vana-cli 0.26.0 → 0.27.0

package/dist/personal-server/local/owner-binding.d.ts

@@ -21,13 +21,33 @@ export interface OwnerBindingDeps {
     onConfirmationUrl?: (url: string) => void;
     timeoutMs?: number;
 }
+/** What Account returns when an exchange is redeemed. */
+export interface RedeemedExchange {
+    status?: string;
+    signature?: string;
+    signerAddress?: string;
+    desktopSigningTrustToken?: string;
+    typedData?: unknown;
+}
+/**
+ * Run one Account signing exchange: the person confirms in the browser, and
+ * the result comes back to a one-time loopback listener, bound to this
+ * process by state and PKCE. `step` names the request in error messages.
+ */
+export declare function runSigningExchange(input: {
+    accountUrl: string;
+    accessToken: string;
+    intent: string;
+    payload?: Record<string, unknown>;
+    step: string;
+}, deps: OwnerBindingDeps): Promise<RedeemedExchange>;
 /**
  * Get the owner-binding signature through Account's signing exchange: Account
- * never signs silently for the CLI, so the person confirms in the browser,
- * and the result comes back to a one-time loopback listener.
+ * never signs it silently for the CLI, so the person confirms in the browser.
  */
 export declare function runOwnerBindingExchange(input: {
     accountUrl: string;
     accessToken: string;
 }, deps: OwnerBindingDeps): Promise<OwnerBinding>;
+export declare function describeFailure(step: string, response: Response): Promise<string>;
 //# sourceMappingURL=owner-binding.d.ts.map

package/dist/personal-server/local/owner-binding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"owner-binding.d.ts","sourceRoot":"","sources":["../../../src/personal-server/local/owner-binding.ts"],"names":[],"mappings":"AAIA;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,uBAAuB,CAAC;AAC1D,eAAO,MAAM,oBAAoB,qCAAqC,CAAC;AAEvE,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,yEAAyE;IACzE,iBAAiB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAmED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,EAClD,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,YAAY,CAAC,CA6FvB"}
+{"version":3,"file":"owner-binding.d.ts","sourceRoot":"","sources":["../../../src/personal-server/local/owner-binding.ts"],"names":[],"mappings":"AAIA;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,uBAAuB,CAAC;AAC1D,eAAO,MAAM,oBAAoB,qCAAqC,CAAC;AAEvE,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,yEAAyE;IACzE,iBAAiB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAmED,yDAAyD;AACzD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE;IACL,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,IAAI,EAAE,MAAM,CAAC;CACd,EACD,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,gBAAgB,CAAC,CAqF3B;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,EAClD,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,YAAY,CAAC,CAUvB;AAED,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,MAAM,CAAC,CAkBjB"}

