@hatk/hatk 0.0.1-alpha.40 → 0.0.1-alpha.42

package/dist/server.js

@@ -1,7 +1,7 @@
 import { existsSync } from 'node:fs';
 import { readFile } from 'node:fs/promises';
 import { join, extname } from 'node:path';
-import { queryRecords, getRecordByUri, searchRecords, getSchema, reshapeRow, setRepoStatus, getRepoStatus, getRepoRetryInfo, queryLabelsForUris, insertLabels, searchAccounts, listReposPaginated, getCollectionCounts, getRepoStatusCounts, getDatabaseSize, deleteLabels, getRecentRecords, listActiveRepoDids, removeRepo, getRepoHandle, getPreferences, putPreference, } from "./database/db.js";
+import { queryRecords, getRecordByUri, searchRecords, getSchema, reshapeRow, setRepoStatus, getRepoStatus, getRepoRetryInfo, queryLabelsForUris, insertLabels, searchAccounts, listReposPaginated, getCollectionCounts, getRepoStatusCounts, getDatabaseSize, deleteLabels, getRecentRecords, listActiveRepoDids, removeRepo, getRepoHandle, getPreferences, putPreference, insertReport, queryReports, resolveReport, getOpenReportCount, } from "./database/db.js";
 import { executeFeed, listFeeds } from "./feeds.js";
 import { executeXrpc, InvalidRequestError, NotFoundError, registerCoreXrpcHandler } from "./xrpc.js";
 import { resolveRecords } from "./hydrate.js";
@@ -16,8 +16,8 @@ import { pdsCreateRecord, pdsDeleteRecord, pdsPutRecord, pdsUploadBlob, ProxyErr
 import { json, jsonError, cors, withCors, file, notFound } from "./response.js";
 import { serve } from "./adapter.js";
 import { renderPage } from "./renderer.js";
-function scopeMissingResponse(acceptEncoding) {
-    const res = withCors(jsonError(401, 'ScopeMissingError', acceptEncoding));
+function scopeMissingResponse(acceptEncoding, handle) {
+    const res = withCors(json({ error: 'ScopeMissingError', ...(handle ? { handle } : {}) }, 401, acceptEncoding));
     res.headers.append('Set-Cookie', clearSessionCookieHeader());
     return res;
 }
@@ -154,6 +154,53 @@ export function registerCoreHandlers(collections, oauth) {
                 throw new InvalidRequestError('Authentication required');
             return pdsUploadBlob(oauth, viewer, input, 'application/octet-stream');
         });
+        registerCoreXrpcHandler('dev.hatk.createReport', async (_params, _cursor, _limit, viewer, input) => {
+            if (!viewer)
+                throw new InvalidRequestError('Authentication required');
+            const body = input;
+            if (!body.subject)
+                throw new InvalidRequestError('Missing subject');
+            if (!body.label || typeof body.label !== 'string')
+                throw new InvalidRequestError('Missing or invalid label');
+            const defs = getLabelDefinitions();
+            if (!defs.some((d) => d.identifier === body.label)) {
+                throw new InvalidRequestError(`Unknown label: ${body.label}`);
+            }
+            if (body.reason && body.reason.length > 2000) {
+                throw new InvalidRequestError('Reason must be 2000 characters or less');
+            }
+            let subjectUri;
+            let subjectDid;
+            if (body.subject.uri) {
+                subjectUri = body.subject.uri;
+                const match = body.subject.uri.match(/^at:\/\/(did:[^/]+)/);
+                if (!match)
+                    throw new InvalidRequestError('Invalid subject URI');
+                subjectDid = match[1];
+            }
+            else if (body.subject.did) {
+                subjectUri = `at://${body.subject.did}`;
+                subjectDid = body.subject.did;
+            }
+            else {
+                throw new InvalidRequestError('Subject must have uri or did');
+            }
+            const result = await insertReport({
+                subjectUri,
+                subjectDid,
+                label: body.label,
+                reason: body.reason,
+                reportedBy: viewer.did,
+            });
+            return {
+                id: result.id,
+                subject: body.subject,
+                label: body.label,
+                reason: body.reason || null,
+                reportedBy: viewer.did,
+                createdAt: new Date().toISOString(),
+            };
+        });
     }
 }
 /**
@@ -561,7 +608,38 @@ export function createHandler(config) {
                     heapTotal: `${(mem.heapTotal / 1024 / 1024).toFixed(1)} MiB`,
                     external: `${(mem.external / 1024 / 1024).toFixed(1)} MiB`,
                 };
-                return withCors(json({ repos: counts, duckdb: dbInfo, node, collections: collectionCounts }, 200, acceptEncoding));
+                const openReports = await getOpenReportCount();
+                return withCors(json({ repos: counts, duckdb: dbInfo, node, collections: collectionCounts, openReports }, 200, acceptEncoding));
+            }
+            // GET /admin/reports — list reports
+            if (url.pathname === '/admin/reports' && request.method === 'GET') {
+                const denied = requireAdmin(viewer, acceptEncoding);
+                if (denied)
+                    return denied;
