@opendatalabs/personal-server-ts-core 0.0.1-canary.01ca694 → 0.0.1-canary.052d47e

package/dist/write/authorize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../src/write/authorize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EACL,qBAAqB,GAEtB,MAAM,yBAAyB,CAAC;AAMjC,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EACL,qBAAqB,GAGtB,MAAM,cAAc,CAAC;AA2CtB,gEAAgE;AAChE,MAAM,UAAU,uBAAuB,CAAC,OAAgB;IACtD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB;IACtC,OAAO,IAAI,aAAa,CACtB,GAAG,EACH,uBAAuB,EACvB,0FAA0F,CAC3F,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,IAAmC;IAEnC,KAAK,UAAU,WAAW,CAAC,OAAgB;QACzC,MAAM,KAAK,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC;QAC9C,OAAO,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,MAAM,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9E,CAAC;IAED,OAAO;QACL,KAAK,CAAC,qBAAqB,CAAC,KAAK;YAC/B,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACjD,IAAI,CAAC,OAAO;gBAAE,OAAO,SAAS,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,WAAW;gBAAE,MAAM,wBAAwB,EAAE,CAAC;YACxD,sEAAsE;YACtE,uEAAuE;YACvE,8BAA8B;YAC9B,MAAM,KAAK,GAAG,MAAM,qBAAqB,CACvC;gBACE,MAAM,EAAE,OAAO,CAAC,cAAc;gBAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,cAAc,EAAE,KAAK,CAAC,KAAK;gBAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;aAC9B,EACD,IAAI,CAAC,WAAW,CACjB,CAAC;YACF,qEAAqE;YACrE,6BAA6B;YAC7B,MAAM,EAAE,YAAY,EAAE,GAAG,WAAW,EAAE,GAAG,MAAM,uBAAuB,CAAC;gBACrE,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,OAAO,EAAE,KAAK,CAAC,EAAE;gBACjB,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,GAAG,EAAE,IAAI,CAAC,GAAG;aACd,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,OAAO,CAAC,cAAc;gBAC/B,OAAO,EAAE,KAAK,CAAC,EAAE;gBACjB,WAAW,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE;gBAC/B,WAAW;gBACX,YAAY;aACb,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,qBAAqB,CAAC,OAAO;YACjC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,CAAC,OAAO;gBAAE,OAAO,SAAS,CAAC;YAC/B,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,uBAAuB,CAAC;gBACrD,OAAO;gBACP,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,GAAG,EAAE,IAAI,CAAC,GAAG;aACd,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,OAAO,CAAC,cAAc;gBAC/B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,YAAY;aACb,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/write/index.d.ts

@@ -0,0 +1,5 @@
+export { createInMemoryWriteProofReplayStore, createInMemoryWriteSessionStore, createWriteSession, hashWriteSessionToken, type CreateWriteSessionInput, type CreateWriteSessionOptions, type CreateWriteSessionResult, type WriteProofReplayStore, type WriteSessionRecord, type WriteSessionStore, } from "./session.js";
+export { createWriteSessionAuthorization, writeServerNotConfigured, writeSessionBearerToken, type WriteSessionAuthorization, type WriteSessionAuthorizationDeps, } from "./authorize.js";
+export { handleWriteSessionRequest, type HandleWriteSessionRequestDeps, type WriteSessionResponseBody, type WriteSessionRouteLogger, } from "./route.js";
+export { WRITE_SIGNATURE_HEADER, WRITER_ATTRIBUTION_KEY, binaryWriteSignedBytes, hasReservedWriterKey, stampWriterAttribution, verifyStoredWriterAttribution, verifyWriterAttribution, WriterAttributionVerificationError, type BinaryWriteSignedBytesInput, type StoredWriterAttributionVerification, type VerifiedWriterAttribution, type VerifyStoredWriterAttributionOptions, type VerifyWriterAttributionInput, type WriterAttribution, } from "./attribution.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/write/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/write/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mCAAmC,EACnC,+BAA+B,EAC/B,kBAAkB,EAClB,qBAAqB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,GACvB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,+BAA+B,EAC/B,wBAAwB,EACxB,uBAAuB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,6BAA6B,GACnC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,yBAAyB,EACzB,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,GAC7B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,oBAAoB,EACpB,sBAAsB,EACtB,6BAA6B,EAC7B,uBAAuB,EACvB,kCAAkC,EAClC,KAAK,2BAA2B,EAChC,KAAK,mCAAmC,EACxC,KAAK,yBAAyB,EAC9B,KAAK,oCAAoC,EACzC,KAAK,4BAA4B,EACjC,KAAK,iBAAiB,GACvB,MAAM,kBAAkB,CAAC"}

