@opendatalabs/personal-server-ts-core 0.0.1-canary.a9babfc → 0.0.1-canary.b033bdb

package/dist/api/index.d.ts

@@ -0,0 +1,84 @@
+import type { AccessLogWriter } from "../logging/access-log.js";
+import type { AccessLogReader } from "../logging/access-reader.js";
+import { type DataStoragePort, type RuntimeAvailabilityPort, type SchemaResolverPort, type FeeVerifierPort } from "../ports/index.js";
+import type { DataReadPolicyPorts } from "../policy/index.js";
+import type { SyncManager } from "../sync/index.js";
+import { type OAuthDeviceSessionLookup, type OAuthTokenStorePort } from "../contracts/index.js";
+import type { DataPortabilityGatewayConfig, GatewayClient } from "@opendatalabs/vana-sdk/browser";
+import type { ServerSigner } from "../signing/index.js";
+export interface PersonalServerReadAuthInput {
+    request: Request;
+    scope: string;
+    grantId?: string;
+    fileId?: string;
+}
+export interface PersonalServerReadAuthResult {
+    builder?: `0x${string}` | string;
+    grantId?: string;
+}
+export interface PersonalServerApiAuthPort {
+    authorizeOwner(request: Request): Promise<void>;
+    authorizeBuilderList(request: Request): Promise<void>;
+    authorizeBuilderRead(input: PersonalServerReadAuthInput): Promise<PersonalServerReadAuthResult | void>;
+}
+export interface PersonalServerApiLogger {
+    info?(payload: Record<string, unknown>, message: string): void;
+    error?(payload: Record<string, unknown>, message: string): void;
+}
+export interface PersonalServerIngestSyncManager {
+    trigger(): Promise<void>;
+    notifyNewData?(): void;
+}
+export interface PersonalServerDataApiDeps {
+    storage: DataStoragePort;
+    auth: PersonalServerApiAuthPort;
+    schemaResolver?: SchemaResolverPort;
+    accessLogWriter: AccessLogWriter;
+    syncManager?: PersonalServerIngestSyncManager | null;
+    runtimeAvailability?: RuntimeAvailabilityPort;
+    feeVerifier?: FeeVerifierPort;
+    now?: () => Date;
+    createLogId?: () => string;
+    logger?: PersonalServerApiLogger;
+}
+export interface PersonalServerAccessLogsApiDeps {
+    auth: Pick<PersonalServerApiAuthPort, "authorizeOwner">;
+    accessLogReader: AccessLogReader;
+}
+export interface PersonalServerSyncApiDeps {
+    auth: Pick<PersonalServerApiAuthPort, "authorizeOwner">;
+    syncManager: Pick<SyncManager, "trigger" | "getStatus"> | null;
+    logger?: PersonalServerApiLogger;
+}
+export interface PersonalServerGrantsApiDeps {
+    auth: Pick<PersonalServerApiAuthPort, "authorizeOwner">;
+    gateway?: Pick<GatewayClient, "getBuilder" | "createGrant" | "listGrantsByUser">;
+    gatewayConfig?: DataPortabilityGatewayConfig;
+    serverOwner?: `0x${string}`;
+    serverSigner?: Pick<ServerSigner, "signGrantRegistration">;
+    now?: () => Date;
+}
+export interface PersonalServerConfigApiDeps {
+    auth: Pick<PersonalServerApiAuthPort, "authorizeOwner">;
+    readConfig(): Promise<unknown>;
+    writeConfig(config: unknown): Promise<void>;
+}
+export interface PersonalServerOauthTokenApiDeps {
+    tokenStore: OAuthTokenStorePort;
+    controlPlaneSecret?: string;
+    deviceSessions?: OAuthDeviceSessionLookup;
+    randomToken(): string;
+    now?: () => Date;
+    safeCompare?: (left: string, right: string) => boolean;
+}
+export interface PersonalServerApiDispatchOptions {
+    basePath?: string;
+}
+export declare function handlePersonalServerDataRequest(request: Request, deps: PersonalServerDataApiDeps, options?: PersonalServerApiDispatchOptions): Promise<Response>;
+export declare function handlePersonalServerAccessLogsRequest(request: Request, deps: PersonalServerAccessLogsApiDeps, options?: PersonalServerApiDispatchOptions): Promise<Response>;
+export declare function handlePersonalServerSyncRequest(request: Request, deps: PersonalServerSyncApiDeps, options?: PersonalServerApiDispatchOptions): Promise<Response>;
+export declare function handlePersonalServerGrantsRequest(request: Request, deps: PersonalServerGrantsApiDeps, options?: PersonalServerApiDispatchOptions): Promise<Response>;
+export declare function handlePersonalServerConfigRequest(request: Request, deps: PersonalServerConfigApiDeps): Promise<Response>;
+export declare function handlePersonalServerOauthTokenRequest(request: Request, deps: PersonalServerOauthTokenApiDeps): Promise<Response>;
+export type { DataReadPolicyPorts };
+//# sourceMappingURL=index.d.ts.map

