dscs-server 0.0.1 → 0.1.0

package/dist/http.js

@@ -4,10 +4,11 @@ import { join } from 'node:path';
 import { createServer } from 'node:http';
 import { PROTOCOL_VERSION, errorBody } from './shared/protocol.js';
 import { SyncError, statusOf } from './shared/wire.js';
+import { BLOB_BATCH_CONTENT_TYPE, MAX_BATCH_BLOBS, MAX_BATCH_BODY_BYTES, decodeBlobBatch, encodeBlobBatch } from './shared/blob-batch.js';
 import { deriveMasterKey, newSalt } from './shared/crypto.js';
 import { hasBlob, putBlob, readBlob } from './blobs.js';
 import { DEFAULT_DATASET, SERVER_SCHEMA_VERSION, adminPassword, blobRecord, isAdminInitialized, markAdminInitialized, readMaxBytes, readMeta, recordBlob, readRevision, setAdminPassword, usedBlobBytes, writeMaxBytes } from './db.js';
-import { MAX_APPEND_BODY_BYTES, adminSessions, appendFrames, deleteSession, getManifest, listChanges, listBatches, sessionCounts } from './sessions.js';
+import { MAX_APPEND_BODY_BYTES, adminSessions, appendFrames, deleteSession, getManifest, getV2SessionSummary, listV2Batches, listV2Changes, listV2Sessions, sessionCounts } from './sessions.js';
 import { acquireLease, releaseLease, SYNC_RESOURCE, vaultResource } from './leases.js';
 import { appendVaultRecord, readVaultCursor, readVaultStream, validVaultWriter } from './vault.js';
 function readServerVersion() {
@@ -118,13 +119,93 @@ function clientIdFrom(req) {
     }
     return value;
 }
+function idempotencyKeyFrom(req) {
+    const raw = req.headers['idempotency-key'];
+    const value = Array.isArray(raw) ? raw[0] ?? '' : String(raw ?? '');
+    if (!/^[A-Za-z0-9._:-]{1,255}$/u.test(value)) {
+        throw new SyncError('bad-request', '需要 1–255 位合法 Idempotency-Key');
+    }
+    return value;
+}
+const SESSION_ID_PATTERN = /^[A-Za-z0-9._:-]{1,128}$/u;
 function sessionIdFrom(pathname, pattern) {
     const match = pattern.exec(pathname);
     if (match === null) throw new SyncError('bad-request', '会话 id 缺失');
     const id = decodeURIComponent(match[1]);
-    if (!/^[A-Za-z0-9._:-]{1,128}$/u.test(id)) throw new SyncError('bad-request', `会话 id 非法：${id}`);
+    if (!SESSION_ID_PATTERN.test(id)) throw new SyncError('bad-request', `会话 id 非法：${id}`);
     return id;
 }
+const MAX_CURSOR_LENGTH = 512;
+function encodeCursor(value) {
+    return Buffer.from(JSON.stringify(value), 'utf8').toString('base64url');
+}
+function decodeCursorObject(raw) {
+    if (raw === null || raw === '') return undefined;
+    if (raw.length > MAX_CURSOR_LENGTH || !/^[A-Za-z0-9_-]+$/u.test(raw)) {
+        throw new SyncError('bad-request', 'cursor 非法');
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(Buffer.from(raw, 'base64url').toString('utf8'));
+    } catch  {
+        throw new SyncError('bad-request', 'cursor 非法');
+    }
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new SyncError('bad-request', 'cursor 非法');
+    }
+    return parsed;
+}
+function decodeSessionsCursor(raw) {
+    const value = decodeCursorObject(raw);
+    if (value === undefined) return undefined;
+    if (value['v'] !== 2 || typeof value['after'] !== 'string' || !SESSION_ID_PATTERN.test(value['after'])) {
+        throw new SyncError('bad-request', 'cursor 非法');
+    }
+    return value['after'];
+}
+function decodeChangesCursor(raw) {
+    const value = decodeCursorObject(raw);
+    if (value === undefined) {
+        return {
+            revision: 0,
+            tombstone: {
+                deletedAt: 0,
+                sessionId: '',
+                createdAt: 0
+            }
+        };
+    }
+    const revision = value['revision'];
+    const tombstone = value['tombstone'];
+    if (value['v'] !== 2 || typeof revision !== 'number' || !Number.isSafeInteger(revision) || revision < 0 || tombstone === null || typeof tombstone !== 'object' || Array.isArray(tombstone)) {
+        throw new SyncError('bad-request', 'cursor 非法');
+    }
+    const record = tombstone;
+    const deletedAt = record['deletedAt'];
+    const sessionId = record['sessionId'];
+    const createdAt = record['createdAt'];
+    const empty = deletedAt === 0 && sessionId === '' && createdAt === 0;
+    if (typeof deletedAt !== 'number' || !Number.isSafeInteger(deletedAt) || deletedAt < 0 || typeof sessionId !== 'string' || !empty && !SESSION_ID_PATTERN.test(sessionId) || typeof createdAt !== 'number' || !Number.isSafeInteger(createdAt) || createdAt < 0) {
+        throw new SyncError('bad-request', 'cursor 非法');
+    }
+    return {
+        revision,
+        tombstone: {
+            deletedAt,
+            sessionId,
+            createdAt
