@ariestools/cli 0.1.11 → 0.1.13

package/dist/bin/daemons/datalake-dev.mjs

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from "node:module";
 import path from "node:path";
-import * as nc from "node:crypto";
-import { createHash, createHmac, randomBytes, timingSafeEqual } from "node:crypto";
 import http from "http";
 import https from "https";
 import { gunzipSync } from "zlib";
-import { createHash as createHash$3, createHmac as createHmac$1, pbkdf2Sync, randomBytes as randomBytes$6 } from "crypto";
+import { createHash as createHash$2, createHmac as createHmac$1, pbkdf2Sync, randomBytes as randomBytes$6 } from "crypto";
+import * as nc from "node:crypto";
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
 import os, { cpus } from "node:os";
 import process$1, { cwd } from "node:process";
 import { Worker } from "node:worker_threads";
@@ -57,189 +57,6 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var __toCommonJS = (mod) => __hasOwnProp.call(mod, "module.exports") ? mod["module.exports"] : __copyProps(__defProp$14({}, "__esModule", { value: true }), mod);
 var __require$1 = /* #__PURE__ */ (() => createRequire(import.meta.url))();
 //#endregion
-//#region ../datalake-core/dist/node/index.mjs
-var API_ERROR_STATUS$1 = {
-	bad_request: 400,
-	unauthorized: 401,
-	forbidden: 403,
-	not_found: 404,
-	conflict: 409,
-	unprocessable: 422,
-	rate_limited: 429,
-	internal: 500
-};
-function datalakeCollectionPath() {
-	return `/v1/datalakes`;
-}
-function datalakeResourcePath(idOrName) {
-	return `${datalakeCollectionPath()}/${encodeURIComponent(idOrName)}`;
-}
-function datalakeGrantsPath(idOrName) {
-	return `${datalakeResourcePath(idOrName)}/grants`;
-}
-function datalakeGrantPath(idOrName, principal) {
-	return `${datalakeGrantsPath(idOrName)}/${encodeURIComponent(principal)}`;
-}
-function datalakeTokensPath(idOrName) {
-	return `${datalakeResourcePath(idOrName)}/tokens`;
-}
-function datalakeHealthPath() {
-	return `/v1/health`;
-}
-var DATALAKE_HEADER_DUPLICATES = "x-datalake-duplicates";
-var DATALAKE_HEADER_REJECTED = "x-datalake-rejected";
-var DATALAKE_HEADER_NEXT_CURSOR = "x-datalake-next-cursor";
-function base64UrlEncode(input) {
-	return (typeof input === "string" ? Buffer.from(input) : input).toString("base64url");
-}
-function base64UrlDecode(input) {
-	return Buffer.from(input, "base64url");
-}
-function signSessionToken(input) {
-	const issuedAt = Math.floor(Date.now() / 1e3);
-	const expiresAt = issuedAt + input.ttlSeconds;
-	const payload = {
-		sub: input.address.toLowerCase(),
-		typ: "session",
-		iat: issuedAt,
-		exp: expiresAt,
-		jti: randomBytes(8).toString("hex")
-	};
-	const toSign = `${base64UrlEncode(JSON.stringify({
-		alg: "HS256",
-		typ: "JWT"
-	}))}.${base64UrlEncode(JSON.stringify(payload))}`;
-	return {
-		token: `${toSign}.${createHmac("sha256", input.signingSecret).update(toSign).digest("base64url")}`,
-		expiresAt: (/* @__PURE__ */ new Date(expiresAt * 1e3)).toISOString()
-	};
-}
-var SessionTokenVerificationError = class extends Error {
-	code;
-	constructor(code, message) {
-		super(message);
-		this.name = "SessionTokenVerificationError";
-		this.code = code;
-	}
-};
-function verifySessionToken(input) {
-	const parts = input.token.split(".");
-	if (parts.length !== 3) throw new SessionTokenVerificationError("malformed", "Token is not a JWS compact serialization");
-	const [header, body, providedSignature] = parts;
-	const expected = createHmac("sha256", input.signingSecret).update(`${header}.${body}`).digest("base64url");
-	const expectedBytes = Buffer.from(expected);
-	const providedBytes = Buffer.from(providedSignature);
-	if (expectedBytes.length !== providedBytes.length || !timingSafeEqual(expectedBytes, providedBytes)) throw new SessionTokenVerificationError("bad_signature", "Signature mismatch");
-	let payload;
-	try {
-		payload = JSON.parse(base64UrlDecode(body).toString("utf8"));
-	} catch {
-		throw new SessionTokenVerificationError("malformed", "Payload is not valid JSON");
-	}
-	if (payload.typ !== "session") throw new SessionTokenVerificationError("wrong_type", "Not a session token");
-	const now = input.now ?? Math.floor(Date.now() / 1e3);
-	if (payload.exp <= now) throw new SessionTokenVerificationError("expired", "Token has expired");
-	return payload;
-}
-function signChallenge(input) {
-	const issuedAt = Math.floor(Date.now() / 1e3);
-	const expiresAt = issuedAt + input.ttlSeconds;
-	const payload = {
-		address: input.address.toLowerCase(),
-		typ: "challenge",
-		iat: issuedAt,
-		exp: expiresAt,
-		jti: randomBytes(8).toString("hex")
-	};
-	const toSign = `${base64UrlEncode(JSON.stringify({
-		alg: "HS256",
-		typ: "JWT"
-	}))}.${base64UrlEncode(JSON.stringify(payload))}`;
-	return {
-		challenge: `${toSign}.${createHmac("sha256", input.signingSecret).update(toSign).digest("base64url")}`,
-		expiresAt: (/* @__PURE__ */ new Date(expiresAt * 1e3)).toISOString()
-	};
-}
-function verifyChallenge(input) {
-	const parts = input.challenge.split(".");
-	if (parts.length !== 3) throw new SessionTokenVerificationError("malformed", "Challenge is not a JWS compact serialization");
-	const [header, body, providedSignature] = parts;
-	const expected = createHmac("sha256", input.signingSecret).update(`${header}.${body}`).digest("base64url");
-	const expectedBytes = Buffer.from(expected);
-	const providedBytes = Buffer.from(providedSignature);
-	if (expectedBytes.length !== providedBytes.length || !timingSafeEqual(expectedBytes, providedBytes)) throw new SessionTokenVerificationError("bad_signature", "Challenge signature mismatch");
-	let payload;
-	try {
-		payload = JSON.parse(base64UrlDecode(body).toString("utf8"));
-	} catch {
-		throw new SessionTokenVerificationError("malformed", "Challenge payload not valid JSON");
-	}
-	if (payload.typ !== "challenge") throw new SessionTokenVerificationError("wrong_type", "Not a challenge token");
-	const now = input.now ?? Math.floor(Date.now() / 1e3);
-	if (payload.exp <= now) throw new SessionTokenVerificationError("expired", "Challenge has expired");
-	return payload;
-}
-function base64UrlEncode2(input) {
-	return (typeof input === "string" ? Buffer.from(input) : input).toString("base64url");
-}
-function base64UrlDecode2(input) {
-	return Buffer.from(input, "base64url");
-}
-function signToken(input) {
-	const issuedAt = Math.floor(Date.now() / 1e3);
-	const expiresAt = issuedAt + input.ttlSeconds;
-	const payload = {
-		sub: input.ownerId,
-		dl: input.datalakeId,
-		role: input.role,
-		iat: issuedAt,
-		exp: expiresAt,
-		jti: randomBytes(8).toString("hex")
-	};
-	const toSign = `${base64UrlEncode2(JSON.stringify({
-		alg: "HS256",
-		typ: "JWT"
-	}))}.${base64UrlEncode2(JSON.stringify(payload))}`;
-	return {
-		token: `${toSign}.${createHmac("sha256", input.signingSecret).update(toSign).digest("base64url")}`,
-		datalakeId: input.datalakeId,
-		role: input.role,
-		expiresAt: (/* @__PURE__ */ new Date(expiresAt * 1e3)).toISOString(),
-		url: input.url
-	};
-}
-var TokenVerificationError = class extends Error {
-	code;
-	constructor(code, message) {
-		super(message);
-		this.name = "TokenVerificationError";
-		this.code = code;
-	}
-};
-function verifyToken(input) {
-	const parts = input.token.split(".");
-	if (parts.length !== 3) throw new TokenVerificationError("malformed", "Token is not a JWS compact serialization");
-	const [header, body, providedSignature] = parts;
-	const expected = createHmac("sha256", input.signingSecret).update(`${header}.${body}`).digest("base64url");
-	const expectedBytes = Buffer.from(expected);
-	const providedBytes = Buffer.from(providedSignature);
-	if (expectedBytes.length !== providedBytes.length || !timingSafeEqual(expectedBytes, providedBytes)) throw new TokenVerificationError("bad_signature", "Signature mismatch");
-	let payload;
-	try {
-		payload = JSON.parse(base64UrlDecode2(body).toString("utf8"));
-	} catch {
-		throw new TokenVerificationError("malformed", "Payload is not valid JSON");
-	}
-	const now = input.now ?? Math.floor(Date.now() / 1e3);
-	if (payload.exp <= now) throw new TokenVerificationError("expired", "Token has expired");
-	if (payload.iat > now + 60) throw new TokenVerificationError("not_yet_valid", "Token issued in the future");
-	return payload;
-}
-var PUBLIC_PRINCIPAL = "public";
-function isPublicPrincipal(principal) {
-	return principal === PUBLIC_PRINCIPAL;
-}
-//#endregion
 //#region ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/core/core.js
 var _a$1;
 function $constructor(name, initializer, params) {
@@ -37171,10 +36988,10 @@ Object.freeze(scryptSync);
 //#endregion
 //#region ../../node_modules/.pnpm/ethers@6.17.0/node_modules/ethers/lib.esm/crypto/sha2.js
