+        const order = parseOrder(params.order);
+        if (order === null)
+            throw new InvalidRequestError(`Invalid order: ${params.order}`);
+        const reserved = new Set(['collection', 'limit', 'cursor', 'sort', 'order']);
+        const filters = {};
+        for (const [key, value] of Object.entries(params)) {
+            if (!reserved.has(key))
+                filters[key] = value;
+        }
+        const result = await queryRecords(collection, {
+            limit,
+            cursor,
+            sort,
+            order,
+            filters: Object.keys(filters).length > 0 ? filters : undefined,
+        });
+        const uris = result.records.map((r) => r.uri);
+        const items = await resolveRecords(uris);
+        return { items, cursor: result.cursor };
     });
-}
-function readBodyRaw(req) {
-    return new Promise((resolve, reject) => {
-        const chunks = [];
-        req.on('data', (chunk) => chunks.push(chunk));
-        req.on('end', () => resolve(Buffer.concat(chunks)));
-        req.on('error', reject);
+    registerCoreXrpcHandler('dev.hatk.getRecord', async (params) => {
+        const uri = params.uri;
+        if (!uri)
+            throw new InvalidRequestError('Missing uri parameter');
+        if (isPrivateCollection(collectionFromUri(uri)))
+            throw new NotFoundError('Record not found');
+        const record = await getRecordByUri(uri);
+        if (!record)
+            throw new NotFoundError('Record not found');
+        const shaped = reshapeRow(record, record?.__childData);
+        const labelsMap = await queryLabelsForUris([record.uri]);
+        if (shaped)
+            shaped.labels = labelsMap.get(record.uri) || [];
+        return { record: shaped };
+    });
+    registerCoreXrpcHandler('dev.hatk.getFeed', async (params, cursor, limit, viewer) => {
+        const feedName = params.feed;
+        if (!feedName)
+            throw new InvalidRequestError('Missing feed parameter');
+        const result = await executeFeed(feedName, params, cursor, limit, viewer);
+        if (!result)
+            throw new NotFoundError(`Unknown feed: ${feedName}`);
+        return result;
+    });
+    registerCoreXrpcHandler('dev.hatk.searchRecords', async (params, cursor, limit) => {
+        const collection = params.collection;
+        const q = params.q;
+        if (!collection)
+            throw new InvalidRequestError('Missing collection parameter');
+        if (!q)
+            throw new InvalidRequestError('Missing q parameter');
+        if (isPrivateCollection(collection))
+            throw new NotFoundError(`Unknown collection: ${collection}`);
+        if (!getSchema(collection))
+            throw new NotFoundError(`Unknown collection: ${collection}`);
+        const fuzzy = params.fuzzy !== 'false';
+        const result = await searchRecords(collection, q, { limit, cursor, fuzzy });
+        const uris = result.records.map((r) => r.uri);
+        const items = await resolveRecords(uris);
+        return { items, cursor: result.cursor };
+    });
+    registerCoreXrpcHandler('dev.hatk.describeFeeds', async () => {
+        return { feeds: listFeeds() };
     });
+    registerCoreXrpcHandler('dev.hatk.describeCollections', async () => {
+        const collectionInfo = collections
+            .filter((c) => !isPrivateCollection(c))
+            .map((c) => {
+            const schema = getSchema(c);
+            return {
+                collection: c,
+                columns: schema?.columns.map((col) => ({
+                    name: col.name,
+                    originalName: col.originalName,
+                    type: col.sqlType,
+                    required: col.notNull,
+                })),
+            };
+        });
+        return { collections: collectionInfo };
+    });
+    registerCoreXrpcHandler('dev.hatk.describeLabels', async () => {
+        return { definitions: getLabelDefinitions() };
+    });
+    // Write operations — proxy to user's PDS
+    if (oauth) {
+        registerCoreXrpcHandler('dev.hatk.getPreferences', async (_params, _cursor, _limit, viewer) => {
+            if (!viewer)
+                throw new InvalidRequestError('Authentication required');
+            const prefs = await getPreferences(viewer.did);
+            return { preferences: prefs };
+        });
+        registerCoreXrpcHandler('dev.hatk.putPreference', async (_params, _cursor, _limit, viewer, input) => {
+            if (!viewer)
+                throw new InvalidRequestError('Authentication required');
+            const body = input;
+            if (!body.key || typeof body.key !== 'string')
+                throw new InvalidRequestError('Missing or invalid key');
+            if (body.value === undefined)
+                throw new InvalidRequestError('Missing value');
+            await putPreference(viewer.did, body.key, body.value);
+            return { success: true };
+        });
+        registerCoreXrpcHandler('dev.hatk.createRecord', async (_params, _cursor, _limit, viewer, input) => {
+            if (!viewer)
+                throw new InvalidRequestError('Authentication required');
+            return pdsCreateRecord(oauth, viewer, input);
+        });
+        registerCoreXrpcHandler('dev.hatk.deleteRecord', async (_params, _cursor, _limit, viewer, input) => {
+            if (!viewer)
+                throw new InvalidRequestError('Authentication required');
+            return pdsDeleteRecord(oauth, viewer, input);
+        });
+        registerCoreXrpcHandler('dev.hatk.putRecord', async (_params, _cursor, _limit, viewer, input) => {
+            if (!viewer)
+                throw new InvalidRequestError('Authentication required');
+            return pdsPutRecord(oauth, viewer, input);
+        });
+        registerCoreXrpcHandler('dev.hatk.uploadBlob', async (_params, _cursor, _limit, viewer, input) => {
+            if (!viewer)
+                throw new InvalidRequestError('Authentication required');
+            return pdsUploadBlob(oauth, viewer, input, 'application/octet-stream');
+        });
+        registerCoreXrpcHandler('dev.hatk.applyWrites', async (_params, _cursor, _limit, viewer, input) => {
+            if (!viewer)
+                throw new InvalidRequestError('Authentication required');
+            return pdsApplyWrites(oauth, viewer, input);
+        });
+        registerCoreXrpcHandler('dev.hatk.push.registerToken', async (_params, _cursor, _limit, viewer, input) => {
+            if (!viewer)
+                throw new InvalidRequestError('Authentication required');
+            const body = input;
+            if (!body.token || typeof body.token !== 'string')
+                throw new InvalidRequestError('Missing or invalid token');
+            const platform = body.platform || 'apns';
+            if (!['apns', 'fcm', 'web'].includes(platform))
+                throw new InvalidRequestError('Invalid platform');
+            const { registerToken } = await import("./push.js");
+            await registerToken(viewer.did, body.token, platform);
+            return { success: true };
+        });
+        registerCoreXrpcHandler('dev.hatk.push.unregisterToken', async (_params, _cursor, _limit, viewer, input) => {
+            if (!viewer)
+                throw new InvalidRequestError('Authentication required');
+            const body = input;
+            if (!body.token || typeof body.token !== 'string')
+                throw new InvalidRequestError('Missing or invalid token');
+            const { unregisterToken } = await import("./push.js");
+            await unregisterToken(viewer.did, body.token);
+            return { success: true };
+        });
+        registerCoreXrpcHandler('dev.hatk.createReport', async (_params, _cursor, _limit, viewer, input) => {
+            if (!viewer)
+                throw new InvalidRequestError('Authentication required');
+            const body = input;
+            if (!body.subject)
+                throw new InvalidRequestError('Missing subject');
+            if (!body.label || typeof body.label !== 'string')
+                throw new InvalidRequestError('Missing or invalid label');
+            const defs = getLabelDefinitions();
+            if (!defs.some((d) => d.identifier === body.label)) {
+                throw new InvalidRequestError(`Unknown label: ${body.label}`);
+            }
+            if (body.reason && body.reason.length > 2000) {
+                throw new InvalidRequestError('Reason must be 2000 characters or less');
+            }
+            let subjectUri;
+            let subjectDid;
+            if (body.subject.uri) {
+                subjectUri = body.subject.uri;
+                const match = body.subject.uri.match(/^at:\/\/(did:[^/]+)/);
+                if (!match)
+                    throw new InvalidRequestError('Invalid subject URI');
+                subjectDid = match[1];
+            }
+            else if (body.subject.did) {
+                // The bare DID, not `at://<did>`: resolving this report labels
+                // `subjectUri`, and an account label is keyed by DID alone. Ozone
+                // writes it that way and every appview reads it that way, so the
+                // `at://` form would apply a label nothing ever looks up.
+                subjectUri = body.subject.did;
+                subjectDid = body.subject.did;
+            }
+            else {
+                throw new InvalidRequestError('Subject must have uri or did');
+            }
+            const result = await insertReport({
+                subjectUri,
+                subjectDid,
+                label: body.label,
+                reason: body.reason,
+                reportedBy: viewer.did,
+            });
+            return {
+                id: result.id,
+                subject: body.subject,
+                label: body.label,
+                reason: body.reason || null,
+                reportedBy: viewer.did,
+                createdAt: new Date().toISOString(),
+            };
+        });
+    }
 }
-export function startServer(port, collections, publicDir, oauth, admins = [], resolveViewer) {
-    const coreXrpc = (method) => `/xrpc/dev.hatk.${method}`;
+/**
+ * Assets we ship inside the package never change while the process is alive, so
+ * read, gzip and hash them once. Repeat visits then cost a 304 instead of the
+ * full (uncompressed) payload.
+ */
+const bundledAssets = new Map();
+async function serveBundledAsset(path, contentType, request, devMode) {
+    let asset = devMode ? undefined : bundledAssets.get(path);
+    if (!asset) {
+        const raw = await readFile(path);
+        asset = {
+            raw,
+            gzip: gzipSync(raw),
+            etag: `"${createHash('sha256').update(raw).digest('base64url').slice(0, 16)}"`,
+        };
+        if (!devMode)
+            bundledAssets.set(path, asset);
+    }
+    const headers = { ETag: asset.etag, 'Cache-Control': 'no-cache' };
+    if (request.headers.get('if-none-match') === asset.etag) {
+        return new Response(null, { status: 304, headers });
+    }
+    const acceptEncoding = request.headers.get('accept-encoding');
+    const useGzip = !!acceptEncoding && /\bgzip\b/.test(acceptEncoding);
+    if (useGzip) {
+        headers['Content-Encoding'] = 'gzip';
+        headers.Vary = 'Accept-Encoding';
+    }
+    headers['Content-Type'] = contentType;
+    return new Response(Buffer.from(useGzip ? asset.gzip : asset.raw), { status: 200, headers });
+}
+function bearerMatches(header, token) {
+    if (!header?.startsWith('Bearer '))
+        return false;
+    const given = Buffer.from(header.slice('Bearer '.length));
+    const want = Buffer.from(token);
+    return given.length === want.length && timingSafeEqual(given, want);
+}
+/**
+ * Create a Web Standard request handler for all hatk routes.
+ * Returns a pure function: (Request) → Promise<Response>
+ */
+export function createHandler(config) {
+    const { collections, publicDir, oauth, admins } = config;
     const devMode = process.env.DEV_MODE === '1';
-    function requireAdmin(viewer, res) {
-        if (!viewer) {
-            jsonError(res, 401, 'Authentication required');
-            return false;
-        }
-        if (!devMode && !admins.includes(viewer.did)) {
-            jsonError(res, 403, 'Admin access required');
-            return false;
-        }
-        return true;
+    const coreXrpc = (method) => `/xrpc/dev.hatk.${method}`;
+    const adminToken = config.adminToken ?? null;
+    if (adminToken?.actor.startsWith('did:'))
+        throw new Error('adminToken.actor must not be a DID');
+    function requireAdmin(viewer, acceptEncoding) {
+        if (!viewer)
+            return withCors(jsonError(401, 'Authentication required', acceptEncoding));
+        // The token's actor is never a DID, so no signed-in account can be it.