package/dist/personal-server/local/owner-binding.js

@@ -58,11 +58,11 @@ async function startLoopbackCallback(expectedState) {
     };
 }
 /**
- * Get the owner-binding signature through Account's signing exchange: Account
- * never signs silently for the CLI, so the person confirms in the browser,
- * and the result comes back to a one-time loopback listener.
+ * Run one Account signing exchange: the person confirms in the browser, and
+ * the result comes back to a one-time loopback listener, bound to this
+ * process by state and PKCE. `step` names the request in error messages.
  */
-export async function runOwnerBindingExchange(input, deps) {
+export async function runSigningExchange(input, deps) {
     const fetchImpl = deps.fetchImpl ?? fetch;
     const account = input.accountUrl.replace(/\/+$/, "");
     const state = base64url(crypto.randomBytes(32));
@@ -77,7 +77,8 @@ export async function runOwnerBindingExchange(input, deps) {
                 authorization: `Bearer ${input.accessToken}`,
             },
             body: JSON.stringify({
-                intent: OWNER_BINDING_INTENT,
+                intent: input.intent,
+                ...(input.payload ? { payload: input.payload } : {}),
                 redirectUri: callback.redirectUri,
                 state,
                 codeChallenge,
@@ -85,7 +86,7 @@ export async function runOwnerBindingExchange(input, deps) {
             }),
         });
         if (!created.ok) {
-            throw new Error(await describeFailure("start the owner confirmation", created));
+            throw new Error(await describeFailure(`start the ${input.step}`, created));
         }
         const { confirmationUrl } = (await created.json());
         if (!confirmationUrl) {
@@ -118,23 +119,31 @@ export async function runOwnerBindingExchange(input, deps) {
             }),
         });
         if (!redeemed.ok) {
-            throw new Error(await describeFailure("finish the owner confirmation", redeemed));
+            throw new Error(await describeFailure(`finish the ${input.step}`, redeemed));
         }
         const body = (await redeemed.json());
         if (body.status !== "signed" || !body.signature || !body.signerAddress) {
-            throw new Error("Account answered the owner confirmation without a signature.");
+            throw new Error(`Account answered the ${input.step} without a signature.`);
         }
-        return {
-            signature: body.signature,
-            signerAddress: body.signerAddress,
-            trustToken: body.desktopSigningTrustToken ?? null,
-        };
+        return body;
     }
     finally {
         callback.close();
     }
 }
-async function describeFailure(step, response) {
+/**
+ * Get the owner-binding signature through Account's signing exchange: Account
+ * never signs it silently for the CLI, so the person confirms in the browser.
+ */
+export async function runOwnerBindingExchange(input, deps) {
+    const body = await runSigningExchange({ ...input, intent: OWNER_BINDING_INTENT, step: "owner confirmation" }, deps);
+    return {
+        signature: body.signature,
+        signerAddress: body.signerAddress,
+        trustToken: body.desktopSigningTrustToken ?? null,
+    };
+}
+export async function describeFailure(step, response) {
     let code = "";
     try {
         const body = (await response.json());