package/dist/write/index.js

@@ -0,0 +1,5 @@
+export { createInMemoryWriteProofReplayStore, createInMemoryWriteSessionStore, createWriteSession, hashWriteSessionToken, } from "./session.js";
+export { createWriteSessionAuthorization, writeServerNotConfigured, writeSessionBearerToken, } from "./authorize.js";
+export { handleWriteSessionRequest, } from "./route.js";
+export { WRITE_SIGNATURE_HEADER, WRITER_ATTRIBUTION_KEY, binaryWriteSignedBytes, hasReservedWriterKey, stampWriterAttribution, verifyStoredWriterAttribution, verifyWriterAttribution, WriterAttributionVerificationError, } from "./attribution.js";
+//# sourceMappingURL=index.js.map

package/dist/write/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/write/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mCAAmC,EACnC,+BAA+B,EAC/B,kBAAkB,EAClB,qBAAqB,GAOtB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,+BAA+B,EAC/B,wBAAwB,EACxB,uBAAuB,GAGxB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,yBAAyB,GAI1B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,oBAAoB,EACpB,sBAAsB,EACtB,6BAA6B,EAC7B,uBAAuB,EACvB,kCAAkC,GAOnC,MAAM,kBAAkB,CAAC"}

package/dist/write/route.d.ts

@@ -0,0 +1,61 @@
+/**
+ * The write-session handshake, as a runtime-agnostic request handler.
+ *
+ * `POST /v1/write/session`: a registered builder proves control of its key and
+ * of a write-grant with a Web3Signed proof (the same handshake shape as the
+ * self-signing MCP session) and gets a short-lived bearer token. That token
+ * then gates delegated writes on the EXISTING ingest endpoint
+ * (`POST /v1/data/:scope`) and the derivative question routes. The Personal
+ * Server keeps signing AddData as the owner; the builder never holds the owner
+ * key.
+ *
+ * This lived in the Node server as a Hono route (packages/server/src/routes/
+ * write-session.ts) and reached for `node:crypto` for two things: a sha-256 of
+ * the proof header, and 32 random bytes for the token. Both have Web Crypto
+ * equivalents, so the handshake is expressed here over plain `Request` /
+ * `Response` and BOTH builds mount the same handler — the Node route is a Hono
+ * wrapper around it, and the browser runtime dispatches to it directly. There
+ * is one implementation of who may open a write session.
+ */
+import type { SessionTokenVerifierPort } from "../auth/index.js";
+import type { AuthSessionVerifierPort, GrantVerifierPort } from "../ports/index.js";
+import { type WriteProofReplayStore, type WriteSessionStore } from "./session.js";
+export interface WriteSessionRouteLogger {
+    info?(payload: Record<string, unknown>, message: string): void;
+    error?(payload: Record<string, unknown>, message: string): void;
+}
+export interface HandleWriteSessionRequestDeps {
+    serverOrigin: string | (() => string);
+    serverOwner?: `0x${string}`;
+    /**
+     * The store the redeeming routes read from. One store is wired into the
+     * handshake and into the API auth adapter; see createApp / the PS-Lite
+     * runtime.
+     */
+    sessionStore: WriteSessionStore;
+    /** Replay guard for the HANDSHAKE proof (distinct from per-write proofs). */
+    replayStore?: WriteProofReplayStore;
+    authSessionVerifier: AuthSessionVerifierPort;
+    grantVerifier: GrantVerifierPort;
+    devToken?: string;
+    accessToken?: string;
+    tokenStore?: SessionTokenVerifierPort;
+    /** Overridable for tests; defaults to `vana_write_` + 32 random bytes. */
+    randomToken?: () => string;
+    ttlMs?: number;
+    now?: () => number;
+    logger?: WriteSessionRouteLogger;
+}
+export interface WriteSessionResponseBody {
+    access_token: string;
+    token_type: "Bearer";
+    expires_in: number;
+    /** Write patterns, `write:` prefix stripped. */
+    scope: string;
+}
+/**
+ * Handle one `POST /v1/write/session` request. The caller has already matched
+ * the method and path; anything reaching here is treated as the handshake.
+ */
+export declare function handleWriteSessionRequest(request: Request, deps: HandleWriteSessionRequestDeps): Promise<Response>;
+//# sourceMappingURL=route.d.ts.map

