@opendatalabs/personal-server-ts-server 0.0.1-canary.01ca694 → 0.0.1-canary.052d47e

package/dist/pending-blob-deletions.js

@@ -0,0 +1,38 @@
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+import { createPendingBlobDeletionStore, normalizePendingBlobDeletions, } from "@opendatalabs/personal-server-ts-core/sync";
+/**
+ * File-backed retry markers for blob deletions whose gateway tombstone landed
+ * but whose storage DELETE did not finish: one exact (scope, version) key
+ * each. Lives next to `sync-cursor.json` under the server root; written
+ * atomically (tmp + rename) like the cursor. A version-1 file (whole scopes)
+ * is read as version-less markers the retry expands into exact keys.
+ */
+export function createFilePendingBlobDeletionStore(filePath) {
+    const kv = {
+        async read() {
+            try {
+                const raw = await readFile(filePath, "utf8");
+                const parsed = JSON.parse(raw);
+                return normalizePendingBlobDeletions(parsed.keys ?? parsed.scopes);
+            }
+            catch (err) {
+                if (err instanceof Error &&
+                    "code" in err &&
+                    err.code === "ENOENT") {
+                    return null;
+                }
+                throw err;
+            }
+        },
+        async write(keys) {
+            await mkdir(dirname(filePath), { recursive: true });
+            const tmpPath = `${filePath}.tmp`;
+            const state = { version: 2, keys };
+            await writeFile(tmpPath, `${JSON.stringify(state, null, 2)}\n`);
+            await rename(tmpPath, filePath);
+        },
+    };
+    return createPendingBlobDeletionStore(kv);
+}
+//# sourceMappingURL=pending-blob-deletions.js.map

package/dist/pending-blob-deletions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-blob-deletions.js","sourceRoot":"","sources":["../src/pending-blob-deletions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EACL,8BAA8B,EAC9B,6BAA6B,GAE9B,MAAM,4CAA4C,CAAC;AAWpD;;;;;;GAMG;AACH,MAAM,UAAU,kCAAkC,CAChD,QAAgB;IAEhB,MAAM,EAAE,GAA0B;QAChC,KAAK,CAAC,IAAI;YACR,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAI5B,CAAC;gBACF,OAAO,6BAA6B,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;YACrE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IACE,GAAG,YAAY,KAAK;oBACpB,MAAM,IAAI,GAAG;oBACZ,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAChD,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,IAAI;YACd,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACpD,MAAM,OAAO,GAAG,GAAG,QAAQ,MAAM,CAAC;YAClC,MAAM,KAAK,GAA6B,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;YAC7D,MAAM,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YAChE,MAAM,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAClC,CAAC;KACF,CAAC;IACF,OAAO,8BAA8B,CAAC,EAAE,CAAC,CAAC;AAC5C,CAAC"}