package/dist/personal-server/local/owner-binding.js.map

@@ -1 +1 @@
-{"version":3,"file":"owner-binding.js","sourceRoot":"","sources":["../../../src/personal-server/local/owner-binding.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,oBAAoB,CAAC;AAC1D,MAAM,CAAC,MAAM,oBAAoB,GAAG,kCAAkC,CAAC;AAoBvE,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzC,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,SAAS,GAAG;8HAC4G,CAAC;AAC/H,MAAM,WAAW,GAAG;4HACwG,CAAC;AAE7H;;;;GAIG;AACH,KAAK,UAAU,qBAAqB,CAAC,aAAqB;IAKxD,IAAI,MAAM,GAGC,IAAI,CAAC;IAChB,MAAM,IAAI,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnD,MAAM,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC/B,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QACrD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAC5D,IAAI,GAAG,CAAC,QAAQ,KAAK,mBAAmB,EAAE,CAAC;YACzC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;YAC5B,gDAAgD;YAChD,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC1E,OAAO;QACT,CAAC;QACD,IAAI,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACvB,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC1E,MAAM,EAAE,MAAM,CACZ,IAAI,KAAK,CACP,KAAK,KAAK,eAAe;gBACvB,CAAC,CAAC,0CAA0C;gBAC5C,CAAC,CAAC,oBAAoB,KAAK,IAAI,SAAS,GAAG,CAC9C,CACF,CAAC;YACF,OAAO;QACT,CAAC;QACD,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACxE,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7E,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;IACjD,OAAO;QACL,WAAW,EAAE,oBAAoB,IAAI,mBAAmB;QACxD,IAAI;QACJ,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE;KAC5B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAkD,EAClD,IAAsB;IAEtB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAChD,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IACvD,MAAM,aAAa,GAAG,SAAS,CAC7B,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAC1D,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAEpD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,OAAO,2BAA2B,EAAE;YACrE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,KAAK,CAAC,WAAW,EAAE;aAC7C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,MAAM,EAAE,oBAAoB;gBAC5B,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,KAAK;gBACL,aAAa;gBACb,mBAAmB,EAAE,MAAM;aAC5B,CAAC;SACH,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,MAAM,eAAe,CAAC,8BAA8B,EAAE,OAAO,CAAC,CAC/D,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,eAAe,EAAE,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAEhD,CAAC;QACF,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,CAAC,iBAAiB,EAAE,CAAC,eAAe,CAAC,CAAC;QAC1C,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;QAElC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;QACvD,IAAI,KAAK,GAA0B,IAAI,CAAC;QACxC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAC9B,QAAQ,CAAC,IAAI;YACb,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBAC/B,KAAK,GAAG,UAAU,CAChB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC,EACnE,SAAS,CACV,CAAC;YACJ,CAAC,CAAC;SACH,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACd,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAC9B,GAAG,OAAO,kCAAkC,EAC5C;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,KAAK,CAAC,WAAW,EAAE;aAC7C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,IAAI;gBACJ,KAAK;gBACL,YAAY;gBACZ,WAAW,EAAE,QAAQ,CAAC,WAAW;aAClC,CAAC;SACH,CACF,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,MAAM,eAAe,CAAC,+BAA+B,EAAE,QAAQ,CAAC,CACjE,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAKlC,CAAC;QACF,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAC;QACJ,CAAC;QACD,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,UAAU,EAAE,IAAI,CAAC,wBAAwB,IAAI,IAAI;SAClD,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,IAAY,EACZ,QAAkB;IAElB,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkC,CAAC;QACtE,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO,aAAa,IAAI,8DAA8D,CAAC;IACzF,CAAC;IACD,IACE,IAAI,KAAK,oBAAoB;QAC7B,IAAI,KAAK,+BAA+B,EACxC,CAAC;QACD,OAAO,aAAa,IAAI,uEAAuE,IAAI,IAAI,CAAC;IAC1G,CAAC;IACD,OAAO,aAAa,IAAI,UAAU,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;AAClF,CAAC"}
+{"version":3,"file":"owner-binding.js","sourceRoot":"","sources":["../../../src/personal-server/local/owner-binding.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,oBAAoB,CAAC;AAC1D,MAAM,CAAC,MAAM,oBAAoB,GAAG,kCAAkC,CAAC;AAoBvE,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzC,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,SAAS,GAAG;8HAC4G,CAAC;AAC/H,MAAM,WAAW,GAAG;4HACwG,CAAC;AAE7H;;;;GAIG;AACH,KAAK,UAAU,qBAAqB,CAAC,aAAqB;IAKxD,IAAI,MAAM,GAGC,IAAI,CAAC;IAChB,MAAM,IAAI,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnD,MAAM,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC/B,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QACrD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAC5D,IAAI,GAAG,CAAC,QAAQ,KAAK,mBAAmB,EAAE,CAAC;YACzC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;YAC5B,gDAAgD;YAChD,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC1E,OAAO;QACT,CAAC;QACD,IAAI,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACvB,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC1E,MAAM,EAAE,MAAM,CACZ,IAAI,KAAK,CACP,KAAK,KAAK,eAAe;gBACvB,CAAC,CAAC,0CAA0C;gBAC5C,CAAC,CAAC,oBAAoB,KAAK,IAAI,SAAS,GAAG,CAC9C,CACF,CAAC;YACF,OAAO;QACT,CAAC;QACD,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACxE,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7E,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;IACjD,OAAO;QACL,WAAW,EAAE,oBAAoB,IAAI,mBAAmB;QACxD,IAAI;QACJ,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE;KAC5B,CAAC;AACJ,CAAC;AAWD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAMC,EACD,IAAsB;IAEtB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAChD,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IACvD,MAAM,aAAa,GAAG,SAAS,CAC7B,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAC1D,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAEpD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,OAAO,2BAA2B,EAAE;YACrE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,KAAK,CAAC,WAAW,EAAE;aAC7C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpD,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,KAAK;gBACL,aAAa;gBACb,mBAAmB,EAAE,MAAM;aAC5B,CAAC;SACH,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,MAAM,eAAe,CAAC,aAAa,KAAK,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,CAC1D,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,eAAe,EAAE,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAEhD,CAAC;QACF,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,CAAC,iBAAiB,EAAE,CAAC,eAAe,CAAC,CAAC;QAC1C,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;QAElC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;QACvD,IAAI,KAAK,GAA0B,IAAI,CAAC;QACxC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAC9B,QAAQ,CAAC,IAAI;YACb,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBAC/B,KAAK,GAAG,UAAU,CAChB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC,EACnE,SAAS,CACV,CAAC;YACJ,CAAC,CAAC;SACH,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACd,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAC9B,GAAG,OAAO,kCAAkC,EAC5C;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,KAAK,CAAC,WAAW,EAAE;aAC7C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,IAAI;gBACJ,KAAK;gBACL,YAAY;gBACZ,WAAW,EAAE,QAAQ,CAAC,WAAW;aAClC,CAAC;SACH,CACF,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,MAAM,eAAe,CAAC,cAAc,KAAK,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAC5D,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAqB,CAAC;QACzD,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CACb,wBAAwB,KAAK,CAAC,IAAI,uBAAuB,CAC1D,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAkD,EAClD,IAAsB;IAEtB,MAAM,IAAI,GAAG,MAAM,kBAAkB,CACnC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,IAAI,EAAE,oBAAoB,EAAE,EACtE,IAAI,CACL,CAAC;IACF,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,SAAmB;QACnC,aAAa,EAAE,IAAI,CAAC,aAAuB;QAC3C,UAAU,EAAE,IAAI,CAAC,wBAAwB,IAAI,IAAI;KAClD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAY,EACZ,QAAkB;IAElB,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkC,CAAC;QACtE,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO,aAAa,IAAI,8DAA8D,CAAC;IACzF,CAAC;IACD,IACE,IAAI,KAAK,oBAAoB;QAC7B,IAAI,KAAK,+BAA+B,EACxC,CAAC;QACD,OAAO,aAAa,IAAI,uEAAuE,IAAI,IAAI,CAAC;IAC1G,CAAC;IACD,OAAO,aAAa,IAAI,UAAU,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;AAClF,CAAC"}

