@opendatalabs/personal-server-ts-server 0.0.1-canary.cb005d5 → 0.0.1-canary.cc587af

package/dist/api-auth.d.ts

@@ -1,5 +1,6 @@
 import { type SessionTokenVerifierPort } from "@opendatalabs/personal-server-ts-core/auth";
 import type { PersonalServerApiAuthPort } from "@opendatalabs/personal-server-ts-core/api";
+import { type WriteProofReplayStore, type WriteSessionStore } from "@opendatalabs/personal-server-ts-core/write";
 import type { DataStoragePort, RuntimeAvailabilityPort } from "@opendatalabs/personal-server-ts-core/ports";
 import type { GatewayClient } from "@opendatalabs/vana-sdk/node";
 export interface ServerApiAuthDeps {
@@ -11,6 +12,20 @@ export interface ServerApiAuthDeps {
     tokenStore?: SessionTokenVerifierPort;
     dataStorage?: Pick<DataStoragePort, "findEntry">;
     runtimeAvailability?: RuntimeAvailabilityPort;
+    /**
+     * Write API sessions. When present, POST /v1/data/:scope accepts a bearer
+     * write-session token (minted by POST /v1/write/session) and authorizes the
+     * write as the session's builder via verifyDataWritePolicy + the
+     * X-Vana-Write-Signature attribution proof. Absent = owner-only ingest,
+     * exactly as before.
+     */
+    writeSessionStore?: WriteSessionStore;
+    /**
+     * Replay guard for per-write proofs (X-Vana-Write-Signature). Defaults to
+     * an in-memory store so replay protection is always on when write sessions
+     * are enabled; hosts may supply a shared store.
+     */
+    writeProofReplayStore?: WriteProofReplayStore;
 }
 export declare function createServerApiAuth(deps: ServerApiAuthDeps): PersonalServerApiAuthPort;
 //# sourceMappingURL=api-auth.d.ts.map

package/dist/api-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-auth.d.ts","sourceRoot":"","sources":["../src/api-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,4CAA4C,CAAC;AACpD,OAAO,KAAK,EACV,yBAAyB,EAE1B,MAAM,2CAA2C,CAAC;AAOnD,OAAO,KAAK,EACV,eAAe,EACf,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEjE,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,OAAO,EAAE,aAAa,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,wBAAwB,CAAC;IACtC,WAAW,CAAC,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IACjD,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;CAC/C;AA6CD,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,iBAAiB,GACtB,yBAAyB,CA0E3B"}
+{"version":3,"file":"api-auth.d.ts","sourceRoot":"","sources":["../src/api-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,4CAA4C,CAAC;AACpD,OAAO,KAAK,EACV,yBAAyB,EAG1B,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACvB,MAAM,6CAA6C,CAAC;AAMrD,OAAO,KAAK,EACV,eAAe,EACf,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEjE,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,OAAO,EAAE,aAAa,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,wBAAwB,CAAC;IACtC,WAAW,CAAC,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IACjD,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;IAC9C;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;CAC/C;AA6CD,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,iBAAiB,GACtB,yBAAyB,CAiI3B"}

package/dist/api-auth.js

@@ -1,5 +1,6 @@
 import { authenticateRequest, } from "@opendatalabs/personal-server-ts-core/auth";
 import { verifyDataReadPolicy } from "@opendatalabs/personal-server-ts-core/policy";
+import { createInMemoryWriteProofReplayStore, createWriteSessionAuthorization, } from "@opendatalabs/personal-server-ts-core/write";
 import { NotOwnerError, ProtocolError, UnregisteredBuilderError, } from "@opendatalabs/personal-server-ts-core/errors";
 function serverNotConfigured() {
     return new ProtocolError(500, "SERVER_NOT_CONFIGURED", "Server owner address not configured. Set VANA_MASTER_KEY_SIGNATURE environment variable.");
@@ -18,30 +19,75 @@ async function authenticate(request, deps) {
     });
 }
 async function assertRegisteredBuilder(gateway, signer) {
-    if ("isRegisteredBuilder" in gateway) {
-        if (await gateway.isRegisteredBuilder(signer))
-            return;
-        throw new UnregisteredBuilderError();
-    }
-    const builder = await gateway.getBuilder(signer);
-    if (!builder)
-        throw new UnregisteredBuilderError();
+    // vana-sdk 3.14.0's GatewayClient always exposes isRegisteredBuilder, so the
+    // legacy getBuilder feature-detect fallback is now unreachable (its else
+    // branch narrows the client to `never`). Query registration directly, matching
+    // middleware/builder-check.ts.
