@opendatalabs/personal-server-ts-server 0.0.1-canary.016adf9 → 0.0.1-canary.052d47e

package/dist/keys/server-account.js

@@ -0,0 +1,48 @@
+/**
+ * ServerAccount wraps a randomly generated private key for EIP-712 signing.
+ * The key is persisted to disk so the same address survives restarts.
+ */
+import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";
+import { dirname } from "node:path";
+import { generatePrivateKey, privateKeyToAccount } from "viem/accounts";
+/**
+ * Loads an existing server keypair from disk, or generates a new random one
+ * and persists it. Returns a ServerAccount suitable for EIP-712 signing.
+ */
+export function loadOrCreateServerAccount(keyPath) {
+    let privateKey;
+    if (existsSync(keyPath)) {
+        const raw = readFileSync(keyPath, "utf-8");
+        const data = JSON.parse(raw);
+        privateKey = data.privateKey;
+    }
+    else {
+        privateKey = generatePrivateKey();
+        const account = privateKeyToAccount(privateKey);
+        // Ensure parent directories exist
+        mkdirSync(dirname(keyPath), { recursive: true });
+        const data = {
+            address: account.address,
+            publicKey: account.publicKey,
+            privateKey,
+        };
+        writeFileSync(keyPath, JSON.stringify(data, null, 2), { mode: 0o600 });
+    }
+    const account = privateKeyToAccount(privateKey);
+    return {
+        address: account.address,
+        publicKey: account.publicKey,
+        async signTypedData(params) {
+            return account.signTypedData({
+                domain: params.domain,
+                types: params.types,
+                primaryType: params.primaryType,
+                message: params.message,
+            });
+        },
+        async signMessage(message) {
+            return account.signMessage({ message });
+        },
+    };
+}
+//# sourceMappingURL=server-account.js.map

package/dist/keys/server-account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-account.js","sourceRoot":"","sources":["../../src/keys/server-account.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAyBxE;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,IAAI,UAAyB,CAAC;IAE9B,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAgB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1C,UAAU,GAAG,IAAI,CAAC,UAA2B,CAAC;IAChD,CAAC;SAAM,CAAC;QACN,UAAU,GAAG,kBAAkB,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;QAEhD,kCAAkC;QAClC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEjD,MAAM,IAAI,GAAgB;YACxB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,UAAU;SACX,CAAC;QACF,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,OAAO,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAEhD,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,KAAK,CAAC,aAAa,CAAC,MAA2B;YAC7C,OAAO,OAAO,CAAC,aAAa,CAAC;gBAC3B,MAAM,EAAE,MAAM,CAAC,MAED;gBACd,KAAK,EAAE,MAAM,CAAC,KAED;gBACb,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,OAAe;YAC/B,OAAO,OAAO,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1C,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/listen.d.ts

@@ -0,0 +1,11 @@
+import { createAdaptorServer } from "@hono/node-server";
+import type { AddressInfo } from "node:net";
+export type NodeFetchHandler = Parameters<typeof createAdaptorServer>[0]["fetch"];
+export type NodeServer = ReturnType<typeof createAdaptorServer>;
+export declare function listenHttpServer(params: {
+    fetch: NodeFetchHandler;
+    port: number;
+    hostname?: string;
+    onListening?: (info: AddressInfo) => void;
+}): Promise<NodeServer>;
+//# sourceMappingURL=listen.d.ts.map

package/dist/listen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"listen.d.ts","sourceRoot":"","sources":["../src/listen.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C,MAAM,MAAM,gBAAgB,GAAG,UAAU,CACvC,OAAO,mBAAmB,CAC3B,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AACd,MAAM,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,wBAAsB,gBAAgB,CAAC,MAAM,EAAE;IAC7C,KAAK,EAAE,gBAAgB,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,IAAI,CAAC;CAC3C,GAAG,OAAO,CAAC,UAAU,CAAC,CAwBtB"}

package/dist/listen.js

@@ -0,0 +1,23 @@
+import { createAdaptorServer } from "@hono/node-server";
+export async function listenHttpServer(params) {
+    const server = createAdaptorServer({ fetch: params.fetch });
+    await new Promise((resolve, reject) => {
+        const onError = (error) => {
+            server.off("error", onError);
+            reject(error);
+        };
+        server.once("error", onError);
+        server.listen(params.port, params.hostname, () => {
+            server.off("error", onError);
+            const address = server.address();
+            if (!address || typeof address === "string") {
+                reject(new Error("Could not resolve bound server address"));
+                return;
+            }
+            params.onListening?.(address);
+            resolve();
+        });
+    });
+    return server;
+}
+//# sourceMappingURL=listen.js.map

package/dist/listen.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"listen.js","sourceRoot":"","sources":["../src/listen.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAQxD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAKtC;IACC,MAAM,MAAM,GAAG,mBAAmB,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAE5D,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,OAAO,GAAG,CAAC,KAAY,EAAE,EAAE;YAC/B,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7B,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CAAC;QAEF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE;YAC/C,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC5C,MAAM,CAAC,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC,CAAC;gBAC5D,OAAO;YACT,CAAC;YAED,MAAM,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC;YAC9B,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/logger/index.d.ts

