@opendatalabs/personal-server-ts-server 0.0.1-canary.eecb7d7 → 0.0.1-canary.eefd1bc

package/dist/ui/ps-lite-debug.js

@@ -125498,6 +125498,12 @@ async function uploadOne(deps, entry) {
         dataPointId = record2.id;
         const adoptedVersion = Number(record2.expectedVersion);
         if (adoptedVersion !== entry.version) {
+          const adoptedKey = `${entry.scope}/${adoptedVersion}`;
+          const adoptedBlobExists = await storageAdapter.exists(storageAdapter.urlForKey(adoptedKey));
+          if (!adoptedBlobExists) {
+            logger.warn({ scope: entry.scope, version: adoptedVersion, dataPointId }, "Adopted registry version has no blob in storage; re-uploading from local content");
+            url2 = await storageAdapter.upload(adoptedKey, encrypted);
+          }
           await storage.updateEntryVersion(entry.path, adoptedVersion);
         }
       } else {
@@ -125555,7 +125561,7 @@ var DETERMINISTIC_STAGES = /* @__PURE__ */ new Set([
   "envelope_validate",
   "block_build"
 ]);
-var TRANSIENT_STATUS_CODES = /* @__PURE__ */ new Set([408, 425, 429, 500, 502, 503, 504]);
+var DETERMINISTIC_DOWNLOAD_STATUSES = /* @__PURE__ */ new Set([404, 410]);
 function classifySyncFailure(input) {
   const stage = input.stage ?? inferStage(input.error);
   const disposition = classifyDisposition(input.error, stage);
@@ -125614,9 +125620,9 @@ function inferPayloadKind(bytes2) {
 }
 function classifyDisposition(error51, stage) {
   if (stage === "download") {
-    const status2 = getNumericProperty(error51, "status") ?? getNumericProperty(error51, "statusCode");
+    const status2 = getNumericProperty(error51, "status") ?? getNumericProperty(error51, "statusCode") ?? getDownloadStatusFromMessage(error51);
     if (status2 !== void 0) {
-      return TRANSIENT_STATUS_CODES.has(status2) ? "transient" : "deterministic";
+      return DETERMINISTIC_DOWNLOAD_STATUSES.has(status2) ? "deterministic" : "transient";
     }
     return "transient";
   }
@@ -125662,6 +125668,10 @@ function getStringProperty(value, key) {
   const property = value[key];
   return typeof property === "string" ? property : "";
 }
+function getDownloadStatusFromMessage(error51) {
+  const match = /download failed: ([1-5]\d{2})\b/.exec(getRawMessage(error51));
+  return match ? Number(match[1]) : void 0;
+}
 function getNumericProperty(value, key) {
   if (typeof value !== "object" || value === null || !(key in value)) {
     return void 0;
@@ -125693,6 +125703,52 @@ function getSafeIssueMessage(stage, disposition) {
   }
 }
 
+// ../core/dist/sync/retry-memory.js
+var DEFAULT_MAX_TRANSIENT_ATTEMPTS = 5;
+var DEFAULT_BACKOFF_BASE_MS = 3e4;
+function downloadRetryKey(record2) {
+  return `${record2.id}@${record2.expectedVersion}`;
+}
+function createDownloadRetryMemory(options = {}) {
+  const maxTransientAttempts = options.maxTransientAttempts ?? DEFAULT_MAX_TRANSIENT_ATTEMPTS;
+  const backoffBaseMs = options.backoffBaseMs ?? DEFAULT_BACKOFF_BASE_MS;
+  const now = options.now ?? Date.now;
+  const entries = /* @__PURE__ */ new Map();
+  return {
+    decide(key) {
+      const entry = entries.get(key);
+      if (!entry)
+        return "attempt";
+      if (entry.permanent || entry.attempts >= maxTransientAttempts) {
+        return "give-up";
+      }
+      return now() < entry.nextRetryAtMs ? "backoff" : "attempt";
+    },
+    recordFailure(key, retryable) {
+      if (!retryable) {
+        entries.set(key, { attempts: 0, nextRetryAtMs: 0, permanent: true });
+        return;
+      }
+      const attempts = (entries.get(key)?.attempts ?? 0) + 1;
+      entries.set(key, {
+        attempts,
+        nextRetryAtMs: now() + backoffBaseMs * 2 ** (attempts - 1),
+        permanent: false
+      });
+    },
+    recordSuccess(key) {
+      entries.delete(key);
+    },
+    onListingReset() {
+      for (const [key, entry] of entries) {
+        if (!entry.permanent) {
+          entries.delete(key);
+        }
+      }
+    }
+  };
+}
+
 // ../core/dist/sync/workers/download.js