 const _sha256 = function(data) {
-	return createHash$3("sha256").update(data).digest();
+	return createHash$2("sha256").update(data).digest();
 };
 const _sha512 = function(data) {
-	return createHash$3("sha512").update(data).digest();
+	return createHash$2("sha512").update(data).digest();
 };
 let __sha256 = _sha256;
 let __sha512 = _sha512;
@@ -46561,7 +46378,7 @@ var require_websocket = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const http$6 = __require$1("http");
 	const net = __require$1("net");
 	const tls = __require$1("tls");
-	const { randomBytes: randomBytes$3, createHash: createHash$2 } = __require$1("crypto");
+	const { randomBytes: randomBytes$3, createHash: createHash$1 } = __require$1("crypto");
 	const { Duplex: Duplex$2, Readable: Readable$3 } = __require$1("stream");
 	const { URL: URL$2 } = __require$1("url");
 	const PerMessageDeflate = require_permessage_deflate();
@@ -47229,7 +47046,7 @@ var require_websocket = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 				abortHandshake(websocket, socket, "Invalid Upgrade header");
 				return;
 			}
-			const digest = createHash$2("sha1").update(key + GUID).digest("base64");
+			const digest = createHash$1("sha1").update(key + GUID).digest("base64");
 			if (res.headers["sec-websocket-accept"] !== digest) {
 				abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
 				return;
@@ -47703,7 +47520,7 @@ var require_websocket_server = /* @__PURE__ */ __commonJSMin(((exports, module)
 	const EventEmitter$11 = __require$1("events");
 	const http$5 = __require$1("http");
 	const { Duplex } = __require$1("stream");
-	const { createHash: createHash$1 } = __require$1("crypto");
+	const { createHash } = __require$1("crypto");
 	const extension = require_extension();
 	const PerMessageDeflate = require_permessage_deflate();
 	const subprotocol = require_subprotocol();
@@ -47972,7 +47789,7 @@ var require_websocket_server = /* @__PURE__ */ __commonJSMin(((exports, module)
 				"HTTP/1.1 101 Switching Protocols",
 				"Upgrade: websocket",
 				"Connection: Upgrade",
-				`Sec-WebSocket-Accept: ${createHash$1("sha1").update(key + GUID).digest("base64")}`
+				`Sec-WebSocket-Accept: ${createHash("sha1").update(key + GUID).digest("base64")}`
 			];
 			const ws = new this.options.WebSocket(null, void 0, this.options);
 			if (protocols.size) {
@@ -78105,6 +77922,142 @@ var AdhocWitness = class extends AbstractWitness {
 };
 HttpBridge.factory(), ViewArchivist.factory(), ViewNode.factory(), AdhocWitness.factory(), GenericPayloadDiviner.factory(), MemoryBoundWitnessDiviner.factory(), IdentityDiviner.factory(), MemoryArchivist.factory(), MemoryArchivist.factory(), MemoryNode.factory(), MemorySentinel.factory(), GenericPayloadDiviner.factory();
 //#endregion
+//#region ../jwt/dist/neutral/index.mjs
+var ADDRESS_PATTERN$1 = /^(?:0x)?[\da-fA-F]{40}$/;
+var PUBLIC_KEY_PATTERN = /^[\da-fA-F]{128}$/;
+var DEFAULT_MAX_LIFETIME_SECONDS = 300;
+var DEFAULT_FUTURE_SKEW_SECONDS = 60;
+async function verifyWalletJwtPolicy(token, options) {
+	const reasons = [];
+	let decoded;
+	try {
+		decoded = decodeJwt(token);
+	} catch {
+		return {
+			ok: false,
+			reasons: ["token is not a valid compact JWT"]
+		};
+	}
+	const header = asRecord(decoded.header);
+	const payload = asRecord(decoded.payload);
+	if (header === void 0 || payload === void 0) return {
+		ok: false,
+		reasons: ["JWT header and payload must be JSON objects"]
+	};
+	const now = options.now ?? Math.floor(Date.now() / 1e3);
+	const maxLifetimeSeconds = options.maxLifetimeSeconds ?? DEFAULT_MAX_LIFETIME_SECONDS;
+	const futureSkewSeconds = options.futureSkewSeconds ?? DEFAULT_FUTURE_SKEW_SECONDS;
+	validateHeader(header, reasons);
+	validatePayload(payload, options.audience, now, maxLifetimeSeconds, futureSkewSeconds, reasons);
+	const scopes = validateProfile(payload, options.profile, reasons);
+	await validateSignature(token, options.audience, now, reasons);
+	const kid = typeof header.kid === "string" ? header.kid : "";
+	const principal = resolvePrincipal(header, payload, reasons);
+	const uniqueReasons = [...new Set(reasons)];
+	if (uniqueReasons.length > 0 || principal === void 0) return {
+		ok: false,
+		reasons: uniqueReasons.length > 0 ? uniqueReasons : ["wallet principal is invalid"]
+	};
+	return {
+		ok: true,
+		header: {
+			alg: JwtAlg.ES256K,
+			typ: JwtTyp.JWT,
+			kid,
+			pub: header.pub
+		},
+		payload,
+		principal,
+		scopes
+	};
+}
+async function validateSignature(token, audience, now, reasons) {
+	try {
+		const verified = await verifyJwt(token, {
+			audience,
+			now
+		});
+		if (!verified.ok) reasons.push(...verified.reasons);
+	} catch {
+		reasons.push("wallet JWT cryptographic verification failed");
+	}
+}
+function resolvePrincipal(header, payload, reasons) {
+	const kid = typeof header.kid === "string" ? header.kid : "";
+	const issuer = typeof payload.iss === "string" ? payload.iss : "";
+	if (!ADDRESS_PATTERN$1.test(kid) || !ADDRESS_PATTERN$1.test(issuer)) return void 0;
+	try {
+		const normalizedKid = normalizeAddress(kid);
+		if (normalizedKid === normalizeAddress(issuer)) return normalizedKid;
+		reasons.push("header.kid does not match payload.iss");
+	} catch {
+		reasons.push("kid or iss is not a valid XYO address");
+	}
+}
+function validateHeader(header, reasons) {
+	if (header.alg !== JwtAlg.ES256K) reasons.push("header.alg must be ES256K");
+	if (header.typ !== JwtTyp.JWT) reasons.push("header.typ must be JWT");
+	if (typeof header.kid !== "string" || !ADDRESS_PATTERN$1.test(header.kid)) reasons.push("header.kid must be a 20-byte hex address");
+	if (typeof header.pub !== "string" || !PUBLIC_KEY_PATTERN.test(header.pub)) reasons.push("header.pub must be an embedded 64-byte secp256k1 public key");
+}
+function validatePayload(payload, audience, now, maxLifetimeSeconds, futureSkewSeconds, reasons) {
+	if (typeof payload.iss !== "string" || !ADDRESS_PATTERN$1.test(payload.iss)) reasons.push("payload.iss must be a 20-byte hex address");
+	if (payload.aud !== audience) reasons.push("payload.aud does not exactly match the required audience");
+	if (payload.schema !== JwtSchema.Signin) reasons.push(`payload.schema must be ${JwtSchema.Signin}`);
+	const iat = payload.iat;
+	const exp = payload.exp;
+	if (!isFiniteInteger$1(iat)) reasons.push("payload.iat must be a finite integer");
+	if (!isFiniteInteger$1(exp)) reasons.push("payload.exp must be a finite integer");
+	if (isFiniteInteger$1(iat) && isFiniteInteger$1(exp)) {
+		if (exp <= iat) reasons.push("payload.exp must be greater than payload.iat");
+		if (exp - iat > maxLifetimeSeconds) reasons.push(`wallet JWT lifetime exceeds ${maxLifetimeSeconds} seconds`);
+		if (iat > now + futureSkewSeconds) reasons.push(`payload.iat is more than ${futureSkewSeconds} seconds in the future`);
+		if (exp <= now) reasons.push("wallet JWT has expired");
+	}
+	if (payload.nbf !== void 0) {
+		if (!isFiniteInteger$1(payload.nbf)) reasons.push("payload.nbf must be a finite integer");
+		else if (payload.nbf > now) reasons.push("wallet JWT is not yet valid");
+	}
+}
+function validateProfile(payload, profile, reasons) {
+	if (profile.kind === "service") {
+		if (payload.origin !== void 0 || payload.scope !== void 0) reasons.push("browser origin/scope claims are not accepted by the service JWT profile");
+		return [];
+	}
+	const origin = profile.origin;
+	if (origin === void 0 || origin.length === 0) reasons.push("browser request Origin is required");
+	if (origin !== void 0 && !profile.allowedOrigins.includes(origin)) reasons.push("browser request Origin is not allowed");
+	if (typeof payload.origin !== "string" || payload.origin.length === 0) reasons.push("payload.origin is required for browser JWTs");
+	else {
+		if (payload.origin !== origin) reasons.push("payload.origin does not match the request Origin");
+		if (!profile.allowedOrigins.includes(payload.origin)) reasons.push("payload.origin is not allowed");
+	}
+	return parseCanonicalScope(payload.scope, profile.allowedScopes, reasons);
+}
+function parseCanonicalScope(value, allowedScopes, reasons) {
+	if (typeof value !== "string" || value.length === 0) {
+		reasons.push("payload.scope is required for browser JWTs");
+		return [];
+	}
+	const scopes = value.split(" ");
+	if (scopes.some((scope) => scope.length === 0)) {
+		reasons.push("payload.scope must use single-space separators with no surrounding whitespace");
+		return [];
+	}
+	const canonical = [...new Set(scopes)].sort();
+	if (canonical.length !== scopes.length || canonical.join(" ") !== value) reasons.push("payload.scope must be sorted, unique, and space-delimited");
+	const allowed = new Set(allowedScopes);
