- at.happyproto.actor.acceptInvite procedure Redeem an invite from admin.createInvites: the caller joins the customers space with read access, and the address the invite went to is paired with the caller's account. Redeeming as an account that is already a customer succeeds and spends nothing. Any signed-in account may call this; the token is the authority.
- at.happyproto.actor.acceptTerms procedure Record that the caller accepted the beta terms in force for their account, with the exact wording they were shown. The dashboard calls it from the terms screen after sign-in. Accepting terms already accepted records nothing new. Each acceptance is kept, append-only. Customers and staff; anyone else is refused.
- at.happyproto.actor.getAccount query Whether the caller is a HappyProto customer, and how many instances they have of how many allowed. Any signed-in caller; a non-customer gets zeros.
- at.happyproto.actor.getProfile query Get an actor's profile. Returns full detail — including dashboard entitlements — only for the authenticated caller; for any other actor it returns public basics only.
- at.happyproto.actor.getTerms query Whether the caller has accepted the beta terms in force. The dashboard asks after each sign-in and shows the terms until the caller accepts them with acceptTerms: once per account, and again whenever the terms change. createInstance is refused until then. Customers and staff; anyone else is refused.
- at.happyproto.actor.syncAccount procedure Record the email address on the caller's PDS account with HappyProto, read server-side from their PDS session. The dashboard calls it once after each sign-in. The PDS reports the address only when the sign-in granted it (transition:email or account:email); without one, the last recorded address is kept, and an unconfirmed address never replaces a confirmed one. The address itself is never returned. Customers and staff; anyone else gets recorded = false.
- at.happyproto.admin.addCustomer procedure Make an account a customer: add it to the customers space with read access. Adding an existing member succeeds and changes nothing. Staff only.
- at.happyproto.admin.cancelHostRequest procedure Cancel a host request and remove its server and volume. confirm must be the request's host name. Staff only.
- at.happyproto.admin.createInvites procedure Invite customers: mint one single-use customers-space invite per address, each expiring after expiresInDays, and record which address each went to, so a redeemed invite pairs the address with the account. Redeemed with actor.acceptInvite. Staff only.
- at.happyproto.admin.createSpaces procedure Create HappyProto's admin and customers spaces, member-only, keeping either that already exists, and add each of staff to the admin space with write access, skipping existing members. Each space is looked up at the uri its script variable (HAPPYPROTO_ADMIN_SPACE, HAPPYPROTO_CUSTOMERS_SPACE) names, or, unset, under HAPPYPROTO_DID. A space created here has a DID of its own, and the uri answered is the one to set its variable to. Idempotent once the variables are set: a second call creates nothing
- at.happyproto.admin.defs defs The autoscaler's settings and what it is waiting on.
- at.happyproto.admin.getAutoscale query The autoscaler: on or paused, how many hosts it may add, what it is waiting on, and free capacity against its thresholds. Staff only.
- at.happyproto.admin.getEncryptionKey query Where an instance's encryption key is in its rotation, and whether a rotation can start now. Staff only.
- at.happyproto.admin.getFleet query Every host, and every tenant with its host, plan, owner and latest metered hour, for the staff fleet view. Staff only.
- at.happyproto.admin.getHostRequest query One host request with its timeline, oldest event first. Staff only.
- at.happyproto.admin.listCustomers query The members of the customers space: everyone the customer endpoints admit. Staff only.
- at.happyproto.admin.listHostRequests query The autoscaler's host requests, newest first, without their timelines. Staff only.
- at.happyproto.admin.listHosts query Every host, with what its tenants hold. Staff only.
- at.happyproto.admin.listInstances query Every instance, whoever owns it, with its placement. Staff only.
- at.happyproto.admin.listInvites query Every customer invite, newest first: the address it went to, whether it is pending, expired or redeemed, and by which account. Staff only.
- at.happyproto.admin.listJobs query Background jobs across every user, newest first. Staff only.
