vault-go 0.11.0 → 0.13.0

package/dist/local-service.js

@@ -1,89 +1,253 @@
-import { createServer } from 'node:http';
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync, renameSync } from 'node:fs';
-import { join } from 'node:path';
-import { createHash, createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
-import { loadConfig, loadTokens, vaultHome } from './config.js';
-import { VaultCloudClient } from './cloud.js';
-import { readActivity } from './activity.js';
-import { dashboardHtml, dashboardScript } from './local-dashboard.js';
-import pkg from '../package.json' with { type: 'json' };
+import { createServer } from "node:http";
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync, unlinkSync, } from "node:fs";
+import { join } from "node:path";
+import { createHash, createHmac, randomBytes, timingSafeEqual, } from "node:crypto";
+import { authPath, loadConfig, loadTokens, vaultHome } from "./config.js";
+import { VaultCloudClient } from "./cloud.js";
+import { readActivity } from "./activity.js";
+import { dashboardHtml, dashboardScript } from "./local-dashboard.js";
+import pkg from "../package.json" with { type: "json" };
+import { authenticateWithBrowser } from "./auth.js";
+import { resolveLocale } from "./locale.js";
+import { callbackPage } from "./callback-page.js";
+import { privateStore } from "./private-store.js";
+import { localDevice } from "./local-device.js";
+import { generateContext, isApiEngine, isContextEngine, listContextEngines, saveEngineKey, selectContextEngine, selectedContextEngine, } from "./context-engines.js";
 export const LOCAL_PORT = 38850;
-const safeEqual = (a, b) => a.length === b.length && /^[A-Za-z0-9_-]{43}$/.test(a) && timingSafeEqual(Buffer.from(a), Buffer.from(b));
+const safeEqual = (a, b) => a.length === b.length &&
+    /^[A-Za-z0-9_-]{43}$/.test(a) &&
+    timingSafeEqual(Buffer.from(a), Buffer.from(b));
 export function localAccessToken(home) {
     mkdirSync(home, { recursive: true, mode: 0o700 });
     chmodSync(home, 0o700);
-    const file = join(home, 'local-access.json');
+    const file = join(home, "local-access.json");
     if (!existsSync(file)) {
         try {
-            writeFileSync(file, JSON.stringify({ token: randomBytes(32).toString('base64url') }), { mode: 0o600, flag: 'wx' });
+            writeFileSync(file, JSON.stringify({ token: randomBytes(32).toString("base64url") }), { mode: 0o600, flag: "wx" });
         }
         catch (e) {
-            if (e.code !== 'EEXIST')
+            if (e.code !== "EEXIST")
                 throw e;
         }
     }
     chmodSync(file, 0o600);
-    const value = JSON.parse(readFileSync(file, 'utf8'));
-    if (typeof value.token !== 'string' || !/^[A-Za-z0-9_-]{43}$/.test(value.token))
-        throw new Error('Invalid local access file.');
+    const value = JSON.parse(readFileSync(file, "utf8"));
+    if (typeof value.token !== "string" ||
+        !/^[A-Za-z0-9_-]{43}$/.test(value.token))
+        throw new Error("Invalid local access file.");
     return value.token;
 }
 function array(value) {
     if (Array.isArray(value))
         return value.slice(0, 100);
-    if (value && typeof value === 'object')
-        for (const key of ['items', 'memories', 'observations', 'projects', 'events', 'data']) {
+    if (value && typeof value === "object")
+        for (const key of [
+            "items",
+            "memories",
+            "observations",
+            "projects",
+            "events",
+            "data",
+        ]) {
             const items = value[key];
             if (Array.isArray(items))
                 return items.slice(0, 100);
         }
     return [];
 }
-async function readBody(req) {
-    const chunks = [];
-    let size = 0;
-    for await (const chunk of req) {
-        size += chunk.length;
-        if (size > 8192)
-            throw new Error('Body too large');
-        chunks.push(Buffer.from(chunk));
-    }
-    return JSON.parse(Buffer.concat(chunks).toString() || '{}');
+class BodyTooLarge extends Error {
+}
+function readBody(req, limit = 8192) {
+    return new Promise((resolve, reject) => {
+        let chunks = [], size = 0, settled = false;
+        const fail = (error) => {
+            if (settled)
+                return;
+            settled = true;
+            chunks = [];
+            reject(error);
+        };
+        req.on("data", (chunk) => {
+            if (settled)
+                return;
+            size += chunk.length;
+            if (size > limit) {
+                fail(new BodyTooLarge());
+                return;
+            }