+	for (const scope of scopes) if (!allowed.has(scope)) reasons.push(`payload.scope contains unknown operation: ${scope}`);
+	return scopes;
+}
+function isFiniteInteger$1(value) {
+	return typeof value === "number" && Number.isFinite(value) && Number.isInteger(value);
+}
+function asRecord(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+	return value;
+}
+//#endregion
 //#region ../../node_modules/.pnpm/prom-client@15.1.3/node_modules/prom-client/lib/util.js
 var require_util$1 = /* @__PURE__ */ __commonJSMin(((exports) => {
 	exports.getValueAsString = function getValueString(value) {
@@ -80782,24 +80735,10 @@ var import_prom_client = (/* @__PURE__ */ __commonJSMin(((exports) => {
 	exports.aggregators = require_metricAggregators().aggregators;
 	exports.AggregatorRegistry = require_cluster();
 })))();
-var SelfSignedWalletJwtTokenStore = class {
-	audience;
-	constructor(audience) {
-		this.audience = audience;
-	}
-	async resolve(token) {
-		let alg;
-		try {
-			alg = decodeJwt(token).header.alg;
-		} catch {
-			return;
-		}
-		if (alg !== JwtAlg.ES256K) return void 0;
-		const result = await verifyJwt(token, { audience: this.audience });
-		if (!result.ok) return void 0;
-		return normalizeAddress(result.payload.iss);
-	}
-};
+var TOKEN_REJECTED = Object.freeze({ rejected: true });
+function isRejectedToken(value) {
+	return typeof value === "object" && value !== null && "rejected" in value && value.rejected === true;
+}
 var StaticTokenStore = class _StaticTokenStore {
 	tokens;
 	constructor(tokens) {
@@ -80825,14 +80764,62 @@ var ChainedTokenStore = class {
 	constructor(stores) {
 		this.stores = stores;
 	}
-	async resolve(token) {
+	async resolve(token, context) {
 		for (const store of this.stores) {
-			const result = await store.resolve(token);
+			const result = await store.resolve(token, context);
+			if (isRejectedToken(result)) return result;
 			if (result !== void 0) return result;
 		}
 	}
 };
-var API_ERROR_STATUS = {
+var SelfSignedWalletJwtTokenStore = class {
+	audience;
+	options;
+	constructor(audience, options = {}) {
+		this.audience = audience;
+		this.options = options;
+	}
+	async resolve(token, context = {}) {
+		if (!isWalletJwtCandidate(token)) return void 0;
+		const isBrowser = context.origin !== void 0 || hasBrowserClaims$1(token);
+		const browser = this.options.browser;
+		if (isBrowser && browser === void 0) return TOKEN_REJECTED;
+		const isServiceProfileAllowed = this.options.isServiceProfileAllowed ?? browser === void 0;
+		if (!isBrowser && !isServiceProfileAllowed) return TOKEN_REJECTED;
+		const result = await verifyWalletJwtPolicy(token, {
+			audience: this.audience,
+			profile: isBrowser ? {
+				kind: "browser",
+				origin: context.origin,
+				allowedOrigins: browser?.allowedOrigins ?? [],
+				allowedScopes: browser?.allowedScopes ?? []
+			} : { kind: "service" }
+		});
+		if (!result.ok) return TOKEN_REJECTED;
+		return {
+			userId: result.principal,
+			kind: "wallet-jwt",
+			profile: isBrowser ? "browser" : "service",
+			scopes: result.scopes
+		};
+	}
+};
+function isWalletJwtCandidate(token) {
+	try {
+		return decodeJwt(token).header.alg === "ES256K" || hasBrowserClaims$1(token);
+	} catch {
+		return false;
+	}
+}
+function hasBrowserClaims$1(token) {
+	try {
+		const payload = decodeJwt(token).payload;
+		return typeof payload === "object" && payload !== null && !Array.isArray(payload) && ("origin" in payload || "scope" in payload);
+	} catch {
+		return false;
+	}
+}
+var API_ERROR_STATUS$1 = {
 	bad_request: 400,
 	unauthorized: 401,
 	forbidden: 403,
@@ -80849,7 +80836,7 @@ var HttpError = class extends Error {
 		super(message);
 		this.name = "HttpError";
 		this.code = code;
-		this.statusCode = API_ERROR_STATUS[code];
+		this.statusCode = API_ERROR_STATUS$1[code];
 	}
 	toErrorBody(requestId) {
 		return {
@@ -80867,11 +80854,93 @@ function registerAuth(app, tokenStore, publicPaths, options = {}) {
 		const authorization = request.headers.authorization;
 		if (!authorization?.toLowerCase().startsWith("bearer ")) throw new HttpError("unauthorized", "Missing or malformed Authorization header");
 		const token = authorization.slice(7).trim();
-		const userId = await tokenStore.resolve(token);
-		if (!userId) throw new HttpError("unauthorized", "Invalid or expired token");
-		request.userId = userId;
+		const resolution = await tokenStore.resolve(token, { origin: request.headers.origin });
+		if (!resolution || isRejectedToken(resolution)) throw new HttpError("unauthorized", "Invalid or expired token");
+		const authenticatedUser = typeof resolution === "string" ? {
+			userId: resolution,
+			kind: "opaque",
+			profile: "service",
+			scopes: []
+		} : resolution;
+		if (request.headers.origin !== void 0 && (authenticatedUser.kind !== "wallet-jwt" || authenticatedUser.profile !== "browser")) throw new HttpError("unauthorized", "Browser requests require an origin-bound wallet JWT");
+		request.authenticatedUser = authenticatedUser;
+		request.userId = authenticatedUser.userId;
 	});
 }
+var ALLOWED_METHODS = [
+	"GET",
+	"POST",
+	"DELETE",
+	"OPTIONS"
+];
+var ALLOWED_REQUEST_HEADERS = [
+	"Authorization",
+	"Content-Type",
+	"Accept"
+];
+function parseCorsOrigins(value) {
+	if (value === void 0 || value.trim().length === 0) return [];
+	const origins = value.split(",").map((origin) => origin.trim()).filter((origin) => origin.length > 0);
+	const unique = [...new Set(origins)];
+	for (const origin of unique) {
+		let parsed;
+		try {
+			parsed = new URL(origin);
+		} catch {
+			throw new Error(`Invalid CORS origin: ${origin}`);
+		}
+		if (parsed.protocol !== "http:" && parsed.protocol !== "https:" || parsed.origin !== origin) throw new Error(`CORS origin must be an exact HTTP(S) origin with no path: ${origin}`);
+	}
+	return unique;
+}
+function registerExactCors(app, options) {
+	if (options.allowedOrigins.length === 0) return;
+	const allowed = new Set(options.allowedOrigins);
+	app.addHook("onRequest", async (request, reply) => {
+		const origin = request.headers.origin;
+		setVaryOrigin(reply);
+		if (origin === void 0) return;
+		if (!allowed.has(origin)) {
+			reply.code(403).send({
+				code: "forbidden",
+				message: "Origin is not allowed"
+			});
+			return;
+		}
+		setCorsResponseHeaders(reply, origin, options.exposedHeaders ?? []);
+		if (request.method !== "OPTIONS") return;
+		if (!isValidPreflight(request)) {
+			reply.code(400).send({
+				code: "bad_request",
+				message: "Invalid CORS preflight request"
+			});
+			return;
+		}
+		reply.code(204).send();
+	});
+}
+function isValidPreflight(request) {
+	const requestedMethod = request.headers["access-control-request-method"];
+	if (requestedMethod === void 0 || !ALLOWED_METHODS.includes(requestedMethod.toUpperCase())) return false;
+	const requestedHeaders = request.headers["access-control-request-headers"];
+	if (requestedHeaders === void 0) return true;
+	const allowed = new Set(ALLOWED_REQUEST_HEADERS.map((header) => header.toLowerCase()));
+	return requestedHeaders.split(",").map((header) => header.trim().toLowerCase()).filter((header) => header.length > 0).every((header) => allowed.has(header));
+}
+function setCorsResponseHeaders(reply, origin, exposedHeaders) {
+	reply.header("access-control-allow-origin", origin);
+	reply.header("access-control-allow-methods", ALLOWED_METHODS.join(", "));
+	reply.header("access-control-allow-headers", ALLOWED_REQUEST_HEADERS.join(", "));
+	if (exposedHeaders.length > 0) reply.header("access-control-expose-headers", exposedHeaders.join(", "));
+}
+function setVaryOrigin(reply) {
+	const existing = reply.getHeader("vary");
+	if (existing === void 0) {
+		reply.header("vary", "Origin");
+		return;
+	}
+	if (!String(existing).split(",").map((value) => value.trim().toLowerCase()).includes("origin")) reply.header("vary", `${String(existing)}, Origin`);
+}
 function registerErrorHandler(app) {
 	app.setErrorHandler((error, request, reply) => {
 		const requestId = request.id;
@@ -80939,7 +81008,7 @@ function registerMetrics$1(app, options) {
 		registers: [registry]
 	});
 	app.addHook("onResponse", (request, reply, done) => {
-		const route = (request.routeOptions?.url ?? request.url ?? "unknown").split("?", 1)[0] ?? "unknown";
+		const route = request.routeOptions?.url?.split("?", 1)[0] ?? "unmatched";
 		const labels = {
 			method: request.method,
 			route,
@@ -80995,6 +81064,287 @@ var JsonSnapshotFile = class {
 	}
 };
 //#endregion
+//#region ../datalake-core/dist/node/index.mjs
+var API_ERROR_STATUS = {
+	bad_request: 400,
+	unauthorized: 401,
+	forbidden: 403,
+	not_found: 404,
+	conflict: 409,
+	unprocessable: 422,
+	rate_limited: 429,
+	internal: 500
+};