+    if (await gateway.isRegisteredBuilder(signer))
+        return;
+    throw new UnregisteredBuilderError();
 }
 export function createServerApiAuth(deps) {
-    return {
-        async authorizeOwner(request) {
-            const result = await authenticate(request, deps);
-            if (result.isPolicyBypass)
-                return;
-            if (!deps.serverOwner)
-                throw serverNotConfigured();
-            if (!isOwner(result.auth.signer, deps.serverOwner)) {
-                throw new NotOwnerError({
-                    signer: result.auth.signer,
-                    expected: deps.serverOwner,
-                });
-            }
+    const writeProofReplayStore = deps.writeProofReplayStore ?? createInMemoryWriteProofReplayStore();
+    // The write-session half of this port is protocol, not runtime: the browser
+    // build's adapters call the same factory, so a delegated write is checked
+    // identically wherever the Personal Server runs.
+    const writeSessions = createWriteSessionAuthorization({
+        serverOrigin: deps.serverOrigin,
+        serverOwner: deps.serverOwner,
+        sessionStore: deps.writeSessionStore,
+        replayStore: writeProofReplayStore,
+        policyPorts: {
+            authSessionVerifier: deps.gateway,
+            grantVerifier: deps.gateway,
+            runtimeAvailability: deps.runtimeAvailability,
+            // Fee seam intentionally not wired: builder writes are free in the
+            // demo slice (write fee mechanics undecided).
         },
+    });
+    async function authorizeOwner(request) {
+        const result = await authenticate(request, deps);
+        if (result.isPolicyBypass)
+            return;
+        if (!deps.serverOwner)
+            throw serverNotConfigured();
+        if (!isOwner(result.auth.signer, deps.serverOwner)) {
+            throw new NotOwnerError({
+                signer: result.auth.signer,
+                expected: deps.serverOwner,
+            });
+        }
+    }
+    /**
+     * Delegated ingest. A bearer token that resolves to a live write session
+     * authorizes as the session builder: the write policy re-runs against the
+     * LIVE grant (revocation / expiry / scope coverage stay authoritative per
+     * write), and the builder's X-Vana-Write-Signature payload proof is
+     * verified and returned for the handler to store with the record. Any
+     * other credential (owner Web3Signed, dev token, control-plane token,
+     * unknown bearer) falls through to the owner path unchanged.
+     */
+    async function authorizeWrite(input) {
+        const delegated = await writeSessions.authorizeSessionWrite(input);
+        if (delegated)
+            return delegated;
+        await authorizeOwner(input.request);
+    }
+    /**
+     * Identity-only recognition of a write-session caller: the bearer must
+     * resolve to a live session and the request must carry that builder's
+     * valid proof, but NO grant policy runs (there is no scope to run it
+     * against). Callers use it only to choose between error shapes, never to
+     * release data, so a revoked or narrowed grant getting a 404 instead of a
+     * 401 discloses nothing. Returns undefined for any other credential.
+     */
+    async function authorizeWriteSession(request) {
+        return writeSessions.recognizeWriteSession(request);
+    }
+    return {
+        authorizeOwner,
+        authorizeWrite,
+        authorizeWriteSession,
         async authorizeBuilderList(request) {
             const result = await authenticate(request, deps);
             if (result.isPolicyBypass ||
@@ -76,6 +122,10 @@ export function createServerApiAuth(deps) {
                     result.mechanism === "control-plane-token")) {
                 return { builder: result.auth.signer, grantId: "owner" };
             }
+            // Fail closed: a builder grant read can't be authorized if we can't
+            // identify this server's owner to bind the grant to.