@@ -0,0 +1,5 @@
+import { type Logger } from "pino";
+import type { LoggingConfig } from "@opendatalabs/personal-server-ts-core/schemas";
+export type { Logger } from "pino";
+export declare function createLogger(config: LoggingConfig): Logger;
+//# sourceMappingURL=index.d.ts.map

package/dist/logger/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/logger/index.ts"],"names":[],"mappings":"AAAA,OAAa,EAAE,KAAK,MAAM,EAAE,MAAM,MAAM,CAAC;AACzC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+CAA+C,CAAC;AAEnF,YAAY,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAEnC,wBAAgB,YAAY,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAO1D"}

package/dist/logger/index.js

@@ -0,0 +1,9 @@
+import pino from "pino";
+export function createLogger(config) {
+    const usePretty = config.pretty || process.env.NODE_ENV !== "production";
+    return pino({
+        level: config.level,
+        ...(usePretty ? { transport: { target: "pino-pretty" } } : {}),
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/logger/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/logger/index.ts"],"names":[],"mappings":"AAAA,OAAO,IAAqB,MAAM,MAAM,CAAC;AAKzC,MAAM,UAAU,YAAY,CAAC,MAAqB;IAChD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;IAEzE,OAAO,IAAI,CAAC;QACV,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC,CAAC;AACL,CAAC"}

package/dist/logging/access-log.d.ts

@@ -0,0 +1,4 @@
+import type { AccessLogEntry, AccessLogWriter } from "@opendatalabs/personal-server-ts-core/logging/access-log";
+export type { AccessLogEntry, AccessLogWriter };
+export declare function createAccessLogWriter(logsDir: string): AccessLogWriter;
+//# sourceMappingURL=access-log.d.ts.map

package/dist/logging/access-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-log.d.ts","sourceRoot":"","sources":["../../src/logging/access-log.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,cAAc,EACd,eAAe,EAChB,MAAM,0DAA0D,CAAC;AAElE,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,CAAC;AAUhD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,CAiBtE"}

package/dist/logging/access-log.js

@@ -0,0 +1,25 @@
+import { mkdir, appendFile } from "node:fs/promises";
+import { join } from "node:path";
+function formatDateForFilename(isoTimestamp) {
+    const date = new Date(isoTimestamp);
+    const yyyy = date.getUTCFullYear();
+    const mm = String(date.getUTCMonth() + 1).padStart(2, "0");
+    const dd = String(date.getUTCDate()).padStart(2, "0");
+    return `${yyyy}-${mm}-${dd}`;
+}
+export function createAccessLogWriter(logsDir) {
+    let dirCreated = false;
+    return {
+        async write(entry) {
+            if (!dirCreated) {
+                await mkdir(logsDir, { recursive: true });
+                dirCreated = true;
+            }
+            const dateStr = formatDateForFilename(entry.timestamp);
+            const filename = `access-${dateStr}.log`;
+            const filepath = join(logsDir, filename);
+            await appendFile(filepath, JSON.stringify(entry) + "\n", "utf-8");
+        },
+    };
+}
+//# sourceMappingURL=access-log.js.map

package/dist/logging/access-log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-log.js","sourceRoot":"","sources":["../../src/logging/access-log.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAQjC,SAAS,qBAAqB,CAAC,YAAoB;IACjD,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;IACnC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC3D,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACtD,OAAO,GAAG,IAAI,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,IAAI,UAAU,GAAG,KAAK,CAAC;IAEvB,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,KAAqB;YAC/B,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC1C,UAAU,GAAG,IAAI,CAAC;YACpB,CAAC;YAED,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACvD,MAAM,QAAQ,GAAG,UAAU,OAAO,MAAM,CAAC;YACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAEzC,MAAM,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;QACpE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/logging/access-reader.d.ts

