@opendatalabs/personal-server-ts-core 0.2.0 → 1.1.0

package/dist/mcp/grantee.js

@@ -0,0 +1,91 @@
+/**
+ * Per-connection MCP grantee key generation + Web3Signed request signing.
+ *
+ * Each MCP connection gets a fresh secp256k1 keypair. The PS route uses this
+ * keypair to sign every read it performs on behalf of the connection so:
+ *
+ *  1. The data read flows through `authorizeBuilderRead` exactly like any
+ *     external builder request.
+ *  2. The access log records the per-connection grantee address, not the
+ *     owner.
+ *  3. Disconnecting one MCP client cannot affect another or the owner.
+ *
+ * This module does NOT do encryption-at-rest. The caller chooses the storage
+ * representation (`McpEncryptedPrivateKey`) — for Node the `plaintext` variant
+ * is fine (same trust boundary as the on-disk server key); for Web PS Lite the
+ * caller should wrap with the owner-derived master key.
+ */
+import { generatePrivateKey, privateKeyToAccount } from "viem/accounts";
+import { buildWeb3SignedHeader } from "@opendatalabs/vana-sdk/browser";
+/**
+ * Generate a new MCP grantee keypair and return both the persisted
+ * (plaintext-wrapped) form and a ready-to-sign `ServerAccount`.
+ */
+export function generateMcpGrantee() {
+    const privateKey = generatePrivateKey();
+    const account = privateKeyToAccount(privateKey);
+    const serverAccount = {
+        address: account.address,
+        publicKey: account.publicKey,
+        async signTypedData(params) {
+            return account.signTypedData({
+                domain: params.domain,
+                types: params.types,
+                primaryType: params.primaryType,
+                message: params.message,
+            });
+        },
+        async signMessage(message) {
+            return account.signMessage({ message });
+        },
+    };
+    return {
+        key: {
+            address: account.address,
+            publicKey: account.publicKey,
+            encryptedPrivateKey: { kind: "plaintext", privateKey },
+        },
+        account: serverAccount,
+    };
+}
+/**
+ * Reconstruct a `ServerAccount` from a persisted MCP grantee record.
+ * Only `plaintext` is supported here; Web PS Lite must decrypt to plaintext
+ * before calling.
+ */
+export function loadMcpGranteeAccount(key) {
+    if (key.encryptedPrivateKey.kind !== "plaintext") {
+        throw new Error("loadMcpGranteeAccount: only plaintext keys are supported here; decrypt first");
+    }
+    const account = privateKeyToAccount(key.encryptedPrivateKey.privateKey);
+    return {
+        address: account.address,
+        publicKey: account.publicKey,
+        async signTypedData(params) {
+            return account.signTypedData({
+                domain: params.domain,
+                types: params.types,
+                primaryType: params.primaryType,
+                message: params.message,
+            });
+        },
+        async signMessage(message) {
+            return account.signMessage({ message });
+        },
+    };
+}
+/**
+ * Build a Web3Signed Authorization header that authenticates the bearer as the
+ * MCP connection's grantee for a given grant id and request URL.
+ */
+export async function signMcpGranteeRequest(params) {
+    return buildWeb3SignedHeader({
+        signMessage: (message) => params.account.signMessage(message),
+        aud: params.aud,
+        method: params.method,
+        uri: params.uri,
+        body: params.body,
+        grantId: params.grantId,
+    });
+}
+//# sourceMappingURL=grantee.js.map

package/dist/mcp/grantee.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grantee.js","sourceRoot":"","sources":["../../src/mcp/grantee.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAevE;;;GAGG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,UAAU,GAAG,kBAAkB,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,aAAa,GAAkB;QACnC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,KAAK,CAAC,aAAa,CAAC,MAAM;YACxB,OAAO,OAAO,CAAC,aAAa,CAAC;gBAC3B,MAAM,EAAE,MAAM,CAAC,MAED;gBACd,KAAK,EAAE,MAAM,CAAC,KAED;gBACb,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,OAAO;YACvB,OAAO,OAAO,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1C,CAAC;KACF,CAAC;IACF,OAAO;QACL,GAAG,EAAE;YACH,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,mBAAmB,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE;SACvD;QACD,OAAO,EAAE,aAAa;KACvB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAkB;IACtD,IAAI,GAAG,CAAC,mBAAmB,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC;IACxE,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,KAAK,CAAC,aAAa,CAAC,MAAM;YACxB,OAAO,OAAO,CAAC,aAAa,CAAC;gBAC3B,MAAM,EAAE,MAAM,CAAC,MAED;gBACd,KAAK,EAAE,MAAM,CAAC,KAED;gBACb,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,OAAO;YACvB,OAAO,OAAO,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1C,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,MAO3C;IACC,OAAO,qBAAqB,CAAC;QAC3B,WAAW,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC;QACrE,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAC;AACL,CAAC"}

