@hatk/hatk 0.0.1-alpha.83 → 0.0.1-alpha.85

package/dist/hooks.d.ts

@@ -65,6 +65,14 @@ export declare function defineHook(event: 'on-commit', options: {
 /**
  * Discover and load the on-login hook from the project's `hooks/` directory.
  * Looks for `on-login.ts` or `on-login.js`. Safe to call if no hook exists.
+ *
+ * The documented contract is `export default defineHook('on-login', handler)`,
+ * which is an object carrying the handler — the same shape the `server/`
+ * scanner recognizes by its `__type` tag. A bare async function is still
+ * accepted, because that is what the legacy `hooks/` directory used before
+ * `defineHook` existed. Anything else is reported rather than installed: a
+ * non-callable hook would otherwise fail silently on every login, since
+ * `fireOnLoginHook` swallows what the hook throws.
  */
 export declare function loadOnLoginHook(hooksDir: string): Promise<void>;
 /** Register a hook from a scanned server/ module. */

package/dist/hooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../src/hooks.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAK9C,OAAO,EAAoB,KAAK,WAAW,EAAE,MAAM,cAAc,CAAA;AACjE,OAAO,EAAqC,KAAK,aAAa,EAAE,MAAM,WAAW,CAAA;AAEjF,0EAA0E;AAC1E,MAAM,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG;IACjD,0CAA0C;IAC1C,GAAG,EAAE,MAAM,CAAA;IACX,gDAAgD;IAChD,EAAE,EAAE;QACF,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;QAC9D,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KACxD,CAAA;IACD,gEAAgE;IAChE,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1C,0DAA0D;IAC1D,YAAY,EAAE,CACZ,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,KACrB,OAAO,CAAC;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC5C,qEAAqE;IACrE,SAAS,EAAE,CACT,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,OAAO,CAAC;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC5C,2DAA2D;IAC3D,YAAY,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAClE,CAAA;AAED,mEAAmE;AACnE,MAAM,MAAM,WAAW,GAAG;IACxB,iDAAiD;IACjD,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAA;IAC3B,wCAAwC;IACxC,UAAU,EAAE,MAAM,CAAA;IAClB,2CAA2C;IAC3C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAA;IAClC,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAA;IACZ,4BAA4B;IAC5B,GAAG,EAAE,MAAM,CAAA;IACX,wCAAwC;IACxC,EAAE,EAAE;QACF,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;QAC9D,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KACxD,CAAA;IACD,iDAAiD;IACjD,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAA;IAC7B,kCAAkC;IAClC,IAAI,EAAE,aAAa,CAAA;CACpB,CAAA;AAQD,wBAAgB,UAAU,CACxB,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,CAAC,GAAG,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,GAC1C;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,CAAC,GAAG,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAA;AACrF,wBAAgB,UAAU,CACxB,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE;IAAE,WAAW,EAAE,MAAM,EAAE,CAAA;CAAE,EAClC,OAAO,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,GAC3C;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,WAAW,CAAC;IAAC,WAAW,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAA;AAkB9G;;;GAGG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQrE;AASD,qDAAqD;AACrD,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,GAAG,GAAG,IAAI,CASlF;AAED,iFAAiF;AACjF,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BjG;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,KAAK,CAAC;IACX,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAA;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAA;CACnC,CAAC,GACD,IAAI,CA6BN"}
+{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../src/hooks.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAK9C,OAAO,EAAoB,KAAK,WAAW,EAAE,MAAM,cAAc,CAAA;AACjE,OAAO,EAAqC,KAAK,aAAa,EAAE,MAAM,WAAW,CAAA;AAEjF,0EAA0E;AAC1E,MAAM,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG;IACjD,0CAA0C;IAC1C,GAAG,EAAE,MAAM,CAAA;IACX,gDAAgD;IAChD,EAAE,EAAE;QACF,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;QAC9D,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KACxD,CAAA;IACD,gEAAgE;IAChE,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1C,0DAA0D;IAC1D,YAAY,EAAE,CACZ,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,KACrB,OAAO,CAAC;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC5C,qEAAqE;IACrE,SAAS,EAAE,CACT,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,OAAO,CAAC;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC5C,2DAA2D;IAC3D,YAAY,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAClE,CAAA;AAED,mEAAmE;AACnE,MAAM,MAAM,WAAW,GAAG;IACxB,iDAAiD;IACjD,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAA;IAC3B,wCAAwC;IACxC,UAAU,EAAE,MAAM,CAAA;IAClB,2CAA2C;IAC3C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAA;IAClC,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAA;IACZ,4BAA4B;IAC5B,GAAG,EAAE,MAAM,CAAA;IACX,wCAAwC;IACxC,EAAE,EAAE;QACF,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;QAC9D,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KACxD,CAAA;IACD,iDAAiD;IACjD,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAA;IAC7B,kCAAkC;IAClC,IAAI,EAAE,aAAa,CAAA;CACpB,CAAA;AAQD,wBAAgB,UAAU,CACxB,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,CAAC,GAAG,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,GAC1C;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,CAAC,GAAG,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAA;AACrF,wBAAgB,UAAU,CACxB,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE;IAAE,WAAW,EAAE,MAAM,EAAE,CAAA;CAAE,EAClC,OAAO,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,GAC3C;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,WAAW,CAAC;IAAC,WAAW,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAA;AAkB9G;;;;;;;;;;;GAWG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBrE;AAgBD,qDAAqD;AACrD,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,GAAG,GAAG,IAAI,CASlF;AAED,iFAAiF;AACjF,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BjG;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,KAAK,CAAC;IACX,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAA;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAA;CACnC,CAAC,GACD,IAAI,CA6BN"}

