@opendatalabs/personal-server-ts-core 0.2.0 → 1.0.1

package/dist/api/index.js

@@ -0,0 +1,774 @@
+import { ProtocolError } from "../errors/catalog.js";
+import { deleteDataScopeContract, ingestDataContract, ingestBinaryDataContract, listAccessLogsContract, listDataScopesContract, listDataVersionsContract, parseDataScopeContract, parseJsonObjectBody, readDataContract, syncFileContract, triggerSyncContract, getSyncStatusContract, configReadErrorContract, configWriteErrorContract, createGrantContract, listGrantsContract, oauthTokenContract, revokeGrantContract, validateServerConfigContract, verifyGrantContract, decodeBinaryEnvelope, isBinaryEnvelope, parseMetadataHeader, stringifyMetadataHeader, } from "../contracts/index.js";
+import { buildChallenge, parsePaymentHeader, verifyPayment, } from "../payment/index.js";
+function jsonResponse(body, init) {
+    const headers = new Headers(init?.headers);
+    headers.set("Content-Type", "application/json");
+    return new Response(JSON.stringify(body), { ...init, headers });
+}
+// X402 spec convention: payment responses are JSON, base64-encoded into a
+// single header value. Returns undefined on encode failure so callers can
+// just omit the header rather than fail the read. Uses btoa + TextEncoder
+// to stay portable across Node and web runtimes.
+function encodePaymentResponseHeader(body) {
+    try {
+        const json = JSON.stringify(body ?? null);
+        const bytes = new TextEncoder().encode(json);
+        let binary = "";
+        for (const b of bytes)
+            binary += String.fromCharCode(b);
+        return btoa(binary);
+    }
+    catch {
+        return undefined;
+    }
+}
+function contractResponse(result) {
+    return jsonResponse(result.body, { status: result.status });
+}
+function contractErrorResponse(err) {
+    return jsonResponse(err.body, { status: err.status });
+}
+function protocolErrorResponse(err) {
+    return jsonResponse(err.toJSON(), { status: err.code });
+}
+function errorResponse(status, errorCode, message) {
+    return jsonResponse({
+        error: {
+            code: status,
+            errorCode,
+            message,
+        },
+    }, { status });
+}
+function methodNotAllowed() {
+    return errorResponse(405, "METHOD_NOT_ALLOWED", "Method not allowed");
+}
+function notFound() {
+    return errorResponse(404, "NOT_FOUND", "Not found");
+}
+async function withApiErrors(handler) {
+    try {
+        return await handler();
+    }
+    catch (err) {
+        if (err instanceof ProtocolError) {
+            return protocolErrorResponse(err);
+        }
+        return errorResponse(500, "INTERNAL_ERROR", "Internal server error");
+    }
+}
+function normalizeLimit(value, fallback) {
+    if (value === null)
+        return fallback;
+    const parsed = Number(value);
+    return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
+}
+function stripBasePath(pathname, basePath) {
+    if (!basePath || basePath === "/")
+        return pathname;
+    if (pathname === basePath)
+        return "/";
+    if (pathname.startsWith(`${basePath}/`)) {
+        return pathname.slice(basePath.length);
+    }
+    return pathname;
+}
+function decodePathPart(value) {
+    return decodeURIComponent(value ?? "");
+}
+function selectedGrantId(request, url) {
+    return (url.searchParams.get("grantId") ??
+        request.headers.get("x-ps-grant-id") ??
+        undefined);
+}
+/**
+ * Run the X402 dispatch for one read:
+ *
+ *   X-PAYMENT absent / malformed / fails local validation
+ *     → challenge: fresh 402 with current fee + accessRecord
+ *   X-PAYMENT valid, forward to gateway succeeds
+ *     → ok: caller proceeds to read the data
+ *   X-PAYMENT valid, gateway returns 4xx/5xx
+ *     → gateway-error: relay the gateway's body verbatim so the builder
+ *       can dispatch (insufficient balance vs. replay vs. race etc.)
