@opendatalabs/personal-server-ts-server 0.0.1-canary.b75bcfa → 0.0.1-canary.bc229f5

package/dist/api-auth.d.ts

@@ -0,0 +1,17 @@
+import { type SessionTokenVerifierPort } from "@opendatalabs/personal-server-ts-core/auth";
+import type { PersonalServerApiAuthPort } from "@opendatalabs/personal-server-ts-core/api";
+import type { DataStoragePort, FeeVerifierPort, RuntimeAvailabilityPort } from "@opendatalabs/personal-server-ts-core/ports";
+import type { GatewayClient } from "@opendatalabs/vana-sdk/node";
+export interface ServerApiAuthDeps {
+    serverOrigin: string | (() => string);
+    serverOwner?: `0x${string}`;
+    gateway: GatewayClient;
+    devToken?: string;
+    accessToken?: string;
+    tokenStore?: SessionTokenVerifierPort;
+    dataStorage?: Pick<DataStoragePort, "findEntry">;
+    feeVerifier?: FeeVerifierPort;
+    runtimeAvailability?: RuntimeAvailabilityPort;
+}
+export declare function createServerApiAuth(deps: ServerApiAuthDeps): PersonalServerApiAuthPort;
+//# sourceMappingURL=api-auth.d.ts.map

package/dist/api-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-auth.d.ts","sourceRoot":"","sources":["../src/api-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,4CAA4C,CAAC;AACpD,OAAO,KAAK,EACV,yBAAyB,EAE1B,MAAM,2CAA2C,CAAC;AAOnD,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EACf,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEjE,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,OAAO,EAAE,aAAa,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,wBAAwB,CAAC;IACtC,WAAW,CAAC,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IACjD,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;CAC/C;AA6CD,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,iBAAiB,GACtB,yBAAyB,CAoD3B"}

package/dist/api-auth.js

@@ -0,0 +1,77 @@
+import { authenticateRequest, } from "@opendatalabs/personal-server-ts-core/auth";
+import { verifyDataReadPolicy } from "@opendatalabs/personal-server-ts-core/policy";
+import { NotOwnerError, ProtocolError, UnregisteredBuilderError, } from "@opendatalabs/personal-server-ts-core/errors";
+function serverNotConfigured() {
+    return new ProtocolError(500, "SERVER_NOT_CONFIGURED", "Server owner address not configured. Set VANA_MASTER_KEY_SIGNATURE environment variable.");
+}
+function isOwner(signer, serverOwner) {
+    return Boolean(serverOwner && signer.toLowerCase() === serverOwner.toLowerCase());
+}
+async function authenticate(request, deps) {
+    return authenticateRequest({
+        request,
+        serverOrigin: deps.serverOrigin,
+        devToken: deps.devToken,
+        accessToken: deps.accessToken,
+        sessionTokenVerifier: deps.tokenStore,
+        serverOwner: deps.serverOwner,
+    });
+}
+async function assertRegisteredBuilder(gateway, signer) {
+    if ("isRegisteredBuilder" in gateway) {
+        if (await gateway.isRegisteredBuilder(signer))
+            return;
+        throw new UnregisteredBuilderError();
+    }
+    const builder = await gateway.getBuilder(signer);
+    if (!builder)
+        throw new UnregisteredBuilderError();
+}
+export function createServerApiAuth(deps) {
+    return {
+        async authorizeOwner(request) {
+            const result = await authenticate(request, deps);
+            if (result.isPolicyBypass)
+                return;
+            if (!deps.serverOwner)
+                throw serverNotConfigured();
+            if (!isOwner(result.auth.signer, deps.serverOwner)) {
+                throw new NotOwnerError({
+                    signer: result.auth.signer,
+                    expected: deps.serverOwner,
+                });
+            }
+        },
+        async authorizeBuilderList(request) {
+            const result = await authenticate(request, deps);
+            if (result.isPolicyBypass ||
+                isOwner(result.auth.signer, deps.serverOwner)) {
+                return;
+            }
+            await assertRegisteredBuilder(deps.gateway, result.auth.signer);
+        },
+        async authorizeBuilderRead(input) {
+            const result = await authenticate(input.request, deps);
+            if (result.isPolicyBypass) {
+                return { builder: result.auth.signer, grantId: "policy-bypass" };
+            }
+            const selectedEntry = deps.dataStorage?.findEntry({
+                scope: input.scope,
+                fileId: input.fileId,
+            });
+            const grant = await verifyDataReadPolicy({
+                signer: result.auth.signer,
+                grantId: result.auth.payload.grantId ?? input.grantId,
+                requestedScope: input.scope,
+                fileId: input.fileId ?? selectedEntry?.fileId ?? undefined,
+            }, {
+                authSessionVerifier: deps.gateway,
+                grantVerifier: deps.gateway,
+                feeVerifier: deps.feeVerifier,
+                runtimeAvailability: deps.runtimeAvailability,
+            });
+            return { builder: result.auth.signer, grantId: grant.id };
+        },
+    };
+}
+//# sourceMappingURL=api-auth.js.map