- at.happyproto.admin.removeCustomer procedure Stop an account being a customer: remove it from the customers space. Removing a non-member succeeds. Staff only.
- at.happyproto.admin.retryHostRequest procedure Start a failed host request again. The workflow skips what already exists, so a retry never orders a second server. Staff only.
- at.happyproto.admin.rotateEncryptionKey procedure Give an instance a new encryption key. The old key stays beside it while HappyView re-seals what it sealed, and is then retired on its own. Staff only.
- at.happyproto.admin.setAutoscalePaused procedure Pause or resume the autoscaler. Pausing stops new host requests; one under way carries on. Staff only.
- at.happyproto.fleet.getAdoption query Per-subsystem feature adoption, ever-used against active now. Admin only.
- at.happyproto.fleet.getBenchmarks query Where one instance sits in its size cohort. Withheld below a cohort of 10: a percentile over fewer is not an aggregate, it is individual data with a statistic drawn over it. Admin only.
- at.happyproto.fleet.getCapacity query Store capacity: the latest totals, a daily trend, per-collection counts and what each tenant holds. Proxied from the provisioner. Admin only.
- at.happyproto.fleet.getCostShape query Disk and memory distribution, and bytes per record. Memory is reported as separate anonymous and file-backed figures and is never totalled. Admin only.
- at.happyproto.fleet.getGrowth query Fleet and per-instance growth rates from instance_daily_deltas. Counter resets are excluded by the view, so a wiped volume lowers no rate. Admin only.
- at.happyproto.fleet.getHostMix query Categorical host facts across the fleet, with consent coverage. Keys whose values vary per instance, or that carry embedded documents, are named but not enumerated. Admin only.
- at.happyproto.fleet.getIngestHealth query Report lag, clock skew and schema-version spread. Lag and skew are separate facts and must not be averaged together. Admin only.
- at.happyproto.fleet.getLexiconShape query Lexicon counts and top-collection concentration. Reads tier-1 shape only; consent-gated lexicon names are not read here. Admin only.
- at.happyproto.fleet.getResets query Counter resets — the negative deltas instance_daily_deltas discards. A reset is a restored backup, a wiped volume, a re-provision or a wrong clock. Admin only.
- at.happyproto.fleet.getRetention query Survival by first-seen cohort. Manual-mode instances are excluded: they have no reporting cadence to miss, so their silence is not churn. Admin only.
- at.happyproto.fleet.getSignals query Fleet-wide failure signals, derived from each instance's most recent snapshot. Admin only.
- at.happyproto.fleet.getTenantIngestMetrics query How any tenant handled incoming records in a window, by collection and action. The same shape as server.getIngestMetrics. Admin only.
- at.happyproto.fleet.getTenantScriptMetrics query How any tenant's scripts ran in a window: every script that ran, or with trigger, one script's series. The same shape as server.getScriptMetrics. Admin only.
- at.happyproto.fleet.getTenantUsage query One tenant's metered usage by hour or day, with the hours that have no report. Proxied from the provisioner. Admin only.
- at.happyproto.fleet.getVersions query HappyView version distribution and upgrade lag. Admin only.
- at.happyproto.fleet.listInstances query The reporting fleet, one row per instance, from its most recent snapshot. Admin only.
- at.happyproto.plugin.profile record A HappyView plugin package, in its publisher's repo. The record key is the package slug, so the slug is immutable: changing it means a different package.
- at.happyproto.plugin.release record One version of a package. The record key is '<slug>:<version>'. A release at a given version is never modified: a registry that later sees a different CID at this key keeps the first and flags the conflict.
- at.happyproto.plugin.releaseExtension object The HappyView-specific half of a release, carried at extensions['at.happyproto.plugin.releaseExtension']. It is the plugin manifest, moved into the signed record so a consent screen renders without downloading the module. It is not trusted: the loader checks it against the module's plugin_info export and its import section, so a release that misstates what its WASM does is refused exactly as a checksum mismatch is.