+ *
+ * The gateway POST goes through `fetch` directly (not `gateway.payForOperation`)
+ * because the SDK client throws plain Errors and loses the body — which is
+ * exactly what we need to distinguish gateway 402 (insufficient balance) from
+ * 409 (replay) from 400 (amount mismatch).
+ */
+async function handleX402Cycle(input) {
+    const { deps, gateway, gatewayConfig, gatewayUrl, builder, scope } = input;
+    // The gateway lowercases opId before EIP-712 recovery — we must do the
+    // same in the challenge so the builder signs over the canonical form.
+    const opIdLower = input.grantId.toLowerCase();
+    // Live grant — re-fetched every cycle. The fee.totalDue is a snapshot
+    // (SDK comment: "clients shouldn't cache"); paymentStatus may have just
+    // flipped if a concurrent payer paid the registration fee.
+    const grant = await gateway.getGrant(opIdLower);
+    if (!grant) {
+        return {
+            kind: "challenge",
+            body: {
+                x402Version: 1,
+                error: "PAYMENT_REQUIRED",
+                accepts: [],
+            },
+        };
+    }
+    // Bind the accessRecord to the entry being served, if it exists and has
+    // been registered with DPv2 yet.
+    const entryRow = deps.storage.findEntry({
+        scope,
+        fileId: input.fileIdParam,
+        at: input.atParam,
+    });
+    const entryForChallenge = entryRow
+        ? {
+            dataPointId: entryRow.dataPointId,
+            scope,
+            version: entryRow.version,
+        }
+        : undefined;
+    async function buildFreshChallenge() {
+        return buildChallenge({
+            builder,
+            grantId: opIdLower,
+            grant,
+            network: deps.network ?? `vana:${gatewayConfig.chainId}`,
+            gatewayConfig,
+            serverSigner: deps.serverSigner,
+            serverOwner: deps.serverOwner,
+            entry: entryForChallenge,
+            generateNonce: deps.generatePaymentNonce,
+            generateRecordIdFn: deps.generateRecordId,
+            now: deps.now,
+        });
+    }
+    const headerValue = input.request.headers.get("x-payment");
+    const parsed = parsePaymentHeader(headerValue);
+    if (!parsed) {
+        return { kind: "challenge", body: await buildFreshChallenge() };
+    }
+    if (!deps.serverAddress) {
+        // Can't validate accessRecord recovery without our own address; fail
+        // closed by reissuing a challenge.
+        deps.logger?.error?.({ scope, grantId: opIdLower }, "X402 enabled but serverAddress is not configured — cannot verify accessRecord");
+        return { kind: "challenge", body: await buildFreshChallenge() };
+    }
+    const verify = await verifyPayment({
+        builder,
+        grantId: opIdLower,
+        grant,
+        entry: entryForChallenge,
+        serverAddress: deps.serverAddress,
+        gatewayConfig,
+        serverOwner: deps.serverOwner,
+        payment: parsed,
+    });
+    if (!verify.ok) {
+        deps.logger?.info?.({ scope, grantId: opIdLower, reason: verify.reason }, "X402 payment verification failed; reissuing challenge");
+        return { kind: "challenge", body: await buildFreshChallenge() };
+    }
+    // Forward to gateway via direct fetch (preserves error body). The SDK
+    // client wraps the same endpoint but throws away the structured response
+    // on non-2xx, which is exactly the info we need to distinguish gateway
+    // 402 (insufficient balance) from 409 (replay / race) from 400 (mismatch).
