@hatk/hatk 0.0.1-alpha.84 → 0.0.1-alpha.86

package/dist/spaces/visibility.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"visibility.d.ts","sourceRoot":"","sources":["../../src/spaces/visibility.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAaH;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAE9E;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,IAAI,CAElE;AAED,+DAA+D;AAC/D,wBAAgB,cAAc,IAAI,WAAW,CAAC,MAAM,CAAC,CAEpD;AAED,6DAA6D;AAC7D,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAGzE;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAUlH"}

package/dist/spaces/visibility.js

@@ -0,0 +1,81 @@
+/**
+ * Which permissioned spaces the read in flight is allowed to serve.
+ *
+ * Space records are not public data. A space's authority decides who may read
+ * it, and it decides that one caller at a time — so a row indexed out of a
+ * space carries an audience, and serving it to a request that has not proven
+ * it belongs to that audience discloses private data no matter how the query
+ * was written.
+ *
+ * hatk has no other per-row visibility concept. The takedown join is
+ * viewer-independent and `privateCollections` is all-or-nothing, so neither
+ * could carry this. The rule here is instead:
+ *
+ *   a row with `space IS NULL` is public repo data and always readable;
+ *   a row with a space is readable only inside a scope that names that space.
+ *
+ * The default is an empty scope, which serves no space rows at all. That is
+ * deliberate: a read path nobody remembered to scope fails closed and shows a
+ * member nothing, rather than failing open and showing a stranger everything.
+ * Every query over a record table applies `spaceFilterSql`; the scope is
+ * established per request by whoever established the viewer.
+ */
+import { AsyncLocalStorage } from 'node:async_hooks';
+const EMPTY = new Set();
+/**
+ * Async-local rather than a module global: a server answers requests
+ * concurrently, and one viewer's readable set must never be observable from
+ * another's request while an await is outstanding.
+ */
+const store = new AsyncLocalStorage();
+/**
+ * Run `fn` with exactly these spaces readable.
+ *
+ * Replaces rather than extends any enclosing scope: widening what a nested read
+ * may see is never what a caller means, and a scope that only ever narrows is
+ * one that can be reasoned about locally.
+ */
+export function withReadableSpaces(spaces, fn) {
+    return store.run(new Set(spaces), fn);
+}
+/**
+ * Set the readable spaces for the rest of the current async context.
+ *
+ * `withReadableSpaces` wants a callback, and a request handler is a long body
+ * rather than something to wrap — restructuring it around a closure to hold a
+ * scope would be the tail wagging the dog. A server handler already runs in its
+ * own async context per request, which is the case `enterWith` exists for.
+ */
+export function enterReadableSpaces(spaces) {
+    store.enterWith(new Set(spaces));
+}
+/** The spaces this read may serve. Empty outside any scope. */
+export function readableSpaces() {
+    return store.getStore() ?? EMPTY;
+}
+/** Whether a space would be served to the read in flight. */
+export function isSpaceReadable(space) {
+    if (space == null)
+        return true;
+    return readableSpaces().has(space);
+}
+/**
+ * The space gate as a SQL predicate, for a table aliased `alias` (pass '' for
+ * an unaliased table).
+ *
+ * `startIdx` is the next free `$N` placeholder; the returned `nextIdx` is the
+ * next one after this predicate's own. With nothing readable the predicate
+ * binds no parameters at all, which is the shape almost every request takes.
+ */
+export function spaceFilterSql(alias, startIdx) {
+    const col = alias ? `${alias}.space` : 'space';
+    const spaces = [...readableSpaces()];
+    if (spaces.length === 0)
+        return { sql: `${col} IS NULL`, params: [], nextIdx: startIdx };
+    const placeholders = spaces.map((_, i) => `$${startIdx + i}`).join(', ');
+    return {
+        sql: `(${col} IS NULL OR ${col} IN (${placeholders}))`,
+        params: spaces,
+        nextIdx: startIdx + spaces.length,
+    };
+}

package/dist/templates/feed.tpl

@@ -5,6 +5,10 @@ export default defineFeed({
   label: '{{Name}}',
 
   async generate(ctx) {
+    // ctx.paginate applies the permissioned-space gate for you, so this page
+    // shows a member the spaces they may read and everyone else the public
+    // rows alone. A feed that builds its own SQL over a space-backed table is
+    // refused with an error naming the table; see ctx.spaceFilter.
     const { rows, cursor } = await ctx.paginate<{ uri: string }>(
       `SELECT uri, cid, indexed_at FROM "your.collection.here"`,
     )

package/dist/templates/xrpc.tpl

@@ -1,7 +1,7 @@
 import { defineQuery } from '$hatk'
 
 export default defineQuery('{{name}}', async (ctx) => {
-  const { ok, db, params, packCursor, unpackCursor } = ctx
+  const { ok, db, params, packCursor, unpackCursor, spaceFilter } = ctx
   const limit = params.limit ?? 30
   const cursor = params.cursor
 