package/dist/api/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAmBL,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EAIzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EACV,4BAA4B,EAC5B,aAAa,EACd,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,CAAC,EAAE,KAAK,MAAM,EAAE,GAAG,MAAM,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,yBAAyB;IACxC,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,oBAAoB,CAClB,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC,CAAC;CACjD;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/D,KAAK,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjE;AAED,MAAM,WAAW,+BAA+B;IAC9C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,aAAa,CAAC,IAAI,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,eAAe,CAAC;IACzB,IAAI,EAAE,yBAAyB,CAAC;IAChC,cAAc,CAAC,EAAE,kBAAkB,CAAC;IACpC,eAAe,EAAE,eAAe,CAAC;IACjC,WAAW,CAAC,EAAE,+BAA+B,GAAG,IAAI,CAAC;IACrD,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;IAC9C,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,uBAAuB,CAAC;CAClC;AAED,MAAM,WAAW,+BAA+B;IAC9C,IAAI,EAAE,IAAI,CAAC,yBAAyB,EAAE,gBAAgB,CAAC,CAAC;IACxD,eAAe,EAAE,eAAe,CAAC;CAClC;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,IAAI,CAAC,yBAAyB,EAAE,gBAAgB,CAAC,CAAC;IACxD,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,GAAG,WAAW,CAAC,GAAG,IAAI,CAAC;IAC/D,MAAM,CAAC,EAAE,uBAAuB,CAAC;CAClC;AAED,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,IAAI,CAAC,yBAAyB,EAAE,gBAAgB,CAAC,CAAC;IACxD,OAAO,CAAC,EAAE,IAAI,CACZ,aAAa,EACb,YAAY,GAAG,aAAa,GAAG,kBAAkB,CAClD,CAAC;IACF,aAAa,CAAC,EAAE,4BAA4B,CAAC;IAC7C,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,YAAY,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,uBAAuB,CAAC,CAAC;IAC3D,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,IAAI,CAAC,yBAAyB,EAAE,gBAAgB,CAAC,CAAC;IACxD,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/B,WAAW,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,+BAA+B;IAC9C,UAAU,EAAE,mBAAmB,CAAC;IAChC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAC1C,WAAW,IAAI,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;CACxD;AAED,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AA4JD,wBAAsB,+BAA+B,CACnD,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,yBAAyB,EAC/B,OAAO,GAAE,gCAAqC,GAC7C,OAAO,CAAC,QAAQ,CAAC,CA2HnB;AAED,wBAAsB,qCAAqC,CACzD,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,+BAA+B,EACrC,OAAO,GAAE,gCAAqC,GAC7C,OAAO,CAAC,QAAQ,CAAC,CAenB;AAED,wBAAsB,+BAA+B,CACnD,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,yBAAyB,EAC/B,OAAO,GAAE,gCAAqC,GAC7C,OAAO,CAAC,QAAQ,CAAC,CAmCnB;AAED,wBAAsB,iCAAiC,CACrD,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,2BAA2B,EACjC,OAAO,GAAE,gCAAqC,GAC7C,OAAO,CAAC,QAAQ,CAAC,CAoDnB;AAED,wBAAsB,iCAAiC,CACrD,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,2BAA2B,GAChC,OAAO,CAAC,QAAQ,CAAC,CA8BnB;AAED,wBAAsB,qCAAqC,CACzD,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,+BAA+B,GACpC,OAAO,CAAC,QAAQ,CAAC,CA6BnB;AAED,YAAY,EAAE,mBAAmB,EAAE,CAAC"}

package/dist/api/index.js

@@ -0,0 +1,383 @@
+import { ProtocolError } from "../errors/catalog.js";
+import { deleteDataScopeContract, ingestDataContract, listAccessLogsContract, listDataScopesContract, listDataVersionsContract, parseDataScopeContract, parseJsonObjectBody, readDataContract, syncFileContract, triggerSyncContract, getSyncStatusContract, configReadErrorContract, configWriteErrorContract, createGrantContract, listGrantsContract, oauthTokenContract, validateServerConfigContract, verifyGrantContract, } from "../contracts/index.js";
+function jsonResponse(body, init) {
+    const headers = new Headers(init?.headers);
+    headers.set("Content-Type", "application/json");
+    return new Response(JSON.stringify(body), { ...init, headers });
+}
+function contractResponse(result) {
+    return jsonResponse(result.body, { status: result.status });
+}
+function contractErrorResponse(err) {
+    return jsonResponse(err.body, { status: err.status });
+}
+function protocolErrorResponse(err) {
+    return jsonResponse(err.toJSON(), { status: err.code });
+}
+function errorResponse(status, errorCode, message) {
+    return jsonResponse({
+        error: {
+            code: status,
+            errorCode,
+            message,
+        },
+    }, { status });
+}
+function methodNotAllowed() {
+    return errorResponse(405, "METHOD_NOT_ALLOWED", "Method not allowed");
+}
+function notFound() {
+    return errorResponse(404, "NOT_FOUND", "Not found");
+}
+async function withApiErrors(handler) {
+    try {
+        return await handler();
+    }
+    catch (err) {
+        if (err instanceof ProtocolError) {
+            return protocolErrorResponse(err);
+        }
+        return errorResponse(500, "INTERNAL_ERROR", "Internal server error");
+    }
+}
+function normalizeLimit(value, fallback) {
+    if (value === null)
+        return fallback;
+    const parsed = Number(value);
+    return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
+}
+function stripBasePath(pathname, basePath) {
+    if (!basePath || basePath === "/")
+        return pathname;
+    if (pathname === basePath)
+        return "/";
+    if (pathname.startsWith(`${basePath}/`)) {
+        return pathname.slice(basePath.length);
+    }
+    return pathname;
+}
+function decodePathPart(value) {
+    return decodeURIComponent(value ?? "");
+}
+function selectedGrantId(request, url) {
+    return (url.searchParams.get("grantId") ??