package/dist/routes/data.d.ts

@@ -1,14 +1,16 @@
 import { Hono } from "hono";
-import { type PersonalServerApiDispatchOptions } from "@opendatalabs/personal-server-ts-core/api";
+import { type PersonalServerApiDispatchOptions, type PersonalServerReadFulfillmentReporter } from "@opendatalabs/personal-server-ts-core/api";
 import type { HierarchyManagerOptions } from "@opendatalabs/personal-server-ts-core/storage/hierarchy";
 import type { IndexManager } from "@opendatalabs/personal-server-ts-core/storage/index";
-import type { GatewayClient } from "@opendatalabs/vana-sdk/node";
+import type { DataPortabilityGatewayConfig, GatewayClient } from "@opendatalabs/vana-sdk/node";
 import type { AccessLogWriter } from "@opendatalabs/personal-server-ts-core/logging/access-log";
-import type { SyncManager } from "@opendatalabs/personal-server-ts-core/sync";
-import type { FeeVerifierPort, DataStoragePort, RuntimeAvailabilityPort } from "@opendatalabs/personal-server-ts-core/ports";
+import type { ScopeDeletionTracker, SyncManager } from "@opendatalabs/personal-server-ts-core/sync";
+import type { DataStoragePort, RuntimeAvailabilityPort } from "@opendatalabs/personal-server-ts-core/ports";
+import type { ServerSigner } from "@opendatalabs/personal-server-ts-core/signing";
 import type { TokenStore } from "../token-store.js";
+import type { WriteProofReplayStore, WriteSessionStore } from "@opendatalabs/personal-server-ts-core/write";
+import type { LineageGatewayPort } from "@opendatalabs/personal-server-ts-core/lineage";
 import type { Logger } from "pino";
-import type { ServerSigner } from "@opendatalabs/personal-server-ts-core/signing";
 export interface DataRouteDeps {
     indexManager: IndexManager;
     hierarchyOptions: HierarchyManagerOptions;
@@ -16,19 +18,68 @@ export interface DataRouteDeps {
     serverOrigin: string | (() => string);
     serverOwner?: `0x${string}`;
     gateway: GatewayClient;
+    /**
+     * Required for the X402 flow on GET /v1/data/:scope. Provides the EIP-712
+     * domain (escrowPaymentDomain + dataRegistryDomain) the server uses to
+     * recover X-PAYMENT signatures and the embedded accessRecord signatures.
+     */
+    gatewayConfig?: DataPortabilityGatewayConfig;
+    /**
+     * Gateway base URL. Used by the X402 forward path — the handler `fetch`es
+     * POST /v1/escrow/pay directly so it can inspect the gateway's structured
+     * error body (the SDK's gateway.payForOperation discards it).
+     */
+    gatewayUrl?: string;
+    /**
+     * When true, GET /v1/data/:scope enforces the X402 challenge / X-PAYMENT
+     * cycle on every read. Off-by-default so dev / test setups don't require
+     * builder-side payment signing.
+     */
+    paymentEnabled?: boolean;
     accessLogWriter: AccessLogWriter;
+    readFulfillmentReporter?: PersonalServerReadFulfillmentReporter;
     syncManager?: SyncManager | null;
+    /** Read-side tombstone memory; reads of a deleted scope answer 410. */
+    scopeDeletions?: ScopeDeletionTracker;
     devToken?: string;
     accessToken?: string;
     tokenStore?: TokenStore;
-    feeVerifier?: FeeVerifierPort;
     dataStorage?: DataStoragePort;
     runtimeAvailability?: RuntimeAvailabilityPort;
-    mountPath?: PersonalServerApiDispatchOptions["basePath"];
-    /** Server signing account — enables binary schema auto-registration. */
+    /**
+     * Write API sessions (POST /v1/write/session). When present, the ingest
+     * endpoint accepts write-session bearer tokens for delegated builder
+     * writes; absent = owner-only ingest, unchanged.
+     */
+    writeSessionStore?: WriteSessionStore;
+    /** Replay guard for per-write proofs; defaults to in-memory (api-auth). */
+    writeProofReplayStore?: WriteProofReplayStore;
+    /**
+     * Powers the RECORD_DATA_ACCESS attestation embedded in 402 challenges.
+     * When supplied alongside serverOwner + paymentEnabled, every challenge
+     * carries a server-signed accessRecord. Required for the on-chain
+     * recordDataAccess to be scheduled by gateway.settle later.
+     */
     serverSigner?: ServerSigner;
-    /** Gateway base URL, required (with serverSigner) for schema registration. */
-    gatewayUrl?: string;
+    /**
+     * Personal server's own EOA address. Needed by the X402 verifier so it
+     * can confirm that the accessRecord echoed back in X-PAYMENT was signed
+     * by this server (not forged by a malicious builder).
+     */
+    serverAddress?: `0x${string}`;
+    /**
+     * Gateway access for derivative data: lineage source lookups on write, the
+     * signed lineage read and the cascade delete walk. Absent = lineage writes
+     * can only cite local scopes; lineage read / cascade answer 503 / 501.
+     */
+    lineageGateway?: LineageGatewayPort;
+    /** Post-commit write hook (derivative recompute on refresh). */
+    onDataWritten?: (event: {
+        scope: string;
+        collectedAt: string;
+        lineageSources?: string[];
+    }) => void;
+    mountPath?: PersonalServerApiDispatchOptions["basePath"];
 }
 export declare function dataRoutes(deps: DataRouteDeps): Hono;
 //# sourceMappingURL=data.d.ts.map