@@ -9,6 +9,18 @@ export default defineQuery('{{name}}', async (ctx) => {
   const sqlParams: (string | number)[] = []
   let paramIdx = 1
 
+  // Which permissioned spaces this viewer may be shown. Typed helpers like
+  // ctx.lookup and ctx.getRecords apply this already; hand-written SQL cannot,
+  // because nothing can inject a predicate into a string you wrote. Drop it on
+  // a collection a space writes into and hatk refuses the query by name.
+  //
+  // Outside a viewer's scope it is `s.space IS NULL` and binds nothing, so on an
+  // instance that indexes no space it costs one test on an indexed column.
+  const spaces = spaceFilter('s', paramIdx)
+  conditions.push(spaces.sql)
+  sqlParams.push(...spaces.params)
+  paramIdx = spaces.nextIdx
+
   if (cursor) {
     const parsed = unpackCursor(cursor)
     if (parsed) {

package/dist/test.d.ts

@@ -5,6 +5,8 @@ export interface TestContext {
     db: {
         query: (sql: string, params?: any[]) => Promise<any[]>;
         run: (sql: string, params?: any[]) => Promise<void>;
+        /** Raw SQL with the permissioned-space guard off, as the runtime contexts have it. */
+        unfiltered: (sql: string, params?: any[]) => Promise<any[]>;
     };
     loadFixtures: (dir?: string) => Promise<void>;
     loadFeed: (name: string) => {

package/dist/test.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"test.d.ts","sourceRoot":"","sources":["../src/test.ts"],"names":[],"mappings":"AAIA,OAAO,EAAc,KAAK,UAAU,EAAE,MAAM,aAAa,CAAA;AAkBzD,OAAO,EAAE,IAAI,IAAI,iBAAiB,EAAE,KAAK,QAAQ,EAAE,MAAM,WAAW,CAAA;AAEpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE7C,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE;QACF,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;QACtD,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KACpD,CAAA;IACD,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7C,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK;QAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,GAAG,CAAC,CAAA;KAAE,CAAA;IAC5E,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK;QAAE,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,CAAA;KAAE,CAAA;IACnE,WAAW,EAAE,CAAC,IAAI,CAAC,EAAE;QACnB,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,MAAM,CAAC,EAAE;YAAE,GAAG,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAA;QAC/B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAChC,KAAK,WAAW,CAAA;IACjB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1B,gBAAgB,CAAC,OAAO,EAAE,UAAU,CAAA;IACpC,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CACxC;AAED,MAAM,WAAW,UAAW,SAAQ,WAAW;IAC7C,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC9D,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC7E,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,QAAQ,KAAK,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAA;IAC/D,aAAa,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAClE;AAYD;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,WAAW,CAAC,CAwL9D;AA8BD,wBAAsB,eAAe,IAAI,OAAO,CAAC,UAAU,CAAC,CAiD3D"}
+{"version":3,"file":"test.d.ts","sourceRoot":"","sources":["../src/test.ts"],"names":[],"mappings":"AAIA,OAAO,EAAc,KAAK,UAAU,EAAE,MAAM,aAAa,CAAA;AAmBzD,OAAO,EAAE,IAAI,IAAI,iBAAiB,EAAE,KAAK,QAAQ,EAAE,MAAM,WAAW,CAAA;AAIpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE7C,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE;QACF,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;QACtD,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;QACnD,sFAAsF;QACtF,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;KAC5D,CAAA;IACD,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7C,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK;QAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,GAAG,CAAC,CAAA;KAAE,CAAA;IAC5E,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK;QAAE,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,CAAA;KAAE,CAAA;IACnE,WAAW,EAAE,CAAC,IAAI,CAAC,EAAE;QACnB,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,MAAM,CAAC,EAAE;YAAE,GAAG,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAA;QAC/B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAChC,KAAK,WAAW,CAAA;IACjB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1B,gBAAgB,CAAC,OAAO,EAAE,UAAU,CAAA;IACpC,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CACxC;AAED,MAAM,WAAW,UAAW,SAAQ,WAAW;IAC7C,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC9D,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC7E,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,QAAQ,KAAK,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAA;IAC/D,aAAa,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAClE;AAYD;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,WAAW,CAAC,CAyL9D;AA8BD,wBAAsB,eAAe,IAAI,OAAO,CAAC,UAAU,CAAC,CAiD3D"}