package/dist/mcp/index.d.ts

@@ -0,0 +1,10 @@
+export * from "./types.js";
+export * from "./store.js";
+export * from "./grantee.js";
+export * from "./builder-registration.js";
+export * from "./read-client.js";
+export * from "./tools.js";
+export * from "./server.js";
+export * from "./connection-api.js";
+export * from "./activity.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/mcp/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,qBAAqB,CAAC;AACpC,cAAc,eAAe,CAAC"}

package/dist/mcp/index.js

@@ -0,0 +1,10 @@
+export * from "./types.js";
+export * from "./store.js";
+export * from "./grantee.js";
+export * from "./builder-registration.js";
+export * from "./read-client.js";
+export * from "./tools.js";
+export * from "./server.js";
+export * from "./connection-api.js";
+export * from "./activity.js";
+//# sourceMappingURL=index.js.map

package/dist/mcp/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,qBAAqB,CAAC;AACpC,cAAc,eAAe,CAAC"}

package/dist/mcp/read-client.d.ts

@@ -0,0 +1,136 @@
+/**
+ * In-process MCP read client.
+ *
+ * The MCP route accepts a tool call from an MCP client, then needs to read scoped data
+ * from the user's Personal Server *as the per-connection grantee*. We do NOT
+ * round-trip through the public HTTP origin for this — the relay/tunnel is only
+ * for inbound MCP traffic. Instead we:
+ *
+ *  1. Build a Web Request signed by the connection's grantee, with the
+ *     existing grantId in the Web3Signed payload.
+ *  2. Use the same auth and access-log ports as `/v1/data`, then read bounded
+ *     block sidecars from storage. MCP tools must not fall back to full envelope
+ *     reads when sidecars are unavailable.
+ *
+ * This guarantees parity: the MCP read goes through the same policy check
+ * (`verifyDataReadPolicy`) and access-log path as an external builder read.
+ * No special owner-mode code path; no shared global grantee; logs record the
+ * per-connection grantee address.
+ */
+import type { ServerAccount } from "../keys/server-account.js";
+import type { ScopeSummary } from "../storage/index/types.js";
+import type { ReadScopeBlocksResponse } from "../storage/blocks/types.js";
+import type { SearchHit } from "./search/index.js";
+import { type PersonalServerDataApiDeps } from "../api/index.js";
+export interface McpScopeMetadata {
+    scope: string;
+    collectedAt: string;
+    sizeBytes: number;
+    /** True when the bounded block read path is available for this scope. */
+    hasBlocks: boolean;
+}
+export interface McpDataReadClient {
+    /**
+     * Perform `GET /v1/data?scopePrefix=…` as the connection grantee. This is
+     * used only for discovery/expanding wildcard grants before a grant-gated
+     * read; it does not return scope contents.
+     */
+    listScopes(params?: {
+        scopePrefix?: string;
+        limit?: number;
+        offset?: number;
+    }): Promise<McpDataListResult>;
+    /**
+     * Return lightweight planning metadata for a scope using the storage index
+     * only — no network call, no block read, no auth. Used by list_granted_scopes
+     * to populate sizeBytes/sizeClass/recommendedAccess without reading data.
+     * Returns null when the scope has no local index entry.
+     */
+    getScopeMetadata(scope: string): Promise<McpScopeMetadata | null>;
+    /**
+     * Perform a grant-gated bounded block read for MCP. This is the path used by
+     * MCP tools that need pagination and must not fall back to full envelope
+     * reads when the bounded storage path is unavailable.
+     */
+    readScopeBlocks(params: {
+        scope: string;
+        grantId: string;
+        cursor?: string;
+        maxBytes?: number;
+    }): Promise<McpDataReadBlocksResult>;
+    /**
+     * Perform a grant-gated raw binary read for an approved binary scope. This
+     * reuses `/v1/data/{scope}?content=raw` so policy checks and access logs stay
+     * identical to normal builder reads.
+     */
+    readRawScopeFile(params: {
+        scope: string;
+        grantId: string;
+        at?: string;
+        fileId?: string;
+    }): Promise<McpDataReadRawFileResult>;
+    /**
+     * Optional indexed search path. Implementations may return `missing` while
+     * an index is absent/stale; callers must keep the bounded block read path as
+     * fallback so full data remains accessible.
+     */
+    searchScopeIndex?(params: {
+        scope: string;
+        grantId: string;
+        query: string;
+        maxResults: number;
+    }): Promise<{
+        status: "hit";
+        hits: SearchHit[];
+    } | {
+        status: "missing";
+    }>;
+}
+export interface McpDataListResult {
+    status: number;
+    scopes: ScopeSummary[];
+    total: number;
+    limit: number;
+    offset: number;
+}
+export interface McpDataReadBlocksResult extends ReadScopeBlocksResponse {
+    status: number;
+}
+export interface McpDataReadRawFileResult {
+    status: number;
+    scope: string;
+    collectedAt?: string;
+    fileId?: string;
+    mimeType: string;
+    filename?: string;
+    sizeBytes: number;
+    contentBase64: string;
+    metadata?: unknown;
+}
+export declare class McpDataReadError extends Error {
+    status: number;
+    body: unknown;
+    constructor(status: number, body: unknown);
+}
+export interface CreateMcpDataReadClientOptions {
+    /**
+     * Origin the Web3Signed payload's `aud` claim is bound to. This MUST match
+     * the `serverOrigin` configured on the data API auth port — otherwise the
+     * signature audience check will fail.
+     */
+    serverOrigin: string;
+    granteeAccount: ServerAccount;
+    /**
+     * The data API deps used to mount `/v1/data` for external traffic. We reuse
+     * the exact same handler + ports so policy and access-logging are identical.
+     */
+    dataApiDeps: PersonalServerDataApiDeps;
+    /**
+     * Base path the data API was mounted under externally — required so the
+     * Web3Signed signature URI matches what `handlePersonalServerDataRequest`
+     * expects after strip-base-path. Defaults to `/v1/data`.
+     */
+    basePath?: string;
+}
+export declare function createMcpDataReadClient(options: CreateMcpDataReadClientOptions): McpDataReadClient;
+//# sourceMappingURL=read-client.d.ts.map