+    const doFetch = deps.paymentFetch ?? fetch;
+    const body = {
+        payerAddress: verify.payment.payload.message.payerAddress,
+        opType: verify.payment.payload.message.opType,
+        opId: verify.payment.payload.message.opId,
+        asset: verify.payment.payload.message.asset,
+        amount: verify.payment.payload.message.amount,
+        paymentNonce: verify.payment.payload.message.paymentNonce,
+    };
+    if (verify.payment.payload.accessRecord) {
+        body["accessRecord"] = verify.payment.payload.accessRecord;
+    }
+    let gatewayRes;
+    try {
+        gatewayRes = await doFetch(`${gatewayUrl.replace(/\/+$/, "")}/v1/escrow/pay`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Authorization: `Web3Signed ${verify.payment.payload.signature}`,
+            },
+            body: JSON.stringify(body),
+        });
+    }
+    catch (err) {
+        deps.logger?.error?.({
+            scope,
+            grantId: opIdLower,
+            error: err.message,
+        }, "X402 gateway forward threw; reissuing challenge");
+        return { kind: "challenge", body: await buildFreshChallenge() };
+    }
+    if (gatewayRes.ok) {
+        // Preserve the gateway's structured success body so the request
+        // handler can echo it back via the X-PAYMENT-RESPONSE header (canonical
+        // X402 convention). Empty/malformed body → propagate as null; the
+        // header still gets set so builders can tell payment succeeded.
+        let payResponseBody = null;
+        try {
+            payResponseBody = await gatewayRes.json();
+        }
+        catch {
+            // Body unreadable but status was 2xx — treat as success with no payload.
+        }
+        return { kind: "ok", payResponse: payResponseBody };
+    }
+    // Read the gateway's structured error body if there is one.
+    let errorBody;
+    try {
+        errorBody = await gatewayRes.json();
+    }
+    catch {
+        errorBody = { error: gatewayRes.statusText };
+    }
+    // 409 (replay or race) and 400 (amount mismatch / shape error) are
+    // recoverable with a fresh challenge — the builder re-signs with the
+    // new state and retries. 402 (insufficient balance) is relayed verbatim
+    // because the builder needs to fix their escrow, not their signature.
+    // 5xx is treated like 402-relayed since the personal server can't
+    // distinguish "transient" from "permanent" without more info.
+    if (gatewayRes.status === 409 || gatewayRes.status === 400) {
+        deps.logger?.info?.({ scope, grantId: opIdLower, status: gatewayRes.status, errorBody }, "Gateway rejected X-PAYMENT; reissuing X402 challenge");
+        return { kind: "challenge", body: await buildFreshChallenge() };
+    }
+    return { kind: "gateway-error", status: gatewayRes.status, body: errorBody };
+}
+function collectedAt(now) {
+    return now()
+        .toISOString()
+        .replace(/\.\d{3}Z$/, "Z");
+}
+/** True when the request body should be treated as a JSON object (the legacy
+ * path). Missing/blank Content-Type is treated as JSON for backward compat. */
+function isJsonContentType(request) {
+    const ct = request.headers.get("content-type");
+    if (!ct)
+        return true;
+    return ct.toLowerCase().includes("application/json");
+}
+function binaryMimeType(request) {
+    const ct = request.headers.get("content-type");
+    if (!ct)
+        return "application/octet-stream";
+    // Strip any "; charset=..." / boundary parameters.
+    return ct.split(";")[0].trim() || "application/octet-stream";
+}
+/** Extract a filename from X-Filename or a Content-Disposition header. */
+function binaryFilename(request) {
+    const explicit = request.headers.get("x-filename");
+    if (explicit)
+        return explicit;
+    const disposition = request.headers.get("content-disposition");
+    const match = disposition?.match(/filename\*?=(?:UTF-8'')?"?([^";]+)"?/i);
+    return match ? decodeURIComponent(match[1]) : undefined;
+}
+function notifyNewData(syncManager) {
+    if (!syncManager)
+        return;
+    if (syncManager.notifyNewData) {
+        syncManager.notifyNewData();
+        return;
+    }
+    void syncManager.trigger().catch(() => undefined);
+}
+function shouldReportReadFulfillment(grantId) {
+    return (grantId !== "unknown" && grantId !== "owner" && grantId !== "policy-bypass");
+}
+function warnReadFulfillmentReporterFailed(deps, event, err) {
+    deps.logger?.warn?.({
+        builder: event.builder,
+        error: err instanceof Error ? err.message : String(err),
+        grantId: event.grantId,