+        request.headers.get("x-ps-grant-id") ??
+        undefined);
+}
+function collectedAt(now) {
+    return now()
+        .toISOString()
+        .replace(/\.\d{3}Z$/, "Z");
+}
+async function resolveSchema(deps, scope) {
+    if (!deps.schemaResolver) {
+        return {
+            ok: false,
+            response: errorResponse(500, "SERVER_NOT_CONFIGURED", "Gateway is not configured"),
+        };
+    }
+    try {
+        const schema = await deps.schemaResolver.getSchemaForScope(scope);
+        if (!schema) {
+            return {
+                ok: false,
+                response: jsonResponse({
+                    error: "NO_SCHEMA",
+                    message: `No schema registered for scope: ${scope}`,
+                }, { status: 400 }),
+            };
+        }
+        return {
+            ok: true,
+            schemaUrl: schema.definitionUrl,
+            schemaId: schema.id,
+        };
+    }
+    catch (err) {
+        deps.logger?.error?.({ err, scope }, "Gateway schema lookup failed");
+        return {
+            ok: false,
+            response: jsonResponse({
+                error: "GATEWAY_ERROR",
+                message: "Failed to look up schema for scope",
+            }, { status: 502 }),
+        };
+    }
+}
+function notifyNewData(syncManager) {
+    if (!syncManager)
+        return;
+    if (syncManager.notifyNewData) {
+        syncManager.notifyNewData();
+        return;
+    }
+    void syncManager.trigger().catch(() => undefined);
+}
+export async function handlePersonalServerDataRequest(request, deps, options = {}) {
+    return withApiErrors(async () => {
+        const url = new URL(request.url);
+        const pathname = stripBasePath(url.pathname, options.basePath);
+        if (pathname === "/" || pathname === "") {
+            if (request.method !== "GET")
+                return methodNotAllowed();
+            await deps.auth.authorizeBuilderList(request);
+            const result = listDataScopesContract({
+                storage: deps.storage,
+                scopePrefix: url.searchParams.get("scopePrefix") ?? undefined,
+                limit: normalizeLimit(url.searchParams.get("limit"), 20),
+                offset: normalizeLimit(url.searchParams.get("offset"), 0),
+            });
+            return jsonResponse(result.response);
+        }
+        const parts = pathname.split("/").filter(Boolean);
+        if (parts.length === 2 && parts[1] === "versions") {
+            if (request.method !== "GET")
+                return methodNotAllowed();
+            await deps.auth.authorizeBuilderList(request);
+            const result = listDataVersionsContract({
+                storage: deps.storage,
+                scopeParam: decodePathPart(parts[0]),
+                limit: normalizeLimit(url.searchParams.get("limit"), 20),
+                offset: normalizeLimit(url.searchParams.get("offset"), 0),
+            });
+            if (!result.ok)
+                return contractErrorResponse(result);
+            return jsonResponse(result.response);
+        }
+        if (parts.length !== 1)
+            return notFound();
+        const scopeParam = decodePathPart(parts[0]);
+        if (request.method === "GET") {
+            const scopeResult = parseDataScopeContract(scopeParam);
+            if (!scopeResult.ok)
+                return contractErrorResponse(scopeResult);
+            const selectedEntry = deps.storage.findEntry({
+                scope: scopeResult.scope,
+                fileId: url.searchParams.get("fileId") ?? undefined,
+                at: url.searchParams.get("at") ?? undefined,
+            });
+            const grantId = selectedGrantId(request, url);
+            const authResult = await deps.auth.authorizeBuilderRead({
+                request,
+                scope: scopeResult.scope,
+                grantId,
+                fileId: url.searchParams.get("fileId") ?? selectedEntry?.fileId ?? undefined,
+            });
+            const result = await readDataContract({
+                storage: deps.storage,
+                scopeParam: scopeResult.scope,
+                fileId: url.searchParams.get("fileId") ?? undefined,
+                at: url.searchParams.get("at") ?? undefined,
+            });
+            if (!result.ok)
+                return contractErrorResponse(result);
+            await deps.accessLogWriter.write({
+                logId: deps.createLogId?.() ?? crypto.randomUUID(),
+                grantId: authResult?.grantId ?? grantId ?? "unknown",
+                builder: authResult?.builder ?? "unknown",
+                action: "read",
+                scope: scopeResult.scope,
+                timestamp: (deps.now ?? (() => new Date()))().toISOString(),
+                ipAddress: request.headers.get("x-forwarded-for") ??