package/dist/personal-server/local/registration.d.ts

@@ -0,0 +1,42 @@
+import { type OwnerBindingDeps } from "./owner-binding.js";
+export declare const SERVER_REGISTRATION_INTENT = "personal_server.server_registration.v1";
+/** What the server's prepareRegistration() returns; the CLI only reads the typed data. */
+export interface RegistrationRequest {
+    typedData: {
+        domain?: {
+            chainId?: number | string;
+            verifyingContract?: string;
+        };
+        message?: {
+            serverAddress?: string;
+            publicKey?: string;
+            serverUrl?: string;
+        };
+    };
+}
+/** Account needs the browser: the silent path is closed for this owner or client. */
+export declare class RegistrationNeedsBrowserError extends Error {
+    readonly code: string;
+    constructor(code: string);
+}
+export interface RegistrationSignature {
+    signature: string;
+    signerAddress: string | null;
+    via: "silent" | "browser";
+}
+/** The fields Account signs, from the server's own registration request. */
+export declare function registrationPayload(request: RegistrationRequest): Record<string, unknown>;
+/**
+ * Have Account sign the server's registration as its owner. Account signs
+ * silently when the owner's wallet lives in Account and the trust token from
+ * the owner confirmation is valid, as it does for Desktop; otherwise the
+ * person confirms in the browser.
+ */
+export declare function signServerRegistration(input: {
+    accountUrl: string;
+    accessToken: string;
+    trustToken: string | null;
+    request: RegistrationRequest;
+    allowBrowser: boolean;
+}, deps: OwnerBindingDeps): Promise<RegistrationSignature>;
+//# sourceMappingURL=registration.d.ts.map

package/dist/personal-server/local/registration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registration.d.ts","sourceRoot":"","sources":["../../../src/personal-server/local/registration.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,oBAAoB,CAAC;AAE5B,eAAO,MAAM,0BAA0B,2CACG,CAAC;AAG3C,0FAA0F;AAC1F,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE;QACT,MAAM,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;YAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACnE,OAAO,CAAC,EAAE;YACR,aAAa,CAAC,EAAE,MAAM,CAAC;YACvB,SAAS,CAAC,EAAE,MAAM,CAAC;YACnB,SAAS,CAAC,EAAE,MAAM,CAAC;SACpB,CAAC;KACH,CAAC;CACH;AAED,qFAAqF;AACrF,qBAAa,6BAA8B,SAAQ,KAAK;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM;gBAAZ,IAAI,EAAE,MAAM;CAKlC;AAED,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,GAAG,EAAE,QAAQ,GAAG,SAAS,CAAC;CAC3B;AAED,4EAA4E;AAC5E,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,mBAAmB,GAC3B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgBzB;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE;IACL,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,mBAAmB,CAAC;IAC7B,YAAY,EAAE,OAAO,CAAC;CACvB,EACD,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,qBAAqB,CAAC,CAyDhC"}

