agent-pager 0.1.0

package/dist/src/hosted-http.js

@@ -0,0 +1,849 @@
+import { canonicalRequest, nowIso, verifyText } from "./crypto.js";
+import { HostedAgentPagerError, HostedAgentPagerService } from "./hosted-service.js";
+import { createSupabaseServiceClient, createSupabaseUserClient, loadSupabaseRuntimeConfig } from "./supabase.js";
+const SIGNATURE_MAX_AGE_MS = 5 * 60_000;
+const DEFAULT_PUBLIC_URL = "http://127.0.0.1:8787";
+const CORS_HEADERS = {
+    "access-control-allow-origin": "*",
+    "access-control-allow-methods": "GET,POST,OPTIONS",
+    "access-control-allow-headers": "authorization,content-type,x-ap-device-id,x-ap-signature,x-ap-timestamp"
+};
+const VERCEL_ROUTE_QUERY_KEYS = [
+    "action",
+    "code",
+    "deliveryId",
+    "deviceId",
+    "path",
+    "requestId",
+    "username"
+];
+export class HostedHttpHandler {
+    options;
+    service;
+    publicUrl;
+    constructor(options) {
+        this.options = options;
+        this.service = new HostedAgentPagerService({
+            supabase: options.supabase,
+            serverPrivateKeyPem: options.serverPrivateKeyPem
+        });
+        this.publicUrl = (options.publicUrl || DEFAULT_PUBLIC_URL).replace(/\/+$/, "");
+    }
+    async handle(request) {
+        const url = new URL(request.url);
+        const bodyText = await request.text();
+        try {
+            if (request.method === "OPTIONS")
+                return empty(204);
+            if (request.method === "GET" && url.pathname === "/api/health") {
+                return json({ ok: true, service: "agent-pager-hosted", realtime: "supabase" });
+            }
+            if (request.method === "GET" && url.pathname === "/api/config") {
+                return json({
+                    supabaseUrl: this.options.supabaseUrl,
+                    supabaseAnonKey: this.options.supabaseAnonKey,
+                    publicUrl: this.publicUrl
+                });
+            }
+            const publicProfile = url.pathname.match(/^\/api\/public\/profiles\/([^/]+)$/);
+            if (request.method === "GET" && publicProfile) {
+                const profile = await this.publicProfileByUsername(decodeURIComponent(publicProfile[1]));
+                if (!profile)
+                    return json({ error: "profile not found" }, 404);
+                return json({ profile });
+            }
+            if (request.method === "POST" && url.pathname === "/api/profiles") {
+                const actor = await this.authenticateBearer(request);
+                const body = parseJsonObject(bodyText);
+                const profile = await this.service.createProfile({
+                    userId: actor.userId,
+                    username: stringBody(body.username),
+                    displayName: optionalStringBody(body.displayName)
+                });
+                return json({ profile });
+            }
+            if (request.method === "POST" && url.pathname === "/api/devices") {
+                const actor = await this.authenticateBearer(request);
+                const body = parseJsonObject(bodyText);
+                const device = await this.service.registerDevice({
+                    userId: actor.userId,
+                    name: stringBody(body.name || body.deviceName || "local terminal"),
+                    publicKeyPem: stringBody(body.publicKeyPem),
+                    platform: optionalStringBody(body.platform),
+                    appVersion: optionalStringBody(body.appVersion)
+                });
+                return json({ device, serverPublicKeyPem: this.options.serverPublicKeyPem });
+            }
+            if (request.method === "POST" && url.pathname === "/api/device-pairings") {
+                const body = parseJsonObject(bodyText);
+                const result = await this.service.createDevicePairing({
+                    name: stringBody(body.name || body.deviceName || "local terminal"),
+                    publicKeyPem: stringBody(body.publicKeyPem),
+                    platform: optionalStringBody(body.platform),
+                    appVersion: optionalStringBody(body.appVersion),
+                    ttlMinutes: optionalNumberBody(body.ttlMinutes)
+                });
+                return json({
+                    code: result.pairing.code,
+                    pairingSecret: result.pairingSecret,
+                    verificationUrl: `${this.publicUrl}/app/devices/pair?code=${encodeURIComponent(result.pairing.code)}`,
+                    expiresAt: result.pairing.expires_at
+                });
+            }
+            const pairingApprove = url.pathname.match(/^\/api\/device-pairings\/([^/]+)\/approve$/);
+            if (request.method === "POST" && pairingApprove) {
+                const actor = await this.authenticateBearer(request);
+                const result = await this.service.approveDevicePairing({