+                    request.headers.get("x-real-ip") ??
+                    "unknown",
+                userAgent: request.headers.get("user-agent") ?? "unknown",
+            });
+            return jsonResponse(result.envelope);
+        }
+        if (request.method === "POST") {
+            await deps.auth.authorizeOwner(request);
+            const scopeResult = parseDataScopeContract(scopeParam);
+            if (!scopeResult.ok)
+                return contractErrorResponse(scopeResult);
+            const parsed = await parseJsonObjectBody(request, "Request body must be valid JSON");
+            if (!parsed.ok)
+                return contractResponse(parsed.result);
+            const schema = await resolveSchema(deps, scopeResult.scope);
+            if (!schema.ok)
+                return schema.response;
+            const collectedAtValue = collectedAt(deps.now ?? (() => new Date()));
+            const result = await ingestDataContract({
+                storage: deps.storage,
+                scopeParam: scopeResult.scope,
+                body: parsed.body,
+                collectedAt: collectedAtValue,
+                status: deps.syncManager ? "syncing" : "stored",
+                schemaUrl: schema.schemaUrl,
+                schemaId: schema.schemaId,
+            });
+            if (!result.ok)
+                return contractErrorResponse(result);
+            deps.logger?.info?.({
+                scope: scopeResult.scope,
+                collectedAt: collectedAtValue,
+                path: result.writeResult.relativePath,
+            }, "Data file ingested");
+            notifyNewData(deps.syncManager);
+            return jsonResponse(result.response, { status: 201 });
+        }
+        if (request.method === "DELETE") {
+            await deps.auth.authorizeOwner(request);
+            const result = await deleteDataScopeContract({
+                storage: deps.storage,
+                scopeParam,
+            });
+            if (!result.ok)
+                return contractErrorResponse(result);
+            deps.logger?.info?.({ scope: scopeParam, deletedCount: result.deletedCount }, "Scope deleted");
+            return new Response(null, { status: 204 });
+        }
+        return methodNotAllowed();
+    });
+}
+export async function handlePersonalServerAccessLogsRequest(request, deps, options = {}) {
+    return withApiErrors(async () => {
+        const url = new URL(request.url);
+        const pathname = stripBasePath(url.pathname, options.basePath);
+        if (pathname !== "/" && pathname !== "")
+            return notFound();
+        if (request.method !== "GET")
+            return methodNotAllowed();
+        await deps.auth.authorizeOwner(request);
+        return contractResponse(await listAccessLogsContract({
+            accessLogReader: deps.accessLogReader,
+            limit: url.searchParams.get("limit"),
+            offset: url.searchParams.get("offset"),
+        }));
+    });
+}
+export async function handlePersonalServerSyncRequest(request, deps, options = {}) {
+    return withApiErrors(async () => {
+        const url = new URL(request.url);
+        const pathname = stripBasePath(url.pathname, options.basePath);
+        if (pathname === "/trigger") {
+            if (request.method !== "POST")
+                return methodNotAllowed();
+            await deps.auth.authorizeOwner(request);
+            return contractResponse(await triggerSyncContract(deps.syncManager));
+        }
+        if (pathname === "/status") {
+            if (request.method !== "GET")
+                return methodNotAllowed();
+            await deps.auth.authorizeOwner(request);
+            return contractResponse(getSyncStatusContract(deps.syncManager));
+        }
+        if (pathname.startsWith("/file/")) {
+            if (request.method !== "POST")
+                return methodNotAllowed();
+            await deps.auth.authorizeOwner(request);
+            const fileId = decodeURIComponent(pathname.slice("/file/".length));
+            deps.logger?.info?.({ fileId }, "File sync requested, triggering full sync");
+            return contractResponse(await syncFileContract({
+                fileId,
+                syncManager: deps.syncManager,
+            }));
+        }
+        return notFound();
+    });
+}
+export async function handlePersonalServerGrantsRequest(request, deps, options = {}) {
+    return withApiErrors(async () => {
+        const url = new URL(request.url);
+        const pathname = stripBasePath(url.pathname, options.basePath);
+        if (pathname === "/" || pathname === "") {
+            await deps.auth.authorizeOwner(request);
+            if (!deps.gateway) {
+                return errorResponse(500, "SERVER_NOT_CONFIGURED", "Gateway is not configured");
+            }
+            if (request.method === "GET") {
+                return contractResponse(await listGrantsContract({
+                    gateway: deps.gateway,
+                    serverOwner: deps.serverOwner,
+                }));
+            }
+            if (request.method === "POST") {
+                const parsed = await parseJsonObjectBody(request);
+                if (!parsed.ok)
+                    return contractResponse(parsed.result);
+                return contractResponse(await createGrantContract({
+                    gateway: deps.gateway,
+                    serverOwner: deps.serverOwner,
+                    serverSigner: deps.serverSigner,
+                    body: parsed.body,