package/dist/api-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-auth.js","sourceRoot":"","sources":["../src/api-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,GAGpB,MAAM,4CAA4C,CAAC;AAKpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8CAA8C,CAAC;AACpF,OAAO,EACL,aAAa,EACb,aAAa,EACb,wBAAwB,GACzB,MAAM,8CAA8C,CAAC;AAoBtD,SAAS,mBAAmB;IAC1B,OAAO,IAAI,aAAa,CACtB,GAAG,EACH,uBAAuB,EACvB,0FAA0F,CAC3F,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CACd,MAAc,EACd,WAAsC;IAEtC,OAAO,OAAO,CACZ,WAAW,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,WAAW,EAAE,CAClE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,OAAgB,EAChB,IAAuB;IAEvB,OAAO,mBAAmB,CAAC;QACzB,OAAO;QACP,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,oBAAoB,EAAE,IAAI,CAAC,UAAU;QACrC,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,OAAsB,EACtB,MAAqB;IAErB,IAAI,qBAAqB,IAAI,OAAO,EAAE,CAAC;QACrC,IAAI,MAAM,OAAO,CAAC,mBAAmB,CAAC,MAAM,CAAC;YAAE,OAAO;QACtD,MAAM,IAAI,wBAAwB,EAAE,CAAC;IACvC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,wBAAwB,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,IAAuB;IAEvB,OAAO;QACL,KAAK,CAAC,cAAc,CAAC,OAAO;YAC1B,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACjD,IAAI,MAAM,CAAC,cAAc;gBAAE,OAAO;YAClC,IAAI,CAAC,IAAI,CAAC,WAAW;gBAAE,MAAM,mBAAmB,EAAE,CAAC;YACnD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBACnD,MAAM,IAAI,aAAa,CAAC;oBACtB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;oBAC1B,QAAQ,EAAE,IAAI,CAAC,WAAW;iBAC3B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,KAAK,CAAC,oBAAoB,CAAC,OAAO;YAChC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACjD,IACE,MAAM,CAAC,cAAc;gBACrB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,EAC7C,CAAC;gBACD,OAAO;YACT,CAAC;YACD,MAAM,uBAAuB,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClE,CAAC;QAED,KAAK,CAAC,oBAAoB,CAAC,KAAkC;YAC3D,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACvD,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;gBAC1B,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;YACnE,CAAC;YAED,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC;gBAChD,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,oBAAoB,CACtC;gBACE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;gBAC1B,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO;gBACrD,cAAc,EAAE,KAAK,CAAC,KAAK;gBAC3B,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,aAAa,EAAE,MAAM,IAAI,SAAS;aAC3D,EACD;gBACE,mBAAmB,EAAE,IAAI,CAAC,OAAO;gBACjC,aAAa,EAAE,IAAI,CAAC,OAAO;gBAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;aAC9C,CACF,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QAC5D,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/api.d.ts

@@ -1,2 +1,5 @@
 export { createServer, type CreateServerOptions, type ServerContext, } from "./bootstrap.js";
+export { startPersonalServer, type StartPersonalServerNodeOptions, } from "./client.js";
+export type { PersonalServerHandle, PersonalServerInfo, PersonalServerRegistrationRequest, PersonalServerStatus, } from "@opendatalabs/personal-server-ts-core/client";
+export { DEFAULT_ROOT_PATH, DEFAULT_CONFIG_PATH, DEFAULT_DATA_DIR, DEFAULT_SERVER_DIR, DEFAULT_VANA_DIR, expandHomePath, loadConfig, resolveRootPath, type LoadConfigOptions, } from "./config/index.js";
 //# sourceMappingURL=api.d.ts.map

package/dist/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,KAAK,mBAAmB,EACxB,KAAK,aAAa,GACnB,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,KAAK,mBAAmB,EACxB,KAAK,aAAa,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,KAAK,8BAA8B,GACpC,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,oBAAoB,EACpB,kBAAkB,EAClB,iCAAiC,EACjC,oBAAoB,GACrB,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,UAAU,EACV,eAAe,EACf,KAAK,iBAAiB,GACvB,MAAM,mBAAmB,CAAC"}

package/dist/api.js

@@ -1,2 +1,4 @@
 export { createServer, } from "./bootstrap.js";
+export { startPersonalServer, } from "./client.js";
+export { DEFAULT_ROOT_PATH, DEFAULT_CONFIG_PATH, DEFAULT_DATA_DIR, DEFAULT_SERVER_DIR, DEFAULT_VANA_DIR, expandHomePath, loadConfig, resolveRootPath, } from "./config/index.js";
 //# sourceMappingURL=api.js.map

package/dist/api.js.map

@@ -1 +1 @@
-{"version":3,"file":"api.js","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,GAGb,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,GAGb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,mBAAmB,GAEpB,MAAM,aAAa,CAAC;AAOrB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,UAAU,EACV,eAAe,GAEhB,MAAM,mBAAmB,CAAC"}