+            if (!deps.serverOwner)
+                throw serverNotConfigured();
             const selectedEntry = deps.dataStorage?.findEntry({
                 scope: input.scope,
                 fileId: input.fileId,
@@ -85,6 +135,7 @@ export function createServerApiAuth(deps) {
                 grantId: result.auth.payload.grantId ?? input.grantId,
                 requestedScope: input.scope,
                 fileId: input.fileId ?? selectedEntry?.fileId ?? undefined,
+                serverOwner: deps.serverOwner,
             }, {
                 authSessionVerifier: deps.gateway,
                 grantVerifier: deps.gateway,

package/dist/api-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-auth.js","sourceRoot":"","sources":["../src/api-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,GAGpB,MAAM,4CAA4C,CAAC;AAKpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8CAA8C,CAAC;AACpF,OAAO,EACL,aAAa,EACb,aAAa,EACb,wBAAwB,GACzB,MAAM,8CAA8C,CAAC;AAkBtD,SAAS,mBAAmB;IAC1B,OAAO,IAAI,aAAa,CACtB,GAAG,EACH,uBAAuB,EACvB,0FAA0F,CAC3F,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CACd,MAAc,EACd,WAAsC;IAEtC,OAAO,OAAO,CACZ,WAAW,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,WAAW,EAAE,CAClE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,OAAgB,EAChB,IAAuB;IAEvB,OAAO,mBAAmB,CAAC;QACzB,OAAO;QACP,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,oBAAoB,EAAE,IAAI,CAAC,UAAU;QACrC,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,OAAsB,EACtB,MAAqB;IAErB,IAAI,qBAAqB,IAAI,OAAO,EAAE,CAAC;QACrC,IAAI,MAAM,OAAO,CAAC,mBAAmB,CAAC,MAAM,CAAC;YAAE,OAAO;QACtD,MAAM,IAAI,wBAAwB,EAAE,CAAC;IACvC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,wBAAwB,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,IAAuB;IAEvB,OAAO;QACL,KAAK,CAAC,cAAc,CAAC,OAAO;YAC1B,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACjD,IAAI,MAAM,CAAC,cAAc;gBAAE,OAAO;YAClC,IAAI,CAAC,IAAI,CAAC,WAAW;gBAAE,MAAM,mBAAmB,EAAE,CAAC;YACnD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBACnD,MAAM,IAAI,aAAa,CAAC;oBACtB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;oBAC1B,QAAQ,EAAE,IAAI,CAAC,WAAW;iBAC3B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,KAAK,CAAC,oBAAoB,CAAC,OAAO;YAChC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACjD,IACE,MAAM,CAAC,cAAc;gBACrB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,EAC7C,CAAC;gBACD,OAAO;YACT,CAAC;YACD,MAAM,uBAAuB,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClE,CAAC;QAED,KAAK,CAAC,oBAAoB,CAAC,KAAkC;YAC3D,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACvD,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;gBAC1B,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;YACnE,CAAC;YACD,yDAAyD;YACzD,sEAAsE;YACtE,wDAAwD;YACxD,kEAAkE;YAClE,mEAAmE;YACnE,4DAA4D;YAC5D,8BAA8B;YAC9B,wEAAwE;YACxE,uEAAuE;YACvE,qEAAqE;YACrE,yDAAyD;YACzD,sEAAsE;YACtE,sEAAsE;YACtE,oEAAoE;YACpE,iEAAiE;YACjE,oEAAoE;YACpE,IACE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC;gBAC7C,CAAC,MAAM,CAAC,SAAS,KAAK,aAAa;oBACjC,MAAM,CAAC,SAAS,KAAK,qBAAqB,CAAC,EAC7C,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;YAC3D,CAAC;YAED,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC;gBAChD,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,oBAAoB,CACtC;gBACE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;gBAC1B,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO;gBACrD,cAAc,EAAE,KAAK,CAAC,KAAK;gBAC3B,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,aAAa,EAAE,MAAM,IAAI,SAAS;aAC3D,EACD;gBACE,mBAAmB,EAAE,IAAI,CAAC,OAAO;gBACjC,aAAa,EAAE,IAAI,CAAC,OAAO;gBAC3B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;aAC9C,CACF,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QAC5D,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"api-auth.js","sourceRoot":"","sources":["../src/api-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,GAGpB,MAAM,4CAA4C,CAAC;AAMpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8CAA8C,CAAC;AACpF,OAAO,EACL,mCAAmC,EACnC,+BAA+B,GAGhC,MAAM,6CAA6C,CAAC;AACrD,OAAO,EACL,aAAa,EACb,aAAa,EACb,wBAAwB,GACzB,MAAM,8CAA8C,CAAC;