@opendatalabs/personal-server-ts-lite 0.0.1-canary.00328bf

package/dist/runtime.d.ts

@@ -0,0 +1,188 @@
+import { type SessionTokenVerifierPort } from "@opendatalabs/personal-server-ts-core/auth";
+import { type PersonalServerApiAuthPort, type PersonalServerReadAuthInput, type PersonalServerReadAuthResult, type PersonalServerReadFulfillmentReporter } from "@opendatalabs/personal-server-ts-core/api";
+import { type QuestionStore, type RecomputeScheduler } from "@opendatalabs/personal-server-ts-core/derivatives";
+import type { LineageGatewayPort } from "@opendatalabs/personal-server-ts-core/lineage";
+import { type DataReadPolicyPorts, type DataWritePolicyPorts } from "@opendatalabs/personal-server-ts-core/policy";
+import { type WriteProofReplayStore, type WriteSessionStore } from "@opendatalabs/personal-server-ts-core/write";
+import type { DataStoragePort, RuntimeAvailabilityPort } from "@opendatalabs/personal-server-ts-core/ports";
+import type { ScopeDeletionTracker } from "@opendatalabs/personal-server-ts-core/sync";
+import type { DataPortabilityGatewayConfig, GatewayClient } from "@opendatalabs/vana-sdk/browser";
+import type { AccessLogWriter } from "@opendatalabs/personal-server-ts-core/logging/access-log";
+import type { AccessLogReader } from "@opendatalabs/personal-server-ts-core/logging/access-reader";
+import type { ServerSigner } from "@opendatalabs/personal-server-ts-core/signing";
+import type { SyncManager } from "@opendatalabs/personal-server-ts-core/sync";
+import { type McpConnectionStore, type McpOAuthAuthorizationStore } from "@opendatalabs/personal-server-ts-core/mcp";
+import { DiagnosticsRecorder } from "./diagnostics.js";
+export interface PsLiteStorageAdapter {
+    kind: "indexeddb" | "opfs" | "custom";
+}
+export type PsLiteReadAuthInput = PersonalServerReadAuthInput;
+export type PsLiteReadAuthResult = PersonalServerReadAuthResult;
+export type PsLiteAuthAdapter = PersonalServerApiAuthPort;
+export interface PsLiteRuntimeOptions {
+    storage: PsLiteStorageAdapter | DataStoragePort;
+    auth?: PsLiteAuthAdapter;
+    active?: boolean;
+    now?: () => Date;
+    config?: {
+        server?: {
+            origin?: string;
+        };
+        gateway?: Partial<DataPortabilityGatewayConfig> & {
+            url?: string;
+        };
+        /** X402 read enforcement. Off by default in the browser runtime. */
+        payment?: {
+            enabled?: boolean;
+        };
+    };
+    saveConfig?: (config: unknown) => Promise<void>;
+    identity?: {
+        address: `0x${string}`;
+        publicKey: `0x${string}`;
+    };
+    gateway?: GatewayClient;
+    serverOwner?: `0x${string}`;
+    serverSigner?: Pick<ServerSigner, "signGrantRegistration"> & Partial<Pick<ServerSigner, "signGrantRevocation" | "signRecordDataAccess" | "address">>;
+    syncManager?: (Pick<SyncManager, "trigger" | "getStatus"> & Partial<Pick<SyncManager, "start" | "stop" | "deleteScope">>) | null;
+    /**
+     * Read-side tombstone memory; reads of a scope the gateway reports deleted
+     * answer 410 (stale local copy or not). Built by the browser runtime
+     * alongside the sync manager, which keeps it current.
+     */
+    scopeDeletions?: ScopeDeletionTracker;
+    accessLogReader?: AccessLogReader;
+    accessLogWriter?: AccessLogWriter;
+    readFulfillmentReporter?: PersonalServerReadFulfillmentReporter;
+    /**
+     * Derivative data: gateway lineage access for the data routes (source
+     * lookups on write, signed lineage read, cascade delete walk).
+     */
+    lineageGateway?: LineageGatewayPort;
+    /**
+     * Derivative compute layer (store + scheduler). Omit to leave
+     * /v1/derivatives answering 503; see createPsLiteDerivativeCompute.
+     */
+    derivatives?: {
+        store: QuestionStore;
+        scheduler: RecomputeScheduler;
+    } | null;
+    accessToken?: string;
+    /**
+     * Write API sessions. When present, POST /v1/write/session is mounted and
+     * mints the bearer tokens the auth adapter redeems on POST /v1/data/:scope
+     * and the derivative question routes. The SAME store must be wired into the
+     * adapter (`writeSessions.store`); `createIndexedDbPsLiteRuntime` does both.
+     * Absent = owner-only ingest and no handshake endpoint.