package/dist/app.d.ts

@@ -1,12 +1,15 @@
 import { Hono } from "hono";
 import type { IndexManager } from "@opendatalabs/personal-server-ts-core/storage/index";
 import type { HierarchyManagerOptions } from "@opendatalabs/personal-server-ts-core/storage/hierarchy";
-import type { GatewayClient } from "@opendatalabs/personal-server-ts-core/gateway";
+import type { DataPortabilityGatewayConfig, GatewayClient } from "@opendatalabs/vana-sdk/node";
+import type { ServerConfig } from "@opendatalabs/personal-server-ts-core/schemas";
 import type { AccessLogWriter } from "@opendatalabs/personal-server-ts-core/logging/access-log";
 import type { AccessLogReader } from "@opendatalabs/personal-server-ts-core/logging/access-reader";
 import { type HealthDeps } from "./routes/health.js";
 import type { SyncManager } from "@opendatalabs/personal-server-ts-core/sync";
 import type { ServerSigner } from "@opendatalabs/personal-server-ts-core/signing";
+import type { DataStoragePort, FeeVerifierPort, RuntimeAvailabilityPort } from "@opendatalabs/personal-server-ts-core/ports";
+import type { TokenStore } from "./token-store.js";
 import type { Logger } from "pino";
 export interface IdentityInfo {
     address: `0x${string}`;
@@ -20,15 +23,28 @@ export interface AppDeps {
     indexManager: IndexManager;
     hierarchyOptions: HierarchyManagerOptions;
     serverOrigin: string | (() => string);
+    localApprovalOrigin?: string | (() => string | undefined);
     serverOwner?: `0x${string}`;
     identity?: IdentityInfo;
     gateway: GatewayClient;
+    gatewayConfig?: DataPortabilityGatewayConfig & {
+        url?: string;
+    };
+    config?: ServerConfig;
     accessLogWriter: AccessLogWriter;
     accessLogReader: AccessLogReader;
+    cloudMode?: boolean;
     devToken?: string;
+    ownerSignature?: `0x${string}`;
+    ownerPrivateKey?: `0x${string}`;
+    accessToken?: string;
     configPath?: string;
     syncManager?: SyncManager | null;
     serverSigner?: ServerSigner;
+    tokenStore?: TokenStore;
+    feeVerifier?: FeeVerifierPort;
+    runtimeAvailability?: RuntimeAvailabilityPort;
+    dataStorage?: DataStoragePort;
     getTunnelStatus?: HealthDeps["getTunnelStatus"];
 }
 export declare function createApp(deps: AppDeps): Hono;

package/dist/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACxF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yDAAyD,CAAC;AACvG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+CAA+C,CAAC;AACnF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAChG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAe,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAUlE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4CAA4C,CAAC;AAC9E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+CAA+C,CAAC;AAClF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAEnC,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,KAAK,MAAM,EAAE,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,YAAY,EAAE,YAAY,CAAC;IAC3B,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,OAAO,EAAE,aAAa,CAAC;IACvB,eAAe,EAAE,eAAe,CAAC;IACjC,eAAe,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACjC,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,eAAe,CAAC,EAAE,UAAU,CAAC,iBAAiB,CAAC,CAAC;CACjD;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAyK7C"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACxF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yDAAyD,CAAC;AACvG,OAAO,KAAK,EACV,4BAA4B,EAC5B,aAAa,EACd,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+CAA+C,CAAC;AAClF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAChG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAe,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAalE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4CAA4C,CAAC;AAC9E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+CAA+C,CAAC;AAClF,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EACf,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAEnC,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,KAAK,MAAM,EAAE,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,YAAY,EAAE,YAAY,CAAC;IAC3B,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,mBAAmB,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;IAC1D,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,OAAO,EAAE,aAAa,CAAC;IACvB,aAAa,CAAC,EAAE,4BAA4B,GAAG;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAChE,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,eAAe,EAAE,eAAe,CAAC;IACjC,eAAe,EAAE,eAAe,CAAC;IACjC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC/B,eAAe,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACjC,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;IAC9C,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,eAAe,CAAC,EAAE,UAAU,CAAC,iBAAiB,CAAC,CAAC;CACjD;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAwM7C"}