AAgCtD,SAAS,mBAAmB;IAC1B,OAAO,IAAI,aAAa,CACtB,GAAG,EACH,uBAAuB,EACvB,0FAA0F,CAC3F,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CACd,MAAc,EACd,WAAsC;IAEtC,OAAO,OAAO,CACZ,WAAW,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,WAAW,EAAE,CAClE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,OAAgB,EAChB,IAAuB;IAEvB,OAAO,mBAAmB,CAAC;QACzB,OAAO;QACP,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,oBAAoB,EAAE,IAAI,CAAC,UAAU;QACrC,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,OAAsB,EACtB,MAAqB;IAErB,6EAA6E;IAC7E,yEAAyE;IACzE,+EAA+E;IAC/E,+BAA+B;IAC/B,IAAI,MAAM,OAAO,CAAC,mBAAmB,CAAC,MAAM,CAAC;QAAE,OAAO;IACtD,MAAM,IAAI,wBAAwB,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,IAAuB;IAEvB,MAAM,qBAAqB,GACzB,IAAI,CAAC,qBAAqB,IAAI,mCAAmC,EAAE,CAAC;IACtE,4EAA4E;IAC5E,0EAA0E;IAC1E,iDAAiD;IACjD,MAAM,aAAa,GAAG,+BAA+B,CAAC;QACpD,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,YAAY,EAAE,IAAI,CAAC,iBAAiB;QACpC,WAAW,EAAE,qBAAqB;QAClC,WAAW,EAAE;YACX,mBAAmB,EAAE,IAAI,CAAC,OAAO;YACjC,aAAa,EAAE,IAAI,CAAC,OAAO;YAC3B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,mEAAmE;YACnE,8CAA8C;SAC/C;KACF,CAAC,CAAC;IAEH,KAAK,UAAU,cAAc,CAAC,OAAgB;QAC5C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,MAAM,CAAC,cAAc;YAAE,OAAO;QAClC,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,MAAM,mBAAmB,EAAE,CAAC;QACnD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,aAAa,CAAC;gBACtB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;gBAC1B,QAAQ,EAAE,IAAI,CAAC,WAAW;aAC3B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,UAAU,cAAc,CAAC,KAAmC;QAC/D,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACnE,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC;QAChC,MAAM,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,UAAU,qBAAqB,CAAC,OAAgB;QACnD,OAAO,aAAa,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACtD,CAAC;IAED,OAAO;QACL,cAAc;QACd,cAAc;QACd,qBAAqB;QAErB,KAAK,CAAC,oBAAoB,CAAC,OAAO;YAChC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACjD,IACE,MAAM,CAAC,cAAc;gBACrB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,EAC7C,CAAC;gBACD,OAAO;YACT,CAAC;YACD,MAAM,uBAAuB,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClE,CAAC;QAED,KAAK,CAAC,oBAAoB,CAAC,KAAkC;YAC3D,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACvD,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;gBAC1B,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;YACnE,CAAC;YACD,yDAAyD;YACzD,sEAAsE;YACtE,wDAAwD;YACxD,kEAAkE;YAClE,mEAAmE;YACnE,4DAA4D;YAC5D,8BAA8B;YAC9B,wEAAwE;YACxE,uEAAuE;YACvE,qEAAqE;YACrE,yDAAyD;YACzD,sEAAsE;YACtE,sEAAsE;YACtE,oEAAoE;YACpE,iEAAiE;YACjE,oEAAoE;YACpE,IACE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC;gBAC7C,CAAC,MAAM,CAAC,SAAS,KAAK,aAAa;oBACjC,MAAM,CAAC,SAAS,KAAK,qBAAqB,CAAC,EAC7C,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;YAC3D,CAAC;YAED,oEAAoE;YACpE,qDAAqD;YACrD,IAAI,CAAC,IAAI,CAAC,WAAW;gBAAE,MAAM,mBAAmB,EAAE,CAAC;YAEnD,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC;gBAChD,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,oBAAoB,CACtC;gBACE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;gBAC1B,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO;gBACrD,cAAc,EAAE,KAAK,CAAC,KAAK;gBAC3B,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,aAAa,EAAE,MAAM,IAAI,SAAS;gBAC1D,WAAW,EAAE,IAAI,CAAC,WAAW;aAC9B,EACD;gBACE,mBAAmB,EAAE,IAAI,CAAC,OAAO;gBACjC,aAAa,EAAE,IAAI,CAAC,OAAO;gBAC3B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;aAC9C,CACF,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QAC5D,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/app.d.ts

@@ -5,13 +5,21 @@ import type { DataPortabilityGatewayConfig, GatewayClient } from "@opendatalabs/
 import type { ServerConfig } from "@opendatalabs/personal-server-ts-core/schemas";
 import type { AccessLogWriter } from "@opendatalabs/personal-server-ts-core/logging/access-log";
 import type { AccessLogReader } from "@opendatalabs/personal-server-ts-core/logging/access-reader";
+import type { PersonalServerReadFulfillmentReporter } from "@opendatalabs/personal-server-ts-core/api";
