@opendatalabs/personal-server-ts-lite 0.0.1-canary.01ca694 → 0.0.1-canary.052d47e

package/dist/derivatives.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"derivatives.js","sourceRoot":"","sources":["../src/derivatives.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AASH,OAAO,EACL,eAAe,EACf,2BAA2B,EAC3B,uCAAuC,EACvC,yBAAyB,EACzB,wBAAwB,EACxB,0BAA0B,GAM3B,MAAM,mDAAmD,CAAC;AAK3D,MAAM,aAAa,GAAG,yBAAyB,CAAC;AAWhD,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,UAA4B;IAE5B,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,GAAG,CAAuB,aAAa,CAAC,CAAC;IACxE,uEAAuE;IACvE,gCAAgC;IAChC,MAAM,OAAO,GAAG,CAAC,KAAK,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAC/D,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACb,GAAG,QAAQ;QACX,SAAS,EAAE,QAAQ,CAAC,SAAS,IAAI,WAAW;KAC7C,CAAC,CACH,CAAC;IACF,OAAO,2BAA2B,CAAC;QACjC,OAAO;QACP,QAAQ,EAAE,CAAC,SAAS,EAAE,EAAE,CACtB,UAAU,CAAC,GAAG,CAAuB,aAAa,EAAE;YAClD,OAAO,EAAE,CAAC;YACV,SAAS;SACV,CAAC;KACL,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAoB;IAC5D,OAAO,CACL,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAC5C,0BAA0B,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAC/C,CAAC;AACJ,CAAC;AAgCD,MAAM,UAAU,6BAA6B,CAC3C,OAAuC;IAEvC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM;QAC3B,CAAC,CAAC;YACE,IAAI,EAAE,CAAC,OAAgC,EAAE,OAAe,EAAE,EAAE,CAC1D,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;YACxC,IAAI,EAAE,CAAC,OAAgC,EAAE,OAAe,EAAE,EAAE,CAC1D,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;SACzC;QACH,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,QAAQ,GACZ,OAAO,CAAC,QAAQ;QAChB,uCAAuC,CAAC;YACtC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO;YACzC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK;YACrC,oEAAoE;YACpE,6DAA6D;YAC7D,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,kEAAkE;YAClE,qEAAqE;YACrE,+DAA+D;YAC/D,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI;gBACvC,CAAC,CAAC,yBAAyB,CAAC;oBACxB,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO;oBACzC,aAAa,EAAE,OAAO,CAAC,aAAa;oBACpC,MAAM;iBACP,CAAC;gBACJ,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;IACL,MAAM,SAAS,GAAuB,wBAAwB,CAAC;QAC7D,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,mBAAmB;QACxD,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,MAAM;QACN,OAAO,EAAE,CAAC,UAAU,EAAE,EAAE,CACtB,eAAe,CAAC,UAAU,EAAE;YAC1B,iEAAiE;YACjE,gBAAgB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC1B,SAAS,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE;gBACvC,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC,CAAC;YACJ,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;YAChD,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,QAAQ;YACR,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc;YACvD,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,IAAI;YAC5C,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,EAAE;YAC1C,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,MAAM;SACP,CAAC;KACL,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACvD,CAAC"}

package/dist/index.d.ts

@@ -3,13 +3,16 @@ export { startPersonalServer, type StartPersonalServerLiteOptions, type StartPer
 export type { PersonalServerHandle, PersonalServerClientErrorBody, PersonalServerDataVersion, PersonalServerHealthRegistration, PersonalServerIdentity, PersonalServerInfo, PersonalServerAuthRequestOptions, PersonalServerListDataOptions, PersonalServerListDataResult, PersonalServerListVersionsOptions, PersonalServerListVersionsResult, PersonalServerReadDataOptions, PersonalServerRegistrationRequest, PersonalServerStatus, PersonalServerSyncTriggerResult, PersonalServerUrls, } from "@opendatalabs/personal-server-ts-core/client";
 export { PersonalServerClientError, dataListPath, dataReadPath, dataVersionsPath, parsePersonalServerJsonResponse, } from "@opendatalabs/personal-server-ts-core/client";
 export { handlePsLiteBridgeRequest, type PsLiteBridgeRequest, type PsLiteBridgeResponse, } from "./bridge.js";
-export { createIndexedDbPsLitePersistence, createOpfsPsLiteDataFileStore, createPersistentPsLiteStorage, isOpfsAvailable, type IndexedDbPsLitePersistenceOptions, type PsLiteDataFileStore, type PsLiteFileStorageKind, type PsLitePersistedStorageState, type PsLitePersistenceAdapter, } from "./storage.js";
+export { createIndexedDbPsLitePersistence, createOpfsPsLiteDataFileStore, createPersistentPsLiteStorage, isOpfsAvailable, type IndexedDbPsLitePersistenceOptions, type PsLiteDataFileStore, type PsLiteFileStorageKind, type PsLitePersistedStorageState, type PsLitePersistenceAdapter, type PsLiteStorageCapabilities, type PsLiteStoragePort, } from "./storage.js";