package/dist/app.js

@@ -7,23 +7,16 @@ import { grantsRoutes } from "./routes/grants.js";
 import { accessLogsRoutes } from "./routes/access-logs.js";
 import { syncRoutes } from "./routes/sync.js";
 import { uiConfigRoutes } from "./routes/ui-config.js";
+import { uiRegistrationRoutes } from "./routes/ui-registration.js";
 import { uiRoute } from "./routes/ui.js";
-import { mcpRoute } from "./routes/mcp.js";
-import { OAuthProvider } from "./oauth/provider.js";
-import { oauthRoutes } from "./oauth/routes.js";
+import { authDeviceRoutes, createDeviceSessionLookup, } from "./routes/auth-device.js";
+import { oauthTokenRoutes } from "./routes/oauth-token.js";
 export function createApp(deps) {
     const app = new Hono();
     // CORS — allow all origins for browser-based clients
     app.use("*", cors({
         origin: "*",
-        allowHeaders: [
-            "Content-Type",
-            "Authorization",
-            "mcp-session-id",
-            "Last-Event-ID",
-            "mcp-protocol-version",
-        ],
-        exposeHeaders: ["mcp-session-id", "mcp-protocol-version"],
+        allowHeaders: ["Content-Type", "Authorization"],
         allowMethods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"],
         maxAge: 86400,
     }));
@@ -31,11 +24,14 @@ export function createApp(deps) {
     app.route("/", healthRoute({
         version: deps.version,
         startedAt: deps.startedAt,
+        serverOrigin: deps.serverOrigin,
         serverOwner: deps.serverOwner,
         identity: deps.identity,
         gateway: deps.gateway,
+        gatewayConfig: deps.gatewayConfig,
         logger: deps.logger,
         getTunnelStatus: deps.getTunnelStatus,
+        runtimeAvailability: deps.runtimeAvailability,
     }));
     // Mount data routes (ingest + read + delete)
     app.route("/v1/data", dataRoutes({
@@ -47,16 +43,26 @@ export function createApp(deps) {
         gateway: deps.gateway,
         accessLogWriter: deps.accessLogWriter,
         devToken: deps.devToken,
+        accessToken: deps.accessToken,
+        tokenStore: deps.tokenStore,
         syncManager: deps.syncManager ?? null,
+        feeVerifier: deps.feeVerifier,
+        runtimeAvailability: deps.runtimeAvailability,
+        dataStorage: deps.dataStorage,
+        mountPath: "/v1/data",
     }));
     // Mount grants routes (POST /verify is public, GET / and POST / need owner auth)
     app.route("/v1/grants", grantsRoutes({
         logger: deps.logger,
         gateway: deps.gateway,
+        gatewayConfig: deps.gatewayConfig,
         serverOwner: deps.serverOwner,
         serverOrigin: deps.serverOrigin,
         devToken: deps.devToken,
+        accessToken: deps.accessToken,
+        tokenStore: deps.tokenStore,
         serverSigner: deps.serverSigner,
+        mountPath: "/v1/grants",
     }));
     // Mount access-logs routes (all owner auth)
     app.route("/v1/access-logs", accessLogsRoutes({
@@ -64,47 +70,67 @@ export function createApp(deps) {
         accessLogReader: deps.accessLogReader,
         serverOrigin: deps.serverOrigin,
         serverOwner: deps.serverOwner,
+        gateway: deps.gateway,
         devToken: deps.devToken,
+        accessToken: deps.accessToken,
+        tokenStore: deps.tokenStore,
+        mountPath: "/v1/access-logs",
     }));
     // Mount sync routes (all owner auth)
     app.route("/v1/sync", syncRoutes({
         logger: deps.logger,
         serverOrigin: deps.serverOrigin,
         serverOwner: deps.serverOwner,
+        gateway: deps.gateway,
         devToken: deps.devToken,
+        accessToken: deps.accessToken,
+        tokenStore: deps.tokenStore,
         syncManager: deps.syncManager ?? null,
+        mountPath: "/v1/sync",
     }));
-    // Mount MCP endpoint (Model Context Protocol for AI tools)
-    if (deps.serverOwner) {
-        const oauthProvider = new OAuthProvider(deps.serverOwner);
-        // Mount OAuth discovery + auth endpoints at the root
-        app.route("/", oauthRoutes({
-            oauthProvider,
-            serverOwner: deps.serverOwner,
-            accountPortalOrigin: process.env.ACCOUNT_URL,
+    // Mount login flow v2 routes (self-hosted CLI auth, no auth required)
+    if (deps.tokenStore) {
+        app.route("/auth/device", authDeviceRoutes({
+            logger: deps.logger,
             serverOrigin: deps.serverOrigin,
+            localApprovalOrigin: deps.localApprovalOrigin,
+            serverOwner: deps.serverOwner,
+            tokenStore: deps.tokenStore,
+            devToken: deps.devToken,
+            accessToken: deps.accessToken,
+            allowInteractiveLogin: !deps.cloudMode,
         }));
-        app.route("/mcp", mcpRoute({
-            mcpContext: {
-                indexManager: deps.indexManager,
-                hierarchyOptions: deps.hierarchyOptions,
-                gatewayClient: deps.gateway,
-                serverOwner: deps.serverOwner,
-                logger: deps.logger,
-            },
-            oauthProvider,
-            serverOrigin: deps.serverOrigin,
+        // RFC 6749 token endpoint. Replaces ad-hoc `/auth/device/token` semantics
+        // with a standard OAuth2 surface that supports both the cloud
+        // control-plane `client_credentials` grant and the CLI device-code grant.
+        app.route("/oauth/token", oauthTokenRoutes({
+            logger: deps.logger,
+            tokenStore: deps.tokenStore,
+            controlPlaneSecret: deps.accessToken,
+            deviceSessions: createDeviceSessionLookup(),
         }));
     }
     // Mount dev UI routes when dev token is available
     if (deps.devToken) {
-        app.route("/ui", uiRoute({ devToken: deps.devToken }));
+        app.route("/ui", uiRoute({
+            devToken: deps.devToken,
+            psLiteBootstrap: deps.ownerSignature
+                ? {
+                    ownerSignature: deps.ownerSignature,
+                    config: deps.config,
+                }
+                : null,
+        }));
         if (deps.configPath) {
             app.route("/ui/api", uiConfigRoutes({
                 devToken: deps.devToken,
                 configPath: deps.configPath,
             }));
         }
+        app.route("/ui/api", uiRegistrationRoutes({
+            devToken: deps.devToken,
+            ownerPrivateKey: deps.ownerPrivateKey,
+        }));
     }
     // Global error handler
     app.onError((err, c) => {