 async function downloadOne(deps, record2) {
   const { storage, storageAdapter, masterKey, logger, diagnostics } = deps;
@@ -125720,7 +125776,10 @@ async function downloadOne(deps, record2) {
   } catch (err2) {
     const detail = err2.message;
     diagnostics?.onDownloadError(record2.id, detail);
-    throw err2;
+    throw withSyncFailureMetadata(err2, {
+      stage: "download",
+      scope: record2.scope
+    });
   }
   diagnostics?.onDownloadEnd(record2.id, record2.scope);
   const scopeKey = deriveScopeKey(masterKey, record2.scope);
@@ -125828,12 +125887,26 @@ async function downloadAll(deps, options = {}) {
   if (repairSummary.missingEnvelopeEntries > 0) {
     logger.warn({ missingEnvelopeEntries: repairSummary.missingEnvelopeEntries }, "Resetting this sync listing to repair stale local index entries");
   }
+  if (options.fullReconcile || repairSummary.missingEnvelopeEntries > 0) {
+    options.retryMemory?.onListingReset();
+  }
   const { dataPoints, cursor: nextCursor } = await gateway.listDataPointsByOwner(serverOwner, lastCursor);
   const results = [];
   let failed = false;
   for (const dataPoint of dataPoints) {
+    const retryKey = downloadRetryKey(dataPoint);
+    const decision = options.retryMemory?.decide(retryKey) ?? "attempt";
+    if (decision === "give-up") {
+      logger.debug({ dataPointId: dataPoint.id, scope: dataPoint.scope }, "Skipping data point after exhausted download retries");
+      continue;
+    }
+    if (decision === "backoff") {
+      failed = true;
+      continue;
+    }
     try {
       const result = await downloadOne(deps, dataPoint);
+      options.retryMemory?.recordSuccess(retryKey);
       if (result) {
         results.push(result);
       }
@@ -125848,6 +125921,7 @@ async function downloadAll(deps, options = {}) {
         payloadKind: metadata.payloadKind,
         encryptedSizeBytes: metadata.encryptedSizeBytes
       });
+      options.retryMemory?.recordFailure(retryKey, classified.issue.retryable);
       if (!classified.issue.retryable) {
         logger.warn({
           dataPointId: dataPoint.id,
@@ -126071,6 +126145,7 @@ function createSyncManager(uploadDeps, downloadDeps, options) {
   let cycleInFlight = null;
   let rerunRequested = false;
   let needsFullReconcile = true;
+  const downloadRetryMemory = createDownloadRetryMemory();
   async function runCycle() {
     if (cycleInFlight) {
       rerunRequested = true;
@@ -126112,7 +126187,8 @@ function createSyncManager(uploadDeps, downloadDeps, options) {
         try {
           const fullReconcile = needsFullReconcile;
           const downloadResults = await downloadAll(downloadDeps, {
-            fullReconcile
+            fullReconcile,
+            retryMemory: downloadRetryMemory
           });
           needsFullReconcile = false;
           downloadDeps.logger.debug({ downloaded: downloadResults.length, fullReconcile }, "Download cycle complete");
@@ -126256,12 +126332,30 @@ function createSdkStorageAdapter(providerOrFactory, options) {
       try {
         await provider().download(storageUrl);
         return true;
-      } catch {
-        return false;
+      } catch (err2) {
+        if (isDefinitiveNotFound(err2)) {
+          return false;
+        }
+        throw err2;
       }
     }
   };
 }
+function isDefinitiveNotFound(err2) {
+  const status2 = numericProperty(err2, "status") ?? numericProperty(err2, "statusCode");
+  if (status2 !== void 0) {
+    return status2 === 404 || status2 === 410;
+  }
+  const message = err2 instanceof Error ? err2.message : String(err2);
+  return /download failed: (404|410)\b/.test(message);
+}
+function numericProperty(value, key) {
+  if (typeof value !== "object" || value === null || !(key in value)) {
+    return void 0;
+  }
+  const property = value[key];
+  return typeof property === "number" ? property : void 0;
+}
 function copyBytes(data) {
   const copy = new Uint8Array(data.byteLength);
   copy.set(data);
@@ -126326,13 +126420,22 @@ async function resolvePsLiteOwner(input) {
 