- at.happyproto.plugin.v1 object A HappyView plugin, as one entry in a software.release.manifest's `artifacts`. It carries the module and its manifest.json as blobs, so they are verified by their CIDs, and the manifest's facts in the signed record, so a consent screen renders without downloading the module. Those facts are not trusted: the loader checks them against the module itself and refuses a plugin that misstates what it does. The registry refuses a manifest whose artifact breaks a rule stated here, including the ones a l
- at.happyproto.registry.defs defs The version's changelog, from the registry's copy of its site.standard.document.
- at.happyproto.registry.getArtifact query The bytes of a blob the registry has copied, served from its own copy and never redirected to the publisher, so a version stays installable after its publisher deletes it. Name the blob either by version and kind or by its CID. Only blobs that an indexed manifest or publication references are served. The output encoding is `*/*`, as com.atproto.sync.getBlob's is; the media type is the one the blob was published with.
- at.happyproto.registry.getPackage query One package by publisher and slug. A withdrawn package is still returned, flagged `deleted`, because its releases stay resolvable.
- at.happyproto.registry.getProject query One plugin, by publisher and name.
- at.happyproto.registry.getRelease query One release by exact version. Served whatever its status, including `deleted`: that is the left-pad protection the registry exists for.
- at.happyproto.registry.getVersion query One version of a plugin, by exact version, whatever its lifecycle state or availability.
- at.happyproto.registry.listReleases query Every release of a package, newest-indexed first, including withdrawn ones flagged `deleted` — a client resolving an exact version needs to see that it exists.
- at.happyproto.registry.listVersions query A plugin's versions, most recently indexed first, whatever their lifecycle state.
- at.happyproto.registry.project record The HappyView facts about a software.release.project that make it a plugin. The record key is the project's name, and the record lives in the same repo as the project. The registry indexes a project's releases only while this record exists and is valid.
- at.happyproto.registry.promoteRelease procedure Publish an existing version's artifact under a new version, such as `1.2.0-rc.1` as `1.2.0`, without uploading it again. The new software.release.version points at the existing manifest. Optionally moves a channel to it and adds a changelog.
- at.happyproto.registry.publishProfile procedure Check a package profile against the rules the indexer applies, and optionally write it to the caller's repo. The indexer validates a record only after it is published and skips an invalid one quietly, so a publisher writing the record itself gets no feedback; this answers the same refusal before the record exists. Pass validateOnly to check a record without writing it. Like every XRPC procedure this needs an authenticated caller, so validateOnly is a dry run rather than an anonymous one.
- at.happyproto.registry.publishRelease procedure Publish a version of a plugin to the caller's repo. Writes a software.release.manifest carrying the artifact, the changelog as a site.standard.document when one is given, the software.release.version, and the channel named by track, moved to the new version, in that order. A record is written only once everything it points at exists, so a failure part-way leaves no dangling reference. Calling again with the same input after such a failure finishes the release rather than refusing it.
- at.happyproto.registry.putProject procedure Create or update a plugin project in the caller's repo. The first call writes the site.standard.publication, the at.happyproto.registry.project and the software.release.project, in that order, so each is indexed after what it depends on. Later calls update the publication and the at.happyproto.registry.project only; the project record itself is never changed.
- at.happyproto.registry.putStatus procedure Add a software.release.status record about one of the caller's projects or versions. Statuses are never edited or deleted: to cancel one, add another with status `withdrawn` that names it in `withdraws`.
- at.happyproto.registry.resolveChannel query The version a plugin's channel points at.
- at.happyproto.registry.retryRelease procedure Copy a pending release's artifact again. A release is listed only once the registry has copied its artifact, which it tries once when it first indexes the release; this is how the release's publisher tries again after that copy failed. An active release is answered as it is, with nothing enqueued.