+            chunks.push(Buffer.from(chunk));
+        });
+        req.once("end", () => {
+            if (settled)
+                return;
+            try {
+                const data = JSON.parse(Buffer.concat(chunks).toString() || "{}");
+                settled = true;
+                resolve(data);
+            }
+            catch {
+                fail(new Error("Invalid JSON"));
+            }
+        });
+        req.once("aborted", () => fail(new Error("Request aborted")));
+        req.once("error", () => fail(new Error("Request failed")));
+    });
 }
 export async function startLocalService(options = {}) {
     const home = options.home ?? vaultHome();
     const token = localAccessToken(home);
     const cloud = options.cloud ?? new VaultCloudClient(home, fetch, false);
+    let storage;
+    try {
+        storage = privateStore(home, options.cacheKey);
+    }
+    catch {
+        /* Remain online without a cache if the OS key store is locked. */
+    }
+    const accountCloud = new VaultCloudClient(home, fetch, false);
+    const monitor = options.device === false
+        ? undefined
+        : (options.device ??
+            localDevice(home, accountCloud, storage, pkg.version));
+    const jobs = new Map();
+    let engineCache;
+    let checkingEngines;
+    function clearJobs(session) {
+        for (const [id, job] of jobs)
+            if (!session || job.session === session) {
+                job.controller.abort();
+                jobs.delete(id);
+            }
+    }
+    async function engines() {
+        const requestOwner = identity();
+        if (engineCache && Date.now() - engineCache.at < 30000)
+            return { ...engineCache.value, selected: selectCurrent() };
+        if (checkingEngines)
+            return checkingEngines;
+        checkingEngines = (async () => {
+            if (options.context)
+                return options.context.list();
+            let managed = {
+                available: false,
+                reason: "Vault AI Resume is not configured or unavailable for this account.",
+                billing: "Uses the Vault observer allowance.",
+            };
+            try {
+                const status = (await accountCloud.observerStatus());
+                managed = {
+                    ...managed,
+                    available: status.configured === true && status.entitlement?.allowed === true,
+                    reason: status.configured
+                        ? "Provider readiness is checked when generating."
+                        : "Managed observer is not configured.",
+                };
+            }
+            catch { }
+            return listContextEngines(home, managed);
+        })();
+        try {
+            const value = await checkingEngines;
+            if (requestOwner === identity())
+                engineCache = { at: Date.now(), value };
+            return value;
+        }
+        finally {
+            checkingEngines = undefined;
+        }
+    }
+    function selectCurrent() {
+        return selectedContextEngine(home);
+    }
     const sessions = new Map();
+    let loginAbort = new AbortController();
+    let login = null;
     let port = options.port ?? LOCAL_PORT;
     let connected = false, cloudError, updatedAt = null;
     let projects = [], memories = [];
-    let owner = '';
+    let owner = "";
     let syncing = null;
     let closed = false;
-    const cache = join(home, 'local-cache.json');
-    function identity() { const config = loadConfig(home); return createHash('sha256').update(config.apiUrl + '|' + (process.env['VAULT_GO_TOKEN'] ?? config.email ?? loadTokens(home)?.accessToken ?? '') + '|' + (loadTokens(home) || process.env['VAULT_GO_TOKEN'] ? 'authenticated' : 'anonymous')).digest('hex'); }
-    function resetOwner() { const next = identity(); if (next === owner)
-        return; owner = next; projects = []; memories = []; updatedAt = null; connected = false; cloudError = undefined; try {
-        const stored = JSON.parse(readFileSync(cache, 'utf8'));
-        if (stored.owner === owner && (loadTokens(home) || process.env['VAULT_GO_TOKEN'])) {
+    const cache = "local-cache.json";
+    if (storage) {
+        try {
+            const old = JSON.parse(readFileSync(join(home, cache), "utf8"));
+            if (old.v !== 1)
+                storage.remove(cache);
+        }
+        catch { }
+    }
+    function identity() {
+        const config = loadConfig(home);
+        return createHash("sha256")
+            .update(config.apiUrl +
+            "|" +
+            (process.env["VAULT_GO_TOKEN"] ??
