@opendatalabs/personal-server-ts-server 1.3.5 → 1.4.0

package/dist/ui/ps-lite-debug.js

@@ -109469,6 +109469,30 @@ function createIndexedDbPsLiteAccessLogStore(options = {}) {
     }
   };
 }
+function indexedDbAvailable() {
+  return typeof indexedDB !== "undefined";
+}
+function createDefaultPsLiteAccessLogStore() {
+  if (!indexedDbAvailable()) {
+    throw new Error("IndexedDB is required for default PS Lite access log persistence.");
+  }
+  return createIndexedDbPsLiteAccessLogStore();
+}
+function createDefaultPsLiteTokenStore() {
+  if (!indexedDbAvailable()) {
+    throw new Error("IndexedDB is required for default PS Lite token storage.");
+  }
+  return createIndexedDbPsLiteTokenStore();
+}
+function createDefaultPsLiteSaveConfig() {
+  if (!indexedDbAvailable()) {
+    throw new Error("IndexedDB is required for default PS Lite config persistence.");
+  }
+  const stateStore = createIndexedDbPsLiteStateStore();
+  return async (nextConfig) => {
+    await savePsLiteConfig(stateStore, nextConfig);
+  };
+}
 async function loadOrCreatePsLiteConfig(store, defaults) {
   const existing = await store.get(CONFIG_KEY);
   if (!existing) {
@@ -126576,15 +126600,6 @@ function toDataStoragePort(storage) {
   }
   throw new Error("PS Lite runtime requires a persistent DataStoragePort. Use createIndexedDbPsLiteRuntime() or createPersistentPsLiteStorage().");
 }
-function indexedDbAvailable() {
-  return typeof indexedDB !== "undefined";
-}
-function createDefaultAccessLogStore() {
-  if (!indexedDbAvailable()) {
-    throw new Error("IndexedDB is required for default PS Lite access log persistence.");
-  }
-  return createIndexedDbPsLiteAccessLogStore();
-}
 function createLogId() {
   return globalThis.crypto?.randomUUID?.() ?? `log-${Date.now()}`;
 }
@@ -126593,27 +126608,32 @@ function randomHex(byteLength) {
   globalThis.crypto.getRandomValues(bytes2);
   return Array.from(bytes2, (byte) => byte.toString(16).padStart(2, "0")).join("");
 }
-function createDefaultTokenStore() {
-  if (!indexedDbAvailable()) {
-    throw new Error("IndexedDB is required for default PS Lite token storage.");
-  }
-  return createIndexedDbPsLiteTokenStore();
-}
-function createDefaultSaveConfig() {
-  if (!indexedDbAvailable()) {
-    throw new Error("IndexedDB is required for default PS Lite config persistence.");
-  }
-  const stateStore = createIndexedDbPsLiteStateStore();
-  return async (nextConfig) => {
-    await savePsLiteConfig(stateStore, nextConfig);
-  };
-}
 function bearerToken(request2) {
   const authorization = request2.headers.get("authorization");
   if (!authorization?.startsWith("Bearer "))
     return null;
   return authorization.slice(7);
 }
+function snapshotGatewayConfig(config2) {
+  const gateway = config2?.gateway;
+  if (!gateway)
+    return void 0;
+  return {
+    ...gateway,
+    ...gateway.contracts ? { contracts: { ...gateway.contracts } } : {}
+  };
+}
+function resolveX402Settings(config2, gateway = config2?.gateway) {
+  const paymentEnabled = config2?.payment?.enabled ?? false;
+  const gatewayConfigComplete = Boolean(gateway && typeof gateway.url === "string" && typeof gateway.chainId === "number" && gateway.contracts && typeof gateway.contracts.dataPortabilityEscrow === "string" && typeof gateway.contracts.dataRegistry === "string");
+  if (paymentEnabled && !gatewayConfigComplete) {
+    throw new Error("PS-Lite x402 payment is enabled (config.payment.enabled) but the gateway config is incomplete. A complete gateway config \u2014 url, chainId, and contracts (dataPortabilityEscrow, dataRegistry) \u2014 is required to charge for reads. Provide the full config or disable payment.");
+  }
+  return {
+    paymentEnabled,
+    gatewayConfig: gatewayConfigComplete ? gateway : void 0
+  };
+}
 function createPsLiteRuntime(options) {
   let active = options.active ?? false;
   const now = options.now ?? (() => /* @__PURE__ */ new Date());
@@ -126625,19 +126645,14 @@ function createPsLiteRuntime(options) {