- at.happyproto.registry.retryVersion procedure Copy a version's blobs into the registry again, after an earlier copy failed. Only the registry's own account may call this. The copy is enqueued for any indexed version and fetches only what is not held yet, so an available version whose optional images failed can be retried. For a version deleted at its source, the copy keeps whatever blobs the publisher's PDS still serves, so instances that installed it can keep loading it by CID, but the version stays deletedAtSource and is never made availa
- at.happyproto.registry.searchPackages query Find packages. Deleted packages are never returned. With `q` the result is ranked by match and capped rather than paged, because the index's substring search takes no cursor; without it the result is paged.
- at.happyproto.registry.searchProjects query Find plugins. Retired projects are left out unless includeRetired is set.
- at.happyproto.registry.updateProfile procedure Replace a package profile the caller has already published, held to the rules publishProfile applies. This is how a publisher edits a profile: it writes to the caller's own repo as them, where com.atproto.repo.putRecord sent through a HappyView instance goes wherever that instance's proxy routing points. It never creates a profile; publish a new one with publishProfile.
- at.happyproto.registry.withdrawRelease procedure Delete a release record the caller published. This is how a publisher withdraws a release: it deletes from the caller's own repo as them, where com.atproto.repo.deleteRecord sent through a HappyView instance goes wherever that instance's proxy routing points. The release stays indexed and served by exact version, marked withdrawn, and the version can never be published again.
- at.happyproto.server.addDomain procedure Add a custom domain to one of the caller's instances. It starts pending, with the DNS records to publish. Customers only.
- at.happyproto.server.checkDomain procedure Check a custom domain's DNS records now, rather than at the next scheduled check. Customers only.
- at.happyproto.server.checkSlug query Whether a slug can be used for a new instance. Customers only. An invalid or reserved slug is answered without asking the provisioner.
- at.happyproto.server.createInstance procedure Create an instance for the caller, and start a job that follows its provisioning. Customers only.
- at.happyproto.server.deleteInstance procedure Delete one of the caller's instances, and start a job that follows the deletion. Customers only.
- at.happyproto.server.getDeployment query One change to one of the caller's own instances, with its steps. Customers only.
- at.happyproto.server.getIngestMetrics query How one of the caller's own instances handled incoming records in a window, by collection and action. Customers only.
- at.happyproto.server.getInstance query One of the caller's own instances. Customers only.
- at.happyproto.server.getJob query One of the caller's own background jobs, such as the one a change to an instance started. Customers only.
- at.happyproto.server.getLogs query A page of what one of the caller's own instances wrote, redacted on its host. Customers only.
- at.happyproto.server.getScriptMetrics query How one of the caller's own instances' scripts ran in a window: every script that ran, or with trigger, one script's series. Customers only.
- at.happyproto.server.getUsage query One of the caller's instances' metered usage by hour or day, with the hours that have no report. Customers only.
- at.happyproto.server.listDeployments query The changes made to one of the caller's own instances, newest first, a page at a time. Customers only.
- at.happyproto.server.listDomains query The domains of one of the caller's instances: its platform subdomain and any custom domain. Customers only.
- at.happyproto.server.listInstances query The caller's own instances. Customers only.
- at.happyproto.server.listPlans query The plans a new or changed instance can use. Customers only.
- at.happyproto.server.removeDomain procedure Remove a custom domain from one of the caller's instances. HappyProto stops serving it. Customers only.
- at.happyproto.server.setPrimaryDomain procedure Make a domain the primary of one of the caller's instances: a verified custom domain that is serving, or the platform subdomain. The instance restarts onto it. Customers only.
- at.happyproto.server.startInstance procedure Start one of the caller's instances, and start a job that follows the start. Customers only.
- at.happyproto.server.stopInstance procedure Stop one of the caller's instances, and start a job that follows the stop. Customers only.
- at.happyproto.server.updateInstance procedure Move one of the caller's instances to another plan or HappyView release, and start a job that follows the change. Customers only.
- at.happyproto.server.upgradeInstance procedure Upgrade one of the caller's instances to the newer HappyView release its availableVersion offers, and start a job that follows the upgrade. The instance is offline for about 30 seconds; its database is snapshotted first, and a release that does not come up healthy is rolled back. Customers only.