package/dist/write/route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../src/write/route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAGjE,OAAO,KAAK,EACV,uBAAuB,EACvB,iBAAiB,EAClB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACvB,MAAM,cAAc,CAAC;AAEtB,MAAM,WAAW,uBAAuB;IACtC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/D,KAAK,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjE;AAED,MAAM,WAAW,6BAA6B;IAC5C,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B;;;;OAIG;IACH,YAAY,EAAE,iBAAiB,CAAC;IAChC,6EAA6E;IAC7E,WAAW,CAAC,EAAE,qBAAqB,CAAC;IACpC,mBAAmB,EAAE,uBAAuB,CAAC;IAC7C,aAAa,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,wBAAwB,CAAC;IACtC,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,MAAM,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,uBAAuB,CAAC;CAClC;AAED,MAAM,WAAW,wBAAwB;IACvC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;CACf;AA2CD;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,6BAA6B,GAClC,OAAO,CAAC,QAAQ,CAAC,CA4GnB"}

package/dist/write/route.js

@@ -0,0 +1,132 @@
+/**
+ * The write-session handshake, as a runtime-agnostic request handler.
+ *
+ * `POST /v1/write/session`: a registered builder proves control of its key and
+ * of a write-grant with a Web3Signed proof (the same handshake shape as the
+ * self-signing MCP session) and gets a short-lived bearer token. That token
+ * then gates delegated writes on the EXISTING ingest endpoint
+ * (`POST /v1/data/:scope`) and the derivative question routes. The Personal
+ * Server keeps signing AddData as the owner; the builder never holds the owner
+ * key.
+ *
+ * This lived in the Node server as a Hono route (packages/server/src/routes/
+ * write-session.ts) and reached for `node:crypto` for two things: a sha-256 of
+ * the proof header, and 32 random bytes for the token. Both have Web Crypto
+ * equivalents, so the handshake is expressed here over plain `Request` /
+ * `Response` and BOTH builds mount the same handler — the Node route is a Hono
+ * wrapper around it, and the browser runtime dispatches to it directly. There
+ * is one implementation of who may open a write session.
+ */
+import { authenticateRequest } from "../auth/index.js";
+import { ProtocolError } from "../errors/catalog.js";
+import { hashConnectionToken } from "../mcp/connection-api.js";
+import { createWriteSession, } from "./session.js";
+function jsonError(status, errorCode, message) {
+    return { error: { code: status, errorCode, message } };
+}
+function jsonResponse(body, status) {
+    return new Response(JSON.stringify(body), {
+        status,
+        headers: { "Content-Type": "application/json" },
+    });
+}
+/**
+ * Only ProtocolErrors are client-facing. Anything else (gateway, store,
+ * runtime failures) is logged with its cause and answered generically so
+ * internal details never reach the caller. Same mapping as the core data
+ * handler.
+ */
+function internalError(logger, err, stage) {
+    logger?.error?.({ err, stage }, "Write session handshake failed with an unexpected error");
+    return jsonResponse(jsonError(500, "INTERNAL_ERROR", "Internal server error"), 500);
+}
+function defaultRandomToken() {
+    const bytes = new Uint8Array(32);
+    globalThis.crypto.getRandomValues(bytes);
+    const hex = Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+    return `vana_write_${hex}`;
+}
+/**
+ * Handle one `POST /v1/write/session` request. The caller has already matched
+ * the method and path; anything reaching here is treated as the handshake.
+ */
+export async function handleWriteSessionRequest(request, deps) {
+    // Fail closed: minting a session requires this server's owner to bind the
+    // grant to (createWriteSession rejects wrong-owner grants).
+    if (!deps.serverOwner) {
+        return jsonResponse(jsonError(500, "SERVER_NOT_CONFIGURED", "Server owner is not configured"), 500);
+    }
+    let authResult;
+    try {
+        authResult = await authenticateRequest({
+            request,
+            serverOrigin: deps.serverOrigin,
+            devToken: deps.devToken,
+            accessToken: deps.accessToken,
+            sessionTokenVerifier: deps.tokenStore,
+            serverOwner: deps.serverOwner,
+        });
+    }
+    catch (err) {
+        if (!(err instanceof ProtocolError)) {
+            return internalError(deps.logger, err, "authenticate");
+        }
+        return jsonResponse(jsonError(401, "WRITE_SESSION_AUTH_FAILED", err.message), 401);
+    }
+    // A bearer credential (dev token, control-plane token, CLI session) proves
+    // nothing about the builder's key, so it can never open a write session.
+    if (authResult.mechanism !== "web3-signed") {
+        return jsonResponse(jsonError(401, "WRITE_SESSION_PROOF_REQUIRED", "POST /v1/write/session requires a Web3Signed proof signed by the builder key"), 401);
+    }
+    const grantId = authResult.auth.payload.grantId;
+    if (!grantId) {
+        return jsonResponse(jsonError(400, "GRANT_ID_REQUIRED", "The Web3Signed proof must carry a grantId (the write-grant issued to the builder)"), 400);
+    }
+    // Replay guard: bind to a digest of the exact proof header, remembered
+    // until the proof's own expiry (a replay only matters while still valid).
+    const proofHeader = request.headers.get("authorization") ?? "";
+    const proofId = await hashConnectionToken(proofHeader);
+    const expSec = authResult.auth.payload.exp;
+    const expiresAtMs = (typeof expSec === "number"
+        ? expSec
+        : Math.floor(Date.now() / 1000) + 300) * 1000;
+    try {
+        const session = await createWriteSession({
+            builderAddress: authResult.auth.signer,
+            grantId,
+            proof: { id: proofId, expiresAtMs },
+        }, {
+            store: deps.sessionStore,
+            authSessionVerifier: deps.authSessionVerifier,
+            grantVerifier: deps.grantVerifier,
+            serverOwner: deps.serverOwner,
+            randomToken: deps.randomToken ?? defaultRandomToken,
+            ...(deps.ttlMs === undefined ? {} : { ttlMs: deps.ttlMs }),
+            ...(deps.now === undefined ? {} : { now: deps.now }),
+            ...(deps.replayStore === undefined
+                ? {}
+                : { replayStore: deps.replayStore }),
+        });
+        deps.logger?.info?.({
+            builder: authResult.auth.signer,
+            grantId: session.grantId,
+            writeScopes: session.writeScopes,
+        }, "Write session minted");
+        const body = {
+            access_token: session.accessToken,
+            token_type: "Bearer",
+            expires_in: session.expiresInSeconds,
+            // Write patterns, prefix stripped — what POST /v1/data/:scope will
+            // accept under this token.
+            scope: session.writeScopes.join(" "),
+        };
+        return jsonResponse(body, 200);
+    }
+    catch (err) {
+        if (err instanceof ProtocolError) {
+            return jsonResponse(err.toJSON(), err.code);
+        }
+        return internalError(deps.logger, err, "create-session");
+    }
+}
+//# sourceMappingURL=route.js.map