+        logId: event.logId,
+        scope: event.scope,
+    }, "Read fulfillment reporter failed");
+}
+export function reportPersonalServerReadFulfillment(deps, event) {
+    if (!deps.readFulfillmentReporter ||
+        !shouldReportReadFulfillment(event.grantId)) {
+        return;
+    }
+    try {
+        void Promise.resolve(deps.readFulfillmentReporter.report(event)).catch((err) => warnReadFulfillmentReporterFailed(deps, event, err));
+    }
+    catch (err) {
+        warnReadFulfillmentReporterFailed(deps, event, err);
+    }
+}
+export async function handlePersonalServerDataRequest(request, deps, options = {}) {
+    return withApiErrors(async () => {
+        const url = new URL(request.url);
+        const pathname = stripBasePath(url.pathname, options.basePath);
+        if (pathname === "/" || pathname === "") {
+            if (request.method !== "GET")
+                return methodNotAllowed();
+            await deps.auth.authorizeBuilderList(request);
+            const result = await listDataScopesContract({
+                storage: deps.storage,
+                scopePrefix: url.searchParams.get("scopePrefix") ?? undefined,
+                limit: normalizeLimit(url.searchParams.get("limit"), 20),
+                offset: normalizeLimit(url.searchParams.get("offset"), 0),
+            });
+            return jsonResponse(result.response);
+        }
+        const parts = pathname.split("/").filter(Boolean);
+        if (parts.length === 2 && parts[1] === "versions") {
+            if (request.method !== "GET")
+                return methodNotAllowed();
+            await deps.auth.authorizeBuilderList(request);
+            const result = listDataVersionsContract({
+                storage: deps.storage,
+                scopeParam: decodePathPart(parts[0]),
+                limit: normalizeLimit(url.searchParams.get("limit"), 20),
+                offset: normalizeLimit(url.searchParams.get("offset"), 0),
+            });
+            if (!result.ok)
+                return contractErrorResponse(result);
+            return jsonResponse(result.response);
+        }
+        if (parts.length !== 1)
+            return notFound();
+        const scopeParam = decodePathPart(parts[0]);
+        if (request.method === "GET") {
+            const scopeResult = parseDataScopeContract(scopeParam);
+            if (!scopeResult.ok)
+                return contractErrorResponse(scopeResult);
+            const selectedEntry = deps.storage.findEntry({
+                scope: scopeResult.scope,
+                fileId: url.searchParams.get("fileId") ?? undefined,
+                at: url.searchParams.get("at") ?? undefined,
+            });
+            // Holds the base64-encoded gateway payForOperation response body when
+            // X402 succeeds — emitted on the final read response as X-PAYMENT-RESPONSE.
+            let paymentResponseHeader;
+            const grantId = selectedGrantId(request, url);
+            const authResult = await deps.auth.authorizeBuilderRead({
+                request,
+                scope: scopeResult.scope,
+                grantId,
+                fileId: url.searchParams.get("fileId") ?? selectedEntry?.fileId ?? undefined,
+            });
+            // X402 payment dance for builder reads. Owner-exempt reads (the
+            // grantId sentinels "owner" / "policy-bypass") skip payment entirely
+            // since there's no payable op to attach the payment to.
+            //
+            // The grantId we pay against is the one verifyDataReadPolicy resolved
+            // from the Web3Signed payload (authoritative source) — not the URL /
+            // header hint, which may be absent when the payload carries it.
+            const isOwnerSignal = authResult?.grantId === "owner" ||
+                authResult?.grantId === "policy-bypass";
+            const builder = authResult?.builder;
+            const resolvedGrantId = !isOwnerSignal && authResult?.grantId ? authResult.grantId : undefined;
+            const willCharge = Boolean(deps.paymentEnabled &&
+                !isOwnerSignal &&
+                typeof builder === "string" &&
+                builder.startsWith("0x") &&
+                resolvedGrantId &&
+                deps.gateway &&
+                deps.gatewayConfig &&
+                deps.gatewayUrl);
+            // Diagnostic: makes it explicit why a read is/isn't charged. x402 has
+            // many "served free" branches (owner read, payment disabled, missing
+            // gateway deps); this surfaces the deciding inputs.
