@opendatalabs/personal-server-ts-core 0.0.1-canary.016adf9 → 0.0.1-canary.052d47e

package/dist/contracts/http.js

@@ -0,0 +1,49 @@
+export function contractOk(body, status = 200) {
+    return { ok: true, status, body };
+}
+export function contractError(status, error, message) {
+    return {
+        ok: false,
+        status,
+        body: { error, message },
+    };
+}
+export function contractProtocolError(status, errorCode, message) {
+    return {
+        ok: false,
+        status,
+        body: {
+            error: {
+                code: status,
+                errorCode,
+                message,
+            },
+        },
+    };
+}
+export function normalizeIntegerParam(value, fallback) {
+    if (value === null || value === undefined)
+        return fallback;
+    const parsed = Number.parseInt(value, 10);
+    return Number.isNaN(parsed) ? fallback : parsed;
+}
+export async function parseJsonObjectBody(request, invalidJsonMessage = "Invalid JSON body") {
+    let body;
+    try {
+        body = await request.json();
+    }
+    catch {
+        return {
+            ok: false,
+            result: contractError(400, "INVALID_BODY", invalidJsonMessage),
+        };
+    }
+    if (body === null || typeof body !== "object" || Array.isArray(body)) {
+        return {
+            ok: false,
+            result: contractError(400, "INVALID_BODY", "Request body must be a JSON object"),
+        };
+    }
+    return { ok: true, body: body };
+}
+//# sourceMappingURL=http.js.map

package/dist/contracts/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/contracts/http.ts"],"names":[],"mappings":"AAIA,MAAM,UAAU,UAAU,CACxB,IAAW,EACX,MAAM,GAAG,GAAG;IAEZ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,MAAc,EACd,KAAa,EACb,OAAe;IAEf,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM;QACN,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;KACzB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,MAAc,EACd,SAAiB,EACjB,OAAe;IAEf,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM;QACN,IAAI,EAAE;YACJ,KAAK,EAAE;gBACL,IAAI,EAAE,MAAM;gBACZ,SAAS;gBACT,OAAO;aACR;SACF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,KAAgC,EAChC,QAAgB;IAEhB,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAgB,EAChB,kBAAkB,GAAG,mBAAmB;IAKxC,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,kBAAkB,CAAC;SAC/D,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,aAAa,CACnB,GAAG,EACH,cAAc,EACd,oCAAoC,CACrC;SACF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAA+B,EAAE,CAAC;AAC7D,CAAC"}

