@opendatalabs/personal-server-ts-lite 0.0.1-canary.00328bf

package/dist/bridge.d.ts

@@ -0,0 +1,23 @@
+import type { PsLiteRuntime } from "./runtime.js";
+export interface PsLiteBridgeRequest {
+    requestId: string;
+    method: string;
+    path: string;
+    query: string;
+    headers: Record<string, string>;
+    /** Base64-encoded request body, matching the browser-local relay PoC. */
+    body: string;
+}
+export interface PsLiteBridgeResponse {
+    requestId: string;
+    status: number;
+    headers: Record<string, string>;
+    /** Base64-encoded response body for relay transport. */
+    body: string;
+    /** Decoded response body for same-context consumers and tests. */
+    textBody: string;
+}
+export declare function handlePsLiteBridgeRequest(runtime: PsLiteRuntime, bridgeRequest: PsLiteBridgeRequest, options?: {
+    origin?: string;
+}): Promise<PsLiteBridgeResponse>;
+//# sourceMappingURL=bridge.d.ts.map

package/dist/bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge.d.ts","sourceRoot":"","sources":["../src/bridge.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;CAClB;AAkDD,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,aAAa,EACtB,aAAa,EAAE,mBAAmB,EAClC,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAChC,OAAO,CAAC,oBAAoB,CAAC,CAe/B"}

package/dist/bridge.js

@@ -0,0 +1,53 @@
+function decodeBase64(input) {
+    if (!input)
+        return new Uint8Array();
+    const binary = typeof globalThis.atob === "function"
+        ? globalThis.atob(input)
+        : Buffer.from(input, "base64").toString("binary");
+    return Uint8Array.from(binary, (char) => char.charCodeAt(0));
+}
+function encodeBase64(bytes) {
+    let binary = "";
+    for (const byte of bytes) {
+        binary += String.fromCharCode(byte);
+    }
+    return typeof globalThis.btoa === "function"
+        ? globalThis.btoa(binary)
+        : Buffer.from(binary, "binary").toString("base64");
+}
+function headersToRecord(headers) {
+    const result = {};
+    headers.forEach((value, key) => {
+        result[key] = value;
+    });
+    return result;
+}
+function buildRequest(origin, bridgeRequest) {
+    const query = bridgeRequest.query
+        ? `?${bridgeRequest.query.replace(/^\?/, "")}`
+        : "";
+    const url = `${origin.replace(/\/+$/, "")}${bridgeRequest.path}${query}`;
+    const method = bridgeRequest.method.toUpperCase();
+    const hasBody = method !== "GET" && method !== "HEAD";
+    const body = hasBody
+        ? decodeBase64(bridgeRequest.body).slice().buffer
+        : undefined;
+    return new Request(url, {
+        method,
+        headers: bridgeRequest.headers,
+        body,
+    });
+}
+export async function handlePsLiteBridgeRequest(runtime, bridgeRequest, options = {}) {
+    const request = buildRequest(options.origin ?? "https://ps-lite.local", bridgeRequest);
+    const response = await runtime.fetch(request);
+    const bytes = new Uint8Array(await response.arrayBuffer());
+    return {
+        requestId: bridgeRequest.requestId,
+        status: response.status,
+        headers: headersToRecord(response.headers),
+        body: encodeBase64(bytes),
+        textBody: new TextDecoder().decode(bytes),
+    };
+}
+//# sourceMappingURL=bridge.js.map

package/dist/bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge.js","sourceRoot":"","sources":["../src/bridge.ts"],"names":[],"mappings":"AAsBA,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,UAAU,EAAE,CAAC;IACpC,MAAM,MAAM,GACV,OAAO,UAAU,CAAC,IAAI,KAAK,UAAU;QACnC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QACxB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtD,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,YAAY,CAAC,KAAiB;IACrC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,OAAO,UAAU,CAAC,IAAI,KAAK,UAAU;QAC1C,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;QACzB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,eAAe,CAAC,OAAgB;IACvC,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QAC7B,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACtB,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CACnB,MAAc,EACd,aAAkC;IAElC,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK;QAC/B,CAAC,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE;QAC9C,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,aAAa,CAAC,IAAI,GAAG,KAAK,EAAE,CAAC;IACzE,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;IAClD,MAAM,OAAO,GAAG,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC;IACtD,MAAM,IAAI,GAAG,OAAO;QAClB,CAAC,CAAC,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,MAAM;QACjD,CAAC,CAAC,SAAS,CAAC;IAEd,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE;QACtB,MAAM;QACN,OAAO,EAAE,aAAa,CAAC,OAAO;QAC9B,IAAI;KACL,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAsB,EACtB,aAAkC,EAClC,UAA+B,EAAE;IAEjC,MAAM,OAAO,GAAG,YAAY,CAC1B,OAAO,CAAC,MAAM,IAAI,uBAAuB,EACzC,aAAa,CACd,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAE3D,OAAO;QACL,SAAS,EAAE,aAAa,CAAC,SAAS;QAClC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,OAAO,EAAE,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC;QAC1C,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC;QACzB,QAAQ,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;KAC1C,CAAC;AACJ,CAAC"}

package/dist/browser-runtime.d.ts

@@ -0,0 +1,58 @@
+import type { ServerConfig } from "@opendatalabs/personal-server-ts-core/schemas";
+import type { Logger } from "@opendatalabs/personal-server-ts-core/logger";
+import type { InferenceProvider } from "@opendatalabs/personal-server-ts-core/derivatives";
+import type { AccessLogReader } from "@opendatalabs/personal-server-ts-core/logging/access-reader";
+import type { AccessLogWriter } from "@opendatalabs/personal-server-ts-core/logging/access-log";
+import type { DataPointFeedPort, DataStoragePort } from "@opendatalabs/personal-server-ts-core/ports";
+import { type PsLiteDataFileStore } from "./storage.js";
+import { type PsLiteStateStore, type PsLiteUnlockedServerIdentity } from "./state.js";
+import { type PsLiteRuntime, type PsLiteRuntimeOptions } from "./runtime.js";
+import { type PsLiteOwnerSyncSigner } from "./sync.js";
+import { type PsLitePersistenceBundle } from "./persistence.js";
+export interface IndexedDbPsLiteRuntimeOptions extends Omit<PsLiteRuntimeOptions, "accessLogReader" | "accessLogWriter" | "config" | "identity" | "saveConfig" | "stateCapabilities" | "storage" | "tokenStore"> {
+    ownerAddress?: `0x${string}`;
+    /**
+     * Inference provider for the derivative compute layer. Defaults to the
+     * OpenAI-compatible fetch client on `config.inference`; tests inject a
+     * fake. Pass `derivatives` (the runtime option) to bypass this wiring.
+     */
+    inferenceProvider?: InferenceProvider;
+    ownerSignature: `0x${string}`;
+    ownerSyncSigner?: PsLiteOwnerSyncSigner;
+    dbName?: string;
+    stateStoreName?: string;
+    storageDbName?: string;
+    storageStoreName?: string;
+    storageKey?: string;
+    runtimeOrigin?: string;
+    configDefaults?: Partial<ServerConfig>;
+    dataFileStore?: PsLiteDataFileStore;
+    logger?: Logger;
+    /**
+     * Deletion-aware gateway feed for the sync workers. Defaults to a REST
+     * feed on the configured gateway URL; inject with a mock `gateway` in tests.
+     */
+    dataPointFeed?: DataPointFeedPort;
+    /**
+     * Inject host-owned persistence ports (Mobile native SQLite/filesystem) in
+     * place of the browser IndexedDB defaults, without giving up this factory's
+     * identity/config/sync/auth/signer composition. This is all-or-nothing:
+     * either omit it for the default Web IndexedDB/OPFS path, or provide every
+     * port for a host-owned persistence implementation.