+            //
+            // Routing: when a logger is wired (the Node server always provides one),
+            // log the full detail through it at debug level so the operator's level
+            // controls + redaction apply and access metadata (scope/grantId/builder)
+            // doesn't unconditionally hit stdout. The browser PS-Lite runtime wires
+            // no logger; there we fall back to console but log ONLY the non-identifying
+            // decision booleans — never scope/grantId/builder.
+            if (deps.logger?.debug) {
+                deps.logger.debug({
+                    scope: scopeResult.scope,
+                    grantId: authResult?.grantId,
+                    isOwnerSignal,
+                    builder,
+                    resolvedGrantId,
+                    paymentEnabled: Boolean(deps.paymentEnabled),
+                    hasGateway: Boolean(deps.gateway),
+                    hasGatewayConfig: Boolean(deps.gatewayConfig),
+                    hasGatewayUrl: Boolean(deps.gatewayUrl),
+                    willCharge,
+                }, "[x402-gate] read");
+            }
+            else {
+                console.info("[x402-gate] read", {
+                    isOwnerSignal,
+                    paymentEnabled: Boolean(deps.paymentEnabled),
+                    hasGateway: Boolean(deps.gateway),
+                    hasGatewayConfig: Boolean(deps.gatewayConfig),
+                    hasGatewayUrl: Boolean(deps.gatewayUrl),
+                    willCharge,
+                });
+            }
+            // Keep the full condition inline (not `if (willCharge)`) so TS narrows
+            // deps.gateway/gatewayConfig/gatewayUrl to non-undefined in the block.
+            if (deps.paymentEnabled &&
+                !isOwnerSignal &&
+                typeof builder === "string" &&
+                builder.startsWith("0x") &&
+                resolvedGrantId &&
+                deps.gateway &&
+                deps.gatewayConfig &&
+                deps.gatewayUrl) {
+                const x402Result = await handleX402Cycle({
+                    deps,
+                    request,
+                    scope: scopeResult.scope,
+                    fileIdParam: url.searchParams.get("fileId") ?? undefined,
+                    atParam: url.searchParams.get("at") ?? undefined,
+                    grantId: resolvedGrantId,
+                    builder: builder,
+                    gateway: deps.gateway,
+                    gatewayConfig: deps.gatewayConfig,
+                    gatewayUrl: deps.gatewayUrl,
+                });
+                if (x402Result.kind === "challenge") {
+                    return jsonResponse(x402Result.body, { status: 402 });
+                }
+                if (x402Result.kind === "gateway-error") {
+                    // Relay the gateway's structured body verbatim so the builder can
+                    // dispatch on it (insufficient balance vs. replay vs. race etc.).
+                    return jsonResponse(x402Result.body, { status: x402Result.status });
+                }
+                // x402Result.kind === "ok" — payment accepted, proceed to read.
+                // The gateway's success body is forwarded back to the builder via
+                // X-PAYMENT-RESPONSE (canonical X402 convention) so callers can see
+                // breakdown / paidAt / paymentNonce without a second gateway round-trip.
+                paymentResponseHeader = encodePaymentResponseHeader(x402Result.payResponse);
+            }
+            const result = await readDataContract({
+                storage: deps.storage,
+                scopeParam: scopeResult.scope,
+                fileId: url.searchParams.get("fileId") ?? undefined,
+                at: url.searchParams.get("at") ?? undefined,
+            });
+            if (!result.ok)
+                return contractErrorResponse(result);
+            const logId = deps.createLogId?.() ?? crypto.randomUUID();
+            const timestamp = (deps.now ?? (() => new Date()))().toISOString();
+            const ipAddress = request.headers.get("x-forwarded-for") ??
+                request.headers.get("x-real-ip") ??