+        if (!devMode && !admins.includes(viewer.did) && viewer.did !== adminToken?.actor)
+            return withCors(jsonError(403, 'Admin access required', acceptEncoding));
+        return null; // auth OK
     }
-    const server = createServer(async (req, res) => {
-        const url = new URL(req.url, `http://localhost:${port}`);
-        res.setHeader('Access-Control-Allow-Origin', '*');
-        res.setHeader('Access-Control-Allow-Headers', '*');
-        res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
-        if (req.method === 'OPTIONS') {
-            res.writeHead(200);
-            res.end();
-            return;
-        }
+    // The /admin/info rollups count every row in every collection table, so they get
+    // slower as the index grows. Cache them for a few seconds — that collapses the
+    // overview's repeat loads and any concurrent requests into one scan — and drop
+    // the cache whenever an admin action changes what they report.
+    const ADMIN_STATS_TTL_MS = 10_000;
+    let adminStats = null;
+    function getAdminStats() {
+        if (adminStats && Date.now() - adminStats.at < ADMIN_STATS_TTL_MS)
+            return adminStats.data;
+        const data = (async () => {
+            const [repos, duckdb, collections, openReports] = await Promise.all([
+                getRepoStatusCounts(),
+                getDatabaseSize(),
+                getCollectionCounts(),
+                getOpenReportCount(),
+            ]);
+            return { repos, duckdb, collections, openReports };
+        })();
+        const entry = { at: Date.now(), data };
+        adminStats = entry;
+        // Don't cache a failure — and keep the rejection handled so it surfaces only
+        // at the awaiting request.
+        data.catch(() => {
+            if (adminStats === entry)
+                adminStats = null;
+        });
+        return data;
+    }
+    function invalidateAdminStats() {
+        adminStats = null;
+    }
+    return async (request) => {
+        const url = new URL(request.url);
+        const acceptEncoding = request.headers.get('accept-encoding');
+        // CORS preflight
+        if (request.method === 'OPTIONS')
+            return cors();
         const isXrpc = url.pathname.startsWith('/xrpc/');
         const isAdmin = url.pathname.startsWith('/admin') && !url.pathname.endsWith('.html') && !url.pathname.endsWith('.js');
         const elapsed = isXrpc || isAdmin ? timer() : null;
         let error;
-        const requestOrigin = `${req.headers['x-forwarded-proto'] || 'http'}://${req.headers['host'] || `localhost:${port}`}`;
+        const requestOrigin = `${request.headers.get('x-forwarded-proto') || 'http'}://${request.headers.get('host') || 'localhost'}`;
         // Authenticate viewer (optional — unauthenticated requests still work)
-        let viewer = resolveViewer?.(req) ?? null;
+        let viewer = config.resolveViewer?.(request) ?? null;
+        // The admin token reaches /admin and nothing else: on an XRPC route it is
+        // not a viewer, so a service holding it cannot act as an account.
+        if (!viewer && isAdmin && adminToken && bearerMatches(request.headers.get('authorization'), adminToken.token)) {
+            viewer = { did: adminToken.actor };
+        }
         if (!viewer && oauth) {
             try {
-                viewer = await authenticate(req.headers['authorization'] || null, req.headers['dpop'] || null, req.method, `${requestOrigin}${url.pathname}`);
+                viewer = await authenticate(request.headers.get('authorization'), request.headers.get('dpop'), request.method, `${requestOrigin}${url.pathname}`);
             }
             catch (err) {
                 emit('oauth', 'authenticate_error', { error: err.message });
             }
         }
+        // Fallback: resolve viewer from session cookie (for browser requests without DPoP)
+        if (!viewer && oauth) {
+            try {
+                viewer = await parseSessionCookie(request);
+            }
+            catch { }
+        }
+        // Which permissioned spaces this request may be shown, established once and
+        // read by every query below. A signed-out visitor gets none — there is no
+        // anonymous read path into a space — and so does an instance that indexes
+        // none, which is every deployment that has not configured `spaces`.
+        try {
+            enterReadableSpaces(await readableSpacesFor(oauth, viewer));
+        }
+        catch (err) {
+            // Failing to establish the scope must not widen it: the default is to
+            // serve no space row, and that is what an unresolved viewer gets.
+            enterReadableSpaces([]);
+            emit('spaces', 'viewer_resolve_error', { error: err.message });
+        }
         try {
             // GET /xrpc/dev.hatk.getRecords?collection=<nsid>&limit=N&cursor=C&<field>=<value>
             if (url.pathname === coreXrpc('getRecords')) {
                 const collection = url.searchParams.get('collection');
-                if (!collection) {
-                    jsonError(res, 400, 'Missing collection parameter');
-                    return;
-                }
-                if (!getSchema(collection)) {
-                    jsonError(res, 404, `Unknown collection: ${collection}`);
-                    return;
-                }
-                const limit = parseInt(url.searchParams.get('limit') || '20');
+                if (!collection)
+                    return withCors(jsonError(400, 'Missing collection parameter', acceptEncoding));
+                if (isPrivateCollection(collection))
+                    return withCors(jsonError(404, `Unknown collection: ${collection}`, acceptEncoding));
+                if (!getSchema(collection))
+                    return withCors(jsonError(404, `Unknown collection: ${collection}`, acceptEncoding));
+                // Every one of these is attacker-controlled, and queryRecords trusts
+                // what it is handed: `sort` and `order` reach the ORDER BY clause and a
+                // non-numeric `limit` reaches the driver. Rejecting them here keeps a
+                // bad query string a 400 instead of a 500 (or worse).
+                const limit = parseLimit(url.searchParams.get('limit'), 20);
+                if (limit === null)
+                    return withCors(jsonError(400, 'Invalid limit parameter', acceptEncoding));
                 const cursor = url.searchParams.get('cursor') || undefined;
                 const sort = url.searchParams.get('sort') || undefined;
-                const order = (url.searchParams.get('order') || undefined);
-                // Collect field filters (everything except reserved params)
+                const order = parseOrder(url.searchParams.get('order'));
+                if (order === null)
+                    return withCors(jsonError(400, `Invalid order: ${url.searchParams.get('order')}`, acceptEncoding));
+                if (sort && !isSortableField(collection, sort))
+                    return withCors(jsonError(400, `Invalid sort field: ${sort}`, acceptEncoding));
+                // Collect field filters (everything except reserved params). An
+                // unknown field is ignored rather than rejected — queryRecords does
+                // the same, and clients rely on passing through extra params.
                 const reserved = new Set(['collection', 'limit', 'cursor', 'sort', 'order']);
                 const filters = {};
                 for (const [key, value] of url.searchParams) {
@@ -110,248 +463,209 @@ export function startServer(port, collections, publicDir, oauth, admins = [], re
                 });
                 const uris = result.records.map((r) => r.uri);
                 const items = await resolveRecords(uris);
-                jsonResponse(res, { items, cursor: result.cursor });
-                return;
+                return withCors(json({ items, cursor: result.cursor }, 200, acceptEncoding));
             }
             // GET /xrpc/dev.hatk.getRecord?uri=<at-uri>
             if (url.pathname === coreXrpc('getRecord')) {
                 const uri = url.searchParams.get('uri');
-                if (!uri) {
-                    jsonError(res, 400, 'Missing uri parameter');
-                    return;
-                }
+                if (!uri)
+                    return withCors(jsonError(400, 'Missing uri parameter', acceptEncoding));
+                if (isPrivateCollection(collectionFromUri(uri)))
+                    return withCors(jsonError(404, 'Record not found', acceptEncoding));
                 const record = await getRecordByUri(uri);
-                if (!record) {
-                    jsonError(res, 404, 'Record not found');
-                    return;
-                }
+                if (!record)
+                    return withCors(jsonError(404, 'Record not found', acceptEncoding));
                 const shaped = reshapeRow(record, record?.__childData);
                 const labelsMap = await queryLabelsForUris([record.uri]);
                 if (shaped)
                     shaped.labels = labelsMap.get(record.uri) || [];
-                jsonResponse(res, { record: shaped });
-                return;
+                return withCors(json({ record: shaped }, 200, acceptEncoding));
             }
             // GET /xrpc/dev.hatk.getFeed?feed=<name>&limit=N&cursor=C
             if (url.pathname === coreXrpc('getFeed')) {
                 const feedName = url.searchParams.get('feed');
-                if (!feedName) {
-                    jsonError(res, 400, 'Missing feed parameter');
-                    return;
-                }
+                if (!feedName)
+                    return withCors(jsonError(400, 'Missing feed parameter', acceptEncoding));
                 const limit = parseInt(url.searchParams.get('limit') || '30');
                 const cursor = url.searchParams.get('cursor') || undefined;
-                const params = {};
-                for (const [key, value] of url.searchParams) {
-                    params[key] = value;
-                }
+                const params = paramsFromSearch(url.searchParams);
                 const result = await executeFeed(feedName, params, cursor, limit, viewer);
-                if (!result) {
-                    jsonError(res, 404, `Unknown feed: ${feedName}`);
-                    return;
-                }
-                jsonResponse(res, result);
-                return;
+                if (!result)
+                    return withCors(jsonError(404, `Unknown feed: ${feedName}`, acceptEncoding));
+                return withCors(json(result, 200, acceptEncoding));
             }
             // GET /xrpc/dev.hatk.searchRecords?collection=<nsid>&q=<query>&limit=N&cursor=C
             if (url.pathname === coreXrpc('searchRecords')) {
                 const collection = url.searchParams.get('collection');
                 const q = url.searchParams.get('q');
-                if (!collection) {
-                    jsonError(res, 400, 'Missing collection parameter');
-                    return;
-                }
-                if (!q) {
-                    jsonError(res, 400, 'Missing q parameter');
-                    return;
-                }
-                if (!getSchema(collection)) {
-                    jsonError(res, 404, `Unknown collection: ${collection}`);
-                    return;
-                }
+                if (!collection)
+                    return withCors(jsonError(400, 'Missing collection parameter', acceptEncoding));
+                if (!q)
+                    return withCors(jsonError(400, 'Missing q parameter', acceptEncoding));
+                if (isPrivateCollection(collection))
+                    return withCors(jsonError(404, `Unknown collection: ${collection}`, acceptEncoding));
+                if (!getSchema(collection))
+                    return withCors(jsonError(404, `Unknown collection: ${collection}`, acceptEncoding));
                 const limit = parseInt(url.searchParams.get('limit') || '20');
                 const cursor = url.searchParams.get('cursor') || undefined;
                 const fuzzy = url.searchParams.get('fuzzy') !== 'false';
                 const result = await searchRecords(collection, q, { limit, cursor, fuzzy });
                 const uris = result.records.map((r) => r.uri);
                 const items = await resolveRecords(uris);
-                jsonResponse(res, { items, cursor: result.cursor });
-                return;
+                return withCors(json({ items, cursor: result.cursor }, 200, acceptEncoding));
             }
             // GET /xrpc/dev.hatk.describeFeeds
             if (url.pathname === coreXrpc('describeFeeds')) {
-                jsonResponse(res, { feeds: listFeeds() });
-                return;
+                return withCors(json({ feeds: listFeeds() }, 200, acceptEncoding));
             }
             // GET /xrpc/dev.hatk.describeCollections
             if (url.pathname === coreXrpc('describeCollections')) {
-                const collectionInfo = collections.map((c) => {
+                const collectionInfo = collections
+                    .filter((c) => !isPrivateCollection(c))
+                    .map((c) => {
                     const schema = getSchema(c);
                     return {
                         collection: c,
                         columns: schema?.columns.map((col) => ({
                             name: col.name,
                             originalName: col.originalName,
-                            type: col.duckdbType,
+                            type: col.sqlType,
                             required: col.notNull,
                         })),
                     };
                 });
-                jsonResponse(res, { collections: collectionInfo });
-                return;