+        }
+    };
+}
+function etagMatches(header, digest) {
+    const raw = Array.isArray(header) ? header.join(',') : header;
+    if (raw === undefined) return false;
+    const target = `"${digest}"`;
+    return raw.split(',').some((entry)=>{
+        const value = entry.trim();
+        return value === '*' || value === target || value === `W/${target}`;
+    });
+}
 function parseAppend(body) {
     if (!Number.isSafeInteger(body.baseIndex)) throw new SyncError('bad-request', 'baseIndex 必须是整数');
     const baseChainHash = body.baseChainHash;
@@ -165,16 +246,24 @@ function intParam(value, fallback, min, max) {
     if (!Number.isSafeInteger(parsed)) throw new SyncError('bad-request', `查询参数必须是整数：${value}`);
     return Math.min(max, Math.max(min, parsed));
 }
-const SYNC_LEASE_PATH = /^\/v1\/sync\/lease$/u;
-const APPEND_PATH = /^\/v1\/sessions\/([^/]+)\/append$/u;
-const DELETE_PATH = /^\/v1\/sessions\/([^/]+)\/delete$/u;
-const MANIFEST_PATH = /^\/v1\/sessions\/([^/]+)\/manifest$/u;
-const BATCHES_PATH = /^\/v1\/sessions\/([^/]+)\/batches$/u;
-const CURSOR_PATH = /^\/v1\/cursor$/u;
-const VAULT_APPEND_PATH = /^\/v1\/vault\/append$/u;
-const VAULT_LEASE_PATH = /^\/v1\/vault\/lease$/u;
-const VAULT_CURSOR_PATH = /^\/v1\/vault\/cursor$/u;
-const VAULT_STREAM_PATH = /^\/v1\/vault\/stream\/([^/]+)$/u;
+const SYNC_LEASE_PATH = /^\/v2\/sync\/lease$/u;
+const V2_SESSIONS_PATH = /^\/v2\/sessions$/u;
+const V2_CHANGES_PATH = /^\/v2\/changes$/u;
+const V2_SUMMARY_PATH = /^\/v2\/sessions\/([^/]+)\/summary$/u;
+const V2_BATCHES_PATH = /^\/v2\/sessions\/([^/]+)\/batches$/u;
+const V2_MANIFEST_PATH = /^\/v2\/sessions\/([^/]+)\/manifest$/u;
+const V2_APPEND_PATH = /^\/v2\/sessions\/([^/]+)\/append$/u;
+const V2_DELETE_PATH = /^\/v2\/sessions\/([^/]+)\/delete$/u;
+const DEVICES_PATH = /^\/v2\/devices$/u;
+const DEVICE_PATH = /^\/v2\/devices\/([0-9a-f]+)$/u;
+const BLOB_PATH = /^\/v2\/blobs\/([0-9a-f]{64})$/u;
+const BLOB_BATCH_PATH = /^\/v2\/blobs\/batch$/u;
+const BLOB_BATCH_READ_PATH = /^\/v2\/blobs\/batch\/read$/u;
+const ME_PATH = /^\/v2\/me$/u;
+const VAULT_APPEND_PATH = /^\/v2\/vault\/append$/u;
+const VAULT_LEASE_PATH = /^\/v2\/vault\/lease$/u;
+const VAULT_CURSOR_PATH = /^\/v2\/vault\/cursor$/u;
+const VAULT_STREAM_PATH = /^\/v2\/vault\/stream\/([^/]+)$/u;
 const ADMIN_DEVICE_PATH = /^\/admin\/devices\/([0-9a-f]+)$/u;
 function withBatchFields(value) {
     if (value === null || typeof value !== 'object') return value;
@@ -341,16 +430,28 @@ export function createHttpServer(options) {
                     server: {
                         version,
                         apiVersions: [
-                            1
+                            2
                         ],
                         protocols: [
                             PROTOCOL_VERSION
                         ],
                         schemaVersion: SERVER_SCHEMA_VERSION,
                         capabilities: [
+                            'session-summary',
+                            'changes-cursor',
+                            'conditional-get',
+                            'idempotent-append',
                             'manifest-digest',
-                            'batches'
-                        ]
+                            'batches',
+                            'batch-upload',
+                            'batch-download',
+                            'zstd-frame'
+                        ],
+                        limits: {
+                            batchBytes: MAX_BATCH_BODY_BYTES,
+                            batchBlobs: MAX_BATCH_BLOBS,
+                            blobBytes: maxBlobBytes
+                        }
                     },
                     now: Date.now()
                 });
@@ -358,19 +459,148 @@ export function createHttpServer(options) {
         },
         {
             method: 'GET',
-            path: /^\/v1\/health$/,
-            handler: async (_req, res)=>{
-                json(res, 200, {
+            path: V2_SESSIONS_PATH,
+            handler: async (req, res)=>{
+                requireDevice(db, req);
+                const url = new URL(req.url ?? '/', 'http://localhost');
+                const after = decodeSessionsCursor(url.searchParams.get('cursor'));
+                const limit = intParam(url.searchParams.get('limit'), 200, 1, 1000);
+                const page = listV2Sessions(db, after, limit);
+                return json(res, 200, {
                     ok: true,
-                    version,