package/dist/personal-server/local/registration.js

@@ -0,0 +1,81 @@
+import { describeFailure, runSigningExchange, } from "./owner-binding.js";
+export const SERVER_REGISTRATION_INTENT = "personal_server.server_registration.v1";
+const SIGN_PATH = "/api/v1/intents/personal-server-registration/sign";
+/** Account needs the browser: the silent path is closed for this owner or client. */
+export class RegistrationNeedsBrowserError extends Error {
+    code;
+    constructor(code) {
+        super(`Registering needs you to confirm in a browser (${code}). Run without --no-input.`);
+        this.code = code;
+    }
+}
+/** The fields Account signs, from the server's own registration request. */
+export function registrationPayload(request) {
+    const message = request.typedData?.message;
+    const domain = request.typedData?.domain;
+    if (!(message?.serverAddress && message.publicKey && message.serverUrl)) {
+        throw new Error("The server's registration request is incomplete.");
+    }
+    const chainId = Number(domain?.chainId);
+    return {
+        serverAddress: message.serverAddress,
+        serverPublicKey: message.publicKey,
+        serverUrl: message.serverUrl,
+        ...(Number.isInteger(chainId) ? { chainId } : {}),
+        ...(typeof domain?.verifyingContract === "string"
+            ? { verifyingContract: domain.verifyingContract }
+            : {}),
+    };
+}
+/**
+ * Have Account sign the server's registration as its owner. Account signs
+ * silently when the owner's wallet lives in Account and the trust token from
+ * the owner confirmation is valid, as it does for Desktop; otherwise the
+ * person confirms in the browser.
+ */
+export async function signServerRegistration(input, deps) {
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    const account = input.accountUrl.replace(/\/+$/, "");
+    const payload = registrationPayload(input.request);
+    const response = await fetchImpl(`${account}${SIGN_PATH}`, {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            authorization: `Bearer ${input.accessToken}`,
+            ...(input.trustToken
+                ? { "x-vana-desktop-trust-token": input.trustToken }
+                : {}),
+        },
+        body: JSON.stringify({ intent: SERVER_REGISTRATION_INTENT, ...payload }),
+    });
+    if (!response.ok) {
+        throw new Error(await describeFailure("sign the registration", response));
+    }
+    const body = (await response.json());
+    if (body.status === "signed" && body.signature) {
+        return {
+            signature: body.signature,
+            signerAddress: body.signerAddress ?? null,
+            via: "silent",
+        };
+    }
+    if (body.status !== "confirmation_required") {
+        throw new Error(`Account did not sign the registration (${body.code ?? body.status ?? "unknown"}).`);
+    }
+    if (!input.allowBrowser) {
+        throw new RegistrationNeedsBrowserError(body.code ?? "confirmation_required");
+    }
+    const redeemed = await runSigningExchange({
+        accountUrl: input.accountUrl,
+        accessToken: input.accessToken,
+        intent: SERVER_REGISTRATION_INTENT,
+        payload,
+        step: "registration",
+    }, deps);
+    return {
+        signature: redeemed.signature,
+        signerAddress: redeemed.signerAddress ?? null,
+        via: "browser",
+    };
+}
+//# sourceMappingURL=registration.js.map