+                    now: () => deps.now?.().getTime() ?? Date.now(),
+                }));
+            }
+            return methodNotAllowed();
+        }
+        if (pathname === "/verify") {
+            if (request.method !== "POST")
+                return methodNotAllowed();
+            const parsed = await parseJsonObjectBody(request);
+            if (!parsed.ok)
+                return contractResponse(parsed.result);
+            return contractResponse(await verifyGrantContract({
+                body: parsed.body,
+                gatewayConfig: deps.gatewayConfig,
+            }));
+        }
+        return notFound();
+    });
+}
+export async function handlePersonalServerConfigRequest(request, deps) {
+    return withApiErrors(async () => {
+        await deps.auth.authorizeOwner(request);
+        if (request.method === "GET") {
+            try {
+                return jsonResponse(await deps.readConfig());
+            }
+            catch (err) {
+                const kind = err instanceof Error &&
+                    "code" in err &&
+                    err.code === "ENOENT"
+                    ? "not-found"
+                    : "read";
+                return contractResponse(configReadErrorContract(kind));
+            }
+        }
+        if (request.method === "PUT") {
+            const parsed = await parseJsonObjectBody(request);
+            if (!parsed.ok)
+                return contractResponse(parsed.result);
+            const result = validateServerConfigContract(parsed.body);
+            if (!result.ok)
+                return contractResponse(result);
+            try {
+                await deps.writeConfig(result.body.config);
+            }
+            catch {
+                return contractResponse(configWriteErrorContract());
+            }
+            return contractResponse(result);
+        }
+        return methodNotAllowed();
+    });
+}
+export async function handlePersonalServerOauthTokenRequest(request, deps) {
+    return withApiErrors(async () => {
+        if (request.method !== "POST")
+            return methodNotAllowed();
+        const contentType = request.headers.get("content-type") ?? "";
+        if (!contentType.includes("application/x-www-form-urlencoded")) {
+            return jsonResponse({
+                error: "invalid_request",
+                error_description: "Content-Type must be application/x-www-form-urlencoded",
+            }, { status: 400 });
+        }
+        const result = await oauthTokenContract({
+            body: new URLSearchParams(await request.text()),
+            authorizationHeader: request.headers.get("authorization"),
+            tokenStore: deps.tokenStore,
+            controlPlaneSecret: deps.controlPlaneSecret,
+            deviceSessions: deps.deviceSessions,
+            randomToken: deps.randomToken,
+            now: deps.now,
+            safeCompare: deps.safeCompare,
+        });
+        return jsonResponse(result.body, {
+            status: result.status,
+            headers: result.headers,
+        });
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/api/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAWrD,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,sBAAsB,EACtB,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,qBAAqB,EACrB,uBAAuB,EACvB,wBAAwB,EACxB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAMlB,4BAA4B,EAC5B,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AA8F/B,SAAS,YAAY,CAAC,IAAa,EAAE,IAAmB;IACtD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAChD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAsB;IAC9C,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAsB;IACnD,OAAO,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAkB;IAC/C,OAAO,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,aAAa,CACpB,MAAkB,EAClB,SAAiB,EACjB,OAAe;IAEf,OAAO,YAAY,CACjB;QACE,KAAK,EAAE;YACL,IAAI,EAAE,MAAM;YACZ,SAAS;YACT,OAAO;SACR;KACF,EACD,EAAE,MAAM,EAAE,CACX,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO,aAAa,CAAC,GAAG,EAAE,oBAAoB,EAAE,oBAAoB,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,QAAQ;IACf,OAAO,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;AACtD,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,OAA2C;IAE3C,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,EAAE,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YACjC,OAAO,qBAAqB,CAAC,GAAG,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,aAAa,CAAC,GAAG,EAAE,gBAAgB,EAAE,uBAAuB,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAoB,EAAE,QAAgB;IAC5D,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IACpC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AACrE,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB,EAAE,QAA4B;IACnE,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,GAAG;QAAE,OAAO,QAAQ,CAAC;IACnD,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACtC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC;QACxC,OAAO,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,cAAc,CAAC,KAAyB;IAC/C,OAAO,kBAAkB,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,eAAe,CAAC,OAAgB,EAAE,GAAQ;IACjD,OAAO,CACL,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC;QAC/B,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QACpC,SAAS,CACV,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,GAAe;IAClC,OAAO,GAAG,EAAE;SACT,WAAW,EAAE;SACb,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,IAAkE,EAClE,KAAa;IAKb,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QACzB