+                    userId: actor.userId,
+                    code: pairingApprove[1]
+                });
+                return json({ pairing: publicPairing(result.pairing), device: result.device });
+            }
+            const pairingClaim = url.pathname.match(/^\/api\/device-pairings\/([^/]+)\/claim$/);
+            if (request.method === "POST" && pairingClaim) {
+                const body = parseJsonObject(bodyText);
+                const result = await this.service.claimDevicePairing({
+                    code: pairingClaim[1],
+                    pairingSecret: stringBody(body.pairingSecret)
+                });
+                return json({
+                    profile: result.profile,
+                    device: result.device,
+                    serverPublicKeyPem: this.options.serverPublicKeyPem,
+                    realtime: await this.createRealtimeSession(result.profile.id)
+                });
+            }
+            const actor = await this.authenticate(request, url, bodyText);
+            if (request.method === "GET" && url.pathname === "/api/devices") {
+                return json({ devices: await this.listDevices(actor.userId) });
+            }
+            const deviceRevoke = url.pathname.match(/^\/api\/devices\/([^/]+)\/revoke$/);
+            if (request.method === "POST" && deviceRevoke) {
+                const device = await this.service.revokeDevice({
+                    userId: actor.userId,
+                    deviceId: decodeURIComponent(deviceRevoke[1]),
+                    actorDeviceId: actor.deviceId
+                });
+                return json({ device: publicDevice(device) });
+            }
+            if (request.method === "POST" && url.pathname === "/api/realtime-token") {
+                if (!actor.deviceId)
+                    throw new HostedAgentPagerError("device authentication is required for realtime tokens", 401);
+                return json({ realtime: await this.createRealtimeSession(actor.userId) });
+            }
+            if (request.method === "GET" && url.pathname === "/api/me") {
+                const [profile, friends, pages, deliveries] = await Promise.all([
+                    this.profileFor(actor.userId),
+                    this.listFriends(actor.userId),
+                    this.listPages(actor.userId, 25),
+                    this.listDeliveries(actor, "pending")
+                ]);
+                return json({ profile, friends, pages, pendingDeliveries: deliveries.map(publicDelivery) });
+            }
+            if (request.method === "GET" && url.pathname === "/api/settings") {
+                return json({ settings: publicSettings(await this.service.getSettings(actor.userId)) });
+            }
+            if (request.method === "POST" && url.pathname === "/api/settings") {
+                const body = parseJsonObject(bodyText);
+                const settings = await this.service.updateSettings({
+                    userId: actor.userId,
+                    presenceVisibility: optionalStringBody(body.presenceVisibility ?? body.presence_visibility),
+                    defaultDeliveryMode: optionalStringBody(body.defaultDeliveryMode ?? body.default_delivery_mode),
+                    quietHours: body.quietHours === undefined ? body.quiet_hours : body.quietHours,
+                    maxPagesPerFriendPerMinute: optionalNumberBody(body.maxPagesPerFriendPerMinute ?? body.max_pages_per_friend_per_minute)
+                });
+                return json({ settings: publicSettings(settings) });
+            }
+            if (request.method === "POST" && url.pathname === "/api/presence") {
+                if (!actor.deviceId)
+                    throw new HostedAgentPagerError("device authentication is required for presence", 401);
+                const body = parseJsonObject(bodyText);
+                await this.service.setPresence({
+                    userId: actor.userId,
+                    deviceId: actor.deviceId,
+                    status: normalizeStatus(body.status),
+                    reachable: body.reachable === undefined ? true : Boolean(body.reachable),
+                    activeAdapter: optionalStringBody(body.activeAdapter)
+                });
+                return json({ ok: true });
+            }
+            if (request.method === "GET" && url.pathname === "/api/invites") {
+                return json({ invites: await this.listInvites(actor.userId) });
+            }
+            if (request.method === "POST" && url.pathname === "/api/invites") {
+                const body = parseJsonObject(bodyText);
+                const invite = await this.service.createInvite({
+                    userId: actor.userId,
+                    ttlHours: optionalNumberBody(body.ttlHours)
+                });
+                return json({ invite: publicInvite(invite, this.publicUrl), url: `${this.publicUrl}/invite/${invite.code}` });