+                const status = url.searchParams.get('status') || 'open';
+                const label = url.searchParams.get('label') || undefined;
+                const limit = parseInt(url.searchParams.get('limit') || '50');
+                const offset = parseInt(url.searchParams.get('offset') || '0');
+                const result = await queryReports({ status, label, limit, offset });
+                return withCors(json(result, 200, acceptEncoding));
+            }
+            // POST /admin/reports/resolve — resolve or dismiss a report
+            if (url.pathname === '/admin/reports/resolve' && request.method === 'POST') {
+                const denied = requireAdmin(viewer, acceptEncoding);
+                if (denied)
+                    return denied;
+                const { id, action } = JSON.parse(await request.text());
+                if (!id || !action)
+                    return withCors(jsonError(400, 'Missing id or action', acceptEncoding));
+                if (action !== 'resolve' && action !== 'dismiss')
+                    return withCors(jsonError(400, 'Action must be resolve or dismiss', acceptEncoding));
+                const report = await resolveReport(id, action === 'resolve' ? 'resolved' : 'dismissed', viewer.did);
+                if (!report)
+                    return withCors(jsonError(404, 'Report not found or already resolved', acceptEncoding));
+                if (action === 'resolve') {
+                    await insertLabels([{ src: 'admin', uri: report.subjectUri, val: report.label }]);
+                }
+                return withCors(json({ ok: true }, 200, acceptEncoding));
             }
             // GET /admin/info/:did — repo status info
             if (url.pathname.startsWith('/admin/info/did:')) {
@@ -757,9 +835,9 @@ export function createHandler(config) {
                 }
                 catch (err) {
                     if (err instanceof ScopeMissingProxyError)
-                        return scopeMissingResponse(acceptEncoding);
+                        return scopeMissingResponse(acceptEncoding, viewer?.handle);
                     if (err instanceof ProxyError)
-                        return withCors(jsonError(err.status, err.message, acceptEncoding));
+                        return withCors(json({ error: err.message, ...(viewer?.handle ? { handle: viewer.handle } : {}) }, err.status, acceptEncoding));
                     throw err;
                 }
             }
@@ -774,9 +852,9 @@ export function createHandler(config) {
                 }
                 catch (err) {
                     if (err instanceof ScopeMissingProxyError)
-                        return scopeMissingResponse(acceptEncoding);
+                        return scopeMissingResponse(acceptEncoding, viewer?.handle);
                     if (err instanceof ProxyError)
-                        return withCors(jsonError(err.status, err.message, acceptEncoding));
+                        return withCors(json({ error: err.message, ...(viewer?.handle ? { handle: viewer.handle } : {}) }, err.status, acceptEncoding));
                     throw err;
                 }
             }
@@ -791,9 +869,9 @@ export function createHandler(config) {
                 }
                 catch (err) {
                     if (err instanceof ScopeMissingProxyError)
-                        return scopeMissingResponse(acceptEncoding);
+                        return scopeMissingResponse(acceptEncoding, viewer?.handle);
                     if (err instanceof ProxyError)
-                        return withCors(jsonError(err.status, err.message, acceptEncoding));
+                        return withCors(json({ error: err.message, ...(viewer?.handle ? { handle: viewer.handle } : {}) }, err.status, acceptEncoding));
                     throw err;
                 }
             }
@@ -809,9 +887,9 @@ export function createHandler(config) {
                 }
                 catch (err) {
                     if (err instanceof ScopeMissingProxyError)
-                        return scopeMissingResponse(acceptEncoding);
+                        return scopeMissingResponse(acceptEncoding, viewer?.handle);
                     if (err instanceof ProxyError)
-                        return withCors(jsonError(err.status, err.message, acceptEncoding));
+                        return withCors(json({ error: err.message, ...(viewer?.handle ? { handle: viewer.handle } : {}) }, err.status, acceptEncoding));
                     throw err;
                 }
             }
@@ -873,7 +951,7 @@ export function createHandler(config) {
                 }
                 catch (err) {
                     if (err instanceof ScopeMissingProxyError)
-                        return scopeMissingResponse(acceptEncoding);
+                        return scopeMissingResponse(acceptEncoding, viewer?.handle);
                     if (err instanceof InvalidRequestError) {
                         return withCors(jsonError(err.status, err.errorName || err.message, acceptEncoding));
                     }