package/dist/test.js

@@ -3,7 +3,7 @@ import { readdirSync, readFileSync } from 'node:fs';
 import { registerHatkResolveHook } from "./resolve-hatk.js";
 import YAML from 'yaml';
 import { loadConfig } from "./config.js";
-import { loadLexicons, storeLexicons, discoverCollections, generateTableSchema, generateCreateTableSQL, } from "./database/schema.js";
+import { validatableLexicons, loadLexicons, storeLexicons, discoverCollections, generateTableSchema, generateCreateTableSQL, } from "./database/schema.js";
 import { initDatabase, querySQL, runSQL, insertRecord, closeDatabase } from "./database/db.js";
 import { createAdapter } from "./database/adapter-factory.js";
 import { SQLITE_DIALECT } from "./database/dialect.js";
@@ -16,6 +16,8 @@ import { validateLexicons } from '@bigmoves/lexicon';
 import { packCursor, unpackCursor, isTakendownDid, filterTakendownDids } from "./database/db.js";
 import { seed as createSeedHelpers } from "./seed.js";
 import { setPrivateCollections } from "./private-collections.js";
+import { spaceFilterSql } from "./spaces/visibility.js";
+import { guardedQuerySQL, unfilteredQuerySQL } from "./spaces/guard.js";
 /**
  * Find the project's hatk.config.ts by walking up from cwd.
  * Returns the resolved config path, or falls back to 'hatk.config.ts'.
@@ -44,7 +46,7 @@ export async function createTestContext() {
     configureCdn(config.cdn);
     // Load and validate lexicons
     const lexicons = loadLexicons(resolve(configDir, 'lexicons'));
-    const lexiconErrors = validateLexicons([...lexicons.values()]);
+    const lexiconErrors = validateLexicons(validatableLexicons(lexicons));
     if (lexiconErrors) {
         const messages = Object.entries(lexiconErrors).flatMap(([nsid, errs]) => errs.map((e) => `${nsid}: ${e}`));
         throw new Error(`Invalid lexicons:\n${messages.join('\n')}`);
@@ -84,7 +86,7 @@ export async function createTestContext() {
     // Discover feeds, xrpc, labels, hooks, og from server/ directory (skip setup scripts in tests)
     await initServer(resolve(configDir, 'server'), { skipSetup: true });
     return {
-        db: { query: querySQL, run: runSQL },
+        db: { query: guardedQuerySQL, run: runSQL, unfiltered: unfilteredQuerySQL },
         _config: config,
         _collections: collections,
         loadFixtures: async (dir) => {
@@ -184,14 +186,14 @@ export async function createTestContext() {
         },
         feedContext: (opts) => {
             const paginateDeps = {
-                db: { query: querySQL },
+                db: { query: guardedQuerySQL, unfiltered: unfilteredQuerySQL },
                 cursor: opts?.cursor,
                 limit: opts?.limit || 30,
                 packCursor,
                 unpackCursor,
             };
             return {
-                db: { query: querySQL },
+                db: { query: guardedQuerySQL, unfiltered: unfilteredQuerySQL },
                 params: opts?.params || {},
                 cursor: opts?.cursor,
                 limit: opts?.limit || 30,
@@ -201,6 +203,7 @@ export async function createTestContext() {
                 isTakendown: isTakendownDid,
                 filterTakendownDids,
                 paginate: createPaginate(paginateDeps),
+                spaceFilter: spaceFilterSql,
             };
         },
         close: async () => {