package/dist/personal-server/local/registration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registration.js","sourceRoot":"","sources":["../../../src/personal-server/local/registration.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,kBAAkB,GAEnB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,CAAC,MAAM,0BAA0B,GACrC,wCAAwC,CAAC;AAC3C,MAAM,SAAS,GAAG,mDAAmD,CAAC;AActE,qFAAqF;AACrF,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IACjC;IAArB,YAAqB,IAAY;QAC/B,KAAK,CACH,kDAAkD,IAAI,4BAA4B,CACnF,CAAC;QAHiB,SAAI,GAAJ,IAAI,CAAQ;IAIjC,CAAC;CACF;AAQD,4EAA4E;AAC5E,MAAM,UAAU,mBAAmB,CACjC,OAA4B;IAE5B,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC;IACzC,IAAI,CAAC,CAAC,OAAO,EAAE,aAAa,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,OAAO;QACL,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,eAAe,EAAE,OAAO,CAAC,SAAS;QAClC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,OAAO,MAAM,EAAE,iBAAiB,KAAK,QAAQ;YAC/C,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE;YACjD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAMC,EACD,IAAsB;IAEtB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAEnD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,OAAO,GAAG,SAAS,EAAE,EAAE;QACzD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,UAAU,KAAK,CAAC,WAAW,EAAE;YAC5C,GAAG,CAAC,KAAK,CAAC,UAAU;gBAClB,CAAC,CAAC,EAAE,4BAA4B,EAAE,KAAK,CAAC,UAAU,EAAE;gBACpD,CAAC,CAAC,EAAE,CAAC;SACR;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE,GAAG,OAAO,EAAE,CAAC;KACzE,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,MAAM,eAAe,CAAC,uBAAuB,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAKlC,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/C,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,IAAI;YACzC,GAAG,EAAE,QAAQ;SACd,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,uBAAuB,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,0CAA0C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,IAAI,SAAS,IAAI,CACpF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QACxB,MAAM,IAAI,6BAA6B,CACrC,IAAI,CAAC,IAAI,IAAI,uBAAuB,CACrC,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CACvC;QACE,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM,EAAE,0BAA0B;QAClC,OAAO;QACP,IAAI,EAAE,cAAc;KACrB,EACD,IAAI,CACL,CAAC;IACF,OAAO;QACL,SAAS,EAAE,QAAQ,CAAC,SAAmB;QACvC,aAAa,EAAE,QAAQ,CAAC,aAAa,IAAI,IAAI;QAC7C,GAAG,EAAE,SAAS;KACf,CAAC;AACJ,CAAC"}

package/dist/personal-server/local/runtime-pkg/entry.mjs

@@ -1,12 +1,16 @@
 // The Personal Server process `vana server start` runs, modeled on Vana
 // Desktop's sidecar (apps/desktop/personal-server/index.js in unity-surfaces).
 //
-// It reads one JSON line on stdin, so the owner signature never appears in the
-// process list or environment:
+// The first JSON line on stdin is its configuration, so the owner signature
+// never appears in the process list or environment:
 //   { rootPath, port, ownerSignature, ownerAddress, network: { gatewayUrl, chainId,
-//     contracts, storageApiUrl } }
-// and writes one JSON object per line on stdout: ready, error, stopped.
-// Logs go to stderr.
+//     contracts, storageApiUrl }, tunnel: { binaryPath, serverAddr, serverPort } | null }
+// Later lines are commands from the CLI, which holds the Account session:
+//   { type: "prepare-registration" } -> registration-request
+//   { type: "submit-registration", signature } -> registration-submitted
+// It writes one JSON object per line on stdout: ready, public, tunnel,
+// registration-request, registration-submitted, command-failed, error,
+// stopped. Logs go to stderr.
 
 import { readFile, rename, writeFile } from "node:fs/promises";
 import { join } from "node:path";
@@ -42,10 +46,12 @@ function applyDerived(persisted, derived) {
   return merged;
 }
 
-// Everything that follows from the network. Local only for now: no tunnel,
-// so nothing is reachable from outside and nothing may be registered, and no
-// sync to Vana storage until registration exists.
-function derivedConfig(network) {
+// Everything that follows from the network and the tunnel client. Without a
+// tunnel client the server is local only: nothing outside can reach it, so
+// it is never registered and has nothing to sync. With one, the server
+// reserves its public URL but dials the relay only once registered, and sync
+// waits for registration too.
+function derivedConfig(network, tunnel) {
   return {
     devUi: { enabled: true },
     gateway: {
@@ -61,29 +67,134 @@ function derivedConfig(network) {
       backend: "vana",
       config: { vana: { apiUrl: network.storageApiUrl } },
     },
-    sync: { enabled: false },
-    tunnel: { enabled: false },
+    sync: { enabled: Boolean(tunnel) },
+    tunnel: tunnel
+      ? {
+          enabled: true,
+          serverAddr: tunnel.serverAddr,
+          serverPort: tunnel.serverPort,
+          binaryPath: tunnel.binaryPath,
+        }
+      : { enabled: false },
   };
 }
 