package/dist/contracts/index.d.ts

@@ -0,0 +1,16 @@
+export { deleteDataScopeContract, IngestPersistedError, ingestDataContract, ingestBinaryDataContract, listDataScopesContract, listDataVersionsContract, parseDataScopeContract, readDataContract, } from "./data.js";
+export { BINARY_MARKER, BINARY_ENCODING, buildBinaryEnvelopeData, decodeBinaryEnvelope, isBinaryEnvelope, sha256Hex, bytesToBase64, base64ToBytes, parseMetadataHeader, stringifyMetadataHeader, } from "./binary.js";
+export type { BinaryEnvelopeData, DecodedBinary } from "./binary.js";
+export { configReadErrorContract, configWriteErrorContract, validateServerConfigContract, } from "./config.js";
+export { approveDeviceSessionContract, createMemoryDeviceSessionStore, DEVICE_POLL_INTERVAL_MS, DEVICE_SESSION_TTL_MS, initiateDeviceSessionContract, pollDeviceSessionContract, provisionDeviceTokenContract, revokeDeviceTokenContract, } from "./auth-device.js";
+export { listAccessLogsContract } from "./access-logs.js";
+export { createGrantContract, listGrantsContract, revokeGrantContract, verifyGrantContract, } from "./grants.js";
+export { contractError, contractOk, contractProtocolError, normalizeIntegerParam, parseJsonObjectBody, } from "./http.js";
+export { oauthTokenContract, OAUTH_ACCESS_TOKEN_TTL_SECONDS, OAUTH_DEVICE_CODE_GRANT, parseOAuthBasicAuth, } from "./oauth.js";
+export { getSyncStatusContract, syncFileContract, triggerSyncContract, } from "./sync.js";
+export type { DataContractError, DataContractErrorBody, DataContractErrorCode, DeleteDataScopeContractInput, DeleteDataScopeContractResult, IngestDataContractInput, IngestDataContractResult, IngestBinaryDataContractInput, ListDataScopesContractInput, ListDataScopesContractResult, ListDataVersionsContractInput, ListDataVersionsContractResult, ReadDataContractInput, ReadDataContractResult, } from "./data.js";
+export type { DeviceContractResult, DeviceSession, DeviceSessionStore, DeviceTokenStorePort, } from "./auth-device.js";
+export type { ContractResult } from "./http.js";
+export type { VerifyGrantContractInput, VerifyGrantRequestBody, CreateGrantRequestBody, CreateGrantContractInput, ListGrantsContractInput, RevokeGrantContractInput, } from "./grants.js";
+export type { OAuthDeviceSession, OAuthDeviceSessionLookup, OAuthTokenResult, OAuthTokenStorePort, } from "./oauth.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/contracts/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/contracts/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,aAAa,EACb,eAAe,EACf,uBAAuB,EACvB,oBAAoB,EACpB,gBAAgB,EAChB,SAAS,EACT,aAAa,EACb,aAAa,EACb,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,4BAA4B,EAC5B,8BAA8B,EAC9B,uBAAuB,EACvB,qBAAqB,EACrB,6BAA6B,EAC7B,yBAAyB,EACzB,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,aAAa,EACb,UAAU,EACV,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,kBAAkB,EAClB,8BAA8B,EAC9B,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,WAAW,CAAC;AAEnB,YAAY,EACV,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,4BAA4B,EAC5B,6BAA6B,EAC7B,uBAAuB,EACvB,wBAAwB,EACxB,6BAA6B,EAC7B,2BAA2B,EAC3B,4BAA4B,EAC5B,6BAA6B,EAC7B,8BAA8B,EAC9B,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,oBAAoB,EACpB,aAAa,EACb,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAChD,YAAY,EACV,wBAAwB,EACxB,sBAAsB,EACtB,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,kBAAkB,EAClB,wBAAwB,EACxB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,YAAY,CAAC"}

package/dist/contracts/index.js

@@ -0,0 +1,10 @@
+export { deleteDataScopeContract, IngestPersistedError, ingestDataContract, ingestBinaryDataContract, listDataScopesContract, listDataVersionsContract, parseDataScopeContract, readDataContract, } from "./data.js";
+export { BINARY_MARKER, BINARY_ENCODING, buildBinaryEnvelopeData, decodeBinaryEnvelope, isBinaryEnvelope, sha256Hex, bytesToBase64, base64ToBytes, parseMetadataHeader, stringifyMetadataHeader, } from "./binary.js";
+export { configReadErrorContract, configWriteErrorContract, validateServerConfigContract, } from "./config.js";
+export { approveDeviceSessionContract, createMemoryDeviceSessionStore, DEVICE_POLL_INTERVAL_MS, DEVICE_SESSION_TTL_MS, initiateDeviceSessionContract, pollDeviceSessionContract, provisionDeviceTokenContract, revokeDeviceTokenContract, } from "./auth-device.js";
+export { listAccessLogsContract } from "./access-logs.js";
+export { createGrantContract, listGrantsContract, revokeGrantContract, verifyGrantContract, } from "./grants.js";
+export { contractError, contractOk, contractProtocolError, normalizeIntegerParam, parseJsonObjectBody, } from "./http.js";
+export { oauthTokenContract, OAUTH_ACCESS_TOKEN_TTL_SECONDS, OAUTH_DEVICE_CODE_GRANT, parseOAuthBasicAuth, } from "./oauth.js";
+export { getSyncStatusContract, syncFileContract, triggerSyncContract, } from "./sync.js";
+//# sourceMappingURL=index.js.map