+function datalakeCollectionPath() {
+	return `/v1/datalakes`;
+}
+function datalakeResourcePath(idOrName) {
+	return `${datalakeCollectionPath()}/${encodeURIComponent(idOrName)}`;
+}
+function datalakeGrantsPath(idOrName) {
+	return `${datalakeResourcePath(idOrName)}/grants`;
+}
+function datalakeGrantPath(idOrName, principal) {
+	return `${datalakeGrantsPath(idOrName)}/${encodeURIComponent(principal)}`;
+}
+function datalakeTokensPath(idOrName) {
+	return `${datalakeResourcePath(idOrName)}/tokens`;
+}
+function datalakeHealthPath() {
+	return `/v1/health`;
+}
+var DATALAKE_HEADER_DUPLICATES = "x-datalake-duplicates";
+var DATALAKE_HEADER_REJECTED = "x-datalake-rejected";
+var DATALAKE_HEADER_NEXT_CURSOR = "x-datalake-next-cursor";
+var StrictHs256Error = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.name = "StrictHs256Error";
+		this.code = code;
+	}
+};
+function verifyStrictHs256(token, signingSecret) {
+	const parts = token.split(".");
+	if (parts.length !== 3) throw new StrictHs256Error("malformed", "Token is not a JWS compact serialization");
+	const [headerPart, payloadPart, signaturePart] = parts;
+	const header = decodeJsonObject(headerPart, "Header");
+	assertExactKeys(header, ["alg", "typ"], "Header");
+	if (header.alg !== "HS256") throw new StrictHs256Error("malformed", "Header alg must be HS256");
+	if (header.typ !== "JWT") throw new StrictHs256Error("malformed", "Header typ must be JWT");
+	const provided = decodeBase64Url(signaturePart, "Signature");
+	const expected = createHmac("sha256", signingSecret).update(`${headerPart}.${payloadPart}`).digest();
+	if (provided.length !== expected.length || !timingSafeEqual(provided, expected)) throw new StrictHs256Error("bad_signature", "Signature mismatch");
+	return { payload: decodeJsonObject(payloadPart, "Payload") };
+}
+function assertExactKeys(value, expected, label) {
+	const actual = Object.keys(value).sort();
+	const canonical = [...expected].sort();
+	if (actual.length !== canonical.length || actual.some((key, index) => key !== canonical[index])) throw new StrictHs256Error("malformed", `${label} fields must be exactly: ${canonical.join(", ")}`);
+}
+function isFiniteInteger(value) {
+	return typeof value === "number" && Number.isFinite(value) && Number.isInteger(value);
+}
+function isNonEmptyString(value) {
+	return typeof value === "string" && value.length > 0;
+}
+function decodeJsonObject(value, label) {
+	let parsed;
+	try {
+		parsed = JSON.parse(decodeBase64Url(value, label).toString("utf8"));
+	} catch (error) {
+		if (error instanceof StrictHs256Error) throw error;
+		throw new StrictHs256Error("malformed", `${label} is not valid JSON`);
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new StrictHs256Error("malformed", `${label} must be a JSON object`);
+	return parsed;
+}
+function decodeBase64Url(value, label) {
+	if (value.length === 0 || !/^[\w-]+$/.test(value)) throw new StrictHs256Error("malformed", `${label} is not canonical base64url`);
+	const decoded = Buffer.from(value, "base64url");
+	if (decoded.toString("base64url") !== value) throw new StrictHs256Error("malformed", `${label} is not canonical base64url`);
+	return decoded;
+}
+function base64UrlEncode(input) {
+	return (typeof input === "string" ? Buffer.from(input) : input).toString("base64url");
+}
+function signSessionToken(input) {
+	const issuedAt = Math.floor(Date.now() / 1e3);
+	const expiresAt = issuedAt + input.ttlSeconds;
+	const payload = {
+		sub: input.address.toLowerCase(),
+		typ: "session",
+		iat: issuedAt,
+		exp: expiresAt,
+		jti: randomBytes(8).toString("hex")
+	};
+	const toSign = `${base64UrlEncode(JSON.stringify({
+		alg: "HS256",
+		typ: "JWT"
+	}))}.${base64UrlEncode(JSON.stringify(payload))}`;
+	return {
+		token: `${toSign}.${createHmac("sha256", input.signingSecret).update(toSign).digest("base64url")}`,
+		expiresAt: (/* @__PURE__ */ new Date(expiresAt * 1e3)).toISOString()
+	};
+}
+var SessionTokenVerificationError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.name = "SessionTokenVerificationError";
+		this.code = code;
+	}
+};
+function verifySessionToken(input) {
+	let raw;
+	try {
+		raw = verifyStrictHs256(input.token, input.signingSecret).payload;
+		assertExactKeys(raw, [
+			"exp",
+			"iat",
+			"jti",
+			"sub",
+			"typ"
+		], "Payload");
+	} catch (error) {
+		if (error instanceof StrictHs256Error) throw new SessionTokenVerificationError(error.code, error.message);
+		throw error;
+	}
+	if (raw.typ !== "session") throw new SessionTokenVerificationError("wrong_type", "Not a session token");
+	if (!isNonEmptyString(raw.sub)) throw new SessionTokenVerificationError("malformed", "Payload sub must be a non-empty string");
+	if (!isNonEmptyString(raw.jti)) throw new SessionTokenVerificationError("malformed", "Payload jti must be a non-empty string");
+	if (!isFiniteInteger(raw.iat)) throw new SessionTokenVerificationError("malformed", "Payload iat must be a finite integer");
+	if (!isFiniteInteger(raw.exp)) throw new SessionTokenVerificationError("malformed", "Payload exp must be a finite integer");
+	if (raw.exp <= raw.iat) throw new SessionTokenVerificationError("malformed", "Payload exp must be greater than iat");
+	const now = input.now ?? Math.floor(Date.now() / 1e3);
+	if (raw.exp <= now) throw new SessionTokenVerificationError("expired", "Token has expired");
+	if (raw.iat > now + 60) throw new SessionTokenVerificationError("not_yet_valid", "Token issued in the future");
+	return {
+		sub: raw.sub,
+		typ: raw.typ,
+		iat: raw.iat,
+		exp: raw.exp,
+		jti: raw.jti
+	};
+}
+function signChallenge(input) {
+	const issuedAt = Math.floor(Date.now() / 1e3);
+	const expiresAt = issuedAt + input.ttlSeconds;
+	const payload = {
+		address: input.address.toLowerCase(),
+		typ: "challenge",
+		iat: issuedAt,
+		exp: expiresAt,
+		jti: randomBytes(8).toString("hex")
+	};
+	const toSign = `${base64UrlEncode(JSON.stringify({
+		alg: "HS256",
+		typ: "JWT"
+	}))}.${base64UrlEncode(JSON.stringify(payload))}`;
+	return {
+		challenge: `${toSign}.${createHmac("sha256", input.signingSecret).update(toSign).digest("base64url")}`,
+		expiresAt: (/* @__PURE__ */ new Date(expiresAt * 1e3)).toISOString()
+	};
+}
+function verifyChallenge(input) {
+	let raw;
+	try {
+		raw = verifyStrictHs256(input.challenge, input.signingSecret).payload;
+		assertExactKeys(raw, [
+			"address",
+			"exp",
+			"iat",
+			"jti",
+			"typ"
+		], "Challenge payload");
+	} catch (error) {
+		if (error instanceof StrictHs256Error) throw new SessionTokenVerificationError(error.code, error.message);
+		throw error;
+	}
+	if (raw.typ !== "challenge") throw new SessionTokenVerificationError("wrong_type", "Not a challenge token");
+	if (!isNonEmptyString(raw.address) || !/^(?:0x)?[\da-fA-F]{40}$/.test(raw.address)) throw new SessionTokenVerificationError("malformed", "Challenge address must be a 20-byte hex address");
+	if (!isNonEmptyString(raw.jti)) throw new SessionTokenVerificationError("malformed", "Challenge jti must be a non-empty string");
+	if (!isFiniteInteger(raw.iat)) throw new SessionTokenVerificationError("malformed", "Challenge iat must be a finite integer");
+	if (!isFiniteInteger(raw.exp)) throw new SessionTokenVerificationError("malformed", "Challenge exp must be a finite integer");
+	if (raw.exp <= raw.iat) throw new SessionTokenVerificationError("malformed", "Challenge exp must be greater than iat");
+	const now = input.now ?? Math.floor(Date.now() / 1e3);
+	if (raw.exp <= now) throw new SessionTokenVerificationError("expired", "Challenge has expired");
+	if (raw.iat > now + 60) throw new SessionTokenVerificationError("not_yet_valid", "Challenge issued in the future");
+	return {
+		address: raw.address,
+		typ: raw.typ,
+		iat: raw.iat,
+		exp: raw.exp,
+		jti: raw.jti
+	};
+}
+function base64UrlEncode2(input) {
+	return (typeof input === "string" ? Buffer.from(input) : input).toString("base64url");
+}
+function signToken(input) {
+	const issuedAt = Math.floor(Date.now() / 1e3);
+	const expiresAt = issuedAt + input.ttlSeconds;
+	const payload = {
+		sub: input.ownerId,
+		dl: input.datalakeId,
+		role: input.role,
+		iat: issuedAt,
+		exp: expiresAt,
+		jti: randomBytes(8).toString("hex")
+	};
+	const toSign = `${base64UrlEncode2(JSON.stringify({
+		alg: "HS256",
+		typ: "JWT"
+	}))}.${base64UrlEncode2(JSON.stringify(payload))}`;
+	return {
+		token: `${toSign}.${createHmac("sha256", input.signingSecret).update(toSign).digest("base64url")}`,
+		datalakeId: input.datalakeId,
+		role: input.role,
+		expiresAt: (/* @__PURE__ */ new Date(expiresAt * 1e3)).toISOString(),
+		url: input.url
+	};
+}
+var TokenVerificationError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.name = "TokenVerificationError";