package/dist/mcp/read-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-client.d.ts","sourceRoot":"","sources":["../../src/mcp/read-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAInD,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,iBAAiB,CAAC;AAGzB,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,yEAAyE;IACzE,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,UAAU,CAAC,MAAM,CAAC,EAAE;QAClB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAE/B;;;;;OAKG;IACH,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAElE;;;;OAIG;IACH,eAAe,CAAC,MAAM,EAAE;QACtB,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAErC;;;;OAIG;IACH,gBAAgB,CAAC,MAAM,EAAE;QACvB,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAEtC;;;;OAIG;IACH,gBAAgB,CAAC,CAAC,MAAM,EAAE;QACxB,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CACP;QACE,MAAM,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,SAAS,EAAE,CAAC;KACnB,GACD;QACE,MAAM,EAAE,SAAS,CAAC;KACnB,CACJ,CAAC;CACH;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,uBAAwB,SAAQ,uBAAuB;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IAEhC,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,OAAO;gBADb,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO;CAWvB;AAED,MAAM,WAAW,8BAA8B;IAC7C;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,aAAa,CAAC;IAC9B;;;OAGG;IACH,WAAW,EAAE,yBAAyB,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,8BAA8B,GACtC,iBAAiB,CAqQnB"}

package/dist/mcp/read-client.js

@@ -0,0 +1,306 @@
+/**
+ * In-process MCP read client.
+ *
+ * The MCP route accepts a tool call from an MCP client, then needs to read scoped data
+ * from the user's Personal Server *as the per-connection grantee*. We do NOT
+ * round-trip through the public HTTP origin for this — the relay/tunnel is only
+ * for inbound MCP traffic. Instead we:
+ *
+ *  1. Build a Web Request signed by the connection's grantee, with the
+ *     existing grantId in the Web3Signed payload.
+ *  2. Use the same auth and access-log ports as `/v1/data`, then read bounded
+ *     block sidecars from storage. MCP tools must not fall back to full envelope
+ *     reads when sidecars are unavailable.
+ *
+ * This guarantees parity: the MCP read goes through the same policy check
+ * (`verifyDataReadPolicy`) and access-log path as an external builder read.
+ * No special owner-mode code path; no shared global grantee; logs record the
+ * per-connection grantee address.
+ */
+import { decodeDataBlockCursor } from "../storage/blocks/index.js";
+import { bytesToBase64, parseMetadataHeader } from "../contracts/binary.js";
+import { signMcpGranteeRequest } from "./grantee.js";
+import { handlePersonalServerDataRequest, reportPersonalServerReadFulfillment, } from "../api/index.js";
+import { ProtocolError } from "../errors/catalog.js";
+export class McpDataReadError extends Error {
+    status;
+    body;
+    constructor(status, body) {
+        super(typeof body === "object" && body !== null && "error" in body
+            ? String(body.error?.message ??
+                `mcp data read failed (status ${status})`)
+            : `mcp data read failed (status ${status})`);
+        this.status = status;
+        this.body = body;
+    }
+}
+export function createMcpDataReadClient(options) {
+    const basePath = options.basePath ?? "/v1/data";
+    return {
+        async listScopes({ scopePrefix, limit, offset } = {}) {
+            const params = new URLSearchParams();
+            if (scopePrefix)
+                params.set("scopePrefix", scopePrefix);
+            if (limit !== undefined)
+                params.set("limit", String(limit));
+            if (offset !== undefined)
+                params.set("offset", String(offset));
+            const query = params.toString();
+            const pathWithQuery = query ? `${basePath}?${query}` : basePath;
+            const authorization = await signMcpGranteeRequest({
+                account: options.granteeAccount,
+                aud: options.serverOrigin,
+                method: "GET",
+                uri: basePath,
+                grantId: "mcp-list",
+            });
+            const url = new URL(pathWithQuery, options.serverOrigin).toString();
+            const request = new Request(url, {
+                method: "GET",
+                headers: { Authorization: authorization },
+            });
+            const response = await handlePersonalServerDataRequest(request, options.dataApiDeps, { basePath });
+            const body = await parseJsonOrText(response);
+            if (!response.ok) {
+                throw new McpDataReadError(response.status, body);
+            }
+            return { status: response.status, ...normalizeListScopesPayload(body) };
+        },
+        async getScopeMetadata(scope) {
+            const storage = options.dataApiDeps.storage;
+            const entry = storage.findEntry({ scope });
+            if (!entry)
+                return null;