@@ -0,0 +1,19 @@
+import type { AccessLogEntry } from "./access-log.js";
+export interface AccessLogReadResult {
+    logs: AccessLogEntry[];
+    total: number;
+    limit: number;
+    offset: number;
+}
+export interface AccessLogReader {
+    read(options?: {
+        limit?: number;
+        offset?: number;
+    }): Promise<AccessLogReadResult>;
+}
+/**
+ * Reads all access-*.log files from logsDir, merges entries,
+ * sorts by timestamp DESC, and paginates.
+ */
+export declare function createAccessLogReader(logsDir: string): AccessLogReader;
+//# sourceMappingURL=access-reader.d.ts.map

package/dist/logging/access-reader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-reader.d.ts","sourceRoot":"","sources":["../../src/logging/access-reader.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,cAAc,EAAE,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,OAAO,CAAC,EAAE;QACb,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAClC;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,CAqDtE"}

package/dist/logging/access-reader.js

@@ -0,0 +1,50 @@
+import { readdir, readFile } from "node:fs/promises";
+import { join } from "node:path";
+/**
+ * Reads all access-*.log files from logsDir, merges entries,
+ * sorts by timestamp DESC, and paginates.
+ */
+export function createAccessLogReader(logsDir) {
+    return {
+        async read(options) {
+            const limit = options?.limit ?? 50;
+            const offset = options?.offset ?? 0;
+            let filenames;
+            try {
+                filenames = await readdir(logsDir);
+            }
+            catch {
+                // Directory doesn't exist — return empty result
+                return { logs: [], total: 0, limit, offset };
+            }
+            const logFiles = filenames.filter((f) => f.startsWith("access-") && f.endsWith(".log"));
+            const allEntries = [];
+            for (const filename of logFiles) {
+                const filepath = join(logsDir, filename);
+                const content = await readFile(filepath, "utf-8");
+                const lines = content
+                    .split("\n")
+                    .filter((line) => line.trim().length > 0);
+                for (const line of lines) {
+                    try {
+                        const entry = JSON.parse(line);
+                        allEntries.push(entry);
+                    }
+                    catch {
+                        // Skip malformed lines
+                    }
+                }
+            }
+            // Sort by timestamp DESC (newest first)
+            allEntries.sort((a, b) => {
+                const ta = new Date(a.timestamp).getTime();
+                const tb = new Date(b.timestamp).getTime();
+                return tb - ta;
+            });
+            const total = allEntries.length;
+            const paginated = allEntries.slice(offset, offset + limit);
+            return { logs: paginated, total, limit, offset };
+        },
+    };
+}
+//# sourceMappingURL=access-reader.js.map

package/dist/logging/access-reader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-reader.js","sourceRoot":"","sources":["../../src/logging/access-reader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAiBjC;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,OAGV;YACC,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC;YAEpC,IAAI,SAAmB,CAAC;YACxB,IAAI,CAAC;gBACH,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;YACrC,CAAC;YAAC,MAAM,CAAC;gBACP,gDAAgD;gBAChD,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAC/C,CAAC;YAED,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACrD,CAAC;YAEF,MAAM,UAAU,GAAqB,EAAE,CAAC;YAExC,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;gBAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBACzC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAClD,MAAM,KAAK,GAAG,OAAO;qBAClB,KAAK,CAAC,IAAI,CAAC;qBACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBAE5C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,IAAI,CAAC;wBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmB,CAAC;wBACjD,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACzB,CAAC;oBAAC,MAAM,CAAC;wBACP,uBAAuB;oBACzB,CAAC;gBACH,CAAC;YACH,CAAC;YAED,wCAAwC;YACxC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;gBACvB,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;gBAC3C,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;gBAC3C,OAAO,EAAE,GAAG,EAAE,CAAC;YACjB,CAAC,CAAC,CAAC;YAEH,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC;YAChC,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC;YAE3D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QACnD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/middleware/access-log.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access-log.d.ts","sourceRoot":"","sources":["../../src/middleware/access-log.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAIhG;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,eAAe,GACtB,iBAAiB,CAoCnB"}
+{"version":3,"file":"access-log.d.ts","sourceRoot":"","sources":["../../src/middleware/access-log.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAIhG;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,eAAe,GACtB,iBAAiB,CA0CnB"}

package/dist/middleware/access-log.js

@@ -12,14 +12,20 @@ export function createAccessLogMiddleware(writer) {
         }
         const auth = c.get("auth");
         const grant = c.get("grant");
-        if (!auth || !grant) {
+        if (!auth) {
             return;
         }
+        const grantId = grant?.id ??
+            (c.get("isPolicyBypass") || c.get("devBypass")
+                ? "policy-bypass"
+                : undefined);
+        if (!grantId)
+            return;
         const scope = c.req.param("scope") ?? "unknown";
         try {
             await writer.write({
                 logId: randomUUID(),
-                grantId: grant.id,
+                grantId,
                 builder: auth.signer,
                 action: "read",
                 scope,