-                    protocol: PROTOCOL_VERSION,
-                    now: Date.now()
+                    value: {
+                        sessions: page.sessions,
+                        nextCursor: page.nextSessionId === null ? null : encodeCursor({
+                            v: 2,
+                            after: page.nextSessionId
+                        })
+                    }
+                });
+            }
+        },
+        {
+            method: 'GET',
+            path: V2_CHANGES_PATH,
+            handler: async (req, res)=>{
+                requireDevice(db, req);
+                const url = new URL(req.url ?? '/', 'http://localhost');
+                const cursor = decodeChangesCursor(url.searchParams.get('cursor'));
+                const limit = intParam(url.searchParams.get('limit'), 200, 1, 1000);
+                const page = listV2Changes(db, cursor.revision, cursor.tombstone, limit);
+                return json(res, 200, {
+                    ok: true,
+                    value: {
+                        sessions: page.sessions,
+                        tombstones: page.tombstones,
+                        nextCursor: encodeCursor({
+                            v: 2,
+                            revision: page.nextRevision,
+                            tombstone: page.nextTombstone
+                        }),
+                        hasMore: page.hasMore
+                    }
+                });
+            }
+        },
+        {
+            method: 'GET',
+            path: V2_SUMMARY_PATH,
+            handler: async (req, res)=>{
+                requireDevice(db, req);
+                const id = sessionIdFrom(new URL(req.url ?? '/', 'http://localhost').pathname, V2_SUMMARY_PATH);
+                const summary = getV2SessionSummary(db, id);
+                if (summary === undefined) return json(res, 404, errorBody('not-found', `没有会话 ${id}`));
+                res.setHeader('etag', `"${summary.manifestDigest}"`);
+                if (etagMatches(req.headers['if-none-match'], summary.manifestDigest)) {
+                    res.statusCode = 304;
+                    res.end();
+                    return;
+                }
+                return json(res, 200, {
+                    ok: true,
+                    value: summary
+                });
+            }
+        },
+        {
+            method: 'GET',
+            path: V2_BATCHES_PATH,
+            handler: async (req, res)=>{
+                requireDevice(db, req);
+                const url = new URL(req.url ?? '/', 'http://localhost');
+                const id = sessionIdFrom(url.pathname, V2_BATCHES_PATH);
+                const from = intParam(url.searchParams.get('from'), 0, 0, Number.MAX_SAFE_INTEGER);
+                const limit = intParam(url.searchParams.get('limit'), 500, 1, 1000);
+                const expected = url.searchParams.get('expectedManifestDigest');
+                if (expected !== null && !/^[0-9a-f]{64}$/u.test(expected)) {
+                    throw new SyncError('bad-request', 'expectedManifestDigest 必须是 64 位十六进制');
+                }
+                const page = listV2Batches(db, id, from, limit);
+                if (page === undefined) return json(res, 404, errorBody('not-found', `没有会话 ${id}`));
+                if (expected !== null && expected !== page.manifestDigest) {
+                    throw new SyncError('conflict', 'manifest 已变化，请重新读取摘要');
+                }
+                return json(res, 200, {
+                    ok: true,
+                    value: page
+                });
+            }
+        },
+        {
+            method: 'POST',
+            path: V2_APPEND_PATH,
+            handler: async (req, res)=>{
+                const device = requireDevice(db, req);
+                const clientId = clientIdFrom(req);
+                const idempotencyKey = idempotencyKeyFrom(req);
+                const id = sessionIdFrom(new URL(req.url ?? '/', 'http://localhost').pathname, V2_APPEND_PATH);
+                const body = await readJson(req, MAX_APPEND_BODY_BYTES);
+                const parsed = parseAppend(body);
+                const value = appendFrames(db, options.dataDir, {
+                    sessionId: id,
+                    deviceId: device.deviceId,
+                    clientId,
+                    idempotencyKey,
+                    ...parsed
+                });
+                return json(res, 200, {
+                    ok: true,
+                    value
+                });
+            }
+        },