package/dist/templates/feed.tpl

@@ -0,0 +1,14 @@
+import { defineFeed } from '$hatk'
+
+export default defineFeed({
+  collection: 'your.collection.here',
+  label: '{{Name}}',
+
+  async generate(ctx) {
+    const { rows, cursor } = await ctx.paginate<{ uri: string }>(
+      `SELECT uri, cid, indexed_at FROM "your.collection.here"`,
+    )
+
+    return ctx.ok({ uris: rows.map((r) => r.uri), cursor })
+  },
+})

package/dist/templates/hook.tpl

@@ -0,0 +1,5 @@
+import { defineHook } from '$hatk'
+
+export default defineHook('{{name}}', async (ctx) => {
+  // Hook logic here
+})

package/dist/templates/label.tpl

@@ -0,0 +1,15 @@
+import { defineLabel } from '$hatk'
+
+export default defineLabel({
+  definition: {
+    identifier: '{{name}}',
+    severity: 'inform',
+    blurs: 'none',
+    defaultSetting: 'warn',
+    locales: [{ lang: 'en', name: '{{Name}}', description: 'Description here' }],
+  },
+  async evaluate(ctx) {
+    // Return array of label identifiers to apply, or empty array
+    return []
+  },
+})

package/dist/templates/og.tpl

@@ -0,0 +1,17 @@
+import type { OpengraphContext, OpengraphResult } from '@hatk/hatk/opengraph'
+
+export default {
+  path: '/og/{{name}}/:id',
+  async generate(ctx: OpengraphContext): Promise<OpengraphResult> {
+    const { db, params } = ctx
+    return {
+      element: {
+        type: 'div',
+        props: {
+          style: { display: 'flex', width: '100%', height: '100%', background: '#080b12', color: 'white', alignItems: 'center', justifyContent: 'center' },
+          children: params.id,
+        },
+      },
+    }
+  },
+}

package/dist/templates/seed.tpl

@@ -0,0 +1,11 @@
+import { seed } from '$hatk'
+
+const { createAccount, createRecord } = seed()
+
+const alice = await createAccount('alice.test')
+
+// await createRecord(alice, 'your.collection.here', {
+//   field: 'value',
+// }, { rkey: 'my-record' })
+
+console.log('\n[seed] Done!')