 // ../lite/dist/sync.js
 var SYNC_CURSOR_KEY = "sync-cursor-v1";
-function createBrowserLogger() {
-  return {
+function createBrowserLogger(logger) {
+  const fallback = {
     info: console.info.bind(console),
     error: console.error.bind(console),
     warn: console.warn.bind(console),
     debug: console.debug.bind(console)
   };
+  if (!logger) {
+    return fallback;
+  }
+  return {
+    debug: logger.debug?.bind(logger) ?? fallback.debug,
+    info: logger.info?.bind(logger) ?? fallback.info,
+    warn: logger.warn?.bind(logger) ?? fallback.warn,
+    error: logger.error?.bind(logger) ?? fallback.error
+  };
 }
 function createPsLiteSyncCursor(stateStore) {
   return {
@@ -126431,7 +126534,7 @@ async function createPsLiteSyncManager(options) {
     contracts: options.config.gateway.contracts
   });
   const cursor = createPsLiteSyncCursor(options.stateStore);
-  const logger = createBrowserLogger();
+  const logger = createBrowserLogger(options.logger);
   const downloadDiagnostics = options.diagnostics ? buildDownloadDiagnosticsHook(options.diagnostics) : void 0;
   const syncManager = createSyncManager({
     storage: options.storage,
@@ -126462,7 +126565,7 @@ async function createPsLiteSyncManager(options) {
           message: "Register this Personal Server before syncing."
         };
       } catch (err2) {
-        logger.warn("Could not verify server registration for sync", err2);
+        logger.warn({ error: err2 instanceof Error ? err2.message : String(err2) }, "Could not verify server registration for sync");
         return {
           ok: false,
           reason: "registration_check_failed",
@@ -126520,7 +126623,8 @@ async function createIndexedDbPsLiteRuntime(options) {
       ownerAddress: options.ownerAddress,
       serverAccount: identity.account,
       gateway,
-      diagnostics
+      diagnostics,
+      logger: options.logger
     })).syncManager;
   }
   let runtimeRef = null;
@@ -127125,7 +127229,20 @@ async function readJsonBody(response) {
   }
 }
 function toClientErrorBody(value) {
-  return value && typeof value === "object" ? value : null;
+  if (!value || typeof value !== "object")
+    return null;
+  const record2 = value;
+  if (record2.error && typeof record2.error === "object") {
+    return record2;
+  }
+  const message = typeof record2.message === "string" ? record2.message : void 0;
+  if (typeof record2.error === "string") {
+    return { ...record2, error: { errorCode: record2.error, message } };
+  }
+  if (message !== void 0) {
+    return { ...record2, error: { message } };
+  }
+  return record2;
 }
 function assertRegistrationMatches(existing, candidate) {
   if (existing.serverUrl === candidate.serverUrl)
@@ -127568,7 +127685,7 @@ async function __wbg_init(module_or_path) {
 // ../lite/dist/relay-tls.js
 var TLS_IDENTITY_CACHE_KEY = "personal-server-lite-tls-identity-v1";
 var DEFAULT_PUBLIC_SUFFIX = "34.16.49.200.sslip.io";
-var DEFAULT_ISSUE_CERT_TIMEOUT_MS = 8e3;
+var DEFAULT_ISSUE_CERT_TIMEOUT_MS = 6e4;
 var rustlsInitPromise;
 function createRustlsPsLiteRelayTlsFactory(options) {
   let trustedIdentity;
@@ -127595,7 +127712,7 @@ function createRustlsPsLiteRelayTlsFactory(options) {
     } else if (trustedIdentity) {
       return trustedIdentity;
     } else {
-      options.logger?.(`serving self-signed cert for ${identity.hostname}; ACME issuance unavailable this attempt, will retry on the next stream/reconnect`);
+      options.logger?.(`serving self-signed cert for ${identity.hostname}; relay certificate unavailable this attempt, will retry on the next stream/reconnect`);
     }
     return identity;
   }
@@ -127645,23 +127762,20 @@ async function createTlsIdentity(input, options) {
   if (cached2) {
     return cached2;
   }
-  const keys = await generateKeyPair();
-  const keyPem = import_node_forge.default.pki.privateKeyToPem(keys.privateKey);
-  const csrPem = createCsrPem(hostname3, keys);
-  const issued = await requestAcmeCertificate({