package/dist/app.js.map

@@ -1 +1 @@
-{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,8CAA8C,CAAC;AAM7E,OAAO,EAAE,WAAW,EAAmB,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AA8BhD,MAAM,UAAU,SAAS,CAAC,IAAa;IACrC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,qDAAqD;IACrD,GAAG,CAAC,GAAG,CACL,GAAG,EACH,IAAI,CAAC;QACH,MAAM,EAAE,GAAG;QACX,YAAY,EAAE;YACZ,cAAc;YACd,eAAe;YACf,gBAAgB;YAChB,eAAe;YACf,sBAAsB;SACvB;QACD,aAAa,EAAE,CAAC,gBAAgB,EAAE,sBAAsB,CAAC;QACzD,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC;QACzD,MAAM,EAAE,KAAK;KACd,CAAC,CACH,CAAC;IAEF,qBAAqB;IACrB,GAAG,CAAC,KAAK,CACP,GAAG,EACH,WAAW,CAAC;QACV,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,eAAe,EAAE,IAAI,CAAC,eAAe;KACtC,CAAC,CACH,CAAC;IAEF,6CAA6C;IAC7C,GAAG,CAAC,KAAK,CACP,UAAU,EACV,UAAU,CAAC;QACT,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;KACtC,CAAC,CACH,CAAC;IAEF,iFAAiF;IACjF,GAAG,CAAC,KAAK,CACP,YAAY,EACZ,YAAY,CAAC;QACX,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,YAAY,EAAE,IAAI,CAAC,YAAY;KAChC,CAAC,CACH,CAAC;IAEF,4CAA4C;IAC5C,GAAG,CAAC,KAAK,CACP,iBAAiB,EACjB,gBAAgB,CAAC;QACf,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC,CACH,CAAC;IAEF,qCAAqC;IACrC,GAAG,CAAC,KAAK,CACP,UAAU,EACV,UAAU,CAAC;QACT,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;KACtC,CAAC,CACH,CAAC;IAEF,2DAA2D;IAC3D,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAE1D,qDAAqD;QACrD,GAAG,CAAC,KAAK,CACP,GAAG,EACH,WAAW,CAAC;YACV,aAAa;YACb,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,mBAAmB,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW;YAC5C,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC,CACH,CAAC;QAEF,GAAG,CAAC,KAAK,CACP,MAAM,EACN,QAAQ,CAAC;YACP,UAAU,EAAE;gBACV,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,aAAa,EAAE,IAAI,CAAC,OAAO;gBAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB;YACD,aAAa;YACb,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,kDAAkD;IAClD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAEvD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,GAAG,CAAC,KAAK,CACP,SAAS,EACT,cAAc,CAAC;gBACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACrB,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACvC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,IAAuB,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,iBAAiB,CAAC,CAAC;QAC9C,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE;gBACL,IAAI,EAAE,GAAG;gBACT,SAAS,EAAE,gBAAgB;gBAC3B,OAAO,EAAE,uBAAuB;aACjC;SACF,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,eAAe;IACf,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE;QACjB,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE;gBACL,IAAI,EAAE,GAAG;gBACT,SAAS,EAAE,WAAW;gBACtB,OAAO,EAAE,WAAW;aACrB;SACF,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,8CAA8C,CAAC;AAU7E,OAAO,EAAE,WAAW,EAAmB,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACzC,OAAO,EACL,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AA+C3D,MAAM,UAAU,SAAS,CAAC,IAAa;IACrC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,qDAAqD;IACrD,GAAG,CAAC,GAAG,CACL,GAAG,EACH,IAAI,CAAC;QACH,MAAM,EAAE,GAAG;QACX,YAAY,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC;QAC/C,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC;QACzD,MAAM,EAAE,KAAK;KACd,CAAC,CACH,CAAC;IAEF,qBAAqB;IACrB,GAAG,CAAC,KAAK,CACP,GAAG,EACH,WAAW,CAAC;QACV,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;KAC9C,CAAC,CACH,CAAC;IAEF,6CAA6C;IAC7C,GAAG,CAAC,KAAK,CACP,UAAU,EACV,UAAU,CAAC;QACT,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;QACrC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,SAAS,EAAE,UAAU;KACtB,CAAC,CACH,CAAC;IAEF,iFAAiF;IACjF,GAAG,CAAC,KAAK,CACP,YAAY,EACZ,YAAY,CAAC;QACX,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,SAAS,EAAE,YAAY;KACxB,CAAC,CACH,CAAC;IAEF,4CAA4C;IAC5C,GAAG,CAAC,KAAK,CACP,iBAAiB,EACjB,gBAAgB,CAAC;QACf,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,SAAS,EAAE,iBAAiB;KAC7B,CAAC,CACH,CAAC;IAEF,qCAAqC;IACrC,GAAG,CAAC,KAAK,CACP,UAAU,EACV,UAAU,CAAC;QACT,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;QACrC,SAAS,EAAE,UAAU;KACtB,CAAC,CACH,CAAC;IAEF,sEAAsE;IACtE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,GAAG,CAAC,KAAK,CACP,cAAc,EACd,gBAAgB,CAAC;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,qBAAqB,EAAE,CAAC,IAAI,CAAC,SAAS;SACvC,CAAC,CACH,CAAC;QAEF,0EAA0E;QAC1E,8DAA8D;QAC9D,0EAA0E;QAC1E,GAAG,CAAC,KAAK,CACP,cAAc,EACd,gBAAgB,CAAC;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,kBAAkB,EAAE,IAAI,CAAC,WAAW;YACpC,cAAc,EAAE,yBAAyB,EAAE;SAC5C,CAAC,CACH,CAAC;IACJ,CAAC;IAED,kDAAkD;IAClD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,GAAG,CAAC,KAAK,CACP,KAAK,EACL,OAAO,CAAC;YACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,eAAe,EAAE,IAAI,CAAC,cAAc;gBAClC,CAAC,CAAC;oBACE,cAAc,EAAE,IAAI,CAAC,cAAc;oBACnC,MAAM,EAAE,IAAI,CAAC,MAAM;iBACpB;gBACH,CAAC,CAAC,IAAI;SACT,CAAC,CACH,CAAC;QAEF,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,GAAG,CAAC,KAAK,CACP,SAAS,EACT,cAAc,CAAC;gBACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,CAAC,CACH,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,KAAK,CACP,SAAS,EACT,oBAAoB,CAAC;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,eAAe,EAAE,IAAI,CAAC,eAAe;SACtC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,uBAAuB;IACvB,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACrB,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACvC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,IAA6B,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,iBAAiB,CAAC,CAAC;QAC9C,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE;gBACL,IAAI,EAAE,GAAG;gBACT,SAAS,EAAE,gBAAgB;gBAC3B,OAAO,EAAE,uBAAuB;aACjC;SACF,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,eAAe;IACf,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE;QACjB,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE;gBACL,IAAI,EAAE,GAAG;gBACT,SAAS,EAAE,WAAW;gBACtB,OAAO,EAAE,WAAW;aACrB;SACF,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/bootstrap.d.ts

