@hatk/hatk 0.0.1-alpha.8 → 0.0.1-alpha.81

package/dist/push.js

@@ -0,0 +1,367 @@
+/**
+ * Push notification delivery via APNs HTTP/2 and FCM HTTP v1.
+ *
+ * Provides `push.send()` for use in on-commit hook context. Looks up device
+ * tokens, builds a payload per platform, and sends over the transport that
+ * platform's tokens belong to. Self-cleans tokens the vendor reports as dead —
+ * Apple's 410, Google's UNREGISTERED. Fire-and-forget — failures are logged via
+ * `emit()` but never throw.
+ *
+ * Either transport can be configured alone. A deployment with only an APNs key
+ * still sends to iOS, and Android tokens simply sit unused until an FCM service
+ * account is supplied.
+ */
+import { connect } from 'node:http2';
+import { readFileSync } from 'node:fs';
+import { createSign } from 'node:crypto';
+import { resolve } from 'node:path';
+import { emit } from "./logger.js";
+import { runSQL, querySQL } from "./database/db.js";
+let pushConfig = null;
+let apnsKey = null;
+let cachedJwt = null;
+let http2Session = null;
+let fcmCredentials = null;
+let cachedFcmToken = null;
+/** Where a service account trades its signed JWT for a bearer token. */
+const GOOGLE_TOKEN_URI = 'https://oauth2.googleapis.com/token';
+/** The only scope FCM sending needs. */
+const FCM_SCOPE = 'https://www.googleapis.com/auth/firebase.messaging';
+/**
+ * Initialize push with config. Must be called before send().
+ *
+ * Each transport is loaded on its own: a missing or malformed credential
+ * disables that platform and leaves the other one sending, rather than taking
+ * push down entirely.
+ */
+export function initPush(config, configDir) {
+    pushConfig = config;
+    apnsKey = null;
+    fcmCredentials = null;
+    cachedJwt = null;
+    cachedFcmToken = null;
+    if (config.apns) {
+        const keyPath = resolve(configDir, config.apns.keyFile);
+        try {
+            apnsKey = readFileSync(keyPath, 'utf8');
+        }
+        catch {
+            emit('push', 'init_error', { transport: 'apns', error: `APNs key file not found: ${keyPath}` });
+        }
+    }
+    if (config.fcm) {
+        const keyPath = resolve(configDir, config.fcm.keyFile);
+        try {
+            const account = JSON.parse(readFileSync(keyPath, 'utf8'));
+            const projectId = config.fcm.projectId ?? account.project_id;
+            if (!account.client_email || !account.private_key || !projectId) {
+                throw new Error('needs client_email, private_key and a project id');
+            }
+            fcmCredentials = {
+                clientEmail: account.client_email,
+                privateKey: account.private_key,
+                projectId,
+                tokenUri: account.token_uri ?? GOOGLE_TOKEN_URI,
+            };
+        }
+        catch (err) {
+            emit('push', 'init_error', {
+                transport: 'fcm',
+                error: `FCM service account unusable (${keyPath}): ${err.message}`,
+            });
+        }
+    }
+    if (!apnsKey && !fcmCredentials)
+        pushConfig = null;
+}
+/** Check if push is configured and at least one transport is usable. */
+export function isPushEnabled() {
+    return pushConfig !== null && (apnsKey !== null || fcmCredentials !== null);
+}
+/** Which platforms this process can actually deliver to, for startup logging. */
+export function enabledPushTransports() {
+    const transports = [];
+    if (apnsKey)
+        transports.push('apns');
+    if (fcmCredentials)
+        transports.push('fcm');
+    return transports;
+}
+/** Build the push interface injected into hook contexts. */
+export function buildPushInterface() {
+    return { send };
+}
+/** Create a JWT for APNs authentication (cached for 50 minutes). */
+function getApnsJwt() {
+    if (cachedJwt && Date.now() < cachedJwt.expires)
+        return cachedJwt.token;
+    const apns = pushConfig?.apns;
+    if (!apns || !apnsKey)
+        throw new Error('APNs not initialized');
+    const header = Buffer.from(JSON.stringify({
+        alg: 'ES256',
+        kid: apns.keyId,
+    })).toString('base64url');
+    const now = Math.floor(Date.now() / 1000);
+    const claims = Buffer.from(JSON.stringify({
+        iss: apns.teamId,
+        iat: now,
+    })).toString('base64url');
+    const signer = createSign('SHA256');
+    signer.update(`${header}.${claims}`);
+    const signature = signer.sign(apnsKey, 'base64url');
+    const token = `${header}.${claims}.${signature}`;
+    cachedJwt = { token, expires: Date.now() + 50 * 60 * 1000 };
+    return token;
+}
+/** Get or create an HTTP/2 connection to APNs. */
+function getHttp2Session() {
+    if (http2Session && !http2Session.closed && !http2Session.destroyed) {
+        return http2Session;
+    }
+    const host = pushConfig?.apns?.production !== false ? 'https://api.push.apple.com' : 'https://api.sandbox.push.apple.com';
