@hatk/hatk 0.0.1-alpha.4 → 0.0.1-alpha.40

package/dist/cloudflare/container.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Cloudflare Container entry point for hatk.
+ *
+ * Runs as a long-lived Node.js process alongside the Worker. Handles the
+ * firehose indexer and backfill loop — the Worker delegates resync requests
+ * here via RPC (Cloudflare Container service bindings).
+ *
+ * No HTTP server — all communication is via the Container RPC interface.
+ */
+export interface Env {
+    /** Cloudflare D1 database binding */
+    DB: D1Database;
+    HATK_RELAY: string;
+    HATK_PLC: string;
+    HATK_OAUTH_ISSUER?: string;
+    HATK_OAUTH_SCOPES?: string;
+    HATK_ADMINS?: string;
+    HATK_COLLECTIONS?: string;
+    HATK_BACKFILL_PARALLELISM?: string;
+    HATK_BACKFILL_FETCH_TIMEOUT?: string;
+    HATK_BACKFILL_MAX_RETRIES?: string;
+    HATK_BACKFILL_FULL_NETWORK?: string;
+    HATK_BACKFILL_REPOS?: string;
+    HATK_BACKFILL_SIGNAL_COLLECTIONS?: string;
+}
+interface D1Database {
+    prepare(sql: string): any;
+    batch<T = unknown>(statements: any[]): Promise<any[]>;
+    exec(sql: string): Promise<any>;
+}
+/**
+ * Resync a single DID by triggering auto-backfill.
+ * Called by the Worker via Container service binding RPC.
+ */
+declare function resync(did: string): Promise<void>;
+/**
+ * Trigger a full re-enumeration backfill of all repos.
+ * Called by the Worker via Container service binding RPC.
+ */
+declare function resyncAll(): Promise<void>;
+/**
+ * Return basic status info about the Container.
+ * Called by the Worker for health checks / admin UI.
+ */
+declare function getStatus(): {
+    initialized: boolean;
+    collections: string[];
+    uptimeMs: number;
+};
+/**
+ * Cloudflare Container entry point.
+ *
+ * Containers expose RPC methods that the Worker can call via the service binding.
+ * The Container also handles fetch requests routed from the Worker, but for hatk
+ * all Worker-to-Container communication uses the RPC methods above.
+ */
+declare const _default: {
+    /**
+     * Container startup — called when the Container is first instantiated.
+     * Initializes the database, starts the firehose, and begins backfill.
+     */
+    start(env: Env): Promise<void>;
+    /**
+     * Handle fetch requests forwarded from the Worker.
+     * The Container doesn't serve HTTP — return 404 for any direct requests.
+     */
+    fetch(request: Request, env: Env): Promise<Response>;
+    resync: typeof resync;
+    resyncAll: typeof resyncAll;
+    getStatus: typeof getStatus;
+};
+export default _default;
+//# sourceMappingURL=container.d.ts.map

package/dist/cloudflare/container.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"container.d.ts","sourceRoot":"","sources":["../../src/cloudflare/container.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA0BH,MAAM,WAAW,GAAG;IAClB,qCAAqC;IACrC,EAAE,EAAE,UAAU,CAAA;IAGd,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAGzB,yBAAyB,CAAC,EAAE,MAAM,CAAA;IAClC,2BAA2B,CAAC,EAAE,MAAM,CAAA;IACpC,yBAAyB,CAAC,EAAE,MAAM,CAAA;IAClC,0BAA0B,CAAC,EAAE,MAAM,CAAA;IACnC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,gCAAgC,CAAC,EAAE,MAAM,CAAA;CAC1C;AAGD,UAAU,UAAU;IAClB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;IACzB,KAAK,CAAC,CAAC,GAAG,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;IACrD,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;CAChC;AAoLD;;;GAGG;AACH,iBAAe,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhD;AAED;;;GAGG;AACH,iBAAe,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAExC;AAED;;;GAGG;AACH,iBAAS,SAAS,IAAI;IAAE,WAAW,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAMtF;AAID;;;;;;GAMG;;IAED;;;OAGG;eACc,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpC;;;OAGG;mBACkB,OAAO,OAAO,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;;;;;AAb5D,wBA0BC"}