package/dist/templates/setup.tpl

@@ -0,0 +1,5 @@
+import { defineSetup } from '$hatk'
+
+export default defineSetup(async (ctx) => {
+  // Setup logic here — runs before the server starts
+})

package/dist/templates/test-feed.tpl

@@ -0,0 +1,19 @@
+import { describe, test, expect, beforeAll, afterAll } from 'vitest'
+import { createTestContext } from '@hatk/hatk/test'
+
+let ctx: Awaited<ReturnType<typeof createTestContext>>
+
+beforeAll(async () => {
+  ctx = await createTestContext()
+  await ctx.loadFixtures()
+})
+
+afterAll(async () => ctx?.close())
+
+describe('{{name}} feed', () => {
+  test('returns results', async () => {
+    const feed = ctx.loadFeed('{{name}}')
+    const result = await feed.generate(ctx.feedContext({ limit: 10 }))
+    expect(result).toBeDefined()
+  })
+})

package/dist/templates/test-xrpc.tpl

@@ -0,0 +1,19 @@
+import { describe, test, expect, beforeAll, afterAll } from 'vitest'
+import { createTestContext } from '@hatk/hatk/test'
+
+let ctx: Awaited<ReturnType<typeof createTestContext>>
+
+beforeAll(async () => {
+  ctx = await createTestContext()
+  await ctx.loadFixtures()
+})
+
+afterAll(async () => ctx?.close())
+
+describe('{{name}}', () => {
+  test('returns response', async () => {
+    const handler = ctx.loadXrpc('{{name}}')
+    const result = await handler.handler({ params: {} })
+    expect(result).toBeDefined()
+  })
+})

package/dist/templates/xrpc.tpl

@@ -0,0 +1,41 @@
+import { defineQuery } from '$hatk'
+
+export default defineQuery('{{name}}', async (ctx) => {
+  const { ok, db, params, packCursor, unpackCursor } = ctx
+  const limit = params.limit ?? 30
+  const cursor = params.cursor
+
+  const conditions: string[] = []
+  const sqlParams: (string | number)[] = []
+  let paramIdx = 1
+
+  if (cursor) {
+    const parsed = unpackCursor(cursor)
+    if (parsed) {
+      conditions.push(`(s.indexed_at < $${paramIdx} OR (s.indexed_at = $${paramIdx + 1} AND s.cid < $${paramIdx + 2}))`)
+      sqlParams.push(parsed.primary, parsed.primary, parsed.cid)
+      paramIdx += 3
+    }
+  }
+
+  const where = conditions.length ? 'WHERE ' + conditions.join(' AND ') : ''
+
+  const rows = (await db.query(
+    `SELECT s.* FROM "your.collection.here" s ${where} ORDER BY s.indexed_at DESC, s.cid DESC LIMIT $${paramIdx}`,
+    sqlParams.concat([limit + 1]),
+  )) as {
+    uri: string
+    cid: string
+    did: string
+    indexed_at: string
+  }[]
+
+  const hasMore = rows.length > limit
+  if (hasMore) rows.pop()
+  const lastRow = rows[rows.length - 1]
+
+  return ok({
+    items: rows,
+    cursor: hasMore && lastRow ? packCursor(lastRow.indexed_at, lastRow.cid) : undefined,
+  })
+})

package/dist/xrpc.d.ts

@@ -1,6 +1,9 @@
 import type { BaseContext } from './hydrate.ts';
 import type { Row, FlatRow } from './lex-types.ts';
+import type { OAuthConfig } from './config.ts';
 export type { Row, FlatRow };
+/** Set the OAuth config used for record write helpers. Called once during boot. */
+export declare function configureOAuth(config: OAuthConfig | null): void;
 /** Thrown from XRPC handlers to return a 400 response with an error message. */
 export declare class InvalidRequestError extends Error {
     status: number;
@@ -47,6 +50,17 @@ export interface XrpcContext<P = Record<string, string>, Records extends Record<
     }>;
     resolve: <R = unknown>(uris: string[]) => Promise<Row<R>[]>;
     exists: (collection: string, filters: Record<string, string>) => Promise<boolean>;
+    createRecord: (collection: string, record: Record<string, unknown>, opts?: {
+        rkey?: string;
+    }) => Promise<{
+        uri?: string;
+        cid?: string;
+    }>;
+    putRecord: (collection: string, rkey: string, record: Record<string, unknown>) => Promise<{
+        uri?: string;
+        cid?: string;
+    }>;
+    deleteRecord: (collection: string, rkey: string) => Promise<void>;
 }
 /** Set the relay URL used for blob URL generation. Called once during boot. */
 export declare function configureRelay(relay: string): void;