+    emit('push', 'connecting', { host });
+    http2Session = connect(host, {
+        peerMaxConcurrentStreams: 100,
+    });
+    http2Session.on('connect', () => {
+        emit('push', 'connected', { host });
+    });
+    http2Session.on('error', (err) => {
+        emit('push', 'connection_error', { host, error: err.message });
+        http2Session = null;
+    });
+    http2Session.on('close', () => {
+        http2Session = null;
+    });
+    return http2Session;
+}
+/** Send a push notification to all devices registered for a DID. */
+async function send(payload) {
+    if (!isPushEnabled())
+        return;
+    const tokens = (await querySQL(`SELECT token, platform FROM _push_tokens WHERE did = $1`, [payload.did]));
+    if (tokens.length === 0)
+        return;
+    // A device is reachable over exactly one transport, named by the platform it
+    // registered under. An unrecognized platform is left alone rather than
+    // guessed at — the row may belong to a client this build doesn't serve yet.
+    const apnsTokens = tokens.filter((t) => t.platform === 'apns');
+    const fcmTokens = tokens.filter((t) => t.platform === 'fcm');
+    if (apnsKey && apnsTokens.length > 0) {
+        const jwt = getApnsJwt();
+        const aps = {
+            alert: { title: payload.title, body: payload.body },
+            sound: 'default',
+        };
+        if (payload.badge !== undefined) {
+            aps.badge = payload.badge;
+        }
+        const apnsPayload = JSON.stringify({
+            aps,
+            ...(payload.data || {}),
+        });
+        for (const { token } of apnsTokens) {
+            sendToApns(token, apnsPayload, jwt, payload).catch(() => { });
+        }
+    }
+    if (fcmCredentials && fcmTokens.length > 0) {
+        // One access token serves every device in this fan-out; it's minted once
+        // and cached for the hour Google grants it.
+        let accessToken;
+        try {
+            accessToken = await getFcmAccessToken();
+        }
+        catch (err) {
+            emit('push', 'send_error', { did: payload.did, transport: 'fcm', error: err.message });
+            return;
+        }
+        for (const { token } of fcmTokens) {
+            sendToFcm(token, accessToken, payload).catch(() => { });
+        }
+    }
+}
+/** Send a single APNs push and handle the response. */
+async function sendToApns(token, payload, jwt, original) {
+    const apns = pushConfig?.apns;
+    if (!apns)
+        return;
+    const session = getHttp2Session();
+    const headers = {
+        ':method': 'POST',
+        ':path': `/3/device/${token}`,
+        authorization: `bearer ${jwt}`,
+        'apns-topic': apns.bundleId,
+        'apns-push-type': 'alert',
+    };
+    if (original.collapseId) {
+        headers['apns-collapse-id'] = original.collapseId;
+    }
+    return new Promise((resolve) => {
+        const req = session.request(headers);
+        let settled = false;
+        const done = () => {
+            if (settled)
+                return;
+            settled = true;
+            resolve();
+        };
+        req.setTimeout(15_000, () => {
+            req.close();
+            emit('push', 'send_error', { did: original.did, error: 'APNs request timed out' });
+            done();
+        });
+        let status = 0;
+        let body = '';
+        req.on('response', (headers) => {
+            status = headers[':status'];
+        });
+        req.on('data', (chunk) => {
+            body += chunk.toString();
+        });
+        req.on('end', async () => {
+            if (settled)
+                return;
+            if (status === 200) {
+                emit('push', 'sent', { did: original.did, token: token.slice(0, 8) + '...' });
+            }
+            else if (status === 410) {
+                // Token is no longer valid — remove it
+                await removeToken(token).catch(() => { });
+                emit('push', 'token_removed', { did: original.did, reason: 'expired' });
+            }
+            else {
+                emit('push', 'send_error', {
+                    did: original.did,
+                    status,
+                    body: body.slice(0, 200),
+                });
+            }
+            done();
+        });
+        req.on('error', (err) => {
+            if (settled)
+                return;
+            emit('push', 'send_error', { did: original.did, error: err.message });
+            done();
+        });
+        req.write(payload);
+        req.end();
+    });
+}
+/**
+ * Mint an OAuth2 access token for the FCM HTTP v1 API.
+ *
+ * The service account signs a JWT asserting the messaging scope, and Google
+ * trades it for a bearer token good for an hour. Cached with a minute of
+ * headroom so one can't expire between minting and the send that uses it.
+ */