 export { createIndexedDbPsLiteAccessLogStore, createIndexedDbPsLiteStateStore, createIndexedDbPsLiteTokenStore, loadOrCreatePsLiteConfig, loadOrCreatePsLiteServerIdentity, loadPsLiteRelayState, savePsLiteConfig, savePsLiteRelayState, type IndexedDbPsLiteAccessLogStoreOptions, type IndexedDbPsLiteStateStoreOptions, type IndexedDbPsLiteTokenStoreOptions, type PsLiteEncryptedPrivateKey, type PsLiteEncryptedServerIdentity, type PsLiteRelayState, type PsLiteStateKey, type PsLiteStateStore, type PsLiteUnlockedServerIdentity, } from "./state.js";
-export { createPsLiteSyncCursor, createPsLiteSyncManager, type PsLiteSyncOptions, } from "./sync.js";
+export { createPsLitePendingBlobDeletionStore, createPsLiteSyncCursor, createPsLiteSyncManager, type PsLiteSyncOptions, } from "./sync.js";
 export { resolvePsLiteOwner, type PsLiteOwnerBindingInput, } from "./owner-binding.js";
-export { createBearerTokenPsLiteAuth, createPsLiteRuntime, createWeb3SignedPsLiteAuth, type BearerTokenPsLiteAuthOptions, type PsLiteAuthAdapter, type PsLiteReadAuthInput, type PsLiteRuntime, type PsLiteRuntimeOptions, type PsLiteStorageAdapter, type PsLiteTokenStore, type Web3SignedPsLiteAuthOptions, } from "./runtime.js";
+export { createPsLiteDerivativeCompute, createPsLiteQuestionStore, psLiteInferenceConfigured, type PsLiteDerivativeCompute, type PsLiteDerivativeComputeOptions, } from "./derivatives.js";
+export { createBearerTokenPsLiteAuth, createPsLiteRuntime, createWeb3SignedPsLiteAuth, type BearerTokenPsLiteAuthOptions, type PsLiteAuthAdapter, type PsLiteReadAuthInput, type PsLiteRuntime, type PsLiteRuntimeOptions, type PsLiteStorageAdapter, type PsLiteTokenStore, type PsLiteWriteSessionAuthOptions, type Web3SignedPsLiteAuthOptions, } from "./runtime.js";
+export { createInMemoryWriteProofReplayStore, createInMemoryWriteSessionStore, hashWriteSessionToken, verifyStoredWriterAttribution, WRITE_SIGNATURE_HEADER, WRITER_ATTRIBUTION_KEY, type WriteProofReplayStore, type WriteSessionRecord, type WriteSessionStore, } from "@opendatalabs/personal-server-ts-core/write";
 export { createIndexedDbMcpConnectionStore, createIndexedDbMcpOAuthAuthorizationStore, type IndexedDbMcpConnectionStoreOptions, type IndexedDbMcpOAuthAuthorizationStoreOptions, } from "./mcp-store.js";
 export { DiagnosticsRecorder, collectDiagnosticsWithTimeout, DIAGNOSTICS_VERSION, type ActiveOperation, type DiagnosticsEvent, type DiagnosticsPhase, type LastNetworkOperation, type PsLiteDiagnosticsSnapshot, type RecordEventOptions, type ScopeDiagnostics, type ScopeReadinessStatus, type StorageHealthSummary, type SyncDiagnostics, } from "./diagnostics.js";
-export { decodeDataFrame, encodeDataFrame, psLiteRelayControlUrl, psLiteRelayPublicUrl, startPsLiteRelayClient, type PsLiteRelayClient, type PsLiteRelayClientOptions, type PsLiteRelayStatus, type PsLiteRelayTlsFactory, type PsLiteRelayTlsPrepareInput, type PsLiteRelayTlsStep, type PsLiteRelayTlsStream, type PsLiteRelayTlsStreamInput, type PsLiteRelayWebSocket, type PsLiteRelayWebSocketFactory, } from "./relay.js";
-export { createRustlsPsLiteRelayTlsFactory, psLiteRelayPublicHost, psLiteRelayPublicUrl as psLiteRelayTlsPublicUrl, type PsLiteRelayTlsIdentity, type RustlsPsLiteRelayTlsOptions, } from "./relay-tls.js";
+export { decodeDataFrame, encodeDataFrame, psLiteRelayControlUrl, psLiteRelayPublicUrl, RELAY_CLOSE_SESSION_REPLACED, startPsLiteRelayClient, type PsLiteRelayClient, type PsLiteRelayClientOptions, type PsLiteRelayCloseEvent, type PsLiteRelayStatus, type PsLiteRelayTlsFactory, type PsLiteRelayTlsPrepareInput, type PsLiteRelayTlsStep, type PsLiteRelayTlsStream, type PsLiteRelayTlsStreamInput, type PsLiteRelayWebSocket, type PsLiteRelayWebSocketFactory, } from "./relay.js";
+export { createLocalStoragePsLiteRelayTlsIdentityStore, createRustlsPsLiteRelayTlsFactory, psLiteRelayPublicHost, psLiteRelayPublicUrl as psLiteRelayTlsPublicUrl, type PsLiteRelayTlsIdentity, type PsLiteRelayTlsIdentityStore, type RustlsPsLiteRelayTlsOptions, } from "./relay-tls.js";
+export { assertCompletePsLitePersistenceBundle, psLitePersistenceRuntimeOptions, type PsLitePersistenceBundle, type PsLitePersistenceRuntimeOptions, } from "./persistence.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,GACnC,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,mBAAmB,EACnB,KAAK,8BAA8B,EACnC,KAAK,mCAAmC,GACzC,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,oBAAoB,EACpB,6BAA6B,EAC7B,yBAAyB,EACzB,gCAAgC,EAChC,sBAAsB,EACtB,kBAAkB,EAClB,gCAAgC,EAChC,6BAA6B,EAC7B,4BAA4B,EAC5B,iCAAiC,EACjC,gCAAgC,EAChC,6BAA6B,EAC7B,iCAAiC,EACjC,oBAAoB,EACpB,+BAA+B,EAC/B,kBAAkB,GACnB,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,yBAAyB,EACzB,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,+BAA+B,GAChC,MAAM,8CAA8C,CAAC;AAEtD,OAAO,EACL,yBAAyB,EACzB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,gCAAgC,EAChC,6BAA6B,EAC7B,6BAA6B,EAC7B,eAAe,EACf,KAAK,iCAAiC,EACtC,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,EAChC,KAAK,wBAAwB,GAC9B,