package/dist/middleware/access-log.js.map

@@ -1 +1 @@
-{"version":3,"file":"access-log.js","sourceRoot":"","sources":["../../src/middleware/access-log.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAMzC;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAuB;IAEvB,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,IAAI,EAAE,CAAC;QAEb,4BAA4B;QAC5B,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YAC9C,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAA6B,CAAC;QACvD,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAqC,CAAC;QAEjE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;QAEhD,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,CAAC;gBACjB,KAAK,EAAE,UAAU,EAAE;gBACnB,OAAO,EAAE,KAAK,CAAC,EAAE;gBACjB,OAAO,EAAE,IAAI,CAAC,MAAM;gBACpB,MAAM,EAAE,MAAM;gBACd,KAAK;gBACL,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,SAAS,EACP,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC;oBAC/B,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC;oBACzB,SAAS;gBACX,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,SAAS;aACnD,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,wDAAwD;QAC1D,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"access-log.js","sourceRoot":"","sources":["../../src/middleware/access-log.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAMzC;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAuB;IAEvB,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,IAAI,EAAE,CAAC;QAEb,4BAA4B;QAC5B,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YAC9C,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAA4B,CAAC;QACtD,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAqC,CAAC;QAEjE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GACX,KAAK,EAAE,EAAE;YACT,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC;gBAC5C,CAAC,CAAC,eAAe;gBACjB,CAAC,CAAC,SAAS,CAAC,CAAC;QACjB,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;QAEhD,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,CAAC;gBACjB,KAAK,EAAE,UAAU,EAAE;gBACnB,OAAO;gBACP,OAAO,EAAE,IAAI,CAAC,MAAM;gBACpB,MAAM,EAAE,MAAM;gBACd,KAAK;gBACL,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,SAAS,EACP,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC;oBAC/B,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC;oBACzB,SAAS;gBACX,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,SAAS;aACnD,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,wDAAwD;QAC1D,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/builder-check.d.ts

@@ -1,8 +1,8 @@
 import type { MiddlewareHandler } from "hono";
-import type { GatewayClient } from "@opendatalabs/personal-server-ts-core/gateway";
+import type { GatewayClient } from "@opendatalabs/vana-sdk/node";
 /**
  * Verifies authenticated signer is a registered builder via Gateway.
  * Must run AFTER web3-auth middleware.
  */
-export declare function createBuilderCheckMiddleware(gateway: GatewayClient): MiddlewareHandler;
+export declare function createBuilderCheckMiddleware(gateway: GatewayClient, serverOwner?: `0x${string}`): MiddlewareHandler;
 //# sourceMappingURL=builder-check.d.ts.map

package/dist/middleware/builder-check.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"builder-check.d.ts","sourceRoot":"","sources":["../../src/middleware/builder-check.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+CAA+C,CAAC;AAInF;;;GAGG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,aAAa,GACrB,iBAAiB,CAyBnB"}
+{"version":3,"file":"builder-check.d.ts","sourceRoot":"","sources":["../../src/middleware/builder-check.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAIjE;;;GAGG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,aAAa,EACtB,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,GAC1B,iBAAiB,CAgCnB"}

package/dist/middleware/builder-check.js

@@ -3,13 +3,18 @@ import { UnregisteredBuilderError } from "@opendatalabs/personal-server-ts-core/
  * Verifies authenticated signer is a registered builder via Gateway.
  * Must run AFTER web3-auth middleware.
  */
-export function createBuilderCheckMiddleware(gateway) {
+export function createBuilderCheckMiddleware(gateway, serverOwner) {
     return async (c, next) => {
-        if (c.get("devBypass")) {
+        if (c.get("isPolicyBypass") ?? c.get("devBypass")) {
             await next();
             return;
         }
         const auth = c.get("auth");
+        if (serverOwner &&
+            auth.signer.toLowerCase() === serverOwner.toLowerCase()) {
+            await next();
+            return;
+        }
         try {
             const registered = await gateway.isRegisteredBuilder(auth.signer);
             if (!registered) {

package/dist/middleware/builder-check.js.map

@@ -1 +1 @@
-{"version":3,"file":"builder-check.js","sourceRoot":"","sources":["../../src/middleware/builder-check.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AAExF;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAC1C,OAAsB;IAEtB,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAiB,CAAC;QAE3C,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAElE,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,GAAG,GAAG,IAAI,wBAAwB,EAAE,CAAC;gBAC3C,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;YACnC,CAAC;YAED,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,wBAAwB,EAAE,CAAC;gBAC5C,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;YACnC,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"builder-check.js","sourceRoot":"","sources":["../../src/middleware/builder-check.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AAGxF;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAC1C,OAAsB,EACtB,WAA2B;IAE3B,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAgB,CAAC;QAC1C,IACE,WAAW;YACX,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,WAAW,EAAE,EACvD,CAAC;YACD,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAElE,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,GAAG,GAAG,IAAI,wBAAwB,EAAE,CAAC;gBAC3C,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;YACnC,CAAC;YAED,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,wBAAwB,EAAE,CAAC;gBAC5C,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;YACnC,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/cors.d.ts