package/dist/xrpc.d.ts

@@ -29,6 +29,7 @@ export interface XrpcContext<P = Record<string, string>, Records extends Record<
     db: {
         query: (sql: string, params?: unknown[]) => Promise<unknown[]>;
         run: (sql: string, params?: unknown[]) => Promise<void>;
+        unfiltered: (sql: string, params?: unknown[]) => Promise<unknown[]>;
     };
     params: P;
     input: I;
@@ -93,7 +94,7 @@ export declare function configureCdn(cdn: CdnConfig | null): void;
  */
 export declare function blobUrl(did: string, ref: unknown, preset?: string): string | undefined;
 /** Build a full XrpcContext from request parameters. Reuses buildBaseContext for shared fields. */
-export declare function buildXrpcContext(params: Record<string, string>, cursor: string | undefined, limit: number, viewer: {
+export declare function buildXrpcContext(params: XrpcParams, cursor: string | undefined, limit: number, viewer: {
     did: string;
     handle?: string;
 } | null, input?: unknown): XrpcContext;
@@ -107,8 +108,23 @@ export declare function initXrpc(xrpcDir: string): Promise<void>;
 export declare function registerXrpcHandler(nsid: string, handlerModule: {
     handler: (ctx: any) => Promise<any>;
 }): void;
+/**
+ * What the query string gives a handler: one value per key, or every value
+ * when the key was repeated (`?dids=a&dids=b`).
+ */
+export type XrpcParams = Record<string, any>;
+/** Collect a query string into params, keeping every value of a repeated key. */
+export declare function paramsFromSearch(search: URLSearchParams): XrpcParams;
+/**
+ * Apply the lexicon's parameter schema before a handler runs: defaults,
+ * integer coercion, and arrays. A query string cannot say whether
+ * `dids=x` is one string or a one-element list, so the schema decides: a
+ * parameter declared `array` always reaches the handler as one, or a handler
+ * that spreads it would spread the characters of a DID instead.
+ */
+export declare function coerceParams(params: XrpcParams, properties: Record<string, any>, required: string[]): void;
 /** Execute a registered XRPC handler by name. Returns null if no handler matches. */
-export declare function executeXrpc(name: string, params: Record<string, string>, cursor: string | undefined, limit: number, viewer?: {
+export declare function executeXrpc(name: string, params: XrpcParams, cursor: string | undefined, limit: number, viewer?: {
     did: string;
 } | null, input?: unknown): Promise<any | null>;
 /** Call a registered XRPC handler directly (no HTTP). For use in SSR renderers. */
@@ -117,7 +133,7 @@ export declare function callXrpc(nsid: string, params?: Record<string, any>, inp
  * Register a core XRPC handler directly (no XrpcContext wrapping).
  * Used for built-in dev.hatk.* handlers that manage their own dependencies.
  */
-export declare function registerCoreXrpcHandler(nsid: string, fn: (params: Record<string, string>, cursor: string | undefined, limit: number, viewer: {
+export declare function registerCoreXrpcHandler(nsid: string, fn: (params: XrpcParams, cursor: string | undefined, limit: number, viewer: {
     did: string;
     handle?: string;
 } | null, input?: unknown) => Promise<any>): void;