+                config.email ??
+                loadTokens(home)?.accessToken ??
+                "") +
+            "|" +
+            (loadTokens(home) || process.env["VAULT_GO_TOKEN"]
+                ? "authenticated"
+                : "anonymous"))
+            .digest("hex");
+    }
+    function resetOwner() {
+        const next = identity();
+        if (next === owner)
+            return;
+        clearJobs();
+        engineCache = undefined;
+        owner = next;
+        projects = [];
+        memories = [];
+        updatedAt = null;
+        connected = false;
+        cloudError = undefined;
+        const stored = storage?.read(cache);
+        if (stored?.owner === owner &&
+            (loadTokens(home) || process.env["VAULT_GO_TOKEN"])) {
             projects = array(stored.projects);
             memories = array(stored.memories);
-            updatedAt = typeof stored.updatedAt === 'string' ? stored.updatedAt : null;
+            updatedAt =
+                typeof stored.updatedAt === "string" ? stored.updatedAt : null;
+        }
+    }
+    function disconnectLocal() {
+        loginAbort.abort();
+        if (login?.status === "pending")
+            login.status = "failed";
+        clearJobs();
+        sessions.clear();
+        try {
+            unlinkSync(authPath(home));
         }
+        catch { }
+        storage?.remove(cache);
+        projects = [];
+        memories = [];
+        connected = false;
+        updatedAt = null;
+        engineCache = undefined;
     }
-    catch { } }
     async function refresh() {
         resetOwner();
         if (syncing)
             return syncing;
-        if (!loadTokens(home) && !process.env['VAULT_GO_TOKEN']) {
+        if (login?.status === "pending")
+            return;
+        if (!loadTokens(home) && !process.env["VAULT_GO_TOKEN"]) {
             connected = false;
             return;
         }
         const requestOwner = owner;
         syncing = (async () => {
             try {
+                await monitor?.heartbeat();
+                if (monitor?.status().status === "revoked") {
+                    disconnectLocal();
+                    return;
+                }
                 const newProjects = await cloud.projects();
                 const newMemories = await cloud.feed({ limit: 50 });
                 if (closed || requestOwner !== identity())
@@ -93,15 +257,12 @@ export async function startLocalService(options = {}) {
                 updatedAt = new Date().toISOString();
                 connected = true;
                 cloudError = undefined;
-                const temp = cache + '.tmp';
-                writeFileSync(temp, JSON.stringify({ owner, projects, memories, updatedAt }), { mode: 0o600 });
-                renameSync(temp, cache);
-                chmodSync(cache, 0o600);
+                storage?.write(cache, { owner, projects, memories, updatedAt });
             }
             catch {
                 if (requestOwner === identity()) {
                     connected = false;
-                    cloudError = 'cloud_unavailable';
+                    cloudError = "cloud_unavailable";
                 }
             }
             finally {
@@ -111,107 +272,368 @@ export async function startLocalService(options = {}) {
         return syncing;
     }
     const server = createServer(async (req, res) => {
-        res.setHeader('Cache-Control', 'no-store');
-        res.setHeader('Referrer-Policy', 'no-referrer');
-        res.setHeader('X-Content-Type-Options', 'nosniff');
-        res.setHeader('X-Frame-Options', 'DENY');
-        res.setHeader('Content-Security-Policy', "default-src 'none'; script-src 'self'; style-src 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; base-uri 'none'; frame-ancestors 'none'; form-action 'none'");
-        const json = (status, value) => { res.writeHead(status, { 'content-type': 'application/json; charset=utf-8' }); res.end(JSON.stringify(value)); };
+        res.setHeader("Cache-Control", "no-store");
+        res.setHeader("Referrer-Policy", "no-referrer");
+        res.setHeader("X-Content-Type-Options", "nosniff");
+        res.setHeader("X-Frame-Options", "DENY");
+        res.setHeader("Content-Security-Policy", "default-src 'none'; script-src 'self'; style-src 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; base-uri 'none'; frame-ancestors 'none'; form-action 'none'");
+        const json = (status, value) => {
+            res.writeHead(status, {
+                "content-type": "application/json; charset=utf-8",
+            });
+            res.end(JSON.stringify(value));