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,QAAQ,EAAE,aAAa,CACrB,GAAG,EACH,uBAAuB,EACvB,2BAA2B,CAC5B;SACF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,QAAQ,EAAE,YAAY,CACpB;oBACE,KAAK,EAAE,WAAW;oBAClB,OAAO,EAAE,mCAAmC,KAAK,EAAE;iBACpD,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB;aACF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,SAAS,EAAE,MAAM,CAAC,aAAa;YAC/B,QAAQ,EAAE,MAAM,CAAC,EAAE;SACpB,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,8BAA8B,CAAC,CAAC;QACrE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,QAAQ,EAAE,YAAY,CACpB;gBACE,KAAK,EAAE,eAAe;gBACtB,OAAO,EAAE,oCAAoC;aAC9C,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB;SACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,WAAqD;IAErD,IAAI,CAAC,WAAW;QAAE,OAAO;IACzB,IAAI,WAAW,CAAC,aAAa,EAAE,CAAC;QAC9B,WAAW,CAAC,aAAa,EAAE,CAAC;QAC5B,OAAO;IACT,CAAC;IACD,KAAK,WAAW,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,OAAgB,EAChB,IAA+B,EAC/B,UAA4C,EAAE;IAE9C,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE;QAC9B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAE/D,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YACxC,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK;gBAAE,OAAO,gBAAgB,EAAE,CAAC;YACxD,MAAM,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,sBAAsB,CAAC;gBACpC,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,WAAW,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,SAAS;gBAC7D,KAAK,EAAE,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;gBACxD,MAAM,EAAE,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;aAC1D,CAAC,CAAC;YACH,OAAO,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;QAED,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;YAClD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK;gBAAE,OAAO,gBAAgB,EAAE,CAAC;YACxD,MAAM,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,wBAAwB,CAAC;gBACtC,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,UAAU,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACpC,KAAK,EAAE,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;gBACxD,MAAM,EAAE,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;aAC1D,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,qBAAqB,CAAC,MAAM,CAAC,CAAC;YACrD,OAAO,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,QAAQ,EAAE,CAAC;QAC1C,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAE5C,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC7B,MAAM,WAAW,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;YACvD,IAAI,CAAC,WAAW,CAAC,EAAE;gBAAE,OAAO,qBAAqB,CAAC,WAAW,CAAC,CAAC;YAC/D,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;gBAC3C,KAAK,EAAE,WAAW,CAAC,KAAK;gBACxB,MAAM,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS;gBACnD,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS;aAC5C,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC9C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC;gBACtD,OAAO;gBACP,KAAK,EAAE,WAAW,CAAC,KAAK;gBACxB,OAAO;gBACP,MAAM,EACJ,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,aAAa,EAAE,MAAM,IAAI,SAAS;aACvE,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;gBACpC,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,UAAU,EAAE,WAAW,CAAC,KAAK;gBAC7B,MAAM,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS;gBACnD,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS;aAC5C,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,qBAAqB,CAAC,MAAM,CAAC,CAAC;YACrD,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC;gBAC/B,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,IAAI,MAAM,CAAC,UAAU,EAAE;gBAClD,OAAO,EAAE,UAAU,EAAE,OAAO,IAAI,OAAO,IAAI,SAAS;gBACpD,OAAO,EAAE,UAAU,EAAE,OAAO,IAAI,SAAS;gBACzC,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,WAAW,CAAC,KAAK;gBACxB,SAAS,EAAE,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE;gBAC3D,SAAS,EACP,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;oBACtC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;oBAChC,SAAS;gBACX,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS;aAC1D,CAAC,CAAC;YACH,OAAO,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC9B,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;YACxC,MAAM,WAAW,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;YACvD,IAAI,CAAC,WAAW,CAAC,EAAE;gBAAE,OAAO,qBAAqB,CAAC,WAAW,CAAC,CAAC;YAC/D,MAAM,MAAM,GAAG,MAAM,mBAAmB,CACtC,OAAO,EACP,iCAAiC,CAClC,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACvD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;YAC5D,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,MAAM,CAAC,QAAQ,CAAC;YACvC,MAAM,gBAAgB,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;YACrE,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;gBACtC,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,UAAU,EAAE,WAAW,CAAC,KAAK;gBAC7B,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,WAAW,EAAE,gBAAgB;gBAC7B,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;gBAC/C,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,qBAAqB,CAAC,MAAM,CAAC,CAAC;YACrD,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CACjB;gBACE,KAAK,EAAE,WAAW,CAAC,KAAK;gBACxB,WAAW,EAAE,gBAAgB;gBAC7B,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,YAAY;aACtC,EACD,oBAAoB,CACrB,CAAC;YACF,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAChC,OAAO,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC;gBAC3C,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,UAAU;aACX,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,qBAAqB,CAAC,MAAM,CAAC,CAAC;YACrD,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CACjB,