+            }
+            const inviteAccept = url.pathname.match(/^\/api\/invites\/([^/]+)\/accept$/);
+            if (request.method === "POST" && inviteAccept) {
+                const body = parseJsonObject(bodyText);
+                const friendship = await this.service.acceptInvite({
+                    userId: actor.userId,
+                    code: inviteAccept[1],
+                    note: optionalStringBody(body.note)
+                });
+                const friends = await this.listFriends(actor.userId);
+                return json({ friendship, friends });
+            }
+            const inviteRevoke = url.pathname.match(/^\/api\/invites\/([^/]+)\/revoke$/);
+            if (request.method === "POST" && inviteRevoke) {
+                const invite = await this.service.revokeInvite({
+                    userId: actor.userId,
+                    code: decodeURIComponent(inviteRevoke[1])
+                });
+                return json({ invite: publicInvite(invite, this.publicUrl) });
+            }
+            if (request.method === "GET" && url.pathname === "/api/friends") {
+                return json({ friends: await this.listFriends(actor.userId) });
+            }
+            const friendRemove = url.pathname.match(/^\/api\/friends\/([^/]+)\/remove$/);
+            if (request.method === "POST" && friendRemove) {
+                const result = await this.service.removeFriend({
+                    ownerUserId: actor.userId,
+                    friendUsername: decodeURIComponent(friendRemove[1])
+                });
+                return json({ removedFriend: profileSummary(result.removedFriend) });
+            }
+            if (request.method === "GET" && url.pathname === "/api/mutes") {
+                return json({ mutes: await this.listMutes(actor.userId) });
+            }
+            if (request.method === "GET" && url.pathname === "/api/blocks") {
+                return json({ blocks: await this.listBlocks(actor.userId) });
+            }
+            if (request.method === "POST" && url.pathname === "/api/blocks") {
+                const body = parseJsonObject(bodyText);
+                const result = await this.service.blockUser({
+                    ownerUserId: actor.userId,
+                    blockedUsername: stringBody(body.username || body.friend)
+                });
+                return json({ blockedUser: profileSummary(result.blockedUser) });
+            }
+            const blockUnblock = url.pathname.match(/^\/api\/blocks\/([^/]+)\/unblock$/);
+            if (request.method === "POST" && blockUnblock) {
+                const result = await this.service.unblockUser({
+                    ownerUserId: actor.userId,
+                    blockedUsername: decodeURIComponent(blockUnblock[1])
+                });
+                return json({ unblockedUser: profileSummary(result.unblockedUser) });
+            }
+            if (request.method === "POST" && url.pathname === "/api/mutes") {
+                const body = parseJsonObject(bodyText);
+                const result = await this.service.muteFriend({
+                    ownerUserId: actor.userId,
+                    mutedUsername: stringBody(body.friend || body.username),
+                    durationMs: parseDurationMs(optionalStringBody(body.duration) || optionalStringBody(body.for)),
+                    reason: optionalStringBody(body.reason)
+                });
+                return json({
+                    mutedUntil: result.mutedUntil,
+                    mutedUser: {
+                        id: result.mutedUser.id,
+                        username: result.mutedUser.username,
+                        displayName: result.mutedUser.display_name
+                    }
+                });
+            }
+            const muteUnmute = url.pathname.match(/^\/api\/mutes\/([^/]+)\/unmute$/);
+            if (request.method === "POST" && muteUnmute) {
+                const result = await this.service.unmuteFriend({
+                    ownerUserId: actor.userId,
+                    mutedUsername: decodeURIComponent(muteUnmute[1])
+                });
+                return json({ unmutedUser: profileSummary(result.unmutedUser) });
+            }
+            if (request.method === "GET" && url.pathname === "/api/friend-requests") {
+                return json({ friendRequests: await this.listFriendRequests(actor.userId) });
+            }
+            if (request.method === "POST" && url.pathname === "/api/friend-requests") {
+                const body = parseJsonObject(bodyText);
+                const request = await this.service.createFriendRequest({
+                    fromUserId: actor.userId,
+                    toUsername: stringBody(body.toUsername || body.to),
+                    note: optionalStringBody(body.note)
+                });
+                return json({ friendRequest: request });