package/dist/contracts/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/contracts/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,aAAa,EACb,eAAe,EACf,uBAAuB,EACvB,oBAAoB,EACpB,gBAAgB,EAChB,SAAS,EACT,aAAa,EACb,aAAa,EACb,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,4BAA4B,EAC5B,8BAA8B,EAC9B,uBAAuB,EACvB,qBAAqB,EACrB,6BAA6B,EAC7B,yBAAyB,EACzB,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,aAAa,EACb,UAAU,EACV,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,kBAAkB,EAClB,8BAA8B,EAC9B,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,WAAW,CAAC"}

package/dist/contracts/oauth.d.ts

@@ -0,0 +1,38 @@
+export declare const OAUTH_DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+export declare const OAUTH_ACCESS_TOKEN_TTL_SECONDS: number;
+export interface OAuthTokenStorePort {
+    addToken(token: string, options?: {
+        expiresAt?: string | Date | null;
+    }): Promise<void>;
+}
+export interface OAuthDeviceSession {
+    status: "pending" | "approved" | "expired";
+    accessToken?: string;
+    accessTokenExpiresAt?: string;
+    sessionId: string;
+}
+export interface OAuthDeviceSessionLookup {
+    findByDeviceCode(deviceCode: string): OAuthDeviceSession | null;
+    consume(sessionId: string): void;
+}
+export type OAuthTokenResult = {
+    status: 200 | 400 | 401;
+    body: Record<string, unknown>;
+    headers: Record<string, string>;
+};
+export interface OAuthTokenContractInput {
+    body: URLSearchParams;
+    authorizationHeader?: string | null;
+    tokenStore: OAuthTokenStorePort;
+    controlPlaneSecret?: string;
+    deviceSessions?: OAuthDeviceSessionLookup;
+    randomToken: () => string;
+    now?: () => Date;
+    safeCompare?: (left: string, right: string) => boolean;
+}
+export declare function parseOAuthBasicAuth(headerValue: string | null | undefined): {
+    clientId: string;
+    clientSecret: string;
+} | null;
+export declare function oauthTokenContract(input: OAuthTokenContractInput): Promise<OAuthTokenResult>;
+//# sourceMappingURL=oauth.d.ts.map

package/dist/contracts/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../src/contracts/oauth.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,uBAAuB,iDACY,CAAC;AAEjD,eAAO,MAAM,8BAA8B,QAAoB,CAAC;AAEhE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CACN,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAA;KAAE,GAC7C,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,wBAAwB;IACvC,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAAC;IAChE,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC,CAAC;AAEF,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,eAAe,CAAC;IACtB,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,UAAU,EAAE,mBAAmB,CAAC;IAChC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAC1C,WAAW,EAAE,MAAM,MAAM,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;CACxD;AAiDD,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACrC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAanD;AAMD,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,gBAAgB,CAAC,CAgB3B"}