package/dist/cloudflare/container.js

@@ -0,0 +1,232 @@
+/**
+ * Cloudflare Container entry point for hatk.
+ *
+ * Runs as a long-lived Node.js process alongside the Worker. Handles the
+ * firehose indexer and backfill loop — the Worker delegates resync requests
+ * here via RPC (Cloudflare Container service bindings).
+ *
+ * No HTTP server — all communication is via the Container RPC interface.
+ */
+import { D1Adapter } from "../database/adapters/d1.js";
+import { initDatabase, getCursor, migrateSchema } from "../database/db.js";
+import { storeLexicons, discoverCollections, buildSchemas } from "../database/schema.js";
+import { discoverViews } from "../views.js";
+import { getDialect } from "../database/dialect.js";
+import { setSearchPort } from "../database/fts.js";
+import { rebuildAllIndexes } from "../database/fts.js";
+import { registerCoreHandlers } from "../server.js";
+import { configureRelay } from "../xrpc.js";
+import { startIndexer, triggerAutoBackfill } from "../indexer.js";
+import { runBackfill } from "../backfill.js";
+import { relayHttpUrl } from "../config.js";
+import { validateLexicons } from '@bigmoves/lexicon';
+import { log } from "../logger.js";
+// ---------- Container state ----------
+let initialized = false;
+let initPromise = null;
+let collections = [];
+let collectionSet = new Set();
+let backfillOpts = null;
+let startedAt = 0;
+/**
+ * One-time initialization. Mirrors main.ts startup minus the HTTP server.
+ */
+async function initialize(env) {
+    startedAt = Date.now();
+    // 1. Parse config from env vars
+    const relay = env.HATK_RELAY || 'wss://bsky.network';
+    const plc = env.HATK_PLC || 'https://plc.directory';
+    configureRelay(relay);
+    const admins = env.HATK_ADMINS ? env.HATK_ADMINS.split(',').map((s) => s.trim()) : [];
+    // 2. Load lexicons — injected at build time via virtual module
+    let lexicons;
+    try {
+        // @ts-expect-error — virtual module generated at build time
+        const lexiconModule = await import('virtual:hatk-lexicons');
+        lexicons = new Map(Object.entries(lexiconModule.default));
+    }
+    catch {
+        lexicons = new Map();
+    }
+    const lexiconErrors = validateLexicons([...lexicons.values()]);
+    if (lexiconErrors) {
+        for (const [nsid, errors] of Object.entries(lexiconErrors)) {
+            for (const err of errors) {
+                console.error(`[container] Invalid lexicon ${nsid}: ${err}`);
+            }
+        }
+        throw new Error('Invalid lexicons — check build output');
+    }
+    storeLexicons(lexicons);
+    // 3. Determine collections
+    collections = env.HATK_COLLECTIONS
+        ? env.HATK_COLLECTIONS.split(',').map((s) => s.trim())
+        : discoverCollections(lexicons);
+    collectionSet = new Set(collections);
+    if (collections.length === 0) {
+        log('[container] No record collections found — running in indexer-only mode');
+    }
+    log(`[container] Loaded config: ${collections.length} collections`);
+    // 4. Build schemas and init D1
+    discoverViews();
+    const engineDialect = getDialect('d1');
+    const { schemas, ddlStatements } = buildSchemas(lexicons, collections, engineDialect);
+    const adapter = new D1Adapter();
+    adapter.initWithBinding(env.DB);
+    setSearchPort(null); // D1 uses SQLite FTS natively
+    await initDatabase(adapter, ':memory:', schemas, ddlStatements);
+    // Auto-migrate schema if lexicons changed
+    const migrationChanges = await migrateSchema(schemas);
+    if (migrationChanges.length > 0) {
+        log(`[container] Applied ${migrationChanges.length} schema migration(s)`);
+    }
+    // 5. Init server directory handlers (feeds, labels, hooks, xrpc, setup)
+    //    In Containers, we load these via the bundled virtual module like the Worker.
+    //    The server/ directory scanning won't work in a Container since there's no filesystem
+    //    layout matching the dev project. For now, register core handlers only.
+    //    When build tooling (Task 7) bundles server handlers, they'll be imported here.
+    const oauthConfig = env.HATK_OAUTH_ISSUER
+        ? {
+            issuer: env.HATK_OAUTH_ISSUER,
+            scopes: env.HATK_OAUTH_SCOPES ? env.HATK_OAUTH_SCOPES.split(',').map((s) => s.trim()) : ['read', 'write'],
+            clients: [],
+        }
+        : null;
+    registerCoreHandlers(collections, oauthConfig);
+    // 6. Parse backfill config
+    const backfillConfig = {
+        fullNetwork: env.HATK_BACKFILL_FULL_NETWORK === 'true',
+        parallelism: env.HATK_BACKFILL_PARALLELISM ? parseInt(env.HATK_BACKFILL_PARALLELISM, 10) : 10,