+     *
+     * KNOWN LIMITATION, same as the Node build: sessions and the proof replay
+     * guard are in-memory, so a reload drops live tokens and the builder
+     * re-handshakes. Because both live in the same memory, a reload can never
+     * leave a replayable proof for a session that survived it.
+     */
+    writeSessionStore?: WriteSessionStore;
+    /**
+     * Replay guard shared by the handshake proof and the per-write proofs.
+     * Defaults to a fresh in-memory store.
+     */
+    writeProofReplayStore?: WriteProofReplayStore;
+    /**
+     * The audience every builder proof must name. It MUST be the origin the
+     * auth adapter verifies write proofs against, or a builder would have to
+     * sign the handshake for one audience and its writes for another. Defaults
+     * to the request's own origin.
+     */
+    serverOrigin?: string | (() => string);
+    tokenStore?: PsLiteTokenStore;
+    stateCapabilities?: Partial<PsLiteRuntimeStateCapabilities>;
+    /**
+     * Per-runtime MCP connection store. Omit to disable the MCP endpoints
+     * (`/mcp/:token` + `/v1/mcp/connections`). Pass `createInMemoryMcpConnectionStore()`
+     * to enable with non-persistent storage, or `createIndexedDbMcpConnectionStore()`
+     * for the production browser default.
+     */
+    mcpConnectionStore?: McpConnectionStore;
+    mcpOAuthAuthorizationStore?: McpOAuthAuthorizationStore;
+    mcpOAuthApprovalUrl?: string | (() => string);
+    /**
+     * Optional diagnostics recorder. When provided, GET /v1/diagnostics (owner-only)
+     * returns a structured snapshot useful for debugging stuck approval pages.
+     */
+    diagnostics?: DiagnosticsRecorder;
+}
+export interface PsLiteRuntimeStateCapabilities {
+    tokens: "indexeddb" | "memory" | "custom";
+    accessLogs: "indexeddb" | "memory" | "custom";
+    config: "indexeddb" | "memory" | "custom";
+}
+export interface PsLiteTokenStore {
+    getTokens(): Promise<string[]>;
+    isValid(token: string): Promise<boolean>;
+    addToken(token: string, options?: {
+        expiresAt?: string | Date | null;
+    }): Promise<void>;
+    removeToken(token: string): Promise<void>;
+}
+export interface PsLiteRuntime extends RuntimeAvailabilityPort {
+    readonly kind: "ps-lite";
+    readonly storage: PsLiteStorageAdapter | DataStoragePort;
+    activate(): void;
+    deactivate(): void;
+    fetch(request: Request): Promise<Response>;
+}
+/**
+ * Delegated-write (Write API) wiring for a PS-Lite auth adapter.
+ *
+ * A builder holding `write:<scope>` opens a session at POST /v1/write/session
+ * and then writes through the ordinary ingest endpoint. The adapter and the
+ * handshake route MUST share one `store` (the route mints what the adapter
+ * redeems) and one `replayStore` (the handshake proof and the per-write proofs
+ * are guarded by the same memory). `createIndexedDbPsLiteRuntime` wires both
+ * for you; supply them yourself only when you build the adapter by hand.
+ */
+export interface PsLiteWriteSessionAuthOptions {
+    /** Live write sessions, shared with the handshake route. */
+    store: WriteSessionStore;
+    /**
+     * Replay guard for the per-write `X-Vana-Write-Signature` proofs. Defaults
+     * to a fresh in-memory store, so replay protection is always on; pass the
+     * runtime's store to share one guard with the handshake route.
+     */
+    replayStore?: WriteProofReplayStore;
+    /**
+     * Live builder/grant verification, re-run on EVERY delegated write, so a
+     * revoked or narrowed grant stops writes at the next one.
+     */
+    policyPorts: DataWritePolicyPorts;
+}
+export interface BearerTokenPsLiteAuthOptions {
+    ownerToken: string;
+    builderToken: string;
+    /**
+     * Optional delegated-write support. The static builder token never gains
+     * write access through it: a delegated write still needs a real session
+     * token plus the builder's signed payload proof, verified exactly as the
+     * Node server verifies it.
+     */
+    writeSessions?: PsLiteWriteSessionAuthOptions & {
+        serverOrigin: string | (() => string);
+        serverOwner: `0x${string}`;
+    };
+}
+export interface Web3SignedPsLiteAuthOptions {
+    origin: string | (() => string);
+    ownerAddress: `0x${string}`;
+    dataReadPolicyPorts?: DataReadPolicyPorts;
+    accessToken?: string;
+    tokenStore?: SessionTokenVerifierPort;
+    now?: () => number;
+    /**
+     * Optional delegated-write support. Absent = owner-only ingest, exactly as
+     * before write sessions existed.