+            }
+            const friendRequestResolve = url.pathname.match(/^\/api\/friend-requests\/([^/]+)\/(approve|deny|cancel)$/);
+            if (request.method === "POST" && friendRequestResolve) {
+                const decision = friendRequestResolve[2] === "approve"
+                    ? "approved"
+                    : friendRequestResolve[2] === "deny"
+                        ? "denied"
+                        : "canceled";
+                const result = await this.service.resolveFriendRequest({
+                    userId: actor.userId,
+                    requestId: friendRequestResolve[1],
+                    decision
+                });
+                return json(result);
+            }
+            if (request.method === "POST" && url.pathname === "/api/pages") {
+                const body = parseJsonObject(bodyText);
+                const result = await this.service.sendPage({
+                    fromUserId: actor.userId,
+                    toUsername: stringBody(body.toUsername || body.to),
+                    message: stringBody(body.message),
+                    urgency: normalizeUrgency(body.urgency),
+                    replyToPageId: optionalStringBody(body.replyToPageId)
+                });
+                return json({
+                    page: result.envelope.page,
+                    deliveries: result.deliveries.map(publicDeliverySummary)
+                });
+            }
+            if (request.method === "GET" && url.pathname === "/api/pages") {
+                return json({ pages: await this.listPages(actor.userId, 100) });
+            }
+            if (request.method === "GET" && url.pathname === "/api/deliveries") {
+                const status = optionalStringBody(url.searchParams.get("status"));
+                return json({ deliveries: (await this.listDeliveries(actor, status)).map(publicDelivery) });
+            }
+            if (request.method === "GET" && url.pathname === "/api/audit-events") {
+                return json({ auditEvents: await this.listAuditEvents(actor.userId) });
+            }
+            if (request.method === "GET" && url.pathname === "/api/abuse-reports") {
+                return json({ abuseReports: await this.listAbuseReports(actor.userId) });
+            }
+            if (request.method === "POST" && url.pathname === "/api/abuse-reports") {
+                const body = parseJsonObject(bodyText);
+                const report = await this.service.createAbuseReport({
+                    reporterUserId: actor.userId,
+                    reportedUsername: optionalStringBody(body.username || body.reportedUsername || body.friend),
+                    pageId: optionalStringBody(body.pageId || body.page_id),
+                    reason: stringBody(body.reason),
+                    details: optionalStringBody(body.details)
+                });
+                return json({ abuseReport: publicAbuseReport(report) });
+            }
+            const deliveryAck = url.pathname.match(/^\/api\/deliveries\/([^/]+)\/ack$/);
+            if (request.method === "POST" && deliveryAck) {
+                await this.service.ackDelivery({
+                    deliveryId: deliveryAck[1],
+                    userId: actor.userId,
+                    deviceId: actor.deviceId
+                });
+                return json({ ok: true });
+            }
+            return json({ error: "not found" }, 404);
+        }
+        catch (error) {
+            if (error instanceof HostedAgentPagerError) {
+                return json({ error: error.message }, error.status);
+            }
+            return json({ error: error instanceof Error ? error.message : "request failed" }, 500);
+        }
+    }
+    async authenticate(request, url, bodyText) {
+        const deviceId = request.headers.get("x-ap-device-id");
+        if (deviceId)
+            return this.authenticateDevice(request, url, bodyText, deviceId);
+        return this.authenticateBearer(request);
+    }
+    async authenticateBearer(request) {
+        const authorization = request.headers.get("authorization") || "";
+        const match = authorization.match(/^Bearer\s+(.+)$/i);
+        if (!match)
+            throw new HostedAgentPagerError("bearer token is required", 401);
+        const { data, error } = await this.options.authSupabase.auth.getUser(match[1]);
+        if (error || !data.user)
+            throw new HostedAgentPagerError("invalid bearer token", 401);
+        return { kind: "bearer", userId: data.user.id };
+    }
+    async authenticateDevice(request, url, bodyText, deviceId) {
+        const timestamp = request.headers.get("x-ap-timestamp") || "";
+        const signature = request.headers.get("x-ap-signature") || "";
+        const timestampMs = Date.parse(timestamp);
+        if (!signature || !Number.isFinite(timestampMs)) {