package/dist/contracts/oauth.js

@@ -0,0 +1,130 @@
+export const OAUTH_DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+export const OAUTH_ACCESS_TOKEN_TTL_SECONDS = 30 * 24 * 60 * 60;
+const NO_STORE_HEADERS = {
+    "Cache-Control": "no-store",
+    Pragma: "no-cache",
+};
+function oauthError(error, description, status = 400) {
+    return {
+        status,
+        body: {
+            error,
+            error_description: description,
+        },
+        headers: NO_STORE_HEADERS,
+    };
+}
+function defaultSafeCompare(left, right) {
+    const leftBytes = new TextEncoder().encode(left);
+    const rightBytes = new TextEncoder().encode(right);
+    const length = Math.max(leftBytes.length, rightBytes.length);
+    let diff = leftBytes.length ^ rightBytes.length;
+    for (let index = 0; index < length; index += 1) {
+        diff |= (leftBytes[index] ?? 0) ^ (rightBytes[index] ?? 0);
+    }
+    return diff === 0;
+}
+function decodeBase64(input) {
+    if (typeof atob === "function") {
+        return atob(input);
+    }
+    throw new Error("Base64 decoding is not available in this runtime");
+}
+export function parseOAuthBasicAuth(headerValue) {
+    if (!headerValue?.startsWith("Basic "))
+        return null;
+    const decoded = decodeBase64(headerValue.slice(6));
+    const separatorIndex = decoded.indexOf(":");
+    if (separatorIndex === -1)
+        return null;
+    try {
+        return {
+            clientId: decodeURIComponent(decoded.slice(0, separatorIndex)),
+            clientSecret: decodeURIComponent(decoded.slice(separatorIndex + 1)),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function asNonEmpty(value) {
+    return value && value.length > 0 ? value : null;
+}
+export async function oauthTokenContract(input) {
+    const grantType = asNonEmpty(input.body.get("grant_type"));
+    if (!grantType) {
+        return oauthError("invalid_request", "Missing grant_type");
+    }
+    if (grantType === "client_credentials") {
+        return handleClientCredentials(input);
+    }
+    if (grantType === OAUTH_DEVICE_CODE_GRANT) {
+        return handleDeviceCode(input);
+    }
+    return oauthError("unsupported_grant_type", `Grant type '${grantType}' is not supported`);
+}
+async function handleClientCredentials(input) {
+    if (!input.controlPlaneSecret) {
+        return oauthError("unauthorized_client", "Server is not configured for client_credentials", 401);
+    }
+    const fromHeader = parseOAuthBasicAuth(input.authorizationHeader);
+    const clientId = fromHeader?.clientId ?? asNonEmpty(input.body.get("client_id"));
+    const clientSecret = fromHeader?.clientSecret ?? asNonEmpty(input.body.get("client_secret"));
+    if (!clientId || !clientSecret) {
+        return oauthError("invalid_client", "Missing client credentials", 401);
+    }
+    if (clientId !== "control-plane") {
+        return oauthError("invalid_client", `Unknown client_id '${clientId}'`, 401);
+    }
+    if (!(input.safeCompare ?? defaultSafeCompare)(clientSecret, input.controlPlaneSecret)) {
+        return oauthError("invalid_client", "Invalid client_secret", 401);
+    }
+    const accessToken = input.randomToken();
+    const expiresAt = new Date((input.now ?? (() => new Date()))().getTime() +
+        OAUTH_ACCESS_TOKEN_TTL_SECONDS * 1000).toISOString();
+    await input.tokenStore.addToken(accessToken, { expiresAt });
+    return {
+        status: 200,
+        body: {
+            access_token: accessToken,
+            token_type: "Bearer",
+            expires_in: OAUTH_ACCESS_TOKEN_TTL_SECONDS,
+        },
+        headers: NO_STORE_HEADERS,
+    };
+}
+async function handleDeviceCode(input) {
+    if (!input.deviceSessions) {
+        return oauthError("unsupported_grant_type", "Device flow is not configured on this server");
+    }
+    const deviceCode = asNonEmpty(input.body.get("device_code"));
+    if (!deviceCode) {
+        return oauthError("invalid_request", "Missing device_code");
+    }
+    const session = input.deviceSessions.findByDeviceCode(deviceCode);
+    if (!session) {
+        return oauthError("expired_token", "Device code is expired or unknown");
+    }
+    if (session.status === "expired") {
+        return oauthError("expired_token", "Device code is expired");
+    }
+    if (session.status === "pending" || !session.accessToken) {
+        return oauthError("authorization_pending", "User has not yet approved the device");
+    }
+    const expiresInSeconds = session.accessTokenExpiresAt
+        ? Math.max(1, Math.floor((Date.parse(session.accessTokenExpiresAt) -
+            (input.now ?? (() => new Date()))().getTime()) /
+            1000))
+        : OAUTH_ACCESS_TOKEN_TTL_SECONDS;
+    input.deviceSessions.consume(session.sessionId);
+    return {
+        status: 200,
+        body: {
+            access_token: session.accessToken,
+            token_type: "Bearer",
+            expires_in: expiresInSeconds,
+        },
+        headers: NO_STORE_HEADERS,
+    };
+}
+//# sourceMappingURL=oauth.js.map