+async function getFcmAccessToken() {
+    if (cachedFcmToken && Date.now() < cachedFcmToken.expires)
+        return cachedFcmToken.token;
+    if (!fcmCredentials)
+        throw new Error('FCM not initialized');
+    const now = Math.floor(Date.now() / 1000);
+    const header = Buffer.from(JSON.stringify({ alg: 'RS256', typ: 'JWT' })).toString('base64url');
+    const claims = Buffer.from(JSON.stringify({
+        iss: fcmCredentials.clientEmail,
+        scope: FCM_SCOPE,
+        aud: fcmCredentials.tokenUri,
+        iat: now,
+        exp: now + 3600,
+    })).toString('base64url');
+    const signer = createSign('RSA-SHA256');
+    signer.update(`${header}.${claims}`);
+    const assertion = `${header}.${claims}.${signer.sign(fcmCredentials.privateKey, 'base64url')}`;
+    const res = await fetch(fcmCredentials.tokenUri, {
+        method: 'POST',
+        headers: { 'content-type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+            grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',
+            assertion,
+        }),
+        signal: AbortSignal.timeout(15_000),
+    });
+    if (!res.ok) {
+        const body = await res.text().catch(() => '');
+        throw new Error(`FCM token exchange failed: ${res.status} ${body.slice(0, 200)}`);
+    }
+    const granted = (await res.json());
+    if (!granted.access_token)
+        throw new Error('FCM token exchange returned no access_token');
+    cachedFcmToken = {
+        token: granted.access_token,
+        expires: Date.now() + ((granted.expires_in ?? 3600) - 60) * 1000,
+    };
+    return cachedFcmToken.token;
+}
+/** Send a single FCM push and handle the response. */
+async function sendToFcm(token, accessToken, original) {
+    // Data-only, deliberately: a `notification` block has the Android SDK draw
+    // the alert itself while the app is backgrounded, which skips the client's
+    // handler and with it the tap destination it derives from `type` and `uri`.
+    // FCM only carries strings in `data`, so everything is sent as one.
+    const data = { title: original.title, body: original.body };
+    for (const [key, value] of Object.entries(original.data ?? {})) {
+        data[key] = String(value);
+    }
+    const message = {
+        token,
+        data,
+        android: {
+            // Data-only messages are "normal" priority by default, which lets Doze
+            // hold one until the device next wakes. These are alerts somebody is
+            // waiting on, so they go high, the way APNs alert pushes do.
+            priority: 'HIGH',
+            ...(original.collapseId ? { collapse_key: original.collapseId } : {}),
+        },
+        // `badge` has no FCM equivalent — an Android launcher badges from the
+        // notification the client posts, not from the payload.
+    };
+    const res = await fetch(`https://fcm.googleapis.com/v1/projects/${fcmCredentials.projectId}/messages:send`, {
+        method: 'POST',
+        headers: {
+            authorization: `Bearer ${accessToken}`,
+            'content-type': 'application/json',
+        },
+        body: JSON.stringify({ message }),
+        signal: AbortSignal.timeout(15_000),
+    });
+    if (res.ok) {
+        emit('push', 'sent', { did: original.did, transport: 'fcm', token: token.slice(0, 8) + '...' });
+        return;
+    }
+    const body = await res.text().catch(() => '');
+    // Google's word for a token that no longer belongs to an install — the same
+    // fact Apple reports as a 410.
+    if (res.status === 404 || body.includes('UNREGISTERED')) {
+        await removeToken(token).catch(() => { });
+        emit('push', 'token_removed', { did: original.did, transport: 'fcm', reason: 'unregistered' });
+        return;
+    }
+    // The bearer token was refused: drop it so the next send mints a fresh one
+    // rather than replaying a credential Google has already rejected.
+    if (res.status === 401 || res.status === 403) {
+        cachedFcmToken = null;
+    }
+    emit('push', 'send_error', {
+        did: original.did,
+        transport: 'fcm',
+        status: res.status,
+        body: body.slice(0, 200),
+    });
+}
+/** Register a push token for a DID. Upserts on conflict. */
+export async function registerToken(did, token, platform) {
+    await runSQL(`INSERT INTO _push_tokens (did, token, platform, created_at)
+     VALUES ($1, $2, $3, $4)
+     ON CONFLICT (did, token) DO UPDATE SET platform = excluded.platform`, [did, token, platform, new Date().toISOString()]);
+}
+/** Remove a push token. */
+export async function removeToken(token) {
+    await runSQL(`DELETE FROM _push_tokens WHERE token = $1`, [token]);
+}
+/** Unregister a specific token for a DID. */
+export async function unregisterToken(did, token) {
+    await runSQL(`DELETE FROM _push_tokens WHERE did = $1 AND token = $2`, [did, token]);
+}

