@opendatalabs/personal-server-ts-server 0.0.1-canary.0d0705b

package/dist/middleware/grant-check.js

@@ -0,0 +1,90 @@
+import { scopeCoveredByGrant } from "@opendatalabs/personal-server-ts-core/scopes";
+import { GrantRequiredError, GrantRevokedError, GrantExpiredError, ScopeMismatchError, InvalidSignatureError, ProtocolError, } from "@opendatalabs/personal-server-ts-core/errors";
+/**
+ * Parse the opaque `grant` string from the gateway response.
+ * The grant field is a JSON-serialized EIP-712 grant payload containing
+ * { user, builder, scopes, expiresAt, nonce }.
+ */
+function parseGrantPayload(grantString) {
+    try {
+        const parsed = JSON.parse(grantString);
+        return {
+            scopes: Array.isArray(parsed.scopes) ? parsed.scopes : [],
+            expiresAt: typeof parsed.expiresAt === "number" ? parsed.expiresAt : 0,
+        };
+    }
+    catch {
+        return { scopes: [], expiresAt: 0 };
+    }
+}
+/**
+ * Enforces grant for data reads. Must run AFTER web3-auth middleware.
+ * Fetches grant from Gateway, checks revocation/expiry/scope/grantee.
+ * Sets c.set('grant', grantResponse).
+ */
+export function createGrantCheckMiddleware(params) {
+    const { gateway } = params;
+    return async (c, next) => {
+        if (c.get("devBypass")) {
+            await next();
+            return;
+        }
+        const auth = c.get("auth");
+        try {
+            // 1. Extract grantId from auth payload
+            const grantId = auth.payload.grantId;
+            if (!grantId) {
+                throw new GrantRequiredError({
+                    reason: "No grantId in authorization payload",
+                });
+            }
+            // 2. Fetch grant from Gateway
+            const grant = await gateway.getGrant(grantId);
+            if (!grant) {
+                throw new GrantRequiredError({ reason: "Grant not found", grantId });
+            }
+            // 3. Check revocation — gateway uses revokedAt (null = not revoked)
+            if (grant.revokedAt !== null) {
+                throw new GrantRevokedError({ grantId: grant.id });
+            }
+            // 4. Parse the opaque grant string to extract scopes and expiresAt
+            const grantPayload = parseGrantPayload(grant.grant);
+            // 5. Check expiry (expiresAt > 0 && expiresAt < now means expired)
+            if (grantPayload.expiresAt > 0) {
+                const now = Math.floor(Date.now() / 1000);
+                if (grantPayload.expiresAt < now) {
+                    throw new GrantExpiredError({ expiresAt: grantPayload.expiresAt });
+                }
+            }
+            // 6. Check scope coverage — extract scope from route param
+            const scope = c.req.param("scope");
+            if (scope && !scopeCoveredByGrant(scope, grantPayload.scopes)) {
+                throw new ScopeMismatchError({
+                    requestedScope: scope,
+                    grantedScopes: grantPayload.scopes,
+                });
+            }
+            // 7. Check grantee — signer must be the grant's builder.
+            //    Gateway returns granteeId (bytes32 builderId), not an address.
+            //    Look up builder by signer address, then compare builder.id === grant.granteeId.
+            const builder = await gateway.getBuilder(auth.signer);
+            if (!builder || builder.id !== grant.granteeId) {
+                throw new InvalidSignatureError({
+                    reason: "Request signer is not the grant builder",
+                    expected: grant.granteeId,
+                    actual: auth.signer,
+                });
+            }
+            // Set grant on context for downstream handlers
+            c.set("grant", grant);
+            await next();
+        }
+        catch (err) {
+            if (err instanceof ProtocolError) {
+                return c.json(err.toJSON(), err.code);
+            }
+            throw err;
+        }
+    };
+}
+//# sourceMappingURL=grant-check.js.map