package/dist/hooks.js

@@ -63,6 +63,14 @@ const onCommitHooks = [];
 /**
  * Discover and load the on-login hook from the project's `hooks/` directory.
  * Looks for `on-login.ts` or `on-login.js`. Safe to call if no hook exists.
+ *
+ * The documented contract is `export default defineHook('on-login', handler)`,
+ * which is an object carrying the handler — the same shape the `server/`
+ * scanner recognizes by its `__type` tag. A bare async function is still
+ * accepted, because that is what the legacy `hooks/` directory used before
+ * `defineHook` existed. Anything else is reported rather than installed: a
+ * non-callable hook would otherwise fail silently on every login, since
+ * `fireOnLoginHook` swallows what the hook throws.
  */
 export async function loadOnLoginHook(hooksDir) {
     const tsPath = resolve(hooksDir, 'on-login.ts');
@@ -71,9 +79,24 @@ export async function loadOnLoginHook(hooksDir) {
     if (!path)
         return;
     const mod = await import(__rewriteRelativeImportExtension(/* @vite-ignore */ `${path}?t=${Date.now()}`));
-    onLoginHook = mod.default;
+    const handler = resolveHookHandler(mod.default);
+    if (!handler) {
+        emit('hooks', 'on_login_load_error', {
+            path,
+            error: 'default export is not a function or a defineHook("on-login", ...) result',
+        });
+        return;
+    }
+    onLoginHook = handler;
     log('[hooks] on-login hook loaded');
 }
+/** Unwrap a hook module's default export into the callable handler, if it has one. */
+function resolveHookHandler(exported) {
+    if (typeof exported === 'function')
+        return exported;
+    const handler = exported?.handler;
+    return typeof handler === 'function' ? handler : null;
+}
 /** Mark a DID as pending, trigger auto-backfill, and wait for completion. */
 async function ensureRepo(did) {
     await setRepoStatus(did, 'pending');

package/dist/indexer.d.ts

@@ -33,9 +33,10 @@ export declare function resumeCursor(liveSeq: number | null, bootCursor: string
 /** Reset module cursor state between tests. */
 export declare function _resetCursorStateForTests(): void;
 /**
- * Drain the write buffer synchronously instead of waiting out
- * FLUSH_INTERVAL_MS. Lets end-to-end tests assert on rows immediately after
- * feeding a frame.
+ * Drain the write buffer instead of waiting out FLUSH_INTERVAL_MS. Lets
+ * end-to-end tests assert on rows immediately after feeding a frame — deletes
+ * included, since they are buffered alongside puts and so are covered by the
+ * same await.
  */
 export declare function _flushForTests(): Promise<void>;
 /**