+        fetchTimeout: env.HATK_BACKFILL_FETCH_TIMEOUT ? parseInt(env.HATK_BACKFILL_FETCH_TIMEOUT, 10) : 30,
+        maxRetries: env.HATK_BACKFILL_MAX_RETRIES ? parseInt(env.HATK_BACKFILL_MAX_RETRIES, 10) : 5,
+        repos: env.HATK_BACKFILL_REPOS ? env.HATK_BACKFILL_REPOS.split(',').map((s) => s.trim()) : undefined,
+        signalCollections: env.HATK_BACKFILL_SIGNAL_COLLECTIONS
+            ? env.HATK_BACKFILL_SIGNAL_COLLECTIONS.split(',').map((s) => s.trim())
+            : undefined,
+    };
+    backfillOpts = {
+        pdsUrl: relayHttpUrl(relay),
+        plcUrl: plc,
+        collections: collectionSet,
+        config: backfillConfig,
+    };
+    // 7. Start firehose indexer
+    const cursor = await getCursor('relay');
+    startIndexer({
+        relayUrl: relay,
+        collections: collectionSet,
+        signalCollections: backfillConfig.signalCollections ? new Set(backfillConfig.signalCollections) : undefined,
+        pinnedRepos: backfillConfig.repos ? new Set(backfillConfig.repos) : undefined,
+        cursor,
+        fetchTimeout: backfillConfig.fetchTimeout,
+        maxRetries: backfillConfig.maxRetries,
+        parallelism: backfillConfig.parallelism,
+    });
+    log('[container] Firehose indexer started');
+    // 8. Run backfill in background
+    runBackfillAndRestart();
+    initialized = true;
+    log('[container] Initialization complete');
+}
+/**
+ * Run backfill, rebuild FTS indexes, and restart the process if records
+ * were imported (to reclaim memory from CAR parsing). Mirrors main.ts behavior.
+ */
+function runBackfillAndRestart() {
+    if (!backfillOpts)
+        return;
+    runBackfill(backfillOpts)
+        .then(async (recordCount) => {
+        log('[container] Backfill complete, building FTS indexes...');
+        await rebuildAllIndexes(collections);
+        log('[container] FTS indexes ready');
+        return recordCount;
+    })
+        .then((recordCount) => {
+        if (recordCount > 0) {
+            log('[container] Restarting to reclaim memory...');
+            process.exit(1);
+        }
+    })
+        .catch((err) => {
+        console.error('[container] Backfill error:', err.message);
+    });
+}
+/**
+ * Ensure initialization has completed. Uses a shared promise so concurrent
+ * RPC calls don't trigger multiple inits.
+ */
+function ensureInit(env) {
+    if (initialized)
+        return Promise.resolve();
+    if (!initPromise) {
+        initPromise = initialize(env).catch((err) => {
+            initPromise = null;
+            throw err;
+        });
+    }
+    return initPromise;
+}
+// ---------- RPC methods ----------
+/**
+ * Resync a single DID by triggering auto-backfill.
+ * Called by the Worker via Container service binding RPC.
+ */
+async function resync(did) {
+    await triggerAutoBackfill(did);
+}
+/**
+ * Trigger a full re-enumeration backfill of all repos.
+ * Called by the Worker via Container service binding RPC.
+ */
+async function resyncAll() {
+    runBackfillAndRestart();
+}
+/**
+ * Return basic status info about the Container.
+ * Called by the Worker for health checks / admin UI.
+ */
+function getStatus() {
+    return {
+        initialized,
+        collections,
+        uptimeMs: startedAt > 0 ? Date.now() - startedAt : 0,
+    };
+}
+// ---------- Container export ----------
+/**
+ * Cloudflare Container entry point.
+ *
+ * Containers expose RPC methods that the Worker can call via the service binding.
+ * The Container also handles fetch requests routed from the Worker, but for hatk
+ * all Worker-to-Container communication uses the RPC methods above.
+ */
+export default {
+    /**
+     * Container startup — called when the Container is first instantiated.
+     * Initializes the database, starts the firehose, and begins backfill.
+     */
+    async start(env) {
+        await ensureInit(env);
+    },
+    /**
+     * Handle fetch requests forwarded from the Worker.
+     * The Container doesn't serve HTTP — return 404 for any direct requests.
+     */
+    async fetch(request, env) {
+        await ensureInit(env);
+        return new Response(JSON.stringify({ error: 'Container does not serve HTTP requests' }), {
+            status: 404,
+            headers: { 'Content-Type': 'application/json' },
+        });
+    },
+    // RPC methods exposed to the Worker via service binding
+    resync,
+    resyncAll,
+    getStatus,
+};
+// Graceful shutdown
+process.on('SIGTERM', () => {
+    log('[container] Received SIGTERM, shutting down...');
+    process.exit(0);
+});