package/dist/routes/data.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"data.d.ts","sourceRoot":"","sources":["../../src/routes/data.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAEL,KAAK,gCAAgC,EACtC,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yDAAyD,CAAC;AACvG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACxF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAChG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4CAA4C,CAAC;AAC9E,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EACf,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAQnC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+CAA+C,CAAC;AAElF,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,YAAY,CAAC;IAC3B,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,OAAO,EAAE,aAAa,CAAC;IACvB,eAAe,EAAE,eAAe,CAAC;IACjC,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;IAC9C,SAAS,CAAC,EAAE,gCAAgC,CAAC,UAAU,CAAC,CAAC;IACzD,wEAAwE;IACxE,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,8EAA8E;IAC9E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI,CAkDpD"}
+{"version":3,"file":"data.d.ts","sourceRoot":"","sources":["../../src/routes/data.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAEL,KAAK,gCAAgC,EACrC,KAAK,qCAAqC,EAC3C,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yDAAyD,CAAC;AACvG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACxF,OAAO,KAAK,EACV,4BAA4B,EAC5B,aAAa,EACd,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAChG,OAAO,KAAK,EACV,oBAAoB,EACpB,WAAW,EACZ,MAAM,4CAA4C,CAAC;AACpD,OAAO,KAAK,EACV,eAAe,EACf,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+CAA+C,CAAC;AAClF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,KAAK,EACV,qBAAqB,EACrB,iBAAiB,EAClB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,+CAA+C,CAAC;AACxF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAQnC,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,YAAY,CAAC;IAC3B,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,OAAO,EAAE,aAAa,CAAC;IACvB;;;;OAIG;IACH,aAAa,CAAC,EAAE,4BAA4B,CAAC;IAC7C;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,eAAe,EAAE,eAAe,CAAC;IACjC,uBAAuB,CAAC,EAAE,qCAAqC,CAAC;IAChE,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACjC,uEAAuE;IACvE,cAAc,CAAC,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;IAC9C;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,2EAA2E;IAC3E,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAC9C;;;;;OAKG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B;;;;OAIG;IACH,aAAa,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC9B;;;;OAIG;IACH,cAAc,CAAC,EAAE,kBAAkB,CAAC;IACpC,gEAAgE;IAChE,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE;QACtB,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;QACpB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;KAC3B,KAAK,IAAI,CAAC;IACX,SAAS,CAAC,EAAE,gCAAgC,CAAC,UAAU,CAAC,CAAC;CAC1D;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI,CAwDpD"}

package/dist/routes/data.js

@@ -3,7 +3,6 @@ import { handlePersonalServerDataRequest, } from "@opendatalabs/personal-server-
 import { createBodyLimit, DATA_INGEST_MAX_SIZE, } from "../middleware/body-limit.js";
 import { createNodeDataStorage } from "../storage/node-data-storage.js";
 import { createServerApiAuth } from "../api-auth.js";
-import { createSchemaRegistrar } from "../schema-registrar.js";
 export function dataRoutes(deps) {
     const app = new Hono();
     const dataStorage = deps.dataStorage ??
@@ -19,26 +18,34 @@ export function dataRoutes(deps) {
         accessToken: deps.accessToken,
         tokenStore: deps.tokenStore,
         dataStorage,
-        feeVerifier: deps.feeVerifier,
         runtimeAvailability: deps.runtimeAvailability,
+        writeSessionStore: deps.writeSessionStore,
+        writeProofReplayStore: deps.writeProofReplayStore,
     });
-    const schemaRegistrar = deps.serverSigner && deps.gatewayUrl
-        ? createSchemaRegistrar({
-            gatewayUrl: deps.gatewayUrl,
-            signer: deps.serverSigner,
-            logger: deps.logger,
-        })
-        : undefined;
     app.use("/:scope", createBodyLimit(DATA_INGEST_MAX_SIZE));
     app.all("*", (c) => handlePersonalServerDataRequest(c.req.raw, {
         storage: dataStorage,
         auth,
-        schemaResolver: deps.gateway,
-        schemaRegistrar,
         accessLogWriter: deps.accessLogWriter,
+        readFulfillmentReporter: deps.readFulfillmentReporter,
         syncManager: deps.syncManager ?? null,
+        scopeDeletions: deps.scopeDeletions,
         runtimeAvailability: deps.runtimeAvailability,
-        feeVerifier: deps.feeVerifier,
+        serverSigner: deps.serverSigner,
+        serverOwner: deps.serverOwner,
+        serverAddress: deps.serverAddress,
+        gateway: deps.gateway,
+        gatewayConfig: deps.gatewayConfig,
+        gatewayUrl: deps.gatewayUrl,
+        paymentEnabled: deps.paymentEnabled,
+        lineageGateway: deps.lineageGateway,
+        onDataWritten: deps.onDataWritten,
+        // Network identifier for the 402 challenge body. We use the chain
+        // id as the convention since the gateway is chain-scoped; clients
+        // dispatch on the (scheme, chainId) pair, not the human name.
+        network: deps.gatewayConfig
+            ? `vana:${deps.gatewayConfig.chainId}`
+            : undefined,
         logger: deps.logger,
     }, { basePath: deps.mountPath }));
     return app;