+		this.code = code;
+	}
+};
+function verifyToken(input) {
+	let raw;
+	try {
+		raw = verifyStrictHs256(input.token, input.signingSecret).payload;
+		assertExactKeys(raw, [
+			"dl",
+			"exp",
+			"iat",
+			"jti",
+			"role",
+			"sub"
+		], "Payload");
+	} catch (error) {
+		if (error instanceof StrictHs256Error) throw new TokenVerificationError(error.code, error.message);
+		throw error;
+	}
+	if (!isNonEmptyString(raw.sub)) throw new TokenVerificationError("malformed", "Payload sub must be a non-empty string");
+	if (!isNonEmptyString(raw.dl)) throw new TokenVerificationError("malformed", "Payload dl must be a non-empty string");
+	if (raw.role !== "viewer" && raw.role !== "runner") throw new TokenVerificationError("malformed", "Payload role must be viewer or runner");
+	if (!isFiniteInteger(raw.iat)) throw new TokenVerificationError("malformed", "Payload iat must be a finite integer");
+	if (!isFiniteInteger(raw.exp)) throw new TokenVerificationError("malformed", "Payload exp must be a finite integer");
+	if (!isNonEmptyString(raw.jti)) throw new TokenVerificationError("malformed", "Payload jti must be a non-empty string");
+	if (raw.exp <= raw.iat) throw new TokenVerificationError("malformed", "Payload exp must be greater than iat");
+	const payload = {
+		sub: raw.sub,
+		dl: raw.dl,
+		role: raw.role,
+		iat: raw.iat,
+		exp: raw.exp,
+		jti: raw.jti
+	};
+	const now = input.now ?? Math.floor(Date.now() / 1e3);
+	if (payload.exp <= now) throw new TokenVerificationError("expired", "Token has expired");
+	if (payload.iat > now + 60) throw new TokenVerificationError("not_yet_valid", "Token issued in the future");
+	return payload;
+}
+var PUBLIC_PRINCIPAL = "public";
+function isPublicPrincipal(principal) {
+	return principal === PUBLIC_PRINCIPAL;
+}
+var DATALAKE_CONTROL_OPERATIONS = [
+	"datalake:create",
+	"datalake:describe",
+	"datalake:list"
+];
+var DATALAKE_DATA_OPERATIONS = [
+	"payload:append",
+	"payload:read",
+	"usage:read"
+];
+DATALAKE_CONTROL_OPERATIONS.join(" ");
+DATALAKE_DATA_OPERATIONS.join(" ");
+//#endregion
 //#region ../../node_modules/.pnpm/reusify@1.1.0/node_modules/reusify/reusify.js
 var require_reusify = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	function reusify(Constructor) {
@@ -111141,6 +111491,7 @@ function registerAuthRoutes(app, deps) {
 	const challengeTtl = deps.challengeTtlSeconds ?? 300;
 	const sessionTtl = deps.sessionTtlSeconds ?? 1440 * 60;
 	app.post(AUTH_CHALLENGE_PATH, async (request) => {
+		requireServiceOnlyRequest(request);
 		const address = request.body?.address;
 		if (!address || !isLikelyAddress(address)) throw new HttpError("bad_request", "address is required (0x-prefixed 20-byte hex)");
 		const { challenge, expiresAt } = signChallenge({
@@ -111154,6 +111505,7 @@ function registerAuthRoutes(app, deps) {
 		};
 	});
 	app.post(AUTH_VERIFY_PATH, async (request) => {
+		requireServiceOnlyRequest(request);
 		const { address, challenge, signature } = request.body ?? {};
 		if (!address || !challenge || !signature) throw new HttpError("bad_request", "address, challenge, and signature are required");
 		if (!isLikelyAddress(address)) throw new HttpError("bad_request", "address must be 0x-prefixed 20-byte hex");
@@ -111187,6 +111539,9 @@ function registerAuthRoutes(app, deps) {
 		};
 	});
 }
+function requireServiceOnlyRequest(request) {
+	if (request.headers.origin !== void 0) throw new HttpError("forbidden", "Legacy challenge/session authentication is service-only");
+}
 function isLikelyAddress(value) {
 	return /^0x[a-fA-F0-9]{40}$/.test(value);
 }
@@ -111197,6 +111552,7 @@ function registerDatalakeRoutes(app, deps) {
 	const idGenerator = deps.idGenerator ?? defaultIdGenerator;
 	const originUrl = deps.datalakeOriginUrl.replace(/\/$/, "");
 	app.post(datalakeCollectionPath(), async (request) => {
+		requireControlOperation(request, "datalake:create");
 		const body = request.body;
 		if (!body || typeof body.name !== "string" || !body.config) throw new HttpError("bad_request", "name and config are required");
 		if (await deps.store.findByIdOrName(request.userId, body.name)) throw new HttpError("conflict", `Datalake already exists: ${body.name}`);
@@ -111211,21 +111567,25 @@ function registerDatalakeRoutes(app, deps) {
 		return descriptor;
 	});
 	app.get(datalakeCollectionPath(), async (request) => {
+		requireControlOperation(request, "datalake:list");
 		return deps.store.listByOwner(request.userId);
 	});
 	app.get(`${datalakeCollectionPath()}/:idOrName`, async (request) => {
+		requireControlOperation(request, "datalake:describe");
 		return requireDatalake(deps, request.userId, request.params.idOrName);
 	});
 	app.delete(`${datalakeCollectionPath()}/:idOrName`, async (request, reply) => {
+		requireControlOperation(request);
 		const descriptor = await requireDatalake(deps, request.userId, request.params.idOrName);
 		await deps.store.remove(descriptor.id);
 		reply.code(204).send();
 	});
 	app.post(`${datalakeResourcePath(":idOrName")}/grants`.replaceAll("%3A", ":"), async (request) => {
+		requireControlOperation(request);
 		const body = request.body;
 		if (!body || typeof body.principal !== "string" || !body.role) throw new HttpError("bad_request", "principal and role are required");
 		if (body.role !== "viewer" && body.role !== "runner") throw new HttpError("unprocessable", `Invalid role: ${String(body.role)}`);
-		const principal = normalizePrincipal(body.principal);
+		const principal = normalizePrincipal$1(body.principal);
 		const descriptor = await requireDatalake(deps, request.userId, request.params.idOrName);
 		return deps.store.upsertAcl(descriptor.id, {
 			principal,
@@ -111236,12 +111596,14 @@ function registerDatalakeRoutes(app, deps) {
 	});
 	const grantPathPattern = datalakeGrantPath(":idOrName", ":principal").replaceAll("%3A", ":");
 	app.delete(grantPathPattern, async (request) => {
-		const principal = normalizePrincipal(request.params.principal);
+		requireControlOperation(request);
+		const principal = normalizePrincipal$1(request.params.principal);
 		const descriptor = await requireDatalake(deps, request.userId, request.params.idOrName);
 		return deps.store.removeAcl(descriptor.id, principal);
 	});
 	const tokensPathPattern = datalakeTokensPath(":idOrName").replaceAll("%3A", ":");
 	app.post(tokensPathPattern, async (request) => {
+		requireControlOperation(request);
 		const body = request.body;
 		if (!body?.role) throw new HttpError("bad_request", "role is required");
 		if (body.role !== "viewer" && body.role !== "runner") throw new HttpError("unprocessable", `Invalid role: ${String(body.role)}`);
@@ -111260,19 +111622,39 @@ function registerDatalakeRoutes(app, deps) {
 		});
 	});
 }
+function requireControlOperation(request, operation) {
+	const auth = request.authenticatedUser;
+	if (request.headers.origin !== void 0 && (auth.kind !== "wallet-jwt" || auth.profile !== "browser")) throw new HttpError("forbidden", "Browser requests require an origin-bound wallet JWT");
+	if (auth.kind !== "wallet-jwt" || auth.profile !== "browser") return;
+	if (operation === void 0 || !auth.scopes.includes(operation)) throw new HttpError("forbidden", "Browser wallet JWT does not authorize this operation");
+}
 async function requireDatalake(deps, ownerId, idOrName) {
 	const descriptor = await deps.store.findByIdOrName(ownerId, idOrName);
 	if (!descriptor) throw new HttpError("not_found", `Datalake not found: ${idOrName}`);
 	return descriptor;
 }
 var ADDRESS_PATTERN = /^(0x)?[\da-fA-F]{40}$/;
-function normalizePrincipal(value) {
+function normalizePrincipal$1(value) {
 	if (isPublicPrincipal(value)) return value;
 	if (ADDRESS_PATTERN.test(value)) return normalizeAddress(value);
 	return value;
 }
 async function buildServer(options) {
-	const app = (0, import_fastify.default)({ logger: options.logger ?? false });
+	const app = (0, import_fastify.default)({
+		logger: options.logger ?? false,
+		logController: new import_fastify.LogController({ disableRequestLogging: true })
+	});
+	registerExactCors(app, {
+		allowedOrigins: options.corsOrigins ?? [],
+		exposedHeaders: [
+			DATALAKE_HEADER_DUPLICATES,
+			DATALAKE_HEADER_REJECTED,
+			DATALAKE_HEADER_NEXT_CURSOR,
+			"x-ratelimit-limit",
+			"x-ratelimit-remaining",
+			"retry-after"
+		]
+	});
 	registerErrorHandler(app);
 	registerAuth(app, options.tokenStore, [
 		datalakeHealthPath(),
@@ -111498,29 +111880,253 @@ function escapeRegex(input) {
 	return input.replaceAll(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`);
 }
 //#endregion
+//#region src/errors/planeErrors.ts
+/**
+* Thrown inside data-plane handlers to produce a structured JSON error.