+     */
+    persistence?: PsLitePersistenceBundle;
+}
+export interface IndexedDbPsLiteRuntime {
+    runtime: PsLiteRuntime;
+    config: ServerConfig;
+    identity: PsLiteUnlockedServerIdentity;
+    stateStore: PsLiteStateStore;
+    storage: DataStoragePort;
+    tokenStore: PsLiteRuntimeOptions["tokenStore"];
+    accessLogStore: AccessLogReader & AccessLogWriter;
+    syncManager: PsLiteRuntimeOptions["syncManager"];
+    /** The compute layer; hosts call `scheduler.stop()` on teardown. */
+    derivatives: PsLiteRuntimeOptions["derivatives"];
+}
+export declare function createIndexedDbPsLiteRuntime(options: IndexedDbPsLiteRuntimeOptions): Promise<IndexedDbPsLiteRuntime>;
+//# sourceMappingURL=browser-runtime.d.ts.map

package/dist/browser-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-runtime.d.ts","sourceRoot":"","sources":["../src/browser-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+CAA+C,CAAC;AAClF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,8CAA8C,CAAC;AAC3E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mDAAmD,CAAC;AAM3F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAChG,OAAO,KAAK,EACV,iBAAiB,EACjB,eAAe,EAChB,MAAM,6CAA6C,CAAC;AAMrD,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,cAAc,CAAC;AACtB,OAAO,EAOL,KAAK,gBAAgB,EACrB,KAAK,4BAA4B,EAClC,MAAM,YAAY,CAAC;AACpB,OAAO,EAGL,KAAK,aAAa,EAClB,KAAK,oBAAoB,EAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EAA2B,KAAK,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAQhF,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,kBAAkB,CAAC;AAE1B,MAAM,WAAW,6BAA8B,SAAQ,IAAI,CACzD,oBAAoB,EAClB,iBAAiB,GACjB,iBAAiB,GACjB,QAAQ,GACR,UAAU,GACV,YAAY,GACZ,mBAAmB,GACnB,SAAS,GACT,YAAY,CACf;IACC,YAAY,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC7B;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,cAAc,EAAE,KAAK,MAAM,EAAE,CAAC;IAC9B,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACvC,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAClC;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,uBAAuB,CAAC;CACvC;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,aAAa,CAAC;IACvB,MAAM,EAAE,YAAY,CAAC;IACrB,QAAQ,EAAE,4BAA4B,CAAC;IACvC,UAAU,EAAE,gBAAgB,CAAC;IAC7B,OAAO,EAAE,eAAe,CAAC;IACzB,UAAU,EAAE,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAC/C,cAAc,EAAE,eAAe,GAAG,eAAe,CAAC;IAClD,WAAW,EAAE,oBAAoB,CAAC,aAAa,CAAC,CAAC;IACjD,oEAAoE;IACpE,WAAW,EAAE,oBAAoB,CAAC,aAAa,CAAC,CAAC;CAClD;AAED,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,sBAAsB,CAAC,CA8NjC"}

package/dist/browser-runtime.js

@@ -0,0 +1,214 @@
+import { createRequestSigner, createServerSigner, } from "@opendatalabs/personal-server-ts-core/signing";
+import { createGatewayLineageClient } from "@opendatalabs/personal-server-ts-core/lineage";
+import { createGatewayClient } from "@opendatalabs/vana-sdk/browser";
+import { createInMemoryWriteProofReplayStore, createInMemoryWriteSessionStore, } from "@opendatalabs/personal-server-ts-core/write";
+import { createIndexedDbPsLitePersistence, createPersistentPsLiteStorage, } from "./storage.js";
+import { createIndexedDbPsLiteAccessLogStore, createIndexedDbPsLiteStateStore, createIndexedDbPsLiteTokenStore, loadOrCreatePsLiteConfig, loadOrCreatePsLiteServerIdentity, savePsLiteConfig, } from "./state.js";
+import { createWeb3SignedPsLiteAuth, createPsLiteRuntime, } from "./runtime.js";
+import { createPsLiteSyncManager } from "./sync.js";
+import { createPsLiteDerivativeCompute, createPsLiteQuestionStore, psLiteInferenceConfigured, } from "./derivatives.js";
+import { resolvePsLiteOwner } from "./owner-binding.js";
+import { DiagnosticsRecorder } from "./diagnostics.js";
+import { assertCompletePsLitePersistenceBundle, } from "./persistence.js";
+export async function createIndexedDbPsLiteRuntime(options) {
+    const dbName = options.dbName ?? "personal-server-lite";
+    const injected = options.persistence;
+    if (injected !== undefined)
+        assertCompletePsLitePersistenceBundle(injected);
+    // No bundle preserves the Web IndexedDB/OPFS path. A supplied bundle has
+    // already been validated as complete, so hosts never silently mix native and
+    // browser persistence. Config, identity, and sync remain generic over state.