@@ -1,7 +1,7 @@
 import type { ServerConfig } from "@opendatalabs/personal-server-ts-core/schemas";
-import { type Logger } from "@opendatalabs/personal-server-ts-core/logger";
-import { type IndexManager } from "@opendatalabs/personal-server-ts-core/storage/index";
-import type { GatewayClient } from "@opendatalabs/personal-server-ts-core/gateway";
+import { type Logger } from "./logger/index.js";
+import { type IndexManager } from "./storage/index-manager.js";
+import type { GatewayClient } from "@opendatalabs/vana-sdk/node";
 import type { AccessLogReader } from "@opendatalabs/personal-server-ts-core/logging/access-reader";
 import type { ServerAccount } from "@opendatalabs/personal-server-ts-core/keys";
 import type { ServerSigner } from "@opendatalabs/personal-server-ts-core/signing";
@@ -21,6 +21,9 @@ export interface ServerContext {
     syncManager: SyncManager | null;
     tunnelManager?: TunnelManager;
     tunnelUrl?: string;
+    localApprovalPort?: number;
+    getLocalApprovalOrigin: () => string | undefined;
+    setLocalApprovalOrigin: (origin?: string) => void;
     devToken?: string;
     startBackgroundServices: () => Promise<void>;
     cleanup: () => Promise<void>;
@@ -30,6 +33,8 @@ export interface CreateServerOptions {
     /** @deprecated Use rootPath instead. */
     serverDir?: string;
     dataDir?: string;
+    ownerSignature?: `0x${string}`;
+    gatewayClient?: GatewayClient;
 }
 export declare function createServer(config: ServerConfig, options?: CreateServerOptions): Promise<ServerContext>;
 //# sourceMappingURL=bootstrap.d.ts.map

package/dist/bootstrap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../src/bootstrap.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+CAA+C,CAAC;AAKlF,OAAO,EAEL,KAAK,MAAM,EACZ,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,qDAAqD,CAAC;AAG7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+CAA+C,CAAC;AAGnF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6DAA6D,CAAC;AAMnG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4CAA4C,CAAC;AAKhF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+CAA+C,CAAC;AAClF,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,4CAA4C,CAAC;AAEpD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAGjC,OAAO,EAAE,aAAa,EAAoB,MAAM,mBAAmB,CAAC;AAEpE,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,IAAI,CAAC;IACV,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,YAAY,CAAC;IACrB,SAAS,EAAE,IAAI,CAAC;IAChB,YAAY,EAAE,YAAY,CAAC;IAC3B,aAAa,EAAE,aAAa,CAAC;IAC7B,eAAe,EAAE,eAAe,CAAC;IACjC,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;IAChC,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uBAAuB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,YAAY,EACpB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,aAAa,CAAC,CA6QxB"}
+{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../src/bootstrap.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+CAA+C,CAAC;AAElF,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE9D,OAAO,EAEL,KAAK,YAAY,EAClB,MAAM,4BAA4B,CAAC;AAGpC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAGjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6DAA6D,CAAC;AAMnG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4CAA4C,CAAC;AAEhF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+CAA+C,CAAC;AAElF,OAAO,EAEL,KAAK,WAAW,EACjB,MAAM,4CAA4C,CAAC;AAEpD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAKjC,OAAO,EAAE,aAAa,EAAoB,MAAM,mBAAmB,CAAC;AAGpE,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,IAAI,CAAC;IACV,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,YAAY,CAAC;IACrB,SAAS,EAAE,IAAI,CAAC;IAChB,YAAY,EAAE,YAAY,CAAC;IAC3B,aAAa,EAAE,aAAa,CAAC;IAC7B,eAAe,EAAE,eAAe,CAAC;IACjC,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;IAChC,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,sBAAsB,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IACjD,sBAAsB,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uBAAuB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC/B,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B;AA0BD,wBAAsB,YAAY,CAChC,MAAM,EAAE,YAAY,EACpB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,aAAa,CAAC,CA4UxB"}