package/dist/cloudflare/hooks.d.ts

@@ -0,0 +1,33 @@
+/**
+ * SvelteKit handle hook for Cloudflare Workers.
+ *
+ * Use with @sveltejs/adapter-cloudflare. Lazily initializes hatk on the first
+ * request using the D1 binding from platform.env, then intercepts hatk API
+ * routes before SvelteKit processes them.
+ *
+ * @example
+ * ```ts
+ * // app/hooks.server.ts
+ * import { createHandle } from '@hatk/hatk/cloudflare/hooks'
+ * export const handle = createHandle()
+ * ```
+ */
+type MaybePromise<T> = T | Promise<T>;
+/** Minimal SvelteKit Handle type to avoid depending on @sveltejs/kit. */
+type Handle = (input: {
+    event: {
+        request: Request;
+        url: URL;
+        platform?: {
+            env?: Record<string, unknown>;
+        };
+    };
+    resolve: (event: any) => MaybePromise<Response>;
+}) => MaybePromise<Response>;
+/**
+ * Create a SvelteKit `handle` function that initializes hatk with D1
+ * and intercepts API routes.
+ */
+export declare function createHandle(): Handle;
+export {};
+//# sourceMappingURL=hooks.d.ts.map

package/dist/cloudflare/hooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../../src/cloudflare/hooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,KAAK,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;AAErC,yEAAyE;AACzE,KAAK,MAAM,GAAG,CAAC,KAAK,EAAE;IACpB,KAAK,EAAE;QACL,OAAO,EAAE,OAAO,CAAA;QAChB,GAAG,EAAE,GAAG,CAAA;QACR,QAAQ,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,CAAA;KAC7C,CAAA;IACD,OAAO,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,YAAY,CAAC,QAAQ,CAAC,CAAA;CAChD,KAAK,YAAY,CAAC,QAAQ,CAAC,CAAA;AAE5B;;;GAGG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAsBrC"}

package/dist/cloudflare/hooks.js

@@ -0,0 +1,40 @@
+/**
+ * SvelteKit handle hook for Cloudflare Workers.
+ *
+ * Use with @sveltejs/adapter-cloudflare. Lazily initializes hatk on the first
+ * request using the D1 binding from platform.env, then intercepts hatk API
+ * routes before SvelteKit processes them.
+ *
+ * @example
+ * ```ts
+ * // app/hooks.server.ts
+ * import { createHandle } from '@hatk/hatk/cloudflare/hooks'
+ * export const handle = createHandle()
+ * ```
+ */
+import { ensureInit, getHandler } from "./init.js";
+import { isHatkRoute } from "../adapter.js";
+/**
+ * Create a SvelteKit `handle` function that initializes hatk with D1
+ * and intercepts API routes.
+ */
+export function createHandle() {
+    return async ({ event, resolve }) => {
+        const env = event.platform?.env;
+        if (!env || !env.DB) {
+            // Not running on Cloudflare (e.g. dev mode) — pass through
+            return resolve(event);
+        }
+        // Lazy init hatk with the D1 binding
+        await ensureInit(env);
+        // hatk API routes
+        if (isHatkRoute(event.url.pathname)) {
+            const handler = getHandler();
+            if (handler) {
+                return handler(event.request);
+            }
+        }
+        // Everything else → SvelteKit
+        return resolve(event);
+    };
+}