+     */
+    writeSessions?: PsLiteWriteSessionAuthOptions;
+}
+export declare function createBearerTokenPsLiteAuth(options: BearerTokenPsLiteAuthOptions): PsLiteAuthAdapter;
+export declare function createWeb3SignedPsLiteAuth(options: Web3SignedPsLiteAuthOptions): PsLiteAuthAdapter;
+export declare function createPsLiteRuntime(options: PsLiteRuntimeOptions): PsLiteRuntime;
+//# sourceMappingURL=runtime.d.ts.map

package/dist/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AASA,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,4CAA4C,CAAC;AAUpD,OAAO,EAOL,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,qCAAqC,EAC3C,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAEL,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACxB,MAAM,mDAAmD,CAAC;AAC3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,+CAA+C,CAAC;AACxF,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EAC1B,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAIL,KAAK,qBAAqB,EAE1B,KAAK,iBAAiB,EACvB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EACV,eAAe,EACf,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,KAAK,EACV,4BAA4B,EAC5B,aAAa,EACd,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAChG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+CAA+C,CAAC;AAClF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4CAA4C,CAAC;AAC9E,OAAO,EAyBL,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,EAChC,MAAM,2CAA2C,CAAC;AAOnD,OAAO,EAEL,mBAAmB,EACpB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,WAAW,GAAG,MAAM,GAAG,QAAQ,CAAC;CACvC;AAED,MAAM,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AAE9D,MAAM,MAAM,oBAAoB,GAAG,4BAA4B,CAAC;AAEhE,MAAM,MAAM,iBAAiB,GAAG,yBAAyB,CAAC;AAE1D,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,oBAAoB,GAAG,eAAe,CAAC;IAChD,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,MAAM,CAAC,EAAE;QACP,MAAM,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC7B,OAAO,CAAC,EAAE,OAAO,CAAC,4BAA4B,CAAC,GAAG;YAAE,GAAG,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACnE,oEAAoE;QACpE,OAAO,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;KACjC,CAAC;IACF,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;QAAC,SAAS,EAAE,KAAK,MAAM,EAAE,CAAA;KAAE,CAAC;IAChE,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAK5B,YAAY,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,uBAAuB,CAAC,GACxD,OAAO,CACL,IAAI,CACF,YAAY,EACZ,qBAAqB,GAAG,sBAAsB,GAAG,SAAS,CAC3D,CACF,CAAC;IACJ,WAAW,CAAC,EACR,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,GAAG,WAAW,CAAC,GACzC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,GAAG,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,GAC/D,IAAI,CAAC;IACT;;;;OAIG;IACH,cAAc,CAAC,EAAE,oBAAoB,CAAC;IACtC,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,uBAAuB,CAAC,EAAE,qCAAqC,CAAC;IAChE;;;OAGG;IACH,cAAc,CAAC,EAAE,kBAAkB,CAAC;IACpC;;;OAGG;IACH,WAAW,CAAC,EAAE;QAAE,KAAK,EAAE,aAAa,CAAC;QAAC,SAAS,EAAE,kBAAkB,CAAA;KAAE,GAAG,IAAI,CAAC;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;OAGG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAC9C;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACvC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,iBAAiB,CAAC,EAAE,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC5D;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,0BAA0B,CAAC,EAAE,0BAA0B,CAAC;IACxD,mBAAmB,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IAC9C;;;OAGG;IACH,WAAW,CAAC,EAAE,mBAAmB,CAAC;CACnC;AAED,MAAM,WAAW,8BAA8B;IAC7C,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAC1C,UAAU,EAAE,WAAW,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAC9C,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,QAAQ,CAAC;CAC3C;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/B,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC,QAAQ,CACN,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAA;KAAE,GAC7C,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3C;AAMD,MAAM,WAAW,aAAc,SAAQ,uBAAuB;IAC5D,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,oBAAoB,GAAG,eAAe,CAAC;IACzD,QAAQ,IAAI,IAAI,CAAC;IACjB,UAAU,IAAI,IAAI,CAAC;IACnB,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC5C;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,6BAA6B;IAC5C,4DAA4D;IAC5D,KAAK,EAAE,iBAAiB,CAAC;IACzB;;;;OAIG;IACH,WAAW,CAAC,EAAE,qBAAqB,CAAC;IACpC;;;OAGG;IACH,WAAW,EAAE,oBAAoB,CAAC;CACnC;AAED,MAAM,WAAW,4BAA4B;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,6BAA6B,GAAG;QAC9C,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;QACtC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;KAC5B,CAAC;CACH;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IAChC,YAAY,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,wBAAwB,CAAC;IACtC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB;;;OAGG;IACH,aAAa,CAAC,EAAE,6BAA6B,CAAC;CAC/C;AA2MD,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,4BAA4B,GACpC,iBAAiB,CAmCnB;AAkCD,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,2BAA2B,GACnC,iBAAiB,CAgEnB;AAoFD,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,oBAAoB,GAC5B,aAAa,CA8jBf"}