package/dist/middleware/grant-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-check.js","sourceRoot":"","sources":["../../src/middleware/grant-check.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,mBAAmB,EAAE,MAAM,8CAA8C,CAAC;AACnF,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,aAAa,GACd,MAAM,8CAA8C,CAAC;AAEtD;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,WAAmB;IAI5C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAGpC,CAAC;QACF,OAAO;YACL,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;YACzD,SAAS,EAAE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;SACvE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACtC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAG1C;IACC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IAE3B,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAiB,CAAC;QAE3C,IAAI,CAAC;YACH,uCAAuC;YACvC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;YACrC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,kBAAkB,CAAC;oBAC3B,MAAM,EAAE,qCAAqC;iBAC9C,CAAC,CAAC;YACL,CAAC;YAED,8BAA8B;YAC9B,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC9C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,kBAAkB,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,CAAC;YACvE,CAAC;YAED,oEAAoE;YACpE,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;gBAC7B,MAAM,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YACrD,CAAC;YAED,mEAAmE;YACnE,MAAM,YAAY,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAEpD,mEAAmE;YACnE,IAAI,YAAY,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;gBAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;gBAC1C,IAAI,YAAY,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;oBACjC,MAAM,IAAI,iBAAiB,CAAC,EAAE,SAAS,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,CAAC;gBACrE,CAAC;YACH,CAAC;YAED,2DAA2D;YAC3D,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,KAAK,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,kBAAkB,CAAC;oBAC3B,cAAc,EAAE,KAAK;oBACrB,aAAa,EAAE,YAAY,CAAC,MAAM;iBACnC,CAAC,CAAC;YACL,CAAC;YAED,yDAAyD;YACzD,oEAAoE;YACpE,qFAAqF;YACrF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,EAAE,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;gBAC/C,MAAM,IAAI,qBAAqB,CAAC;oBAC9B,MAAM,EAAE,yCAAyC;oBACjD,QAAQ,EAAE,KAAK,CAAC,SAAS;oBACzB,MAAM,EAAE,IAAI,CAAC,MAAM;iBACpB,CAAC,CAAC;YACL,CAAC;YAED,+CAA+C;YAC/C,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACtB,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;gBACjC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,IAAiB,CAAC,CAAC;YACrD,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/owner-check.d.ts

@@ -0,0 +1,9 @@
+import type { MiddlewareHandler } from "hono";
+/**
+ * Verifies the authenticated signer is the server owner.
+ * Must run AFTER web3-auth middleware (expects c.get('auth')).
+ * Returns 500 when serverOwner is not configured.
+ * Compares addresses case-insensitively.
+ */
+export declare function createOwnerCheckMiddleware(serverOwner: `0x${string}` | undefined): MiddlewareHandler;
+//# sourceMappingURL=owner-check.d.ts.map

package/dist/middleware/owner-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-check.d.ts","sourceRoot":"","sources":["../../src/middleware/owner-check.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAI9C;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,WAAW,EAAE,KAAK,MAAM,EAAE,GAAG,SAAS,GACrC,iBAAiB,CAuCnB"}

package/dist/middleware/owner-check.js

@@ -0,0 +1,37 @@
+import { NotOwnerError } from "@opendatalabs/personal-server-ts-core/errors";
+/**
+ * Verifies the authenticated signer is the server owner.
+ * Must run AFTER web3-auth middleware (expects c.get('auth')).
+ * Returns 500 when serverOwner is not configured.
+ * Compares addresses case-insensitively.
+ */
+export function createOwnerCheckMiddleware(serverOwner) {
+    return async (c, next) => {
+        if (c.get("devBypass")) {
+            await next();
+            return;
+        }
+        if (!serverOwner) {
+            return c.json({
+                error: {
+                    code: 500,
+                    errorCode: "SERVER_NOT_CONFIGURED",
+                    message: "Server owner address not configured. Set VANA_MASTER_KEY_SIGNATURE environment variable.",
+                },
+            }, 500);
+        }
+        const auth = c.get("auth");
+        if (!auth) {
+            throw new Error("owner-check middleware requires web3-auth middleware to run first");
+        }
+        if (auth.signer.toLowerCase() !== serverOwner.toLowerCase()) {
+            const err = new NotOwnerError({
+                signer: auth.signer,
+                expected: serverOwner,
+            });
+            return c.json(err.toJSON(), 401);
+        }
+        await next();
+    };
+}
+//# sourceMappingURL=owner-check.js.map