+                "unknown";
+            const userAgent = request.headers.get("user-agent") ?? "unknown";
+            const loggedGrantId = authResult?.grantId ?? grantId ?? "unknown";
+            const loggedBuilder = authResult?.builder ?? "unknown";
+            await deps.accessLogWriter.write({
+                logId,
+                grantId: loggedGrantId,
+                builder: loggedBuilder,
+                action: "read",
+                scope: scopeResult.scope,
+                timestamp,
+                ipAddress,
+                userAgent,
+            });
+            const reportReadFulfillment = () => {
+                if (!authResult?.grantId || !authResult.builder)
+                    return;
+                reportPersonalServerReadFulfillment(deps, {
+                    builder: authResult.builder,
+                    fileId: url.searchParams.get("fileId") ??
+                        selectedEntry?.fileId ??
+                        undefined,
+                    grantId: authResult.grantId,
+                    ipAddress,
+                    logId,
+                    scope: scopeResult.scope,
+                    servedAt: timestamp,
+                    userAgent,
+                });
+            };
+            const headers = {};
+            if (paymentResponseHeader) {
+                headers["X-PAYMENT-RESPONSE"] = paymentResponseHeader;
+            }
+            const wantsRawContent = url.searchParams.get("content") === "raw";
+            // `?content=raw` streams the decoded bytes of a binary envelope with its
+            // original media type, so a builder can download the file directly. The
+            // X-PAYMENT-RESPONSE header (if any) rides along on the raw response too.
+            if (wantsRawContent) {
+                if (!isBinaryEnvelope(result.envelope)) {
+                    return jsonResponse({
+                        error: "NOT_BINARY_SCOPE",
+                        message: `Scope "${scopeResult.scope}" does not expose raw binary content.`,
+                    }, { status: 400, headers });
+                }
+                const decoded = decodeBinaryEnvelope(result.envelope);
+                headers["Content-Type"] = decoded.mimeType;
+                headers["Content-Length"] = String(decoded.bytes.length);
+                if (decoded.filename) {
+                    headers["Content-Disposition"] =
+                        `attachment; filename="${decoded.filename}"`;
+                }
+                if (decoded.metadata !== undefined) {
+                    headers["X-Vana-Metadata"] = stringifyMetadataHeader(decoded.metadata);
+                }
+                const response = new Response(decoded.bytes, {
+                    status: 200,
+                    headers,
+                });
+                return response;
+            }
+            const response = jsonResponse(result.envelope, { headers });
+            reportReadFulfillment();
+            return response;
+        }
+        if (request.method === "POST") {
+            await deps.auth.authorizeOwner(request);
+            const scopeResult = parseDataScopeContract(scopeParam);
+            if (!scopeResult.ok)
+                return contractErrorResponse(scopeResult);
+            const collectedAtValue = collectedAt(deps.now ?? (() => new Date()));
+            const status = deps.syncManager ? "syncing" : "stored";
+            // Binary / unstructured data (e.g. a PDF): the body is raw bytes. DPv2
+            // data points are scope-addressed and carry no schemaId, so unstructured
+            // data needs no schema at all — we ingest it schemaless. (Structured JSON
+            // below still resolves a schema for validation/metadata.)
+            if (!isJsonContentType(request)) {
+                const bytes = new Uint8Array(await request.arrayBuffer());
+                const result = await ingestBinaryDataContract({
+                    storage: deps.storage,
+                    scopeParam: scopeResult.scope,
+                    bytes,
+                    mimeType: binaryMimeType(request),
+                    filename: binaryFilename(request),
+                    metadata: parseMetadataHeader(request.headers.get("x-vana-metadata")),
+                    collectedAt: collectedAtValue,
+                    status,
+                });
+                if (!result.ok)
+                    return contractErrorResponse(result);
+                deps.logger?.info?.({
+                    scope: scopeResult.scope,
+                    collectedAt: collectedAtValue,
+                    path: result.writeResult.relativePath,
+                    mimeType: binaryMimeType(request),
+                    sizeBytes: bytes.length,
+                }, "Binary data file ingested");
+                notifyNewData(deps.syncManager);
+                return jsonResponse(result.response, { status: 201 });
+            }
+            const parsed = await parseJsonObjectBody(request, "Request body must be valid JSON");
+            if (!parsed.ok)
+                return contractResponse(parsed.result);
+            // DPv2 is scope-addressed and the gateway records no schemas, so JSON
+            // ingest is schemaless too — no lookup, no schemaId/$schema stamped.