-    issuerUrl: resolveCertIssuerUrl(options),
+  const wildcard = await requestSessionCertificate({
+    issuerUrl: resolveSessionCertUrl(options),
     sessionId: input.sessionId,
-    csrPem,
-    keyPem,
     issueToken: input.issueToken ?? "",
     hostname: hostname3,
     storage: options.storage,
     logger: options.logger,
     timeoutMs: options.issueCertTimeoutMs ?? DEFAULT_ISSUE_CERT_TIMEOUT_MS
   });
-  if (issued) {
-    return issued;
+  if (wildcard) {
+    return wildcard;
   }
+  const keys = await generateKeyPair();
+  const keyPem = import_node_forge.default.pki.privateKeyToPem(keys.privateKey);
   return createSelfSignedIdentity(hostname3, keyPem, keys);
 }
 function generateKeyPair() {
@@ -127675,24 +127789,6 @@ function generateKeyPair() {
     });
   });
 }
-function createCsrPem(hostname3, keys) {
-  const csr = import_node_forge.default.pki.createCertificationRequest();
-  csr.publicKey = keys.publicKey;
-  csr.setSubject([{ name: "commonName", value: hostname3 }]);
-  csr.setAttributes([
-    {
-      name: "extensionRequest",
-      extensions: [
-        {
-          name: "subjectAltName",
-          altNames: [{ type: 2, value: hostname3 }]
-        }
-      ]
-    }
-  ]);
-  csr.sign(keys.privateKey, import_node_forge.default.md.sha256.create());
-  return import_node_forge.default.pki.certificationRequestToPem(csr);
-}
 function createSelfSignedIdentity(hostname3, keyPem, keys) {
   const cert = import_node_forge.default.pki.createCertificate();
   cert.publicKey = keys.publicKey;
@@ -127720,48 +127816,71 @@ function createSelfSignedIdentity(hostname3, keyPem, keys) {
     trusted: false
   };
 }
-async function requestAcmeCertificate(input) {
+function issueCertAbortSignal(timeoutMs) {
+  return typeof AbortSignal !== "undefined" && typeof AbortSignal.timeout === "function" ? AbortSignal.timeout(timeoutMs) : void 0;
+}
+function withIssueCertTimeout(promise2, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      reject(new Error(`certificate issuer did not respond within ${timeoutMs}ms`));
+    }, timeoutMs);
+    promise2.then((value) => {
+      clearTimeout(timer);
+      resolve(value);
+    }, (error51) => {
+      clearTimeout(timer);
+      reject(error51);
+    });
+  });
+}
+function resolveSessionCertUrl(options) {
+  const base = options.certIssuerUrl ? options.certIssuerUrl.replace(/\/+$/, "").replace(/\/issue-cert$/, "") : (() => {
+    const url2 = new URL(options.controlUrl);
+    url2.protocol = url2.protocol === "wss:" ? "https:" : "http:";
+    url2.pathname = "";
+    url2.search = "";
+    url2.hash = "";
+    return url2.toString().replace(/\/+$/, "");
+  })();
+  return `${base}/session-cert`;
+}
+async function requestSessionCertificate(input) {
   if (!input.issueToken) {
-    input.logger?.("ACME issuer token unavailable; using self-signed certificate");
+    input.logger?.("session issue token unavailable; using self-signed certificate");
     return void 0;
   }
   try {
-    return await withIssueCertTimeout(issueCertificate(input), input.timeoutMs);
+    return await withIssueCertTimeout(fetchSessionCert(input), input.timeoutMs);
   } catch (error51) {
     input.logger?.(error51 instanceof Error ? error51.message : String(error51));
-    input.logger?.("ACME certificate request failed; using self-signed certificate");
+    input.logger?.("session certificate request failed; using self-signed certificate");
     return void 0;
   }
 }
-async function issueCertificate(input) {
+async function fetchSessionCert(input) {
   const response = await fetch(input.issuerUrl, {
     method: "POST",
     headers: { "content-type": "application/json" },
     body: JSON.stringify({
       sessionId: input.sessionId,
-      csrPem: input.csrPem,
       issueToken: input.issueToken
     }),
-    // Belt: cancels the request in flight where supported. The
-    // withIssueCertTimeout race is the load-bearing guard — a fetch whose
-    // implementation ignores `signal` must still not wedge identity
-    // resolution.