+    const stateStore = injected?.state ??
+        createIndexedDbPsLiteStateStore({
+            dbName,
+            storeName: options.stateStoreName ?? "state",
+        });
+    const config = await loadOrCreatePsLiteConfig(stateStore, options.configDefaults);
+    const identity = await loadOrCreatePsLiteServerIdentity({
+        store: stateStore,
+        ownerSignature: options.ownerSignature,
+    });
+    const tokenStore = injected?.tokens ??
+        createIndexedDbPsLiteTokenStore({
+            dbName,
+            storeName: "tokens",
+        });
+    const accessLogStore = injected?.accessLog ??
+        createIndexedDbPsLiteAccessLogStore({
+            dbName,
+            storeName: "accessLogs",
+        });
+    const storage = injected?.storage ??
+        (await createPersistentPsLiteStorage({ kind: "indexeddb" }, createIndexedDbPsLitePersistence({
+            dbName: options.storageDbName ?? `${dbName}-storage`,
+            storeName: options.storageStoreName ?? "state",
+            key: options.storageKey ?? "data-storage-v1",
+        }), options.dataFileStore));
+    const gateway = options.gateway ?? createGatewayClient(config.gateway.url);
+    const serverOwner = await resolvePsLiteOwner({
+        ownerAddress: options.ownerAddress,
+        ownerSignature: options.ownerSignature,
+    });
+    const serverSigner = options.serverSigner ??
+        createServerSigner(identity.account, {
+            chainId: config.gateway.chainId,
+            contracts: config.gateway.contracts,
+        });
+    // Create (or reuse) a shared diagnostics recorder before the sync manager so
+    // both share the same recorder instance and events appear in /v1/diagnostics.
+    const diagnostics = options.diagnostics ?? new DiagnosticsRecorder();
+    // The one browser request signer: the identity key that registered this
+    // server with the gateway signs the lineage reads and the inference relay
+    // calls with the same Web3Signed scheme.
+    const requestSigner = createRequestSigner(identity.account);
+    // Derivative data: lineage reads are signed with the server key and
+    // derivatives are registered with their lineage (see core/lineage).
+    const lineageGateway = createGatewayLineageClient({
+        gatewayUrl: config.gateway.url,
+        requestSigner,
+    });
+    let syncManager = options.syncManager ?? null;
+    let scopeDeletions = options.scopeDeletions;
+    let runtimeRef = null;
+    // Derivative compute: built before sync so downloads can mark questions
+    // stale; it reaches the sync manager lazily to upload its results.
+    // Without a relay URL (or an injected provider) the layer stays off and
+    // /v1/derivatives answers 503: the browser never calls a provider
+    // directly with no key.
+    let derivatives = options.derivatives ?? null;
+    if (derivatives === null &&
+        options.derivatives === undefined &&
+        (options.inferenceProvider || psLiteInferenceConfigured(config))) {
+        derivatives = createPsLiteDerivativeCompute({
+            config,
+            storage,
+            store: await createPsLiteQuestionStore(stateStore),
+            serverOwner,
+            syncManager: () => syncManager,
+            scopeDeletions: () => scopeDeletions,
+            writePolicyPorts: {
+                authSessionVerifier: gateway,
+                grantVerifier: gateway,
+            },
+            runtimeAvailability: {
+                isAvailable: () => runtimeRef?.isAvailable() ?? Boolean(options.active),
+            },
+            provider: options.inferenceProvider,
+            // The relay forwards only requests signed as the owner's server.