+            const result = await ingestDataContract({
+                storage: deps.storage,
+                scopeParam: scopeResult.scope,
+                body: parsed.body,
+                collectedAt: collectedAtValue,
+                status,
+            });
+            if (!result.ok)
+                return contractErrorResponse(result);
+            deps.logger?.info?.({
+                scope: scopeResult.scope,
+                collectedAt: collectedAtValue,
+                path: result.writeResult.relativePath,
+            }, "Data file ingested");
+            notifyNewData(deps.syncManager);
+            return jsonResponse(result.response, { status: 201 });
+        }
+        if (request.method === "DELETE") {
+            await deps.auth.authorizeOwner(request);
+            // Propagate the deletion to the authoritative stores (R2 blobs + gateway records) BEFORE the
+            // local delete — it reads the local index to find what to remove. Best-effort: a remote
+            // failure must not block the owner's local delete (and sync would otherwise resurrect it; the
+            // download-worker reconciliation is the backstop). Parse the scope first so an invalid scope
+            // still 400s without a wasted remote call.
+            const parsed = parseDataScopeContract(scopeParam);
+            if (parsed.ok && deps.syncManager?.deleteScopeRemote) {
+                try {
+                    await deps.syncManager.deleteScopeRemote(parsed.scope);
+                }
+                catch (err) {
+                    deps.logger?.info?.({ scope: scopeParam, error: err.message }, "Remote scope deletion failed; proceeding with local delete");
+                }
+            }
+            const result = await deleteDataScopeContract({
+                storage: deps.storage,
+                scopeParam,
+            });
+            if (!result.ok)
+                return contractErrorResponse(result);
+            deps.logger?.info?.({ scope: scopeParam, deletedCount: result.deletedCount }, "Scope deleted");
+            return new Response(null, { status: 204 });
+        }
+        return methodNotAllowed();
+    });
+}
+export async function handlePersonalServerAccessLogsRequest(request, deps, options = {}) {
+    return withApiErrors(async () => {
+        const url = new URL(request.url);
+        const pathname = stripBasePath(url.pathname, options.basePath);
+        if (pathname !== "/" && pathname !== "")
+            return notFound();
+        if (request.method !== "GET")
+            return methodNotAllowed();
+        await deps.auth.authorizeOwner(request);
+        return contractResponse(await listAccessLogsContract({
+            accessLogReader: deps.accessLogReader,
+            limit: url.searchParams.get("limit"),
+            offset: url.searchParams.get("offset"),
+        }));
+    });
+}
+export async function handlePersonalServerSyncRequest(request, deps, options = {}) {
+    return withApiErrors(async () => {
+        const url = new URL(request.url);
+        const pathname = stripBasePath(url.pathname, options.basePath);
+        if (pathname === "/trigger") {
+            if (request.method !== "POST")
+                return methodNotAllowed();
+            await deps.auth.authorizeOwner(request);
+            return contractResponse(await triggerSyncContract(deps.syncManager));
+        }
+        if (pathname === "/status") {
+            if (request.method !== "GET")
+                return methodNotAllowed();
+            await deps.auth.authorizeOwner(request);
+            return contractResponse(getSyncStatusContract(deps.syncManager));
+        }
+        if (pathname.startsWith("/file/")) {
+            if (request.method !== "POST")
+                return methodNotAllowed();
+            await deps.auth.authorizeOwner(request);
+            const fileId = decodeURIComponent(pathname.slice("/file/".length));
+            deps.logger?.info?.({ fileId }, "File sync requested, triggering full sync");
+            return contractResponse(await syncFileContract({
+                fileId,
+                syncManager: deps.syncManager,
+            }));
+        }
+        return notFound();
+    });
+}
+export async function handlePersonalServerGrantsRequest(request, deps, options = {}) {
+    return withApiErrors(async () => {
+        const url = new URL(request.url);
+        const pathname = stripBasePath(url.pathname, options.basePath);
+        if (pathname === "/" || pathname === "") {
+            await deps.auth.authorizeOwner(request);
+            if (!deps.gateway) {
+                return errorResponse(500, "SERVER_NOT_CONFIGURED", "Gateway is not configured");
+            }
+            if (request.method === "GET") {
+                return contractResponse(await listGrantsContract({
+                    gateway: deps.gateway,
+                    serverOwner: deps.serverOwner,
+                }));
+            }
+            if (request.method === "POST") {
+                const parsed = await parseJsonObjectBody(request);
+                if (!parsed.ok)
+                    return contractResponse(parsed.result);
+                // Canary createGrant doesn't need a clock — grantVersion defaults
+                // to "1" and callers re-registering pass a strictly higher value.