     signal: issueCertAbortSignal(input.timeoutMs)
   });
   if (!response.ok) {
     const detail = await response.text();
-    input.logger?.(`ACME issuer unavailable (${response.status}); using self-signed certificate`);
+    input.logger?.(`session-cert unavailable (${response.status}); using self-signed certificate`);
     input.logger?.(detail.slice(0, 240));
     return void 0;
   }
   const payload = await response.json();
-  if (!payload.certPem) {
-    input.logger?.("ACME issuer returned no certificate; using self-signed certificate");
+  if (!payload.certPem || !payload.keyPem) {
+    input.logger?.("session-cert returned no certificate; using self-signed certificate");
     return void 0;
   }
   const identity = {
     certPem: payload.certPem,
-    keyPem: input.keyPem,
+    keyPem: payload.keyPem,
     hostname: input.hostname,
     source: "acme",
     trusted: true
@@ -127769,38 +127888,10 @@ async function issueCertificate(input) {
   try {
     cacheTlsIdentity(identity, input.storage);
   } catch (error51) {
-    input.logger?.(`failed to persist issued certificate (${error51 instanceof Error ? error51.message : String(error51)}); continuing with the in-memory identity`);
+    input.logger?.(`failed to persist session certificate (${error51 instanceof Error ? error51.message : String(error51)}); continuing with the in-memory identity`);
   }
   return identity;
 }
-function issueCertAbortSignal(timeoutMs) {
-  return typeof AbortSignal !== "undefined" && typeof AbortSignal.timeout === "function" ? AbortSignal.timeout(timeoutMs) : void 0;
-}
-function withIssueCertTimeout(promise2, timeoutMs) {
-  return new Promise((resolve, reject) => {
-    const timer = setTimeout(() => {
-      reject(new Error(`certificate issuer did not respond within ${timeoutMs}ms (hung /issue-cert)`));
-    }, timeoutMs);
-    promise2.then((value) => {
-      clearTimeout(timer);
-      resolve(value);
-    }, (error51) => {
-      clearTimeout(timer);
-      reject(error51);
-    });
-  });
-}
-function resolveCertIssuerUrl(options) {
-  if (options.certIssuerUrl) {
-    return options.certIssuerUrl.replace(/\/+$/, "");
-  }
-  const url2 = new URL(options.controlUrl);
-  url2.protocol = url2.protocol === "wss:" ? "https:" : "http:";
-  url2.pathname = "/issue-cert";
-  url2.search = "";
-  url2.hash = "";
-  return url2.toString();
-}
 function readCachedTlsIdentity(hostname3, storage = globalThis.localStorage) {
   try {
     const raw = storage.getItem(`${TLS_IDENTITY_CACHE_KEY}:${hostname3}`);
@@ -128479,7 +128570,7 @@ async function startPersonalServer(options) {
   }
   async function callFetch(input, init) {
     const origin = (await info()).urls.apiOrigin ?? localOrigin;
-    return runtime.fetch(toRuntimeRequest(input, origin, init));
+    return runtime.fetch(await toRuntimeRequest(input, origin, init));
   }
   async function postData2(scope, body, postOptions) {
     const current = await info();
@@ -128714,10 +128805,16 @@ function requiredApiOrigin(info) {
   }
   return info.urls.apiOrigin;
 }
-function toRuntimeRequest(input, origin, init) {
+async function toRuntimeRequest(input, origin, init) {
   const url2 = `${origin}${requestPath(input)}`;
   if (input instanceof Request) {
-    const base = new Request(url2, input);
+    const buffered = input.method === "GET" || input.method === "HEAD" ? void 0 : await input.clone().arrayBuffer();
+    const base = new Request(url2, {
+      method: input.method,
+      headers: input.headers,
+      body: buffered && buffered.byteLength > 0 ? buffered : void 0,
+      signal: input.signal
+    });
     return init ? new Request(base, init) : base;
   }
   return new Request(url2, init);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opendatalabs/personal-server-ts-server",
-  "version": "0.0.1-canary.eecb7d7",
+  "version": "0.0.1-canary.eefd1bc",
   "description": "Hono HTTP server for the Vana Personal Server — routes, middleware, composition root",
   "license": "MIT",
   "repository": {
@@ -44,8 +44,8 @@
   },
   "dependencies": {
     "@hono/node-server": "^1.19.13",
-    "@opendatalabs/personal-server-ts-core": "0.0.1-canary.eecb7d7",
-    "@opendatalabs/personal-server-ts-lite": "0.0.1-canary.eecb7d7",
+    "@opendatalabs/personal-server-ts-core": "0.0.1-canary.eefd1bc",
+    "@opendatalabs/personal-server-ts-lite": "0.0.1-canary.eefd1bc",
     "@opendatalabs/vana-sdk": "3.13.0",
     "better-sqlite3": "^12.11.1",
     "hono": "^4.12.27",