package/dist/routes/data.js.map

@@ -1 +1 @@
-{"version":3,"file":"data.js","sourceRoot":"","sources":["../../src/routes/data.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EACL,+BAA+B,GAEhC,MAAM,2CAA2C,CAAC;AAanD,OAAO,EACL,eAAe,EACf,oBAAoB,GACrB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAyB/D,MAAM,UAAU,UAAU,CAAC,IAAmB;IAC5C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,MAAM,WAAW,GACf,IAAI,CAAC,WAAW;QAChB,qBAAqB,CAAC;YACpB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;SACxC,CAAC,CAAC;IACL,MAAM,IAAI,GAAG,mBAAmB,CAAC;QAC/B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,WAAW;QACX,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;KAC9C,CAAC,CAAC;IAEH,MAAM,eAAe,GACnB,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,UAAU;QAClC,CAAC,CAAC,qBAAqB,CAAC;YACpB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,MAAM,EAAE,IAAI,CAAC,YAAY;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IAEhB,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC1D,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CACjB,+BAA+B,CAC7B,CAAC,CAAC,GAAG,CAAC,GAAG,EACT;QACE,OAAO,EAAE,WAAW;QACpB,IAAI;QACJ,cAAc,EAAE,IAAI,CAAC,OAAO;QAC5B,eAAe;QACf,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;QACrC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,EACD,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,CAC7B,CACF,CAAC;IAEF,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"data.js","sourceRoot":"","sources":["../../src/routes/data.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EACL,+BAA+B,GAGhC,MAAM,2CAA2C,CAAC;AAwBnD,OAAO,EACL,eAAe,EACf,oBAAoB,GACrB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAyErD,MAAM,UAAU,UAAU,CAAC,IAAmB;IAC5C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,MAAM,WAAW,GACf,IAAI,CAAC,WAAW;QAChB,qBAAqB,CAAC;YACpB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;SACxC,CAAC,CAAC;IACL,MAAM,IAAI,GAAG,mBAAmB,CAAC;QAC/B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,WAAW;QACX,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;KAClD,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC1D,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CACjB,+BAA+B,CAC7B,CAAC,CAAC,GAAG,CAAC,GAAG,EACT;QACE,OAAO,EAAE,WAAW;QACpB,IAAI;QACJ,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;QACrD,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;QACrC,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,kEAAkE;QAClE,kEAAkE;QAClE,8DAA8D;QAC9D,OAAO,EAAE,IAAI,CAAC,aAAa;YACzB,CAAC,CAAC,QAAQ,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE;YACtC,CAAC,CAAC,SAAS;QACb,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,EACD,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,CAC7B,CACF,CAAC;IAEF,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/routes/derivatives.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Derivative compute routes: /v1/derivatives/questions. Thin Hono wrapper
+ * over the runtime-agnostic core handler; builder auth is the Write API's
+ * (write-session token + signed proof), owner auth is the usual owner gate.
+ */
+import { Hono } from "hono";
+import type { Logger } from "pino";
+import type { GatewayClient } from "@opendatalabs/vana-sdk/node";
+import { type PersonalServerDerivativesApiDeps } from "@opendatalabs/personal-server-ts-core/derivatives";
+import type { PersonalServerApiDispatchOptions } from "@opendatalabs/personal-server-ts-core/api";
+import type { DataStoragePort, RuntimeAvailabilityPort } from "@opendatalabs/personal-server-ts-core/ports";
+import type { WriteProofReplayStore, WriteSessionStore } from "@opendatalabs/personal-server-ts-core/write";
+import type { TokenStore } from "../token-store.js";
+export interface DerivativesRouteDeps {
+    logger: Logger;
+    serverOrigin: string | (() => string);
+    serverOwner?: `0x${string}`;
+    gateway: GatewayClient;
+    devToken?: string;
+    accessToken?: string;
+    tokenStore?: TokenStore;
+    dataStorage?: DataStoragePort;
+    runtimeAvailability?: RuntimeAvailabilityPort;
+    /** Shared with the data routes so builder tokens work on both. */
+    writeSessionStore?: WriteSessionStore;
+    writeProofReplayStore?: WriteProofReplayStore;
+    /** The compute layer (store + scheduler). Absent = every route answers 503. */
+    compute?: PersonalServerDerivativesApiDeps["compute"];
+    now?: () => Date;
+    mountPath?: PersonalServerApiDispatchOptions["basePath"];
+}
+export declare function derivativesRoutes(deps: DerivativesRouteDeps): Hono;
+//# sourceMappingURL=derivatives.d.ts.map