+                return withCors(json({ collections: collectionInfo }, 200, acceptEncoding));
             }
             // GET /xrpc/dev.hatk.describeLabels
             if (url.pathname === coreXrpc('describeLabels')) {
-                jsonResponse(res, { definitions: getLabelDefinitions() });
-                return;
+                return withCors(json({ definitions: getLabelDefinitions() }, 200, acceptEncoding));
             }
             // GET /xrpc/dev.hatk.getPreferences — get all preferences for authenticated user
             if (url.pathname === coreXrpc('getPreferences')) {
-                if (!viewer) {
-                    jsonError(res, 401, 'Authentication required');
-                    return;
-                }
+                if (!viewer)
+                    return withCors(jsonError(401, 'Authentication required', acceptEncoding));
                 const prefs = await getPreferences(viewer.did);
-                jsonResponse(res, { preferences: prefs });
-                return;
+                return withCors(json({ preferences: prefs }, 200, acceptEncoding));
             }
             // POST /xrpc/dev.hatk.putPreference — set a single preference
-            if (url.pathname === coreXrpc('putPreference') && req.method === 'POST') {
-                if (!viewer) {
-                    jsonError(res, 401, 'Authentication required');
-                    return;
-                }
-                const body = JSON.parse(await readBody(req));
-                if (!body.key || typeof body.key !== 'string') {
-                    jsonError(res, 400, 'Missing or invalid key');
-                    return;
-                }
-                if (body.value === undefined) {
-                    jsonError(res, 400, 'Missing value');
-                    return;
-                }
+            if (url.pathname === coreXrpc('putPreference') && request.method === 'POST') {
+                if (!viewer)
+                    return withCors(jsonError(401, 'Authentication required', acceptEncoding));
+                const body = JSON.parse(await request.text());
+                if (!body.key || typeof body.key !== 'string')
+                    return withCors(jsonError(400, 'Missing or invalid key', acceptEncoding));
+                if (body.value === undefined)
+                    return withCors(jsonError(400, 'Missing value', acceptEncoding));
                 await putPreference(viewer.did, body.key, body.value);
-                jsonResponse(res, { success: true });
-                return;
+                return withCors(json({ success: true }, 200, acceptEncoding));
             }
             // ── Admin Repo Management ──
             // POST /admin/repos/add — enqueue DIDs for backfill
-            if (url.pathname === '/admin/repos/add' && req.method === 'POST') {
-                if (!requireAdmin(viewer, res))
-                    return;
-                const { dids } = JSON.parse(await readBody(req));
-                if (!Array.isArray(dids)) {
-                    jsonError(res, 400, 'Missing dids array');
-                    return;
-                }
+            if (url.pathname === '/admin/repos/add' && request.method === 'POST') {
+                const denied = requireAdmin(viewer, acceptEncoding);
+                if (denied)
+                    return denied;
+                const { dids } = JSON.parse(await request.text());
+                if (!Array.isArray(dids))
+                    return withCors(jsonError(400, 'Missing dids array', acceptEncoding));
                 for (const did of dids) {
                     await setRepoStatus(did, 'pending');
                     triggerAutoBackfill(did);
                 }
-                jsonResponse(res, { added: dids.length });
-                return;
+                invalidateAdminStats();
+                return withCors(json({ added: dids.length }, 200, acceptEncoding));
             }
             // POST /admin/labels/rescan — retroactively apply label rules
-            if (url.pathname === '/admin/labels/rescan' && req.method === 'POST') {
-                if (!requireAdmin(viewer, res))
-                    return;
+            if (url.pathname === '/admin/labels/rescan' && request.method === 'POST') {
+                const denied = requireAdmin(viewer, acceptEncoding);
+                if (denied)
+                    return denied;
                 const result = await rescanLabels(collections);
-                jsonResponse(res, result);
-                return;
+                return withCors(json(result, 200, acceptEncoding));
             }
             // ── Admin Endpoints ──
             // GET /admin/whoami — check if current viewer is admin
             if (url.pathname === '/admin/whoami') {
-                if (!requireAdmin(viewer, res))
-                    return;
-                jsonResponse(res, { did: viewer.did, admin: true });
-                return;
+                const denied = requireAdmin(viewer, acceptEncoding);
+                if (denied)
+                    return denied;
+                return withCors(json({ did: viewer.did, admin: true }, 200, acceptEncoding));
             }
             // GET /admin/labels/definitions — get available label definitions
             if (url.pathname === '/admin/labels/definitions') {
-                if (!requireAdmin(viewer, res))
-                    return;
-                jsonResponse(res, { definitions: getLabelDefinitions() });
-                return;
+                const denied = requireAdmin(viewer, acceptEncoding);
+                if (denied)
+                    return denied;
+                return withCors(json({ definitions: getLabelDefinitions() }, 200, acceptEncoding));
             }
             // POST /admin/labels — apply a label
-            if (url.pathname === '/admin/labels' && req.method === 'POST') {
-                if (!requireAdmin(viewer, res))
-                    return;
-                const { uri, val } = JSON.parse(await readBody(req));
-                if (!uri || !val) {
-                    jsonError(res, 400, 'Missing uri or val');
-                    return;
-                }
+            if (url.pathname === '/admin/labels' && request.method === 'POST') {
+                const denied = requireAdmin(viewer, acceptEncoding);
+                if (denied)
+                    return denied;
+                const { uri, val } = JSON.parse(await request.text());
+                if (!uri || !val)
+                    return withCors(jsonError(400, 'Missing uri or val', acceptEncoding));
                 await insertLabels([{ src: 'admin', uri, val }]);
-                jsonResponse(res, { ok: true });
-                return;
+                return withCors(json({ ok: true }, 200, acceptEncoding));
             }
             // POST /admin/labels/reset — delete all labels of a given type
-            if (url.pathname === '/admin/labels/reset' && req.method === 'POST') {
-                if (!requireAdmin(viewer, res))
-                    return;
-                const { val } = JSON.parse(await readBody(req));
-                if (!val) {
-                    jsonError(res, 400, 'Missing val');
-                    return;
-                }
-                const result = await querySQL(`SELECT COUNT(*)::INTEGER as count FROM _labels WHERE val = $1`, [val]);
-                const count = Number(result[0]?.count || 0);
-                await querySQL(`DELETE FROM _labels WHERE val = $1`, [val]);
-                jsonResponse(res, { deleted: count });
-                return;
+            if (url.pathname === '/admin/labels/reset' && request.method === 'POST') {
+                const denied = requireAdmin(viewer, acceptEncoding);
+                if (denied)
+                    return denied;
+                const { val } = JSON.parse(await request.text());
+                if (!val)
+                    return withCors(jsonError(400, 'Missing val', acceptEncoding));
+                const deleted = await deleteLabels(val);
+                return withCors(json({ deleted }, 200, acceptEncoding));
             }
             // POST /admin/labels/negate — negate a label
-            if (url.pathname === '/admin/labels/negate' && req.method === 'POST') {
-                if (!requireAdmin(viewer, res))
-                    return;
-                const { uri, val } = JSON.parse(await readBody(req));
-                if (!uri || !val) {
-                    jsonError(res, 400, 'Missing uri or val');
-                    return;
-                }
+            if (url.pathname === '/admin/labels/negate' && request.method === 'POST') {
+                const denied = requireAdmin(viewer, acceptEncoding);
+                if (denied)
+                    return denied;
+                const { uri, val } = JSON.parse(await request.text());
+                if (!uri || !val)
+                    return withCors(jsonError(400, 'Missing uri or val', acceptEncoding));
                 await insertLabels([{ src: 'admin', uri, val, neg: true }]);
-                jsonResponse(res, { ok: true });
-                return;
+                return withCors(json({ ok: true }, 200, acceptEncoding));
             }
             // POST /admin/takedown — takedown an account
-            if (url.pathname === '/admin/takedown' && req.method === 'POST') {
-                if (!requireAdmin(viewer, res))
-                    return;
-                const { did } = JSON.parse(await readBody(req));
-                if (!did) {
-                    jsonError(res, 400, 'Missing did');
-                    return;
-                }
+            if (url.pathname === '/admin/takedown' && request.method === 'POST') {
+                const denied = requireAdmin(viewer, acceptEncoding);
+                if (denied)
+                    return denied;
+                const { did } = JSON.parse(await request.text());
+                if (!did)
+                    return withCors(jsonError(400, 'Missing did', acceptEncoding));
                 await setRepoStatus(did, 'takendown');
-                jsonResponse(res, { ok: true });
-                return;
+                invalidateAdminStats();
+                return withCors(json({ ok: true }, 200, acceptEncoding));
             }
             // POST /admin/reverse-takedown — reverse a takedown
-            if (url.pathname === '/admin/reverse-takedown' && req.method === 'POST') {
-                if (!requireAdmin(viewer, res))
-                    return;
-                const { did } = JSON.parse(await readBody(req));
-                if (!did) {
-                    jsonError(res, 400, 'Missing did');
-                    return;
-                }
+            if (url.pathname === '/admin/reverse-takedown' && request.method === 'POST') {
+                const denied = requireAdmin(viewer, acceptEncoding);
+                if (denied)
+                    return denied;
+                const { did } = JSON.parse(await request.text());
+                if (!did)
+                    return withCors(jsonError(400, 'Missing did', acceptEncoding));
                 await setRepoStatus(did, 'active');
-                jsonResponse(res, { ok: true });
-                return;
+                invalidateAdminStats();
+                return withCors(json({ ok: true }, 200, acceptEncoding));
             }
             // GET /admin/search — search records or accounts
             if (url.pathname === '/admin/search') {
-                if (!requireAdmin(viewer, res))
-                    return;
+                const denied = requireAdmin(viewer, acceptEncoding);
+                if (denied)
+                    return denied;
                 const q = url.searchParams.get('q') || '';
                 const type = url.searchParams.get('type') || 'records';
                 const limit = parseInt(url.searchParams.get('limit') || '20');
                 if (type === 'accounts') {
                     const accounts = await searchAccounts(q, limit);
-                    jsonResponse(res, { accounts });
-                    return;
+                    return withCors(json({ accounts }, 200, acceptEncoding));
                 }
                 // No query — live firehose activity (excludes bulk backfill records)
                 if (!q) {
@@ -359,11 +673,9 @@ export function startServer(port, collections, publicDir, oauth, admins = [], re
                     const allResults = [];
                     for (const col of collections) {
                         try {
-                            const schema = getSchema(col);
-                            if (!schema)
+                            const rows = await getRecentRecords(col, limit + offset);
+                            if (!rows.length)
                                 continue;
-                            // Only show records indexed after the repo's backfill completed (live activity)
-                            const rows = await querySQL(`SELECT t.* FROM ${schema.tableName} t JOIN _repos r ON t.did = r.did WHERE t.indexed_at > r.backfilled_at ORDER BY t.indexed_at DESC LIMIT $1`, [limit + offset]);
                             const uris = rows.map((r) => r.uri);
                             const labelsMap = await queryLabelsForUris(uris);
                             for (const rec of rows) {
@@ -378,22 +690,20 @@ export function startServer(port, collections, publicDir, oauth, admins = [], re
                         return ta > tb ? -1 : ta < tb ? 1 : 0;
                     });
                     const page = allResults.slice(offset, offset + limit);
-                    jsonResponse(res, { records: page, total: allResults.length });
-                    return;
+                    return withCors(json({ records: page, total: allResults.length }, 200, acceptEncoding));
                 }
                 // URI lookup
                 if (q.startsWith('at://')) {