+            throw new HostedAgentPagerError("device signature is required", 401);
+        }
+        if (Math.abs(Date.now() - timestampMs) > SIGNATURE_MAX_AGE_MS) {
+            throw new HostedAgentPagerError("device signature timestamp is stale", 401);
+        }
+        const { data: device, error } = await this.options.supabase
+            .from("devices")
+            .select()
+            .eq("id", deviceId)
+            .is("revoked_at", null)
+            .maybeSingle();
+        if (error)
+            throw new HostedAgentPagerError(error.message, 500);
+        if (!device)
+            throw new HostedAgentPagerError("device not found", 401);
+        const pathAndQuery = signedPathAndQuery(url);
+        const canonical = canonicalRequest(request.method, pathAndQuery, timestamp, bodyText);
+        if (!verifyText(device.public_key_pem, canonical, signature)) {
+            throw new HostedAgentPagerError("invalid device signature", 401);
+        }
+        await this.options.supabase
+            .from("devices")
+            .update({ last_seen_at: nowIso() })
+            .eq("id", device.id);
+        return { kind: "device", userId: device.user_id, deviceId: device.id, device };
+    }
+    async profileFor(userId) {
+        const { data, error } = await this.options.supabase
+            .from("profiles")
+            .select("id,username,display_name,avatar_url,public_profile_enabled,default_status,created_at,updated_at")
+            .eq("id", userId)
+            .maybeSingle();
+        if (error)
+            throw new HostedAgentPagerError(error.message, 500);
+        return data;
+    }
+    async publicProfileByUsername(username) {
+        const { data, error } = await this.options.supabase
+            .from("profiles")
+            .select("id,username,display_name,avatar_url,public_profile_enabled,created_at")
+            .eq("username", cleanUsername(username))
+            .eq("public_profile_enabled", true)
+            .maybeSingle();
+        if (error)
+            throw new HostedAgentPagerError(error.message, 500);
+        if (!data)
+            return null;
+        const { count, error: friendCountError } = await this.options.supabase
+            .from("friendships")
+            .select("id", { count: "exact", head: true })
+            .or(`user_a_id.eq.${data.id},user_b_id.eq.${data.id}`)
+            .is("revoked_at", null);
+        if (friendCountError)
+            throw new HostedAgentPagerError(friendCountError.message, 500);
+        return {
+            username: data.username,
+            displayName: data.display_name,
+            avatarUrl: data.avatar_url,
+            friendCount: count || 0,
+            profileUrl: `${this.publicUrl}/@${data.username}`
+        };
+    }
+    async listDevices(userId) {
+        const { data, error } = await this.options.supabase
+            .from("devices")
+            .select("id,name,public_key_fingerprint,platform,app_version,created_at,last_seen_at,revoked_at")
+            .eq("user_id", userId)
+            .order("created_at", { ascending: false });
+        if (error)
+            throw new HostedAgentPagerError(error.message, 500);
+        return data.map(publicDevice);
+    }
+    async listInvites(userId) {
+        const { data, error } = await this.options.supabase
+            .from("friend_invites")
+            .select()
+            .eq("created_by_user_id", userId)
+            .order("created_at", { ascending: false })
+            .limit(100);
+        if (error)
+            throw new HostedAgentPagerError(error.message, 500);
+        return data.map((invite) => publicInvite(invite, this.publicUrl));
+    }
+    async listFriends(userId) {
+        const { data: friendships, error } = await this.options.supabase
+            .from("friendships")
+            .select("id,user_a_id,user_b_id,created_at")
+            .or(`user_a_id.eq.${userId},user_b_id.eq.${userId}`)
+            .is("revoked_at", null)
+            .order("created_at", { ascending: false });
+        if (error)
+            throw new HostedAgentPagerError(error.message, 500);
+        const friendIds = friendships.map((friendship) => friendship.user_a_id === userId ? friendship.user_b_id : friendship.user_a_id);
+        if (!friendIds.length)
+            return [];
+        const [profiles, presence] = await Promise.all([
+            this.profilesByIds(friendIds),
+            this.presenceByUserIds(friendIds)
+        ]);
+        return friendIds.map((friendId) => {
+            const profile = profiles.get(friendId);
+            const visiblePresence = presence.get(friendId);
+            return {
+                id: friendId,
+                username: profile?.username || "unknown",
+                displayName: profile?.display_name || profile?.username || "Unknown",
+                status: visiblePresence?.status || "offline",