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,mCAAmC,EACnC,+BAA+B,EAC/B,+BAA+B,EAC/B,wBAAwB,EACxB,gCAAgC,EAChC,oBAAoB,EACpB,gBAAgB,EAChB,oBAAoB,EACpB,KAAK,oCAAoC,EACzC,KAAK,gCAAgC,EACrC,KAAK,gCAAgC,EACrC,KAAK,yBAAyB,EAC9B,KAAK,6BAA6B,EAClC,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,4BAA4B,GAClC,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,KAAK,iBAAiB,GACvB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,kBAAkB,EAClB,KAAK,uBAAuB,GAC7B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,0BAA0B,EAC1B,KAAK,4BAA4B,EACjC,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,2BAA2B,GACjC,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,iCAAiC,EACjC,yCAAyC,EACzC,KAAK,kCAAkC,EACvC,KAAK,0CAA0C,GAChD,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,mBAAmB,EACnB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,eAAe,GACrB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,EACzB,KAAK,2BAA2B,GACjC,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,iCAAiC,EACjC,qBAAqB,EACrB,oBAAoB,IAAI,uBAAuB,EAC/C,KAAK,sBAAsB,EAC3B,KAAK,2BAA2B,GACjC,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,GACnC,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,mBAAmB,EACnB,KAAK,8BAA8B,EACnC,KAAK,mCAAmC,GACzC,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,oBAAoB,EACpB,6BAA6B,EAC7B,yBAAyB,EACzB,gCAAgC,EAChC,sBAAsB,EACtB,kBAAkB,EAClB,gCAAgC,EAChC,6BAA6B,EAC7B,4BAA4B,EAC5B,iCAAiC,EACjC,gCAAgC,EAChC,6BAA6B,EAC7B,iCAAiC,EACjC,oBAAoB,EACpB,+BAA+B,EAC/B,kBAAkB,GACnB,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,yBAAyB,EACzB,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,+BAA+B,GAChC,MAAM,8CAA8C,CAAC;AAEtD,OAAO,EACL,yBAAyB,EACzB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,gCAAgC,EAChC,6BAA6B,EAC7B,6BAA6B,EAC7B,eAAe,EACf,KAAK,iCAAiC,EACtC,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,EAChC,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,iBAAiB,GACvB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,mCAAmC,EACnC,+BAA+B,EAC/B,+BAA+B,EAC/B,wBAAwB,EACxB,gCAAgC,EAChC,oBAAoB,EACpB,gBAAgB,EAChB,oBAAoB,EACpB,KAAK,oCAAoC,EACzC,KAAK,gCAAgC,EACrC,KAAK,gCAAgC,EACrC,KAAK,yBAAyB,EAC9B,KAAK,6BAA6B,EAClC,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,4BAA4B,GAClC,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,oCAAoC,EACpC,sBAAsB,EACtB,uBAAuB,EACvB,KAAK,iBAAiB,GACvB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,kBAAkB,EAClB,KAAK,uBAAuB,GAC7B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,EACzB,yBAAyB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,8BAA8B,GACpC,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,0BAA0B,EAC1B,KAAK,4BAA4B,EACjC,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,6BAA6B,EAClC,KAAK,2BAA2B,GACjC,MAAM,cAAc,CAAC;AAItB,OAAO,EACL,mCAAmC,EACnC,+BAA+B,EAC/B,qBAAqB,EACrB,6BAA6B,EAC7B,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,GACvB,MAAM,6CAA6C,CAAC;AAErD,OAAO,EACL,iCAAiC,EACjC,yCAAyC,EACzC,KAAK,kCAAkC,EACvC,KAAK,0CAA0C,GAChD,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,mBAAmB,EACnB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,eAAe,GACrB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,4BAA4B,EAC5B,sBAAsB,EACtB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,EACzB,KAAK,2BAA2B,GACjC,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,6CAA6C,EAC7C,iCAAiC,EACjC,qBAAqB,EACrB,oBAAoB,IAAI,uBAAuB,EAC/C,KAAK,sBAAsB,EAC3B,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,GACjC,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,qCAAqC,EACrC,+BAA+B,EAC/B,KAAK,uBAAuB,EAC5B,KAAK,+BAA+B,GACrC,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -4,11 +4,16 @@ export { PersonalServerClientError, dataListPath, dataReadPath, dataVersionsPath
 export { handlePsLiteBridgeRequest, } from "./bridge.js";
 export { createIndexedDbPsLitePersistence, createOpfsPsLiteDataFileStore, createPersistentPsLiteStorage, isOpfsAvailable, } from "./storage.js";
 export { createIndexedDbPsLiteAccessLogStore, createIndexedDbPsLiteStateStore, createIndexedDbPsLiteTokenStore, loadOrCreatePsLiteConfig, loadOrCreatePsLiteServerIdentity, loadPsLiteRelayState, savePsLiteConfig, savePsLiteRelayState, } from "./state.js";
-export { createPsLiteSyncCursor, createPsLiteSyncManager, } from "./sync.js";
+export { createPsLitePendingBlobDeletionStore, createPsLiteSyncCursor, createPsLiteSyncManager, } from "./sync.js";
 export { resolvePsLiteOwner, } from "./owner-binding.js";
+export { createPsLiteDerivativeCompute, createPsLiteQuestionStore, psLiteInferenceConfigured, } from "./derivatives.js";
 export { createBearerTokenPsLiteAuth, createPsLiteRuntime, createWeb3SignedPsLiteAuth, } from "./runtime.js";
+// Delegated builder writes: hosts that build their own auth adapter (or want
+// one store shared across several runtimes) wire these themselves.