package/dist/xrpc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"xrpc.d.ts","sourceRoot":"","sources":["../src/xrpc.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAE/C,OAAO,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AAElD,YAAY,EAAE,GAAG,EAAE,OAAO,EAAE,CAAA;AAE5B,gFAAgF;AAChF,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,MAAM,SAAM;IACZ,SAAS,CAAC,EAAE,MAAM,CAAA;gBACN,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM;CAIhD;AACD,0DAA0D;AAC1D,qBAAa,aAAc,SAAQ,mBAAmB;IACpD,MAAM,SAAM;gBACA,OAAO,SAAc;CAGlC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW,CAC1B,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC1B,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzD,CAAC,GAAG,OAAO,CACX,SAAQ,WAAW;IACnB,EAAE,EAAE;QACF,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;QAC9D,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KACxD,CAAA;IACD,MAAM,EAAE,CAAC,CAAA;IACT,KAAK,EAAE,CAAC,CAAA;IACR,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,MAAM,CAAA;IAC7D,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;IACzE,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IAC9C,mBAAmB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;IAC7D,MAAM,EAAE,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,OAAO,EACvC,UAAU,EAAE,CAAC,EACb,CAAC,EAAE,MAAM,EACT,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,KACxD,OAAO,CAAC;QAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC7D,OAAO,EAAE,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAC3D,MAAM,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAClF;AAgBD,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,QAE3C;AAED;;;GAGG;AACH,wBAAgB,OAAO,CACrB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,OAAO,EACZ,MAAM,GAAE,QAAQ,GAAG,QAAQ,GAAG,gBAAgB,GAAG,eAA0B,GAC1E,MAAM,GAAG,SAAS,CAQpB;AAED,mGAAmG;AACnG,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAC/C,KAAK,CAAC,EAAE,OAAO,GACd,WAAW,CAqBb;AAoBD;;;;GAIG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAwC7D;AAED,oEAAoE;AACpE,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE;IAAE,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,CAAA;CAAE,GAAG,IAAI,CA2B9G;AAED,qFAAqF;AACrF,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAC/B,KAAK,CAAC,EAAE,OAAO,GACd,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAYrB;AAED,mFAAmF;AACnF,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAM,EAAE,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAgB5G;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,CACF,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAC/C,KAAK,CAAC,EAAE,OAAO,KACZ,OAAO,CAAC,GAAG,CAAC,GAChB,IAAI,CAEN;AAED,+CAA+C;AAC/C,wBAAgB,QAAQ,IAAI,MAAM,EAAE,CAEnC"}
+{"version":3,"file":"xrpc.d.ts","sourceRoot":"","sources":["../src/xrpc.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAE/C,OAAO,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAG9C,YAAY,EAAE,GAAG,EAAE,OAAO,EAAE,CAAA;AAI5B,mFAAmF;AACnF,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,QAExD;AAED,gFAAgF;AAChF,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,MAAM,SAAM;IACZ,SAAS,CAAC,EAAE,MAAM,CAAA;gBACN,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM;CAIhD;AACD,0DAA0D;AAC1D,qBAAa,aAAc,SAAQ,mBAAmB;IACpD,MAAM,SAAM;gBACA,OAAO,SAAc;CAGlC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW,CAC1B,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC1B,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzD,CAAC,GAAG,OAAO,CACX,SAAQ,WAAW;IACnB,EAAE,EAAE;QACF,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;QAC9D,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KACxD,CAAA;IACD,MAAM,EAAE,CAAC,CAAA;IACT,KAAK,EAAE,CAAC,CAAA;IACR,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,MAAM,CAAA;IAC7D,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;IACzE,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IAC9C,mBAAmB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;IAC7D,MAAM,EAAE,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,OAAO,EACvC,UAAU,EAAE,CAAC,EACb,CAAC,EAAE,MAAM,EACT,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,KACxD,OAAO,CAAC;QAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC7D,OAAO,EAAE,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAC3D,MAAM,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IACjF,YAAY,EAAE,CACZ,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,KACrB,OAAO,CAAC;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC5C,SAAS,EAAE,CACT,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,OAAO,CAAC;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC5C,YAAY,EAAE,CACZ,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,KACT,OAAO,CAAC,IAAI,CAAC,CAAA;CACnB;AAgBD,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,QAE3C;AAED;;;GAGG;AACH,wBAAgB,OAAO,CACrB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,OAAO,EACZ,MAAM,GAAE,QAAQ,GAAG,QAAQ,GAAG,gBAAgB,GAAG,eAA0B,GAC1E,MAAM,GAAG,SAAS,CAQpB;AAED,mGAAmG;AACnG,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAC/C,KAAK,CAAC,EAAE,OAAO,GACd,WAAW,CAoCb;AAoBD;;;;GAIG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAwC7D;AAED,oEAAoE;AACpE,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE;IAAE,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,CAAA;CAAE,GAAG,IAAI,CA2B9G;AAED,qFAAqF;AACrF,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAC/B,KAAK,CAAC,EAAE,OAAO,GACd,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAYrB;AAED,mFAAmF;AACnF,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAM,EAAE,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAgB5G;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,CACF,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAC/C,KAAK,CAAC,EAAE,OAAO,KACZ,OAAO,CAAC,GAAG,CAAC,GAChB,IAAI,CAEN;AAED,+CAA+C;AAC/C,wBAAgB,QAAQ,IAAI,MAAM,EAAE,CAEnC"}