@@ -0,0 +1,18 @@
+/**
+ * CORS for browser-based clients (allow all origins).
+ *
+ * A browser preflight only passes when every non-safelisted request header is
+ * listed in Access-Control-Allow-Headers, and a browser can only read a
+ * non-safelisted response header that is listed in
+ * Access-Control-Expose-Headers. Both lists therefore have to track every
+ * custom header the API reads or writes on a browser-reachable route; the
+ * Write API (delegated ingest) is the first path a builder app calls straight
+ * from the browser. Header names are case-insensitive (Fetch).
+ */
+/** Request headers the API reads that are not CORS-safelisted. */
+export declare const CORS_ALLOW_HEADERS: readonly string[];
+/** Response headers a browser client must be able to read back. */
+export declare const CORS_EXPOSE_HEADERS: readonly string[];
+export declare const CORS_ALLOW_METHODS: readonly string[];
+export declare function corsMiddleware(): import("hono").MiddlewareHandler;
+//# sourceMappingURL=cors.d.ts.map

package/dist/middleware/cors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../src/middleware/cors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,kEAAkE;AAClE,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAa/C,CAAC;AAEF,mEAAmE;AACnE,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAIhD,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAM/C,CAAC;AAEF,wBAAgB,cAAc,qCAQ7B"}

package/dist/middleware/cors.js

@@ -0,0 +1,51 @@
+/**
+ * CORS for browser-based clients (allow all origins).
+ *
+ * A browser preflight only passes when every non-safelisted request header is
+ * listed in Access-Control-Allow-Headers, and a browser can only read a
+ * non-safelisted response header that is listed in
+ * Access-Control-Expose-Headers. Both lists therefore have to track every
+ * custom header the API reads or writes on a browser-reachable route; the
+ * Write API (delegated ingest) is the first path a builder app calls straight
+ * from the browser. Header names are case-insensitive (Fetch).
+ */
+import { cors } from "hono/cors";
+import { WRITE_SIGNATURE_HEADER } from "@opendatalabs/personal-server-ts-core/write";
+/** Request headers the API reads that are not CORS-safelisted. */
+export const CORS_ALLOW_HEADERS = [
+    "Content-Type",
+    "Authorization",
+    // Write API: builder-signed payload proof on delegated ingest
+    // (api-auth authorizeWrite -> verifyWriterAttribution).
+    WRITE_SIGNATURE_HEADER,
+    // Ingest hints (core handlePersonalServerDataRequest).
+    "X-Vana-Metadata",
+    "X-Filename",
+    "Content-Disposition",
+    // Granted / paid reads.
+    "X-PS-Grant-Id",
+    "X-PAYMENT",
+];
+/** Response headers a browser client must be able to read back. */
+export const CORS_EXPOSE_HEADERS = [
+    "X-Vana-Metadata",
+    "X-PAYMENT-RESPONSE",
+    "Content-Disposition",
+];
+export const CORS_ALLOW_METHODS = [
+    "GET",
+    "POST",
+    "PUT",
+    "DELETE",
+    "OPTIONS",
+];
+export function corsMiddleware() {
+    return cors({
+        origin: "*",
+        allowHeaders: [...CORS_ALLOW_HEADERS],
+        exposeHeaders: [...CORS_EXPOSE_HEADERS],
+        allowMethods: [...CORS_ALLOW_METHODS],
+        maxAge: 86400,
+    });
+}
+//# sourceMappingURL=cors.js.map

package/dist/middleware/cors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../src/middleware/cors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AAErF,kEAAkE;AAClE,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,cAAc;IACd,eAAe;IACf,8DAA8D;IAC9D,wDAAwD;IACxD,sBAAsB;IACtB,uDAAuD;IACvD,iBAAiB;IACjB,YAAY;IACZ,qBAAqB;IACrB,wBAAwB;IACxB,eAAe;IACf,WAAW;CACZ,CAAC;AAEF,mEAAmE;AACnE,MAAM,CAAC,MAAM,mBAAmB,GAAsB;IACpD,iBAAiB;IACjB,oBAAoB;IACpB,qBAAqB;CACtB,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,KAAK;IACL,MAAM;IACN,KAAK;IACL,QAAQ;IACR,SAAS;CACV,CAAC;AAEF,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,CAAC;QACV,MAAM,EAAE,GAAG;QACX,YAAY,EAAE,CAAC,GAAG,kBAAkB,CAAC;QACrC,aAAa,EAAE,CAAC,GAAG,mBAAmB,CAAC;QACvC,YAAY,EAAE,CAAC,GAAG,kBAAkB,CAAC;QACrC,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;AACL,CAAC"}

