vana-cli 0.25.0 → 0.27.0

package/dist/personal-server/local/registration.js

@@ -0,0 +1,81 @@
+import { describeFailure, runSigningExchange, } from "./owner-binding.js";
+export const SERVER_REGISTRATION_INTENT = "personal_server.server_registration.v1";
+const SIGN_PATH = "/api/v1/intents/personal-server-registration/sign";
+/** Account needs the browser: the silent path is closed for this owner or client. */
+export class RegistrationNeedsBrowserError extends Error {
+    code;
+    constructor(code) {
+        super(`Registering needs you to confirm in a browser (${code}). Run without --no-input.`);
+        this.code = code;
+    }
+}
+/** The fields Account signs, from the server's own registration request. */
+export function registrationPayload(request) {
+    const message = request.typedData?.message;
+    const domain = request.typedData?.domain;
+    if (!(message?.serverAddress && message.publicKey && message.serverUrl)) {
+        throw new Error("The server's registration request is incomplete.");
+    }
+    const chainId = Number(domain?.chainId);
+    return {
+        serverAddress: message.serverAddress,
+        serverPublicKey: message.publicKey,
+        serverUrl: message.serverUrl,
+        ...(Number.isInteger(chainId) ? { chainId } : {}),
+        ...(typeof domain?.verifyingContract === "string"
+            ? { verifyingContract: domain.verifyingContract }
+            : {}),
+    };
+}
+/**
+ * Have Account sign the server's registration as its owner. Account signs
+ * silently when the owner's wallet lives in Account and the trust token from
+ * the owner confirmation is valid, as it does for Desktop; otherwise the
+ * person confirms in the browser.
+ */
+export async function signServerRegistration(input, deps) {
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    const account = input.accountUrl.replace(/\/+$/, "");
+    const payload = registrationPayload(input.request);
+    const response = await fetchImpl(`${account}${SIGN_PATH}`, {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            authorization: `Bearer ${input.accessToken}`,
+            ...(input.trustToken
+                ? { "x-vana-desktop-trust-token": input.trustToken }
+                : {}),
+        },
+        body: JSON.stringify({ intent: SERVER_REGISTRATION_INTENT, ...payload }),
+    });
+    if (!response.ok) {
+        throw new Error(await describeFailure("sign the registration", response));
+    }
+    const body = (await response.json());
+    if (body.status === "signed" && body.signature) {
+        return {
+            signature: body.signature,
+            signerAddress: body.signerAddress ?? null,
+            via: "silent",
+        };
+    }
+    if (body.status !== "confirmation_required") {
+        throw new Error(`Account did not sign the registration (${body.code ?? body.status ?? "unknown"}).`);
+    }
+    if (!input.allowBrowser) {
+        throw new RegistrationNeedsBrowserError(body.code ?? "confirmation_required");
+    }
+    const redeemed = await runSigningExchange({
+        accountUrl: input.accountUrl,
+        accessToken: input.accessToken,
+        intent: SERVER_REGISTRATION_INTENT,
+        payload,
+        step: "registration",
+    }, deps);
+    return {
+        signature: redeemed.signature,
+        signerAddress: redeemed.signerAddress ?? null,
+        via: "browser",
+    };
+}
+//# sourceMappingURL=registration.js.map

package/dist/personal-server/local/registration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registration.js","sourceRoot":"","sources":["../../../src/personal-server/local/registration.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,kBAAkB,GAEnB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,CAAC,MAAM,0BAA0B,GACrC,wCAAwC,CAAC;AAC3C,MAAM,SAAS,GAAG,mDAAmD,CAAC;AActE,qFAAqF;AACrF,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IACjC;IAArB,YAAqB,IAAY;QAC/B,KAAK,CACH,kDAAkD,IAAI,4BAA4B,CACnF,CAAC;QAHiB,SAAI,GAAJ,IAAI,CAAQ;IAIjC,CAAC;CACF;AAQD,4EAA4E;AAC5E,MAAM,UAAU,mBAAmB,CACjC,OAA4B;IAE5B,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC;IACzC,IAAI,CAAC,CAAC,OAAO,EAAE,aAAa,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,OAAO;QACL,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,eAAe,EAAE,OAAO,CAAC,SAAS;QAClC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,OAAO,MAAM,EAAE,iBAAiB,KAAK,QAAQ;YAC/C,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE;YACjD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAMC,EACD,IAAsB;IAEtB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAEnD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,OAAO,GAAG,SAAS,EAAE,EAAE;QACzD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,UAAU,KAAK,CAAC,WAAW,EAAE;YAC5C,GAAG,CAAC,KAAK,CAAC,UAAU;gBAClB,CAAC,CAAC,EAAE,4BAA4B,EAAE,KAAK,CAAC,UAAU,EAAE;gBACpD,CAAC,CAAC,EAAE,CAAC;SACR;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE,GAAG,OAAO,EAAE,CAAC;KACzE,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,MAAM,eAAe,CAAC,uBAAuB,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAKlC,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/C,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,IAAI;YACzC,GAAG,EAAE,QAAQ;SACd,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,uBAAuB,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,0CAA0C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,IAAI,SAAS,IAAI,CACpF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QACxB,MAAM,IAAI,6BAA6B,CACrC,IAAI,CAAC,IAAI,IAAI,uBAAuB,CACrC,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CACvC;QACE,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM,EAAE,0BAA0B;QAClC,OAAO;QACP,IAAI,EAAE,cAAc;KACrB,EACD,IAAI,CACL,CAAC;IACF,OAAO;QACL,SAAS,EAAE,QAAQ,CAAC,SAAmB;QACvC,aAAa,EAAE,QAAQ,CAAC,aAAa,IAAI,IAAI;QAC7C,GAAG,EAAE,SAAS;KACf,CAAC;AACJ,CAAC"}