package/dist/xrpc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"xrpc.d.ts","sourceRoot":"","sources":["../src/xrpc.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAE/C,OAAO,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AAElD,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAEzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAEpD,YAAY,EAAE,GAAG,EAAE,OAAO,EAAE,CAAA;AAI5B,mFAAmF;AACnF,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,QAExD;AAED,gFAAgF;AAChF,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,MAAM,SAAM;IACZ,SAAS,CAAC,EAAE,MAAM,CAAA;gBACN,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM;CAIhD;AACD,0DAA0D;AAC1D,qBAAa,aAAc,SAAQ,mBAAmB;IACpD,MAAM,SAAM;gBACA,OAAO,SAAc;CAGlC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW,CAC1B,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC1B,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzD,CAAC,GAAG,OAAO,CACX,SAAQ,WAAW;IACnB,EAAE,EAAE;QACF,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;QAC9D,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KACxD,CAAA;IACD,MAAM,EAAE,CAAC,CAAA;IACT,KAAK,EAAE,CAAC,CAAA;IACR,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,MAAM,CAAA;IAC7D,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;IACzE,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IAC9C,mBAAmB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;IAC7D,MAAM,EAAE,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,OAAO,EACvC,UAAU,EAAE,CAAC,EACb,CAAC,EAAE,MAAM,EACT,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,KACxD,OAAO,CAAC;QAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC7D,OAAO,EAAE,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAC3D,MAAM,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IACjF,YAAY,EAAE,CACZ,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,KACrB,OAAO,CAAC;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC5C,SAAS,EAAE,CACT,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,OAAO,CAAC;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC5C,YAAY,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACjE,WAAW,EAAE,CACX,MAAM,EAAE,KAAK,CAAC;QACZ,KAAK,EAAE,MAAM,CAAA;QACb,UAAU,EAAE,MAAM,CAAA;QAClB,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAChC,CAAC,KACC,OAAO,CAAC;QAAE,OAAO,CAAC,EAAE,KAAK,CAAC;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,GAAG,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC,CAAA;IAChF;;;;OAIG;IACH,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAClF;AAiBD,+EAA+E;AAC/E,iFAAiF;AACjF,wBAAgB,YAAY,IAAI,OAAO,CAOtC;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,QAE3C;AAED,4EAA4E;AAC5E,wBAAgB,YAAY,CAAC,GAAG,EAAE,SAAS,GAAG,IAAI,QAUjD;AAWD;;;GAGG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,MAAiB,GAAG,MAAM,GAAG,SAAS,CAehG;AAED,mGAAmG;AACnG,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAC/C,KAAK,CAAC,EAAE,OAAO,GACd,WAAW,CA8Cb;AAoBD;;;;GAIG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAwC7D;AAED,oEAAoE;AACpE,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE;IAAE,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,CAAA;CAAE,GAAG,IAAI,CA2B9G;AAED,qFAAqF;AACrF,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAC/B,KAAK,CAAC,EAAE,OAAO,GACd,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAYrB;AAED,mFAAmF;AACnF,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAM,EAAE,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAgB5G;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,CACF,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAC/C,KAAK,CAAC,EAAE,OAAO,KACZ,OAAO,CAAC,GAAG,CAAC,GAChB,IAAI,CAEN;AAED,+CAA+C;AAC/C,wBAAgB,QAAQ,IAAI,MAAM,EAAE,CAEnC"}
+{"version":3,"file":"xrpc.d.ts","sourceRoot":"","sources":["../src/xrpc.ts"],"names":[],"mappings":"AAuCA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAE/C,OAAO,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AAElD,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAEzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAEpD,YAAY,EAAE,GAAG,EAAE,OAAO,EAAE,CAAA;AAI5B,mFAAmF;AACnF,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,QAExD;AAED,gFAAgF;AAChF,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,MAAM,SAAM;IACZ,SAAS,CAAC,EAAE,MAAM,CAAA;gBACN,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM;CAIhD;AACD,0DAA0D;AAC1D,qBAAa,aAAc,SAAQ,mBAAmB;IACpD,MAAM,SAAM;gBACA,OAAO,SAAc;CAGlC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW,CAC1B,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC1B,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzD,CAAC,GAAG,OAAO,CACX,SAAQ,WAAW;IACnB,EAAE,EAAE;QACF,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;QAC9D,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;QACvD,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;KACpE,CAAA;IACD,MAAM,EAAE,CAAC,CAAA;IACT,KAAK,EAAE,CAAC,CAAA;IACR,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,MAAM,CAAA;IAC7D,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;IACzE,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IAC9C,mBAAmB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;IAC7D,MAAM,EAAE,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,OAAO,EACvC,UAAU,EAAE,CAAC,EACb,CAAC,EAAE,MAAM,EACT,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,KACxD,OAAO,CAAC;QAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC7D,OAAO,EAAE,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAC3D,MAAM,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IACjF,YAAY,EAAE,CACZ,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,KACrB,OAAO,CAAC;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC5C,SAAS,EAAE,CACT,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,OAAO,CAAC;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC5C,YAAY,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACjE,WAAW,EAAE,CACX,MAAM,EAAE,KAAK,CAAC;QACZ,KAAK,EAAE,MAAM,CAAA;QACb,UAAU,EAAE,MAAM,CAAA;QAClB,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAChC,CAAC,KACC,OAAO,CAAC;QAAE,OAAO,CAAC,EAAE,KAAK,CAAC;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,GAAG,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC,CAAA;IAChF;;;;OAIG;IACH,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAClF;AAiBD,+EAA+E;AAC/E,iFAAiF;AACjF,wBAAgB,YAAY,IAAI,OAAO,CAStC;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,QAE3C;AAED,4EAA4E;AAC5E,wBAAgB,YAAY,CAAC,GAAG,EAAE,SAAS,GAAG,IAAI,QAUjD;AAWD;;;GAGG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,MAAiB,GAAG,MAAM,GAAG,SAAS,CAehG;AAED,mGAAmG;AACnG,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAC/C,KAAK,CAAC,EAAE,OAAO,GACd,WAAW,CA8Cb;AAoBD;;;;GAIG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA2B7D;AAED,oEAAoE;AACpE,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE;IAAE,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,CAAA;CAAE,GAAG,IAAI,CAe9G;AAED;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;AAE5C,iFAAiF;AACjF,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,eAAe,GAAG,UAAU,CASpE;AAQD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAsB1G;AAED,qFAAqF;AACrF,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAC/B,KAAK,CAAC,EAAE,OAAO,GACd,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAYrB;AAED,mFAAmF;AACnF,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAM,EAAE,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAkB5G;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,CACF,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAC/C,KAAK,CAAC,EAAE,OAAO,KACZ,OAAO,CAAC,GAAG,CAAC,GAChB,IAAI,CAEN;AAED,+CAA+C;AAC/C,wBAAgB,QAAQ,IAAI,MAAM,EAAE,CAEnC"}