package/dist/write/route.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.js","sourceRoot":"","sources":["../../src/write/route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAK/D,OAAO,EACL,kBAAkB,GAGnB,MAAM,cAAc,CAAC;AAsCtB,SAAS,SAAS,CAAC,MAAc,EAAE,SAAiB,EAAE,OAAe;IACnE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC;AACzD,CAAC;AAED,SAAS,YAAY,CAAC,IAAa,EAAE,MAAc;IACjD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CACpB,MAA2C,EAC3C,GAAY,EACZ,KAAa;IAEb,MAAM,EAAE,KAAK,EAAE,CACb,EAAE,GAAG,EAAE,KAAK,EAAE,EACd,yDAAyD,CAC1D,CAAC;IACF,OAAO,YAAY,CACjB,SAAS,CAAC,GAAG,EAAE,gBAAgB,EAAE,uBAAuB,CAAC,EACzD,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB;IACzB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CACrC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CACnC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,OAAO,cAAc,GAAG,EAAE,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAgB,EAChB,IAAmC;IAEnC,0EAA0E;IAC1E,4DAA4D;IAC5D,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtB,OAAO,YAAY,CACjB,SAAS,CAAC,GAAG,EAAE,uBAAuB,EAAE,gCAAgC,CAAC,EACzE,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,CAAC;IACf,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,mBAAmB,CAAC;YACrC,OAAO;YACP,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,oBAAoB,EAAE,IAAI,CAAC,UAAU;YACrC,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,CAAC,GAAG,YAAY,aAAa,CAAC,EAAE,CAAC;YACpC,OAAO,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,YAAY,CACjB,SAAS,CAAC,GAAG,EAAE,2BAA2B,EAAE,GAAG,CAAC,OAAO,CAAC,EACxD,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,yEAAyE;IACzE,IAAI,UAAU,CAAC,SAAS,KAAK,aAAa,EAAE,CAAC;QAC3C,OAAO,YAAY,CACjB,SAAS,CACP,GAAG,EACH,8BAA8B,EAC9B,8EAA8E,CAC/E,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;IAChD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,YAAY,CACjB,SAAS,CACP,GAAG,EACH,mBAAmB,EACnB,mFAAmF,CACpF,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,0EAA0E;IAC1E,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;IAC/D,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,WAAW,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;IAC3C,MAAM,WAAW,GACf,CAAC,OAAO,MAAM,KAAK,QAAQ;QACzB,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC;IAElD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,kBAAkB,CACtC;YACE,cAAc,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM;YACtC,OAAO;YACP,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE;SACpC,EACD;YACE,KAAK,EAAE,IAAI,CAAC,YAAY;YACxB,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,kBAAkB;YACnD,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;YAC1D,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;YACpD,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS;gBAChC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;SACvC,CACF,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CACjB;YACE,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM;YAC/B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,EACD,sBAAsB,CACvB,CAAC;QACF,MAAM,IAAI,GAA6B;YACrC,YAAY,EAAE,OAAO,CAAC,WAAW;YACjC,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,OAAO,CAAC,gBAAgB;YACpC,mEAAmE;YACnE,2BAA2B;YAC3B,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;SACrC,CAAC;QACF,OAAO,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YACjC,OAAO,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC"}