+            const hasBlocks = typeof storage.hasScopeBlocks === "function"
+                ? await storage.hasScopeBlocks(scope, entry.collectedAt)
+                : false;
+            return {
+                scope,
+                collectedAt: entry.collectedAt,
+                sizeBytes: entry.sizeBytes,
+                hasBlocks,
+            };
+        },
+        async readScopeBlocks({ scope, grantId, cursor, maxBytes }) {
+            const storage = options.dataApiDeps.storage;
+            if (!storage.readScopeBlocks) {
+                throw new McpDataReadError(503, {
+                    error: "BOUNDED_DATA_UNAVAILABLE",
+                    message: "Bounded scope data is unavailable while the storage sidecar is missing or still indexing.",
+                    scope,
+                });
+            }
+            const pinnedCollectedAt = collectedAtFromCursor(scope, cursor);
+            const selectedEntry = storage.findEntry({
+                scope,
+                ...(pinnedCollectedAt ? { at: pinnedCollectedAt } : {}),
+            });
+            if (!selectedEntry) {
+                throw new McpDataReadError(404, {
+                    error: "NOT_FOUND",
+                    message: `No data found for scope "${scope}"`,
+                });
+            }
+            const safeScope = encodeURIComponent(scope);
+            const signingUri = `${basePath}/${safeScope}`;
+            const authorization = await signMcpGranteeRequest({
+                account: options.granteeAccount,
+                aud: options.serverOrigin,
+                method: "GET",
+                uri: signingUri,
+                grantId,
+            });
+            const url = new URL(signingUri, options.serverOrigin).toString();
+            const request = new Request(url, {
+                method: "GET",
+                headers: { Authorization: authorization },
+            });
+            let authResult;
+            try {
+                authResult = await options.dataApiDeps.auth.authorizeBuilderRead({
+                    request,
+                    scope,
+                    grantId,
+                    fileId: selectedEntry.fileId ?? undefined,
+                });
+            }
+            catch (err) {
+                if (err instanceof ProtocolError) {
+                    throw new McpDataReadError(err.code, err.toJSON());
+                }
+                throw err;
+            }
+            try {
+                const result = await storage.readScopeBlocks(scope, selectedEntry.collectedAt, {
+                    cursor,
+                    maxBytes: maxBytes ?? 16_384,
+                });
+                const logId = options.dataApiDeps.createLogId?.() ?? crypto.randomUUID();
+                const timestamp = (options.dataApiDeps.now ?? (() => new Date()))().toISOString();
+                const ipAddress = request.headers.get("x-forwarded-for") ??
+                    request.headers.get("x-real-ip") ??
+                    "unknown";
+                const userAgent = request.headers.get("user-agent") ?? "unknown";
+                await options.dataApiDeps.accessLogWriter.write({
+                    logId,
+                    grantId: authResult?.grantId ?? grantId,
+                    builder: authResult?.builder ?? options.granteeAccount.address,
+                    action: "read",
+                    scope,
+                    timestamp,
+                    ipAddress,
+                    userAgent,
+                });
+                if (authResult?.grantId &&
+                    authResult.builder &&
+                    !cursor &&
+                    !result.nextCursor) {
+                    reportPersonalServerReadFulfillment(options.dataApiDeps, {
+                        builder: authResult.builder,
+                        fileId: selectedEntry.fileId ?? undefined,
+                        grantId: authResult.grantId,
+                        ipAddress,
+                        logId,
+                        scope,
+                        servedAt: timestamp,
+                        userAgent,
+                    });
+                }
+                return { status: 200, ...result };
+            }
+            catch (err) {
+                if (err instanceof ProtocolError) {
+                    throw new McpDataReadError(err.code, err.toJSON());
+                }
+                if (err instanceof Error) {
+                    const code = dataBlockStorageErrorCode(err);
+                    const status = code === "cursor_invalid" ? 400 : 503;
+                    throw new McpDataReadError(status, {
+                        error: code === "cursor_invalid"
+                            ? "INVALID_CURSOR"
+                            : "BOUNDED_DATA_UNAVAILABLE",
+                        message: code === "cursor_invalid"
+                            ? "The bounded read cursor is invalid for this scope."