package/dist/cloudflare/init.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Shared Cloudflare initialization logic used by both the standalone Worker
+ * entry and the SvelteKit handle hook.
+ */
+export interface CloudflareEnv {
+    DB: D1Database;
+    HATK_RELAY?: string;
+    HATK_PLC?: string;
+    HATK_OAUTH_ISSUER?: string;
+    HATK_OAUTH_SCOPES?: string;
+    HATK_ADMINS?: string;
+    HATK_COLLECTIONS?: string;
+    [key: string]: unknown;
+}
+interface D1Database {
+    prepare(sql: string): any;
+    batch<T = unknown>(statements: any[]): Promise<any[]>;
+    exec(sql: string): Promise<any>;
+}
+/**
+ * Ensure initialization has completed. Concurrent calls share the same promise.
+ */
+export declare function ensureInit(env: CloudflareEnv): Promise<void>;
+/** Get the hatk request handler (only valid after init). */
+export declare function getHandler(): ((request: Request) => Promise<Response>) | null;
+export {};
+//# sourceMappingURL=init.d.ts.map

package/dist/cloudflare/init.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/cloudflare/init.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAgBH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,UAAU,CAAA;IACd,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,UAAU,UAAU;IAClB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;IACzB,KAAK,CAAC,CAAC,GAAG,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;IACrD,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;CAChC;AAoFD;;GAEG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAS5D;AAED,4DAA4D;AAC5D,wBAAgB,UAAU,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,IAAI,CAE7E"}

package/dist/cloudflare/init.js

@@ -0,0 +1,103 @@
+/**
+ * Shared Cloudflare initialization logic used by both the standalone Worker
+ * entry and the SvelteKit handle hook.
+ */
+import { D1Adapter } from "../database/adapters/d1.js";
+import { initDatabase, migrateSchema } from "../database/db.js";
+import { storeLexicons, discoverCollections, buildSchemas } from "../database/schema.js";
+import { discoverViews } from "../views.js";
+import { getDialect } from "../database/dialect.js";
+import { setSearchPort } from "../database/fts.js";
+import { initOAuth } from "../oauth/server.js";
+import { parseSessionCookie, getSessionCookieName } from "../oauth/session.js";
+import { createHandler, registerCoreHandlers } from "../server.js";
+import { configureRelay } from "../xrpc.js";
+import { callXrpc } from "../xrpc.js";
+import { validateLexicons } from '@bigmoves/lexicon';
+let handler = null;
+let initPromise = null;
+/**
+ * One-time initialization. Sets up D1 adapter, database schemas, XRPC
+ * handlers, OAuth, and the globalThis bridge for SvelteKit SSR.
+ */
+async function initialize(env) {
+    const relay = env.HATK_RELAY || 'wss://bsky.network';
+    const plc = env.HATK_PLC || 'https://plc.directory';
+    configureRelay(relay);
+    const admins = env.HATK_ADMINS ? env.HATK_ADMINS.split(',').map((s) => s.trim()) : [];
+    // Load lexicons — injected at build time via virtual module
+    let lexicons;
+    try {
+        // @ts-expect-error — virtual module generated at build time
+        const lexiconModule = await import('virtual:hatk-lexicons');
+        lexicons = new Map(Object.entries(lexiconModule.default));
+    }
+    catch {
+        lexicons = new Map();
+    }
+    const lexiconErrors = validateLexicons([...lexicons.values()]);
+    if (lexiconErrors) {
+        for (const [nsid, errors] of Object.entries(lexiconErrors)) {
+            for (const err of errors) {
+                console.error(`[hatk] Invalid lexicon ${nsid}: ${err}`);
+            }
+        }
+        throw new Error('Invalid lexicons — check build output');
+    }
+    storeLexicons(lexicons);
+    const collections = env.HATK_COLLECTIONS
+        ? env.HATK_COLLECTIONS.split(',').map((s) => s.trim())
+        : discoverCollections(lexicons);
+    // Build schemas and init D1
+    discoverViews();
+    const engineDialect = getDialect('d1');
+    const { schemas, ddlStatements } = buildSchemas(lexicons, collections, engineDialect);
+    const adapter = new D1Adapter();
+    adapter.initWithBinding(env.DB);
+    setSearchPort(null);
+    await initDatabase(adapter, ':memory:', schemas, ddlStatements);
+    await migrateSchema(schemas);
+    // Register core XRPC handlers
+    const oauthConfig = env.HATK_OAUTH_ISSUER
+        ? {
+            issuer: env.HATK_OAUTH_ISSUER,
+            scopes: env.HATK_OAUTH_SCOPES ? env.HATK_OAUTH_SCOPES.split(',').map((s) => s.trim()) : ['read', 'write'],
+            clients: [],
+        }
+        : null;
+    registerCoreHandlers(collections, oauthConfig);
+    if (oauthConfig) {
+        await initOAuth(oauthConfig, plc, relay);
+    }
+    // Expose bridge for SvelteKit SSR
+    ;
+    globalThis.__hatk_callXrpc = callXrpc;
+    globalThis.__hatk_parseSessionCookie = parseSessionCookie;
+    globalThis.__hatk_sessionCookieName = getSessionCookieName();
+    // Create the request handler
+    handler = createHandler({
+        collections,
+        publicDir: null,
+        oauth: oauthConfig,
+        admins,
+        onResync: undefined,
+    });
+}
+/**
+ * Ensure initialization has completed. Concurrent calls share the same promise.
+ */
+export function ensureInit(env) {
+    if (handler)
+        return Promise.resolve();
+    if (!initPromise) {
+        initPromise = initialize(env).catch((err) => {
+            initPromise = null;
+            throw err;
+        });
+    }
+    return initPromise;
+}
+/** Get the hatk request handler (only valid after init). */
+export function getHandler() {
+    return handler;
+}