+                reachable: visiblePresence?.reachable || false,
+                lastSeenAt: visiblePresence?.last_seen_at || null
+            };
+        });
+    }
+    async listFriendRequests(userId) {
+        const { data, error } = await this.options.supabase
+            .from("friend_requests")
+            .select("id,from_user_id,to_user_id,note,status,created_at,resolved_at")
+            .or(`from_user_id.eq.${userId},to_user_id.eq.${userId}`)
+            .order("created_at", { ascending: false })
+            .limit(100);
+        if (error)
+            throw new HostedAgentPagerError(error.message, 500);
+        if (!data.length)
+            return [];
+        const userIds = [...new Set(data.flatMap((request) => [request.from_user_id, request.to_user_id]))];
+        const profiles = await this.profilesByIds(userIds);
+        return data.map((request) => ({
+            id: request.id,
+            direction: request.to_user_id === userId ? "incoming" : "outgoing",
+            status: request.status,
+            note: request.note,
+            createdAt: request.created_at,
+            resolvedAt: request.resolved_at,
+            from: profileSummary(profiles.get(request.from_user_id)),
+            to: profileSummary(profiles.get(request.to_user_id))
+        }));
+    }
+    async listMutes(userId) {
+        const { data, error } = await this.options.supabase
+            .from("mutes")
+            .select("muted_user_id,muted_until,reason,created_at")
+            .eq("owner_user_id", userId)
+            .order("created_at", { ascending: false });
+        if (error)
+            throw new HostedAgentPagerError(error.message, 500);
+        if (!data.length)
+            return [];
+        const profiles = await this.profilesByIds(data.map((mute) => mute.muted_user_id));
+        return data.map((mute) => ({
+            mutedUntil: mute.muted_until,
+            reason: mute.reason,
+            createdAt: mute.created_at,
+            user: profileSummary(profiles.get(mute.muted_user_id))
+        }));
+    }
+    async listBlocks(userId) {
+        const { data, error } = await this.options.supabase
+            .from("blocks")
+            .select("blocked_user_id,created_at")
+            .eq("owner_user_id", userId)
+            .order("created_at", { ascending: false });
+        if (error)
+            throw new HostedAgentPagerError(error.message, 500);
+        if (!data.length)
+            return [];
+        const profiles = await this.profilesByIds(data.map((block) => block.blocked_user_id));
+        return data.map((block) => ({
+            createdAt: block.created_at,
+            user: profileSummary(profiles.get(block.blocked_user_id))
+        }));
+    }
+    async listPages(userId, limit) {
+        const { data: pages, error } = await this.options.supabase
+            .from("pages")
+            .select()
+            .or(`from_user_id.eq.${userId},to_user_id.eq.${userId}`)
+            .order("created_at", { ascending: false })
+            .limit(limit);
+        if (error)
+            throw new HostedAgentPagerError(error.message, 500);
+        if (!pages.length)
+            return [];
+        const userIds = [...new Set(pages.flatMap((page) => [page.from_user_id, page.to_user_id]))];
+        const profiles = await this.profilesByIds(userIds);
+        return pages.map((page) => ({
+            ...page,
+            fromUsername: profiles.get(page.from_user_id)?.username || "unknown",
+            toUsername: profiles.get(page.to_user_id)?.username || "unknown"
+        }));
+    }
+    async listDeliveries(actor, status) {
+        let query = this.options.supabase
+            .from("page_deliveries")
+            .select()
+            .eq("recipient_user_id", actor.userId)
+            .order("created_at", { ascending: false })
+            .limit(100);
+        if (actor.deviceId) {
+            query = query.or(`device_id.eq.${actor.deviceId},device_id.is.null`);
+        }
+        if (status) {
+            query = query.eq("status", status);
+        }
+        const { data, error } = await query;
+        if (error)
+            throw new HostedAgentPagerError(error.message, 500);
+        return data;
+    }
+    async listAuditEvents(userId) {
+        const { data, error } = await this.options.supabase
+            .from("audit_events")
+            .select("id,action,target_type,target_id,metadata,created_at,actor_user_id,target_user_id")
+            .or(`actor_user_id.eq.${userId},target_user_id.eq.${userId}`)
+            .order("created_at", { ascending: false })
+            .limit(100);
+        if (error)
+            throw new HostedAgentPagerError(error.message, 500);
+        return data.map((event) => ({
+            id: event.id,
+            action: event.action,
+            targetType: event.target_type,
+            targetId: event.target_id,