+                            : "Bounded scope data is unavailable while the storage sidecar is missing or still indexing.",
+                        scope,
+                        ...(code ? { reason: code } : {}),
+                    });
+                }
+                throw err;
+            }
+        },
+        async readRawScopeFile({ scope, grantId, at, fileId }) {
+            const storage = options.dataApiDeps.storage;
+            const selectedEntry = storage.findEntry({
+                scope,
+                ...(fileId ? { fileId } : {}),
+                ...(at ? { at } : {}),
+            });
+            if (!selectedEntry) {
+                throw new McpDataReadError(404, {
+                    error: "NOT_FOUND",
+                    message: `No data found for scope "${scope}"`,
+                });
+            }
+            const safeScope = encodeURIComponent(scope);
+            const signingUri = `${basePath}/${safeScope}`;
+            const query = new URLSearchParams({ content: "raw" });
+            if (fileId)
+                query.set("fileId", fileId);
+            if (at)
+                query.set("at", at);
+            query.set("grantId", grantId);
+            const authorization = await signMcpGranteeRequest({
+                account: options.granteeAccount,
+                aud: options.serverOrigin,
+                method: "GET",
+                uri: signingUri,
+                grantId,
+            });
+            const url = new URL(`${signingUri}?${query.toString()}`, options.serverOrigin).toString();
+            const request = new Request(url, {
+                method: "GET",
+                headers: { Authorization: authorization },
+            });
+            const response = await handlePersonalServerDataRequest(request, options.dataApiDeps, { basePath });
+            if (!response.ok) {
+                throw new McpDataReadError(response.status, await parseJsonOrText(response));
+            }
+            const mimeType = response.headers.get("content-type") ?? "application/octet-stream";
+            if (mimeType.includes("application/json")) {
+                throw new McpDataReadError(400, {
+                    error: "NOT_BINARY_SCOPE",
+                    message: `Scope "${scope}" does not expose raw binary content.`,
+                });
+            }
+            const bytes = new Uint8Array(await response.arrayBuffer());
+            const contentDisposition = response.headers.get("content-disposition");
+            const metadataHeader = response.headers.get("x-vana-metadata");
+            return {
+                status: response.status,
+                scope,
+                collectedAt: selectedEntry.collectedAt,
+                fileId: selectedEntry.fileId ?? undefined,
+                mimeType,
+                filename: filenameFromContentDisposition(contentDisposition),
+                sizeBytes: bytes.byteLength,
+                contentBase64: bytesToBase64(bytes),
+                metadata: parseMetadataHeader(metadataHeader),
+            };
+        },
+    };
+}
+async function parseJsonOrText(response) {
+    const text = await response.text();
+    try {
+        return text ? JSON.parse(text) : null;
+    }
+    catch {
+        return text;
+    }
+}
+function filenameFromContentDisposition(value) {
+    if (!value)
+        return undefined;
+    const match = /filename="([^"]+)"/i.exec(value) ?? /filename=([^;]+)/i.exec(value);
+    return match?.[1]?.trim();
+}
+function collectedAtFromCursor(scope, cursor) {
+    if (!cursor)
+        return undefined;
+    const decoded = decodeDataBlockCursor(cursor);
+    if (!decoded.ok || decoded.cursor.scope !== scope)
+        return undefined;
+    return decoded.cursor.collectedAt;
+}
+function dataBlockStorageErrorCode(err) {
+    if (!("code" in err))
+        return undefined;
+    const code = err.code;
+    return typeof code === "string" ? code : undefined;
+}
+function normalizeListScopesPayload(body) {
+    if (typeof body !== "object" || body === null) {
+        return { scopes: [], total: 0, limit: 0, offset: 0 };
+    }
+    const payload = body;
+    const scopes = Array.isArray(payload.scopes)
+        ? payload.scopes.filter(isScopeSummary)
+        : [];
+    return {
+        scopes,
+        total: typeof payload.total === "number" ? payload.total : scopes.length,
+        limit: typeof payload.limit === "number" ? payload.limit : scopes.length,
+        offset: typeof payload.offset === "number" ? payload.offset : 0,
+    };
+}
+function isScopeSummary(value) {
+    if (typeof value !== "object" || value === null) {
+        return false;
+    }
+    const summary = value;
+    return (typeof summary.scope === "string" &&
+        typeof summary.latestCollectedAt === "string" &&
+        typeof summary.versionCount === "number");
+}
+//# sourceMappingURL=read-client.js.map