+        };
         const host = req.headers.host?.toLowerCase();
         const allowed = [`localhost:${port}`, `127.0.0.1:${port}`];
         if (!host || !allowed.includes(host)) {
-            json(403, { error: 'invalid_host' });
+            json(403, { error: "invalid_host" });
             return;
         }
         const origin = req.headers.origin;
-        if (origin && !allowed.map(h => 'http://' + h).includes(origin)) {
-            json(403, { error: 'invalid_origin' });
+        if (origin && !allowed.map((h) => "http://" + h).includes(origin)) {
+            json(403, { error: "invalid_origin" });
             return;
         }
-        if (req.headers['sec-fetch-site'] === 'cross-site' && req.url?.startsWith('/api/')) {
-            json(403, { error: 'cross_site_request' });
+        if (req.headers["sec-fetch-site"] === "cross-site" &&
+            req.url?.startsWith("/api/")) {
+            json(403, { error: "cross_site_request" });
             return;
         }
         let url;
         try {
-            url = new URL(req.url ?? '/', `http://${host}`);
+            url = new URL(req.url ?? "/", `http://${host}`);
         }
         catch {
-            json(400, { error: 'invalid_url' });
+            json(400, { error: "invalid_url" });
             return;
         }
-        if (url.pathname === '/health' && req.method === 'GET') {
-            const challenge = url.searchParams.get('challenge');
-            json(200, { service: 'vault-go', version: pkg.version, port, ...(challenge && /^[A-Za-z0-9_-]{43}$/.test(challenge) ? { proof: createHmac('sha256', token).update(challenge).digest('base64url') } : {}) });
+        if (url.pathname === "/health" && req.method === "GET") {
+            const challenge = url.searchParams.get("challenge");
+            json(200, {
+                service: "vault-go",
+                version: pkg.version,
+                port,
+                ...(challenge && /^[A-Za-z0-9_-]{43}$/.test(challenge)
+                    ? {
+                        proof: createHmac("sha256", token)
+                            .update(challenge)
+                            .digest("base64url"),
+                    }
+                    : {}),
+            });
             return;
         }
-        if (url.pathname === '/' && req.method === 'GET') {
-            res.setHeader('Content-Type', 'text/html; charset=utf-8');
+        if (url.pathname === "/" && req.method === "GET") {
+            res.setHeader("Content-Type", "text/html; charset=utf-8");
             res.end(dashboardHtml());
             return;
         }
-        if (url.pathname === '/app.js' && req.method === 'GET') {
-            res.setHeader('Content-Type', 'text/javascript; charset=utf-8');
+        if (url.pathname === "/app.js" && req.method === "GET") {
+            res.setHeader("Content-Type", "text/javascript; charset=utf-8");
             res.end(dashboardScript());
             return;
         }
+        if (url.pathname === "/logo.png" && req.method === "GET") {
+            try {
+                res.setHeader("Content-Type", "image/png");
+                res.end(readFileSync(new URL("../assets/vault-logo-glass.png", import.meta.url)));
+            }
+            catch {
+                res.writeHead(404).end();
+            }
+            return;
+        }
         try {
-            if (url.pathname === '/api/session' && req.method === 'POST') {
-                const data = await readBody(req);
-                if (typeof data.token !== 'string' || !safeEqual(data.token, token)) {
-                    json(401, { error: 'unauthorized' });
+            const cookie = req.headers.cookie
+                ?.split(";")
+                .map((s) => s.trim())
+                .find((s) => s.startsWith("vault_local_session="))
+                ?.slice("vault_local_session=".length) ?? "";
+            const setSessionCookie = (session) => res.setHeader("Set-Cookie", `vault_local_session=${session}; HttpOnly; SameSite=Strict; Path=/; Max-Age=43200`);
+            if (url.pathname === "/api/connect/status" && req.method === "GET") {
+                json(200, {
+                    status: (sessions.get(cookie) ?? 0) > Date.now()
+                        ? "connected"
+                        : login?.session === cookie
+                            ? login.status
+                            : "idle",
+                });
+                return;
+            }
+            if (url.pathname === "/api/connect" && req.method === "POST") {
+                // A website can navigate here, but only this origin may initiate login.