+        {
+            method: 'GET',
+            path: V2_MANIFEST_PATH,
+            handler: async (req, res)=>{
+                requireDevice(db, req);
+                const id = sessionIdFrom(new URL(req.url ?? '/', 'http://localhost').pathname, V2_MANIFEST_PATH);
+                const found = getManifest(db, id);
+                if (found === undefined) return json(res, 404, errorBody('not-found', `没有会话 ${id}`));
+                return json(res, 200, {
+                    ok: true,
+                    value: withBatchFields(found)
                 });
             }
         },
         {
             method: 'POST',
-            path: /^\/v1\/devices$/,
+            path: V2_DELETE_PATH,
+            handler: async (req, res)=>{
+                const device = requireDevice(db, req);
+                const clientId = clientIdFrom(req);
+                const id = sessionIdFrom(new URL(req.url ?? '/', 'http://localhost').pathname, V2_DELETE_PATH);
+                const body = await readJson(req);
+                if (!Number.isSafeInteger(body.createdAt)) throw new SyncError('bad-request', 'createdAt 必须是整数');
+                return json(res, 200, {
+                    ok: true,
+                    value: deleteSession(db, id, device.deviceId, clientId, Number(body.createdAt))
+                });
+            }
+        },
+        {
+            method: 'POST',
+            path: DEVICES_PATH,
             handler: async (req, res)=>{
                 const auth = authenticate(db, req);
                 if (auth?.role !== 'admin') return json(res, 401, errorBody('unauthorized', '需要 setup token'));
@@ -385,7 +615,7 @@ export function createHttpServer(options) {
         },
         {
             method: 'GET',
-            path: /^\/v1\/devices$/,
+            path: DEVICES_PATH,
             handler: async (req, res)=>{
                 const auth = authenticate(db, req);
                 if (auth?.role !== 'admin') return json(res, 401, errorBody('unauthorized', '需要 setup token'));
@@ -397,11 +627,11 @@ export function createHttpServer(options) {
         },
         {
             method: 'DELETE',
-            path: /^\/v1\/devices\/([0-9a-f]+)$/,
+            path: DEVICE_PATH,
             handler: async (req, res)=>{
                 const auth = authenticate(db, req);
                 if (auth?.role !== 'admin') return json(res, 401, errorBody('unauthorized', '需要 setup token'));
-                const match = /^\/v1\/devices\/([0-9a-f]+)$/.exec(new URL(req.url ?? '/', 'http://localhost').pathname);
+                const match = DEVICE_PATH.exec(new URL(req.url ?? '/', 'http://localhost').pathname);
                 if (match === null) return json(res, 404, errorBody('not-found', '没有这个设备'));
                 const revoked = revokeDevice(db, match[1]);
                 return revoked ? json(res, 200, {
@@ -415,7 +645,107 @@ export function createHttpServer(options) {
         },
         {
             method: 'POST',
-            path: /^\/v1\/blobs$/,
+            path: BLOB_BATCH_PATH,
+            handler: async (req, res)=>{
+                requireDevice(db, req);
+                const body = await readRaw(req, MAX_BATCH_BODY_BYTES);
+                const entries = decodeBlobBatch(body);
+                const results = [];
+                const fresh = new Map();
+                for (const entry of entries){
+                    const actual = createHash('sha256').update(entry.data).digest('hex');
+                    if (actual !== entry.sha256) {
+                        throw new SyncError('bad-request', `批量 blob 的哈希不匹配：${entry.sha256}`);
+                    }
+                    const existing = blobRecord(db, actual);
+                    if (existing !== undefined || fresh.has(actual)) {
+                        results.push({
+                            sha256: actual,
+                            bytes: entry.data.length,
+                            dedup: true
+                        });
+                        continue;
+                    }
+                    fresh.set(actual, {
+                        kind: entry.kind,
+                        data: entry.data
+                    });
+                    results.push({
+                        sha256: actual,
+                        bytes: entry.data.length,
+                        dedup: false
+                    });
+                }
+                const newBytes = [
+                    ...fresh.values()
+                ].reduce((sum, entry)=>sum + entry.data.length, 0);