package/dist/routes/derivatives.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"derivatives.d.ts","sourceRoot":"","sources":["../../src/routes/derivatives.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AACnC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAGL,KAAK,gCAAgC,EACtC,MAAM,mDAAmD,CAAC;AAC3D,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAClG,OAAO,KAAK,EACV,eAAe,EACf,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EACV,qBAAqB,EACrB,iBAAiB,EAClB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAIpD,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,OAAO,EAAE,aAAa,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;IAC9C,kEAAkE;IAClE,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAC9C,+EAA+E;IAC/E,OAAO,CAAC,EAAE,gCAAgC,CAAC,SAAS,CAAC,CAAC;IACtD,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,SAAS,CAAC,EAAE,gCAAgC,CAAC,UAAU,CAAC,CAAC;CAC1D;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,oBAAoB,GAAG,IAAI,CA6BlE"}

package/dist/routes/derivatives.js

@@ -0,0 +1,33 @@
+/**
+ * Derivative compute routes: /v1/derivatives/questions. Thin Hono wrapper
+ * over the runtime-agnostic core handler; builder auth is the Write API's
+ * (write-session token + signed proof), owner auth is the usual owner gate.
+ */
+import { Hono } from "hono";
+import { handlePersonalServerDerivativesRequest, MAX_QUESTION_BODY_BYTES, } from "@opendatalabs/personal-server-ts-core/derivatives";
+import { createBodyLimit } from "../middleware/body-limit.js";
+import { createServerApiAuth } from "../api-auth.js";
+export function derivativesRoutes(deps) {
+    const app = new Hono();
+    const auth = createServerApiAuth({
+        serverOrigin: deps.serverOrigin,
+        serverOwner: deps.serverOwner,
+        gateway: deps.gateway,
+        devToken: deps.devToken,
+        accessToken: deps.accessToken,
+        tokenStore: deps.tokenStore,
+        dataStorage: deps.dataStorage,
+        runtimeAvailability: deps.runtimeAvailability,
+        writeSessionStore: deps.writeSessionStore,
+        writeProofReplayStore: deps.writeProofReplayStore,
+    });
+    app.use("*", createBodyLimit(MAX_QUESTION_BODY_BYTES));
+    app.all("*", (c) => handlePersonalServerDerivativesRequest(c.req.raw, {
+        auth,
+        compute: deps.compute ?? null,
+        now: deps.now,
+        logger: deps.logger,
+    }, { basePath: deps.mountPath }));
+    return app;
+}
+//# sourceMappingURL=derivatives.js.map

package/dist/routes/derivatives.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"derivatives.js","sourceRoot":"","sources":["../../src/routes/derivatives.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,EACL,sCAAsC,EACtC,uBAAuB,GAExB,MAAM,mDAAmD,CAAC;AAW3D,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAqBrD,MAAM,UAAU,iBAAiB,CAAC,IAA0B;IAC1D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,mBAAmB,CAAC;QAC/B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;KAClD,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,eAAe,CAAC,uBAAuB,CAAC,CAAC,CAAC;IACvD,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CACjB,sCAAsC,CACpC,CAAC,CAAC,GAAG,CAAC,GAAG,EACT;QACE,IAAI;QACJ,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI;QAC7B,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,EACD,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,CAC7B,CACF,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/routes/enclave-jobs.d.ts

@@ -0,0 +1,9 @@
+import { Hono } from "hono";
+import { type JobRequestEnvelope } from "@opendatalabs/vana-sdk/protocol/jobs";
+import type { JobExecuteResponse } from "../jobs/types.js";
+export interface EnclaveJobRouteDeps {
+    accessToken: string;
+    executeJob(envelope: JobRequestEnvelope): Promise<JobExecuteResponse>;
+}
+export declare function enclaveJobRoutes(deps: EnclaveJobRouteDeps): Hono;
+//# sourceMappingURL=enclave-jobs.d.ts.map

package/dist/routes/enclave-jobs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enclave-jobs.d.ts","sourceRoot":"","sources":["../../src/routes/enclave-jobs.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,sCAAsC,CAAC;AAE9C,OAAO,KAAK,EAEV,kBAAkB,EAEnB,MAAM,kBAAkB,CAAC;AAM1B,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;CACvE;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,mBAAmB,GAAG,IAAI,CA0ChE"}

package/dist/routes/enclave-jobs.js

@@ -0,0 +1,104 @@
+import { timingSafeEqual } from "node:crypto";
+import { Hono } from "hono";
+import { isAddress, isHex } from "viem";
+import { JOB_OPERATIONS, JOB_PROTOCOL_VERSION, } from "@opendatalabs/vana-sdk/protocol/jobs";
+import { createBodyLimit } from "../middleware/body-limit.js";
+import { JobFailure } from "../jobs/worker.js";
+const MAX_JOB_BODY_BYTES = 256 * 1024;
+const BEARER_PREFIX = "Bearer ";
+export function enclaveJobRoutes(deps) {
+    const app = new Hono();
+    app.use("/execute", createBodyLimit(MAX_JOB_BODY_BYTES));
+    app.post("/execute", async (context) => {
+        if (!hasValidBearer(context.req.header("authorization"), deps.accessToken)) {
+            return context.json(jobError("AUTH_INVALID", "invalid bearer token"), 401);
+        }
+        let body;
+        try {
+            body = await context.req.json();
+        }
+        catch {
+            return context.json({ error: { message: "invalid request body" } }, 400);
+        }
+        if (!isJobEnvelope(body)) {
+            return context.json({ error: { message: "invalid request body" } }, 400);
+        }
+        try {
+            return context.json(await deps.executeJob(body), 200);
+        }
+        catch (error) {
+            if (error instanceof JobFailure) {
+                return context.json(jobError(error.code, error.message, error.retryable), statusFor(error.code));
+            }
+            return context.json(jobError("INTERNAL", "job execution failed", true), 500);
+        }
+    });
+    return app;
+}
+function hasValidBearer(header, expected) {
+    if (!header?.startsWith(BEARER_PREFIX)) {
+        return false;
+    }
+    const received = Buffer.from(header.slice(BEARER_PREFIX.length));
+    const target = Buffer.from(expected);
+    if (received.length !== target.length) {
+        return false;
+    }
+    return timingSafeEqual(received, target);
+}
+function isJobEnvelope(value) {
+    if (!isRecord(value) || !isRecord(value.request)) {
+        return false;
+    }
+    const request = value.request;
+    return (value.auth !== "" &&
+        typeof value.auth === "string" &&
+        request.v === JOB_PROTOCOL_VERSION &&
+        typeof request.jobId === "string" &&
+        isAddressValue(request.owner) &&
+        isAddressValue(request.builder) &&
+        isHexValue(request.builderPublicKey) &&
+        isHexValue(request.grantId) &&
+        typeof request.scope === "string" &&
+        JOB_OPERATIONS.some((operation) => operation === request.operation) &&
+        (request.pinnedVersion === null ||
+            typeof request.pinnedVersion === "string") &&
+        typeof request.deadline === "string");
+}
+function isAddressValue(value) {
+    return typeof value === "string" && isAddress(value);
+}
+function isHexValue(value) {
+    return typeof value === "string" && isHex(value);
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null;
+}
+function jobError(code, message, retryable = false) {
+    return { error: { code, message, retryable } };
+}
+function statusFor(code) {
+    switch (code) {
+        case "AUTH_INVALID":
+            return 401;
+        case "BUILDER_MISMATCH":
+        case "OWNER_MISMATCH":
+        case "GRANT_REVOKED":
+        case "GRANT_INVALID":
+        case "SIGNED_ARTIFACT_MISSING":
+        case "SIGNED_ARTIFACT_INVALID":
+        case "SERVER_NOT_REGISTERED":
+            return 403;
+        case "SCOPE_NOT_FOUND":
+            return 404;
+        case "VERSION_MISMATCH":
+            return 409;
+        case "DEADLINE_PASSED":
+            return 410;
+        case "RESULT_TOO_LARGE":
+            return 413;
+        case "INTERNAL":
+            return 500;
+    }
+}
+//# sourceMappingURL=enclave-jobs.js.map