                     const rec = await getRecordByUri(q);
                     if (rec) {
                         const labelsMap = await queryLabelsForUris([rec.uri]);
-                        jsonResponse(res, {
+                        return withCors(json({
                             records: [{ ...reshapeRow(rec, rec?.__childData), labels: labelsMap.get(rec.uri) || [] }],
-                        });
+                        }, 200, acceptEncoding));
                     }
                     else {
-                        jsonResponse(res, { records: [] });
+                        return withCors(json({ records: [] }, 200, acceptEncoding));
                     }
-                    return;
                 }
                 // DID lookup — find all records by this DID
                 if (q.startsWith('did:')) {
@@ -412,8 +722,7 @@ export function startServer(port, collections, publicDir, oauth, admins = [], re
                         }
                         catch { }
                     }
-                    jsonResponse(res, { records: allResults.slice(0, limit) });
-                    return;
+                    return withCors(json({ records: allResults.slice(0, limit) }, 200, acceptEncoding));
                 }
                 // Default: full-text search records across all collections
                 const allResults = [];
@@ -431,56 +740,62 @@ export function startServer(port, collections, publicDir, oauth, admins = [], re
                     }
                     catch { }
                 }
-                jsonResponse(res, { records: allResults.slice(0, limit) });
-                return;
+                return withCors(json({ records: allResults.slice(0, limit) }, 200, acceptEncoding));
             }
             // POST /admin/repos/resync — re-download repos
-            if (url.pathname === '/admin/repos/resync' && req.method === 'POST') {
-                if (!requireAdmin(viewer, res))
-                    return;
-                const body = await readBody(req);
-                const { dids } = body ? JSON.parse(body) : {};
+            if (url.pathname === '/admin/repos/resync' && request.method === 'POST') {
+                const denied = requireAdmin(viewer, acceptEncoding);
+                if (denied)
+                    return denied;
+                const bodyText = await request.text();
+                const { dids } = bodyText ? JSON.parse(bodyText) : {};
                 let repoList;
                 if (Array.isArray(dids) && dids.length > 0) {
                     repoList = dids;
                 }
                 else {
-                    const rows = await querySQL(`SELECT did FROM _repos WHERE status = 'active'`);
-                    repoList = rows.map((r) => r.did);
+                    repoList = await listActiveRepoDids();
                 }
+                const isTargeted = Array.isArray(dids) && dids.length > 0;
                 for (const did of repoList) {
                     await setRepoStatus(did, 'pending');
-                    triggerAutoBackfill(did);
                 }
-                jsonResponse(res, { resyncing: repoList.length });
-                return;
+                if (isTargeted) {
+                    for (const did of repoList) {
+                        triggerAutoBackfill(did);
+                    }
+                }
+                else if (config.onResync) {
+                    config.onResync();
+                }
+                else {
+                    for (const did of repoList) {
+                        triggerAutoBackfill(did);
+                    }
+                }
+                invalidateAdminStats();
+                return withCors(json({ resyncing: repoList.length }, 200, acceptEncoding));
             }
             // POST /admin/repos/remove — remove DIDs from tracking
-            if (url.pathname === '/admin/repos/remove' && req.method === 'POST') {
-                if (!requireAdmin(viewer, res))
-                    return;
-                const { dids } = JSON.parse(await readBody(req));
-                if (!Array.isArray(dids)) {
-                    jsonError(res, 400, 'Missing dids array');
-                    return;
-                }
+            if (url.pathname === '/admin/repos/remove' && request.method === 'POST') {
+                const denied = requireAdmin(viewer, acceptEncoding);
+                if (denied)
+                    return denied;
+                const { dids } = JSON.parse(await request.text());
+                if (!Array.isArray(dids))
+                    return withCors(jsonError(400, 'Missing dids array', acceptEncoding));
                 for (const did of dids) {
-                    await querySQL(`DELETE FROM _repos WHERE did = $1`, [did]);
+                    await removeRepo(did);
                 }
-                jsonResponse(res, { removed: dids.length });
-                return;
+                invalidateAdminStats();
+                return withCors(json({ removed: dids.length }, 200, acceptEncoding));
             }
             // GET /admin/info — aggregate status + db size + collection counts
             if (url.pathname === '/admin/info') {
-                if (!requireAdmin(viewer, res))
-                    return;
-                const rows = await querySQL(`SELECT status, COUNT(*)::INTEGER as count FROM _repos GROUP BY status`);
-                const counts = {};
-                for (const row of rows)
-                    counts[row.status] = Number(row.count);
-                const sizeRows = await querySQL(`SELECT database_size, memory_usage, memory_limit FROM pragma_database_size()`);
-                const dbInfo = sizeRows[0] ?? {};
-                const collectionCounts = await getCollectionCounts();
+                const denied = requireAdmin(viewer, acceptEncoding);
+                if (denied)
+                    return denied;
+                const stats = await getAdminStats();
                 const mem = process.memoryUsage();
                 const node = {
                     rss: `${(mem.rss / 1024 / 1024).toFixed(1)} MiB`,
@@ -488,372 +803,624 @@ export function startServer(port, collections, publicDir, oauth, admins = [], re
                     heapTotal: `${(mem.heapTotal / 1024 / 1024).toFixed(1)} MiB`,
                     external: `${(mem.external / 1024 / 1024).toFixed(1)} MiB`,
                 };
-                jsonResponse(res, { repos: counts, duckdb: dbInfo, node, collections: collectionCounts });
-                return;
+                return withCors(json({
+                    repos: stats.repos,
+                    duckdb: stats.duckdb,
+                    node,
+                    collections: stats.collections,
+                    openReports: stats.openReports,
+                }, 200, acceptEncoding));
+            }
+            // GET /admin/reports — list reports
+            if (url.pathname === '/admin/reports' && request.method === 'GET') {
+                const denied = requireAdmin(viewer, acceptEncoding);
+                if (denied)
+                    return denied;
+                const status = url.searchParams.get('status') || 'open';
+                const label = url.searchParams.get('label') || undefined;
+                const limit = parseInt(url.searchParams.get('limit') || '50');
+                const offset = parseInt(url.searchParams.get('offset') || '0');
+                const result = await queryReports({ status, label, limit, offset });
+                return withCors(json(result, 200, acceptEncoding));
+            }
+            // POST /admin/reports/resolve — resolve or dismiss a report
+            if (url.pathname === '/admin/reports/resolve' && request.method === 'POST') {
+                const denied = requireAdmin(viewer, acceptEncoding);
+                if (denied)
+                    return denied;
+                const { id, action } = JSON.parse(await request.text());
+                if (!id || !action)
+                    return withCors(jsonError(400, 'Missing id or action', acceptEncoding));
+                if (action !== 'resolve' && action !== 'dismiss')
+                    return withCors(jsonError(400, 'Action must be resolve or dismiss', acceptEncoding));
+                const report = await resolveReport(id, action === 'resolve' ? 'resolved' : 'dismissed', viewer.did);
+                if (!report)
+                    return withCors(jsonError(404, 'Report not found or already resolved', acceptEncoding));
+                if (action === 'resolve') {
+                    await insertLabels([{ src: 'admin', uri: report.subjectUri, val: report.label }]);
+                }
+                invalidateAdminStats();
+                return withCors(json({ ok: true }, 200, acceptEncoding));
+            }
+            // GET /admin/review — the classifier review queue
+            if (url.pathname === '/admin/review' && request.method === 'GET') {
+                const denied = requireAdmin(viewer, acceptEncoding);
+                if (denied)
+                    return denied;
+                const result = await queryClassifications({
+                    classifier: url.searchParams.get('classifier') || undefined,
+                    signal: url.searchParams.get('signal') || undefined,
+                    minScore: url.searchParams.has('minScore') ? Number(url.searchParams.get('minScore')) : undefined,
+                    state: url.searchParams.get('state') || 'pending',
+                    limit: parseInt(url.searchParams.get('limit') || '25'),
+                    offset: parseInt(url.searchParams.get('offset') || '0'),
+                });
+                return withCors(json(result, 200, acceptEncoding));
+            }
+            // GET /admin/review/stats — rollups, classifier names, scan progress
+            if (url.pathname === '/admin/review/stats' && request.method === 'GET') {
+                const denied = requireAdmin(viewer, acceptEncoding);
+                if (denied)
+                    return denied;
+                const stats = await getClassificationStats();
+                return withCors(json({ ...stats, classifiers: listClassifiers(), configured: isClefConfigured(), scan: getScanProgress() }, 200, acceptEncoding));
+            }
+            // POST /admin/review/scan — start a scan. Returns as soon as it is under
+            // way; a scan of a whole network outlives any sensible request timeout, so
+            // progress is polled from /admin/review/stats rather than awaited here.
+            if (url.pathname === '/admin/review/scan' && request.method === 'POST') {
+                const denied = requireAdmin(viewer, acceptEncoding);
+                if (denied)
+                    return denied;
+                if (!isClefConfigured())
+                    return withCors(jsonError(400, 'Clef is not configured — set `clef` in hatk.config.ts', acceptEncoding));
+                const body = JSON.parse((await request.text()) || '{}');
+                const running = getScanProgress();
+                if (running?.running)
+                    return withCors(jsonError(409, 'A scan is already running', acceptEncoding));
+                runScan({ classifier: body.classifier, force: body.force === true, limit: body.limit })
+                    .then(() => invalidateAdminStats())
+                    .catch(() => { });
+                return withCors(json({ ok: true, started: true }, 202, acceptEncoding));
+            }
+            // GET /admin/review/subject/:did — everything needed to judge one subject
+            if (url.pathname.startsWith('/admin/review/subject/')) {
+                const denied = requireAdmin(viewer, acceptEncoding);
+                if (denied)
+                    return denied;
+                const did = decodeURIComponent(url.pathname.slice('/admin/review/subject/'.length));
+                if (!did.startsWith('did:'))
+                    return withCors(jsonError(400, 'Expected a DID', acceptEncoding));
+                const [records, counts, handle, status, labels] = await Promise.all([
+                    getRecordsByDid(did, collections, 6),
+                    getRecordCountsByDid(did, collections),
+                    getRepoHandle(did),
+                    getRepoStatus(did),
+                    queryLabelsForUris([did]),
+                ]);
+                return withCors(json({ did, handle, status, records, counts, labels }, 200, acceptEncoding));
+            }
+            // POST /admin/review/act — resolve the report and act, in one step
+            if (url.pathname === '/admin/review/act' && request.method === 'POST') {
+                const denied = requireAdmin(viewer, acceptEncoding);
+                if (denied)
+                    return denied;
+                const { did, uri, action, label } = JSON.parse(await request.text());
+                const subjectUri = uri || did;
+                if (!subjectUri || !action)
+                    return withCors(jsonError(400, 'Missing subject or action', acceptEncoding));
+                if (!['takedown', 'label', 'dismiss'].includes(action))
+                    return withCors(jsonError(400, 'Action must be takedown, label or dismiss', acceptEncoding));
+                if (action === 'takedown') {
+                    if (!did)
+                        return withCors(jsonError(400, 'Takedown needs a did', acceptEncoding));
+                    await setRepoStatus(did, 'takendown');
+                }
+                else if (action === 'label') {
+                    if (!label)
+                        return withCors(jsonError(400, 'Label action needs a label', acceptEncoding));
+                    await insertLabels([{ src: 'admin', uri: subjectUri, val: label }]);
+                }
+                // Close whatever the classifier filed, so the subject leaves the queue
+                // whichever way it was decided.