package/dist/cloudflare/worker.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Cloudflare Worker entry point for hatk.
+ *
+ * Handles HTTP requests via the Workers fetch handler. The firehose indexer
+ * and backfill run in a companion Container — the Worker only serves the
+ * API and web UI.
+ *
+ * For SvelteKit apps, prefer using the handle hook from
+ * '@hatk/hatk/cloudflare/hooks' with adapter-cloudflare instead.
+ */
+import { type CloudflareEnv } from './init.ts';
+interface ContainerBinding {
+    resync(did: string): Promise<void>;
+    fetch(request: Request): Promise<Response>;
+}
+interface Env extends CloudflareEnv {
+    CONTAINER: ContainerBinding;
+}
+interface ExecutionContext {
+    waitUntil(promise: Promise<unknown>): void;
+    passThroughOnException(): void;
+}
+declare const _default: {
+    fetch(request: Request, env: Env, ctx: ExecutionContext): Promise<Response>;
+};
+export default _default;
+//# sourceMappingURL=worker.d.ts.map

package/dist/cloudflare/worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.d.ts","sourceRoot":"","sources":["../../src/cloudflare/worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAA0B,KAAK,aAAa,EAAE,MAAM,WAAW,CAAA;AAGtE,UAAU,gBAAgB;IACxB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClC,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAC3C;AAED,UAAU,GAAI,SAAQ,aAAa;IACjC,SAAS,EAAE,gBAAgB,CAAA;CAC5B;AAED,UAAU,gBAAgB;IACxB,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAA;IAC1C,sBAAsB,IAAI,IAAI,CAAA;CAC/B;;mBAGsB,OAAO,OAAO,GAAG,OAAO,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC;;AADnF,wBA2CC"}