package/dist/routes/enclave-jobs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enclave-jobs.js","sourceRoot":"","sources":["../../src/routes/enclave-jobs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,KAAK,EAA0B,MAAM,MAAM,CAAC;AAChE,OAAO,EACL,cAAc,EACd,oBAAoB,GAErB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAM9D,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C,MAAM,kBAAkB,GAAG,GAAG,GAAG,IAAI,CAAC;AACtC,MAAM,aAAa,GAAG,SAAS,CAAC;AAOhC,MAAM,UAAU,gBAAgB,CAAC,IAAyB;IACxD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,eAAe,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACzD,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACrC,IACE,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,EACtE,CAAC;YACD,OAAO,OAAO,CAAC,IAAI,CACjB,QAAQ,CAAC,cAAc,EAAE,sBAAsB,CAAC,EAChD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3E,CAAC;QAED,IAAI,CAAC;YACH,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;gBAChC,OAAO,OAAO,CAAC,IAAI,CACjB,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,EACpD,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CACtB,CAAC;YACJ,CAAC;YAED,OAAO,OAAO,CAAC,IAAI,CACjB,QAAQ,CAAC,UAAU,EAAE,sBAAsB,EAAE,IAAI,CAAC,EAClD,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CAAC,MAA0B,EAAE,QAAgB;IAClE,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QACtC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAE9B,OAAO,CACL,KAAK,CAAC,IAAI,KAAK,EAAE;QACjB,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,OAAO,CAAC,CAAC,KAAK,oBAAoB;QAClC,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;QACjC,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC;QAC7B,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC;QAC/B,UAAU,CAAC,OAAO,CAAC,gBAAgB,CAAC;QACpC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC;QAC3B,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;QACjC,cAAc,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,CAAC;QACnE,CAAC,OAAO,CAAC,aAAa,KAAK,IAAI;YAC7B,OAAO,OAAO,CAAC,aAAa,KAAK,QAAQ,CAAC;QAC5C,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CACrC,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACrD,CAAC;AAED,SAAS,QAAQ,CACf,IAAoB,EACpB,OAAe,EACf,SAAS,GAAG,KAAK;IAEjB,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC;AACjD,CAAC;AAED,SAAS,SAAS,CAChB,IAAoB;IAEpB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,cAAc;YACjB,OAAO,GAAG,CAAC;QACb,KAAK,kBAAkB,CAAC;QACxB,KAAK,gBAAgB,CAAC;QACtB,KAAK,eAAe,CAAC;QACrB,KAAK,eAAe,CAAC;QACrB,KAAK,yBAAyB,CAAC;QAC/B,KAAK,yBAAyB,CAAC;QAC/B,KAAK,uBAAuB;YAC1B,OAAO,GAAG,CAAC;QACb,KAAK,iBAAiB;YACpB,OAAO,GAAG,CAAC;QACb,KAAK,kBAAkB;YACrB,OAAO,GAAG,CAAC;QACb,KAAK,iBAAiB;YACpB,OAAO,GAAG,CAAC;QACb,KAAK,kBAAkB;YACrB,OAAO,GAAG,CAAC;QACb,KAAK,UAAU;YACb,OAAO,GAAG,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/routes/mcp.d.ts

@@ -19,12 +19,13 @@
 import { Hono } from "hono";
 import type { Logger } from "pino";
 import type { DataPortabilityGatewayConfig, GatewayClient } from "@opendatalabs/vana-sdk/node";
-import { buildMcpUrl, buildStableMcpUrl, type McpConnectionStore, type McpOAuthAuthorizationStore, type McpActivityRecorder } from "@opendatalabs/personal-server-ts-core/mcp";
+import { buildMcpUrl, buildStableMcpUrl, type McpProofReplayStore, type McpConnectionStore, type McpSessionStore, type McpOAuthAuthorizationStore, type McpActivityRecorder } from "@opendatalabs/personal-server-ts-core/mcp";
+import type { PersonalServerReadFulfillmentReporter } from "@opendatalabs/personal-server-ts-core/api";
 import type { AccessLogWriter } from "@opendatalabs/personal-server-ts-core/logging/access-log";
 import type { ServerSigner } from "@opendatalabs/personal-server-ts-core/signing";
 import type { HierarchyManagerOptions } from "@opendatalabs/personal-server-ts-core/storage/hierarchy";
 import type { IndexManager } from "@opendatalabs/personal-server-ts-core/storage/index";
-import type { DataStoragePort, FeeVerifierPort, RuntimeAvailabilityPort } from "@opendatalabs/personal-server-ts-core/ports";
+import type { DataStoragePort, RuntimeAvailabilityPort } from "@opendatalabs/personal-server-ts-core/ports";
 import type { TokenStore } from "../token-store.js";
 export interface McpRouteDeps {
     logger: Logger;
@@ -36,22 +37,40 @@ export interface McpRouteDeps {
      */
     serverOrigin: string | (() => string);
     serverOwner?: `0x${string}`;
-    serverSigner?: Pick<ServerSigner, "signGrantRegistration">;
+    /** The server's own account address — required for x402 payment settlement. */
+    serverAddress?: `0x${string}`;
+    serverSigner?: Pick<ServerSigner, "signGrantRegistration" | "signRecordDataAccess">;
     gateway: GatewayClient;
     gatewayConfig?: (DataPortabilityGatewayConfig & {
         url?: string;
     }) | null;
+    /**
+     * Enables x402 pay-per-read for self-signing (chatbot) MCP sessions only.
+     * The owner/OAuth connection path is always free regardless of this flag.
+     */
+    paymentEnabled?: boolean;
     devToken?: string;
     accessToken?: string;
     tokenStore?: TokenStore;
     accessLogWriter: AccessLogWriter;
+    readFulfillmentReporter?: PersonalServerReadFulfillmentReporter;
     indexManager?: IndexManager;
     hierarchyOptions?: HierarchyManagerOptions;
     dataStorage?: DataStoragePort;
-    feeVerifier?: FeeVerifierPort;
     runtimeAvailability?: RuntimeAvailabilityPort;
     /** Per-process connection store. Defaults to in-memory. */
     connectionStore?: McpConnectionStore;
+    /**
+     * Per-process store for self-signing chatbot MCP sessions (Option A).
+     * Defaults to in-memory. Shared within `mcpStreamableHttpRoutes` between the
+     * `/mcp/session` handshake and the `/mcp` reads.
+     */
+    sessionStore?: McpSessionStore;
+    /**
+     * Per-process replay guard for `/mcp/session` handshake proofs. Defaults to
+     * in-memory. Rejects reuse of a still-valid Web3Signed proof.
+     */
+    proofReplayStore?: McpProofReplayStore;
     /**
      * OAuth authorization store shared by `/mcp/oauth/authorize`,
      * `/mcp/oauth/token`, and the owner approval endpoint.