package/dist/middleware/owner-check.js

@@ -7,7 +7,7 @@ import { NotOwnerError } from "@opendatalabs/personal-server-ts-core/errors";
  */
 export function createOwnerCheckMiddleware(serverOwner) {
     return async (c, next) => {
-        if (c.get("devBypass")) {
+        if (c.get("isPolicyBypass") ?? c.get("devBypass")) {
             await next();
             return;
         }

package/dist/middleware/owner-check.js.map

@@ -1 +1 @@
-{"version":3,"file":"owner-check.js","sourceRoot":"","sources":["../../src/middleware/owner-check.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,8CAA8C,CAAC;AAG7E;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,WAAsC;IAEtC,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE;oBACL,IAAI,EAAE,GAAG;oBACT,SAAS,EAAE,uBAAuB;oBAClC,OAAO,EACL,0FAA0F;iBAC7F;aACF,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAA6B,CAAC;QAEvD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,WAAW,EAAE,EAAE,CAAC;YAC5D,MAAM,GAAG,GAAG,IAAI,aAAa,CAAC;gBAC5B,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,WAAW;aACtB,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QACnC,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"owner-check.js","sourceRoot":"","sources":["../../src/middleware/owner-check.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,8CAA8C,CAAC;AAG7E;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,WAAsC;IAEtC,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE;oBACL,IAAI,EAAE,GAAG;oBACT,SAAS,EAAE,uBAAuB;oBAClC,OAAO,EACL,0FAA0F;iBAC7F;aACF,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAA4B,CAAC;QAEtD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,WAAW,EAAE,EAAE,CAAC;YAC5D,MAAM,GAAG,GAAG,IAAI,aAAa,CAAC;gBAC5B,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,WAAW;aACtB,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QACnC,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/web3-auth.d.ts

@@ -1,7 +1,14 @@
 import type { MiddlewareHandler } from "hono";
+import { mapSdkAuthError, type AuthMechanism, type RequestAuth, type SessionTokenVerifierPort } from "@opendatalabs/personal-server-ts-core/auth";
+import type { TokenStore } from "../token-store.js";
+import "../hono-context.js";
+export { mapSdkAuthError };
+export type { AuthMechanism, RequestAuth };
 export interface Web3AuthMiddlewareDeps {
     serverOrigin: string | (() => string);
     devToken?: string;
+    accessToken?: string;
+    tokenStore?: TokenStore | SessionTokenVerifierPort;
     serverOwner?: `0x${string}`;
 }
 /**
@@ -11,6 +18,11 @@ export interface Web3AuthMiddlewareDeps {
  * When a devToken is configured and the request carries a matching
  * Bearer token, auth context is populated with the server owner
  * and c.set('devBypass', true) is set to skip downstream checks.
+ *
+ * When a control-plane token (PS_ACCESS_TOKEN) or tokenStore-issued CLI token is
+ * configured and the request carries a matching Bearer token, auth context
+ * is populated with the server owner. These are owner-authenticated requests,
+ * not dev-bypass requests.
  */
 export declare function createWeb3AuthMiddleware(depsOrOrigin: Web3AuthMiddlewareDeps | string): MiddlewareHandler;
 //# sourceMappingURL=web3-auth.d.ts.map

package/dist/middleware/web3-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"web3-auth.d.ts","sourceRoot":"","sources":["../../src/middleware/web3-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAI9C,MAAM,WAAW,sBAAsB;IACrC,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;CAC7B;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,YAAY,EAAE,sBAAsB,GAAG,MAAM,GAC5C,iBAAiB,CAsDnB"}
+{"version":3,"file":"web3-auth.d.ts","sourceRoot":"","sources":["../../src/middleware/web3-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,EAEL,eAAe,EACf,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,wBAAwB,EAC9B,MAAM,4CAA4C,CAAC;AAEpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAMpD,OAAO,oBAAoB,CAAC;AAE5B,OAAO,EAAE,eAAe,EAAE,CAAC;AAC3B,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC;AAE3C,MAAM,WAAW,sBAAsB;IACrC,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,UAAU,GAAG,wBAAwB,CAAC;IACnD,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;CAC7B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACtC,YAAY,EAAE,sBAAsB,GAAG,MAAM,GAC5C,iBAAiB,CA+BnB"}