package/dist/indexer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"indexer.d.ts","sourceRoot":"","sources":["../src/indexer.ts"],"names":[],"mappings":"AA8BA,iFAAiF;AACjF,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAA;IACtC,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,yBAAyB;IACzB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,yBAAyB;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAC7B;AA0JD,6GAA6G;AAC7G,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAEzC;AAED,6EAA6E;AAC7E,wBAAgB,UAAU,IAAI,MAAM,GAAG,IAAI,CAE1C;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAStD;AAED,uFAAuF;AACvF,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,WAAW,GAAG,IAAI,CAE7D;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAErH;AAED,+CAA+C;AAC/C,wBAAgB,yBAAyB,IAAI,IAAI,CAIhD;AAED;;;;GAIG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAMpD;AAED;;;;;;;GAOG;AACH,iEAAiE;AACjE,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGxD;AAED,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,SAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CA8EjF;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IACxB,iBAAiB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAC/B,WAAW,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IACzB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED,oDAAoD;AACpD,UAAU,WAAY,SAAQ,eAAe;IAC3C,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACvB;AAyBD;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CA6B3E;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CAkCxE;AAED,6EAA6E;AAC7E,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IACxB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACvB;AAED,wEAAwE;AACxE,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,cAAc,GAAG,SAAS,CAgD/D;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CA4CvG;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,OAAO,CAE3F;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,IAAI,CAwE9D;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,UAAU,EACjB,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,EACxB,KAAK,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAc,GACrC,IAAI,CAoDN"}
+{"version":3,"file":"indexer.d.ts","sourceRoot":"","sources":["../src/indexer.ts"],"names":[],"mappings":"AA2CA,iFAAiF;AACjF,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAA;IACtC,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,yBAAyB;IACzB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,yBAAyB;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAC7B;AAgMD,6GAA6G;AAC7G,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAEzC;AAED,6EAA6E;AAC7E,wBAAgB,UAAU,IAAI,MAAM,GAAG,IAAI,CAE1C;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAStD;AAED,uFAAuF;AACvF,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,WAAW,GAAG,IAAI,CAE7D;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAErH;AAED,+CAA+C;AAC/C,wBAAgB,yBAAyB,IAAI,IAAI,CAIhD;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAMpD;AAED;;;;;;;GAOG;AACH,iEAAiE;AACjE,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGxD;AAED,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,SAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAoFjF;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IACxB,iBAAiB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAC/B,WAAW,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IACzB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED,oDAAoD;AACpD,UAAU,WAAY,SAAQ,eAAe;IAC3C,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACvB;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CA2B3E;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CAkCxE;AAED,6EAA6E;AAC7E,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IACxB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACvB;AAED,wEAAwE;AACxE,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,cAAc,GAAG,SAAS,CAgD/D;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CA4CvG;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,OAAO,CAE3F;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,IAAI,CAkE9D;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,UAAU,EACjB,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,EACxB,KAAK,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAc,GACrC,IAAI,CAoDN"}