+                for (const id of await findOpenReportsForSubject(subjectUri)) {
+                    await resolveReport(id, action === 'dismiss' ? 'dismissed' : 'resolved', viewer.did);
+                }
+                invalidateAdminStats();
+                return withCors(json({ ok: true }, 200, acceptEncoding));
             }
             // GET /admin/info/:did — repo status info
             if (url.pathname.startsWith('/admin/info/did:')) {
-                if (!requireAdmin(viewer, res))
-                    return;
+                const denied = requireAdmin(viewer, acceptEncoding);
+                if (denied)
+                    return denied;
                 const did = url.pathname.slice('/admin/info/'.length);
                 const status = await getRepoStatus(did);
-                if (!status) {
-                    jsonError(res, 404, 'Repo not found');
-                    return;
-                }
+                if (!status)
+                    return withCors(jsonError(404, 'Repo not found', acceptEncoding));
                 const retryInfo = await getRepoRetryInfo(did);
-                jsonResponse(res, {
+                return withCors(json({
                     did,
                     status,
                     retry_count: retryInfo?.retryCount ?? 0,
                     retry_after: retryInfo?.retryAfter ?? 0,
-                });
-                return;
+                }, 200, acceptEncoding));
             }
             // GET /admin/repos — paginated repo listing
-            if (url.pathname === '/admin/repos' && req.method === 'GET') {
-                if (!requireAdmin(viewer, res))
-                    return;
+            if (url.pathname === '/admin/repos' && request.method === 'GET') {
+                const denied = requireAdmin(viewer, acceptEncoding);
+                if (denied)
+                    return denied;
                 const limit = parseInt(url.searchParams.get('limit') || '50');
                 const offset = parseInt(url.searchParams.get('offset') || '0');
                 const status = url.searchParams.get('status') || undefined;
                 const q = url.searchParams.get('q') || undefined;
                 const result = await listReposPaginated({ limit, offset, status, q });
-                jsonResponse(res, result);
-                return;
-            }
-            // GET /admin/schema — full DuckDB DDL dump + lexicons
-            if (url.pathname === '/admin/schema') {
-                if (!requireAdmin(viewer, res))
-                    return;
-                const { getAllLexicons } = await import("./schema.js");
-                const ddl = await getSchemaDump();
-                jsonResponse(res, { ddl, lexicons: getAllLexicons() });
-                return;
+                return withCors(json(result, 200, acceptEncoding));
             }
             // ── Public Repo Endpoints (used by hatk clients for auto-sync) ──
             // POST /repos/add — enqueue DIDs for backfill (public)
-            if (url.pathname === '/repos/add' && req.method === 'POST') {
-                const { dids } = JSON.parse(await readBody(req));
-                if (!Array.isArray(dids)) {
-                    jsonError(res, 400, 'Missing dids array');
-                    return;
-                }
+            if (url.pathname === '/repos/add' && request.method === 'POST') {
+                const { dids } = JSON.parse(await request.text());
+                if (!Array.isArray(dids))
+                    return withCors(jsonError(400, 'Missing dids array', acceptEncoding));
                 for (const did of dids) {
                     await setRepoStatus(did, 'pending');
                     triggerAutoBackfill(did);
                 }
-                jsonResponse(res, { added: dids.length });
-                return;
+                return withCors(json({ added: dids.length }, 200, acceptEncoding));
             }
             // GET /info/:did — repo status info (public)
             if (url.pathname.startsWith('/info/did:')) {
                 const did = url.pathname.slice('/info/'.length);
                 const status = await getRepoStatus(did);
-                if (!status) {
-                    jsonError(res, 404, 'Repo not found');
-                    return;
-                }
+                if (!status)
+                    return withCors(jsonError(404, 'Repo not found', acceptEncoding));
                 const retryInfo = await getRepoRetryInfo(did);
-                jsonResponse(res, {
+                return withCors(json({
                     did,
                     status,
                     retry_count: retryInfo?.retryCount ?? 0,
                     retry_after: retryInfo?.retryAfter ?? 0,
-                });
-                return;
+                }, 200, acceptEncoding));
             }
             // --- OAuth Endpoints ---
+            // GET /.well-known/did.json — this instance's own DID document, so a space
+            // authority can resolve where to deliver notices. Published only when a
+            // service DID is configured; it carries a service entry and no key.
+            if (url.pathname === '/.well-known/did.json' && config.spaces?.serviceDid) {
+                return withCors(json(spaceDidDocument(config.spaces.serviceDid, config.spaces.publicUrl ?? requestOrigin, config.spaces.serviceFragment ?? 'atproto_space_syncer'), 200, acceptEncoding));
+            }
             // OAuth well-known endpoints
             if (url.pathname === '/.well-known/oauth-authorization-server' && oauth) {
-                jsonResponse(res, getAuthServerMetadata(oauth.issuer, oauth));
-                return;
+                return withCors(json(getAuthServerMetadata(oauth.issuer, oauth), 200, acceptEncoding));
             }
             if (url.pathname === '/.well-known/oauth-protected-resource' && oauth) {
-                jsonResponse(res, getProtectedResourceMetadata(oauth.issuer, oauth));
-                return;
+                return withCors(json(getProtectedResourceMetadata(oauth.issuer, oauth), 200, acceptEncoding));
             }
             if (url.pathname === '/oauth/jwks' && oauth) {
-                jsonResponse(res, getJwks());
-                return;
+                return withCors(json(getJwks(), 200, acceptEncoding));
             }
             if ((url.pathname === '/oauth/client-metadata.json' || url.pathname === '/oauth-client-metadata.json') && oauth) {
-                jsonResponse(res, getClientMetadata(oauth.issuer, oauth));
-                return;
+                return withCors(json(getClientMetadata(oauth.issuer, oauth), 200, acceptEncoding));
+            }
+            // Public key a PDS fetches to verify our client assertions.
+            if (url.pathname === '/oauth/client-jwks.json' && oauth) {
+                return withCors(json(getClientJwks(), 200, acceptEncoding));
+            }
+            // Dev-only: create a session cookie for any DID (for testing)
+            if (url.pathname === '/__dev/login' && devMode && oauth) {
+                const did = url.searchParams.get('did');
+                if (!did)
+                    return withCors(jsonError(400, 'did required', acceptEncoding));
+                const handle = (await getRepoHandle(did)) ?? did;
+                const cookieValue = await createSessionCookie({ did, handle });
+                const secure = url.protocol === 'https:';
+                const accounts = await createAccountsCookie(withAccount(await parseAccountsCookie(request), { did, handle }));
+                return new Response(JSON.stringify({ ok: true }), {
+                    status: 200,
+                    headers: [
+                        ['Content-Type', 'application/json'],
+                        ['Set-Cookie', sessionCookieHeader(cookieValue, secure)],
+                        ['Set-Cookie', accountsCookieHeader(accounts, secure)],
+                    ],
+                });
+            }
+            // OAuth Login (server-initiated, no DPoP required)
+            if (url.pathname === '/oauth/login' && oauth) {
+                const handle = url.searchParams.get('handle') || '';
+                const prompt = url.searchParams.get('prompt') || undefined;
+                const pds = url.searchParams.get('pds') || undefined;
+                if (!handle && prompt !== 'create')
+                    return withCors(jsonError(400, 'handle required', acceptEncoding));
+                try {
+                    const redirectUrl = await serverLogin(oauth, handle, { prompt, pds });
+                    return new Response(null, {
+                        status: 302,
+                        headers: { Location: redirectUrl, 'Set-Cookie': clearSessionCookieHeader() },
+                    });
+                }
+                catch (err) {
+                    const message = err instanceof Error ? err.message : 'Login failed';
+                    return withCors(jsonError(400, message, acceptEncoding));
+                }
             }
             // OAuth PAR
-            if (url.pathname === '/oauth/par' && req.method === 'POST' && oauth) {
-                const rawBody = await readBody(req);
+            if (url.pathname === '/oauth/par' && request.method === 'POST' && oauth) {
+                const rawBody = await request.text();
                 let body;
-                if (req.headers['content-type']?.includes('application/x-www-form-urlencoded')) {
+                if (request.headers.get('content-type')?.includes('application/x-www-form-urlencoded')) {
                     body = Object.fromEntries(new URLSearchParams(rawBody));
                 }
                 else {
                     body = JSON.parse(rawBody);
                 }
-                const dpopHeader = req.headers['dpop'];
-                if (!dpopHeader) {
-                    jsonError(res, 400, 'DPoP header required');
-                    return;
+                const dpopHeader = request.headers.get('dpop');
+                if (!dpopHeader)
+                    return withCors(jsonError(400, 'DPoP header required', acceptEncoding));
+                try {
+                    const result = await handlePar(oauth, body, dpopHeader, `${requestOrigin}/oauth/par`);
+                    return withCors(json(result, 200, acceptEncoding));
+                }
+                catch (err) {
+                    const message = err instanceof Error ? err.message : 'Unknown error';
+                    return withCors(jsonError(400, message, acceptEncoding));
                 }
-                const result = await handlePar(oauth, body, dpopHeader, `${requestOrigin}/oauth/par`);
-                jsonResponse(res, result);
-                return;
             }
             // OAuth Authorize
             if (url.pathname === '/oauth/authorize' && oauth) {
                 const requestUri = url.searchParams.get('request_uri');
-                if (!requestUri) {
-                    jsonError(res, 400, 'request_uri required');
-                    return;
-                }
-                const request = await getOAuthRequest(requestUri);
-                if (!request) {
-                    jsonError(res, 400, 'Invalid or expired request_uri');
-                    return;
-                }
-                const redirectUrl = buildAuthorizeRedirect(oauth, request);
-                res.writeHead(302, { Location: redirectUrl });
-                res.end();
-                return;
+                if (!requestUri)
+                    return withCors(jsonError(400, 'request_uri required', acceptEncoding));
+                const oauthRequest = await getOAuthRequest(requestUri);
+                if (!oauthRequest)
+                    return withCors(jsonError(400, 'Invalid or expired request_uri', acceptEncoding));
+                const redirectUrl = buildAuthorizeRedirect(oauth, oauthRequest);
+                return new Response(null, { status: 302, headers: { Location: redirectUrl } });
             }
             // OAuth Callback (PDS redirects here after user approves)
             // Skip if iss matches our own issuer — that's the client-side redirect, let the SPA handle it
             if (url.pathname === '/oauth/callback' && oauth) {
                 const iss = url.searchParams.get('iss');
-                if (iss === oauth.issuer) {
-                    // Client-side callback — fall through to SPA
-                }
-                else {
+                if (iss !== oauth.issuer) {
                     const code = url.searchParams.get('code');
                     const state = url.searchParams.get('state');
-                    if (!code) {
-                        jsonError(res, 400, 'Missing code');
-                        return;
+                    const oauthError = url.searchParams.get('error');
+                    if (oauthError) {
+                        const errorRedirect = await handleCallbackError(oauth, oauthError, url.searchParams.get('error_description'), state);
+                        return new Response(null, {
+                            status: 302,
+                            headers: { Location: errorRedirect, 'Set-Cookie': clearSessionCookieHeader() },
+                        });
+                    }
+                    if (!code)
+                        return withCors(jsonError(400, 'Missing code', acceptEncoding));
+                    let result;
+                    try {
+                        result = await handleCallback(oauth, code, state, iss);
                     }
-                    const result = await handleCallback(oauth, code, state, iss);
-                    res.writeHead(302, { Location: result.clientRedirectUri });
-                    res.end();
-                    return;
+                    catch (err) {
+                        // Same convention as the token endpoint below: an error that names
+                        // its own status keeps it, anything else is a genuine failure and
+                        // falls through to the 500.