package/dist/write/session.d.ts

@@ -0,0 +1,96 @@
+/**
+ * Write API session (server-signed delegated writes, v1).
+ *
+ * A registered builder that holds its OWN key and a WRITE-grant proves control
+ * of that key ONCE — a Web3Signed handshake to `POST /v1/write/session` — and
+ * the PS mints a short-lived bearer token bound to `{ builderAddress, grantId }`
+ * (the grant's `write:`-prefixed scope entries define what it may write).
+ * Writes then present that token on the EXISTING ingest endpoint
+ * (`POST /v1/data/:scope`); each write authorizes as the builder via
+ * `verifyDataWritePolicy` and the PS ingests / encrypts / uploads / registers
+ * through the normal owner path — the PS signs AddData as the owner exactly as
+ * it does today, and the builder never holds the owner key.
+ *
+ * Deliberately the same handshake shape as the self-signing MCP session
+ * (mcp/session.ts): prove key control once, short-lived bearer after. The
+ * session token is authorization only; per-write builder ATTRIBUTION is a
+ * separate signed proof (see ./attribution.ts).
+ */
+import { hashConnectionToken } from "../mcp/connection-api.js";
+import { createInMemoryMcpProofReplayStore, type McpProofReplayStore } from "../mcp/session.js";
+import type { AuthSessionVerifierPort, GrantVerifierPort } from "../ports/index.js";
+export type WriteProofReplayStore = McpProofReplayStore;
+export declare const createInMemoryWriteProofReplayStore: typeof createInMemoryMcpProofReplayStore;
+export declare const hashWriteSessionToken: typeof hashConnectionToken;
+export interface WriteSessionRecord {
+    /** SHA-256 hex of the raw session token. Only the hash is stored. */
+    tokenHash: string;
+    /** The builder's address (recovered from the handshake proof). */
+    builderAddress: `0x${string}`;
+    /** The write-grant id the builder was issued (grantee == builder). */
+    grantId: string;
+    /** The grant's write patterns at handshake time (prefix stripped). */
+    writeScopes: string[];
+    createdAt: string;
+    expiresAtMs: number;
+}
+export interface WriteSessionStore {
+    create(record: WriteSessionRecord): Promise<void>;
+    /** Returns a live (non-expired) session, or null. */
+    getByTokenHash(tokenHash: string): Promise<WriteSessionRecord | null>;
+}
+/**
+ * KNOWN LIMITATION: in-memory only, same trade-off as the MCP session store —
+ * a process restart drops live tokens and the builder must re-handshake.
+ * Acceptable for today's single-instance Personal Server; persist via the
+ * host's state store before multi-instance.
+ */
+export declare function createInMemoryWriteSessionStore(): WriteSessionStore;
+export interface CreateWriteSessionInput {
+    builderAddress: `0x${string}`;
+    grantId: string;
+    /**
+     * Handshake-proof replay guard. When supplied together with a `replayStore`,
+     * a proof id already seen (and still live) is rejected instead of minting a
+     * fresh token. `expiresAtMs` bounds how long the id is remembered (the
+     * proof's own expiry).
+     */
+    proof?: {
+        id: string;
+        expiresAtMs: number;
+    };
+}
+export interface CreateWriteSessionOptions {
+    store: WriteSessionStore;
+    authSessionVerifier: AuthSessionVerifierPort;
+    grantVerifier: GrantVerifierPort;
+    /**
+     * This server's owner address. The grant's grantor MUST equal it — mirrors
+     * `verifyDataWritePolicy`'s ownership binding, applied at handshake so a
+     * wrong-owner grant fails with a clear error instead of minting a token
+     * whose every write would 403.
+     */
+    serverOwner: `0x${string}`;
+    randomToken: () => string;
+    ttlMs?: number;
+    now?: () => number;
+    /** Optional replay guard for the handshake proof (see `input.proof`). */
+    replayStore?: WriteProofReplayStore;
+}
+export interface CreateWriteSessionResult {
+    accessToken: string;
+    expiresInSeconds: number;
+    grantId: string;
+    /** Write patterns (prefix stripped) the session may write into. */
+    writeScopes: string[];
+}
+/**
+ * Validate the handshake identity and mint a write-session token. Same
+ * division of labor as createMcpSession: the handshake does the minimal
+ * checks that give a clear error (builder registered, grant exists + not
+ * revoked + carries write scopes, grantee == builder, grantor == owner);
+ * per-scope / expiry enforcement stays authoritative at write time, where
+ * `verifyDataWritePolicy` runs against the live grant on every POST.
+ */
+export declare function createWriteSession(input: CreateWriteSessionInput, options: CreateWriteSessionOptions): Promise<CreateWriteSessionResult>;
+//# sourceMappingURL=session.d.ts.map