+                const used = usedBlobBytes(db);
+                const limit = effectiveMaxBytes();
+                if (used + newBytes > limit) {
+                    throw new SyncError('quota', `存储超额：已用 ${used} 字节，本批新增 ${newBytes} 字节，上限 ${limit} 字节`);
+                }
+                for (const [sha256, entry] of fresh){
+                    await putBlob(options.dataDir, entry.data);
+                    recordBlob(db, sha256, entry.data.length, entry.kind);
+                }
+                return json(res, 200, {
+                    ok: true,
+                    value: {
+                        blobs: results
+                    }
+                });
+            }
+        },
+        {
+            method: 'POST',
+            path: BLOB_BATCH_READ_PATH,
+            handler: async (req, res)=>{
+                requireDevice(db, req);
+                const body = await readJson(req);
+                const raw = body.sha256;
+                if (!Array.isArray(raw) || raw.length < 1 || raw.length > MAX_BATCH_BLOBS) {
+                    throw new SyncError('bad-request', `sha256 必须是 1–${MAX_BATCH_BLOBS} 个数组项`);
+                }
+                const hashes = [];
+                for (const value of raw){
+                    if (typeof value !== 'string' || !/^[0-9a-f]{64}$/u.test(value)) {
+                        throw new SyncError('bad-request', 'sha256 必须是 64 位小写十六进制');
+                    }
+                    hashes.push(value);
+                }
+                const kinds = [];
+                for (const sha256 of hashes){
+                    if (!await hasBlob(options.dataDir, sha256)) return json(res, 404, errorBody('not-found', `没有这个 blob：${sha256}`));
+                    const record = blobRecord(db, sha256);
+                    if (record === undefined) return json(res, 404, errorBody('not-found', `没有这个 blob：${sha256}`));
+                    if (record.kind !== 'frame' && record.kind !== 'attachment' && record.kind !== 'vault') {
+                        throw new SyncError('bad-request', `blob 类别非法：${record.kind}`);
+                    }
+                    kinds.push(record.kind);
+                }
+                const blobs = [];
+                for(let index = 0; index < hashes.length; index += 1){
+                    blobs.push({
+                        kind: kinds[index],
+                        data: await readBlob(options.dataDir, hashes[index])
+                    });
+                }
+                let encoded;
+                try {
+                    encoded = encodeBlobBatch(blobs);
+                } catch (error) {
+                    throw new SyncError('bad-request', error instanceof Error ? error.message : String(error));
+                }
+                res.statusCode = 200;
+                res.setHeader('content-type', BLOB_BATCH_CONTENT_TYPE);
+                res.setHeader('content-length', encoded.length);
+                res.setHeader('cache-control', 'no-store');
+                res.end(encoded);
+            }
+        },
+        {
+            method: 'POST',
+            path: /^\/v2\/blobs$/,
             handler: async (req, res)=>{
                 const auth = authenticate(db, req);
                 if (auth === undefined) return json(res, 401, errorBody('unauthorized', '需要设备或 setup token'));
@@ -455,7 +785,7 @@ export function createHttpServer(options) {
         },
         {
             method: 'HEAD',
-            path: /^\/v1\/blobs\/([0-9a-f]{64})$/,
+            path: BLOB_PATH,
             handler: async (req, res)=>{
                 const auth = authenticate(db, req);
                 if (auth === undefined) {
@@ -463,18 +793,18 @@ export function createHttpServer(options) {
                     res.end();
                     return;
                 }
-                const match = /^\/v1\/blobs\/([0-9a-f]{64})$/.exec(new URL(req.url ?? '/', 'http://localhost').pathname);
+                const match = BLOB_PATH.exec(new URL(req.url ?? '/', 'http://localhost').pathname);
                 res.statusCode = match !== null && await hasBlob(options.dataDir, match[1]) ? 200 : 404;
                 res.end();
             }
         },
         {
             method: 'GET',
-            path: /^\/v1\/blobs\/([0-9a-f]{64})$/,
+            path: BLOB_PATH,
             handler: async (req, res)=>{
                 const auth = authenticate(db, req);
                 if (auth === undefined) return json(res, 401, errorBody('unauthorized', '需要设备或 setup token'));