+const lines = readline
+  .createInterface({ input: process.stdin })
+  [Symbol.asyncIterator]();
+
 async function readInput() {
-  const rl = readline.createInterface({ input: process.stdin });
-  for await (const line of rl) {
-    if (line.trim()) {
-      rl.close();
-      return JSON.parse(line);
-    }
+  for (;;) {
+    const { value, done } = await lines.next();
+    if (done) throw new Error("No configuration on stdin.");
+    if (value.trim()) return JSON.parse(value);
   }
-  throw new Error("No configuration on stdin.");
 }
 
 let ps = null;
 
+// Only a tunnel URL may be registered: without one the server offers its
+// localhost origin, which no app could ever reach.
+function publicState(info) {
+  const tunnel = info.details?.tunnel ?? null;
+  return {
+    registered: Boolean(info.registration?.registered),
+    serverAddress: info.server?.address ?? null,
+    serverUrl: info.urls?.public ?? null,
+    tunnel: tunnel
+      ? {
+          status: tunnel.status ?? null,
+          routable: tunnel.routable !== false,
+          warning: tunnel.warning ?? null,
+        }
+      : null,
+  };
+}
+
+let watching = false;
+
+// The server dials the relay on its own once it sees the registration (it
+// polls the gateway); report when the public URL answers, as Desktop does.
+async function watchTunnel() {
+  if (watching) return;
+  watching = true;
+  const started = Date.now();
+  let last = null;
+  while (Date.now() - started < 10 * 60_000) {
+    try {
+      last = publicState(await ps.info());
+      if (last.tunnel?.status === "connected" && last.tunnel.routable) {
+        send({ type: "tunnel", status: "connected", url: last.serverUrl });
+        return;
+      }
+    } catch (error) {
+      process.stderr.write(`[entry] tunnel check failed: ${error}\n`);
+    }
+    await new Promise((resolve) => setTimeout(resolve, 3_000));
+  }
+  send({
+    type: "tunnel",
+    status: last?.tunnel?.status ?? "unknown",
+    url: last?.serverUrl ?? null,
+    warning: last?.tunnel?.warning ?? "The tunnel did not connect in time.",
+  });
+}
+
+// Typed data can carry bigints, which JSON.stringify refuses.
+const plain = (value) =>
+  JSON.parse(
+    JSON.stringify(value, (_key, item) =>
+      typeof item === "bigint" ? item.toString() : item,
+    ),
+  );
+
+async function handleCommands() {
+  for (;;) {
+    const { value, done } = await lines.next();
+    if (done) return;
+    if (!value.trim()) continue;
+    let command;
+    try {
+      command = JSON.parse(value);
+    } catch {
+      continue;
+    }
+    try {
+      if (command.type === "prepare-registration") {
+        const { serverUrl } = publicState(await ps.info());
+        if (!serverUrl) throw new Error("The server has no public URL.");
+        const request = await ps.prepareRegistration({ serverUrl });
+        send({
+          type: "registration-request",
+          request: { typedData: plain(request.typedData) },
+        });
+      } else if (command.type === "submit-registration") {
+        const result = await ps.submitRegistration({
+          signature: command.signature,
+        });
+        send({
+          type: "registration-submitted",
+          serverId: result?.serverId ?? null,
+          alreadyRegistered: Boolean(result?.alreadyRegistered),
+        });
+        void watchTunnel();
+      }
+    } catch (error) {
+      send({
+        type: "command-failed",
+        command: command.type,
+        message: error instanceof Error ? error.message : String(error),
+      });
+    }
+  }
+}
+
 async function main() {
   const input = await readInput();
-  const { rootPath, port, ownerSignature, ownerAddress, network } = input;
+  const { rootPath, port, ownerSignature, ownerAddress, network, tunnel } =
+    input;
   const configPath = join(rootPath, "server.json");
-  const derived = derivedConfig(network);
+  const derived = derivedConfig(network, tunnel ?? null);
 