+export { createInMemoryWriteProofReplayStore, createInMemoryWriteSessionStore, hashWriteSessionToken, verifyStoredWriterAttribution, WRITE_SIGNATURE_HEADER, WRITER_ATTRIBUTION_KEY, } from "@opendatalabs/personal-server-ts-core/write";
 export { createIndexedDbMcpConnectionStore, createIndexedDbMcpOAuthAuthorizationStore, } from "./mcp-store.js";
 export { DiagnosticsRecorder, collectDiagnosticsWithTimeout, DIAGNOSTICS_VERSION, } from "./diagnostics.js";
-export { decodeDataFrame, encodeDataFrame, psLiteRelayControlUrl, psLiteRelayPublicUrl, startPsLiteRelayClient, } from "./relay.js";
-export { createRustlsPsLiteRelayTlsFactory, psLiteRelayPublicHost, psLiteRelayPublicUrl as psLiteRelayTlsPublicUrl, } from "./relay-tls.js";
+export { decodeDataFrame, encodeDataFrame, psLiteRelayControlUrl, psLiteRelayPublicUrl, RELAY_CLOSE_SESSION_REPLACED, startPsLiteRelayClient, } from "./relay.js";
+export { createLocalStoragePsLiteRelayTlsIdentityStore, createRustlsPsLiteRelayTlsFactory, psLiteRelayPublicHost, psLiteRelayPublicUrl as psLiteRelayTlsPublicUrl, } from "./relay-tls.js";
+export { assertCompletePsLitePersistenceBundle, psLitePersistenceRuntimeOptions, } from "./persistence.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,GAG7B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,mBAAmB,GAGpB,MAAM,aAAa,CAAC;AAmBrB,OAAO,EACL,yBAAyB,EACzB,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,+BAA+B,GAChC,MAAM,8CAA8C,CAAC;AAEtD,OAAO,EACL,yBAAyB,GAG1B,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,gCAAgC,EAChC,6BAA6B,EAC7B,6BAA6B,EAC7B,eAAe,GAMhB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,mCAAmC,EACnC,+BAA+B,EAC/B,+BAA+B,EAC/B,wBAAwB,EACxB,gCAAgC,EAChC,oBAAoB,EACpB,gBAAgB,EAChB,oBAAoB,GAUrB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,sBAAsB,EACtB,uBAAuB,GAExB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,kBAAkB,GAEnB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,0BAA0B,GAS3B,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,iCAAiC,EACjC,yCAAyC,GAG1C,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,mBAAmB,GAWpB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,GAWvB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,iCAAiC,EACjC,qBAAqB,EACrB,oBAAoB,IAAI,uBAAuB,GAGhD,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,GAG7B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,mBAAmB,GAGpB,MAAM,aAAa,CAAC;AAmBrB,OAAO,EACL,yBAAyB,EACzB,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,+BAA+B,GAChC,MAAM,8CAA8C,CAAC;AAEtD,OAAO,EACL,yBAAyB,GAG1B,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,gCAAgC,EAChC,6BAA6B,EAC7B,6BAA6B,EAC7B,eAAe,GAQhB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,mCAAmC,EACnC,+BAA+B,EAC/B,+BAA+B,EAC/B,wBAAwB,EACxB,gCAAgC,EAChC,oBAAoB,EACpB,gBAAgB,EAChB,oBAAoB,GAUrB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,oCAAoC,EACpC,sBAAsB,EACtB,uBAAuB,GAExB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,kBAAkB,GAEnB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,EACzB,yBAAyB,GAG1B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,0BAA0B,GAU3B,MAAM,cAAc,CAAC;AAEtB,6EAA6E;AAC7E,mEAAmE;AACnE,OAAO,EACL,mCAAmC,EACnC,+BAA+B,EAC/B,qBAAqB,EACrB,6BAA6B,EAC7B,sBAAsB,EACtB,sBAAsB,GAIvB,MAAM,6CAA6C,CAAC;AAErD,OAAO,EACL,iCAAiC,EACjC,yCAAyC,GAG1C,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,mBAAmB,GAWpB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,4BAA4B,EAC5B,sBAAsB,GAYvB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,6CAA6C,EAC7C,iCAAiC,EACjC,qBAAqB,EACrB,oBAAoB,IAAI,uBAAuB,GAIhD,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,qCAAqC,EACrC,+BAA+B,GAGhC,MAAM,kBAAkB,CAAC"}

package/dist/persistence.d.ts

@@ -0,0 +1,69 @@
+import type { DataStoragePort } from "@opendatalabs/personal-server-ts-core/ports";
+import type { ServerConfig } from "@opendatalabs/personal-server-ts-core/schemas";
+import type { AccessLogReader } from "@opendatalabs/personal-server-ts-core/logging/access-reader";
+import type { AccessLogWriter } from "@opendatalabs/personal-server-ts-core/logging/access-log";
+import type { McpConnectionStore, McpOAuthAuthorizationStore } from "@opendatalabs/personal-server-ts-core/mcp";
+import type { PsLiteRuntimeOptions, PsLiteTokenStore } from "./runtime.js";
+import { type PsLiteStateStore } from "./state.js";
+import type { PsLiteRelayTlsIdentityStore } from "./relay-tls.js";
+/**
+ * The complete set of PS Lite persistence ports, named as one composition
+ * contract for a host (Mobile) that backs them all with a single durable store.
+ *
+ * This is a struct of the EXISTING narrow contracts — it deliberately does not
+ * collapse them into one catch-all domain API. A host may implement each port
+ * over one SQLite database, but PS Lite keeps addressing them by their narrow
+ * responsibilities (data storage, key/value state, tokens, access logs, MCP
+ * connection/authorization records, relay TLS identity).
+ *
+ * `relayTlsIdentity` is consumed by the relay TLS factory
+ * (`createRustlsPsLiteRelayTlsFactory`), not the HTTP runtime. The start
+ * factory forwards it to the relay automatically. A supplied bundle is all or
+ * nothing: hosts must not accidentally combine native and browser persistence.
+ */
+export interface PsLitePersistenceBundle {
+    /** Data envelopes + index metadata. */
+    storage: DataStoragePort;
+    /** Key/value runtime state: config, encrypted server identity, relay, cursor. */
+    state: PsLiteStateStore;
+    /** Session/device access tokens. */
+    tokens: PsLiteTokenStore;
+    /** Access-log read + write. */
+    accessLog: AccessLogReader & AccessLogWriter;
+    /** Per-connection MCP records (grantee key, token hash, grants). */
+    mcpConnections: McpConnectionStore;
+    /** In-flight MCP OAuth authorization records. */
+    mcpOAuthAuthorizations: McpOAuthAuthorizationStore;
+    /** Issued relay TLS identity cache. Consumed by the relay TLS factory. */
+    relayTlsIdentity: PsLiteRelayTlsIdentityStore;
+}
+/**
+ * The subset of {@link PsLiteRuntimeOptions} that a persistence bundle supplies.
+ * Everything a caller still owns (auth, identity, gateway, signer, config
+ * values, sync manager) stays out of the bundle.
+ */
+export type PsLitePersistenceRuntimeOptions = Pick<PsLiteRuntimeOptions, "storage" | "tokenStore" | "accessLogReader" | "accessLogWriter" | "saveConfig" | "mcpConnectionStore" | "mcpOAuthAuthorizationStore"> & Required<Pick<PsLiteRuntimeOptions, "config">>;
+/**
+ * Map a {@link PsLitePersistenceBundle} onto the runtime option subset it backs,
+ * so a host can construct PS Lite with no direct browser storage dependency:
+ *
+ * ```ts
+ * const runtime = createPsLiteRuntime({
+ *   ...(await psLitePersistenceRuntimeOptions(bundle, configDefaults)),
+ *   auth,
+ *   identity,
+ *   serverOwner,
+ *   active: true,
+ * });
+ * ```
+ *
+ * `saveConfig` is derived from the injected state store via the existing
+ * `savePsLiteConfig` contract, so config writes land in the host's store.