package/dist/xrpc.js

@@ -32,6 +32,12 @@ import { log, emit, timer } from "./logger.js";
 import { querySQL, runSQL, packCursor, unpackCursor, isTakendownDid, filterTakendownDids, searchRecords, findUriByFields, } from "./database/db.js";
 import { resolveRecords, buildBaseContext } from "./hydrate.js";
 import { getLexicon } from "./database/schema.js";
+import { pdsCreateRecord, pdsPutRecord, pdsDeleteRecord } from "./pds-proxy.js";
+let _oauthConfig = null;
+/** Set the OAuth config used for record write helpers. Called once during boot. */
+export function configureOAuth(config) {
+    _oauthConfig = config;
+}
 /** Thrown from XRPC handlers to return a 400 response with an error message. */
 export class InvalidRequestError extends Error {
     status = 400;
@@ -89,6 +95,27 @@ export function buildXrpcContext(params, cursor, limit, viewer, input) {
             const uri = await findUriByFields(collection, conditions);
             return uri !== null;
         },
+        createRecord: async (collection, record, opts) => {
+            if (!_oauthConfig)
+                throw new Error('No OAuth config — cannot write to PDS');
+            if (!viewer)
+                throw new Error('Authentication required to write records');
+            return pdsCreateRecord(_oauthConfig, viewer, { collection, record, rkey: opts?.rkey });
+        },
+        putRecord: async (collection, rkey, record) => {
+            if (!_oauthConfig)
+                throw new Error('No OAuth config — cannot write to PDS');
+            if (!viewer)
+                throw new Error('Authentication required to write records');
+            return pdsPutRecord(_oauthConfig, viewer, { collection, rkey, record });
+        },
+        deleteRecord: async (collection, rkey) => {
+            if (!_oauthConfig)
+                throw new Error('No OAuth config — cannot write to PDS');
+            if (!viewer)
+                throw new Error('Authentication required to write records');
+            await pdsDeleteRecord(_oauthConfig, viewer, { collection, rkey });
+        },
     };
 }
 const handlers = new Map();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hatk/hatk",
-  "version": "0.0.1-alpha.40",
+  "version": "0.0.1-alpha.42",
   "license": "MIT",
   "bin": {
     "hatk": "dist/cli.js"
@@ -28,7 +28,8 @@
     "./renderer": "./dist/renderer.js"
   },
   "scripts": {
-    "build": "tsc -p tsconfig.build.json",
+    "clean": "rm -rf dist",
+    "build": "npm run clean && tsc -p tsconfig.build.json && cp -r src/templates dist/templates && cp -r src/lexicons dist/lexicons",
     "prepublishOnly": "npm run build"
   },
   "dependencies": {

package/public/admin.html

@@ -1203,6 +1203,7 @@
           <button class="tab active" data-tab="overview">Overview</button>
           <button class="tab" data-tab="repos">Repos</button>
           <button class="tab" data-tab="content">Content</button>
+          <button class="tab" data-tab="reports">Reports</button>
         </nav>
 