package/dist/write/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/write/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EACL,iCAAiC,EACjC,KAAK,mBAAmB,EACzB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EACV,uBAAuB,EACvB,iBAAiB,EAClB,MAAM,mBAAmB,CAAC;AAc3B,MAAM,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AACxD,eAAO,MAAM,mCAAmC,0CACb,CAAC;AACpC,eAAO,MAAM,qBAAqB,4BAAsB,CAAC;AAEzD,MAAM,WAAW,kBAAkB;IACjC,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,cAAc,EAAE,KAAK,MAAM,EAAE,CAAC;IAC9B,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,qDAAqD;IACrD,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;CACvE;AAED;;;;;GAKG;AACH,wBAAgB,+BAA+B,IAAI,iBAAiB,CAgBnE;AAID,MAAM,WAAW,uBAAuB;IACtC,cAAc,EAAE,KAAK,MAAM,EAAE,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,KAAK,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7C;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,iBAAiB,CAAC;IACzB,mBAAmB,EAAE,uBAAuB,CAAC;IAC7C,aAAa,EAAE,iBAAiB,CAAC;IACjC;;;;;OAKG;IACH,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;IAC3B,WAAW,EAAE,MAAM,MAAM,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,yEAAyE;IACzE,WAAW,CAAC,EAAE,qBAAqB,CAAC;CACrC;AAED,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,uBAAuB,EAC9B,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,wBAAwB,CAAC,CA4FnC"}