 import { type HealthDeps } from "./routes/health.js";
+import { type WriteProofReplayStore, type WriteSessionStore } from "@opendatalabs/personal-server-ts-core/write";
 import { McpActivityRecorder, type McpConnectionStore, type McpOAuthAuthorizationStore } from "@opendatalabs/personal-server-ts-core/mcp";
-import type { SyncManager } from "@opendatalabs/personal-server-ts-core/sync";
+import type { ScopeDeletionTracker, SyncManager } from "@opendatalabs/personal-server-ts-core/sync";
 import type { ServerSigner } from "@opendatalabs/personal-server-ts-core/signing";
+import type { LineageGatewayPort } from "@opendatalabs/personal-server-ts-core/lineage";
+import type { QuestionStore, RecomputeScheduler } from "@opendatalabs/personal-server-ts-core/derivatives";
 import type { DataStoragePort, RuntimeAvailabilityPort } from "@opendatalabs/personal-server-ts-core/ports";
 import type { TokenStore } from "./token-store.js";
 import type { Logger } from "pino";
+import type { JobRequestEnvelope } from "@opendatalabs/vana-sdk/protocol/jobs";
+import type { JobExecuteResponse } from "./jobs/types.js";
+import type { PdppAuthorizationService } from "@opendatalabs/personal-server-ts-core/ports/pdpp-auth";
+import type { PdppRecordStore, StreamDeclarationRegistry } from "@opendatalabs/personal-server-ts-core/storage/pdpp-records";
 export interface IdentityInfo {
     address: `0x${string}`;
     publicKey: `0x${string}`;
@@ -34,13 +42,23 @@ export interface AppDeps {
     config?: ServerConfig;
     accessLogWriter: AccessLogWriter;
     accessLogReader: AccessLogReader;
+    readFulfillmentReporter?: PersonalServerReadFulfillmentReporter;
     cloudMode?: boolean;
     devToken?: string;
+    /**
+     * Port of the loopback-only auth listener. The dev UI subtree is served
+     * only to connections that arrived on it (never via the tunnel).
+     */
+    localApprovalPort?: number;
+    /** Main server port; a loopback-port collision disables the dev UI. */
+    serverPort?: number;
     ownerSignature?: `0x${string}`;
     ownerPrivateKey?: `0x${string}`;
     accessToken?: string;
     configPath?: string;
     syncManager?: SyncManager | null;
+    /** Read-side tombstone memory; reads of a deleted scope answer 410. */
+    scopeDeletions?: ScopeDeletionTracker;
     serverSigner?: ServerSigner;
     tokenStore?: TokenStore;
     runtimeAvailability?: RuntimeAvailabilityPort;
@@ -55,7 +73,24 @@ export interface AppDeps {
      * Off-by-default to keep dev / test setups frictionless.
      */
     paymentEnabled?: boolean;
+    /** Derivative data: gateway lineage access for the data routes. */
+    lineageGateway?: LineageGatewayPort;
+    /**
+     * Derivative compute layer (docs/derivative-data-api.md, "Compute").
+     * Absent = /v1/derivatives answers 503 and writes trigger no recompute.
+     */
+    derivativeCompute?: {
+        store: QuestionStore;
+        scheduler: RecomputeScheduler;
+    } | null;
     getTunnelStatus?: HealthDeps["getTunnelStatus"];
+    /**
+     * Invoked when the /ui/api registration route confirms the server is
+     * registered with the gateway (fresh or pre-existing), so a
+     * registration-gated tunnel can start immediately instead of waiting for
+     * the bootstrap's gateway poll (BUI-611).
+     */
+    onServerRegistered?: (serverId: string | null) => void;
     /**
      * MCP connection store shared between the `/mcp/:token` Streamable HTTP
      * endpoint and the owner `/v1/mcp/connections` management surface. Defaults
@@ -66,6 +101,36 @@ export interface AppDeps {
     mcpOAuthAuthorizationStore?: McpOAuthAuthorizationStore;
     mcpOAuthApprovalUrl?: string | (() => string);
     mcpActivityRecorder?: McpActivityRecorder;
+    mcpHydrateScopes?: (scopes: string[]) => Promise<void>;
+    /**
+     * Write API session store shared between POST /v1/write/session (which
+     * mints tokens) and the ingest endpoint (which redeems them). Defaults to
+     * an in-memory store, mirroring the MCP connection store default.