         <!-- Overview -->
@@ -1277,6 +1278,21 @@
             <div class="loading">Loading</div>
           </div>
         </div>
+
+        <!-- Reports -->
+        <div class="tab-panel" id="panel-reports">
+          <div class="search-bar">
+            <select class="search-input" id="reports-status" style="max-width: 200px">
+              <option value="open">Open</option>
+              <option value="resolved">Resolved</option>
+              <option value="dismissed">Dismissed</option>
+            </select>
+            <select class="search-input" id="reports-label-filter" style="max-width: 200px">
+              <option value="">All labels</option>
+            </select>
+          </div>
+          <div id="reports-results"></div>
+        </div>
       </div>
 
       <!-- Bottom nav (mobile) -->
@@ -1285,6 +1301,7 @@
           <button class="bnav-btn active" data-tab="overview">Overview</button>
           <button class="bnav-btn" data-tab="repos">Repos</button>
           <button class="bnav-btn" data-tab="content">Content</button>
+          <button class="bnav-btn" data-tab="reports">Reports</button>
         </div>
       </div>
     </div>
@@ -1468,6 +1485,7 @@
         if (tab === 'overview') loadOverview()
         if (tab === 'repos') loadRepos()
         if (tab === 'content') loadContent()
+        if (tab === 'reports') loadReports()
         if (push) pushURL({ tab, status: '', q: '', offset: 0, cq: '' })
       }
 
@@ -1494,6 +1512,7 @@
       <div class="stat-card"><div class="stat-label">Pending</div><div class="stat-value yellow">${fmt(repoStatuses.pending)}</div></div>
       <div class="stat-card"><div class="stat-label">Failed</div><div class="stat-value red">${fmt(repoStatuses.failed)}</div></div>
       <div class="stat-card"><div class="stat-label">Taken Down</div><div class="stat-value red">${fmt(repoStatuses.takendown)}</div></div>
+      ${info.openReports > 0 ? `<div class="stat-card" style="cursor:pointer" onclick="activateTab('reports')"><div class="stat-label">Open Reports</div><div class="stat-value yellow">${fmt(info.openReports)}</div></div>` : ''}
     `
 