package/dist/mcp/read-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-client.js","sourceRoot":"","sources":["../../src/mcp/read-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAMH,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EACL,+BAA+B,EAC/B,mCAAmC,GAEpC,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAmGrD,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAEhC;IACA;IAFT,YACS,MAAc,EACd,IAAa;QAEpB,KAAK,CACH,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,IAAI;YAC1D,CAAC,CAAC,MAAM,CACH,IAAyC,CAAC,KAAK,EAAE,OAAO;gBACvD,gCAAgC,MAAM,GAAG,CAC5C;YACH,CAAC,CAAC,gCAAgC,MAAM,GAAG,CAC9C,CAAC;QAVK,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAS;IAUtB,CAAC;CACF;AAuBD,MAAM,UAAU,uBAAuB,CACrC,OAAuC;IAEvC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,UAAU,CAAC;IAEhD,OAAO;QACL,KAAK,CAAC,UAAU,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE;YAClD,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;YACrC,IAAI,WAAW;gBAAE,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;YACxD,IAAI,KAAK,KAAK,SAAS;gBAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC5D,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChC,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;YAEhE,MAAM,aAAa,GAAG,MAAM,qBAAqB,CAAC;gBAChD,OAAO,EAAE,OAAO,CAAC,cAAc;gBAC/B,GAAG,EAAE,OAAO,CAAC,YAAY;gBACzB,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,QAAQ;gBACb,OAAO,EAAE,UAAU;aACpB,CAAC,CAAC;YAEH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;YACpE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE;gBAC/B,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,aAAa,EAAE,aAAa,EAAE;aAC1C,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,+BAA+B,CACpD,OAAO,EACP,OAAO,CAAC,WAAW,EACnB,EAAE,QAAQ,EAAE,CACb,CAAC;YAEF,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;YAE7C,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACpD,CAAC;YAED,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,GAAG,0BAA0B,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1E,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,KAAa;YAClC,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC;YAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAC3C,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YACxB,MAAM,SAAS,GACb,OAAO,OAAO,CAAC,cAAc,KAAK,UAAU;gBAC1C,CAAC,CAAC,MAAM,OAAO,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC;gBACxD,CAAC,CAAC,KAAK,CAAC;YACZ,OAAO;gBACL,KAAK;gBACL,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS;aACV,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE;YACxD,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC;YAC5C,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;gBAC7B,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE;oBAC9B,KAAK,EAAE,0BAA0B;oBACjC,OAAO,EACL,2FAA2F;oBAC7F,KAAK;iBACN,CAAC,CAAC;YACL,CAAC;YAED,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC/D,MAAM,aAAa,GAAG,OAAO,CAAC,SAAS,CAAC;gBACtC,KAAK;gBACL,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxD,CAAC,CAAC;YACH,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE;oBAC9B,KAAK,EAAE,WAAW;oBAClB,OAAO,EAAE,4BAA4B,KAAK,GAAG;iBAC9C,CAAC,CAAC;YACL,CAAC;YAED,MAAM,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAC5C,MAAM,UAAU,GAAG,GAAG,QAAQ,IAAI,SAAS,EAAE,CAAC;YAC9C,MAAM,aAAa,GAAG,MAAM,qBAAqB,CAAC;gBAChD,OAAO,EAAE,OAAO,CAAC,cAAc;gBAC/B,GAAG,EAAE,OAAO,CAAC,YAAY;gBACzB,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,UAAU;gBACf,OAAO;aACR,CAAC,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;YACjE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE;gBAC/B,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,aAAa,EAAE,aAAa,EAAE;aAC1C,CAAC,CAAC;YAEH,IAAI,UAMS,CAAC;YACd,IAAI,CAAC;gBACH,UAAU,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,oBAAoB,CAAC;oBAC/D,OAAO;oBACP,KAAK;oBACL,OAAO;oBACP,MAAM,EAAE,aAAa,CAAC,MAAM,IAAI,SAAS;iBAC1C,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;oBACjC,MAAM,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;gBACrD,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,eAAe,CAC1C,KAAK,EACL,aAAa,CAAC,WAAW,EACzB;oBACE,MAAM;oBACN,QAAQ,EAAE,QAAQ,IAAI,MAAM;iBAC7B,CACF,CAAC;gBACF,MAAM,KAAK,GACT,OAAO,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;gBAC7D,MAAM,SAAS,GAAG,CAChB,OAAO,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAC9C,EAAE,CAAC,WAAW,EAAE,CAAC;gBAClB,MAAM,SAAS,GACb,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;oBACtC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;oBAChC,SAAS,CAAC;gBACZ,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC;gBACjE,MAAM,OAAO,CAAC,WAAW,CAAC,eAAe,CAAC,KAAK,CAAC;oBAC9C,KAAK;oBACL,OAAO,EAAE,UAAU,EAAE,OAAO,IAAI,OAAO;oBACvC,OAAO,EAAE,UAAU,EAAE,OAAO,IAAI,OAAO,CAAC,cAAc,CAAC,OAAO;oBAC9D,MAAM,EAAE,MAAM;oBACd,KAAK;oBACL,SAAS;oBACT,SAAS;oBACT,SAAS;iBACV,CAAC,CAAC;gBACH,IACE,UAAU,EAAE,OAAO;oBACnB,UAAU,CAAC,OAAO;oBAClB,CAAC,MAAM;oBACP,CAAC,MAAM,CAAC,UAAU,EAClB,CAAC;oBACD,mCAAmC,CAAC,OAAO,CAAC,WAAW,EAAE;wBACvD,OAAO,EAAE,UAAU,CAAC,OAAO;wBAC3B,MAAM,EAAE,aAAa,CAAC,MAAM,IAAI,SAAS;wBACzC,OAAO,EAAE,UAAU,CAAC,OAAO;wBAC3B,SAAS;wBACT,KAAK;wBACL,KAAK;wBACL,QAAQ,EAAE,SAAS;wBACnB,SAAS;qBACV,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;YACpC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;oBACjC,MAAM,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;gBACrD,CAAC;gBACD,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;oBACzB,MAAM,IAAI,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;oBAC5C,MAAM,MAAM,GAAG,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;oBACrD,MAAM,IAAI,gBAAgB,CAAC,MAAM,EAAE;wBACjC,KAAK,EACH,IAAI,KAAK,gBAAgB;4BACvB,CAAC,CAAC,gBAAgB;4BAClB,CAAC,CAAC,0BAA0B;wBAChC,OAAO,EACL,IAAI,KAAK,gBAAgB;4BACvB,CAAC,CAAC,oDAAoD;4BACtD,CAAC,CAAC,2FAA2F;wBACjG,KAAK;wBACL,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAClC,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE;YACnD,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC;YAC5C,MAAM,aAAa,GAAG,OAAO,CAAC,SAAS,CAAC;gBACtC,KAAK;gBACL,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7B,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtB,CAAC,CAAC;YACH,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE;oBAC9B,KAAK,EAAE,WAAW;oBAClB,OAAO,EAAE,4BAA4B,KAAK,GAAG;iBAC9C,CAAC,CAAC;YACL,CAAC;YAED,MAAM,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAC5C,MAAM,UAAU,GAAG,GAAG,QAAQ,IAAI,SAAS,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YACtD,IAAI,MAAM;gBAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACxC,IAAI,EAAE;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC5B,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAE9B,MAAM,aAAa,GAAG,MAAM,qBAAqB,CAAC;gBAChD,OAAO,EAAE,OAAO,CAAC,cAAc;gBAC/B,GAAG,EAAE,OAAO,CAAC,YAAY;gBACzB,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,UAAU;gBACf,OAAO;aACR,CAAC,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CACjB,GAAG,UAAU,IAAI,KAAK,CAAC,QAAQ,EAAE,EAAE,EACnC,OAAO,CAAC,YAAY,CACrB,CAAC,QAAQ,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE;gBAC/B,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,aAAa,EAAE,aAAa,EAAE;aAC1C,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,+BAA+B,CACpD,OAAO,EACP,OAAO,CAAC,WAAW,EACnB,EAAE,QAAQ,EAAE,CACb,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,gBAAgB,CACxB,QAAQ,CAAC,MAAM,EACf,MAAM,eAAe,CAAC,QAAQ,CAAC,CAChC,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GACZ,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,0BAA0B,CAAC;YACrE,IAAI,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE;oBAC9B,KAAK,EAAE,kBAAkB;oBACzB,OAAO,EAAE,UAAU,KAAK,uCAAuC;iBAChE,CAAC,CAAC;YACL,CAAC;YAED,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;YAC3D,MAAM,kBAAkB,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;YACvE,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YAC/D,OAAO;gBACL,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,KAAK;gBACL,WAAW,EAAE,aAAa,CAAC,WAAW;gBACtC,MAAM,EAAE,aAAa,CAAC,MAAM,IAAI,SAAS;gBACzC,QAAQ;gBACR,QAAQ,EAAE,8BAA8B,CAAC,kBAAkB,CAAC;gBAC5D,SAAS,EAAE,KAAK,CAAC,UAAU;gBAC3B,aAAa,EAAE,aAAa,CAAC,KAAK,CAAC;gBACnC,QAAQ,EAAE,mBAAmB,CAAC,cAAc,CAAC;aAC9C,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,QAAkB;IAC/C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,8BAA8B,CACrC,KAAoB;IAEpB,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,KAAK,GACT,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,qBAAqB,CAC5B,KAAa,EACb,MAA0B;IAE1B,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IACpE,OAAO,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;AACpC,CAAC;AAED,SAAS,yBAAyB,CAAC,GAAU;IAC3C,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACvC,MAAM,IAAI,GAAI,GAA0B,CAAC,IAAI,CAAC;IAC9C,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAED,SAAS,0BAA0B,CACjC,IAAa;IAEb,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAC9C,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IACvD,CAAC;IACD,MAAM,OAAO,GAAG,IAKf,CAAC;IACF,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;QAC1C,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC;QACvC,CAAC,CAAC,EAAE,CAAC;IACP,OAAO;QACL,MAAM;QACN,KAAK,EAAE,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM;QACxE,KAAK,EAAE,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM;QACxE,MAAM,EAAE,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;KAChE,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,KAIf,CAAC;IACF,OAAO,CACL,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;QACjC,OAAO,OAAO,CAAC,iBAAiB,KAAK,QAAQ;QAC7C,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ,CACzC,CAAC;AACJ,CAAC"}