package/dist/bootstrap.js

@@ -4,19 +4,43 @@ import { randomUUID } from "node:crypto";
 import { join } from "node:path";
 const require = createRequire(import.meta.url);
 const pkg = require("../package.json");
-import { DEFAULT_ROOT_PATH, resolveRootPath, } from "@opendatalabs/personal-server-ts-core/config";
-import { createLogger, } from "@opendatalabs/personal-server-ts-core/logger";
-import { initializeDatabase, createIndexManager, } from "@opendatalabs/personal-server-ts-core/storage/index";
-import { createGatewayClient } from "@opendatalabs/personal-server-ts-core/gateway";
-import { createAccessLogWriter } from "@opendatalabs/personal-server-ts-core/logging/access-log";
-import { createAccessLogReader } from "@opendatalabs/personal-server-ts-core/logging/access-reader";
-import { deriveMasterKey, recoverServerOwner, loadOrCreateServerAccount, } from "@opendatalabs/personal-server-ts-core/keys";
-import { createServerSigner, createRequestSigner, } from "@opendatalabs/personal-server-ts-core/signing";
-import { createSyncCursor, createSyncManager, } from "@opendatalabs/personal-server-ts-core/sync";
-import { createVanaStorageAdapter } from "@opendatalabs/personal-server-ts-core/storage/adapters";
+import { DEFAULT_ROOT_PATH, resolveRootPath } from "./config/index.js";
+import { createLogger } from "./logger/index.js";
+import { initializeDatabase } from "./storage/index-schema.js";
+import { createIndexManager, } from "./storage/index-manager.js";
+import { createGatewayClient } from "@opendatalabs/vana-sdk/node";
+import { createAccessLogWriter } from "./logging/access-log.js";
+import { createAccessLogReader } from "./logging/access-reader.js";
+import { deriveMasterKey, recoverServerOwner, } from "@opendatalabs/vana-sdk/node";
+import { loadOrCreateServerAccount } from "./keys/server-account.js";
+import { createServerSigner } from "@opendatalabs/personal-server-ts-core/signing";
+import { createSyncCursor } from "./sync-cursor.js";
+import { createSyncManager, } from "@opendatalabs/personal-server-ts-core/sync";
+import { createVanaSyncStorageAdapter } from "@opendatalabs/personal-server-ts-core/storage/adapters";
 import { createApp } from "./app.js";
 import { generateDevToken } from "./dev-token.js";
+import { migrateLocalState } from "./migrations/local-state.js";
+import { createTokenStore } from "./token-store.js";
 import { TunnelManager, ensureFrpcBinary } from "./tunnel/index.js";
+import { createNodeDataStorage } from "./storage/node-data-storage.js";
+const DEFAULT_LOCAL_APPROVAL_PORT = 34127;
+function resolveLocalApprovalPort(serverPort) {
+    const raw = process.env.LOCAL_AUTH_PORT;
+    if (raw !== undefined) {
+        const parsed = Number(raw);
+        if (Number.isInteger(parsed) &&
+            parsed >= 1 &&
+            parsed <= 65535 &&
+            parsed !== serverPort) {
+            return parsed;
+        }
+    }
+    const adjacentPort = serverPort + 1;
+    if (adjacentPort <= 65535) {
+        return adjacentPort;
+    }
+    return DEFAULT_LOCAL_APPROVAL_PORT;
+}
 export async function createServer(config, options) {
     const logger = createLogger(config.logging);
     const startedAt = new Date();
@@ -24,14 +48,26 @@ export async function createServer(config, options) {
     const dataDir = options?.dataDir ?? join(storageRoot, "data");
     const indexPath = join(storageRoot, "index.db");
     const configPath = join(storageRoot, "config.json");
+    const syncCursorPath = join(storageRoot, "sync-cursor.json");
+    const tokensPath = join(storageRoot, "tokens.json");
     await mkdir(storageRoot, { recursive: true });
     await mkdir(dataDir, { recursive: true });
     const db = initializeDatabase(indexPath);
+    await migrateLocalState({
+        storageRoot,
+        dataDir,
+        configPath,
+        syncCursorPath,
+        tokensPath,
+    });
     const indexManager = createIndexManager(db);
     const hierarchyOptions = { dataDir };
-    const gatewayClient = createGatewayClient(config.gateway.url);
+    const dataStorage = createNodeDataStorage({ indexManager, hierarchyOptions });
+    const gatewayClient = options?.gatewayClient ?? createGatewayClient(config.gateway.url);
     // Derive server owner from VANA_MASTER_KEY_SIGNATURE env var
-    const masterKeySignature = process.env.VANA_MASTER_KEY_SIGNATURE;
+    const masterKeySignature = options?.ownerSignature ??
+        process.env.VANA_MASTER_KEY_SIGNATURE;
+    const ownerPrivateKey = process.env.VANA_OWNER_PRIVATE_KEY;
     let serverOwner;
     let serverAccount;
     let serverSigner;
@@ -58,6 +94,30 @@ export async function createServer(config, options) {
     else {
         logger.warn("VANA_MASTER_KEY_SIGNATURE not set — owner-restricted endpoints will return 500");