package/dist/middleware/web3-auth.js

@@ -1,5 +1,12 @@
-import { verifyWeb3Signed } from "@opendatalabs/personal-server-ts-core/auth";
+import { authenticateRequest, mapSdkAuthError, } from "@opendatalabs/personal-server-ts-core/auth";
 import { ProtocolError } from "@opendatalabs/personal-server-ts-core/errors";
+// Ambient module augmentation that types `c.get("authMechanism")` etc. —
+// must be in the TS module graph so the augmentation takes effect. The
+// previous reach-through (data-read-policy.ts) was deleted in the X402
+// migration; the web3-auth middleware is the most natural new anchor
+// since it's the one writing these context vars in the first place.
+import "../hono-context.js";
+export { mapSdkAuthError };
 /**
  * Parses + verifies Web3Signed Authorization header.
  * Sets c.set('auth', VerifiedAuth) for downstream handlers.
@@ -7,47 +14,36 @@ import { ProtocolError } from "@opendatalabs/personal-server-ts-core/errors";
  * When a devToken is configured and the request carries a matching
  * Bearer token, auth context is populated with the server owner
  * and c.set('devBypass', true) is set to skip downstream checks.
+ *
+ * When a control-plane token (PS_ACCESS_TOKEN) or tokenStore-issued CLI token is
+ * configured and the request carries a matching Bearer token, auth context
+ * is populated with the server owner. These are owner-authenticated requests,
+ * not dev-bypass requests.
  */
 export function createWeb3AuthMiddleware(depsOrOrigin) {
     const deps = typeof depsOrOrigin === "string"
         ? { serverOrigin: depsOrOrigin }
         : depsOrOrigin;
     return async (c, next) => {
-        // Dev token bypass: if configured and header matches, skip Web3Signed verification
-        if (deps.devToken) {
-            const authHeader = c.req.header("authorization");
-            if (authHeader === `Bearer ${deps.devToken}`) {
-                if (!deps.serverOwner) {
-                    return c.json({
-                        error: {
-                            code: 500,
-                            errorCode: "SERVER_NOT_CONFIGURED",
-                            message: "Server owner address not configured. Set VANA_MASTER_KEY_SIGNATURE environment variable.",
-                        },
-                    }, 500);
-                }
-                c.set("auth", {
-                    signer: deps.serverOwner,
-                    payload: {},
-                });
-                c.set("devBypass", true);
-                await next();
-                return;
-            }
-        }
         try {
-            const auth = await verifyWeb3Signed({
-                headerValue: c.req.header("authorization"),
-                expectedOrigin: typeof deps.serverOrigin === "function"
-                    ? deps.serverOrigin()
-                    : deps.serverOrigin,
-                expectedMethod: c.req.method,
-                expectedPath: new URL(c.req.url).pathname,
+            const result = await authenticateRequest({
+                request: c.req.raw,
+                serverOrigin: deps.serverOrigin,
+                devToken: deps.devToken,
+                accessToken: deps.accessToken,
+                sessionTokenVerifier: deps.tokenStore,
+                serverOwner: deps.serverOwner,
             });
-            c.set("auth", auth);
+            c.set("auth", result.auth);
+            c.set("authMechanism", result.mechanism);
+            c.set("isPolicyBypass", result.isPolicyBypass);
+            c.set("devBypass", result.devBypass);
             await next();
         }
         catch (err) {
+            const authError = mapSdkAuthError(err);
+            if (authError)
+                return c.json(authError.toJSON(), authError.code);
             if (err instanceof ProtocolError) {
                 return c.json(err.toJSON(), err.code);
             }