package/dist/middleware/owner-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-check.js","sourceRoot":"","sources":["../../src/middleware/owner-check.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,8CAA8C,CAAC;AAG7E;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,WAAsC;IAEtC,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE;oBACL,IAAI,EAAE,GAAG;oBACT,SAAS,EAAE,uBAAuB;oBAClC,OAAO,EACL,0FAA0F;iBAC7F;aACF,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAA6B,CAAC;QAEvD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,WAAW,EAAE,EAAE,CAAC;YAC5D,MAAM,GAAG,GAAG,IAAI,aAAa,CAAC;gBAC5B,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,WAAW;aACtB,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QACnC,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/web3-auth.d.ts

@@ -0,0 +1,16 @@
+import type { MiddlewareHandler } from "hono";
+export interface Web3AuthMiddlewareDeps {
+    serverOrigin: string;
+    devToken?: string;
+    serverOwner?: `0x${string}`;
+}
+/**
+ * Parses + verifies Web3Signed Authorization header.
+ * Sets c.set('auth', VerifiedAuth) for downstream handlers.
+ *
+ * When a devToken is configured and the request carries a matching
+ * Bearer token, auth context is populated with the server owner
+ * and c.set('devBypass', true) is set to skip downstream checks.
+ */
+export declare function createWeb3AuthMiddleware(depsOrOrigin: Web3AuthMiddlewareDeps | string): MiddlewareHandler;
+//# sourceMappingURL=web3-auth.d.ts.map

package/dist/middleware/web3-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"web3-auth.d.ts","sourceRoot":"","sources":["../../src/middleware/web3-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAI9C,MAAM,WAAW,sBAAsB;IACrC,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;CAC7B;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,YAAY,EAAE,sBAAsB,GAAG,MAAM,GAC5C,iBAAiB,CAmDnB"}

package/dist/middleware/web3-auth.js

@@ -0,0 +1,56 @@
+import { verifyWeb3Signed } from "@opendatalabs/personal-server-ts-core/auth";
+import { ProtocolError } from "@opendatalabs/personal-server-ts-core/errors";
+/**
+ * Parses + verifies Web3Signed Authorization header.
+ * Sets c.set('auth', VerifiedAuth) for downstream handlers.
+ *
+ * When a devToken is configured and the request carries a matching
+ * Bearer token, auth context is populated with the server owner
+ * and c.set('devBypass', true) is set to skip downstream checks.
+ */
+export function createWeb3AuthMiddleware(depsOrOrigin) {
+    const deps = typeof depsOrOrigin === "string"
+        ? { serverOrigin: depsOrOrigin }
+        : depsOrOrigin;
+    return async (c, next) => {
+        // Dev token bypass: if configured and header matches, skip Web3Signed verification
+        if (deps.devToken) {
+            const authHeader = c.req.header("authorization");
+            if (authHeader === `Bearer ${deps.devToken}`) {
+                if (!deps.serverOwner) {
+                    return c.json({
+                        error: {
+                            code: 500,
+                            errorCode: "SERVER_NOT_CONFIGURED",
+                            message: "Server owner address not configured. Set VANA_MASTER_KEY_SIGNATURE environment variable.",
+                        },
+                    }, 500);
+                }
+                c.set("auth", {
+                    signer: deps.serverOwner,
+                    payload: {},
+                });
+                c.set("devBypass", true);
+                await next();
+                return;
+            }
+        }
+        try {
+            const auth = await verifyWeb3Signed({
+                headerValue: c.req.header("authorization"),
+                expectedOrigin: deps.serverOrigin,
+                expectedMethod: c.req.method,
+                expectedPath: new URL(c.req.url).pathname,
+            });
+            c.set("auth", auth);
+            await next();
+        }
+        catch (err) {
+            if (err instanceof ProtocolError) {
+                return c.json(err.toJSON(), err.code);
+            }
+            throw err;
+        }
+    };
+}
+//# sourceMappingURL=web3-auth.js.map