package/dist/indexer.js

@@ -45,9 +45,10 @@ let indexerMaxRetries;
 let indexerPlcUrl;
 let maxConcurrentBackfills = 3;
 /**
- * Flush the write buffer — insert all buffered records, update the relay cursor,
- * run label rules on inserted records, and trigger FTS rebuilds when the write
- * threshold is reached. Emits a wide event with batch stats.
+ * Flush the write buffer — apply all buffered puts and deletes in arrival
+ * order, update the relay cursor, run label rules on inserted records, and
+ * trigger FTS rebuilds when the write threshold is reached. Emits a wide event
+ * with batch stats.
  */
 async function flushBuffer() {
     if (buffer.length === 0)
@@ -55,14 +56,38 @@ async function flushBuffer() {
     const elapsed = timer();
     const batch = buffer.splice(0);
     let insertedCount = 0;
+    let deletedCount = 0;
     const errors = [];
     let cursorError;
     const inserted = [];
+    const applied = [];
+    // Strictly sequential: two writes to the same URI in one batch must land in
+    // the order they arrived, so nothing here may run concurrently.
     for (const item of batch) {
         try {
-            await insertRecord(item.collection, item.uri, item.cid, item.authorDid, item.record);
-            insertedCount++;
-            inserted.push(item);
+            if (item.action === 'delete') {
+                await deleteRecord(item.collection, item.uri);
+                deletedCount++;
+                applied.push({
+                    action: 'delete',
+                    collection: item.collection,
+                    uri: item.uri,
+                    authorDid: item.authorDid,
+                    record: null,
+                });
+            }
+            else {
+                await insertRecord(item.collection, item.uri, item.cid, item.authorDid, item.record);
+                insertedCount++;
+                inserted.push(item);
+                applied.push({
+                    action: 'create',
+                    collection: item.collection,
+                    uri: item.uri,
+                    authorDid: item.authorDid,
+                    record: item.record,
+                });
+            }
         }
         catch (err) {
             errors.push(err.message);
@@ -88,14 +113,9 @@ async function flushBuffer() {
             value: item.record,
         }).catch(() => { });
     }
-    // Fire on-commit hooks for inserted records (async, non-blocking)
-    fireOnCommitHooks(inserted.map((item) => ({
-        action: 'create',
-        collection: item.collection,
-        uri: item.uri,
-        authorDid: item.authorDid,
-        record: item.record,
-    })));
+    // Fire on-commit hooks for everything the batch applied, in the order it was
+    // applied (async, non-blocking)
+    fireOnCommitHooks(applied);
     // Aggregate collection counts and unique DIDs for wide event
     const collections = {};
     const dids = new Set();
@@ -106,6 +126,7 @@ async function flushBuffer() {
     emit('indexer', 'flush', {
         batch_size: batch.length,
         inserted_count: insertedCount,
+        deleted_count: deletedCount,
         error_count: errors.length,
         cursor_seq: lastSeq,
         duration_ms: elapsed(),
@@ -125,16 +146,32 @@ async function flushBuffer() {
         }
     }
 }
+/**
+ * Run a flush once every flush already queued has finished.
+ *
+ * Nothing awaits the flush a full batch triggers, and the interval timer can
+ * fire while that flush is still waiting on the database. Two flushes in flight
+ * hold disjoint batches but interleave their awaits, so a write in the later
+ * batch can reach the database before one in the earlier batch — which would
+ * give back exactly the cross-batch reordering the single buffer removes.
+ * Chaining them costs nothing on an idle indexer and keeps the queue global.
+ */
+let flushChain = Promise.resolve();
+function enqueueFlush() {
+    const next = flushChain.then(() => flushBuffer(), () => flushBuffer());
+    flushChain = next;
+    return next;
+}
 /** Schedule a flush after FLUSH_INTERVAL_MS if one isn't already pending. */
 function scheduleFlush() {
     if (flushTimer)
         return;
-    flushTimer = setTimeout(async () => {
+    flushTimer = setTimeout(() => {
         flushTimer = null;
-        await flushBuffer();
+        void enqueueFlush().catch(() => { });
     }, FLUSH_INTERVAL_MS);
 }
-/** Add a record to the write buffer. Flushes immediately if BATCH_SIZE is reached. */
+/** Add a write to the buffer. Flushes immediately if BATCH_SIZE is reached. */
 function bufferWrite(item) {
     buffer.push(item);
     if (buffer.length >= BATCH_SIZE) {
@@ -142,7 +179,7 @@ function bufferWrite(item) {
             clearTimeout(flushTimer);
             flushTimer = null;
         }
-        flushBuffer();
+        void enqueueFlush().catch(() => { });
     }
     else {
         scheduleFlush();
@@ -196,16 +233,17 @@ export function _resetCursorStateForTests() {
     cursorKey = 'relay';
 }
 /**
- * Drain the write buffer synchronously instead of waiting out
- * FLUSH_INTERVAL_MS. Lets end-to-end tests assert on rows immediately after
- * feeding a frame.
+ * Drain the write buffer instead of waiting out FLUSH_INTERVAL_MS. Lets
+ * end-to-end tests assert on rows immediately after feeding a frame — deletes
+ * included, since they are buffered alongside puts and so are covered by the
+ * same await.
  */
 export async function _flushForTests() {
     if (flushTimer) {
         clearTimeout(flushTimer);
         flushTimer = null;
     }
-    await flushBuffer();
+    await enqueueFlush();
 }
 /**
  * Auto-backfill a DID's repo when first seen on the firehose.
@@ -262,7 +300,14 @@ export async function triggerAutoBackfill(did, attempt = 0) {
     backfillInFlight.delete(did);
     for (const item of buffered) {
         try {
-            await insertRecord(item.collection, item.uri, item.cid, item.authorDid, item.record);
+            if (item.action === 'delete') {
+                // A delete that arrived mid-backfill has to be replayed after the CAR
+                // export lands, or the export's snapshot of the record outlives it.
+                await deleteRecord(item.collection, item.uri);
+            }
+            else {
+                await insertRecord(item.collection, item.uri, item.cid, item.authorDid, item.record);
+            }
         }
         catch {
             replayErrors++;
@@ -295,28 +340,6 @@ export async function triggerAutoBackfill(did, attempt = 0) {
         }, delayMs);
     }
 }
-/** Emit a memory diagnostics wide event every 30s for observability. */
-function startMemoryDiagnostics() {
-    setInterval(() => {
-        const mem = process.memoryUsage();
-        let pendingBufferItems = 0;
-        for (const [, items] of pendingBuffers) {
-            pendingBufferItems += items.length;
-        }
-        emit('diagnostics', 'memory', {
-            heap_used_mb: Math.round(mem.heapUsed / 1024 / 1024),
-            heap_total_mb: Math.round(mem.heapTotal / 1024 / 1024),
-            rss_mb: Math.round(mem.rss / 1024 / 1024),
-            external_mb: Math.round(mem.external / 1024 / 1024),
-            array_buffers_mb: Math.round(mem.arrayBuffers / 1024 / 1024),
-            write_buffer_len: buffer.length,
-            pending_buffer_dids: pendingBuffers.size,
-            pending_buffer_items: pendingBufferItems,
-            backfill_in_flight: backfillInFlight.size,
-            repo_status_cache_size: repoStatusCache.size,
-        });
-    }, 30_000);
-}
 /**
  * Connect to the AT Protocol relay firehose and begin indexing.
  *
@@ -346,7 +369,6 @@ export async function configureIndexer(opts) {
         }
         log(`[indexer] Warmed repo status cache with ${statuses.length} entries`);
     }
-    // startMemoryDiagnostics()
     // Checkpoint the cursor on a timer regardless of write activity (see
     // checkpointCursor). Guarded so reconnects don't stack intervals; unref'd so
     // it never keeps the process alive.
@@ -558,19 +580,21 @@ export function applyCommit(did, ops) {
     // For non-signal ops (e.g. profile updates), only process if this DID is already tracked
     if (!hasSignalOp && repoStatus === null)
         return;
+    /** Queue a write behind anything already queued for this DID. */
+    const enqueue = (item) => {
+        // If DID is mid-backfill, buffer instead of writing directly
+        if (pendingBuffers.has(did))
+            pendingBuffers.get(did).push(item);
+        else
+            bufferWrite(item);
+    };
     for (const op of ops) {
         const uri = `at://${did}/${op.collection}/${op.rkey}`;
         if (op.action === 'delete') {
-            deleteRecord(op.collection, uri);
-            fireOnCommitHooks([
-                {
-                    action: 'delete',
-                    collection: op.collection,
-                    uri,
-                    authorDid: did,
-                    record: null,
-                },
-            ]);
+            // Buffered, not applied here: see {@link WriteBuffer}. The on-commit hook
+            // fires from the flush too, so a handler never sees a delete announced
+            // before the row is actually gone.
+            enqueue({ action: 'delete', collection: op.collection, uri, authorDid: did });
             continue;
         }
         const record = op.record;
@@ -588,14 +612,7 @@ export function applyCommit(did, ops) {
             });
             continue;
         }
-        const item = { collection: op.collection, uri, cid: op.cid, authorDid: did, record };
-        // If DID is mid-backfill, buffer instead of writing directly
-        if (pendingBuffers.has(did)) {
-            pendingBuffers.get(did).push(item);
-        }
-        else {
-            bufferWrite(item);
-        }
+        enqueue({ action: 'put', collection: op.collection, uri, cid: op.cid, authorDid: did, record });
     }
 }
 /**