+ */
+export declare function psLitePersistenceRuntimeOptions(bundle: PsLitePersistenceBundle, configDefaults?: Partial<ServerConfig>): Promise<PsLitePersistenceRuntimeOptions>;
+/**
+ * Defends the all-or-nothing bundle contract at the JavaScript boundary, where
+ * TypeScript's required properties are not enforced.
+ */
+export declare function assertCompletePsLitePersistenceBundle(bundle: PsLitePersistenceBundle | null | undefined): void;
+//# sourceMappingURL=persistence.d.ts.map

package/dist/persistence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"persistence.d.ts","sourceRoot":"","sources":["../src/persistence.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+CAA+C,CAAC;AAClF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAChG,OAAO,KAAK,EACV,kBAAkB,EAClB,0BAA0B,EAC3B,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAC3E,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAElE;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,uBAAuB;IACtC,uCAAuC;IACvC,OAAO,EAAE,eAAe,CAAC;IACzB,iFAAiF;IACjF,KAAK,EAAE,gBAAgB,CAAC;IACxB,oCAAoC;IACpC,MAAM,EAAE,gBAAgB,CAAC;IACzB,+BAA+B;IAC/B,SAAS,EAAE,eAAe,GAAG,eAAe,CAAC;IAC7C,oEAAoE;IACpE,cAAc,EAAE,kBAAkB,CAAC;IACnC,iDAAiD;IACjD,sBAAsB,EAAE,0BAA0B,CAAC;IACnD,0EAA0E;IAC1E,gBAAgB,EAAE,2BAA2B,CAAC;CAC/C;AAED;;;;GAIG;AACH,MAAM,MAAM,+BAA+B,GAAG,IAAI,CAChD,oBAAoB,EAClB,SAAS,GACT,YAAY,GACZ,iBAAiB,GACjB,iBAAiB,GACjB,YAAY,GACZ,oBAAoB,GACpB,4BAA4B,CAC/B,GACC,QAAQ,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEjD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,+BAA+B,CACnD,MAAM,EAAE,uBAAuB,EAC/B,cAAc,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,GACrC,OAAO,CAAC,+BAA+B,CAAC,CAgB1C;AAED;;;GAGG;AACH,wBAAgB,qCAAqC,CACnD,MAAM,EAAE,uBAAuB,GAAG,IAAI,GAAG,SAAS,GACjD,IAAI,CAmBN"}

package/dist/persistence.js

@@ -0,0 +1,58 @@
+import { loadOrCreatePsLiteConfig, savePsLiteConfig, } from "./state.js";
+/**
+ * Map a {@link PsLitePersistenceBundle} onto the runtime option subset it backs,
+ * so a host can construct PS Lite with no direct browser storage dependency:
+ *
+ * ```ts
+ * const runtime = createPsLiteRuntime({
+ *   ...(await psLitePersistenceRuntimeOptions(bundle, configDefaults)),
+ *   auth,
+ *   identity,
+ *   serverOwner,
+ *   active: true,
+ * });
+ * ```
+ *
+ * `saveConfig` is derived from the injected state store via the existing
+ * `savePsLiteConfig` contract, so config writes land in the host's store.
+ */
+export async function psLitePersistenceRuntimeOptions(bundle, configDefaults) {
+    assertCompletePsLitePersistenceBundle(bundle);
+    const config = await loadOrCreatePsLiteConfig(bundle.state, configDefaults);
+    return {
+        storage: bundle.storage,
+        config,
+        tokenStore: bundle.tokens,
+        accessLogReader: bundle.accessLog,
+        accessLogWriter: bundle.accessLog,
+        saveConfig: async (nextConfig) => {
+            const saved = await savePsLiteConfig(bundle.state, nextConfig);
+            Object.assign(config, saved);
+        },
+        mcpConnectionStore: bundle.mcpConnections,
+        mcpOAuthAuthorizationStore: bundle.mcpOAuthAuthorizations,
+    };
+}
+/**
+ * Defends the all-or-nothing bundle contract at the JavaScript boundary, where
+ * TypeScript's required properties are not enforced.
+ */
+export function assertCompletePsLitePersistenceBundle(bundle) {
+    if (!bundle || typeof bundle !== "object") {
+        throw new Error("PS Lite persistence bundle must be a complete object");
+    }
+    const required = [
+        "storage",
+        "state",
+        "tokens",
+        "accessLog",
+        "mcpConnections",
+        "mcpOAuthAuthorizations",
+        "relayTlsIdentity",
+    ];
+    const missing = required.filter((key) => bundle[key] == null);
+    if (missing.length > 0) {
+        throw new Error(`PS Lite persistence bundle must be complete; missing ${missing.join(", ")}`);
+    }
+}
+//# sourceMappingURL=persistence.js.map

package/dist/persistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"persistence.js","sourceRoot":"","sources":["../src/persistence.ts"],"names":[],"mappings":"AASA,OAAO,EACL,wBAAwB,EACxB,gBAAgB,GAEjB,MAAM,YAAY,CAAC;AAoDpB;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,MAA+B,EAC/B,cAAsC;IAEtC,qCAAqC,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,MAAM,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IAC5E,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM;QACN,UAAU,EAAE,MAAM,CAAC,MAAM;QACzB,eAAe,EAAE,MAAM,CAAC,SAAS;QACjC,eAAe,EAAE,MAAM,CAAC,SAAS;QACjC,UAAU,EAAE,KAAK,EAAE,UAAmB,EAAE,EAAE;YACxC,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;YAC/D,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;QACD,kBAAkB,EAAE,MAAM,CAAC,cAAc;QACzC,0BAA0B,EAAE,MAAM,CAAC,sBAAsB;KAC1D,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qCAAqC,CACnD,MAAkD;IAElD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,QAAQ,GAAsC;QAClD,SAAS;QACT,OAAO;QACP,QAAQ;QACR,WAAW;QACX,gBAAgB;QAChB,wBAAwB;QACxB,kBAAkB;KACnB,CAAC;IACF,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC;IAC9D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,wDAAwD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC7E,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/relay-tls.d.ts

@@ -1,10 +1,45 @@
 import type { PsLiteRelayTlsFactory } from "./relay.js";
+/**
+ * Persistence port for the relay's issued TLS identity. PS Lite runtime code
+ * resolves the cached cert through this injected store instead of reaching for
+ * `globalThis.localStorage` directly, so a non-browser host (Mobile) can back
+ * it with app-private storage. Browser callers get the localStorage-backed
+ * default via {@link createLocalStoragePsLiteRelayTlsIdentityStore}.