package/dist/middleware/web3-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web3-auth.js","sourceRoot":"","sources":["../../src/middleware/web3-auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,4CAA4C,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,8CAA8C,CAAC;AAQ7E;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CACtC,YAA6C;IAE7C,MAAM,IAAI,GACR,OAAO,YAAY,KAAK,QAAQ;QAC9B,CAAC,CAAC,EAAE,YAAY,EAAE,YAAY,EAAE;QAChC,CAAC,CAAC,YAAY,CAAC;IAEnB,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,mFAAmF;QACnF,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YACjD,IAAI,UAAU,KAAK,UAAU,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;gBAC7C,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;oBACtB,OAAO,CAAC,CAAC,IAAI,CACX;wBACE,KAAK,EAAE;4BACL,IAAI,EAAE,GAAG;4BACT,SAAS,EAAE,uBAAuB;4BAClC,OAAO,EACL,0FAA0F;yBAC7F;qBACF,EACD,GAAG,CACJ,CAAC;gBACJ,CAAC;gBACD,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE;oBACZ,MAAM,EAAE,IAAI,CAAC,WAAW;oBACxB,OAAO,EAAE,EAAE;iBACZ,CAAC,CAAC;gBACH,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;gBACzB,MAAM,IAAI,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;QACH,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC;gBAClC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC;gBAC1C,cAAc,EAAE,IAAI,CAAC,YAAY;gBACjC,cAAc,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM;gBAC5B,YAAY,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ;aAC1C,CAAC,CAAC;YAEH,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACpB,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;gBACjC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,IAAiB,CAAC,CAAC;YACrD,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/routes/access-logs.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Access logs routes — GET / returns paginated access log entries.
+ * Owner auth is wired in Task 4.1.
+ */
+import { Hono } from "hono";
+import type { Logger } from "pino";
+import type { AccessLogReader } from "@opendatalabs/personal-server-ts-core/logging/access-reader";
+export interface AccessLogsRouteDeps {
+    logger: Logger;
+    accessLogReader: AccessLogReader;
+    serverOrigin: string;
+    serverOwner?: `0x${string}`;
+    devToken?: string;
+}
+export declare function accessLogsRoutes(deps: AccessLogsRouteDeps): Hono;
+//# sourceMappingURL=access-logs.d.ts.map

package/dist/routes/access-logs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-logs.d.ts","sourceRoot":"","sources":["../../src/routes/access-logs.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AACnC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6DAA6D,CAAC;AAInG,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,eAAe,CAAC;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,mBAAmB,GAAG,IAAI,CA2BhE"}

package/dist/routes/access-logs.js

@@ -0,0 +1,30 @@
+/**
+ * Access logs routes — GET / returns paginated access log entries.
+ * Owner auth is wired in Task 4.1.
+ */
+import { Hono } from "hono";
+import { createWeb3AuthMiddleware } from "../middleware/web3-auth.js";
+import { createOwnerCheckMiddleware } from "../middleware/owner-check.js";
+export function accessLogsRoutes(deps) {
+    const app = new Hono();
+    const web3Auth = createWeb3AuthMiddleware({
+        serverOrigin: deps.serverOrigin,
+        devToken: deps.devToken,
+        serverOwner: deps.serverOwner,
+    });
+    const ownerCheck = createOwnerCheckMiddleware(deps.serverOwner);
+    // GET / — list access logs with pagination (owner auth required)
+    app.get("/", web3Auth, ownerCheck, async (c) => {
+        const limitParam = c.req.query("limit");
+        const offsetParam = c.req.query("offset");
+        const limit = limitParam !== undefined ? parseInt(limitParam, 10) : 50;
+        const offset = offsetParam !== undefined ? parseInt(offsetParam, 10) : 0;
+        const result = await deps.accessLogReader.read({
+            limit: Number.isNaN(limit) ? 50 : limit,
+            offset: Number.isNaN(offset) ? 0 : offset,
+        });
+        return c.json(result);
+    });
+    return app;
+}
+//# sourceMappingURL=access-logs.js.map

package/dist/routes/access-logs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-logs.js","sourceRoot":"","sources":["../../src/routes/access-logs.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAU1E,MAAM,UAAU,gBAAgB,CAAC,IAAyB;IACxD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,MAAM,QAAQ,GAAG,wBAAwB,CAAC;QACxC,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,0BAA0B,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAEhE,iEAAiE;IACjE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7C,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAE1C,MAAM,KAAK,GAAG,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,MAAM,MAAM,GAAG,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAEzE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;YAC7C,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK;YACvC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;SAC1C,CAAC,CAAC;QAEH,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/routes/data.d.ts