+* Distinct from the control-plane `HttpError` only for type hygiene; the
+* wire format is identical.
+*/
+var PlaneHttpError = class extends Error {
+	code;
+	statusCode;
+	constructor(code, message) {
+		super(message);
+		this.name = "PlaneHttpError";
+		this.code = code;
+		this.statusCode = API_ERROR_STATUS[code];
+	}
+};
+function toPlaneErrorBody(error, requestId) {
+	return {
+		code: error.code,
+		message: error.message,
+		requestId
+	};
+}
+//#endregion
+//#region src/auth/accessContext.ts
+const VIEWER_OPERATIONS = ["payload:read", "usage:read"];
+const RUNNER_OPERATIONS = [
+	...DATALAKE_DATA_OPERATIONS,
+	"payload:clear",
+	"payload:delete"
+];
+/** Resolves and attaches access once, before quota and route authorization. */
+function registerAccessContext(app, options) {
+	app.addHook("preHandler", async (request) => {
+		const datalakeId = extractDatalakeId$2(request);
+		if (datalakeId === void 0) return;
+		request.datalakeAccess = await resolveAccess({
+			allowedOrigins: options.allowedOrigins,
+			authorizationHeader: request.headers.authorization,
+			controlStore: options.controlStore,
+			datalakeId,
+			origin: request.headers.origin,
+			isServiceWalletJwtAllowed: options.isServiceWalletJwtAllowed,
+			signingSecret: options.signingSecret
+		});
+	});
+}
+/**
+* Non-throwing access resolution keeps invalid credentials available to the
+* later anonymous-IP rate limiter. Routes call `requireAccessContext` to
+* surface the stored error and enforce their operation without re-verifying.
+*/
+async function resolveAccess(input) {
+	const descriptor = await input.controlStore.findById(input.datalakeId);
+	if (!descriptor) return failure(false, new PlaneHttpError("not_found", `Datalake not found: ${input.datalakeId}`));
+	const tokenValue = extractBearer(input.authorizationHeader);
+	if (tokenValue !== void 0) {
+		const verified = await verifyBearer(tokenValue, descriptor, input);
+		if (!verified.ok) return {
+			authenticated: false,
+			descriptor,
+			error: new PlaneHttpError("unauthorized", verified.message)
+		};
+		const maxRole = findLiveRole(descriptor, verified.principal);
+		if (maxRole === void 0) return {
+			authenticated: true,
+			descriptor,
+			principal: verified.principal,
+			error: new PlaneHttpError("forbidden", "Verified principal has no live access to this datalake")
+		};
+		const effectiveOperations = intersectOperations(verified.operations, operationsForRole(maxRole));
+		const context = {
+			authenticated: true,
+			descriptor,
+			principal: verified.principal,
+			maxRole,
+			effectiveOperations
+		};
+		return {
+			authenticated: true,
+			descriptor,
+			principal: verified.principal,
+			context
+		};
+	}
+	const publicRole = findPublicLiveRole(descriptor);
+	if (publicRole !== void 0) return {
+		authenticated: false,
+		descriptor,
+		context: {
+			authenticated: false,
+			descriptor,
+			maxRole: publicRole,
+			effectiveOperations: operationsForRole(publicRole)
+		}
+	};
+	return {
+		authenticated: false,
+		descriptor,
+		error: new PlaneHttpError("unauthorized", "Authentication required")
+	};
+}
+function requireAccessContext(request, operation) {
+	const resolution = request.datalakeAccess;
+	if (resolution?.error !== void 0) throw resolution.error;
+	const context = resolution?.context;
+	if (context === void 0) throw new PlaneHttpError("internal", "Datalake access context is missing");
+	if (!context.effectiveOperations.includes(operation)) throw new PlaneHttpError("forbidden", `Operation ${operation} is not authorized`);
+	return context;
+}
+async function verifyBearer(token, descriptor, input) {
+	if (isEs256kJwt(token)) return verifyWalletBearer(token, descriptor, input);
+	if (input.origin !== void 0) return {
+		ok: false,
+		message: "Browser requests require an origin-bound wallet JWT"
+	};
+	try {
+		const payload = verifyToken({
+			token,
+			signingSecret: input.signingSecret
+		});
+		if (payload.dl !== descriptor.id) return {
+			ok: false,
+			message: "Token is not scoped to this datalake"
+		};
+		return {
+			ok: true,
+			principal: normalizePrincipal(payload.sub),
+			operations: operationsForRole(payload.role)
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			message: error instanceof Error ? error.message : "Invalid token"
+		};
+	}
+}
+async function verifyWalletBearer(token, descriptor, input) {
+	const isBrowser = input.origin !== void 0 || hasBrowserClaims(token);
+	if (!isBrowser && !input.isServiceWalletJwtAllowed) return {
+		ok: false,
+		message: "Non-browser wallet JWT profile is not enabled"
+	};
+	const result = await verifyWalletJwtPolicy(token, {
+		audience: descriptor.id,
+		profile: isBrowser ? {
+			kind: "browser",
+			origin: input.origin,
+			allowedOrigins: input.allowedOrigins,
+			allowedScopes: DATALAKE_DATA_OPERATIONS
+		} : { kind: "service" }
+	});
+	if (!result.ok) return {
+		ok: false,
+		message: `Wallet JWT verification failed: ${result.reasons.join("; ")}`
+	};
+	return {
+		ok: true,
+		principal: result.principal,
+		operations: isBrowser ? result.scopes : RUNNER_OPERATIONS
+	};
+}
+function findLiveRole(descriptor, principal) {
+	if (normalizePrincipal(descriptor.ownerId) === principal) return "runner";
+	let role;
+	for (const candidate of descriptor.acl) {
+		if (isPublicPrincipal(candidate.principal) || normalizePrincipal(candidate.principal) !== principal) continue;
+		if (candidate.role === "runner") return "runner";
+		role = "viewer";
+	}
+	return role;
+}
+function findPublicLiveRole(descriptor) {
+	let role;
+	for (const candidate of descriptor.acl) {
+		if (!isPublicPrincipal(candidate.principal)) continue;
+		if (candidate.role === "runner") return "runner";
+		role = "viewer";
+	}
+	return role;
+}
+function operationsForRole(role) {
+	return role === "runner" ? RUNNER_OPERATIONS : VIEWER_OPERATIONS;
+}
+function intersectOperations(tokenOperations, liveOperations) {
+	const live = new Set(liveOperations);
+	return tokenOperations.filter((operation) => live.has(operation));
+}
+function isEs256kJwt(token) {
+	try {
+		return decodeJwt(token).header.alg === JwtAlg.ES256K;
+	} catch {
+		return false;
+	}
+}
+function hasBrowserClaims(token) {
+	try {
+		const payload = decodeJwt(token).payload;
+		return typeof payload === "object" && payload !== null && !Array.isArray(payload) && ("origin" in payload || "scope" in payload);
+	} catch {
+		return false;
+	}
+}
+function extractBearer(authorization) {
+	if (authorization === void 0 || !authorization.toLowerCase().startsWith("bearer ")) return void 0;
+	const value = authorization.slice(7).trim();
+	return value.length > 0 ? value : void 0;
+}
+function normalizePrincipal(value) {
+	if (/^(?:0x)?[\da-fA-F]{40}$/.test(value)) return normalizeAddress(value);
+	return value;
+}
+function extractDatalakeId$2(request) {
+	const value = request.params?.id;
+	return typeof value === "string" ? value : void 0;
+}
+function failure(authenticated, error) {
+	return {
+		authenticated,
+		error
+	};
+}
+//#endregion
 //#region src/plugins/auditPlugin.ts
 const START_TIME_KEY = "__ariesAuditStart__";
 /**
 * Installs onRequest + onResponse hooks that record one JSONL row per
 * request to the configured `AuditLogger`. Health checks are skipped.
 */
-function registerAudit(app, logger) {
+function registerAudit(app, logger, principalHashSecret) {
 	app.addHook("onRequest", async (request) => {
 		request[START_TIME_KEY] = Date.now();
 	});
 	app.addHook("onResponse", async (request, reply) => {
-		const pathname = (request.raw.url ?? request.url).split("?", 1)[0] ?? "";
-		if (pathname.endsWith("/health")) return;
+		const path = routeTemplate(request);
+		if (path.endsWith("/health")) return;
 		const start = request[START_TIME_KEY] ?? Date.now();
 		const durationMs = Date.now() - start;
-		const { subject, authenticated } = resolveSubject$1(request);
+		const { subject, authenticated } = resolveSubject$1(request, principalHashSecret);
 		const datalakeId = extractDatalakeId$1(request);
+		const datalakeSubject = datalakeId === void 0 ? void 0 : `datalake:${stableDatalakeHash(datalakeId, principalHashSecret)}`;
 		logger.log({
 			time: (/* @__PURE__ */ new Date()).toISOString(),
 			requestId: request.id,
 			method: request.method,
-			path: pathname,
-			datalakeId,
+			path,
+			datalakeSubject,
 			subject,
 			authenticated,
 			statusCode: reply.statusCode,
@@ -111529,49 +112135,33 @@ function registerAudit(app, logger) {
 		});
 	});
 }
-function resolveSubject$1(request) {
-	const authorization = request.headers.authorization;
-	if (authorization?.toLowerCase().startsWith("bearer ")) {
-		const token = authorization.slice(7).trim();
-		return {
-			subject: `auth:${createHash("sha256").update(token).digest("hex").slice(0, 16)}`,
-			authenticated: true
-		};
-	}
+function resolveSubject$1(request, principalHashSecret) {
+	const principal = request.datalakeAccess?.principal;
+	if (principal !== void 0) return {
+		subject: `principal:${stablePrincipalHash(principal, principalHashSecret)}`,
+		authenticated: true
+	};
 	return {
 		subject: `anonymous:${request.ip}`,
 		authenticated: false
 	};
 }
+function stablePrincipalHash(principal, secret) {
+	return createHmac("sha256", secret).update("aries-datalake-principal-v1\0").update(principal).digest("hex").slice(0, 32);
+}
+function stableDatalakeHash(datalakeId, secret) {
+	return createHmac("sha256", secret).update("aries-datalake-id-v1\0").update(datalakeId).digest("hex").slice(0, 32);
+}
+function routeTemplate(request) {
+	const route = request.routeOptions?.url;
+	if (typeof route !== "string" || route.length === 0) return "unmatched";
+	return route.split("?", 1)[0] ?? "unmatched";
+}
 function extractDatalakeId$1(request) {
 	const value = request.params?.id;
 	return typeof value === "string" ? value : void 0;
 }
 //#endregion
-//#region src/errors/planeErrors.ts
-/**
-* Thrown inside data-plane handlers to produce a structured JSON error.