package/dist/contracts/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/contracts/oauth.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,uBAAuB,GAClC,8CAA8C,CAAC;AAEjD,MAAM,CAAC,MAAM,8BAA8B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AA+ChE,MAAM,gBAAgB,GAAG;IACvB,eAAe,EAAE,UAAU;IAC3B,MAAM,EAAE,UAAU;CACnB,CAAC;AAEF,SAAS,UAAU,CACjB,KAAiB,EACjB,WAAmB,EACnB,SAAoB,GAAG;IAEvB,OAAO;QACL,MAAM;QACN,IAAI,EAAE;YACJ,KAAK;YACL,iBAAiB,EAAE,WAAW;SAC/B;QACD,OAAO,EAAE,gBAAgB;KAC1B,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY,EAAE,KAAa;IACrD,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAC7D,IAAI,IAAI,GAAG,SAAS,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IAChD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC/C,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,WAAsC;IAEtC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,MAAM,OAAO,GAAG,YAAY,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,cAAc,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,CAAC;QACH,OAAO;YACL,QAAQ,EAAE,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;YAC9D,YAAY,EAAE,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC;SACpE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAoB;IACtC,OAAO,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAA8B;IAE9B,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;IAC3D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,UAAU,CAAC,iBAAiB,EAAE,oBAAoB,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;QACvC,OAAO,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,SAAS,KAAK,uBAAuB,EAAE,CAAC;QAC1C,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,UAAU,CACf,wBAAwB,EACxB,eAAe,SAAS,oBAAoB,CAC7C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,KAA8B;IAE9B,IAAI,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAC9B,OAAO,UAAU,CACf,qBAAqB,EACrB,iDAAiD,EACjD,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAClE,MAAM,QAAQ,GACZ,UAAU,EAAE,QAAQ,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;IAClE,MAAM,YAAY,GAChB,UAAU,EAAE,YAAY,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;IAE1E,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;QAC/B,OAAO,UAAU,CAAC,gBAAgB,EAAE,4BAA4B,EAAE,GAAG,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;QACjC,OAAO,UAAU,CAAC,gBAAgB,EAAE,sBAAsB,QAAQ,GAAG,EAAE,GAAG,CAAC,CAAC;IAC9E,CAAC;IACD,IACE,CAAC,CAAC,KAAK,CAAC,WAAW,IAAI,kBAAkB,CAAC,CACxC,YAAY,EACZ,KAAK,CAAC,kBAAkB,CACzB,EACD,CAAC;QACD,OAAO,UAAU,CAAC,gBAAgB,EAAE,uBAAuB,EAAE,GAAG,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACxC,MAAM,SAAS,GAAG,IAAI,IAAI,CACxB,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3C,8BAA8B,GAAG,IAAI,CACxC,CAAC,WAAW,EAAE,CAAC;IAEhB,MAAM,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IAC5D,OAAO;QACL,MAAM,EAAE,GAAG;QACX,IAAI,EAAE;YACJ,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,8BAA8B;SAC3C;QACD,OAAO,EAAE,gBAAgB;KAC1B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,KAA8B;IAE9B,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,OAAO,UAAU,CACf,wBAAwB,EACxB,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IAC7D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,UAAU,CAAC,iBAAiB,EAAE,qBAAqB,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,cAAc,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAClE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,UAAU,CAAC,eAAe,EAAE,mCAAmC,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,UAAU,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzD,OAAO,UAAU,CACf,uBAAuB,EACvB,sCAAsC,CACvC,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAAG,OAAO,CAAC,oBAAoB;QACnD,CAAC,CAAC,IAAI,CAAC,GAAG,CACN,CAAC,EACD,IAAI,CAAC,KAAK,CACR,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC;YACvC,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;YAC9C,IAAI,CACP,CACF;QACH,CAAC,CAAC,8BAA8B,CAAC;IAEnC,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChD,OAAO;QACL,MAAM,EAAE,GAAG;QACX,IAAI,EAAE;YACJ,YAAY,EAAE,OAAO,CAAC,WAAW;YACjC,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,gBAAgB;SAC7B;QACD,OAAO,EAAE,gBAAgB;KAC1B,CAAC;AACJ,CAAC"}