   let accessLogReader = options.accessLogReader;
   let accessLogWriter = options.accessLogWriter;
   if (!accessLogReader || !accessLogWriter) {
-    const accessLogStore = createDefaultAccessLogStore();
+    const accessLogStore = createDefaultPsLiteAccessLogStore();
     accessLogReader ??= accessLogStore;
     accessLogWriter ??= accessLogStore;
   }
-  const tokenStore = options.tokenStore ?? createDefaultTokenStore();
-  const saveConfig = options.saveConfig ?? createDefaultSaveConfig();
-  const paymentEnabled = options.config?.payment?.enabled ?? false;
-  const gw2 = options.config?.gateway;
-  const gatewayConfigComplete = Boolean(gw2 && typeof gw2.url === "string" && typeof gw2.chainId === "number" && gw2.contracts && typeof gw2.contracts.dataPortabilityEscrow === "string" && typeof gw2.contracts.dataRegistry === "string");
-  if (paymentEnabled && !gatewayConfigComplete) {
-    throw new Error("PS-Lite x402 payment is enabled (config.payment.enabled) but the gateway config is incomplete. A complete gateway config \u2014 url, chainId, and contracts (dataPortabilityEscrow, dataRegistry) \u2014 is required to charge for reads. Provide the full config or disable payment.");
-  }
-  const x402GatewayConfig = gatewayConfigComplete ? gw2 : void 0;
+  const tokenStore = options.tokenStore ?? createDefaultPsLiteTokenStore();
+  const saveConfig = options.saveConfig ?? createDefaultPsLiteSaveConfig();
+  const boundGatewayConfig = snapshotGatewayConfig(options.config);
+  resolveX402Settings(options.config, boundGatewayConfig);
   const x402ServerSigner = options.serverSigner?.signRecordDataAccess ? { signRecordDataAccess: options.serverSigner.signRecordDataAccess } : void 0;
   const deviceSessions = createMemoryDeviceSessionStore();
   const mcpOAuthAuthorizationStore = options.mcpOAuthAuthorizationStore ?? createInMemoryMcpOAuthAuthorizationStore();
@@ -126847,6 +126862,7 @@ function createPsLiteRuntime(options) {
         }
         const dataPrefix = "/v1/data";
         if (url2.pathname === dataPrefix || url2.pathname.startsWith(`${dataPrefix}/`)) {
+          const x402 = resolveX402Settings(options.config, boundGatewayConfig);
           return handlePersonalServerDataRequest(request2, {
             storage: dataStorage,
             auth,
@@ -126859,10 +126875,10 @@ function createPsLiteRuntime(options) {
             // complete gateway config (validated at construction); a partial
             // config leaves these undefined so reads are served free instead
             // of yielding a malformed challenge.
-            paymentEnabled,
+            paymentEnabled: x402.paymentEnabled,
             gateway: options.gateway,
-            gatewayConfig: x402GatewayConfig,
-            gatewayUrl: x402GatewayConfig?.url,
+            gatewayConfig: x402.gatewayConfig,
+            gatewayUrl: x402.gatewayConfig?.url,
             serverAddress: options.identity?.address,
             // The data owner signed into the RecordDataAccess attestation.
             // Distinct from serverAddress (the server keypair): the core only
@@ -126930,7 +126946,11 @@ function createPsLiteRuntime(options) {
               return options.config ?? {};
             },
             async writeConfig(config2) {
+              resolveX402Settings(config2, boundGatewayConfig);
               await saveConfig(config2);
+              if (options.config && typeof config2 === "object" && config2 !== null) {
+                Object.assign(options.config, config2);
+              }
             }
           });
         }
@@ -126949,7 +126969,9 @@ function createPsLiteRuntime(options) {
             runtimeAvailability: { isAvailable: () => active },
             serverOrigin: url2.origin,
             gateway: options.gateway,
-            gatewayConfig: options.config?.gateway,
+            // Pinned like the x402 path: grant registration is signed with the
+            // startup EIP-712 domain, so the MCP route must see the same one.