-* Distinct from the control-plane `HttpError` only for type hygiene; the
-* wire format is identical.
-*/
-var PlaneHttpError = class extends Error {
-	code;
-	statusCode;
-	constructor(code, message) {
-		super(message);
-		this.name = "PlaneHttpError";
-		this.code = code;
-		this.statusCode = API_ERROR_STATUS$1[code];
-	}
-};
-function toPlaneErrorBody(error, requestId) {
-	return {
-		code: error.code,
-		message: error.message,
-		requestId
-	};
-}
-//#endregion
 //#region src/plugins/errorHandler.ts
 function registerPlaneErrorHandler(app) {
 	app.setErrorHandler((error, request, reply) => {
@@ -111695,7 +112285,7 @@ function registerMetrics(app) {
 		registers: [registry]
 	});
 	app.addHook("onResponse", (request, reply, done) => {
-		const route = (request.routeOptions?.url ?? request.url ?? "unknown").split("?", 1)[0] ?? "unknown";
+		const route = request.routeOptions?.url?.split("?", 1)[0] ?? "unmatched";
 		const labels = {
 			method: request.method,
 			route,
@@ -111718,17 +112308,15 @@ function registerMetrics(app) {
 * request. Fires after route matching, so the health endpoint (no `:id`
 * param) is not rate limited.
 *
-* For keying purposes the plugin peeks at the Authorization header but does
-* not verify it — verification is the route handler's job. The keying is
-* tolerant of forged tokens because an unverified attacker still ends up
-* in their own bucket (and 401s at the route handler).
+* Access resolution runs first. Verified tokens key by stable principal;
+* missing or invalid credentials consume the anonymous IP bucket.
 */
 function registerRateLimit(app, deps) {
 	const config = "check" in deps ? { limiter: deps } : deps;
 	app.addHook("preHandler", async (request, reply) => {
 		const datalakeId = extractDatalakeId(request);
 		if (!datalakeId) return;
-		const override = await resolveOverride(config.controlStore, datalakeId);
+		const override = resolveOverride(request);
 		const { subject, authenticated } = resolveSubject(request);
 		const decision = config.limiter.check({
 			datalakeId,
@@ -111748,22 +112336,18 @@ function extractDatalakeId(request) {
 	return typeof value === "string" ? value : void 0;
 }
 function resolveSubject(request) {
-	const authorization = request.headers.authorization;
-	if (authorization?.toLowerCase().startsWith("bearer ")) {
-		const token = authorization.slice(7).trim();
-		return {
-			subject: `auth:${createHash("sha256").update(token).digest("hex").slice(0, 16)}`,
-			authenticated: true
-		};
-	}
+	const principal = request.datalakeAccess?.principal;
+	if (principal !== void 0) return {
+		subject: `auth:${principal}`,
+		authenticated: true
+	};
 	return {
 		subject: `anonymous:${request.ip}`,
 		authenticated: false
 	};
 }
-async function resolveOverride(store, datalakeId) {
-	if (!store) return void 0;
-	return (await store.findById(datalakeId))?.config.rateLimits;
+function resolveOverride(request) {
+	return request.datalakeAccess?.descriptor?.config.rateLimits;
 }
 //#endregion
 //#region src/rateLimit/TokenBucketRateLimiter.ts
@@ -111859,119 +112443,11 @@ function registerPlaneHealthRoute(app, version) {
 	});
 }
 //#endregion
-//#region src/auth/accessContext.ts
-const ROLE_RANK = {
-	viewer: 1,
-	runner: 2
-};
-/**
-* Resolves whether a request may proceed. Order of precedence:
-*
-*  1. A valid bearer token scoped to this datalake → authenticated, uses the
-*     role encoded in the JWT.
-*  2. No token but the datalake has a `public` ACL grant with at least the
-*     required role → unauthenticated public access.
-*
-* Any other state is an error: 401 for bad/missing creds on a private
-* datalake, 403 for insufficient role.
-*/
-async function resolveAccess(input) {
-	const descriptor = await input.controlStore.findById(input.datalakeId);
-	if (!descriptor) throw new PlaneHttpError("not_found", `Datalake not found: ${input.datalakeId}`);
-	const tokenValue = extractBearer(input.authorizationHeader);
-	if (tokenValue) {
-		if (isWalletJwt(tokenValue)) {
-			const result = await resolveWalletJwt(tokenValue, descriptor);
-			ensureRole(result.role, input.requiredRole);
-			return {
-				descriptor,
-				role: result.role,
-				authenticated: true,
-				token: result.token
-			};
-		}
-		const payload = verifyBearer(tokenValue, input.signingSecret, descriptor.id);
-		ensureRole(payload.role, input.requiredRole);
-		return {
-			descriptor,
-			role: payload.role,
-			authenticated: true,
-			token: payload
-		};
-	}
-	const publicGrant = descriptor.acl.find((entry) => isPublicPrincipal(entry.principal));
-	if (publicGrant) {
-		ensureRole(publicGrant.role, input.requiredRole);
-		return {
-			descriptor,
-			role: publicGrant.role,
-			authenticated: false
-		};
-	}
-	throw new PlaneHttpError("unauthorized", "Authentication required");
-}
-function extractBearer(authorization) {
-	if (!authorization) return void 0;
-	if (!authorization.toLowerCase().startsWith("bearer ")) return void 0;
-	return authorization.slice(7).trim();
-}
-function verifyBearer(token, signingSecret, datalakeId) {
-	try {
-		const payload = verifyToken({
-			token,
-			signingSecret
-		});
-		if (payload.dl !== datalakeId) throw new PlaneHttpError("forbidden", "Token is not scoped to this datalake");
-		return payload;
-	} catch (error) {
-		if (error instanceof PlaneHttpError) throw error;
-		throw new PlaneHttpError("unauthorized", error instanceof Error ? error.message : "Invalid token");
-	}
-}
-function ensureRole(granted, required) {
-	if (ROLE_RANK[granted] < ROLE_RANK[required]) throw new PlaneHttpError("forbidden", `Role ${granted} is insufficient; ${required} required`);
-}
-function isWalletJwt(token) {
-	try {
-		return decodeJwt(token).header.alg === JwtAlg.ES256K;
-	} catch {
-		return false;
-	}
-}
-async function resolveWalletJwt(token, descriptor) {
-	const result = await verifyJwt(token, { audience: descriptor.id });
-	if (!result.ok) throw new PlaneHttpError("unauthorized", `Wallet JWT verification failed: ${result.reasons.join("; ")}`);
-	const callerAddress = normalizeAddress(result.payload.iss);
-	const ownerAddress = normalizeAddress(descriptor.ownerId);
-	let role;
-	if (callerAddress === ownerAddress) role = "runner";
-	else role = descriptor.acl.find((e) => !isPublicPrincipal(e.principal) && normalizeAddress(e.principal) === callerAddress)?.role;
-	if (!role) throw new PlaneHttpError("forbidden", `Address ${callerAddress} has no access to this datalake`);
-	const synthesized = {
-		sub: callerAddress,
-		dl: descriptor.id,
-		role,
-		iat: result.payload.iat,
-		exp: result.payload.exp,
-		jti: `wallet:${callerAddress}:${result.payload.iat}`
-	};
-	return {
-		role,
-		token: synthesized
-	};
-}
-//#endregion
 //#region src/routes/payloadRoutes.ts
 const PLANE_PREFIX$1 = `/v1/datalakes/:id`;
 function registerPayloadRoutes(app, deps) {
 	app.post(`${PLANE_PREFIX$1}/insert`, async (request, reply) => {
-		const access = await resolveAccess({
-			controlStore: deps.controlStore,
-			signingSecret: deps.signingSecret,
-			datalakeId: request.params.id,
-			authorizationHeader: request.headers.authorization,
-			requiredRole: "runner"
-		});
+		const access = requireAccessContext(request, "payload:append");
 		const payloads = normalizeInsertBody(request.body);
 		if (payloads.length === 0) {
 			setInsertSummaryHeaders(reply, 0, []);
@@ -111984,38 +112460,20 @@ function registerPayloadRoutes(app, deps) {
 		return result.inserted;
 	});
 	app.post(`${PLANE_PREFIX$1}/get`, async (request) => {
-		const access = await resolveAccess({
-			controlStore: deps.controlStore,
-			signingSecret: deps.signingSecret,
-			datalakeId: request.params.id,
-			authorizationHeader: request.headers.authorization,
-			requiredRole: "viewer"
-		});
+		const access = requireAccessContext(request, "payload:read");
 		const hashes = parseHashesBody(request.body);
 		if (hashes.length === 0) throw new PlaneHttpError("bad_request", "Body must be a non-empty array of hashes");