+            requestSigner,
+            logger: options.logger,
+        });
+    }
+    else if (derivatives === null && options.derivatives === undefined) {
+        options.logger?.warn({ baseUrl: config.inference.baseUrl }, "Derivative compute disabled: inference.baseUrl is the direct-provider default; point it at the Vana inference relay");
+    }
+    if (!syncManager && config.sync.enabled) {
+        const sync = await createPsLiteSyncManager({
+            config,
+            stateStore,
+            storage,
+            ownerSignature: options.ownerSignature,
+            ownerAddress: options.ownerAddress,
+            ownerSyncSigner: options.ownerSyncSigner,
+            serverAccount: identity.account,
+            gateway,
+            dataPointFeed: options.dataPointFeed,
+            scopeDeletions,
+            diagnostics,
+            logger: options.logger,
+            lineageGateway,
+            onDataPointIndexed: (event) => derivatives?.scheduler.markSourceChanged(event.scope, {
+                lineageSources: event.lineageSources,
+            }),
+        });
+        syncManager = sync.syncManager;
+        scopeDeletions = sync.scopeDeletions;
+    }
+    const runtimeAvailability = {
+        isAvailable: () => runtimeRef?.isAvailable() ?? Boolean(options.active),
+    };
+    // Delegated builder writes. One session store is wired into the handshake
+    // route AND the auth adapter (the route mints what the adapter redeems),
+    // and one replay guard covers the handshake proof and every per-write
+    // proof — the same single-store discipline as createApp in the Node build.
+    // A caller that brings its OWN auth adapter owns this wiring, so we do not
+    // mount a handshake for a store that adapter has never heard of.
+    const writeProofReplayStore = options.writeProofReplayStore ?? createInMemoryWriteProofReplayStore();
+    const writeSessionStore = options.writeSessionStore ??
+        (options.auth ? undefined : createInMemoryWriteSessionStore());
+    // One audience for the whole delegated-write flow: the handshake proof and
+    // every per-write proof are verified against the same origin.
+    const serverOrigin = options.serverOrigin ??
+        (() => options.runtimeOrigin ?? config.server.origin);
+    const auth = options.auth ??
+        createWeb3SignedPsLiteAuth({
+            origin: serverOrigin,
+            ownerAddress: serverOwner,
+            accessToken: options.accessToken,
+            tokenStore,
+            dataReadPolicyPorts: {
+                authSessionVerifier: gateway,
+                grantVerifier: gateway,
+                runtimeAvailability,
+            },
+            ...(writeSessionStore
+                ? {
+                    writeSessions: {
+                        store: writeSessionStore,
+                        replayStore: writeProofReplayStore,
+                        policyPorts: {
+                            authSessionVerifier: gateway,
+                            grantVerifier: gateway,
+                            runtimeAvailability,
+                        },
+                    },
+                }
+                : {}),
+        });
+    const runtime = createPsLiteRuntime({
+        ...options,
+        auth,
+        serverOrigin,
+        writeSessionStore,
+        writeProofReplayStore,
+        storage,
+        config,
+        identity: {
+            address: identity.account.address,
+            publicKey: identity.account.publicKey,
+        },
+        gateway,
+        serverOwner,
+        serverSigner,
+        syncManager,
+        scopeDeletions,
+        diagnostics,
+        lineageGateway,
+        derivatives,
+        saveConfig: async (nextConfig) => {
+            const saved = await savePsLiteConfig(stateStore, nextConfig);
+            Object.assign(config, saved);
+        },
+        stateCapabilities: { config: injected?.state ? "custom" : "indexeddb" },
+        tokenStore,
+        accessLogReader: accessLogStore,
+        accessLogWriter: accessLogStore,
+        // A complete host bundle owns both MCP records too. Direct options remain
+        // available only on the default Web path for backwards compatibility.