package/dist/renderer.d.ts

@@ -0,0 +1,27 @@
+export interface SSRManifest {
+    getPreloadTags(url: string): string;
+}
+export interface RenderResult {
+    html: string;
+    head?: string;
+}
+export type RendererHandler = (request: Request, manifest: SSRManifest) => Promise<RenderResult>;
+export declare function defineRenderer(handler: RendererHandler): {
+    __type: "renderer";
+    handler: RendererHandler;
+};
+export declare function registerRenderer(handler: RendererHandler): void;
+export declare function setSSRManifest(manifest: SSRManifest): void;
+export declare function getRenderer(): RendererHandler | null;
+export declare function getSSRManifest(): SSRManifest | null;
+/**
+ * Render an HTML page by calling the user's renderer and assembling the result
+ * into the index.html template.
+ *
+ * @param template - The index.html content (with <!--ssr-outlet--> placeholder)
+ * @param request - The incoming Request
+ * @param ogMeta - Optional OG meta tags to inject
+ * @returns Assembled HTML string, or null if no renderer is registered
+ */
+export declare function renderPage(template: string, request: Request, ogMeta?: string | null): Promise<string | null>;
+//# sourceMappingURL=renderer.d.ts.map

package/dist/renderer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"renderer.d.ts","sourceRoot":"","sources":["../src/renderer.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,WAAW;IAC1B,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CACpC;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;AAKhG,wBAAgB,cAAc,CAAC,OAAO,EAAE,eAAe;;;EAEtD;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,CAG/D;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,WAAW,GAAG,IAAI,CAE1D;AAED,wBAAgB,WAAW,IAAI,eAAe,GAAG,IAAI,CAEpD;AAED,wBAAgB,cAAc,IAAI,WAAW,GAAG,IAAI,CAEnD;AAED;;;;;;;;GAQG;AACH,wBAAsB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAsBnH"}

package/dist/renderer.js

@@ -0,0 +1,46 @@
+import { log } from "./logger.js";
+let renderer = null;
+let ssrManifest = null;
+export function defineRenderer(handler) {
+    return { __type: 'renderer', handler };
+}
+export function registerRenderer(handler) {
+    renderer = handler;
+    log('[renderer] SSR renderer registered');
+}
+export function setSSRManifest(manifest) {
+    ssrManifest = manifest;
+}
+export function getRenderer() {
+    return renderer;
+}
+export function getSSRManifest() {
+    return ssrManifest;
+}
+/**
+ * Render an HTML page by calling the user's renderer and assembling the result
+ * into the index.html template.
+ *
+ * @param template - The index.html content (with <!--ssr-outlet--> placeholder)
+ * @param request - The incoming Request
+ * @param ogMeta - Optional OG meta tags to inject
+ * @returns Assembled HTML string, or null if no renderer is registered
+ */
+export async function renderPage(template, request, ogMeta) {
+    if (!renderer)
+        return null;
+    const manifest = ssrManifest || { getPreloadTags: () => '' };
+    const result = await renderer(request, manifest);
+    let html = template;
+    // Inject SSR head tags (preloads, styles)
+    if (result.head) {
+        html = html.replace('</head>', `${result.head}\n</head>`);
+    }
+    // Inject OG meta tags
+    if (ogMeta) {
+        html = html.replace('</head>', `${ogMeta}\n</head>`);
+    }
+    // Inject rendered HTML into the outlet
+    html = html.replace('<!--ssr-outlet-->', result.html);
+    return html;
+}