@@ -0,0 +1,20 @@
+import { Hono } from "hono";
+import type { HierarchyManagerOptions } from "@opendatalabs/personal-server-ts-core/storage/hierarchy";
+import type { IndexManager } from "@opendatalabs/personal-server-ts-core/storage/index";
+import type { GatewayClient } from "@opendatalabs/personal-server-ts-core/gateway";
+import type { AccessLogWriter } from "@opendatalabs/personal-server-ts-core/logging/access-log";
+import type { SyncManager } from "@opendatalabs/personal-server-ts-core/sync";
+import type { Logger } from "pino";
+export interface DataRouteDeps {
+    indexManager: IndexManager;
+    hierarchyOptions: HierarchyManagerOptions;
+    logger: Logger;
+    serverOrigin: string;
+    serverOwner?: `0x${string}`;
+    gateway: GatewayClient;
+    accessLogWriter: AccessLogWriter;
+    syncManager?: SyncManager | null;
+    devToken?: string;
+}
+export declare function dataRoutes(deps: DataRouteDeps): Hono;
+//# sourceMappingURL=data.d.ts.map

package/dist/routes/data.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"data.d.ts","sourceRoot":"","sources":["../../src/routes/data.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAS5B,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yDAAyD,CAAC;AACvG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACxF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+CAA+C,CAAC;AACnF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAChG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4CAA4C,CAAC;AAC9E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAWnC,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,YAAY,CAAC;IAC3B,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,OAAO,EAAE,aAAa,CAAC;IACvB,eAAe,EAAE,eAAe,CAAC;IACjC,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI,CAoRpD"}