package/dist/routes/mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../src/routes/mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AACnC,OAAO,KAAK,EACV,4BAA4B,EAC5B,aAAa,EACd,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAKL,WAAW,EACX,iBAAiB,EAkBjB,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,EAC/B,KAAK,mBAAmB,EACzB,MAAM,2CAA2C,CAAC;AAOnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAChG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+CAA+C,CAAC;AAClF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yDAAyD,CAAC;AACvG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACxF,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EACf,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAGpD,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,YAAY,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,uBAAuB,CAAC,CAAC;IAC3D,OAAO,EAAE,aAAa,CAAC;IACvB,aAAa,CAAC,EAAE,CAAC,4BAA4B,GAAG;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;IACzE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,eAAe,EAAE,eAAe,CAAC;IACjC,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAC3C,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;IAC9C,2DAA2D;IAC3D,eAAe,CAAC,EAAE,kBAAkB,CAAC;IACrC;;;OAGG;IACH,uBAAuB,CAAC,EAAE,0BAA0B,CAAC;IACrD,sDAAsD;IACtD,gBAAgB,CAAC,EAAE,mBAAmB,CAAC;IACvC;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;CAC5C;AAuID;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAqG7D;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAgTvD;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAoFhE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAkC1D;AAED,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC"}
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../src/routes/mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AACnC,OAAO,KAAK,EACV,4BAA4B,EAC5B,aAAa,EACd,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAKL,WAAW,EACX,iBAAiB,EAWjB,KAAK,mBAAmB,EAcxB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,0BAA0B,EAC/B,KAAK,mBAAmB,EACzB,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAGV,qCAAqC,EACtC,MAAM,2CAA2C,CAAC;AAInD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAChG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+CAA+C,CAAC;AAClF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yDAAyD,CAAC;AACvG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACxF,OAAO,KAAK,EACV,eAAe,EACf,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAGpD,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,+EAA+E;IAC/E,aAAa,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC9B,YAAY,CAAC,EAAE,IAAI,CACjB,YAAY,EACZ,uBAAuB,GAAG,sBAAsB,CACjD,CAAC;IACF,OAAO,EAAE,aAAa,CAAC;IACvB,aAAa,CAAC,EAAE,CAAC,4BAA4B,GAAG;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;IACzE;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,eAAe,EAAE,eAAe,CAAC;IACjC,uBAAuB,CAAC,EAAE,qCAAqC,CAAC;IAChE,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAC3C,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;IAC9C,2DAA2D;IAC3D,eAAe,CAAC,EAAE,kBAAkB,CAAC;IACrC;;;;OAIG;IACH,YAAY,CAAC,EAAE,eAAe,CAAC;IAC/B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,mBAAmB,CAAC;IACvC;;;OAGG;IACH,uBAAuB,CAAC,EAAE,0BAA0B,CAAC;IACrD,sDAAsD;IACtD,gBAAgB,CAAC,EAAE,mBAAmB,CAAC;IACvC;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;CAC5C;AAqID;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAqG7D;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAgTvD;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CA6RhE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAkC1D;AAED,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC"}