-                const match = /^\/v1\/blobs\/([0-9a-f]{64})$/.exec(new URL(req.url ?? '/', 'http://localhost').pathname);
+                const match = BLOB_PATH.exec(new URL(req.url ?? '/', 'http://localhost').pathname);
                 if (match === null) return json(res, 404, errorBody('not-found', '没有这个 blob'));
                 const sha256 = match[1];
                 if (!await hasBlob(options.dataDir, sha256)) return json(res, 404, errorBody('not-found', '没有这个 blob'));
@@ -511,85 +841,6 @@ export function createHttpServer(options) {
                 });
             }
         },
-        {
-            method: 'POST',
-            path: APPEND_PATH,
-            handler: async (req, res)=>{
-                const device = requireDevice(db, req);
-                const clientId = clientIdFrom(req);
-                const id = sessionIdFrom(new URL(req.url ?? '/', 'http://localhost').pathname, APPEND_PATH);
-                const body = await readJson(req, MAX_APPEND_BODY_BYTES);
-                const parsed = parseAppend(body);
-                const value = appendFrames(db, options.dataDir, {
-                    sessionId: id,
-                    deviceId: device.deviceId,
-                    clientId,
-                    ...parsed
-                });
-                return json(res, 200, {
-                    ok: true,
-                    value: withBatchFields(value)
-                });
-            }
-        },
-        {
-            method: 'POST',
-            path: DELETE_PATH,
-            handler: async (req, res)=>{
-                const device = requireDevice(db, req);
-                const clientId = clientIdFrom(req);
-                const id = sessionIdFrom(new URL(req.url ?? '/', 'http://localhost').pathname, DELETE_PATH);
-                const body = await readJson(req);
-                if (!Number.isSafeInteger(body.createdAt)) throw new SyncError('bad-request', 'createdAt 必须是整数');
-                return json(res, 200, {
-                    ok: true,
-                    value: deleteSession(db, id, device.deviceId, clientId, Number(body.createdAt))
-                });
-            }
-        },
-        {
-            method: 'GET',
-            path: MANIFEST_PATH,
-            handler: async (req, res)=>{
-                requireDevice(db, req);
-                const id = sessionIdFrom(new URL(req.url ?? '/', 'http://localhost').pathname, MANIFEST_PATH);
-                const found = getManifest(db, id);
-                if (found === undefined) return json(res, 404, errorBody('not-found', `没有会话 ${id}`));
-                return json(res, 200, {
-                    ok: true,
-                    value: withBatchFields(found)
-                });
-            }
-        },
-        {
-            method: 'GET',
-            path: BATCHES_PATH,
-            handler: async (req, res)=>{
-                requireDevice(db, req);
-                const url = new URL(req.url ?? '/', 'http://localhost');
-                const id = sessionIdFrom(url.pathname, BATCHES_PATH);
-                const found = listBatches(db, id, intParam(url.searchParams.get('from'), 0, 0, Number.MAX_SAFE_INTEGER), intParam(url.searchParams.get('limit'), 500, 1, 1000));
-                if (found === undefined) return json(res, 404, errorBody('not-found', `没有会话 ${id}`));
-                return json(res, 200, {
-                    ok: true,
-                    value: withBatchFields(found)
-                });
-            }
-        },
-        {
-            method: 'GET',
-            path: CURSOR_PATH,
-            handler: async (req, res)=>{
-                requireDevice(db, req);
-                const url = new URL(req.url ?? '/', 'http://localhost');
-                const since = intParam(url.searchParams.get('since'), 0, 0, Number.MAX_SAFE_INTEGER);
-                const limit = intParam(url.searchParams.get('limit'), 200, 1, 1000);
-                return json(res, 200, {
-                    ok: true,
-                    value: listChanges(db, since, limit)
-                });
-            }
-        },
         {
             method: 'POST',
             path: VAULT_LEASE_PATH,
@@ -937,7 +1188,7 @@ export function createHttpServer(options) {
         },
         {
             method: 'GET',
-            path: /^\/v1\/me$/,
+            path: ME_PATH,
             handler: async (req, res)=>{
                 const auth = authenticate(db, req);
                 if (auth === undefined) return json(res, 401, errorBody('unauthorized', '未知 token'));