+            metadata: event.metadata,
+            createdAt: event.created_at
+        }));
+    }
+    async listAbuseReports(userId) {
+        const { data, error } = await this.options.supabase
+            .from("abuse_reports")
+            .select()
+            .eq("reporter_user_id", userId)
+            .order("created_at", { ascending: false })
+            .limit(100);
+        if (error)
+            throw new HostedAgentPagerError(error.message, 500);
+        return data.map(publicAbuseReport);
+    }
+    async profilesByIds(userIds) {
+        if (!userIds.length)
+            return new Map();
+        const { data, error } = await this.options.supabase
+            .from("profiles")
+            .select("id,username,display_name")
+            .in("id", userIds);
+        if (error)
+            throw new HostedAgentPagerError(error.message, 500);
+        return new Map(data.map((profile) => [profile.id, profile]));
+    }
+    async presenceByUserIds(userIds) {
+        if (!userIds.length)
+            return new Map();
+        const { data, error } = await this.options.supabase
+            .from("presence")
+            .select("user_id,status,reachable,last_seen_at")
+            .in("user_id", userIds)
+            .order("last_seen_at", { ascending: false });
+        if (error)
+            throw new HostedAgentPagerError(error.message, 500);
+        const byUser = new Map();
+        for (const row of data) {
+            const existing = byUser.get(row.user_id);
+            if (!existing || (!existing.reachable && row.reachable)) {
+                byUser.set(row.user_id, {
+                    status: row.status,
+                    reachable: row.reachable,
+                    last_seen_at: row.last_seen_at
+                });
+            }
+        }
+        return byUser;
+    }
+    async createRealtimeSession(userId) {
+        const { data: userData, error: userError } = await this.options.supabase.auth.admin.getUserById(userId);
+        const email = userData.user?.email;
+        if (userError || !email) {
+            throw new HostedAgentPagerError(userError?.message || "paired user email is required for realtime auth", 500);
+        }
+        const { data: linkData, error: linkError } = await this.options.supabase.auth.admin.generateLink({
+            type: "magiclink",
+            email
+        });
+        const tokenHash = linkData.properties?.hashed_token;
+        if (linkError || !tokenHash) {
+            throw new HostedAgentPagerError(linkError?.message || "failed to create realtime auth link", 500);
+        }
+        const { data: sessionData, error: sessionError } = await this.options.authSupabase.auth.verifyOtp({
+            token_hash: tokenHash,
+            type: "email"
+        });
+        const session = sessionData.session;
+        if (sessionError || !session?.access_token || session.user?.id !== userId) {
+            throw new HostedAgentPagerError(sessionError?.message || "failed to create realtime auth session", 500);
+        }
+        return {
+            supabaseUrl: this.options.supabaseUrl,
+            supabaseAnonKey: this.options.supabaseAnonKey,
+            accessToken: session.access_token,
+            expiresAt: session.expires_at
+                ? new Date(session.expires_at * 1000).toISOString()
+                : new Date(Date.now() + Math.max(60, session.expires_in || 3600) * 1000).toISOString()
+        };
+    }
+}
+export function createHostedHttpHandler(options) {
+    return new HostedHttpHandler(options);
+}
+export function createHostedHttpHandlerFromEnv(env = process.env) {
+    const config = loadSupabaseRuntimeConfig(env);
+    const serverPrivateKeyPem = pemFromEnv(env.AGENT_PAGER_SERVER_PRIVATE_KEY_PEM);
+    const serverPublicKeyPem = pemFromEnv(env.AGENT_PAGER_SERVER_PUBLIC_KEY_PEM);
+    if (!serverPrivateKeyPem || !serverPublicKeyPem) {
+        throw new Error("Missing AGENT_PAGER_SERVER_PRIVATE_KEY_PEM and AGENT_PAGER_SERVER_PUBLIC_KEY_PEM.");
+    }
+    return createHostedHttpHandler({
+        supabase: createSupabaseServiceClient(config),
+        authSupabase: createSupabaseUserClient(config),
+        serverPrivateKeyPem,
+        serverPublicKeyPem,
+        supabaseUrl: config.url,
+        supabaseAnonKey: config.anonKey,
+        publicUrl: env.NEXT_PUBLIC_AGENT_PAGER_URL || env.AGENT_PAGER_PUBLIC_URL
+    });
+}
+function parseJsonObject(bodyText) {
+    if (!bodyText.trim())
+        return {};
+    const parsed = JSON.parse(bodyText);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new HostedAgentPagerError("JSON object body is required", 400);
+    }
+    return parsed;
+}
+function publicDelivery(delivery) {
+    return {
+        id: delivery.id,
+        pageId: delivery.page_id,
+        deviceId: delivery.device_id,
+        status: delivery.status,
+        channel: delivery.delivery_channel,
+        envelope: delivery.envelope,