+ */
+export interface PsLiteRelayTlsIdentityStore {
+    read(hostname: string): Promise<PsLiteRelayTlsIdentity | null> | PsLiteRelayTlsIdentity | null;
+    write(identity: PsLiteRelayTlsIdentity): Promise<void> | void;
+}
 export interface RustlsPsLiteRelayTlsOptions {
     controlUrl: string;
     publicSuffix?: string;
     certIssuerUrl?: string;
+    /**
+     * Injected persistence for the issued relay TLS identity. Omit to fall back
+     * to {@link storage} (or, if that is also omitted, the browser localStorage
+     * default). Non-browser hosts pass their own store to keep runtime code free
+     * of hidden `globalThis` access.
+     */
+    identityStore?: PsLiteRelayTlsIdentityStore;
+    /**
+     * @deprecated Prefer {@link identityStore}. A raw `Storage` is wrapped by
+     * {@link createLocalStoragePsLiteRelayTlsIdentityStore}. Retained so existing
+     * browser callers keep their exact localStorage behavior.
+     */
     storage?: Storage;
     logger?: (line: string) => void;
+    /**
+     * Max time to wait on the relay's certificate endpoint before treating this
+     * attempt as failed and serving the self-signed fallback. A hung issuer
+     * (observed live, BUI-666: the endpoint accepts the POST and never responds)
+     * would otherwise leave the identity promise pending forever — and every
+     * incoming TLS handshake awaits that promise, so the public endpoint serves
+     * zero bytes while the control session looks healthy.
+     *
+     * Default 60s. This preserves the old per-session ACME margin and is still
+     * bounded for a truly wedged relay endpoint.
+     */
+    issueCertTimeoutMs?: number;
 }
 export interface PsLiteRelayTlsIdentity {
     certPem: string;
@@ -16,4 +51,11 @@ export interface PsLiteRelayTlsIdentity {
 export declare function createRustlsPsLiteRelayTlsFactory(options: RustlsPsLiteRelayTlsOptions): PsLiteRelayTlsFactory;
 export declare function psLiteRelayPublicHost(sessionId: string, publicSuffix?: string): string;
 export declare function psLiteRelayPublicUrl(sessionId: string, publicSuffix?: string): string;
+/**
+ * Browser default relay TLS identity store: persists the issued cert in
+ * `localStorage`, matching PS Lite's pre-injection behavior byte for byte. This
+ * is the one place the relay TLS path is allowed to touch a browser global; the
+ * resolution logic above goes through the injected {@link PsLiteRelayTlsIdentityStore}.
+ */
+export declare function createLocalStoragePsLiteRelayTlsIdentityStore(storage?: Storage): PsLiteRelayTlsIdentityStore;
 //# sourceMappingURL=relay-tls.d.ts.map

package/dist/relay-tls.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"relay-tls.d.ts","sourceRoot":"","sources":["../src/relay-tls.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,qBAAqB,EAKtB,MAAM,YAAY,CAAC;AAKpB,MAAM,WAAW,2BAA2B;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,aAAa,GAAG,aAAa,CAAC;IAC/C,OAAO,EAAE,OAAO,CAAC;CAClB;AAID,wBAAgB,iCAAiC,CAC/C,OAAO,EAAE,2BAA2B,GACnC,qBAAqB,CAgBvB;AAED,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,YAAY,SAAwB,GACnC,MAAM,CAER;AAED,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,YAAY,SAAwB,GACnC,MAAM,CAER"}
+{"version":3,"file":"relay-tls.d.ts","sourceRoot":"","sources":["../src/relay-tls.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,qBAAqB,EAKtB,MAAM,YAAY,CAAC;AAMpB;;;;;;GAMG;AACH,MAAM,WAAW,2BAA2B;IAC1C,IAAI,CACF,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,GAAG,sBAAsB,GAAG,IAAI,CAAC;IAC1E,KAAK,CAAC,QAAQ,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAC/D;AAED,MAAM,WAAW,2BAA2B;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,2BAA2B,CAAC;IAC5C;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,aAAa,GAAG,aAAa,CAAC;IAC/C,OAAO,EAAE,OAAO,CAAC;CAClB;AAID,wBAAgB,iCAAiC,CAC/C,OAAO,EAAE,2BAA2B,GACnC,qBAAqB,CA4EvB;AAED,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,YAAY,SAAwB,GACnC,MAAM,CAER;AAED,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,YAAY,SAAwB,GACnC,MAAM,CAER;AA2PD;;;;;GAKG;AACH,wBAAgB,6CAA6C,CAC3D,OAAO,GAAE,OAAiC,GACzC,2BAA2B,CAa7B"}

package/dist/relay-tls.js

@@ -2,18 +2,71 @@ import forge from "node-forge";
 import initRustls, { TlsServer as RustlsServer, } from "./browser-tls-rustls/browser_tls_rustls.js";
 const TLS_IDENTITY_CACHE_KEY = "personal-server-lite-tls-identity-v1";
 const DEFAULT_PUBLIC_SUFFIX = "34.16.49.200.sslip.io";
+const DEFAULT_ISSUE_CERT_TIMEOUT_MS = 60_000;
 let rustlsInitPromise;
 export function createRustlsPsLiteRelayTlsFactory(options) {
-    let identityPromise;
+    // Only a trusted relay identity is memoized for the factory's lifetime. A
+    // self-signed fallback must NOT be: it means issuance failed on this attempt
+    // (no issueToken yet, certificate endpoint error/timeout), and locking it in
+    // would strand the tab on an untrusted cert forever — even after a reconnect
+    // delivers a fresh issueToken (BUI-664). The relay factory outlives every
+    // reconnect, so a first-attempt fallback used to pin the whole session to
+    // self-signed. Leaving it unmemoized lets the next prepare/createStream retry
+    // issuance (or hit the persisted certificate cache once it succeeds).