+                if (!origin || !allowed.map((h) => "http://" + h).includes(origin)) {
+                    json(403, { error: "invalid_origin" });
+                    return;
+                }
+                if (login?.status === "pending") {
+                    json(409, { error: "login_pending" });
                     return;
                 }
-                const session = randomBytes(32).toString('base64url');
+                const data = (await readBody(req));
+                const locale = resolveLocale(typeof data.locale === "string" ? data.locale : undefined);
+                loginAbort = new AbortController();
+                const attemptAbort = loginAbort;
+                const attempt = {
+                    session: randomBytes(32).toString("base64url"),
+                    status: "pending",
+                };
+                login = attempt;
+                let announce;
+                let rejectStart;
+                const started = new Promise((resolve, reject) => {
+                    announce = resolve;
+                    rejectStart = reject;
+                });
+                void (options.authenticate ?? authenticateWithBrowser)(home, {
+                    locale,
+                    signal: attemptAbort.signal,
+                    report: () => { },
+                    callbackHtml: callbackPage(locale, `http://localhost:${port}/`),
+                    openBrowser: async (authUrl) => announce(authUrl),
+                })
+                    .then(async () => {
+                    if (closed || attemptAbort.signal.aborted)
+                        return;
+                    await monitor?.reauthorize();
+                    if (closed || attemptAbort.signal.aborted)
+                        return;
+                    attempt.status = "connected";
+                    sessions.set(attempt.session, Date.now() + 12 * 60 * 60 * 1000);
+                    await refresh();
+                })
+                    .catch((error) => {
+                    attempt.status = "failed";
+                    rejectStart(error);
+                });
+                const authUrl = await started;
+                setSessionCookie(attempt.session);
+                json(200, { url: authUrl });
+                return;
+            }
+            if (url.pathname === "/api/session" && req.method === "POST") {
+                const data = (await readBody(req));
+                if (typeof data.token !== "string" || !safeEqual(data.token, token)) {
+                    json(401, { error: "unauthorized" });
+                    return;
+                }
+                const session = randomBytes(32).toString("base64url");
                 for (const [key, expiry] of sessions)
                     if (expiry < Date.now())
                         sessions.delete(key);
                 if (sessions.size >= 32)
                     sessions.delete(sessions.keys().next().value);
                 sessions.set(session, Date.now() + 12 * 60 * 60 * 1000);
-                res.setHeader('Set-Cookie', `vault_local_session=${session}; HttpOnly; SameSite=Strict; Path=/; Max-Age=43200`);
+                setSessionCookie(session);
                 json(200, { ok: true });
                 return;
             }
-            const bearer = req.headers.authorization?.replace(/^Bearer /, '') ?? '';
-            const cookie = req.headers.cookie?.split(';').map(s => s.trim()).find(s => s.startsWith('vault_local_session='))?.slice('vault_local_session='.length) ?? '';
-            if (!safeEqual(bearer, token) && (sessions.get(cookie) ?? 0) <= Date.now()) {
-                json(401, { error: 'unauthorized' });
+            const bearer = req.headers.authorization?.replace(/^Bearer /, "") ?? "";
+            if (!safeEqual(bearer, token) &&
+                (sessions.get(cookie) ?? 0) <= Date.now()) {
+                json(401, { error: "unauthorized" });
+                return;
+            }
+            if (url.pathname === "/api/logout" && req.method === "POST") {
+                clearJobs(cookie || bearer);
+                sessions.delete(cookie);
+                res.setHeader("Set-Cookie", "vault_local_session=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0");
+                json(200, { ok: true });
                 return;
             }
             resetOwner();
-            if (url.pathname === '/api/status' && req.method === 'GET') {
+            if (url.pathname === "/api/device/disconnect" && req.method === "POST") {