package/dist/routes/data.js

@@ -0,0 +1,213 @@
+import { Hono } from "hono";
+import { ScopeSchema } from "@opendatalabs/personal-server-ts-core/scopes";
+import { createDataFileEnvelope } from "@opendatalabs/personal-server-ts-core/schemas/data-file";
+import { generateCollectedAt, writeDataFile, readDataFile, deleteAllForScope, } from "@opendatalabs/personal-server-ts-core/storage/hierarchy";
+import { createBodyLimit, DATA_INGEST_MAX_SIZE, } from "../middleware/body-limit.js";
+import { createWeb3AuthMiddleware } from "../middleware/web3-auth.js";
+import { createBuilderCheckMiddleware } from "../middleware/builder-check.js";
+import { createGrantCheckMiddleware } from "../middleware/grant-check.js";
+import { createAccessLogMiddleware } from "../middleware/access-log.js";
+import { createOwnerCheckMiddleware } from "../middleware/owner-check.js";
+export function dataRoutes(deps) {
+    const app = new Hono();
+    // Create middleware instances
+    const web3Auth = createWeb3AuthMiddleware({
+        serverOrigin: deps.serverOrigin,
+        devToken: deps.devToken,
+        serverOwner: deps.serverOwner,
+    });
+    const builderCheck = createBuilderCheckMiddleware(deps.gateway);
+    const grantCheck = createGrantCheckMiddleware({
+        gateway: deps.gateway,
+        serverOwner: deps.serverOwner,
+    });
+    const accessLog = createAccessLogMiddleware(deps.accessLogWriter);
+    // GET /v1/data/:scope/versions — list versions for a scope (requires auth + builder, no grant)
+    app.get("/:scope/versions", web3Auth, builderCheck, async (c) => {
+        // 1. Validate scope
+        const scopeParam = c.req.param("scope");
+        const scopeResult = ScopeSchema.safeParse(scopeParam);
+        if (!scopeResult.success) {
+            return c.json({
+                error: "INVALID_SCOPE",
+                message: scopeResult.error.issues[0].message,
+            }, 400);
+        }
+        const scope = scopeResult.data;
+        // 2. Parse pagination
+        const limit = c.req.query("limit")
+            ? parseInt(c.req.query("limit"), 10)
+            : 20;
+        const offset = c.req.query("offset")
+            ? parseInt(c.req.query("offset"), 10)
+            : 0;
+        // 3. Query index
+        const entries = deps.indexManager.findByScope({ scope, limit, offset });
+        const total = deps.indexManager.countByScope(scope);
+        // 4. Return response
+        return c.json({
+            scope,
+            versions: entries.map((e) => ({
+                fileId: e.fileId,
+                collectedAt: e.collectedAt,
+            })),
+            total,
+            limit,
+            offset,
+        });
+    });
+    // GET /v1/data — list distinct scopes (requires auth + builder, no grant)
+    app.get("/", web3Auth, builderCheck, async (c) => {
+        const scopePrefix = c.req.query("scopePrefix");
+        const limit = c.req.query("limit")
+            ? parseInt(c.req.query("limit"), 10)
+            : 20;
+        const offset = c.req.query("offset")
+            ? parseInt(c.req.query("offset"), 10)
+            : 0;
+        const result = deps.indexManager.listDistinctScopes({
+            scopePrefix: scopePrefix || undefined,
+            limit,
+            offset,
+        });
+        return c.json({
+            scopes: result.scopes,
+            total: result.total,
+            limit,
+            offset,
+        });
+    });
+    // GET /v1/data/:scope — read a data file (requires auth + grant)
+    app.get("/:scope", web3Auth, builderCheck, grantCheck, accessLog, async (c) => {
+        // 1. Validate scope
+        const scopeParam = c.req.param("scope");
+        const scopeResult = ScopeSchema.safeParse(scopeParam);
+        if (!scopeResult.success) {
+            return c.json({
+                error: "INVALID_SCOPE",
+                message: scopeResult.error.issues[0].message,
+            }, 400);
+        }
+        const scope = scopeResult.data;
+        // 2. Determine lookup strategy: fileId, at, or latest
+        const fileIdParam = c.req.query("fileId");
+        const atParam = c.req.query("at");
+        let entry;
+        if (fileIdParam) {
+            entry = deps.indexManager.findByFileId(fileIdParam);
+        }
+        else if (atParam) {
+            entry = deps.indexManager.findClosestByScope(scope, atParam);