package/dist/xrpc.js

@@ -26,10 +26,11 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
  * })
  * ```
  */
+import { guardedQuerySQL, unfilteredQuerySQL } from "./spaces/guard.js";
 import { resolve, relative } from 'node:path';
 import { readdirSync, statSync } from 'node:fs';
 import { log, emit, timer } from "./logger.js";
-import { querySQL, runSQL, packCursor, unpackCursor, isTakendownDid, filterTakendownDids, searchRecords, findUriByFields, } from "./database/db.js";
+import { runSQL, packCursor, unpackCursor, isTakendownDid, filterTakendownDids, searchRecords, findUriByFields, } from "./database/db.js";
 import { resolveRecords, buildBaseContext } from "./hydrate.js";
 import { getLexicon } from "./database/schema.js";
 import { createHmac } from 'node:crypto';
@@ -62,7 +63,7 @@ let _cdn = null;
 export function isLocalRelay() {
     try {
         const host = new URL(_relayUrl).hostname;
-        return host === 'localhost' || host === '127.0.0.1' || host === '[::1]' || host === '::1' || host.endsWith('.localhost');
+        return (host === 'localhost' || host === '127.0.0.1' || host === '[::1]' || host === '::1' || host.endsWith('.localhost'));
     }
     catch {
         return false;
@@ -119,7 +120,7 @@ export function buildXrpcContext(params, cursor, limit, viewer, input) {
     const base = buildBaseContext(viewer);
     return {
         ...base,
-        db: { query: querySQL, run: runSQL },
+        db: { query: guardedQuerySQL, run: runSQL, unfiltered: unfilteredQuerySQL },
         params,
         input: input || {},
         cursor,
@@ -212,20 +213,7 @@ export async function initXrpc(xrpcDir) {
         handlers.set(name, {
             name,
             execute: async (params, cursor, limit, viewer, input) => {
-                // Apply defaults and coerce types from lexicon
-                for (const [key, def] of Object.entries(paramProperties)) {
-                    if (params[key] == null && def.default != null) {
-                        params[key] = String(def.default);
-                    }
-                    if (params[key] != null && def.type === 'integer') {
-                        params[key] = Number(params[key]);
-                    }
-                }
-                for (const param of requiredParams) {
-                    if (!params[param]) {
-                        throw new InvalidRequestError(`Missing required parameter: ${param}`, 'InvalidRequest');
-                    }
-                }
+                coerceParams(params, paramProperties, requiredParams);
                 const ctx = buildXrpcContext(params, cursor, limit, viewer, input);
                 return handler.handler(ctx);
             },
@@ -242,24 +230,64 @@ export function registerXrpcHandler(nsid, handlerModule) {
     handlers.set(nsid, {
         name: nsid,
         execute: async (params, cursor, limit, viewer, input) => {
-            for (const [key, def] of Object.entries(paramProperties)) {
-                if (params[key] == null && def.default != null) {
-                    params[key] = String(def.default);
-                }
-                if (params[key] != null && def.type === 'integer') {
-                    params[key] = Number(params[key]);
-                }
-            }
-            for (const param of requiredParams) {
-                if (!params[param]) {
-                    throw new InvalidRequestError(`Missing required parameter: ${param}`, 'InvalidRequest');
-                }
-            }
+            coerceParams(params, paramProperties, requiredParams);
             const ctx = buildXrpcContext(params, cursor, limit, viewer, input);
             return handlerModule.handler(ctx);
         },
     });
 }
+/** Collect a query string into params, keeping every value of a repeated key. */
+export function paramsFromSearch(search) {
+    const params = {};
+    for (const [key, value] of search) {
+        const prior = params[key];
+        if (prior === undefined)