package/dist/contracts/sync.d.ts

@@ -0,0 +1,10 @@
+import type { SyncManager, SyncStatus } from "../sync/index.js";
+import { type ContractResult } from "./http.js";
+export interface SyncFileContractInput {
+    syncManager: Pick<SyncManager, "trigger"> | null;
+    fileId: string;
+}
+export declare function triggerSyncContract(syncManager: Pick<SyncManager, "trigger"> | null): Promise<ContractResult>;
+export declare function getSyncStatusContract(syncManager: Pick<SyncManager, "getStatus"> | null): ContractResult<SyncStatus>;
+export declare function syncFileContract(input: SyncFileContractInput): Promise<ContractResult>;
+//# sourceMappingURL=sync.d.ts.map

package/dist/contracts/sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../src/contracts/sync.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAc,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAE5D,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,IAAI,CAAC;IACjD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,mBAAmB,CACvC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,IAAI,GAC/C,OAAO,CAAC,cAAc,CAAC,CAMzB;AAED,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,GAAG,IAAI,GACjD,cAAc,CAAC,UAAU,CAAC,CAa5B;AAED,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,cAAc,CAAC,CAUzB"}

package/dist/contracts/sync.js

@@ -0,0 +1,34 @@
+import { contractOk } from "./http.js";
+export async function triggerSyncContract(syncManager) {
+    if (!syncManager) {
+        return contractOk({ status: "disabled", message: "Sync is not enabled" });
+    }
+    void syncManager.trigger().catch(() => undefined);
+    return contractOk({ status: "started", message: "Sync triggered" }, 202);
+}
+export function getSyncStatusContract(syncManager) {
+    if (!syncManager) {
+        return contractOk({
+            enabled: false,
+            running: false,
+            syncing: false,
+            lastSync: null,
+            lastProcessedTimestamp: null,
+            pendingFiles: 0,
+            errors: [],
+        });
+    }
+    return contractOk(syncManager.getStatus());
+}
+export async function syncFileContract(input) {
+    if (!input.syncManager) {
+        return contractOk({
+            fileId: input.fileId,
+            status: "disabled",
+            message: "Sync is not enabled",
+        });
+    }
+    void input.syncManager.trigger().catch(() => undefined);
+    return contractOk({ fileId: input.fileId, status: "started" }, 202);
+}
+//# sourceMappingURL=sync.js.map

package/dist/contracts/sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync.js","sourceRoot":"","sources":["../../src/contracts/sync.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAuB,MAAM,WAAW,CAAC;AAO5D,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,WAAgD;IAEhD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,UAAU,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,KAAK,WAAW,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAClD,OAAO,UAAU,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,WAAkD;IAElD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,UAAU,CAAC;YAChB,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,IAAI;YACd,sBAAsB,EAAE,IAAI;YAC5B,YAAY,EAAE,CAAC;YACf,MAAM,EAAE,EAAE;SACX,CAAC,CAAC;IACL,CAAC;IACD,OAAO,UAAU,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAA4B;IAE5B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACvB,OAAO,UAAU,CAAC;YAChB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,qBAAqB;SAC/B,CAAC,CAAC;IACL,CAAC;IACD,KAAK,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACxD,OAAO,UAAU,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC;AACtE,CAAC"}