package/dist/oauth/service-describe.d.ts

@@ -2,20 +2,31 @@
  * What a PDS says it serves, and the scopes worth asking it for.
  *
  * `community.lexicon.service.describe` answers with a service's roles and every
- * XRPC method it routes. It is the only way to ask: atproto publishes no method
- * list, so the alternative is to call a method and read the failure, where a
- * server without an optional feature and one that is broken look alike.
+ * XRPC method it routes. It is the direct question and the answer to trust when
+ * it comes — but it is still a proposal, and implementations exist that serve
+ * the features while serving no describe. The reference spaces build of
+ * `@atproto/pds` is one: it routes every space method and does not contain the
+ * describe NSID at all. Reading its silence as "no optional features" denies it
+ * scopes it could honor.
+ *
+ * So when describe says nothing, the methods a caller actually cares about are
+ * probed directly. Calling one and reading the failure cannot tell a missing
+ * feature from a broken server *on its own* — but it can against a control: ask
+ * for an NSID that certainly does not exist, learn how this server says "no such
+ * method", and a different answer for a real method is evidence it has one.
  *
  * Used before pushing an authorization request, so a PDS is asked for a
  * feature's scopes only when it implements the feature.
  */
 import type { OAuthConfig } from '../config.ts';
 /**
- * Every XRPC method a PDS serves. An empty set for a server that answers no
- * describe — which is every PDS that predates the method, so absence has to
- * read as "no optional features" rather than as an error.
+ * Every XRPC method a PDS serves, as far as it can be established.
+ *
+ * `candidates` are the methods the caller needs an answer about. They are only
+ * used when describe says nothing — an explicit list is always preferred to
+ * inference, and a server that answers describe is taken at its word.
  */
-export declare function describeMethods(pdsEndpoint: string): Promise<Set<string>>;
+export declare function describeMethods(pdsEndpoint: string, candidates?: string[]): Promise<Set<string>>;
 /**
  * The scope string to request from this PDS: `base`, plus any conditional set
  * whose `whenMethod` the server serves.

package/dist/oauth/service-describe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-describe.d.ts","sourceRoot":"","sources":["../../src/oauth/service-describe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAU/C;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAwB/E;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,UAAU,EAAE,OAAO,GAClB,OAAO,CAAC,MAAM,CAAC,CAUjB;AAED,+CAA+C;AAC/C,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC"}
+{"version":3,"file":"service-describe.d.ts","sourceRoot":"","sources":["../../src/oauth/service-describe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAkD/C;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,GAAE,MAAM,EAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CA+B1G;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,UAAU,EAAE,OAAO,GAClB,OAAO,CAAC,MAAM,CAAC,CAajB;AAED,+CAA+C;AAC/C,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC"}