 		if (hashes.length > deps.maxPageSize) throw new PlaneHttpError("unprocessable", `Cannot request more than ${deps.maxPageSize} hashes per call`);
 		return deps.payloadStore.get(access.descriptor.id, hashes);
 	});
 	app.get(`${PLANE_PREFIX$1}/get/:hash`, async (request) => {
-		const access = await resolveAccess({
-			controlStore: deps.controlStore,
-			signingSecret: deps.signingSecret,
-			datalakeId: request.params.id,
-			authorizationHeader: request.headers.authorization,
-			requiredRole: "viewer"
-		});
+		const access = requireAccessContext(request, "payload:read");
 		const [payload] = await deps.payloadStore.get(access.descriptor.id, [request.params.hash]);
 		if (!payload) throw new PlaneHttpError("not_found", `Payload not found: ${request.params.hash}`);
 		return payload;
 	});
 	app.get(`${PLANE_PREFIX$1}/next`, async (request, reply) => {
-		const access = await resolveAccess({
-			controlStore: deps.controlStore,
-			signingSecret: deps.signingSecret,
-			datalakeId: request.params.id,
-			authorizationHeader: request.headers.authorization,
-			requiredRole: "viewer"
-		});
+		const access = requireAccessContext(request, "payload:read");
 		const options = {
 			limit: request.query.limit === void 0 ? void 0 : Number(request.query.limit),
 			cursor: request.query.cursor,
@@ -112025,35 +112483,17 @@ function registerPayloadRoutes(app, deps) {
 		return runNext(deps, access.descriptor.id, options, reply);
 	});
 	app.post(`${PLANE_PREFIX$1}/next`, async (request, reply) => {
-		const access = await resolveAccess({
-			controlStore: deps.controlStore,
-			signingSecret: deps.signingSecret,
-			datalakeId: request.params.id,
-			authorizationHeader: request.headers.authorization,
-			requiredRole: "viewer"
-		});
+		const access = requireAccessContext(request, "payload:read");
 		const options = request.body ?? {};
 		return runNext(deps, access.descriptor.id, options, reply);
 	});
 	app.delete(`${PLANE_PREFIX$1}/delete/:hash`, async (request, reply) => {
-		const access = await resolveAccess({
-			controlStore: deps.controlStore,
-			signingSecret: deps.signingSecret,
-			datalakeId: request.params.id,
-			authorizationHeader: request.headers.authorization,
-			requiredRole: "runner"
-		});
+		const access = requireAccessContext(request, "payload:delete");
 		if (!await deps.payloadStore.delete(access.descriptor.id, request.params.hash)) throw new PlaneHttpError("not_found", `Payload not found: ${request.params.hash}`);
 		reply.code(204).send();
 	});
 	app.post(`${PLANE_PREFIX$1}/clear`, async (request) => {
-		const access = await resolveAccess({
-			controlStore: deps.controlStore,
-			signingSecret: deps.signingSecret,
-			datalakeId: request.params.id,
-			authorizationHeader: request.headers.authorization,
-			requiredRole: "runner"
-		});
+		const access = requireAccessContext(request, "payload:clear");
 		return { removed: await deps.payloadStore.clear(access.descriptor.id) };
 	});
 }
@@ -112127,13 +112567,7 @@ const PLANE_PREFIX = `/v1/datalakes/:id`;
 */
 function registerUsageRoute(app, deps) {
 	app.get(`${PLANE_PREFIX}/usage`, async (request) => {
-		const access = await resolveAccess({
-			controlStore: deps.controlStore,
-			signingSecret: deps.signingSecret,
-			datalakeId: request.params.id,
-			authorizationHeader: request.headers.authorization,
-			requiredRole: "viewer"
-		});
+		const access = requireAccessContext(request, "usage:read");
 		const descriptor = access.descriptor;
 		const payloadCount = await deps.payloadStore.count(descriptor.id);
 		const response = {
@@ -112142,10 +112576,10 @@ function registerUsageRoute(app, deps) {
 		};
 		if (deps.rateLimiter) {
 			const override = descriptor.config.rateLimits;
-			const authSubject = access.token?.sub ?? descriptor.ownerId;
+			const authSubject = access.principal ?? descriptor.ownerId;
 			const authPeek = deps.rateLimiter.peek({
 				datalakeId: descriptor.id,
-				subject: `auth-peek:${authSubject}`
+				subject: `auth:${authSubject}`
 			}, true, override);
 			const anonPeek = deps.rateLimiter.peek({
 				datalakeId: descriptor.id,
@@ -112173,11 +112607,29 @@ function registerUsageRoute(app, deps) {
 */
 async function buildPlaneServer(options) {
 	const app = (0, import_fastify.default)({
+		bodyLimit: 10 * 1024 * 1024,
 		logger: options.logger ?? false,
-		bodyLimit: 10 * 1024 * 1024
+		logController: new import_fastify.LogController({ disableRequestLogging: true })
+	});
+	registerExactCors(app, {
+		allowedOrigins: options.corsOrigins ?? [],
+		exposedHeaders: [
+			DATALAKE_HEADER_DUPLICATES,
+			DATALAKE_HEADER_REJECTED,
+			DATALAKE_HEADER_NEXT_CURSOR,
+			"x-ratelimit-limit",
+			"x-ratelimit-remaining",
+			"retry-after"
+		]
 	});
 	registerGzipJsonParser(app);
 	registerPlaneErrorHandler(app);
+	registerAccessContext(app, {
+		allowedOrigins: options.corsOrigins ?? [],
+		controlStore: options.controlStore,
+		isServiceWalletJwtAllowed: options.isServiceWalletJwtAllowed ?? false,
+		signingSecret: options.signingSecret
+	});
 	let limiter;
 	if (options.rateLimiter !== false) {
 		limiter = options.rateLimiter ?? new TokenBucketRateLimiter({
@@ -112185,26 +112637,19 @@ async function buildPlaneServer(options) {
 			anonymousPerMinute: 20,
 			burstFactor: 2
 		});
-		registerRateLimit(app, {
-			limiter,
-			controlStore: options.controlStore
-		});
+		registerRateLimit(app, { limiter });
 	}
-	registerAudit(app, options.auditLogger ?? new NullAuditLogger());
+	registerAudit(app, options.auditLogger ?? new NullAuditLogger(), options.auditPrincipalSecret ?? options.signingSecret);
 	registerMetrics(app);
 	registerPlaneHealthRoute(app, options.version);
 	const maxInsertBatch = options.maxInsertBatch ?? 1e3;
 	registerPayloadRoutes(app, {
-		controlStore: options.controlStore,
 		payloadStore: options.payloadStore,
-		signingSecret: options.signingSecret,
 		maxInsertBatch,
 		maxPageSize: options.maxPageSize ?? 1e3
 	});
 	registerUsageRoute(app, {
-		controlStore: options.controlStore,
 		payloadStore: options.payloadStore,
-		signingSecret: options.signingSecret,
 		rateLimiter: limiter
 	});
 	return app;
@@ -112401,6 +112846,7 @@ const PERSIST_DIR = process.env.DATALAKE_PERSIST_DIR;
 const AUDIT_LOG = process.env.DATALAKE_AUDIT_LOG;
 const AUDIT_DIR = process.env.DATALAKE_AUDIT_DIR;
 const AUDIT_MAX_AGE = process.env.DATALAKE_AUDIT_MAX_AGE_DAYS;
+const CORS_ORIGINS = parseCorsOrigins(process.env.DATALAKE_CORS_ORIGINS);
 function makeStores() {
 	if (!PERSIST_DIR) return {
 		controlStore: new InMemoryDatalakeStore(),
@@ -112414,7 +112860,13 @@ function makeStores() {
 	};
 }
 function makeTokenStore() {
-	const stores = [new SelfSignedWalletJwtTokenStore(DATALAKE_CONTROL_AUDIENCE), new WalletJwtTokenStore(SIGNING_SECRET)];
+	const stores = [new SelfSignedWalletJwtTokenStore(DATALAKE_CONTROL_AUDIENCE, {
+		browser: {
+			allowedOrigins: CORS_ORIGINS,
+			allowedScopes: DATALAKE_CONTROL_OPERATIONS
+		},
+		isServiceProfileAllowed: true
+	}), new WalletJwtTokenStore(SIGNING_SECRET)];
 	const labels = [`self-signed-jwt(aud=${DATALAKE_CONTROL_AUDIENCE})`, "session-jwt"];
 	const staticTokens = process.env.DATALAKE_CONTROL_TOKENS;
 	if (staticTokens && staticTokens.length > 0) {
@@ -112456,7 +112908,8 @@ async function main() {
 		datalakeOriginUrl: DATALAKE_ORIGIN_URL,
 		tokenSigningSecret: SIGNING_SECRET,
 		version: VERSION,
-		logger: { level: process.env.LOG_LEVEL ?? "info" }
+		logger: { level: process.env.LOG_LEVEL ?? "info" },
+		corsOrigins: CORS_ORIGINS
 	});
 	const { logger: auditLogger, description: auditDescription } = makeAuditLogger();
 	const plane = await buildPlaneServer({
@@ -112465,7 +112918,9 @@ async function main() {
 		signingSecret: SIGNING_SECRET,
 		version: VERSION,
 		logger: { level: process.env.LOG_LEVEL ?? "info" },
-		auditLogger
+		auditLogger,
+		corsOrigins: CORS_ORIGINS,
+		isServiceWalletJwtAllowed: true
 	});
 	await control.listen({
 		port: CONTROL_PORT,