package/dist/derivatives/api.d.ts

@@ -0,0 +1,48 @@
+/**
+ * HTTP surface of the compute layer, mounted under `/v1/derivatives`:
+ *
+ *   POST   /questions                 register (builder write auth or owner)
+ *   GET    /questions                 list (owner; builder with ?derivedScope=)
+ *   GET    /questions/:id             status (owner or the registering builder)
+ *   POST   /questions/:id/recompute   owner or the registering builder
+ *   DELETE /questions/:id             owner or the registering builder
+ *
+ * Builder authentication is the Write API's: a write-session bearer token
+ * plus the X-Vana-Write-Signature proof over the request, authorized for
+ * `write:<derivedScope>` (api-auth authorizeWrite). No new credential.
+ *
+ * The proof signs the request URI INCLUDING its query string (see
+ * canonicalSignedUri in write/attribution.ts), because on the list route the
+ * query decides the authorization: `?derivedScope=X` is the scope the caller
+ * is authorized against, and a proof that did not commit to it could be
+ * captured on one scope and replayed on another.
+ */
+import type { PersonalServerApiAuthPort, PersonalServerApiDispatchOptions } from "../api/index.js";
+import type { RecomputeScheduler } from "./scheduler.js";
+import { type QuestionStore } from "./types.js";
+/** Registration bodies are small; anything larger is refused up front. */
+export declare const MAX_QUESTION_BODY_BYTES: number;
+export interface PersonalServerDerivativesApiDeps {
+    auth: Pick<PersonalServerApiAuthPort, "authorizeOwner" | "authorizeWrite" | "authorizeWriteSession" | "authorizeBuilderRead">;
+    /** Absent = the compute layer is not wired; every route answers 503. */
+    compute?: {
+        store: QuestionStore;
+        scheduler: Pick<RecomputeScheduler, "requestRecompute" | "markSourceChanged"> & {
+            /**
+             * Next scheduled automatic retry of a failed question (ISO time), or
+             * null. Optional so a minimal scheduler stays a valid dependency; the
+             * status route then reports no retry.
+             */
+            nextRetryAt?(questionId: string): string | null;
+            /** True while a retry compute is running (timer fired, not settled). */
+            retryInFlight?(questionId: string): boolean;
+        };
+    } | null;
+    now?: () => Date;
+    createQuestionId?: () => string;
+    logger?: {
+        info?(payload: Record<string, unknown>, message: string): void;
+    };
+}
+export declare function handlePersonalServerDerivativesRequest(request: Request, deps: PersonalServerDerivativesApiDeps, options?: PersonalServerApiDispatchOptions): Promise<Response>;
+//# sourceMappingURL=api.d.ts.map

package/dist/derivatives/api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/derivatives/api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAaH,OAAO,KAAK,EACV,yBAAyB,EACzB,gCAAgC,EAGjC,MAAM,iBAAiB,CAAC;AAMzB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,YAAY,CAAC;AAEpB,0EAA0E;AAC1E,eAAO,MAAM,uBAAuB,QAAY,CAAC;AAKjD,MAAM,WAAW,gCAAgC;IAC/C,IAAI,EAAE,IAAI,CACR,yBAAyB,EACvB,gBAAgB,GAChB,gBAAgB,GAChB,uBAAuB,GACvB,sBAAsB,CACzB,CAAC;IACF,wEAAwE;IACxE,OAAO,CAAC,EAAE;QACR,KAAK,EAAE,aAAa,CAAC;QACrB,SAAS,EAAE,IAAI,CACb,kBAAkB,EAClB,kBAAkB,GAAG,mBAAmB,CACzC,GAAG;YACF;;;;eAIG;YACH,WAAW,CAAC,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;YAChD,wEAAwE;YACxE,aAAa,CAAC,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;SAC7C,CAAC;KACH,GAAG,IAAI,CAAC;IACT,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,MAAM,CAAC;IAChC,MAAM,CAAC,EAAE;QACP,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;KAChE,CAAC;CACH;AAuOD,wBAAsB,sCAAsC,CAC1D,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,gCAAgC,EACtC,OAAO,GAAE,gCAAqC,GAC7C,OAAO,CAAC,QAAQ,CAAC,CAqMnB"}