package/dist/oauth/service-describe.js

@@ -4,12 +4,53 @@ const PROBE_TIMEOUT_MS = 5000;
 const CACHE_TTL_MS = 60 * 60 * 1000;
 /** Answers are a property of the server, so one entry covers every account on it. */
 const cache = new Map();
+/** An NSID no server routes, for learning how one says "no such method". */
+const CONTROL_NSID = 'dev.hatk.unspecced.methodThatDoesNotExist';
+/** How a server answered, as a comparable string: status and error code. */
+async function signature(pdsEndpoint, nsid) {
+    try {
+        const res = await fetch(`${pdsEndpoint.replace(/\/$/, '')}/xrpc/${nsid}`, {
+            headers: { accept: 'application/json' },
+            signal: AbortSignal.timeout(PROBE_TIMEOUT_MS),
+        });
+        const body = (await res.json().catch(() => null));
+        return `${res.status}:${body?.error ?? ''}`;
+    }
+    catch {
+        return null;
+    }
+}
 /**
- * Every XRPC method a PDS serves. An empty set for a server that answers no
- * describe — which is every PDS that predates the method, so absence has to
- * read as "no optional features" rather than as an error.
+ * Which of `candidates` this server appears to route, judged against how it
+ * answers for a method that does not exist.
+ *
+ * Conservative by construction. A server that answers identically either way —
+ * bsky.social returns `401 AuthMissing` for both — yields nothing, so a feature
+ * it does not have is never claimed. The cost is failing to see support that
+ * cannot be distinguished, which is where this started anyway.
  */
-export async function describeMethods(pdsEndpoint) {
+async function probeMethods(pdsEndpoint, candidates) {
+    const control = await signature(pdsEndpoint, CONTROL_NSID);
+    // Unreachable is not evidence about the server, so claim nothing.
+    if (control === null)
+        return new Set();
+    const answers = await Promise.all(candidates.map((n) => signature(pdsEndpoint, n)));
+    const found = new Set();
+    candidates.forEach((nsid, i) => {
+        const a = answers[i];
+        if (a !== null && a !== control)
+            found.add(nsid);
+    });
+    return found;
+}
+/**
+ * Every XRPC method a PDS serves, as far as it can be established.
+ *
+ * `candidates` are the methods the caller needs an answer about. They are only
+ * used when describe says nothing — an explicit list is always preferred to
+ * inference, and a server that answers describe is taken at its word.
+ */
+export async function describeMethods(pdsEndpoint, candidates = []) {
     const cached = cache.get(pdsEndpoint);
     if (cached && cached.expires > Date.now())
         return cached.methods;
@@ -32,6 +73,12 @@ export async function describeMethods(pdsEndpoint) {
     catch {
         methods = new Set();
     }
+    // No describe, or one that listed nothing: fall back to asking about the
+    // methods this caller actually needs. Only those — a probe per method is a
+    // request per method, and the conditional sets name two.
+    if (methods.size === 0 && candidates.length > 0) {
+        methods = await probeMethods(pdsEndpoint, candidates);
+    }
     cache.set(pdsEndpoint, { methods, expires: Date.now() + CACHE_TTL_MS });
     return methods;
 }
@@ -48,7 +95,7 @@ export async function negotiateScope(config, base, pdsEndpoint, isLoopback) {
     const conditional = config.conditionalScopes ?? [];
     if (conditional.length === 0 || !pdsEndpoint || isLoopback)
         return base;
-    const methods = await describeMethods(pdsEndpoint);
+    const methods = await describeMethods(pdsEndpoint, conditional.map((c) => c.whenMethod));
     const granted = conditional.filter((c) => methods.has(c.whenMethod)).flatMap((c) => c.scopes);
     if (granted.length === 0)
         return base;

package/dist/opengraph.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"opengraph.d.ts","sourceRoot":"","sources":["../src/opengraph.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAE5C,4CAA4C;AAC5C,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAC3B,QAAQ,CAAC,EAAE,CAAC,UAAU,GAAG,MAAM,CAAC,EAAE,GAAG,MAAM,CAAA;QAC3C,GAAG,CAAC,EAAE,MAAM,CAAA;QACZ,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KACnB,CAAA;CACF;AAED,uDAAuD;AACvD,MAAM,WAAW,gBAAiB,SAAQ,WAAW;IACnD,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;CACpD;AAED,qDAAqD;AACrD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,UAAU,CAAA;IACnB,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAA;KAAE,CAAA;IAC5D,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAChD;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,OAAO,CAAC,eAAe,CAAC;;;oBAA7C,gBAAgB,KAAK,OAAO,CAAC,eAAe,CAAC;EAEnG;AAkCD,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA0EhE;AAED,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,OAAO,CAAC,eAAe,CAAC,CAAA;CAC9D,GAAG,IAAI,CAsDP;AAED,wBAAsB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA+BrF;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAyC3E"}
+{"version":3,"file":"opengraph.d.ts","sourceRoot":"","sources":["../src/opengraph.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAE5C,4CAA4C;AAC5C,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAC3B,QAAQ,CAAC,EAAE,CAAC,UAAU,GAAG,MAAM,CAAC,EAAE,GAAG,MAAM,CAAA;QAC3C,GAAG,CAAC,EAAE,MAAM,CAAA;QACZ,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KACnB,CAAA;CACF;AAED,uDAAuD;AACvD,MAAM,WAAW,gBAAiB,SAAQ,WAAW;IACnD,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;CACpD;AAED,qDAAqD;AACrD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,UAAU,CAAA;IACnB,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAA;KAAE,CAAA;IAC5D,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAChD;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,OAAO,CAAC,eAAe,CAAC;;;oBAA7C,gBAAgB,KAAK,OAAO,CAAC,eAAe,CAAC;EAEnG;AAiDD,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAyEhE;AAED,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,OAAO,CAAC,eAAe,CAAC,CAAA;CAC9D,GAAG,IAAI,CAqDP;AAED,wBAAsB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA+BrF;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAyC3E"}