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,EACxD,eAAe,CAChB,CAAC;YACF,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7C,CAAC;QAED,OAAO,gBAAgB,EAAE,CAAC;IAC5B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,OAAgB,EAChB,IAAqC,EACrC,UAA4C,EAAE;IAE9C,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE;QAC9B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC/D,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,EAAE;YAAE,OAAO,QAAQ,EAAE,CAAC;QAC3D,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK;YAAE,OAAO,gBAAgB,EAAE,CAAC;QACxD,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QACxC,OAAO,gBAAgB,CACrB,MAAM,sBAAsB,CAAC;YAC3B,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC;YACpC,MAAM,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC;SACvC,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,OAAgB,EAChB,IAA+B,EAC/B,UAA4C,EAAE;IAE9C,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE;QAC9B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAE/D,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;YAC5B,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO,gBAAgB,EAAE,CAAC;YACzD,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;YACxC,OAAO,gBAAgB,CAAC,MAAM,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK;gBAAE,OAAO,gBAAgB,EAAE,CAAC;YACxD,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;YACxC,OAAO,gBAAgB,CAAC,qBAAqB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO,gBAAgB,EAAE,CAAC;YACzD,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACnE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CACjB,EAAE,MAAM,EAAE,EACV,2CAA2C,CAC5C,CAAC;YACF,OAAO,gBAAgB,CACrB,MAAM,gBAAgB,CAAC;gBACrB,MAAM;gBACN,WAAW,EAAE,IAAI,CAAC,WAAW;aAC9B,CAAC,CACH,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,OAAgB,EAChB,IAAiC,EACjC,UAA4C,EAAE;IAE9C,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE;QAC9B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAE/D,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBAClB,OAAO,aAAa,CAClB,GAAG,EACH,uBAAuB,EACvB,2BAA2B,CAC5B,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBAC7B,OAAO,gBAAgB,CACrB,MAAM,kBAAkB,CAAC;oBACvB,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,WAAW,EAAE,IAAI,CAAC,WAAW;iBAC9B,CAAC,CACH,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9B,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;gBAClD,IAAI,CAAC,MAAM,CAAC,EAAE;oBAAE,OAAO,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACvD,OAAO,gBAAgB,CACrB,MAAM,mBAAmB,CAAC;oBACxB,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE;iBAChD,CAAC,CACH,CAAC;YACJ,CAAC;YACD,OAAO,gBAAgB,EAAE,CAAC;QAC5B,CAAC;QAED,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO,gBAAgB,EAAE,CAAC;YACzD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;YAClD,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACvD,OAAO,gBAAgB,CACrB,MAAM,mBAAmB,CAAC;gBACxB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,aAAa,EAAE,IAAI,CAAC,aAAa;aACC,CAAC,CACtC,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,OAAgB,EAChB,IAAiC;IAEjC,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE;QAC9B,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,OAAO,YAAY,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;YAC/C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,GACR,GAAG,YAAY,KAAK;oBACpB,MAAM,IAAI,GAAG;oBACZ,GAAyB,CAAC,IAAI,KAAK,QAAQ;oBAC1C,CAAC,CAAC,WAAW;oBACb,CAAC,CAAC,MAAM,CAAC;gBACb,OAAO,gBAAgB,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;YAClD,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACvD,MAAM,MAAM,GAAG,4BAA4B,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACzD,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAChD,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,WAAW,CAAE,MAAM,CAAC,IAA4B,CAAC,MAAM,CAAC,CAAC;YACtE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,gBAAgB,CAAC,wBAAwB,EAAE,CAAC,CAAC;YACtD,CAAC;YACD,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,gBAAgB,EAAE,CAAC;IAC5B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,OAAgB,EAChB,IAAqC;IAErC,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE;QAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO,gBAAgB,EAAE,CAAC;QACzD,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC9D,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,mCAAmC,CAAC,EAAE,CAAC;YAC/D,OAAO,YAAY,CACjB;gBACE,KAAK,EAAE,iBAAiB;gBACxB,iBAAiB,EACf,wDAAwD;aAC3D,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;YACtC,IAAI,EAAE,IAAI,eAAe,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YAC/C,mBAAmB,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;YACzD,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE;YAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/auth/index.d.ts

@@ -0,0 +1,2 @@
+export { authenticateRequest, mapSdkAuthError, type AuthenticatedRequest, type AuthenticateRequestInput, type AuthMechanism, type RequestAuth, type SessionTokenVerifierPort, } from "./request.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,wBAAwB,GAC9B,MAAM,cAAc,CAAC"}

package/dist/auth/index.js

@@ -0,0 +1,2 @@
+export { authenticateRequest, mapSdkAuthError, } from "./request.js";
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,eAAe,GAMhB,MAAM,cAAc,CAAC"}

package/dist/auth/request.d.ts

@@ -0,0 +1,28 @@
+import { type Web3SignedPayload } from "@opendatalabs/vana-sdk/browser";
+import { ProtocolError } from "../errors/catalog.js";
+export type AuthMechanism = "web3-signed" | "dev-token" | "control-plane-token" | "cli-session-token";
+export interface RequestAuth {
+    signer: `0x${string}`;