+        serverSignature: delivery.server_signature,
+        createdAt: delivery.created_at,
+        deliveredAt: delivery.delivered_at,
+        ackedAt: delivery.acked_at
+    };
+}
+function publicDeliverySummary(delivery) {
+    return {
+        id: delivery.id,
+        deviceId: delivery.device_id,
+        status: delivery.status,
+        createdAt: delivery.created_at
+    };
+}
+function publicPairing(pairing) {
+    return {
+        code: pairing.code,
+        expiresAt: pairing.expires_at,
+        approvedAt: pairing.approved_at,
+        deviceId: pairing.device_id,
+        consumedAt: pairing.consumed_at
+    };
+}
+function publicInvite(invite, publicUrl) {
+    return {
+        code: invite.code,
+        url: `${publicUrl}/invite/${invite.code}`,
+        createdAt: invite.created_at,
+        expiresAt: invite.expires_at,
+        acceptedAt: invite.accepted_at,
+        acceptedByUserId: invite.accepted_by_user_id,
+        revokedAt: invite.revoked_at,
+        useCount: invite.use_count,
+        maxUses: invite.max_uses,
+        status: invite.revoked_at
+            ? "revoked"
+            : invite.accepted_by_user_id || invite.use_count >= invite.max_uses
+                ? "used"
+                : Date.parse(invite.expires_at) < Date.now()
+                    ? "expired"
+                    : "active"
+    };
+}
+function publicSettings(settings) {
+    return {
+        presenceVisibility: settings.presence_visibility,
+        defaultDeliveryMode: settings.default_delivery_mode,
+        quietHours: settings.quiet_hours,
+        maxPagesPerFriendPerMinute: settings.max_pages_per_friend_per_minute,
+        createdAt: settings.created_at,
+        updatedAt: settings.updated_at
+    };
+}
+function publicAbuseReport(report) {
+    return {
+        id: report.id,
+        reportedUserId: report.reported_user_id,
+        pageId: report.page_id,
+        reason: report.reason,
+        details: report.details,
+        status: report.status,
+        createdAt: report.created_at,
+        reviewedAt: report.reviewed_at
+    };
+}
+function signedPathAndQuery(url) {
+    const params = new URLSearchParams(url.searchParams);
+    for (const key of VERCEL_ROUTE_QUERY_KEYS)
+        params.delete(key);
+    const query = params.toString();
+    return `${url.pathname}${query ? `?${query}` : ""}`;
+}
+function publicDevice(device) {
+    return {
+        id: device.id,
+        name: device.name,
+        fingerprint: device.public_key_fingerprint,
+        platform: device.platform,
+        appVersion: device.app_version,
+        createdAt: device.created_at,
+        lastSeenAt: device.last_seen_at,
+        revokedAt: device.revoked_at
+    };
+}
+function json(body, status = 200) {
+    return new Response(JSON.stringify(body), {
+        status,
+        headers: {
+            ...CORS_HEADERS,
+            "content-type": "application/json; charset=utf-8"
+        }
+    });
+}
+function empty(status) {
+    return new Response(null, { status, headers: CORS_HEADERS });
+}
+function stringBody(value) {
+    return String(value || "");
+}
+function optionalStringBody(value) {
+    if (value === undefined || value === null || value === "")
+        return undefined;
+    return String(value);
+}
+function optionalNumberBody(value) {
+    if (value === undefined || value === null || value === "")
+        return undefined;
+    const number = Number(value);
+    return Number.isFinite(number) ? number : undefined;
+}
+function parseDurationMs(value) {
+    if (!value || value === "forever" || value === "indefinite")
+        return null;
+    const match = value.trim().toLowerCase().match(/^(\d+)\s*(m|min|minute|minutes|h|hr|hour|hours|d|day|days)$/);
+    if (!match)
+        throw new HostedAgentPagerError("duration must look like 15m, 2h, 1d, or forever", 400);
+    const amount = Number(match[1]);
+    const unit = match[2][0];
+    if (unit === "m")
+        return amount * 60_000;
+    if (unit === "h")
+        return amount * 60 * 60_000;
+    return amount * 24 * 60 * 60_000;
+}
+function cleanUsername(value) {
+    return String(value || "").trim().toLowerCase().replace(/[^a-z0-9_-]/g, "").slice(0, 31);
+}
+function profileSummary(profile) {
+    if (!profile) {
+        return { id: "", username: "unknown", displayName: "Unknown" };
+    }
+    return {
+        id: profile.id,
+        username: profile.username,
+        displayName: profile.display_name
+    };
+}
+function normalizeUrgency(value) {
+    return ["gentle", "normal", "firm", "professionally-dramatic"].includes(String(value))
+        ? String(value)
+        : "normal";
+}
+function normalizeStatus(value) {
+    return ["online", "busy", "muted", "offline"].includes(String(value))
+        ? String(value)
+        : "online";
+}
+function pemFromEnv(value) {
+    return (value || "").replace(/\\n/g, "\n");
+}