package/dist/middleware/web3-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"web3-auth.js","sourceRoot":"","sources":["../../src/middleware/web3-auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,4CAA4C,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,8CAA8C,CAAC;AAQ7E;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CACtC,YAA6C;IAE7C,MAAM,IAAI,GACR,OAAO,YAAY,KAAK,QAAQ;QAC9B,CAAC,CAAC,EAAE,YAAY,EAAE,YAAY,EAAE;QAChC,CAAC,CAAC,YAAY,CAAC;IAEnB,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,mFAAmF;QACnF,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YACjD,IAAI,UAAU,KAAK,UAAU,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;gBAC7C,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;oBACtB,OAAO,CAAC,CAAC,IAAI,CACX;wBACE,KAAK,EAAE;4BACL,IAAI,EAAE,GAAG;4BACT,SAAS,EAAE,uBAAuB;4BAClC,OAAO,EACL,0FAA0F;yBAC7F;qBACF,EACD,GAAG,CACJ,CAAC;gBACJ,CAAC;gBACD,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE;oBACZ,MAAM,EAAE,IAAI,CAAC,WAAW;oBACxB,OAAO,EAAE,EAAE;iBACZ,CAAC,CAAC;gBACH,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;gBACzB,MAAM,IAAI,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;QACH,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC;gBAClC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC;gBAC1C,cAAc,EACZ,OAAO,IAAI,CAAC,YAAY,KAAK,UAAU;oBACrC,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE;oBACrB,CAAC,CAAC,IAAI,CAAC,YAAY;gBACvB,cAAc,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM;gBAC5B,YAAY,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ;aAC1C,CAAC,CAAC;YAEH,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACpB,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;gBACjC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,IAAiB,CAAC,CAAC;YACrD,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"web3-auth.js","sourceRoot":"","sources":["../../src/middleware/web3-auth.ts"],"names":[],"mappings":"AACA,OAAO,EACL,mBAAmB,EACnB,eAAe,GAIhB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,8CAA8C,CAAC;AAE7E,yEAAyE;AACzE,uEAAuE;AACvE,uEAAuE;AACvE,qEAAqE;AACrE,oEAAoE;AACpE,OAAO,oBAAoB,CAAC;AAE5B,OAAO,EAAE,eAAe,EAAE,CAAC;AAW3B;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,wBAAwB,CACtC,YAA6C;IAE7C,MAAM,IAAI,GACR,OAAO,YAAY,KAAK,QAAQ;QAC9B,CAAC,CAAC,EAAE,YAAY,EAAE,YAAY,EAAE;QAChC,CAAC,CAAC,YAAY,CAAC;IAEnB,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;gBACvC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG;gBAClB,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,oBAAoB,EAAE,IAAI,CAAC,UAAU;gBACrC,WAAW,EAAE,IAAI,CAAC,WAAW;aAC9B,CAAC,CAAC;YAEH,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3B,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,SAAiC,CAAC,CAAC;YACjE,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;YAC/C,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YACrC,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,SAAS;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,IAAW,CAAC,CAAC;YACxE,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;gBACjC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,IAAiB,CAAC,CAAC;YACrD,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/migrations/detect-stuck-version-ledger.d.ts

@@ -0,0 +1,43 @@
+import type Database from "better-sqlite3";
+import type { StateMigration } from "./state-migrations.js";
+/**
+ * BUI-715 follow-up — NON-DESTRUCTIVE detection of the stuck version-ledger
+ * fingerprint on the desktop Personal Server.
+ *
+ * Background. The local `version` in `data_files` is a per-snapshot counter
+ * (`findLatestVersionByScope() + 1`, bumped on every connector run). The
+ * gateway's `currentVersion` is a per-content-change counter. When the gateway
+ * falls behind the local counter (a moksha / DataRegistry reset, or a pre-#755
+ * network switch that shared one state folder across mainnet/testnet), repeated
+ * re-snapshots pile up several unsynced rows for the same scope that thrash on
+ * `409 Gap in version sequence`.
+ *
+ * Why detect, not repair. The runtime already recovers this non-destructively:
+ * the upload worker's 409 handling (BUI-540 adopt / BUI-715 rebase, #158/#202)
+ * rebases distinct content onto the gateway's next-valid version and ADOPTS
+ * identical content (`record.dataHash === dataHash`) rather than minting a new
+ * version — so duplicate pending rows dedupe on the next sync without deleting
+ * anything. A boot-time `DELETE` cannot be made safe offline: `data_files`
+ * carries no content hash, so "duplicate re-snapshot" (safe to drop) is
+ * indistinguishable from "distinct history" (must keep). Worse, the schema
+ * migration adds `data_point_id` as a NULL column, so on the first boot after a
+ * schema upgrade a legacy user's fully-synced rows momentarily look pending.
+ * This migration therefore only OBSERVES and records prevalence; recovery is
+ * left to the runtime.
+ *
+ * Caveat on the count. Because `data_point_id IS NULL` also matches rows freshly
+ * backfilled by the schema migration, the reported pending-row count is an upper
+ * bound on the first boot after a schema upgrade. It is telemetry, not a gate.
+ */
+export declare const DETECT_STUCK_VERSION_LEDGER_ID = "2026-07-14-detect-stuck-version-ledger";
+export interface StuckScopeReport {
+    scope: string;
+    pendingRows: number;
+}
+/**
+ * Scopes with more than one row still pending upload (`data_point_id IS NULL`) —
+ * the accumulation fingerprint. One pending row is ordinary in-flight work.
+ */
+export declare function findStuckScopes(db: Database.Database): StuckScopeReport[];
+export declare const detectStuckVersionLedger: StateMigration;
+//# sourceMappingURL=detect-stuck-version-ledger.d.ts.map

package/dist/migrations/detect-stuck-version-ledger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect-stuck-version-ledger.d.ts","sourceRoot":"","sources":["../../src/migrations/detect-stuck-version-ledger.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,8BAA8B,2CACD,CAAC;AAE3C,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AAOD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,GAAG,gBAAgB,EAAE,CAYzE;AAED,eAAO,MAAM,wBAAwB,EAAE,cA6BtC,CAAC"}