+                if (login?.status === "pending") {
+                    json(409, { error: "login_in_progress" });
+                    return;
+                }
+                await monitor?.disconnect();
+                disconnectLocal();
+                res.setHeader("Set-Cookie", "vault_local_session=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0");
+                json(200, { ok: true });
+                return;
+            }
+            if (url.pathname === "/api/context/engines" && req.method === "GET") {
+                json(200, await engines());
+                return;
+            }
+            if (url.pathname === "/api/context/engine" && req.method === "PUT") {
+                const data = (await readBody(req));
+                if (!isContextEngine(data.engine)) {
+                    json(400, { error: "invalid_engine" });
+                    return;
+                }
+                selectContextEngine(home, data.engine);
+                json(200, { selected: data.engine });
+                return;
+            }
+            if (url.pathname === "/api/context/secret" && req.method === "PUT") {
+                const data = (await readBody(req));
+                if (!isApiEngine(data.provider) || typeof data.key !== "string") {
+                    json(400, { error: "invalid_engine_key" });
+                    return;
+                }
+                saveEngineKey(home, data.provider, data.key);
+                engineCache = undefined;
+                json(200, { configured: data.provider });
+                return;
+            }
+            if (url.pathname === "/api/context/generate" && req.method === "POST") {
+                const data = (await readBody(req, 65536));
+                if (!loadTokens(home) ||
+                    !isContextEngine(data.engine) ||
+                    typeof data.text !== "string" ||
+                    !data.text.trim() ||
+                    data.text.length > 16000 ||
+                    data.consent !== true) {
+                    json(400, { error: "invalid_generation_request" });
+                    return;
+                }
+                for (const [id, job] of jobs)
+                    if (Date.now() - job.createdAt > 600000) {
+                        job.controller.abort();
+                        jobs.delete(id);
+                    }
+                if ([...jobs.values()].some((j) => j.status === "running")) {
+                    json(409, { error: "generation_in_progress" });
+                    return;
+                }
+                if (jobs.size >= 8)
+                    jobs.delete(jobs.keys().next().value);
+                const id = randomBytes(16).toString("hex");
+                const job = {
+                    id,
+                    owner: identity(),
+                    session: cookie || bearer,
+                    status: "running",
+                    controller: new AbortController(),
+                    createdAt: Date.now(),
+                };
+                jobs.set(id, job);
+                void (options.context?.generate ?? generateContext)(home, data.engine, data.text, {
+                    signal: job.controller.signal,
+                    managedGenerate: (text, opts) => accountCloud.observerGenerate(text, opts.signal),
+                })
+                    .then((result) => {
+                    if (job.controller.signal.aborted || job.owner !== identity())
+                        return;
+                    job.result = result;
+                    job.status = "completed";
+                })
+                    .catch(() => {
+                    if (job.controller.signal.aborted)
+                        return;
+                    job.status = "failed";
+                    job.error = "generation_failed";
+                });
+                json(202, { jobId: id });
+                return;
+            }
+            const jobMatch = url.pathname.match(/^\/api\/context\/jobs\/([a-f0-9]{32})$/);
+            if (jobMatch) {
+                const job = jobs.get(jobMatch[1]);
+                if (!job ||
+                    job.owner !== identity() ||
+                    job.session !== (cookie || bearer)) {
+                    json(404, { error: "job_not_found" });
+                    return;
+                }
+                if (req.method === "DELETE") {
+                    job.controller.abort();
+                    jobs.delete(job.id);
+                    json(200, { ok: true });