+            gatewayConfig: boundGatewayConfig,
             serverOwner: options.serverOwner ?? options.identity?.address,
             serverSigner: options.serverSigner,
             activityRecorder
@@ -128488,10 +128510,33 @@ async function createPsLiteSyncManager(options) {
   return { syncManager, serverOwner };
 }
 
+// ../lite/dist/persistence.js
+function assertCompletePsLitePersistenceBundle(bundle) {
+  if (!bundle || typeof bundle !== "object") {
+    throw new Error("PS Lite persistence bundle must be a complete object");
+  }
+  const required2 = [
+    "storage",
+    "state",
+    "tokens",
+    "accessLog",
+    "mcpConnections",
+    "mcpOAuthAuthorizations",
+    "relayTlsIdentity"
+  ];
+  const missing = required2.filter((key) => bundle[key] == null);
+  if (missing.length > 0) {
+    throw new Error(`PS Lite persistence bundle must be complete; missing ${missing.join(", ")}`);
+  }
+}
+
 // ../lite/dist/browser-runtime.js
 async function createIndexedDbPsLiteRuntime(options) {
   const dbName = options.dbName ?? "personal-server-lite";
-  const stateStore = createIndexedDbPsLiteStateStore({
+  const injected = options.persistence;
+  if (injected !== void 0)
+    assertCompletePsLitePersistenceBundle(injected);
+  const stateStore = injected?.state ?? createIndexedDbPsLiteStateStore({
     dbName,
     storeName: options.stateStoreName ?? "state"
   });
@@ -128500,15 +128545,15 @@ async function createIndexedDbPsLiteRuntime(options) {
     store: stateStore,
     ownerSignature: options.ownerSignature
   });
-  const tokenStore = createIndexedDbPsLiteTokenStore({
+  const tokenStore = injected?.tokens ?? createIndexedDbPsLiteTokenStore({
     dbName,
     storeName: "tokens"
   });
-  const accessLogStore = createIndexedDbPsLiteAccessLogStore({
+  const accessLogStore = injected?.accessLog ?? createIndexedDbPsLiteAccessLogStore({
     dbName,
     storeName: "accessLogs"
   });
-  const storage = await createPersistentPsLiteStorage({ kind: "indexeddb" }, createIndexedDbPsLitePersistence({
+  const storage = injected?.storage ?? await createPersistentPsLiteStorage({ kind: "indexeddb" }, createIndexedDbPsLitePersistence({
     dbName: options.storageDbName ?? `${dbName}-storage`,
     storeName: options.storageStoreName ?? "state",
     key: options.storageKey ?? "data-storage-v1"
@@ -128569,10 +128614,14 @@ async function createIndexedDbPsLiteRuntime(options) {
       const saved = await savePsLiteConfig(stateStore, nextConfig);
       Object.assign(config2, saved);
     },
-    stateCapabilities: { config: "indexeddb" },
+    stateCapabilities: { config: injected?.state ? "custom" : "indexeddb" },
     tokenStore,
     accessLogReader: accessLogStore,
-    accessLogWriter: accessLogStore
+    accessLogWriter: accessLogStore,
+    // A complete host bundle owns both MCP records too. Direct options remain
+    // available only on the default Web path for backwards compatibility.
+    mcpConnectionStore: injected?.mcpConnections ?? options.mcpConnectionStore,
+    mcpOAuthAuthorizationStore: injected?.mcpOAuthAuthorizations ?? options.mcpOAuthAuthorizationStore
   });
   runtimeRef = runtime;
   return {
@@ -129601,13 +129650,14 @@ function createRustlsPsLiteRelayTlsFactory(options) {
   let trustedIdentity;
   let inFlight;
   let inFlightToken;
+  const identityStore = options.identityStore ?? (options.storage ? createLocalStoragePsLiteRelayTlsIdentityStore(options.storage) : void 0);
   async function resolveIdentity(input) {
     if (trustedIdentity) {
       return trustedIdentity;
     }
     const token = input.issueToken ?? "";
     if (!inFlight || token && token !== inFlightToken) {
-      const attempt = createTlsIdentity(input, options).finally(() => {
+      const attempt = createTlsIdentity(input, options, identityStore ?? createLocalStoragePsLiteRelayTlsIdentityStore()).finally(() => {
         if (inFlight === attempt) {
           inFlight = void 0;
           inFlightToken = void 0;
@@ -129666,9 +129716,9 @@ function normalizeTlsStep(value) {
     handshaking: Boolean(step.handshaking)
   };
 }
-async function createTlsIdentity(input, options) {
+async function createTlsIdentity(input, options, identityStore) {
   const hostname3 = psLiteRelayPublicHost(input.sessionId, options.publicSuffix);
-  const cached2 = readCachedTlsIdentity(hostname3, options.storage);
+  const cached2 = await readCachedTlsIdentity(hostname3, identityStore);
   if (cached2) {
     return cached2;
   }
@@ -129677,7 +129727,7 @@ async function createTlsIdentity(input, options) {
     sessionId: input.sessionId,
     issueToken: input.issueToken ?? "",
     hostname: hostname3,
-    storage: options.storage,