+    payload: Partial<Web3SignedPayload>;
+}
+export interface SessionTokenVerifierPort {
+    isValid(token: string): Promise<boolean>;
+}
+export interface AuthenticateRequestInput {
+    request: Request;
+    serverOrigin: string | (() => string);
+    devToken?: string;
+    accessToken?: string;
+    sessionTokenVerifier?: SessionTokenVerifierPort;
+    serverOwner?: `0x${string}`;
+    now?: () => number;
+}
+export interface AuthenticatedRequest {
+    auth: RequestAuth;
+    mechanism: AuthMechanism;
+    isPolicyBypass: boolean;
+    devBypass: boolean;
+}
+export declare function mapSdkAuthError(err: unknown): ProtocolError | null;
+export declare function authenticateRequest(input: AuthenticateRequestInput): Promise<AuthenticatedRequest>;
+//# sourceMappingURL=request.d.ts.map

package/dist/auth/request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../src/auth/request.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,iBAAiB,EACvB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAIL,aAAa,EACd,MAAM,sBAAsB,CAAC;AAE9B,MAAM,MAAM,aAAa,GACrB,aAAa,GACb,WAAW,GACX,qBAAqB,GACrB,mBAAmB,CAAC;AAExB,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,KAAK,MAAM,EAAE,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,wBAAwB,CAAC;IAChD,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,EAAE,aAAa,CAAC;IACzB,cAAc,EAAE,OAAO,CAAC;IACxB,SAAS,EAAE,OAAO,CAAC;CACpB;AAsDD,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,aAAa,GAAG,IAAI,CAWlE;AAgBD,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC,oBAAoB,CAAC,CA8C/B"}

package/dist/auth/request.js

@@ -0,0 +1,106 @@
+import { ExpiredTokenError as SdkExpiredTokenError, InvalidSignatureError as SdkInvalidSignatureError, MissingAuthError as SdkMissingAuthError, verifyWeb3Signed, } from "@opendatalabs/vana-sdk/browser";
+import { ExpiredTokenError, InvalidSignatureError, MissingAuthError, ProtocolError, } from "../errors/catalog.js";
+function resolveOrigin(origin) {
+    return typeof origin === "function" ? origin() : origin;
+}
+function serverNotConfigured() {
+    return new ProtocolError(500, "SERVER_NOT_CONFIGURED", "Server owner address not configured. Set VANA_MASTER_KEY_SIGNATURE environment variable.");
+}
+function createOwnerSessionAuth(serverOwner) {
+    return {
+        signer: serverOwner,
+        payload: {},
+    };
+}
+function safeCompare(a, b) {
+    const left = new TextEncoder().encode(a);
+    const right = new TextEncoder().encode(b);
+    const length = Math.max(left.length, right.length);
+    let diff = left.length ^ right.length;
+    for (let index = 0; index < length; index += 1) {
+        diff |= (left[index] ?? 0) ^ (right[index] ?? 0);
+    }
+    return diff === 0;
+}
+function getBearerToken(headerValue) {
+    if (!headerValue?.startsWith("Bearer "))
+        return null;
+    return headerValue.slice(7);
+}
+async function requestBodyBytes(request) {
+    if (request.method === "GET" || request.method === "HEAD")
+        return undefined;
+    return new Uint8Array(await request.clone().arrayBuffer());
+}
+function getErrorDetails(err) {
+    if (err && typeof err === "object" && "details" in err) {
+        const details = err.details;
+        if (details && typeof details === "object" && !Array.isArray(details)) {
+            return details;
+        }
+    }
+    return undefined;
+}
+export function mapSdkAuthError(err) {
+    if (err instanceof SdkMissingAuthError) {
+        return new MissingAuthError(getErrorDetails(err));
+    }
+    if (err instanceof SdkInvalidSignatureError) {
+        return new InvalidSignatureError(getErrorDetails(err));
+    }
+    if (err instanceof SdkExpiredTokenError) {
+        return new ExpiredTokenError(getErrorDetails(err));
+    }
+    return null;
+}
+function ownerTokenResult(serverOwner, mechanism, isPolicyBypass) {
+    if (!serverOwner)
+        throw serverNotConfigured();
+    return {
+        auth: createOwnerSessionAuth(serverOwner),
+        mechanism,
+        isPolicyBypass,
+        devBypass: isPolicyBypass,
+    };
+}
+export async function authenticateRequest(input) {
+    const authHeader = input.request.headers.get("authorization");
+    const bearerToken = getBearerToken(authHeader);
+    if (input.devToken && authHeader === `Bearer ${input.devToken}`) {
+        return ownerTokenResult(input.serverOwner, "dev-token", true);
+    }
+    if (input.accessToken &&
+        bearerToken &&
+        safeCompare(bearerToken, input.accessToken)) {
+        return ownerTokenResult(input.serverOwner, "control-plane-token", false);
+    }
+    if (input.sessionTokenVerifier &&
+        bearerToken &&
+        (await input.sessionTokenVerifier.isValid(bearerToken))) {
+        return ownerTokenResult(input.serverOwner, "cli-session-token", false);
+    }
+    try {
+        const url = new URL(input.request.url);
+        const auth = await verifyWeb3Signed({
+            headerValue: authHeader ?? undefined,
+            expectedOrigin: resolveOrigin(input.serverOrigin),
+            expectedMethod: input.request.method,
+            expectedPath: url.pathname,
+            bodyBytes: await requestBodyBytes(input.request),
+            now: input.now?.(),
+        });
+        return {
+            auth,
+            mechanism: "web3-signed",
+            isPolicyBypass: false,
+            devBypass: false,
+        };
+    }
+    catch (err) {
+        const authError = mapSdkAuthError(err);
+        if (authError)
+            throw authError;
+        throw err;
+    }
+}
+//# sourceMappingURL=request.js.map