package/dist/resolve-hatk.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Register a Node.js module resolve hook so dynamic import() of server files
+ * can resolve the $hatk alias to the generated entry points.
+ */
+export declare function registerHatkResolveHook(): void;
+//# sourceMappingURL=resolve-hatk.d.ts.map

package/dist/resolve-hatk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-hatk.d.ts","sourceRoot":"","sources":["../src/resolve-hatk.ts"],"names":[],"mappings":"AAIA;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,IAAI,CAU9C"}

package/dist/resolve-hatk.js

@@ -0,0 +1,20 @@
+import { resolve } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { registerHooks } from 'node:module';
+/**
+ * Register a Node.js module resolve hook so dynamic import() of server files
+ * can resolve the $hatk alias to the generated entry points.
+ */
+export function registerHatkResolveHook() {
+    const hatkUrl = pathToFileURL(resolve('hatk.generated.ts')).href;
+    const hatkClientUrl = pathToFileURL(resolve('hatk.generated.client.ts')).href;
+    registerHooks({
+        resolve(specifier, context, nextResolve) {
+            if (specifier === '$hatk/client')
+                return { url: hatkClientUrl, shortCircuit: true };
+            if (specifier === '$hatk')
+                return { url: hatkUrl, shortCircuit: true };
+            return nextResolve(specifier, context);
+        },
+    });
+}

package/dist/response.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Create a JSON Response with optional gzip compression.
+ * Mirrors the old jsonResponse/sendJson behavior.
+ */
+export declare function json(data: unknown, status?: number, acceptEncoding?: string | null): Response;
+/** Create a JSON error Response. */
+export declare function jsonError(status: number, message: string, acceptEncoding?: string | null): Response;
+/** CORS preflight Response. */
+export declare function cors(): Response;
+/** Add CORS headers to an existing Response. */
+export declare function withCors(response: Response): Response;
+/** Create a static file Response with correct MIME type. */
+export declare function file(content: Buffer | Uint8Array, contentType: string, cacheControl?: string): Response;
+/** 404 Not Found. */
+export declare function notFound(): Response;
+//# sourceMappingURL=response.d.ts.map

package/dist/response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"response.d.ts","sourceRoot":"","sources":["../src/response.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,wBAAgB,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,SAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,QAAQ,CAuB1F;AAED,oCAAoC;AACpC,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,QAAQ,CAEnG;AAED,+BAA+B;AAC/B,wBAAgB,IAAI,IAAI,QAAQ,CAS/B;AAED,gDAAgD;AAChD,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,QAAQ,CAUrD;AAED,4DAA4D;AAC5D,wBAAgB,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,QAAQ,CAQvG;AAED,qBAAqB;AACrB,wBAAgB,QAAQ,IAAI,QAAQ,CAEnC"}

package/dist/response.js

@@ -0,0 +1,69 @@
+import { gzipSync } from 'node:zlib';
+import { normalizeValue } from "./database/db.js";
+/**
+ * Create a JSON Response with optional gzip compression.
+ * Mirrors the old jsonResponse/sendJson behavior.
+ */
+export function json(data, status = 200, acceptEncoding) {
+    const body = Buffer.from(JSON.stringify(data, (_, v) => normalizeValue(v)));
+    if (body.length > 1024 && acceptEncoding && /\bgzip\b/.test(acceptEncoding)) {
+        const compressed = gzipSync(body);
+        return new Response(compressed, {
+            status,
+            headers: {
+                'Content-Type': 'application/json',
+                'Content-Encoding': 'gzip',
+                Vary: 'Accept-Encoding',
+                ...(status === 200 ? { 'Cache-Control': 'no-store' } : {}),
+            },
+        });
+    }
+    return new Response(body, {
+        status,
+        headers: {
+            'Content-Type': 'application/json',
+            ...(status === 200 ? { 'Cache-Control': 'no-store' } : {}),
+        },
+    });
+}
+/** Create a JSON error Response. */
+export function jsonError(status, message, acceptEncoding) {
+    return json({ error: message }, status, acceptEncoding);
+}
+/** CORS preflight Response. */
+export function cors() {
+    return new Response(null, {
+        status: 200,
+        headers: {
+            'Access-Control-Allow-Origin': '*',
+            'Access-Control-Allow-Headers': '*',
+            'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
+        },
+    });
+}
+/** Add CORS headers to an existing Response. */
+export function withCors(response) {
+    const headers = new Headers(response.headers);
+    headers.set('Access-Control-Allow-Origin', '*');
+    headers.set('Access-Control-Allow-Headers', '*');
+    headers.set('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
+    return new Response(response.body, {
+        status: response.status,
+        statusText: response.statusText,
+        headers,
+    });
+}
+/** Create a static file Response with correct MIME type. */
+export function file(content, contentType, cacheControl) {
+    return new Response(Buffer.from(content), {
+        status: 200,
+        headers: {
+            'Content-Type': contentType,
+            ...(cacheControl ? { 'Cache-Control': cacheControl } : {}),
+        },
+    });
+}
+/** 404 Not Found. */
+export function notFound() {
+    return new Response('Not Found', { status: 404 });
+}