+        mcpConnectionStore: injected?.mcpConnections ?? options.mcpConnectionStore,
+        mcpOAuthAuthorizationStore: injected?.mcpOAuthAuthorizations ?? options.mcpOAuthAuthorizationStore,
+    });
+    runtimeRef = runtime;
+    return {
+        runtime,
+        config,
+        identity,
+        stateStore,
+        storage,
+        tokenStore,
+        accessLogStore,
+        syncManager,
+        derivatives,
+    };
+}
+//# sourceMappingURL=browser-runtime.js.map

package/dist/browser-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-runtime.js","sourceRoot":"","sources":["../src/browser-runtime.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAO3F,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EACL,mCAAmC,EACnC,+BAA+B,GAChC,MAAM,6CAA6C,CAAC;AACrD,OAAO,EACL,gCAAgC,EAChC,6BAA6B,GAE9B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,mCAAmC,EACnC,+BAA+B,EAC/B,+BAA+B,EAC/B,wBAAwB,EACxB,gCAAgC,EAChC,gBAAgB,GAGjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,GAGpB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,uBAAuB,EAA8B,MAAM,WAAW,CAAC;AAChF,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EACL,qCAAqC,GAEtC,MAAM,kBAAkB,CAAC;AA2D1B,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAsC;IAEtC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,sBAAsB,CAAC;IACxD,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC;IACrC,IAAI,QAAQ,KAAK,SAAS;QAAE,qCAAqC,CAAC,QAAQ,CAAC,CAAC;IAC5E,yEAAyE;IACzE,6EAA6E;IAC7E,6EAA6E;IAC7E,MAAM,UAAU,GACd,QAAQ,EAAE,KAAK;QACf,+BAA+B,CAAC;YAC9B,MAAM;YACN,SAAS,EAAE,OAAO,CAAC,cAAc,IAAI,OAAO;SAC7C,CAAC,CAAC;IACL,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAC3C,UAAU,EACV,OAAO,CAAC,cAAc,CACvB,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,gCAAgC,CAAC;QACtD,KAAK,EAAE,UAAU;QACjB,cAAc,EAAE,OAAO,CAAC,cAAc;KACvC,CAAC,CAAC;IACH,MAAM,UAAU,GACd,QAAQ,EAAE,MAAM;QAChB,+BAA+B,CAAC;YAC9B,MAAM;YACN,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC;IACL,MAAM,cAAc,GAClB,QAAQ,EAAE,SAAS;QACnB,mCAAmC,CAAC;YAClC,MAAM;YACN,SAAS,EAAE,YAAY;SACxB,CAAC,CAAC;IACL,MAAM,OAAO,GACX,QAAQ,EAAE,OAAO;QACjB,CAAC,MAAM,6BAA6B,CAClC,EAAE,IAAI,EAAE,WAAW,EAAE,EACrB,gCAAgC,CAAC;YAC/B,MAAM,EAAE,OAAO,CAAC,aAAa,IAAI,GAAG,MAAM,UAAU;YACpD,SAAS,EAAE,OAAO,CAAC,gBAAgB,IAAI,OAAO;YAC9C,GAAG,EAAE,OAAO,CAAC,UAAU,IAAI,iBAAiB;SAC7C,CAAC,EACF,OAAO,CAAC,aAAa,CACtB,CAAC,CAAC;IACL,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3E,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC;QAC3C,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,cAAc,EAAE,OAAO,CAAC,cAAc;KACvC,CAAC,CAAC;IACH,MAAM,YAAY,GAChB,OAAO,CAAC,YAAY;QACpB,kBAAkB,CAAC,QAAQ,CAAC,OAAO,EAAE;YACnC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO;YAC/B,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;SACpC,CAAC,CAAC;IACL,6EAA6E;IAC7E,8EAA8E;IAC9E,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,mBAAmB,EAAE,CAAC;IACrE,wEAAwE;IACxE,0EAA0E;IAC1E,yCAAyC;IACzC,MAAM,aAAa,GAAG,mBAAmB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC5D,oEAAoE;IACpE,oEAAoE;IACpE,MAAM,cAAc,GAAG,0BAA0B,CAAC;QAChD,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG;QAC9B,aAAa;KACd,CAAC,CAAC;IACH,IAAI,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC;IAC9C,IAAI,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;IAC5C,IAAI,UAAU,GAAyB,IAAI,CAAC;IAC5C,wEAAwE;IACxE,mEAAmE;IACnE,wEAAwE;IACxE,kEAAkE;IAClE,wBAAwB;IACxB,IAAI,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC;IAC9C,IACE,WAAW,KAAK,IAAI;QACpB,OAAO,CAAC,WAAW,KAAK,SAAS;QACjC,CAAC,OAAO,CAAC,iBAAiB,IAAI,yBAAyB,CAAC,MAAM,CAAC,CAAC,EAChE,CAAC;QACD,WAAW,GAAG,6BAA6B,CAAC;YAC1C,MAAM;YACN,OAAO;YACP,KAAK,EAAE,MAAM,yBAAyB,CAAC,UAAU,CAAC;YAClD,WAAW;YACX,WAAW,EAAE,GAAG,EAAE,CAAC,WAAW;YAC9B,cAAc,EAAE,GAAG,EAAE,CAAC,cAAc;YACpC,gBAAgB,EAAE;gBAChB,mBAAmB,EAAE,OAAO;gBAC5B,aAAa,EAAE,OAAO;aACvB;YACD,mBAAmB,EAAE;gBACnB,WAAW,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;aACxE;YACD,QAAQ,EAAE,OAAO,CAAC,iBAAiB;YACnC,iEAAiE;YACjE,aAAa;YACb,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACrE,OAAO,CAAC,MAAM,EAAE,IAAI,CAClB,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,EACrC,qHAAqH,CACtH,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC;YACzC,MAAM;YACN,UAAU;YACV,OAAO;YACP,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,aAAa,EAAE,QAAQ,CAAC,OAAO;YAC/B,OAAO;YACP,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,cAAc;YACd,WAAW;YACX,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,cAAc;YACd,kBAAkB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC5B,WAAW,EAAE,SAAS,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE;gBACpD,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC,CAAC;SACL,CAAC,CAAC;QACH,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QAC/B,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;IACvC,CAAC;IACD,MAAM,mBAAmB,GAAG;QAC1B,WAAW,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;KACxE,CAAC;IACF,0EAA0E;IAC1E,yEAAyE;IACzE,sEAAsE;IACtE,2EAA2E;IAC3E,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,qBAAqB,GACzB,OAAO,CAAC,qBAAqB,IAAI,mCAAmC,EAAE,CAAC;IACzE,MAAM,iBAAiB,GACrB,OAAO,CAAC,iBAAiB;QACzB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,+BAA+B,EAAE,CAAC,CAAC;IACjE,2EAA2E;IAC3E,8DAA8D;IAC9D,MAAM,YAAY,GAChB,OAAO,CAAC,YAAY;QACpB,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,aAAa,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxD,MAAM,IAAI,GACR,OAAO,CAAC,IAAI;QACZ,0BAA0B,CAAC;YACzB,MAAM,EAAE,YAAY;YACpB,YAAY,EAAE,WAAW;YACzB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,UAAU;YACV,mBAAmB,EAAE;gBACnB,mBAAmB,EAAE,OAAO;gBAC5B,aAAa,EAAE,OAAO;gBACtB,mBAAmB;aACpB;YACD,GAAG,CAAC,iBAAiB;gBACnB,CAAC,CAAC;oBACE,aAAa,EAAE;wBACb,KAAK,EAAE,iBAAiB;wBACxB,WAAW,EAAE,qBAAqB;wBAClC,WAAW,EAAE;4BACX,mBAAmB,EAAE,OAAO;4BAC5B,aAAa,EAAE,OAAO;4BACtB,mBAAmB;yBACpB;qBACF;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;IACL,MAAM,OAAO,GAAG,mBAAmB,CAAC;QAClC,GAAG,OAAO;QACV,IAAI;QACJ,YAAY;QACZ,iBAAiB;QACjB,qBAAqB;QACrB,OAAO;QACP,MAAM;QACN,QAAQ,EAAE;YACR,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO;YACjC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS;SACtC;QACD,OAAO;QACP,WAAW;QACX,YAAY;QACZ,WAAW;QACX,cAAc;QACd,WAAW;QACX,cAAc;QACd,WAAW;QACX,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;YAC/B,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;YAC7D,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;QACD,iBAAiB,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE;QACvE,UAAU;QACV,eAAe,EAAE,cAAc;QAC/B,eAAe,EAAE,cAAc;QAC/B,0EAA0E;QAC1E,sEAAsE;QACtE,kBAAkB,EAAE,QAAQ,EAAE,cAAc,IAAI,OAAO,CAAC,kBAAkB;QAC1E,0BAA0B,EACxB,QAAQ,EAAE,sBAAsB,IAAI,OAAO,CAAC,0BAA0B;KACzE,CAAC,CAAC;IACH,UAAU,GAAG,OAAO,CAAC;IAErB,OAAO;QACL,OAAO;QACP,MAAM;QACN,QAAQ;QACR,UAAU;QACV,OAAO;QACP,UAAU;QACV,cAAc;QACd,WAAW;QACX,WAAW;KACZ,CAAC;AACJ,CAAC"}

package/dist/browser-tls-rustls/browser_tls_rustls.d.ts

@@ -0,0 +1,49 @@
+/* tslint:disable */
+/* eslint-disable */
+
+export class TlsServer {
+    free(): void;
+    [Symbol.dispose](): void;
+    constructor(cert_pem: string, key_pem: string);
+    process_tls(input: Uint8Array): any;
+    write_plaintext(plaintext: Uint8Array, close: boolean): any;
+}
+
+export type InitInput = RequestInfo | URL | Response | BufferSource | WebAssembly.Module;
+
+export interface InitOutput {
+    readonly memory: WebAssembly.Memory;
+    readonly __wbg_tlsserver_free: (a: number, b: number) => void;
+    readonly tlsserver_new: (a: number, b: number, c: number, d: number) => [number, number, number];
+    readonly tlsserver_process_tls: (a: number, b: number, c: number) => [number, number, number];
+    readonly tlsserver_write_plaintext: (a: number, b: number, c: number, d: number) => [number, number, number];
+    readonly __wbindgen_exn_store: (a: number) => void;
+    readonly __externref_table_alloc: () => number;
+    readonly __wbindgen_externrefs: WebAssembly.Table;
+    readonly __wbindgen_malloc: (a: number, b: number) => number;
+    readonly __wbindgen_realloc: (a: number, b: number, c: number, d: number) => number;
+    readonly __externref_table_dealloc: (a: number) => void;
+    readonly __wbindgen_start: () => void;
+}
+
+export type SyncInitInput = BufferSource | WebAssembly.Module;
+
+/**
+ * Instantiates the given `module`, which can either be bytes or
+ * a precompiled `WebAssembly.Module`.
+ *
+ * @param {{ module: SyncInitInput }} module - Passing `SyncInitInput` directly is deprecated.
+ *
+ * @returns {InitOutput}
+ */
+export function initSync(module: { module: SyncInitInput } | SyncInitInput): InitOutput;
+
+/**
+ * If `module_or_path` is {RequestInfo} or {URL}, makes a request and
+ * for everything else, calls `WebAssembly.instantiate` directly.
+ *
+ * @param {{ module_or_path: InitInput | Promise<InitInput> }} module_or_path - Passing `InitInput` directly is deprecated.
+ *
+ * @returns {Promise<InitOutput>}
+ */
+export default function __wbg_init (module_or_path?: { module_or_path: InitInput | Promise<InitInput> } | InitInput | Promise<InitInput>): Promise<InitOutput>;