package/dist/write/session.js

@@ -0,0 +1,136 @@
+/**
+ * Write API session (server-signed delegated writes, v1).
+ *
+ * A registered builder that holds its OWN key and a WRITE-grant proves control
+ * of that key ONCE — a Web3Signed handshake to `POST /v1/write/session` — and
+ * the PS mints a short-lived bearer token bound to `{ builderAddress, grantId }`
+ * (the grant's `write:`-prefixed scope entries define what it may write).
+ * Writes then present that token on the EXISTING ingest endpoint
+ * (`POST /v1/data/:scope`); each write authorizes as the builder via
+ * `verifyDataWritePolicy` and the PS ingests / encrypts / uploads / registers
+ * through the normal owner path — the PS signs AddData as the owner exactly as
+ * it does today, and the builder never holds the owner key.
+ *
+ * Deliberately the same handshake shape as the self-signing MCP session
+ * (mcp/session.ts): prove key control once, short-lived bearer after. The
+ * session token is authorization only; per-write builder ATTRIBUTION is a
+ * separate signed proof (see ./attribution.ts).
+ */
+import { hashConnectionToken } from "../mcp/connection-api.js";
+import { createInMemoryMcpProofReplayStore, } from "../mcp/session.js";
+import { writeScopePatterns } from "../policy/data-write.js";
+import { GrantOwnerMismatchError, GrantRequiredError, GrantRevokedError, InvalidSignatureError, ProtocolError, ScopeMismatchError, UnregisteredBuilderError, } from "../errors/catalog.js";
+export const createInMemoryWriteProofReplayStore = createInMemoryMcpProofReplayStore;
+export const hashWriteSessionToken = hashConnectionToken;
+/**
+ * KNOWN LIMITATION: in-memory only, same trade-off as the MCP session store —
+ * a process restart drops live tokens and the builder must re-handshake.
+ * Acceptable for today's single-instance Personal Server; persist via the
+ * host's state store before multi-instance.
+ */
+export function createInMemoryWriteSessionStore() {
+    const byHash = new Map();
+    return {
+        async create(record) {
+            byHash.set(record.tokenHash, record);
+        },
+        async getByTokenHash(tokenHash) {
+            const record = byHash.get(tokenHash);
+            if (!record)
+                return null;
+            if (record.expiresAtMs <= Date.now()) {
+                byHash.delete(tokenHash);
+                return null;
+            }
+            return record;
+        },
+    };
+}
+const DEFAULT_SESSION_TTL_MS = 60 * 60 * 1000;
+/**
+ * Validate the handshake identity and mint a write-session token. Same
+ * division of labor as createMcpSession: the handshake does the minimal
+ * checks that give a clear error (builder registered, grant exists + not
+ * revoked + carries write scopes, grantee == builder, grantor == owner);
+ * per-scope / expiry enforcement stays authoritative at write time, where
+ * `verifyDataWritePolicy` runs against the live grant on every POST.
+ */
+export async function createWriteSession(input, options) {
+    const builder = await options.authSessionVerifier.getBuilder(input.builderAddress);
+    if (!builder)
+        throw new UnregisteredBuilderError();
+    const grant = await options.grantVerifier.getGrant(input.grantId);
+    if (!grant) {
+        throw new GrantRequiredError({
+            reason: "Grant not found",
+            grantId: input.grantId,
+        });
+    }
+    if (grant.revokedAt !== null) {
+        throw new GrantRevokedError({ grantId: grant.id });
+    }
+    const patterns = writeScopePatterns(grant.scopes ?? []);
+    if (patterns.length === 0) {
+        throw new ScopeMismatchError({
+            reason: "Grant has no write scopes (write-grant entries use the write: prefix)",
+            grantedScopes: grant.scopes ?? [],
+        });
+    }
+    if (builder.id.toLowerCase() !== grant.granteeId.toLowerCase()) {
+        throw new InvalidSignatureError({
+            reason: "Handshake signer is not the grant builder",
+            expected: grant.granteeId,
+            actual: input.builderAddress,
+        });
+    }
+    // Ownership binding — fail closed on a grantor-less grant: gateway
+    // responses are untrusted runtime data, despite their type.
+    if (!grant.grantorAddress ||
+        grant.grantorAddress.toLowerCase() !== options.serverOwner.toLowerCase()) {
+        throw new GrantOwnerMismatchError({
+            grantId: grant.id,
+            expected: options.serverOwner,
+            actual: grant.grantorAddress ?? null,
+        });
+    }
+    // Prepare the token first (deterministic, can't meaningfully fail) so the
+    // only fallible step after consuming the proof is persistence.
+    const token = options.randomToken();
+    const tokenHash = await hashWriteSessionToken(token);
+    const ttlMs = options.ttlMs ?? DEFAULT_SESSION_TTL_MS;
+    const nowMs = options.now?.() ?? Date.now();
+    // Replay guard: a still-valid handshake proof must mint at most one token.
+    // Same consume/rollback discipline as createMcpSession.
+    const usingReplayGuard = Boolean(input.proof && options.replayStore);
+    if (input.proof && options.replayStore) {
+        const replayed = await options.replayStore.consume(input.proof.id, input.proof.expiresAtMs);
+        if (replayed) {
+            throw new ProtocolError(401, "WRITE_SESSION_PROOF_REPLAY", "Handshake proof already used; sign a fresh proof");
+        }
+    }
+    try {
+        await options.store.create({
+            tokenHash,
+            builderAddress: input.builderAddress,
+            grantId: grant.id,
+            writeScopes: patterns,
+            createdAt: new Date(nowMs).toISOString(),
+            expiresAtMs: nowMs + ttlMs,
+        });
+    }
+    catch (err) {
+        // Persistence failed — release the reservation so a legitimate retry with
+        // the same still-valid proof isn't rejected as a replay.
+        if (usingReplayGuard && input.proof && options.replayStore?.release) {
+            await options.replayStore.release(input.proof.id);
+        }
+        throw err;
+    }
+    return {
+        accessToken: token,
+        expiresInSeconds: Math.floor(ttlMs / 1000),
+        grantId: grant.id,
+        writeScopes: patterns,
+    };
+}
+//# sourceMappingURL=session.js.map