package/dist/mcp/resources.d.ts

@@ -0,0 +1,37 @@
+import type { ReadResourceResult } from "@modelcontextprotocol/sdk/types.js";
+import { z } from "zod";
+import { type McpDataReadClient } from "./read-client.js";
+import type { McpConnectionRecord } from "./types.js";
+export declare const RAW_SCOPE_RESOURCE_TEMPLATES: readonly ["vana://scope/{scope}/raw", "vana://scope/{scope}/raw/at/{at}", "vana://scope/{scope}/raw/file/{fileId}"];
+export interface RawScopeResourceParams {
+    scope: string;
+    at?: string;
+    fileId?: string;
+}
+export interface RawScopeResourceContext {
+    connection: McpConnectionRecord;
+    readClient: McpDataReadClient;
+}
+export declare function rawScopeResourceUri(params: RawScopeResourceParams): string;
+export declare function parseRawScopeResourceUri(uri: URL): RawScopeResourceParams;
+export declare function resolveGrantForRawScopeResource(connection: McpConnectionRecord, scope: string): {
+    grantId: string;
+} | null;
+export declare function readRawScopeResource(uri: URL, ctx: RawScopeResourceContext): Promise<ReadResourceResult>;
+export declare function rawScopeMetadata(raw: {
+    scope: string;
+    collectedAt?: string;
+    fileId?: string;
+    filename?: string;
+    mimeType: string;
+    sizeBytes: number;
+    metadata?: unknown;
+}): Record<string, unknown>;
+export declare const rawScopeFileInputSchema: {
+    scope: z.ZodString;
+    at: z.ZodOptional<z.ZodString>;
+    fileId: z.ZodOptional<z.ZodString>;
+    includeContent: z.ZodOptional<z.ZodBoolean>;
+    maxBytes: z.ZodOptional<z.ZodNumber>;
+};
+//# sourceMappingURL=resources.d.ts.map

package/dist/mcp/resources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resources.d.ts","sourceRoot":"","sources":["../../src/mcp/resources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAoB,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC5E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,eAAO,MAAM,4BAA4B,qHAI/B,CAAC;AAEX,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,mBAAmB,CAAC;IAChC,UAAU,EAAE,iBAAiB,CAAC;CAC/B;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM,CAS1E;AAED,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,GAAG,GAAG,sBAAsB,CA0BzE;AAED,wBAAgB,+BAA+B,CAC7C,UAAU,EAAE,mBAAmB,EAC/B,KAAK,EAAE,MAAM,GACZ;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAe5B;AAED,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,uBAAuB,GAC3B,OAAO,CAAC,kBAAkB,CAAC,CA2B7B;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAU1B;AAED,eAAO,MAAM,uBAAuB;;;;;;CAiBnC,CAAC"}