+                return contractResponse(await createGrantContract({
+                    gateway: deps.gateway,
+                    serverOwner: deps.serverOwner,
+                    serverSigner: deps.serverSigner,
+                    body: parsed.body,
+                }));
+            }
+            return methodNotAllowed();
+        }
+        if (pathname === "/verify") {
+            if (request.method !== "POST")
+                return methodNotAllowed();
+            const parsed = await parseJsonObjectBody(request);
+            if (!parsed.ok)
+                return contractResponse(parsed.result);
+            return contractResponse(await verifyGrantContract({
+                body: parsed.body,
+                gatewayConfig: deps.gatewayConfig,
+            }));
+        }
+        if (pathname.startsWith("/")) {
+            if (request.method !== "DELETE")
+                return methodNotAllowed();
+            await deps.auth.authorizeOwner(request);
+            if (!deps.gateway) {
+                return errorResponse(500, "SERVER_NOT_CONFIGURED", "Gateway is not configured");
+            }
+            return contractResponse(await revokeGrantContract({
+                gateway: deps.gateway,
+                serverOwner: deps.serverOwner,
+                serverSigner: deps.serverSigner,
+                grantId: decodeURIComponent(pathname.slice(1)),
+            }));
+        }
+        return notFound();
+    });
+}
+export async function handlePersonalServerConfigRequest(request, deps) {
+    return withApiErrors(async () => {
+        await deps.auth.authorizeOwner(request);
+        if (request.method === "GET") {
+            try {
+                return jsonResponse(await deps.readConfig());
+            }
+            catch (err) {
+                const kind = err instanceof Error &&
+                    "code" in err &&
+                    err.code === "ENOENT"
+                    ? "not-found"
+                    : "read";
+                return contractResponse(configReadErrorContract(kind));
+            }
+        }
+        if (request.method === "PUT") {
+            const parsed = await parseJsonObjectBody(request);
+            if (!parsed.ok)
+                return contractResponse(parsed.result);
+            const result = validateServerConfigContract(parsed.body);
+            if (!result.ok)
+                return contractResponse(result);
+            try {
+                await deps.writeConfig(result.body.config);
+            }
+            catch {
+                return contractResponse(configWriteErrorContract());
+            }
+            return contractResponse(result);
+        }
+        return methodNotAllowed();
+    });
+}
+export async function handlePersonalServerOauthTokenRequest(request, deps) {
+    return withApiErrors(async () => {
+        if (request.method !== "POST")
+            return methodNotAllowed();
+        const contentType = request.headers.get("content-type") ?? "";
+        if (!contentType.includes("application/x-www-form-urlencoded")) {
+            return jsonResponse({
+                error: "invalid_request",
+                error_description: "Content-Type must be application/x-www-form-urlencoded",
+            }, { status: 400 });
+        }
+        const result = await oauthTokenContract({
+            body: new URLSearchParams(await request.text()),
+            authorizationHeader: request.headers.get("authorization"),
+            tokenStore: deps.tokenStore,
+            controlPlaneSecret: deps.controlPlaneSecret,
+            deviceSessions: deps.deviceSessions,
+            randomToken: deps.randomToken,
+            now: deps.now,
+            safeCompare: deps.safeCompare,
+        });
+        return jsonResponse(result.body, {
+            status: result.status,
+            headers: result.headers,
+        });
+    });
+}
+//# sourceMappingURL=index.js.map