package/dist/cloudflare/worker.js

@@ -0,0 +1,54 @@
+/**
+ * Cloudflare Worker entry point for hatk.
+ *
+ * Handles HTTP requests via the Workers fetch handler. The firehose indexer
+ * and backfill run in a companion Container — the Worker only serves the
+ * API and web UI.
+ *
+ * For SvelteKit apps, prefer using the handle hook from
+ * '@hatk/hatk/cloudflare/hooks' with adapter-cloudflare instead.
+ */
+import { ensureInit, getHandler } from "./init.js";
+import { isHatkRoute } from "../adapter.js";
+export default {
+    async fetch(request, env, ctx) {
+        try {
+            await ensureInit(env);
+        }
+        catch (err) {
+            return new Response(JSON.stringify({ error: 'Initialization failed', detail: err.message }), {
+                status: 500,
+                headers: { 'Content-Type': 'application/json' },
+            });
+        }
+        const url = new URL(request.url);
+        const handler = getHandler();
+        // Intercept admin resync to delegate to the Container via RPC
+        if (url.pathname === '/admin/repos/resync' && request.method === 'POST') {
+            try {
+                const body = await request.text();
+                const { dids } = body ? JSON.parse(body) : {};
+                if (Array.isArray(dids)) {
+                    for (const did of dids) {
+                        ctx.waitUntil(env.CONTAINER.resync(did));
+                    }
+                    return new Response(JSON.stringify({ resyncing: dids.length }), {
+                        headers: { 'Content-Type': 'application/json', 'Access-Control-Allow-Origin': '*' },
+                    });
+                }
+            }
+            catch (err) {
+                return new Response(JSON.stringify({ error: err.message }), {
+                    status: 500,
+                    headers: { 'Content-Type': 'application/json' },
+                });
+            }
+        }
+        // hatk routes → handler
+        if (isHatkRoute(url.pathname)) {
+            return handler(request);
+        }
+        // Everything else → 404 (use cloudflare/hooks for SvelteKit integration)
+        return new Response('Not found', { status: 404 });
+    },
+};

package/dist/config.d.ts

@@ -20,6 +20,7 @@ export interface OAuthConfig {
     issuer: string;
     scopes: string[];
     clients: OAuthClientConfig[];
+    cookieName?: string;
 }
 export interface BackfillConfig {
     signalCollections?: string[];
@@ -33,6 +34,7 @@ export interface HatkConfig {
     relay: string;
     plc: string;
     port: number;
+    databaseEngine: 'duckdb' | 'sqlite';
     database: string;
     publicDir: string | null;
     collections: string[];
@@ -41,7 +43,16 @@ export interface HatkConfig {
     oauth: OAuthConfig | null;
     admins: string[];
 }
+/** Input type for defineConfig — fields that have defaults are optional. */
+export type HatkConfigInput = Partial<Omit<HatkConfig, 'oauth' | 'backfill'>> & {
+    oauth?: (Partial<OAuthConfig> & {
+        clients: OAuthClientConfig[];
+    }) | null;
+    backfill?: Partial<BackfillConfig>;
+};
+/** Identity function that provides type inference for hatk config files. */
+export declare function defineConfig(config: HatkConfigInput): HatkConfigInput;
 /** Derive HTTP URL from relay WebSocket URL (ws://host → http://host) */
 export declare function relayHttpUrl(relay: string): string;
-export declare function loadConfig(configPath: string): HatkConfig;
+export declare function loadConfig(configPath: string): Promise<HatkConfig>;
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAA;IACrC,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAA;IACnC,cAAc,EAAE,MAAM,GAAG,MAAM,GAAG,QAAQ,CAAA;IAC1C,OAAO,CAAC,EAAE,WAAW,EAAE,CAAA;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,OAAO,EAAE,iBAAiB,EAAE,CAAA;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;IAChB,WAAW,EAAE,OAAO,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,QAAQ,EAAE,cAAc,CAAA;IACxB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,KAAK,EAAE,WAAW,GAAG,IAAI,CAAA;IACzB,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB;AAED,yEAAyE;AACzE,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,CAyCzD"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAA;IACrC,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAA;IACnC,cAAc,EAAE,MAAM,GAAG,MAAM,GAAG,QAAQ,CAAA;IAC1C,OAAO,CAAC,EAAE,WAAW,EAAE,CAAA;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,OAAO,EAAE,iBAAiB,EAAE,CAAA;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;IAChB,WAAW,EAAE,OAAO,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,EAAE,QAAQ,GAAG,QAAQ,CAAA;IACnC,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,QAAQ,EAAE,cAAc,CAAA;IACxB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,KAAK,EAAE,WAAW,GAAG,IAAI,CAAA;IACzB,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB;AAED,4EAA4E;AAC5E,MAAM,MAAM,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,GAAG,UAAU,CAAC,CAAC,GAAG;IAC9E,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG;QAAE,OAAO,EAAE,iBAAiB,EAAE,CAAA;KAAE,CAAC,GAAG,IAAI,CAAA;IACxE,QAAQ,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAA;CACnC,CAAA;AAED,4EAA4E;AAC5E,wBAAgB,YAAY,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CAErE;AAED,yEAAyE;AACzE,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAwDxE"}