package/dist/write/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/write/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EACL,iCAAiC,GAElC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAK7D,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,sBAAsB,CAAC;AAM9B,MAAM,CAAC,MAAM,mCAAmC,GAC9C,iCAAiC,CAAC;AACpC,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AAqBzD;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B;IAC7C,MAAM,MAAM,GAAG,IAAI,GAAG,EAA8B,CAAC;IACrD,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,MAAM;YACjB,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACvC,CAAC;QACD,KAAK,CAAC,cAAc,CAAC,SAAS;YAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACrC,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,IAAI,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACrC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACzB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAwC9C;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAA8B,EAC9B,OAAkC;IAElC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,UAAU,CAC1D,KAAK,CAAC,cAAc,CACrB,CAAC;IACF,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,wBAAwB,EAAE,CAAC;IAEnD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,kBAAkB,CAAC;YAC3B,MAAM,EAAE,iBAAiB;YACzB,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IACxD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,kBAAkB,CAAC;YAC3B,MAAM,EACJ,uEAAuE;YACzE,aAAa,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE;SAClC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;QAC/D,MAAM,IAAI,qBAAqB,CAAC;YAC9B,MAAM,EAAE,2CAA2C;YACnD,QAAQ,EAAE,KAAK,CAAC,SAAS;YACzB,MAAM,EAAE,KAAK,CAAC,cAAc;SAC7B,CAAC,CAAC;IACL,CAAC;IACD,mEAAmE;IACnE,4DAA4D;IAC5D,IACE,CAAC,KAAK,CAAC,cAAc;QACrB,KAAK,CAAC,cAAc,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,CAAC,WAAW,EAAE,EACxE,CAAC;QACD,MAAM,IAAI,uBAAuB,CAAC;YAChC,OAAO,EAAE,KAAK,CAAC,EAAE;YACjB,QAAQ,EAAE,OAAO,CAAC,WAAW;YAC7B,MAAM,EAAE,KAAK,CAAC,cAAc,IAAI,IAAI;SACrC,CAAC,CAAC;IACL,CAAC;IAED,0EAA0E;IAC1E,+DAA+D;IAC/D,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,sBAAsB,CAAC;IACtD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAE5C,2EAA2E;IAC3E,wDAAwD;IACxD,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;IACrE,IAAI,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAChD,KAAK,CAAC,KAAK,CAAC,EAAE,EACd,KAAK,CAAC,KAAK,CAAC,WAAW,CACxB,CAAC;QACF,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,aAAa,CACrB,GAAG,EACH,4BAA4B,EAC5B,kDAAkD,CACnD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;YACzB,SAAS;YACT,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,OAAO,EAAE,KAAK,CAAC,EAAE;YACjB,WAAW,EAAE,QAAQ;YACrB,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE;YACxC,WAAW,EAAE,KAAK,GAAG,KAAK;SAC3B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0EAA0E;QAC1E,yDAAyD;QACzD,IAAI,gBAAgB,IAAI,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC;YACpE,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,OAAO;QACL,WAAW,EAAE,KAAK;QAClB,gBAAgB,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;QAC1C,OAAO,EAAE,KAAK,CAAC,EAAE;QACjB,WAAW,EAAE,QAAQ;KACtB,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opendatalabs/personal-server-ts-core",
-  "version": "0.0.1-canary.01ca694",
+  "version": "0.0.1-canary.052d47e",
   "description": "Protocol logic for the Vana Personal Server — auth, grants, scopes, storage, keys",
   "license": "MIT",
   "repository": {
@@ -80,6 +80,14 @@
       "types": "./dist/policy/index.d.ts",
       "import": "./dist/policy/index.js"
     },
+    "./lineage": {
+      "types": "./dist/lineage/index.d.ts",
+      "import": "./dist/lineage/index.js"
+    },
+    "./derivatives": {
+      "types": "./dist/derivatives/index.d.ts",
+      "import": "./dist/derivatives/index.js"
+    },
     "./ports": {
       "types": "./dist/ports/index.d.ts",
       "import": "./dist/ports/index.js"
@@ -119,6 +127,14 @@
     "./test-utils": {
       "types": "./dist/test-utils/index.d.ts",
       "import": "./dist/test-utils/index.js"
+    },
+    "./payment": {
+      "types": "./dist/payment/index.d.ts",
+      "import": "./dist/payment/index.js"
+    },
+    "./write": {
+      "types": "./dist/write/index.d.ts",
+      "import": "./dist/write/index.js"
     }
   },
   "scripts": {
@@ -126,10 +142,10 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@opendatalabs/vana-sdk": "^3.4.1",
+    "@opendatalabs/vana-sdk": "3.22.0-pr.207.0a5d07b",
     "minisearch": "^7.2.0",
     "unpdf": "^1.6.2",
-    "viem": "^2.48.11",
+    "viem": "^2.54.2",
     "zod": "^4.4.3"
   }
 }