+                        if (err instanceof OAuthError)
+                            return withCors(json({ error: err.code, error_description: err.description }, err.status, acceptEncoding));
+                        // A callback matching no pending authorization request is a stale
+                        // redirect, not a server fault — the request expired while a login
+                        // tab sat open, or the user came back to a login they already
+                        // finished. Answer like the other client errors on this route.
+                        if (err instanceof Error && err.message === 'No matching authorization request found')
+                            return withCors(jsonError(400, err.message, acceptEncoding));
+                        throw err;
+                    }
+                    const isSecure = requestOrigin.startsWith('https');
+                    const handle = (await getRepoHandle(result.did)) ?? result.did;
+                    const session = { did: result.did, handle };
+                    const cookie = await createSessionCookie(session);
+                    // Remember the account alongside the active session so the browser
+                    // can switch back to it later without another trip to the PDS.
+                    const accounts = await createAccountsCookie(withAccount(await parseAccountsCookie(request), session));
+                    // Server-initiated login stores redirectUri as '/' — redirect cleanly without code/iss params
+                    const redirectTo = result.clientRedirectUri.startsWith('/?code=') ? '/' : result.clientRedirectUri;
+                    return new Response(null, {
+                        status: 302,
+                        headers: [
+                            ['Location', redirectTo],
+                            ['Set-Cookie', sessionCookieHeader(cookie, isSecure)],
+                            ['Set-Cookie', accountsCookieHeader(accounts, isSecure)],
+                        ],
+                    });
+                }
+                // Client-side callback — fall through to SPA
+            }
+            // Session cookie logout. Also drops the account from the switch list —
+            // leaving it there would keep a working path back into an account the
+            // user believes they signed out of, which matters on a shared machine.
+            if (url.pathname === '/auth/logout' && request.method === 'POST') {
+                const current = await parseSessionCookie(request);
+                const isSecure = requestOrigin.startsWith('https');
+                const headers = [['Set-Cookie', clearSessionCookieHeader()]];
+                if (current) {
+                    const remaining = withoutAccount(await parseAccountsCookie(request), current.did);
+                    headers.push([
+                        'Set-Cookie',
+                        remaining.length
+                            ? accountsCookieHeader(await createAccountsCookie(remaining), isSecure)
+                            : clearAccountsCookieHeader(),
+                    ]);
+                }
+                return new Response(null, { status: 200, headers });
+            }
+            // Accounts this browser may switch between. The cookie is HttpOnly, so
+            // this is the only way for a client to see what's in it.
+            if (url.pathname === '/auth/accounts' && request.method === 'GET') {
+                const stored = await parseAccountsCookie(request);
+                const active = await parseSessionCookie(request);
+                // Sessions created before this feature existed have a session cookie
+                // and no accounts cookie. Adopt the active account into the list rather
+                // than reporting it as unknown — otherwise the switcher looks empty and
+                // signing into a second account appears to drop the first.
+                const needsHealing = !!active && !stored.some((a) => a.did === active.did);
+                const accounts = needsHealing ? withAccount(stored, active) : stored;
+                // An account whose server-side OAuth session is gone can't be switched
+                // to — say so rather than letting the client offer a dead option.
+                // `__dev/login` fabricates a session with no OAuth grant behind it, so
+                // in dev every remembered account counts as switchable.
+                const resolved = await Promise.all(accounts.map(async (a) => ({ ...a, available: devMode || !!(await getSession(a.did)) })));
+                const res = withCors(json({ accounts: resolved, active: active?.did ?? null }, 200, acceptEncoding));
+                // Persist the adoption so the next switch has something to authorize
+                // against, instead of healing the list again on every load.
+                if (needsHealing) {
+                    res.headers.append('Set-Cookie', accountsCookieHeader(await createAccountsCookie(accounts), requestOrigin.startsWith('https')));
+                }
+                return res;
+            }
+            // Switch the active account without re-authorizing at the PDS.
+            //
+            // The OAuth grant belongs to this server acting for the user, not to a
+            // browser session — so once a browser has proven it owns an account, we
+            // can re-issue its session cookie from the stored session. The accounts
+            // cookie is the proof: it's encrypted with the server key, so a client
+            // can't name a DID it never signed in as.
+            if (url.pathname === '/auth/switch' && request.method === 'POST') {
+                let did;
+                try {
+                    const body = await request.json();
+                    did = typeof body?.did === 'string' ? body.did : undefined;
                 }
+                catch {
+                    return withCors(jsonError(400, 'Invalid JSON body', acceptEncoding));
+                }
+                if (!did)
+                    return withCors(jsonError(400, 'did required', acceptEncoding));
+                const accounts = await parseAccountsCookie(request);
+                const account = accounts.find((a) => a.did === did);
+                if (!account)
+                    return withCors(jsonError(403, 'Not signed in as that account', acceptEncoding));
+                if (!devMode && !(await getSession(account.did))) {
+                    // The stored grant is gone (revoked, or cleaned up). Drop it from the
+                    // list so the client stops offering it and can send the user through
+                    // a fresh sign-in instead.
+                    const isSecure = requestOrigin.startsWith('https');
+                    const remaining = withoutAccount(accounts, account.did);
+                    const res = withCors(jsonError(409, 'Session expired for that account', acceptEncoding));
+                    res.headers.append('Set-Cookie', remaining.length
+                        ? accountsCookieHeader(await createAccountsCookie(remaining), isSecure)
+                        : clearAccountsCookieHeader());
+                    return res;
+                }
+                // Refresh the handle in passing — it may have changed while dormant.
+                const handle = (await getRepoHandle(account.did)) ?? account.handle;
+                const session = { did: account.did, handle };
+                const isSecure = requestOrigin.startsWith('https');
+                const res = withCors(json({ did: session.did, handle: session.handle }, 200, acceptEncoding));
+                res.headers.append('Set-Cookie', sessionCookieHeader(await createSessionCookie(session), isSecure));
+                res.headers.append('Set-Cookie', accountsCookieHeader(await createAccountsCookie(withAccount(accounts, session)), isSecure));
+                return res;
             }
             // OAuth Token
-            if (url.pathname === '/oauth/token' && req.method === 'POST' && oauth) {
-                const rawBody = await readBody(req);
+            if (url.pathname === '/oauth/token' && request.method === 'POST' && oauth) {
+                const rawBody = await request.text();
                 let body;
-                if (req.headers['content-type']?.includes('application/x-www-form-urlencoded')) {
+                if (request.headers.get('content-type')?.includes('application/x-www-form-urlencoded')) {
                     body = Object.fromEntries(new URLSearchParams(rawBody));
                 }
                 else {
                     body = JSON.parse(rawBody);
                 }
-                const dpopHeader = req.headers['dpop'];
+                const dpopHeader = request.headers.get('dpop');
                 if (!dpopHeader) {
-                    jsonError(res, 400, 'DPoP header required');
-                    return;
-                }
-                const result = await handleToken(oauth, body, dpopHeader, `${requestOrigin}/oauth/token`);
-                jsonResponse(res, result);
-                return;
-            }
-            // POST /xrpc/dev.hatk.createRecord — proxy write to user's PDS
-            if (url.pathname === coreXrpc('createRecord') && req.method === 'POST' && oauth) {
-                if (!viewer) {
-                    jsonError(res, 401, 'Authentication required');
-                    return;
+                    return withCors(json({ error: 'invalid_request', error_description: 'DPoP header required' }, 400, acceptEncoding));
                 }
-                const body = JSON.parse(await readBody(req));
-                const validationError = validateRecord(getLexiconArray(), body.collection, body.record);
-                if (validationError) {
-                    jsonError(res, 400, `InvalidRecord: ${validationError.path ? validationError.path + ': ' : ''}${validationError.message}`);
-                    return;
-                }
-                const session = await getSession(viewer.did);
-                if (!session) {
-                    jsonError(res, 401, 'No PDS session for user');
-                    return;
+                try {
+                    const result = await handleToken(oauth, body, dpopHeader, `${requestOrigin}/oauth/token`);
+                    return withCors(json(result, 200, acceptEncoding));
                 }
-                const pdsUrl = `${session.pds_endpoint}/xrpc/com.atproto.repo.createRecord`;
-                const pdsBody = {
-                    repo: viewer.did,
-                    collection: body.collection,
-                    rkey: body.rkey,
-                    record: body.record,
-                };
-                const pdsRes = await proxyToPds(oauth, session, 'POST', pdsUrl, pdsBody);
-                if (!pdsRes.ok) {
-                    jsonError(res, pdsRes.status, pdsRes.body.error || 'PDS write failed');
-                    return;
+                catch (err) {
+                    if (err instanceof OAuthError) {
+                        return withCors(json({ error: err.code, error_description: err.description }, err.status, acceptEncoding));
+                    }
+                    throw err;
                 }
-                const result = pdsRes.body;
-                // Index the record immediately
+            }
+            // POST /xrpc/dev.hatk.createRecord — proxy write to user's PDS
+            if (url.pathname === coreXrpc('createRecord') && request.method === 'POST' && oauth) {
+                if (!viewer)
+                    return withCors(jsonError(401, 'Authentication required', acceptEncoding));
+                const body = JSON.parse(await request.text());
                 try {
-                    await insertRecord(body.collection, result.uri, result.cid, viewer.did, body.record);
+                    const result = await pdsCreateRecord(oauth, viewer, body);
+                    return withCors(json(result, 200, acceptEncoding));
                 }
-                catch {
-                    // Non-fatal — firehose will catch it
+                catch (err) {
+                    if (err instanceof ScopeMissingProxyError)
+                        return scopeMissingResponse(acceptEncoding, viewer?.handle);
+                    if (err instanceof ProxyError)
+                        return withCors(json({ error: err.message, ...(viewer?.handle ? { handle: viewer.handle } : {}) }, err.status, acceptEncoding));
+                    throw err;
                 }
-                jsonResponse(res, result);
-                return;
             }
             // POST /xrpc/dev.hatk.deleteRecord — proxy delete to user's PDS
-            if (url.pathname === coreXrpc('deleteRecord') && req.method === 'POST' && oauth) {
-                if (!viewer) {
-                    jsonError(res, 401, 'Authentication required');
-                    return;
-                }
-                const body = JSON.parse(await readBody(req));
-                const session = await getSession(viewer.did);
-                if (!session) {
-                    jsonError(res, 401, 'No PDS session for user');
-                    return;
-                }
-                const pdsUrl = `${session.pds_endpoint}/xrpc/com.atproto.repo.deleteRecord`;
-                const pdsBody = {
-                    repo: viewer.did,
-                    collection: body.collection,
-                    rkey: body.rkey,
-                };
-                const pdsRes = await proxyToPds(oauth, session, 'POST', pdsUrl, pdsBody);
-                if (!pdsRes.ok) {
-                    jsonError(res, pdsRes.status, pdsRes.body.error || 'PDS delete failed');
-                    return;
-                }
-                const result = pdsRes.body;
-                // Delete the record locally
+            if (url.pathname === coreXrpc('deleteRecord') && request.method === 'POST' && oauth) {
+                if (!viewer)
+                    return withCors(jsonError(401, 'Authentication required', acceptEncoding));
+                const body = JSON.parse(await request.text());
                 try {
-                    const uri = `at://${viewer.did}/${body.collection}/${body.rkey}`;
-                    await deleteRecord(body.collection, uri);