           const collectionCards = document.getElementById('collection-cards')
@@ -2107,6 +2126,120 @@
           })
         })
       }
+
+      // ── Reports ──
+
+      const reportsPage = { limit: 50, offset: 0 }
+
+      function populateReportsLabelFilter() {
+        const select = document.getElementById('reports-label-filter')
+        const current = select.value
+        select.innerHTML = '<option value="">All labels</option>' +
+          labelDefinitions.map(d => `<option value="${d.identifier}">${d.identifier}</option>`).join('')
+        select.value = current
+      }
+
+      document.getElementById('reports-status').addEventListener('change', () => {
+        reportsPage.offset = 0
+        loadReports()
+      })
+      document.getElementById('reports-label-filter').addEventListener('change', () => {
+        reportsPage.offset = 0
+        loadReports()
+      })
+
+      async function loadReports() {
+        populateReportsLabelFilter()
+        const status = document.getElementById('reports-status').value
+        const label = document.getElementById('reports-label-filter').value
+        const container = document.getElementById('reports-results')
+        container.innerHTML = '<div class="loading">Loading</div>'
+        try {
+          let url = `/admin/reports?status=${status}&limit=${reportsPage.limit}&offset=${reportsPage.offset}`
+          if (label) url += `&label=${encodeURIComponent(label)}`
+          const result = await api(url)
+          renderReports(result.reports || [], result.total)
+        } catch (e) {
+          container.innerHTML = `<div class="empty-state">${escapeHtml(e.message)}</div>`
+        }
+      }
+
+      function renderReports(reports, total) {
+        const container = document.getElementById('reports-results')
+        if (!reports.length) {
+          container.innerHTML = '<div class="empty-state">No reports found</div>'
+          return
+        }
+
+        const showPagination = total != null && total > reportsPage.limit
+        const paginationHtml = showPagination ? `
+          <div class="pagination">
+            <span>${reportsPage.offset + 1}\u2013${Math.min(reportsPage.offset + reportsPage.limit, total)} of ${total.toLocaleString()}</span>
+            <div class="pagination-buttons">
+              <button class="btn btn-sm" data-reports-page="prev" ${reportsPage.offset === 0 ? 'disabled' : ''}>Prev</button>
+              <button class="btn btn-sm" data-reports-page="next" ${reportsPage.offset + reportsPage.limit >= total ? 'disabled' : ''}>Next</button>
+            </div>
+          </div>
+        ` : ''
+
+        const countLabel = total != null
+          ? `${total.toLocaleString()} report${total !== 1 ? 's' : ''}`
+          : `${reports.length} result${reports.length !== 1 ? 's' : ''}`
+
+        const isOpen = document.getElementById('reports-status').value === 'open'
+
+        container.innerHTML = `
+          <div class="card">
+            <div class="result-count">${countLabel}</div>
+            ${reports.map(r => {
+              const reporterDisplay = r.reported_by_handle ? `@${escapeHtml(r.reported_by_handle)}` : escapeHtml(r.reported_by)
+              const date = new Date(r.created_at).toLocaleString()
+              return `<div class="record-card">
+                <div class="record-header">
+                  <div class="record-meta">
+                    <div class="record-uri" title="${escapeHtml(r.subject_uri)}">${escapeHtml(r.subject_uri)}</div>
+                    <div class="record-summary">
+                      <span class="label-tag">${escapeHtml(r.label)}</span>
+                      reported by ${reporterDisplay} &middot; ${date}
+                    </div>
+                    ${r.reason ? `<div class="record-summary" style="margin-top:0.25rem">${escapeHtml(r.reason)}</div>` : ''}
+                    ${!isOpen ? `<div class="record-summary" style="margin-top:0.25rem;opacity:0.6">${escapeHtml(r.status)}${r.resolved_by ? ` by ${escapeHtml(r.resolved_by)}` : ''}</div>` : ''}
+                  </div>
+                  ${isOpen ? `<div class="record-actions">
+                    <button class="btn btn-sm" data-action="resolve-report" data-id="${r.id}" data-resolve="resolve" style="background:var(--accent);color:white">Apply Label</button>
+                    <button class="btn btn-sm" data-action="resolve-report" data-id="${r.id}" data-resolve="dismiss">Dismiss</button>
+                  </div>` : ''}
+                </div>
+              </div>`
+            }).join('')}
+            ${paginationHtml}
+          </div>
+        `
+
+        container.querySelectorAll('[data-reports-page="prev"]').forEach(b => {
+          b.addEventListener('click', () => { reportsPage.offset = Math.max(0, reportsPage.offset - reportsPage.limit); loadReports() })
+        })
+        container.querySelectorAll('[data-reports-page="next"]').forEach(b => {
+          b.addEventListener('click', () => { reportsPage.offset += reportsPage.limit; loadReports() })
+        })
+
+        container.querySelectorAll('[data-action="resolve-report"]').forEach(btn => {
+          btn.addEventListener('click', async () => {
+            const action = btn.dataset.resolve
+            try {
+              await api('/admin/reports/resolve', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ id: parseInt(btn.dataset.id), action }),
+              })
+              toast(action === 'resolve' ? 'Label applied & report resolved' : 'Report dismissed', 'success')
+              loadReports()
+            } catch (e) {
+              toast(e.message, 'error')
+            }
+          })
+        })
+      }
     </script>
   </body>
 </html>