package/dist/opengraph.js

@@ -32,6 +32,20 @@ let defaultFont = null;
 const cache = new Map();
 const CACHE_TTL = 5 * 60 * 1000;
 const CACHE_MAX = 200;
+/**
+ * Read a font file as an ArrayBuffer holding *only* that font's bytes.
+ *
+ * `readFileSync` returns a Buffer that, for small files, is a view into Node's
+ * shared 64 KB allocation pool — so `buffer.buffer` is the whole pool, not the
+ * font, and the font generally starts at a nonzero `byteOffset`. Handing that
+ * to satori makes it read whatever happened to be pooled before the font and
+ * reject the result with "Unsupported OpenType signature". Slice out the
+ * view's own range instead.
+ */
+function readFontData(fontPath) {
+    const fontData = readFileSync(fontPath);
+    return fontData.buffer.slice(fontData.byteOffset, fontData.byteOffset + fontData.byteLength);
+}
 function compilePath(path) {
     const paramNames = [];
     const re = path.replace(/:([^/]+)/g, (_, name) => {
@@ -44,8 +58,7 @@ export async function initOpengraph(ogDir) {
     // Load default font
     try {
         const fontPath = resolve(import.meta.dirname, '..', 'fonts', 'Inter-Regular.woff');
-        const fontData = readFileSync(fontPath);
-        defaultFont = { name: 'Inter', data: fontData.buffer, weight: 400, style: 'normal' };
+        defaultFont = { name: 'Inter', data: readFontData(fontPath), weight: 400, style: 'normal' };
         log('[opengraph] loaded default font: Inter');
     }
     catch {
@@ -121,8 +134,7 @@ export function registerOgHandler(ogMod) {
     if (!defaultFont) {
         try {
             const fontPath = resolve(import.meta.dirname, '..', 'fonts', 'Inter-Regular.woff');
-            const fontData = readFileSync(fontPath);
-            defaultFont = { name: 'Inter', data: fontData.buffer, weight: 400, style: 'normal' };
+            defaultFont = { name: 'Inter', data: readFontData(fontPath), weight: 400, style: 'normal' };
         }
         catch { }
     }

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAsEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AA4B9C;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,GAAG,IAAI,CAqM3F;AAgDD,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,KAAK,EAAE,WAAW,GAAG,IAAI,CAAA;IACzB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACxF,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;IAC5D,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAA;CACtB;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CA2iC5F;AAGD,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EAAE,EACrB,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,KAAK,EAAE,WAAW,GAAG,IAAI,EACzB,MAAM,GAAE,MAAM,EAAO,EACrB,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAC5D,QAAQ,CAAC,EAAE,MAAM,IAAI,GACpB,OAAO,WAAW,EAAE,MAAM,CAG5B"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAsEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAyD9C;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,GAAG,IAAI,CAuM3F;AAgDD,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,KAAK,EAAE,WAAW,GAAG,IAAI,CAAA;IACzB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACxF,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;IAC5D,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAA;CACtB;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAwkC5F;AAGD,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EAAE,EACrB,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,KAAK,EAAE,WAAW,GAAG,IAAI,EACzB,MAAM,GAAE,MAAM,EAAO,EACrB,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAC5D,QAAQ,CAAC,EAAE,MAAM,IAAI,GACpB,OAAO,WAAW,EAAE,MAAM,CAG5B"}