+                    const result = await pdsDeleteRecord(oauth, viewer, body);
+                    return withCors(json(result, 200, acceptEncoding));
                 }
-                catch {
-                    // Non-fatal — firehose will catch it
+                catch (err) {
+                    if (err instanceof ScopeMissingProxyError)
+                        return scopeMissingResponse(acceptEncoding, viewer?.handle);
+                    if (err instanceof ProxyError)
+                        return withCors(json({ error: err.message, ...(viewer?.handle ? { handle: viewer.handle } : {}) }, err.status, acceptEncoding));
+                    throw err;
                 }
-                jsonResponse(res, result);
-                return;
             }
             // POST /xrpc/dev.hatk.putRecord — proxy create-or-update to user's PDS
-            if (url.pathname === coreXrpc('putRecord') && req.method === 'POST' && oauth) {
-                if (!viewer) {
-                    jsonError(res, 401, 'Authentication required');
-                    return;
-                }
-                const body = JSON.parse(await readBody(req));
-                const validationError = validateRecord(getLexiconArray(), body.collection, body.record);
-                if (validationError) {
-                    jsonError(res, 400, `InvalidRecord: ${validationError.path ? validationError.path + ': ' : ''}${validationError.message}`);
-                    return;
-                }
-                const session = await getSession(viewer.did);
-                if (!session) {
-                    jsonError(res, 401, 'No PDS session for user');
-                    return;
-                }
-                const pdsUrl = `${session.pds_endpoint}/xrpc/com.atproto.repo.putRecord`;
-                const pdsBody = {
-                    repo: viewer.did,
-                    collection: body.collection,
-                    rkey: body.rkey,
-                    record: body.record,
-                };
-                const pdsRes = await proxyToPds(oauth, session, 'POST', pdsUrl, pdsBody);
-                if (!pdsRes.ok) {
-                    jsonError(res, pdsRes.status, pdsRes.body.error || 'PDS write failed');
-                    return;
-                }
-                const result = pdsRes.body;
-                // Re-index (insertRecord uses INSERT OR REPLACE so this handles both create and update)
+            if (url.pathname === coreXrpc('putRecord') && request.method === 'POST' && oauth) {
+                if (!viewer)
+                    return withCors(jsonError(401, 'Authentication required', acceptEncoding));
+                const body = JSON.parse(await request.text());
                 try {
-                    await insertRecord(body.collection, result.uri, result.cid, viewer.did, body.record);
+                    const result = await pdsPutRecord(oauth, viewer, body);
+                    return withCors(json(result, 200, acceptEncoding));
                 }
-                catch {
-                    // Non-fatal — firehose will catch it
+                catch (err) {
+                    if (err instanceof ScopeMissingProxyError)
+                        return scopeMissingResponse(acceptEncoding, viewer?.handle);
+                    if (err instanceof ProxyError)
+                        return withCors(json({ error: err.message, ...(viewer?.handle ? { handle: viewer.handle } : {}) }, err.status, acceptEncoding));
+                    throw err;
                 }
-                jsonResponse(res, result);
-                return;
             }
             // POST /xrpc/dev.hatk.uploadBlob — proxy blob upload to user's PDS
-            if (url.pathname === coreXrpc('uploadBlob') && req.method === 'POST' && oauth) {
-                if (!viewer) {
-                    jsonError(res, 401, 'Authentication required');
-                    return;
-                }
-                const session = await getSession(viewer.did);
-                if (!session) {
-                    jsonError(res, 401, 'No PDS session for user');
-                    return;
+            if (url.pathname === coreXrpc('uploadBlob') && request.method === 'POST' && oauth) {
+                if (!viewer)
+                    return withCors(jsonError(401, 'Authentication required', acceptEncoding));
+                const contentType = request.headers.get('content-type') || 'application/octet-stream';
+                const rawBody = new Uint8Array(await request.arrayBuffer());
+                try {
+                    const result = await pdsUploadBlob(oauth, viewer, rawBody, contentType);
+                    return withCors(json(result, 200, acceptEncoding));
                 }
-                const contentType = req.headers['content-type'] || 'application/octet-stream';
-                const rawBody = await readBodyRaw(req);
-                const pdsUrl = `${session.pds_endpoint}/xrpc/com.atproto.repo.uploadBlob`;
-                const pdsRes = await proxyToPdsRaw(oauth, session, pdsUrl, rawBody, contentType);
-                if (!pdsRes.ok) {
-                    jsonError(res, pdsRes.status, String(pdsRes.body.error || 'PDS upload failed'));
-                    return;
+                catch (err) {
+                    if (err instanceof ScopeMissingProxyError)
+                        return scopeMissingResponse(acceptEncoding, viewer?.handle);
+                    if (err instanceof ProxyError)
+                        return withCors(json({ error: err.message, ...(viewer?.handle ? { handle: viewer.handle } : {}) }, err.status, acceptEncoding));
+                    throw err;
                 }
-                jsonResponse(res, pdsRes.body);
-                return;
             }
             // GET /admin — serve admin UI from hatk package
             if (url.pathname === '/admin' || url.pathname === '/admin/') {
                 const adminPath = join(import.meta.dirname, '../public/admin.html');
                 try {
-                    const content = await readFile(adminPath);
-                    res.writeHead(200, { 'Content-Type': 'text/html' });
-                    res.end(content);
-                    return;
+                    return withCors(await serveBundledAsset(adminPath, 'text/html', request, devMode));
                 }
                 catch {
-                    res.writeHead(404);
-                    res.end('Admin page not found');
-                    return;
+                    return withCors(new Response('Admin page not found', { status: 404 }));
                 }
             }
             // GET /admin/admin-auth.js — serve bundled OAuth client
             if (url.pathname === '/admin/admin-auth.js') {
                 const authPath = join(import.meta.dirname, '../public/admin-auth.js');
                 try {
-                    const content = await readFile(authPath);
-                    res.writeHead(200, { 'Content-Type': 'application/javascript' });
-                    res.end(content);
-                    return;
+                    return withCors(await serveBundledAsset(authPath, 'application/javascript', request, devMode));
                 }
                 catch {
-                    res.writeHead(404);
-                    res.end('Not found');
-                    return;
+                    return notFound();
                 }
             }
             // GET /_health
             if (url.pathname === '/_health') {
-                jsonResponse(res, { status: 'ok' });
-                return;
+                return withCors(json({ status: 'ok' }, 200, acceptEncoding));
             }
             // GET /og/* — OpenGraph image routes
-            if (url.pathname.startsWith('/og/') && !res.writableEnded) {
+            if (url.pathname.startsWith('/og/')) {
                 const png = await handleOpengraphRequest(url.pathname);
-                if (png) {
-                    res.writeHead(200, {
-                        'Content-Type': 'image/png',
-                        'Cache-Control': 'public, max-age=300',
+                if (png)
+                    return withCors(file(png, 'image/png', 'public, max-age=300'));
+            }
+            // GET/POST /xrpc/{nsid} — custom XRPC handlers (matched by full NSID from folder structure)
+            // POST /xrpc/com.atproto.space.notifyWrite — a space authority telling us
+            // one of its repos moved. Carries no records: it says look again, and the
+            // read that follows uses our own credential like any other.
+            //
+            // Best-effort by protocol, so this answers before syncing and never lets
+            // a sync failure become the authority's problem. A missed notice is
+            // recovered by the reconcile sweep.
+            if (url.pathname === '/xrpc/com.atproto.space.notifyWrite' && request.method === 'POST') {
+                const serviceId = spaceServiceId();
+                if (!serviceId)
+                    return withCors(jsonError(404, 'This instance receives no space notices', acceptEncoding));
+                const notice = parseWriteNotice(await request.json().catch(() => null));
+                if (!notice)
+                    return withCors(jsonError(400, 'Expected space, repo and repoRev', acceptEncoding));
+                try {
+                    await verifyNotice(request.headers.get('authorization'), {
+                        iss: parseSpaceRef(notice.space).authority,
+                        aud: serviceId,
+                        lxm: 'com.atproto.space.notifyWrite',
                     });
-                    res.end(png);
-                    return;
                 }
+                catch (err) {
+                    if (err instanceof NoticeError) {
+                        // Loud on this side too. A refused notice is otherwise visible
+                        // only in the authority's log, which belongs to somebody else —
+                        // so an appview silently falls back to the sweep and looks merely
+                        // slow rather than broken.
+                        emit('spaces', 'notice_refused', {
+                            space: notice.space,
+                            repo: notice.repo,
+                            status: err.status,
+                            reason: err.message,
+                        });
+                        return withCors(jsonError(err.status, err.message, acceptEncoding));
+                    }
+                    throw err;
+                }
+                // Debounced per repo: one member writing a gallery sends a notice per
+                // record, and each is an invitation to read the same repo again.
+                scheduleNoticeSync(`${notice.space}|${notice.repo}`, () => handleWriteNotice(notice).then(() => { }));
+                return withCors(json({}, 200, acceptEncoding));
             }
-            // GET/POST /xrpc/{nsid} — custom XRPC handlers (matched by full NSID from folder structure)
-            if (url.pathname.startsWith('/xrpc/') && !res.writableEnded) {
+            // POST /xrpc/com.atproto.space.notifySpaceDeleted — the authority saying a
+            // space is gone and every copy of it should go too.
+            if (url.pathname === '/xrpc/com.atproto.space.notifySpaceDeleted' && request.method === 'POST') {
+                const serviceId = spaceServiceId();
+                if (!serviceId)
+                    return withCors(jsonError(404, 'This instance receives no space notices', acceptEncoding));
+                const body = (await request.json().catch(() => null));
+                const space = typeof body?.space === 'string' ? body.space : null;
+                const ref = space ? parseSpaceRef(space) : null;
+                if (!space || !ref)
+                    return withCors(jsonError(400, 'Expected a space', acceptEncoding));
+                try {
+                    await verifyNotice(request.headers.get('authorization'), {
+                        iss: ref.authority,
+                        aud: serviceId,
+                        lxm: 'com.atproto.space.notifySpaceDeleted',
+                    });
+                }
+                catch (err) {
+                    if (err instanceof NoticeError)
+                        return withCors(jsonError(err.status, err.message, acceptEncoding));
+                    throw err;
+                }
+                await unwatchSpace(space);
+                return withCors(json({}, 200, acceptEncoding));
+            }
+            if (url.pathname.startsWith('/xrpc/')) {
                 const method = url.pathname.slice('/xrpc/'.length);
                 const limit = parseInt(url.searchParams.get('limit') || '20');
                 const cursor = url.searchParams.get('cursor') || undefined;
-                const params = {};
-                for (const [key, value] of url.searchParams) {
-                    params[key] = value;
-                }
+                const params = paramsFromSearch(url.searchParams);
                 // Parse request body for POST (procedures)
                 let input;
-                if (req.method === 'POST') {
+                if (request.method === 'POST') {
                     try {
-                        input = JSON.parse(await readBody(req));
+                        input = JSON.parse(await request.text());
                     }
                     catch {
                         input = {};
@@ -861,19 +1428,60 @@ export function startServer(port, collections, publicDir, oauth, admins = [], re
                 }
                 try {
                     const result = await executeXrpc(method, params, cursor, limit, viewer, input);
-                    if (result) {
-                        jsonResponse(res, result);
-                        return;
-                    }
+                    // A handler may answer with a Response of its own, which is the only
+                    // way to serve anything but JSON — com.atproto.sync.getBlob is the
+                    // shape in the wild, and a lexicon declaring `encoding: "*/*"` has no
+                    // other way to honour it. Everything else is serialized as before.