+            params[key] = value;
+        else if (Array.isArray(prior))
+            prior.push(value);
+        else
+            params[key] = [prior, value];
+    }
+    return params;
+}
+function coerceScalar(value, def) {
+    // Only integers, as before: a boolean still reaches the handler as the
+    // string it was sent as, and handlers written against that keep working.
+    return def?.type === 'integer' ? Number(value) : value;
+}
+/**
+ * Apply the lexicon's parameter schema before a handler runs: defaults,
+ * integer coercion, and arrays. A query string cannot say whether
+ * `dids=x` is one string or a one-element list, so the schema decides: a
+ * parameter declared `array` always reaches the handler as one, or a handler
+ * that spreads it would spread the characters of a DID instead.
+ */
+export function coerceParams(params, properties, required) {
+    for (const [key, def] of Object.entries(properties)) {
+        if (params[key] == null && def.default != null) {
+            params[key] = def.type === 'array' ? [...def.default] : def.type === 'string' ? String(def.default) : def.default;
+        }
+        if (params[key] == null)
+            continue;
+        if (def.type === 'array') {
+            const list = Array.isArray(params[key]) ? params[key] : [params[key]];
+            params[key] = list.map((v) => coerceScalar(v, def.items));
+        }
+        else if (Array.isArray(params[key])) {
+            // A scalar given twice: the last one wins, as a form submission would.
+            params[key] = coerceScalar(params[key][params[key].length - 1], def);
+        }
+        else {
+            params[key] = coerceScalar(params[key], def);
+        }
+    }
+    for (const param of required) {
+        const v = params[param];
+        if (v == null || v === '' || (Array.isArray(v) && v.length === 0)) {
+            throw new InvalidRequestError(`Missing required parameter: ${param}`, 'InvalidRequest');
+        }
+    }
+}
 /** Execute a registered XRPC handler by name. Returns null if no handler matches. */
 export async function executeXrpc(name, params, cursor, limit, viewer, input) {
     const handler = handlers.get(name);
@@ -286,8 +314,10 @@ export async function callXrpc(nsid, params = {}, input) {
     }
     const stringParams = {};
     for (const [k, v] of Object.entries(params)) {
-        if (v != null)
-            stringParams[k] = String(v);
+        if (v == null)
+            continue;
+        // A list stays a list, as the query string would have carried it.
+        stringParams[k] = Array.isArray(v) ? v.map(String) : String(v);
     }
     const limit = params.limit ? Number(params.limit) : 20;
     const cursor = params.cursor ?? undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hatk/hatk",
-  "version": "0.0.1-alpha.84",
+  "version": "0.0.1-alpha.86",
   "license": "MIT",
   "bin": {
     "hatk": "dist/cli.js"
@@ -25,18 +25,21 @@
     "./test": "./dist/test.js",
     "./config": "./dist/config.js",
     "./vite-plugin": "./dist/vite-plugin.js",
-    "./renderer": "./dist/renderer.js"
+    "./renderer": "./dist/renderer.js",
+    "./spaces": "./dist/spaces/index.js"
   },
   "scripts": {
     "clean": "rm -rf dist",
     "build": "npm run clean && tsc -p tsconfig.build.json && cp -r src/templates dist/templates && cp -r src/lexicons dist/lexicons",
     "prepublishOnly": "npm run build",
-    "test": "vitest run"
+    "test": "vitest run --coverage",
+    "test:watch": "vitest"
   },
   "dependencies": {
-    "@bigmoves/lexicon": "^0.2.2",
+    "@bigmoves/lexicon": "^0.2.4",
     "@duckdb/node-api": "^1.4.4-r.1",
     "@hatk/oauth-client": "*",
+    "@noble/curves": "^2.4.0",
     "@resvg/resvg-js": "^2.6.2",
     "better-sqlite3": "^12.6.2",
     "satori": "^0.28.1",
@@ -46,6 +49,7 @@
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.13",
     "@types/react": "^19.2.14",
+    "@vitest/coverage-v8": "^4.1.11",
     "vite": "^8.0.0"
   },
   "peerDependencies": {