   // Persist the derived block the way Desktop does, so a network change can
   // never leave an old gateway or storage host behind in server.json.
@@ -129,6 +240,13 @@ async function main() {
     port,
     url: info.urls?.local ?? `http://localhost:${port}`,
   });
+  void handleCommands();
+  if (!tunnel) return;
+
+  // Waits for the gateway registration check and the tunnel URL reservation.
+  const state = publicState(await ps.ready({ publicUrl: true }));
+  send({ type: "public", ...state });
+  if (state.registered) void watchTunnel();
 }
 
 async function shutdown(signal) {

package/dist/personal-server/local/server.d.ts

@@ -15,14 +15,25 @@ export declare function choosePort(requested?: number): Promise<number | null>;
  * taken over; a live one means a server is already running from that dir.
  */
 export declare function acquireDataDirLock(dir: string): Promise<() => Promise<void>>;
+/** One JSON line the server process writes on stdout. */
+export interface ServerMessage {
+    type: string;
+    [key: string]: unknown;
+}
 export interface LocalServerHandle {
     url: string;
     port: number;
     accessToken: string;
     /** Resolves when the server process exits, for whatever reason. */
     exited: Promise<number | null>;
+    /** Send one command line to the server process. */
+    send(command: Record<string, unknown>): void;
+    /** Every message from now on; returns an unsubscribe. */
+    onMessage(listener: (message: ServerMessage) => void): () => void;
     stop(): Promise<void>;
 }
+/** The next message of one of `types`, or a timeout error. */
+export declare function nextMessage(handle: Pick<LocalServerHandle, "onMessage" | "exited">, types: string[], timeoutMs: number): Promise<ServerMessage>;
 /**
  * Start the pinned Personal Server as a foreground child process on the
  * managed Node, local only, and wait until it answers.
@@ -34,6 +45,20 @@ export declare function startLocalServer(input: {
     binding: OwnerBinding;
     port: number;
     logPath: string;
+    /** A tunnel client to run; absent = local only. */
+    frpcPath?: string | null;
     readyTimeoutMs?: number;
 }): Promise<LocalServerHandle>;
+/** What the CLI remembers about a server it registered. */
+export interface PublicMarker {
+    serverAddress: string;
+    serverUrl: string;
+    registeredAt: string;
+}
+/**
+ * A registered server stays public: registrations cannot be removed, so once
+ * apps may look for it, every later start brings its tunnel back.
+ */
+export declare function readPublicMarker(network: VanaNetworkName): PublicMarker | null;
+export declare function writePublicMarker(network: VanaNetworkName, marker: PublicMarker): Promise<void>;
 //# sourceMappingURL=server.d.ts.map

package/dist/personal-server/local/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/personal-server/local/server.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAMvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,mEAAmE;AACnE,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,mEAAmE;AACnE,wBAAsB,kBAAkB,CACtC,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,aAAa,EAAE,CAAC,CA+B1B;AAWD,qFAAqF;AACrF,wBAAsB,UAAU,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQ3E;AAWD;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CA8B9B;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,MAAM,EAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC/B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE;IAC5C,OAAO,EAAE,eAAe,CAAC;IACzB,IAAI,EAAE,YAAY,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,YAAY,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAwH7B"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/personal-server/local/server.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAMvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,mEAAmE;AACnE,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,mEAAmE;AACnE,wBAAsB,kBAAkB,CACtC,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,aAAa,EAAE,CAAC,CA+B1B;AAWD,qFAAqF;AACrF,wBAAsB,UAAU,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQ3E;AAWD;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CA8B9B;AAED,yDAAyD;AACzD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,MAAM,EAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC/B,mDAAmD;IACnD,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC7C,yDAAyD;IACzD,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAClE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED,8DAA8D;AAC9D,wBAAgB,WAAW,CACzB,MAAM,EAAE,IAAI,CAAC,iBAAiB,EAAE,WAAW,GAAG,QAAQ,CAAC,EACvD,KAAK,EAAE,MAAM,EAAE,EACf,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,aAAa,CAAC,CAoBxB;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE;IAC5C,OAAO,EAAE,eAAe,CAAC;IACzB,IAAI,EAAE,YAAY,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,YAAY,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAqJ7B;AAED,2DAA2D;AAC3D,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB;AAMD;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,eAAe,GACvB,YAAY,GAAG,IAAI,CAgBrB;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,eAAe,EACxB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,IAAI,CAAC,CAMf"}