+                    if (result instanceof Response)
+                        return withCors(result);
+                    if (result)
+                        return withCors(json(result, 200, acceptEncoding));
                 }
                 catch (err) {
+                    if (err instanceof ScopeMissingProxyError)
+                        return scopeMissingResponse(acceptEncoding, viewer?.handle);
                     if (err instanceof InvalidRequestError) {
-                        jsonError(res, err.status, err.errorName || err.message);
-                        return;
+                        return withCors(jsonError(err.status, err.errorName || err.message, acceptEncoding));
                     }
                     throw err;
                 }
             }
+            // GET /space-blob?space=&repo=&cid= — a blob inside a permissioned space.
+            // Unlike /blob/ below it is not dev-only, and every request is authorized
+            // with the viewer's own credential for the space: a space blob has no
+            // public URL by design. `if-none-match` is passed along because the
+            // answer may be that the viewer already holds it.
+            if (url.pathname === '/space-blob') {
+                const parsed = parseSpaceBlobRequest(url.searchParams);
+                if (!parsed)
+                    return withCors(jsonError(400, 'Expected space, repo and cid', acceptEncoding));
+                return withCors(await serveSpaceBlob(oauth, viewer, parsed, request.headers.get('if-none-match')));
+            }
+            // GET /blob/:did/:cid — dev-only image proxy (see blobUrl in xrpc.ts).
+            // A PDS serves getBlob as an attachment with nosniff, which a browser
+            // refuses to render in <img>; re-serving it from here drops that and
+            // lets one origin cover repos on any number of local PDSes.
+            if (url.pathname.startsWith('/blob/') && isLocalRelay()) {
+                const [did, cid] = url.pathname.slice('/blob/'.length).split('/');
+                if (!did || !cid)
+                    return withCors(jsonError(400, 'Expected /blob/:did/:cid', acceptEncoding));
+                try {
+                    const pds = await pdsFor(did);
+                    const upstream = await fetch(`${pds}/xrpc/com.atproto.sync.getBlob?did=${encodeURIComponent(did)}&cid=${encodeURIComponent(cid)}`);
+                    if (!upstream.ok)
+                        return withCors(jsonError(upstream.status, 'Blob not found', acceptEncoding));
+                    return withCors(new Response(upstream.body, {
+                        status: 200,
+                        headers: {
+                            'content-type': upstream.headers.get('content-type') || 'application/octet-stream',
+                            'cache-control': 'public, max-age=3600',
+                        },
+                    }));
+                }
+                catch (err) {
+                    return withCors(jsonError(502, `Blob fetch failed: ${err.message}`, acceptEncoding));
+                }
+            }
             // GET /robots.txt — serve from user's public dir or fall back to hatk default
             if (url.pathname === '/robots.txt') {
                 const userRobots = publicDir ? join(publicDir, 'robots.txt') : null;
@@ -881,9 +1489,7 @@ export function startServer(port, collections, publicDir, oauth, admins = [], re
                 const robotsPath = userRobots && existsSync(userRobots) ? userRobots : defaultRobots;
                 try {
                     const content = await readFile(robotsPath);
-                    res.writeHead(200, { 'Content-Type': 'text/plain' });
-                    res.end(content);
-                    return;
+                    return withCors(file(content, 'text/plain'));
                 }
                 catch {
                     // fall through
@@ -894,38 +1500,45 @@ export function startServer(port, collections, publicDir, oauth, admins = [], re
                 try {
                     const filePath = join(publicDir, url.pathname === '/' ? 'index.html' : url.pathname);
                     const content = await readFile(filePath);
-                    res.writeHead(200, { 'Content-Type': MIME[extname(filePath)] || 'text/plain' });
-                    res.end(content);
-                    return;
+                    return withCors(file(content, MIME[extname(filePath)] || 'text/plain'));
                 }
                 catch { }
-                // SPA fallback — serve index.html for client-side routes
+                // SSR or SPA fallback — serve index.html for client-side routes
                 try {
-                    let content = await readFile(join(publicDir, 'index.html'), 'utf-8');
-                    // Inject OG meta tags for shareable routes
+                    const template = await readFile(join(publicDir, 'index.html'), 'utf-8');
                     const ogMeta = buildOgMeta(url.pathname, requestOrigin);
+                    globalThis.__hatk_viewer = viewer;
+                    let renderedHtml;
+                    try {
+                        renderedHtml = await renderPage(template, request, ogMeta);
+                    }
+                    finally {
+                        ;
+                        globalThis.__hatk_viewer = null;
+                    }
+                    if (renderedHtml) {
+                        return withCors(file(Buffer.from(renderedHtml), 'text/html'));
+                    }
+                    // SPA fallback — inject OG meta only
+                    let html = template;
                     if (ogMeta) {
-                        content = content.replace('</head>', `${ogMeta}\n</head>`);
+                        html = html.replace('</head>', `${ogMeta}\n</head>`);
                     }
-                    res.writeHead(200, { 'Content-Type': 'text/html' });
-                    res.end(content);
-                    return;
+                    return withCors(file(Buffer.from(html), 'text/html'));
                 }
                 catch { }
             }
-            res.writeHead(404);
-            res.end('Not Found');
+            return notFound();
         }
         catch (err) {
             error = err.message;
-            jsonError(res, 500, err.message);
+            return withCors(jsonError(500, err.message, acceptEncoding));
         }
         finally {
-            if (isXrpc || isAdmin) {
+            if ((isXrpc || isAdmin) && elapsed) {
                 emit('server', 'request', {
-                    method: req.method,
+                    method: request.method,
                     path: url.pathname,
-                    status_code: res.statusCode,
                     duration_ms: elapsed(),
                     collection: url.searchParams.get('collection') || undefined,
                     query: url.searchParams.get('q') || undefined,
@@ -933,135 +1546,10 @@ export function startServer(port, collections, publicDir, oauth, admins = [], re
                 });
             }
         }
-    });
-    server.listen(port, () => log(`[server] ${oauth?.issuer || `http://localhost:${port}`}`));
-    return server;
-}
-function sendJson(res, status, body) {
-    const acceptEncoding = res.req?.headers['accept-encoding'] || '';
-    if (body.length > 1024 && /\bgzip\b/.test(acceptEncoding)) {
-        const compressed = gzipSync(body);
-        res.writeHead(status, {
-            'Content-Type': 'application/json',
-            'Content-Encoding': 'gzip',
-            Vary: 'Accept-Encoding',
-            ...(status === 200 ? { 'Cache-Control': 'no-store' } : {}),
-        });
-        res.end(compressed);
-    }
-    else {
-        res.writeHead(status, {
-            'Content-Type': 'application/json',
-            ...(status === 200 ? { 'Cache-Control': 'no-store' } : {}),
-        });
-        res.end(body);
-    }
-}
-function jsonResponse(res, data) {
-    sendJson(res, 200, Buffer.from(JSON.stringify(data, (_, v) => normalizeValue(v))));
+    };
 }
-function jsonError(res, status, message) {
-    if (res.headersSent)
-        return;
-    sendJson(res, status, Buffer.from(JSON.stringify({ error: message })));
-}
-/** Proxy a request to the user's PDS with DPoP + automatic nonce retry + token refresh. */
-async function proxyToPds(oauthConfig, session, method, pdsUrl, body) {
-    const serverKey = await getServerKey('appview-oauth-key');
-    const privateJwk = JSON.parse(serverKey.privateKey);
-    const publicJwk = JSON.parse(serverKey.publicKey);
-    let accessToken = session.access_token;
-    async function doFetch(token, nonce) {
-        const proof = await createDpopProof(privateJwk, publicJwk, method, pdsUrl, token, nonce);
-        const res = await fetch(pdsUrl, {
-            method,
-            headers: {
-                'Content-Type': 'application/json',
-                Authorization: `DPoP ${token}`,
-                DPoP: proof,
-            },
-            body: JSON.stringify(body),
-        });
-        const resBody = await res.json().catch(() => ({}));
-        return { ok: res.ok, status: res.status, body: resBody, headers: res.headers };
-    }
-    let result = await doFetch(accessToken);
-    if (result.ok)
-        return result;
-    let nonce;
-    // Step 1: handle DPoP nonce requirement
-    if (result.body.error === 'use_dpop_nonce') {
-        nonce = result.headers.get('DPoP-Nonce') || undefined;
-        if (nonce) {
-            result = await doFetch(accessToken, nonce);
-            if (result.ok)
-                return result;
-        }
-    }
-    // Step 2: handle expired PDS token — refresh and retry
-    if (result.body.error === 'invalid_token') {
-        const refreshed = await refreshPdsSession(oauthConfig, session);
-        if (refreshed) {
-            accessToken = refreshed.accessToken;
-            result = await doFetch(accessToken, nonce);
-            if (result.ok)
-                return result;
-            // May need DPoP nonce after refresh
-            if (result.body.error === 'use_dpop_nonce') {
-                nonce = result.headers.get('DPoP-Nonce') || undefined;
-                if (nonce)
-                    result = await doFetch(accessToken, nonce);
-            }
-        }
-    }
-    return result;
-}
-/** Proxy a raw binary request to the user's PDS with DPoP + nonce retry + token refresh. */
-async function proxyToPdsRaw(oauthConfig, session, pdsUrl, body, contentType) {
-    const serverKey = await getServerKey('appview-oauth-key');
-    const privateJwk = JSON.parse(serverKey.privateKey);
-    const publicJwk = JSON.parse(serverKey.publicKey);
-    let accessToken = session.access_token;
-    async function doFetch(token, nonce) {
-        const proof = await createDpopProof(privateJwk, publicJwk, 'POST', pdsUrl, token, nonce);
-        const res = await fetch(pdsUrl, {
-            method: 'POST',
-            headers: {
-                'Content-Type': contentType,
-                'Content-Length': String(body.length),
-                Authorization: `DPoP ${token}`,
-                DPoP: proof,
-            },
-            body: Buffer.from(body),
-        });
-        const resBody = await res.json().catch(() => ({}));
-        return { ok: res.ok, status: res.status, body: resBody, headers: res.headers };
-    }
-    let result = await doFetch(accessToken);
-    if (result.ok)
-        return result;
-    let nonce;
-    if (result.body.error === 'use_dpop_nonce') {
-        nonce = result.headers.get('DPoP-Nonce') || undefined;
-        if (nonce) {
-            result = await doFetch(accessToken, nonce);
-            if (result.ok)
-                return result;
-        }
-    }
-    if (result.body.error === 'invalid_token') {
-        const refreshed = await refreshPdsSession(oauthConfig, session);
-        if (refreshed) {
-            accessToken = refreshed.accessToken;
-            result = await doFetch(accessToken, nonce);
-            if (result.ok)
-                return result;
-            if (result.body.error === 'use_dpop_nonce') {
-                nonce = result.headers.get('DPoP-Nonce') || undefined;
-                if (nonce)
-                    result = await doFetch(accessToken, nonce);
-            }
-        }
-    }
-    return result;
+// Backward-compatible wrapper
+export function startServer(port, collections, publicDir, oauth, admins = [], resolveViewer, onResync) {
+    const handler = createHandler({ collections, publicDir, oauth, admins, resolveViewer, onResync });
+    return serve(handler, port);
 }