package/dist/personal-server/local/runtime-pkg/entry.mjs

@@ -0,0 +1,271 @@
+// The Personal Server process `vana server start` runs, modeled on Vana
+// Desktop's sidecar (apps/desktop/personal-server/index.js in unity-surfaces).
+//
+// The first JSON line on stdin is its configuration, so the owner signature
+// never appears in the process list or environment:
+//   { rootPath, port, ownerSignature, ownerAddress, network: { gatewayUrl, chainId,
+//     contracts, storageApiUrl }, tunnel: { binaryPath, serverAddr, serverPort } | null }
+// Later lines are commands from the CLI, which holds the Account session:
+//   { type: "prepare-registration" } -> registration-request
+//   { type: "submit-registration", signature } -> registration-submitted
+// It writes one JSON object per line on stdout: ready, public, tunnel,
+// registration-request, registration-submitted, command-failed, error,
+// stopped. Logs go to stderr.
+
+import { readFile, rename, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import readline from "node:readline";
+
+import {
+  loadConfig,
+  startPersonalServer,
+} from "@opendatalabs/personal-server-ts/node";
+
+const send = (message) => process.stdout.write(`${JSON.stringify(message)}\n`);
+
+function isPlainObject(value) {
+  return (
+    typeof value === "object" &&
+    value !== null &&
+    !Array.isArray(value) &&
+    Object.getPrototypeOf(value) !== null
+  );
+}
+
+// Derived leaves win and every other persisted key survives, as in Desktop's
+// applyDerivedServerConfig.
+function applyDerived(persisted, derived) {
+  if (!isPlainObject(persisted)) return structuredClone(derived);
+  const merged = { ...persisted };
+  for (const [key, value] of Object.entries(derived)) {
+    merged[key] =
+      isPlainObject(value) && isPlainObject(merged[key])
+        ? applyDerived(merged[key], value)
+        : structuredClone(value);
+  }
+  return merged;
+}
+
+// Everything that follows from the network and the tunnel client. Without a
+// tunnel client the server is local only: nothing outside can reach it, so
+// it is never registered and has nothing to sync. With one, the server
+// reserves its public URL but dials the relay only once registered, and sync
+// waits for registration too.
+function derivedConfig(network, tunnel) {
+  return {
+    devUi: { enabled: true },
+    gateway: {
+      url: network.gatewayUrl,
+      chainId: network.chainId,
+      contracts: network.contracts,
+    },
+    inference: {
+      baseUrl: `${network.gatewayUrl.replace(/\/+$/, "")}/v1/inference`,
+    },
+    logging: { level: "info", pretty: false },
+    storage: {
+      backend: "vana",
+      config: { vana: { apiUrl: network.storageApiUrl } },
+    },
+    sync: { enabled: Boolean(tunnel) },
+    tunnel: tunnel
+      ? {
+          enabled: true,
+          serverAddr: tunnel.serverAddr,
+          serverPort: tunnel.serverPort,
+          binaryPath: tunnel.binaryPath,
+        }
+      : { enabled: false },
+  };
+}
+
+const lines = readline
+  .createInterface({ input: process.stdin })
+  [Symbol.asyncIterator]();
+
+async function readInput() {
+  for (;;) {
+    const { value, done } = await lines.next();
+    if (done) throw new Error("No configuration on stdin.");
+    if (value.trim()) return JSON.parse(value);
+  }
+}
+
+let ps = null;
+
+// Only a tunnel URL may be registered: without one the server offers its
+// localhost origin, which no app could ever reach.
+function publicState(info) {
+  const tunnel = info.details?.tunnel ?? null;
+  return {
+    registered: Boolean(info.registration?.registered),
+    serverAddress: info.server?.address ?? null,
+    serverUrl: info.urls?.public ?? null,
+    tunnel: tunnel
+      ? {
+          status: tunnel.status ?? null,
+          routable: tunnel.routable !== false,
+          warning: tunnel.warning ?? null,
+        }
+      : null,
+  };
+}
+
+let watching = false;
+
+// The server dials the relay on its own once it sees the registration (it
+// polls the gateway); report when the public URL answers, as Desktop does.
+async function watchTunnel() {
+  if (watching) return;
+  watching = true;
+  const started = Date.now();
+  let last = null;
+  while (Date.now() - started < 10 * 60_000) {
+    try {
+      last = publicState(await ps.info());
+      if (last.tunnel?.status === "connected" && last.tunnel.routable) {