package/dist/server.js

@@ -20,6 +20,36 @@ import { json, jsonError, cors, withCors, file, notFound } from "./response.js";
 import { collectionFromUri, isPrivateCollection } from "./private-collections.js";
 import { serve } from "./adapter.js";
 import { renderPage } from "./renderer.js";
+/**
+ * Parse a client-supplied `limit`, or null if it is not a usable one.
+ *
+ * `parseInt` alone lets `limit=abc` through as NaN and `limit=-5` through as a
+ * negative bound, both of which reach the database driver: the first as a
+ * datatype error, the second as "no limit at all" on SQLite. Neither is a
+ * server fault, so the caller turns a null into a 400.
+ */
+function parseLimit(raw, fallback) {
+    if (raw === null || raw === '')
+        return fallback;
+    if (!/^\d+$/.test(raw))
+        return null;
+    const value = Number(raw);
+    return value >= 1 ? value : null;
+}
+/** Whether `sort` names a column queryRecords can order this collection by. */
+function isSortableField(collection, sort) {
+    if (sort === 'indexed_at')
+        return true;
+    const schema = getSchema(collection);
+    return !!schema?.columns.some((c) => c.originalName === sort || c.name === sort);
+}
+/** Narrow a client-supplied `order` to the two values that may reach ORDER BY. */
+function parseOrder(raw) {
+    if (!raw)
+        return undefined;
+    const lowered = raw.toLowerCase();
+    return lowered === 'asc' || lowered === 'desc' ? lowered : null;
+}
 function scopeMissingResponse(acceptEncoding, handle) {
     const res = withCors(json({ error: 'ScopeMissingError', ...(handle ? { handle } : {}) }, 401, acceptEncoding));
     res.headers.append('Set-Cookie', clearSessionCookieHeader());
@@ -45,7 +75,11 @@ export function registerCoreHandlers(collections, oauth) {
         if (!getSchema(collection))
             throw new NotFoundError(`Unknown collection: ${collection}`);
         const sort = params.sort || undefined;
-        const order = (params.order || undefined);
+        if (sort && !isSortableField(collection, sort))
+            throw new InvalidRequestError(`Invalid sort field: ${sort}`);
+        const order = parseOrder(params.order);
+        if (order === null)
+            throw new InvalidRequestError(`Invalid order: ${params.order}`);
         const reserved = new Set(['collection', 'limit', 'cursor', 'sort', 'order']);
         const filters = {};
         for (const [key, value] of Object.entries(params)) {
@@ -358,11 +392,23 @@ export function createHandler(config) {
                     return withCors(jsonError(404, `Unknown collection: ${collection}`, acceptEncoding));
                 if (!getSchema(collection))
                     return withCors(jsonError(404, `Unknown collection: ${collection}`, acceptEncoding));
-                const limit = parseInt(url.searchParams.get('limit') || '20');
+                // Every one of these is attacker-controlled, and queryRecords trusts
+                // what it is handed: `sort` and `order` reach the ORDER BY clause and a
+                // non-numeric `limit` reaches the driver. Rejecting them here keeps a
+                // bad query string a 400 instead of a 500 (or worse).
+                const limit = parseLimit(url.searchParams.get('limit'), 20);
+                if (limit === null)
+                    return withCors(jsonError(400, 'Invalid limit parameter', acceptEncoding));
                 const cursor = url.searchParams.get('cursor') || undefined;
                 const sort = url.searchParams.get('sort') || undefined;
-                const order = (url.searchParams.get('order') || undefined);
-                // Collect field filters (everything except reserved params)
+                const order = parseOrder(url.searchParams.get('order'));
+                if (order === null)
+                    return withCors(jsonError(400, `Invalid order: ${url.searchParams.get('order')}`, acceptEncoding));
+                if (sort && !isSortableField(collection, sort))
+                    return withCors(jsonError(400, `Invalid sort field: ${sort}`, acceptEncoding));
+                // Collect field filters (everything except reserved params). An
+                // unknown field is ignored rather than rejected — queryRecords does
+                // the same, and clients rely on passing through extra params.
                 const reserved = new Set(['collection', 'limit', 'cursor', 'sort', 'order']);
                 const filters = {};
                 for (const [key, value] of url.searchParams) {
@@ -920,7 +966,24 @@ export function createHandler(config) {
                     }
                     if (!code)
                         return withCors(jsonError(400, 'Missing code', acceptEncoding));
-                    const result = await handleCallback(oauth, code, state, iss);
+                    let result;
+                    try {
+                        result = await handleCallback(oauth, code, state, iss);
+                    }
+                    catch (err) {
+                        // Same convention as the token endpoint below: an error that names
+                        // its own status keeps it, anything else is a genuine failure and
+                        // falls through to the 500.
+                        if (err instanceof OAuthError)
+                            return withCors(json({ error: err.code, error_description: err.description }, err.status, acceptEncoding));
+                        // A callback matching no pending authorization request is a stale
+                        // redirect, not a server fault — the request expired while a login
+                        // tab sat open, or the user came back to a login they already
+                        // finished. Answer like the other client errors on this route.
+                        if (err instanceof Error && err.message === 'No matching authorization request found')
+                            return withCors(jsonError(400, err.message, acceptEncoding));
+                        throw err;
+                    }
                     const isSecure = requestOrigin.startsWith('https');
                     const handle = (await getRepoHandle(result.did)) ?? result.did;
                     const session = { did: result.did, handle };