+    identityStore,
     logger: options.logger,
     timeoutMs: options.issueCertTimeoutMs ?? DEFAULT_ISSUE_CERT_TIMEOUT_MS
   });
@@ -129796,20 +129846,27 @@ async function fetchSessionCert(input) {
     trusted: true
   };
   try {
-    cacheTlsIdentity(identity, input.storage);
+    await cacheTlsIdentity(identity, input.identityStore);
   } catch (error51) {
     input.logger?.(`failed to persist session certificate (${error51 instanceof Error ? error51.message : String(error51)}); continuing with the in-memory identity`);
   }
   return identity;
 }
-function readCachedTlsIdentity(hostname3, storage = globalThis.localStorage) {
-  try {
-    const raw = storage.getItem(`${TLS_IDENTITY_CACHE_KEY}:${hostname3}`);
-    if (!raw) {
-      return void 0;
+function createLocalStoragePsLiteRelayTlsIdentityStore(storage = globalThis.localStorage) {
+  return {
+    read(hostname3) {
+      const raw = storage.getItem(`${TLS_IDENTITY_CACHE_KEY}:${hostname3}`);
+      return raw ? JSON.parse(raw) : null;
+    },
+    write(identity) {
+      storage.setItem(`${TLS_IDENTITY_CACHE_KEY}:${identity.hostname}`, JSON.stringify(identity));
     }
-    const identity = JSON.parse(raw);
-    if (identity.hostname !== hostname3 || !identity.certPem || !identity.keyPem || identity.source !== "acme") {
+  };
+}
+async function readCachedTlsIdentity(hostname3, identityStore) {
+  try {
+    const identity = await identityStore.read(hostname3);
+    if (!identity || identity.hostname !== hostname3 || !identity.certPem || !identity.keyPem || identity.source !== "acme") {
       return void 0;
     }
     const notAfter = firstCertificateNotAfter(identity.certPem);
@@ -129825,11 +129882,11 @@ function readCachedTlsIdentity(hostname3, storage = globalThis.localStorage) {
     return void 0;
   }
 }
-function cacheTlsIdentity(identity, storage = globalThis.localStorage) {
+async function cacheTlsIdentity(identity, identityStore) {
   if (identity.source !== "acme") {
     return;
   }
-  storage.setItem(`${TLS_IDENTITY_CACHE_KEY}:${identity.hostname}`, JSON.stringify(identity));
+  await identityStore.write(identity);
 }
 function firstCertificateNotAfter(certPem) {
   const match = certPem.match(/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/);
@@ -129869,6 +129926,7 @@ function startPsLiteRelayClient(options) {
     controlUrl: baseControlUrl,
     publicSuffix: options.publicSuffix,
     certIssuerUrl: options.certIssuerUrl,
+    identityStore: options.tlsIdentityStore,
     logger: options.logger
   }) : options.tls;
   const streams = /* @__PURE__ */ new Map();
@@ -130376,9 +130434,15 @@ function httpStatusText(status2) {
 // ../lite/dist/client.js
 var DEFAULT_LITE_ORIGIN = "https://ps-lite.local";
 async function startPersonalServer(options) {
+  if (options.persistence && options.runtime) {
+    throw new Error("runtime cannot be supplied with a complete persistence bundle");
+  }
+  if (options.persistence && options.relayStateStore) {
+    throw new Error("relayStateStore cannot be supplied with a complete persistence bundle");
+  }
   const localOrigin = options.localOrigin ?? DEFAULT_LITE_ORIGIN;
   const relayOptions = options.relay || void 0;
-  const relayStateStore = relayOptions ? options.relayStateStore ?? (options.runtime ? void 0 : createIndexedDbPsLiteStateStore({
+  const relayStateStore = relayOptions ? options.relayStateStore ?? options.persistence?.state ?? (options.runtime ? void 0 : createIndexedDbPsLiteStateStore({
     dbName: options.dbName ?? "personal-server-lite",
     storeName: options.stateStoreName ?? "state"
   })) : void 0;
@@ -130421,6 +130485,7 @@ async function startPersonalServer(options) {
       ...resolvedRelayOptions,
       runtime,
       origin: runtimeOrigin,
+      tlsIdentityStore: options.persistence?.relayTlsIdentity ?? resolvedRelayOptions.tlsIdentityStore,
       onStatus(nextRelayStatus, detail) {
         relayStatus2 = nextRelayStatus;
         if (nextRelayStatus === "error")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opendatalabs/personal-server-ts-server",
-  "version": "1.3.5",
+  "version": "1.4.0",
   "description": "Hono HTTP server for the Vana Personal Server — routes, middleware, composition root",
   "license": "MIT",
   "repository": {
@@ -44,8 +44,8 @@
   },
   "dependencies": {
     "@hono/node-server": "^1.19.13",
-    "@opendatalabs/personal-server-ts-core": "1.3.5",
-    "@opendatalabs/personal-server-ts-lite": "1.3.5",
+    "@opendatalabs/personal-server-ts-core": "1.4.0",
+    "@opendatalabs/personal-server-ts-lite": "1.4.0",
     "@opendatalabs/vana-sdk": "3.14.0",
     "better-sqlite3": "^12.11.1",
     "hono": "^4.12.27",