+        }
+        else {
+            entry = deps.indexManager.findLatestByScope(scope);
+        }
+        // 3. 404 if not found
+        if (!entry) {
+            return c.json({
+                error: "NOT_FOUND",
+                message: `No data found for scope "${scope}"`,
+            }, 404);
+        }
+        // 4. Read the data file from disk
+        const envelope = await readDataFile(deps.hierarchyOptions, scope, entry.collectedAt);
+        // 5. Return 200 with envelope
+        return c.json(envelope);
+    });
+    app.use("/:scope", createBodyLimit(DATA_INGEST_MAX_SIZE));
+    app.post("/:scope", async (c) => {
+        // 1. Parse & validate scope
+        const scopeParam = c.req.param("scope");
+        const scopeResult = ScopeSchema.safeParse(scopeParam);
+        if (!scopeResult.success) {
+            return c.json({
+                error: "INVALID_SCOPE",
+                message: scopeResult.error.issues[0].message,
+            }, 400);
+        }
+        const scope = scopeResult.data;
+        // 2. Parse JSON body
+        let body;
+        try {
+            body = await c.req.json();
+        }
+        catch {
+            return c.json({
+                error: "INVALID_BODY",
+                message: "Request body must be valid JSON",
+            }, 400);
+        }
+        if (body === null || typeof body !== "object" || Array.isArray(body)) {
+            return c.json({
+                error: "INVALID_BODY",
+                message: "Request body must be a JSON object",
+            }, 400);
+        }
+        // 3. Look up schema via Gateway (strict: reject if not found)
+        let schemaUrl;
+        try {
+            const schema = await deps.gateway.getSchemaForScope(scope);
+            if (!schema) {
+                return c.json({
+                    error: "NO_SCHEMA",
+                    message: `No schema registered for scope: ${scope}`,
+                }, 400);
+            }
+            schemaUrl = schema.definitionUrl;
+        }
+        catch (err) {
+            deps.logger.error({ err, scope }, "Gateway schema lookup failed");
+            return c.json({
+                error: "GATEWAY_ERROR",
+                message: "Failed to look up schema for scope",
+            }, 502);
+        }
+        // 4. Generate collectedAt
+        const collectedAt = generateCollectedAt();
+        // 5. Construct envelope
+        const envelope = createDataFileEnvelope(scope, collectedAt, body, schemaUrl);
+        // 6. Write atomically
+        const writeResult = await writeDataFile(deps.hierarchyOptions, envelope);
+        // 7. Insert into index
+        deps.indexManager.insert({
+            fileId: null,
+            path: writeResult.relativePath,
+            scope,
+            collectedAt,
+            sizeBytes: writeResult.sizeBytes,
+        });
+        deps.logger.info({ scope, collectedAt, path: writeResult.relativePath }, "Data file ingested");
+        // 8. Notify sync manager of new data (if enabled)
+        let status = "stored";
+        if (deps.syncManager) {
+            deps.syncManager.notifyNewData();
+            status = "syncing";
+        }
+        // 9. Return 201
+        return c.json({ scope, collectedAt, status }, 201);
+    });
+    // Owner-check middleware (web3-auth + owner-check)
+    const ownerCheck = createOwnerCheckMiddleware(deps.serverOwner);
+    // DELETE /v1/data/:scope — delete all versions for a scope (owner auth required)
+    app.delete("/:scope", web3Auth, ownerCheck, async (c) => {
+        // 1. Validate scope
+        const scopeParam = c.req.param("scope");
+        const scopeResult = ScopeSchema.safeParse(scopeParam);
+        if (!scopeResult.success) {
+            return c.json({
+                error: "INVALID_SCOPE",
+                message: scopeResult.error.issues[0].message,
+            }, 400);
+        }
+        const scope = scopeResult.data;
+        // 2. Delete from index
+        const deletedCount = deps.indexManager.deleteByScope(scope);
+        // 3. Delete from filesystem
+        await deleteAllForScope(deps.hierarchyOptions, scope);
+        deps.logger.info({ scope, deletedCount }, "Scope deleted");
+        // 4. Return 204
+        return c.body(null, 204);
+    });
+    return app;
+}
+//# sourceMappingURL=data.js.map