     }
+    // Resolve PS_ACCESS_TOKEN for cloud control-plane / bootstrap auth.
+    // This is not the per-login CLI session token returned to users.
+    let accessToken = process.env.PS_ACCESS_TOKEN;
+    if (!accessToken && process.env.CLOUD_MODE === "true") {
+        try {
+            const metadataRes = await fetch("http://metadata.google.internal/computeMetadata/v1/instance/attributes/ps-access-token", {
+                headers: { "Metadata-Flavor": "Google" },
+                signal: AbortSignal.timeout(2000),
+            });
+            if (metadataRes.ok) {
+                const token = (await metadataRes.text()).trim();
+                if (token.length > 0) {
+                    accessToken = token;
+                    logger.info("PS control-plane token loaded from instance metadata");
+                }
+            }
+        }
+        catch {
+            logger.debug("Could not read PS control-plane token from instance metadata");
+        }
+    }
+    if (accessToken) {
+        logger.info("PS_ACCESS_TOKEN configured — control-plane bearer auth enabled");
+    }
     // Download frpc binary eagerly (auth-independent) so it's ready when the user signs in
     let frpcBinaryPath = "";
     if (config.tunnel.enabled) {
@@ -78,19 +138,16 @@ export async function createServer(config, options) {
         serverAccount &&
         serverSigner) {
         const masterKey = deriveMasterKey(masterKeySignature);
-        const vanaConfig = config.storage.config.vana ?? {
-            apiUrl: "https://storage.vana.com",
-        };
-        const requestSigner = createRequestSigner(serverAccount);
-        const storageAdapter = createVanaStorageAdapter({
-            apiUrl: vanaConfig.apiUrl,
-            ownerAddress: serverOwner,
-            signer: requestSigner,
+        const storageAdapter = createVanaSyncStorageAdapter({
+            config,
+            serverOwner,
+            serverAccount,
+        });
+        const cursor = createSyncCursor(syncCursorPath, {
+            legacyConfigPath: configPath,
         });
-        const cursor = createSyncCursor(configPath);
         const uploadDeps = {
-            indexManager,
-            hierarchyOptions,
+            storage: dataStorage,
             storageAdapter,
             gateway: gatewayClient,
             signer: serverSigner,
@@ -99,8 +156,7 @@ export async function createServer(config, options) {
             logger,
         };
         const downloadDeps = {
-            indexManager,
-            hierarchyOptions,
+            storage: dataStorage,
             storageAdapter,
             gateway: gatewayClient,
             cursor,
@@ -121,8 +177,15 @@ export async function createServer(config, options) {
     const accessLogReader = createAccessLogReader(logsDir);
     // Generate ephemeral dev token when devUi is enabled
     const devToken = config.devUi.enabled ? generateDevToken() : undefined;
+    // Token store for /auth/device flow (self-hosted CLI auth)
+    const tokenStore = createTokenStore(tokensPath, logger);
+    const cloudMode = process.env.CLOUD_MODE === "true";
+    const localApprovalPort = cloudMode
+        ? undefined
+        : resolveLocalApprovalPort(config.server.port);
     // Mutable origin — starts with config value, updated when tunnel connects
     let effectiveOrigin = config.server.origin;
+    let effectiveLocalApprovalOrigin;
     // Mutable tunnelManager — set when tunnel starts in background
     let tunnelManager;
     const app = createApp({
@@ -132,12 +195,21 @@ export async function createServer(config, options) {
         indexManager,
         hierarchyOptions,
         serverOrigin: () => effectiveOrigin,
+        localApprovalOrigin: () => effectiveLocalApprovalOrigin,
         serverOwner,
         identity,
         gateway: gatewayClient,
+        gatewayConfig: config.gateway,
+        config,
         accessLogWriter,
         accessLogReader,
+        dataStorage,
+        cloudMode,
         devToken,
+        ownerSignature: masterKeySignature,
+        ownerPrivateKey,
+        accessToken,
+        tokenStore,
         configPath,
         syncManager,
         serverSigner,
@@ -165,6 +237,11 @@ export async function createServer(config, options) {
         syncManager,
         tunnelManager,
         tunnelUrl: undefined,
+        localApprovalPort,
+        getLocalApprovalOrigin: () => effectiveLocalApprovalOrigin,
+        setLocalApprovalOrigin: (origin) => {
+            effectiveLocalApprovalOrigin = origin;
+        },
         devToken,
         startBackgroundServices: async () => {
             // --- Gateway registration check (slow: HTTP call) ---