+        send({ type: "tunnel", status: "connected", url: last.serverUrl });
+        return;
+      }
+    } catch (error) {
+      process.stderr.write(`[entry] tunnel check failed: ${error}\n`);
+    }
+    await new Promise((resolve) => setTimeout(resolve, 3_000));
+  }
+  send({
+    type: "tunnel",
+    status: last?.tunnel?.status ?? "unknown",
+    url: last?.serverUrl ?? null,
+    warning: last?.tunnel?.warning ?? "The tunnel did not connect in time.",
+  });
+}
+
+// Typed data can carry bigints, which JSON.stringify refuses.
+const plain = (value) =>
+  JSON.parse(
+    JSON.stringify(value, (_key, item) =>
+      typeof item === "bigint" ? item.toString() : item,
+    ),
+  );
+
+async function handleCommands() {
+  for (;;) {
+    const { value, done } = await lines.next();
+    if (done) return;
+    if (!value.trim()) continue;
+    let command;
+    try {
+      command = JSON.parse(value);
+    } catch {
+      continue;
+    }
+    try {
+      if (command.type === "prepare-registration") {
+        const { serverUrl } = publicState(await ps.info());
+        if (!serverUrl) throw new Error("The server has no public URL.");
+        const request = await ps.prepareRegistration({ serverUrl });
+        send({
+          type: "registration-request",
+          request: { typedData: plain(request.typedData) },
+        });
+      } else if (command.type === "submit-registration") {
+        const result = await ps.submitRegistration({
+          signature: command.signature,
+        });
+        send({
+          type: "registration-submitted",
+          serverId: result?.serverId ?? null,
+          alreadyRegistered: Boolean(result?.alreadyRegistered),
+        });
+        void watchTunnel();
+      }
+    } catch (error) {
+      send({
+        type: "command-failed",
+        command: command.type,
+        message: error instanceof Error ? error.message : String(error),
+      });
+    }
+  }
+}
+
+async function main() {
+  const input = await readInput();
+  const { rootPath, port, ownerSignature, ownerAddress, network, tunnel } =
+    input;
+  const configPath = join(rootPath, "server.json");
+  const derived = derivedConfig(network, tunnel ?? null);
+
+  // Persist the derived block the way Desktop does, so a network change can
+  // never leave an old gateway or storage host behind in server.json.
+  let persisted = null;
+  try {
+    persisted = JSON.parse(await readFile(configPath, "utf8"));
+  } catch {
+    persisted = null;
+  }
+  const next = applyDerived(persisted, derived);
+  const temporary = `${configPath}.${process.pid}.tmp`;
+  await writeFile(temporary, `${JSON.stringify(next, null, 2)}\n`, {
+    mode: 0o600,
+  });
+  await rename(temporary, configPath);
+
+  // configDefaults merges shallowly for some sections, so hand back whole
+  // sections from the schema-complete loaded config.
+  const loaded = await loadConfig({ configPath, rootPath });
+  const configDefaults = {
+    server: {
+      ...loaded.server,
+      port,
+      ...(ownerAddress ? { address: ownerAddress } : {}),
+    },
+  };
+  for (const key of Object.keys(derived)) {
+    configDefaults[key] = applyDerived(loaded[key], derived[key]);
+  }
+
+  ps = await startPersonalServer({
+    configPath,
+    rootPath,
+    port,
+    ownerSignature,
+    mcpOAuthApprovalUrl: "vana://mcp-authorization",
+    configDefaults,
+    onStatus: (status) => process.stderr.write(`[status] ${status}\n`),
+  });
+  const info = await ps.ready();
+  send({
+    type: "ready",
+    port,
+    url: info.urls?.local ?? `http://localhost:${port}`,
+  });
+  void handleCommands();
+  if (!tunnel) return;
+
+  // Waits for the gateway registration check and the tunnel URL reservation.
+  const state = publicState(await ps.ready({ publicUrl: true }));
+  send({ type: "public", ...state });
+  if (state.registered) void watchTunnel();
+}
+
+async function shutdown(signal) {
+  process.stderr.write(`[entry] ${signal}, stopping\n`);
+  try {
+    await ps?.stop();
+  } finally {
+    send({ type: "stopped" });
+    process.exit(0);
+  }
+}
+
+process.on("SIGINT", () => void shutdown("SIGINT"));
+process.on("SIGTERM", () => void shutdown("SIGTERM"));
+
+main().catch((error) => {
+  send({
+    type: "error",
+    message: error instanceof Error ? error.message : String(error),
+  });
+  process.exit(1);
+});