+    let trustedIdentity;
+    let inFlight;
+    let inFlightToken;
+    // Do not create the browser default here: merely composing a relay factory
+    // must remain safe in a native/SSR host that has not injected localStorage.
+    // The default adapter is resolved only when a relay actually prepares TLS.
+    const identityStore = options.identityStore ??
+        (options.storage
+            ? createLocalStoragePsLiteRelayTlsIdentityStore(options.storage)
+            : undefined);
+    async function resolveIdentity(input) {
+        if (trustedIdentity) {
+            return trustedIdentity;
+        }
+        // Coalesce concurrent callers onto one attempt, but clear on settle so a
+        // failed (self-signed) attempt doesn't block the next retry. A caller that
+        // brings a fresh issueToken must NOT join an in-flight attempt made with
+        // different (or no) credentials: that attempt can settle self-signed even
+        // though this caller could mint a trusted cert, and the first strict-TLS
+        // stream after recovery would still get the untrusted identity. Such a
+        // caller starts its own attempt; the superseded one settles harmlessly.
+        const token = input.issueToken ?? "";
+        if (!inFlight || (token && token !== inFlightToken)) {
+            const attempt = createTlsIdentity(input, options, identityStore ?? createLocalStoragePsLiteRelayTlsIdentityStore()).finally(() => {
+                if (inFlight === attempt) {
+                    inFlight = undefined;
+                    inFlightToken = undefined;
+                }
+            });
+            inFlight = attempt;
+            inFlightToken = token;
+        }
+        const identity = await inFlight;
+        if (identity.trusted) {
+            trustedIdentity = identity;
+        }
+        else if (trustedIdentity) {
+            // A concurrent tokened attempt settled trusted while this caller was
+            // awaiting a fallback attempt — serve the trusted identity instead of
+            // handing one last stream a self-signed cert.
+            return trustedIdentity;
+        }
+        else {
+            options.logger?.(`serving self-signed cert for ${identity.hostname}; relay certificate unavailable this attempt, will retry on the next stream/reconnect`);
+        }
+        return identity;
+    }
     return {
         async prepare(input) {
-            identityPromise ??= createTlsIdentity(input, options);
-            await identityPromise;
+            await resolveIdentity(input);
         },
         async createStream(input) {
             await ensureRustls();
-            identityPromise ??= createTlsIdentity(input, options);
-            const identity = await identityPromise;
+            const identity = await resolveIdentity(input);
             const tls = new RustlsServer(identity.certPem, identity.keyPem);
             return createRustlsStream(tls);
         },
@@ -50,28 +103,33 @@ function normalizeTlsStep(value) {
         handshaking: Boolean(step.handshaking),
     };
 }
-async function createTlsIdentity(input, options) {
+async function createTlsIdentity(input, options, identityStore) {
     const hostname = psLiteRelayPublicHost(input.sessionId, options.publicSuffix);
-    const cached = readCachedTlsIdentity(hostname, options.storage);
+    const cached = await readCachedTlsIdentity(hostname, identityStore);
     if (cached) {
         return cached;
     }
-    const keys = await generateKeyPair();
-    const keyPem = forge.pki.privateKeyToPem(keys.privateKey);
-    const csrPem = createCsrPem(hostname, keys);
-    const issued = await requestAcmeCertificate({
-        issuerUrl: resolveCertIssuerUrl(options),
+    // Fetch the relay's shared wildcard cert+key for this session (POST
+    // /session-cert). This replaces per-session ACME: the relay issues one
+    // `*.<suffix>` cert and hands it to every session, so there is no per-session
+    // DNS-01 challenge, no TXT-propagation race, and no Let's Encrypt rate-limit
+    // exposure. The wildcard SAN covers our `<sessionId>.<suffix>` hostname.
+    const wildcard = await requestSessionCertificate({
+        issuerUrl: resolveSessionCertUrl(options),
         sessionId: input.sessionId,
-        csrPem,
-        keyPem,
         issueToken: input.issueToken ?? "",
         hostname,
-        storage: options.storage,
+        identityStore,
         logger: options.logger,
+        timeoutMs: options.issueCertTimeoutMs ?? DEFAULT_ISSUE_CERT_TIMEOUT_MS,
     });
-    if (issued) {
-        return issued;
+    if (wildcard) {
+        return wildcard;
     }
+    // Unmemoized self-signed fallback (BUI-664): the relay was unreachable or the
+    // wildcard was unavailable this attempt; retry issuance on the next stream.
+    const keys = await generateKeyPair();
+    const keyPem = forge.pki.privateKeyToPem(keys.privateKey);
     return createSelfSignedIdentity(hostname, keyPem, keys);
 }
 function generateKeyPair() {
@@ -85,24 +143,6 @@ function generateKeyPair() {
         });
     });
 }
-function createCsrPem(hostname, keys) {
-    const csr = forge.pki.createCertificationRequest();
-    csr.publicKey = keys.publicKey;
-    csr.setSubject([{ name: "commonName", value: hostname }]);
-    csr.setAttributes([
-        {
-            name: "extensionRequest",
-            extensions: [
-                {
-                    name: "subjectAltName",
-                    altNames: [{ type: 2, value: hostname }],
-                },
-            ],
-        },
-    ]);
-    csr.sign(keys.privateKey, forge.md.sha256.create());
-    return forge.pki.certificationRequestToPem(csr);
-}
 function createSelfSignedIdentity(hostname, keyPem, keys) {
     const cert = forge.pki.createCertificate();
     cert.publicKey = keys.publicKey;
@@ -130,67 +170,117 @@ function createSelfSignedIdentity(hostname, keyPem, keys) {
         trusted: false,
     };
 }
-async function requestAcmeCertificate(input) {
+function issueCertAbortSignal(timeoutMs) {
+    return typeof AbortSignal !== "undefined" &&
+        typeof AbortSignal.timeout === "function"
+        ? AbortSignal.timeout(timeoutMs)
+        : undefined;
+}
+function withIssueCertTimeout(promise, timeoutMs) {
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => {
+            reject(new Error(`certificate issuer did not respond within ${timeoutMs}ms`));
+        }, timeoutMs);
+        promise.then((value) => {
+            clearTimeout(timer);
+            resolve(value);
+        }, (error) => {
+            clearTimeout(timer);
+            reject(error);
+        });
+    });
+}
+function resolveSessionCertUrl(options) {
+    const base = options.certIssuerUrl
+        ? options.certIssuerUrl.replace(/\/+$/, "").replace(/\/issue-cert$/, "")
+        : (() => {
+            const url = new URL(options.controlUrl);
+            url.protocol = url.protocol === "wss:" ? "https:" : "http:";
+            url.pathname = "";
+            url.search = "";
+            url.hash = "";
+            return url.toString().replace(/\/+$/, "");
+        })();
+    return `${base}/session-cert`;
+}
+/**
+ * Fetch the relay's shared wildcard cert+key for this browser session. Unlike
+ * the per-session ACME path, the relay already holds the cert, so this is a
+ * fast lookup with no DNS challenge. Returns undefined (self-signed fallback)
+ * on any failure.