package/dist/routes/data.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"data.js","sourceRoot":"","sources":["../../src/routes/data.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,8CAA8C,CAAC;AAC3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACjG,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,YAAY,EACZ,iBAAiB,GAClB,MAAM,yDAAyD,CAAC;AAOjE,OAAO,EACL,eAAe,EACf,oBAAoB,GACrB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAC9E,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAc1E,MAAM,UAAU,UAAU,CAAC,IAAmB;IAC5C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,8BAA8B;IAC9B,MAAM,QAAQ,GAAG,wBAAwB,CAAC;QACxC,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,0BAA0B,CAAC;QAC5C,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,yBAAyB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAElE,+FAA+F;IAC/F,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9D,oBAAoB;QACpB,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,WAAW,GAAG,WAAW,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACtD,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,eAAe;gBACtB,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO;aAC7C,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC;QAE/B,sBAAsB;QACtB,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;YAChC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAE,EAAE,EAAE,CAAC;YACrC,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;YAClC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAE,EAAE,EAAE,CAAC;YACtC,CAAC,CAAC,CAAC,CAAC;QAEN,iBAAiB;QACjB,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACxE,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAEpD,qBAAqB;QACrB,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,KAAK;YACL,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC5B,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,WAAW,EAAE,CAAC,CAAC,WAAW;aAC3B,CAAC,CAAC;YACH,KAAK;YACL,KAAK;YACL,MAAM;SACP,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/C,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;YAChC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAE,EAAE,EAAE,CAAC;YACrC,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;YAClC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAE,EAAE,EAAE,CAAC;YACtC,CAAC,CAAC,CAAC,CAAC;QAEN,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC;YAClD,WAAW,EAAE,WAAW,IAAI,SAAS;YACrC,KAAK;YACL,MAAM;SACP,CAAC,CAAC;QAEH,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,KAAK;YACL,MAAM;SACP,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,iEAAiE;IACjE,GAAG,CAAC,GAAG,CACL,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,SAAS,EACT,KAAK,EAAE,CAAC,EAAE,EAAE;QACV,oBAAoB;QACpB,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,WAAW,GAAG,WAAW,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACtD,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,eAAe;gBACtB,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO;aAC7C,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC;QAE/B,sDAAsD;QACtD,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAElC,IAAI,KAAK,CAAC;QACV,IAAI,WAAW,EAAE,CAAC;YAChB,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QACtD,CAAC;aAAM,IAAI,OAAO,EAAE,CAAC;YACnB,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC/D,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACrD,CAAC;QAED,sBAAsB;QACtB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,4BAA4B,KAAK,GAAG;aAC9C,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,kCAAkC;QAClC,MAAM,QAAQ,GAAG,MAAM,YAAY,CACjC,IAAI,CAAC,gBAAgB,EACrB,KAAK,EACL,KAAK,CAAC,WAAW,CAClB,CAAC;QAEF,8BAA8B;QAC9B,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAE1D,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9B,4BAA4B;QAC5B,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,WAAW,GAAG,WAAW,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACtD,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,eAAe;gBACtB,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO;aAC7C,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC;QAE/B,qBAAqB;QACrB,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,iCAAiC;aAC3C,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,oCAAoC;aAC9C,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,8DAA8D;QAC9D,IAAI,SAA6B,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,CAAC,IAAI,CACX;oBACE,KAAK,EAAE,WAAW;oBAClB,OAAO,EAAE,mCAAmC,KAAK,EAAE;iBACpD,EACD,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,SAAS,GAAG,MAAM,CAAC,aAAa,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,8BAA8B,CAAC,CAAC;YAClE,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,eAAe;gBACtB,OAAO,EAAE,oCAAoC;aAC9C,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,0BAA0B;QAC1B,MAAM,WAAW,GAAG,mBAAmB,EAAE,CAAC;QAE1C,wBAAwB;QACxB,MAAM,QAAQ,GAAG,sBAAsB,CACrC,KAAK,EACL,WAAW,EACX,IAA+B,EAC/B,SAAS,CACV,CAAC;QAEF,sBAAsB;QACtB,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QAEzE,uBAAuB;QACvB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;YACvB,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,WAAW,CAAC,YAAY;YAC9B,KAAK;YACL,WAAW;YACX,SAAS,EAAE,WAAW,CAAC,SAAS;SACjC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,CAAC,YAAY,EAAE,EACtD,oBAAoB,CACrB,CAAC;QAEF,kDAAkD;QAClD,IAAI,MAAM,GAAyB,QAAQ,CAAC;QAC5C,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC;YACjC,MAAM,GAAG,SAAS,CAAC;QACrB,CAAC;QAED,gBAAgB;QAChB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,mDAAmD;IACnD,MAAM,UAAU,GAAG,0BAA0B,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAEhE,iFAAiF;IACjF,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtD,oBAAoB;QACpB,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,WAAW,GAAG,WAAW,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACtD,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,eAAe;gBACtB,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO;aAC7C,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC;QAE/B,uBAAuB;QACvB,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAE5D,4BAA4B;QAC5B,MAAM,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;QAEtD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,eAAe,CAAC,CAAC;QAE3D,gBAAgB;QAChB,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/routes/grants.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Grants routes — POST /verify (public endpoint).
+ * Verifies EIP-712 grant signatures locally without network calls.
+ */
+import { Hono } from "hono";
+import type { Logger } from "pino";
+import type { GatewayClient } from "@opendatalabs/personal-server-ts-core/gateway";
+export interface GrantsRouteDeps {
+    logger: Logger;
+    gateway: GatewayClient;
+    serverOwner?: `0x${string}`;
+    serverOrigin: string;
+    devToken?: string;
+}
+export declare function grantsRoutes(deps: GrantsRouteDeps): Hono;
+//# sourceMappingURL=grants.d.ts.map

package/dist/routes/grants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../../src/routes/grants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAEnC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+CAA+C,CAAC;AAQnF,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,aAAa,CAAC;IACvB,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AA0CD,wBAAgB,YAAY,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI,CAuGxD"}