+                    return;
+                }
+                if (req.method === "GET") {
+                    json(200, {
+                        status: job.status,
+                        result: job.result,
+                        error: job.error,
+                    });
+                    return;
+                }
+            }
+            if (url.pathname === "/api/status" && req.method === "GET") {
                 const config = loadConfig(home);
-                json(200, { service: 'vault-go', version: pkg.version, port, authenticated: Boolean(loadTokens(home) || process.env['VAULT_GO_TOKEN']), email: config.email, cloud: { connected, error: cloudError, syncing: Boolean(syncing) }, activity: readActivity(home), projects, memories, updatedAt });
+                json(200, {
+                    service: "vault-go",
+                    version: pkg.version,
+                    port,
+                    authenticated: Boolean(loadTokens(home) || process.env["VAULT_GO_TOKEN"]),
+                    email: config.email,
+                    cloud: { connected, error: cloudError, syncing: Boolean(syncing) },
+                    device: monitor?.status() ?? { status: "unregistered" },
+                    security: {
+                        cache: {
+                            encrypted: Boolean(storage),
+                            keyStorage: storage?.keyStorage ?? "unavailable",
+                        },
+                        credentials: "file-permissions",
+                        transport: {
+                            local: "loopback-http",
+                            cloud: new URL(config.apiUrl).protocol === "https:" ? "https" : "http",
+                        },
+                        endToEndEncrypted: false,
+                    },
+                    activity: readActivity(home),
+                    projects,
+                    memories,
+                    updatedAt,
+                });
                 return;
             }
-            if (url.pathname === '/api/sync' && req.method === 'POST') {
+            if (url.pathname === "/api/sync" && req.method === "POST") {
                 await readBody(req);
                 await refresh();
                 json(200, { ok: connected });
                 return;
             }
-            if (url.pathname === '/api/shutdown' && req.method === 'POST') {
+            if (url.pathname === "/api/shutdown" && req.method === "POST") {
                 json(200, { ok: true });
                 setTimeout(() => void close(), 30);
                 return;
             }
-            json(404, { error: 'not_found' });
+            json(404, { error: "not_found" });
         }
-        catch {
-            if (!res.headersSent)
-                json(400, { error: 'invalid_request' });
+        catch (error) {
+            if (!res.headersSent) {
+                if (error instanceof BodyTooLarge)
+                    res.setHeader("Connection", "close");
+                json(error instanceof BodyTooLarge ? 413 : 400, {
+                    error: error instanceof BodyTooLarge
+                        ? "body_too_large"
+                        : "invalid_request",
+                });
+            }
             else
                 res.end();
         }
     });
-    await new Promise((resolve, reject) => { server.once('error', reject); server.listen(port, '127.0.0.1', resolve); });
+    server.headersTimeout = 5000;
+    server.requestTimeout = 15000;
+    server.keepAliveTimeout = 5000;
+    server.maxHeadersCount = 40;
+    server.maxConnections = 64;
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(port, "127.0.0.1", resolve);
+    });
     const address = server.address();
-    if (address && typeof address !== 'string')
+    if (address && typeof address !== "string")
         port = address.port;
     const timer = setInterval(() => void refresh(), options.pollMs ?? 15_000);
     timer.unref();
     void refresh();
-    async function close() { closed = true; clearInterval(timer); sessions.clear(); server.closeAllConnections(); await new Promise(resolve => server.close(() => resolve())); }
+    async function close() {
+        closed = true;
+        loginAbort.abort();
+        monitor?.close();
+        clearJobs();
+        clearInterval(timer);
+        sessions.clear();
+        server.closeAllConnections();
+        await new Promise((resolve) => server.close(() => resolve()));
+        storage?.close();
+    }
     return { server, port, close };
 }