+ */
+async function requestSessionCertificate(input) {
     if (!input.issueToken) {
-        input.logger?.("ACME issuer token unavailable; using self-signed certificate");
+        input.logger?.("session issue token unavailable; using self-signed certificate");
         return undefined;
     }
     try {
-        const response = await fetch(input.issuerUrl, {
-            method: "POST",
-            headers: { "content-type": "application/json" },
-            body: JSON.stringify({
-                sessionId: input.sessionId,
-                csrPem: input.csrPem,
-                issueToken: input.issueToken,
-            }),
-        });
-        if (!response.ok) {
-            const detail = await response.text();
-            input.logger?.(`ACME issuer unavailable (${response.status}); using self-signed certificate`);
-            input.logger?.(detail.slice(0, 240));
-            return undefined;
-        }
-        const payload = (await response.json());
-        if (!payload.certPem) {
-            input.logger?.("ACME issuer returned no certificate; using self-signed certificate");
-            return undefined;
-        }
-        const identity = {
-            certPem: payload.certPem,
-            keyPem: input.keyPem,
-            hostname: input.hostname,
-            source: "acme",
-            trusted: true,
-        };
-        cacheTlsIdentity(identity, input.storage);
-        return identity;
+        return await withIssueCertTimeout(fetchSessionCert(input), input.timeoutMs);
     }
     catch (error) {
         input.logger?.(error instanceof Error ? error.message : String(error));
-        input.logger?.("ACME certificate request failed; using self-signed certificate");
+        input.logger?.("session certificate request failed; using self-signed certificate");
         return undefined;
     }
 }
-function resolveCertIssuerUrl(options) {
-    if (options.certIssuerUrl) {
-        return options.certIssuerUrl.replace(/\/+$/, "");
+async function fetchSessionCert(input) {
+    const response = await fetch(input.issuerUrl, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+            sessionId: input.sessionId,
+            issueToken: input.issueToken,
+        }),
+        signal: issueCertAbortSignal(input.timeoutMs),
+    });
+    if (!response.ok) {
+        const detail = await response.text();
+        input.logger?.(`session-cert unavailable (${response.status}); using self-signed certificate`);
+        input.logger?.(detail.slice(0, 240));
+        return undefined;
+    }
+    const payload = (await response.json());
+    if (!payload.certPem || !payload.keyPem) {
+        input.logger?.("session-cert returned no certificate; using self-signed certificate");
+        return undefined;
     }
-    const url = new URL(options.controlUrl);
-    url.protocol = url.protocol === "wss:" ? "https:" : "http:";
-    url.pathname = "/issue-cert";
-    url.search = "";
-    url.hash = "";
-    return url.toString();
-}
-function readCachedTlsIdentity(hostname, storage = globalThis.localStorage) {
+    const identity = {
+        certPem: payload.certPem,
+        keyPem: payload.keyPem,
+        hostname: input.hostname,
+        source: "acme",
+        trusted: true,
+    };
     try {
-        const raw = storage.getItem(`${TLS_IDENTITY_CACHE_KEY}:${hostname}`);
-        if (!raw) {
-            return undefined;
-        }
-        const identity = JSON.parse(raw);
-        if (identity.hostname !== hostname ||
+        await cacheTlsIdentity(identity, input.identityStore);
+    }
+    catch (error) {
+        input.logger?.(`failed to persist session certificate (${error instanceof Error ? error.message : String(error)}); continuing with the in-memory identity`);
+    }
+    return identity;
+}
+/**
+ * Browser default relay TLS identity store: persists the issued cert in
+ * `localStorage`, matching PS Lite's pre-injection behavior byte for byte. This
+ * is the one place the relay TLS path is allowed to touch a browser global; the
+ * resolution logic above goes through the injected {@link PsLiteRelayTlsIdentityStore}.
+ */
+export function createLocalStoragePsLiteRelayTlsIdentityStore(storage = globalThis.localStorage) {
+    return {
+        read(hostname) {
+            const raw = storage.getItem(`${TLS_IDENTITY_CACHE_KEY}:${hostname}`);
+            return raw ? JSON.parse(raw) : null;
+        },
+        write(identity) {
+            storage.setItem(`${TLS_IDENTITY_CACHE_KEY}:${identity.hostname}`, JSON.stringify(identity));
+        },
+    };
+}
+async function readCachedTlsIdentity(hostname, identityStore) {
+    try {
+        const identity = await identityStore.read(hostname);
+        if (!identity ||
+            identity.hostname !== hostname ||
             !identity.certPem ||
             !identity.keyPem ||
             identity.source !== "acme") {
@@ -210,11 +300,11 @@ function readCachedTlsIdentity(hostname, storage = globalThis.localStorage) {
         return undefined;
     }
 }
-function cacheTlsIdentity(identity, storage = globalThis.localStorage) {
+async function cacheTlsIdentity(identity, identityStore) {
     if (identity.source !== "acme") {
         return;
     }
-    storage.setItem(`${TLS_IDENTITY_CACHE_KEY}:${identity.hostname}`, JSON.stringify(identity));
+    await identityStore.write(identity);
 }
 function firstCertificateNotAfter(certPem) {
     const match = certPem.match(/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/);