package/dist/scanner.d.ts

@@ -0,0 +1,21 @@
+export interface ScannedModule {
+    path: string;
+    name: string;
+    mod: any;
+}
+export interface ScanResult {
+    feeds: ScannedModule[];
+    queries: ScannedModule[];
+    procedures: ScannedModule[];
+    hooks: ScannedModule[];
+    setup: ScannedModule[];
+    labels: ScannedModule[];
+    og: ScannedModule[];
+    renderer: ScannedModule | null;
+}
+/**
+ * Scan a directory for hatk server modules.
+ * Each file's default export is inspected for a `__type` tag.
+ */
+export declare function scanServerDir(serverDir: string): Promise<ScanResult>;
+//# sourceMappingURL=scanner.d.ts.map

package/dist/scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,GAAG,CAAA;CACT;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,aAAa,EAAE,CAAA;IACtB,OAAO,EAAE,aAAa,EAAE,CAAA;IACxB,UAAU,EAAE,aAAa,EAAE,CAAA;IAC3B,KAAK,EAAE,aAAa,EAAE,CAAA;IACtB,KAAK,EAAE,aAAa,EAAE,CAAA;IACtB,MAAM,EAAE,aAAa,EAAE,CAAA;IACvB,EAAE,EAAE,aAAa,EAAE,CAAA;IACnB,QAAQ,EAAE,aAAa,GAAG,IAAI,CAAA;CAC/B;AAmBD;;;GAGG;AACH,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA2D1E"}

package/dist/scanner.js

@@ -0,0 +1,88 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import { resolve, relative } from 'node:path';
+import { readdirSync, statSync, existsSync } from 'node:fs';
+import { log } from "./logger.js";
+/** Recursively collect .ts/.js files, skipping _ prefixed and dot files */
+function walkDir(dir) {
+    const results = [];
+    try {
+        for (const entry of readdirSync(dir)) {
+            if (entry.startsWith('_') || entry.startsWith('.'))
+                continue;
+            const full = resolve(dir, entry);
+            if (statSync(full).isDirectory()) {
+                results.push(...walkDir(full));
+            }
+            else if (entry.endsWith('.ts') || entry.endsWith('.js')) {
+                results.push(full);
+            }
+        }
+    }
+    catch { }
+    return results.sort();
+}
+/**
+ * Scan a directory for hatk server modules.
+ * Each file's default export is inspected for a `__type` tag.
+ */
+export async function scanServerDir(serverDir) {
+    const result = {
+        feeds: [],
+        queries: [],
+        procedures: [],
+        hooks: [],
+        setup: [],
+        labels: [],
+        og: [],
+        renderer: null,
+    };
+    if (!existsSync(serverDir))
+        return result;
+    const files = walkDir(serverDir);
+    for (const filePath of files) {
+        const name = relative(serverDir, filePath).replace(/\.(ts|js)$/, '');
+        const mod = await import(__rewriteRelativeImportExtension(/* @vite-ignore */ `${filePath}?t=${Date.now()}`));
+        const exported = mod.default;
+        if (!exported) {
+            log(`[scanner] ${name}: no default export, skipping`);
+            continue;
+        }
+        const entry = { path: filePath, name, mod: exported };
+        switch (exported.__type) {
+            case 'feed':
+                result.feeds.push(entry);
+                break;
+            case 'query':
+                result.queries.push(entry);
+                break;
+            case 'procedure':
+                result.procedures.push(entry);
+                break;
+            case 'hook':
+                result.hooks.push(entry);
+                break;
+            case 'setup':
+                result.setup.push(entry);
+                break;
+            case 'labels':
+                result.labels.push(entry);
+                break;
+            case 'og':
+                result.og.push(entry);
+                break;
+            case 'renderer':
+                result.renderer = entry;
+                break;
+            default:
+                log(`[scanner] ${name}: no recognized __type tag, skipping`);
+        }
+    }
+    return result;
+}