+     */
+    writeSessionStore?: WriteSessionStore;
+    /**
+     * Replay guard for per-write proofs on delegated ingest. Defaults to an
+     * in-memory store (api-auth); hosts may supply a shared one.
+     */
+    writeProofReplayStore?: WriteProofReplayStore;
+    profile?: "standard" | "enclave";
+    jobWorker?: (envelope: JobRequestEnvelope) => Promise<JobExecuteResponse>;
+    /**
+     * PDPP §4/§8 record model + Resource Server query surface. Absent = the
+     * PDPP routes are not mounted; existing deployments are unaffected. When
+     * present, all three must be present together (record store, token
+     * resolution, and stream declarations are mutually required).
+     */
+    pdpp?: {
+        store: PdppRecordStore;
+        auth: PdppAuthorizationService;
+        declarations: StreamDeclarationRegistry;
+        instancesForSubject?: (subjectId: string) => string[];
+        readBlobBytes?: (blobId: string) => Promise<Uint8Array<ArrayBuffer> | undefined>;
+        /** This resource server's own identifier, RFC 9728 `resource` member. */
+        resource: string;
+        authorizationServers?: string[];
+    };
 }
 export declare function createApp(deps: AppDeps): Hono;
 //# sourceMappingURL=app.d.ts.map

package/dist/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACxF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yDAAyD,CAAC;AACvG,OAAO,KAAK,EACV,4BAA4B,EAC5B,aAAa,EACd,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+CAA+C,CAAC;AAClF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAChG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAe,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAWlE,OAAO,EACL,mBAAmB,EAGnB,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,EAChC,MAAM,2CAA2C,CAAC;AASnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4CAA4C,CAAC;AAC9E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+CAA+C,CAAC;AAClF,OAAO,KAAK,EACV,eAAe,EACf,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAEnC,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,KAAK,MAAM,EAAE,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,YAAY,EAAE,YAAY,CAAC;IAC3B,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,mBAAmB,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;IAC1D,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,OAAO,EAAE,aAAa,CAAC;IACvB,aAAa,CAAC,EAAE,4BAA4B,GAAG;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAChE,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,eAAe,EAAE,eAAe,CAAC;IACjC,eAAe,EAAE,eAAe,CAAC;IACjC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC/B,eAAe,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACjC,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;IAC9C,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,eAAe,CAAC,EAAE,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAChD;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,0BAA0B,CAAC,EAAE,0BAA0B,CAAC;IACxD,mBAAmB,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IAC9C,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAuP7C"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACxF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yDAAyD,CAAC;AACvG,OAAO,KAAK,EACV,4BAA4B,EAC5B,aAAa,EACd,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+CAA+C,CAAC;AAClF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAChG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,2CAA2C,CAAC;AACvG,OAAO,EAAe,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAKlE,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACvB,MAAM,6CAA6C,CAAC;AAcrD,OAAO,EACL,mBAAmB,EAGnB,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,EAChC,MAAM,2CAA2C,CAAC;AASnD,OAAO,KAAK,EACV,oBAAoB,EACpB,WAAW,EACZ,MAAM,4CAA4C,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+CAA+C,CAAC;AAClF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,+CAA+C,CAAC;AACxF,OAAO,KAAK,EACV,aAAa,EACb,kBAAkB,EACnB,MAAM,mDAAmD,CAAC;AAC3D,OAAO,KAAK,EACV,eAAe,EACf,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAEnC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC/E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAI1D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,KAAK,EACV,eAAe,EACf,yBAAyB,EAC1B,MAAM,4DAA4D,CAAC;AAEpE,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,KAAK,MAAM,EAAE,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,YAAY,EAAE,YAAY,CAAC;IAC3B,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,mBAAmB,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;IAC1D,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,OAAO,EAAE,aAAa,CAAC;IACvB,aAAa,CAAC,EAAE,4BAA4B,GAAG;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAChE,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,eAAe,EAAE,eAAe,CAAC;IACjC,eAAe,EAAE,eAAe,CAAC;IACjC,uBAAuB,CAAC,EAAE,qCAAqC,CAAC;IAChE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC/B,eAAe,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACjC,uEAAuE;IACvE,cAAc,CAAC,EAAE,oBAAoB,CAAC;IACtC,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;IAC9C,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,mEAAmE;IACnE,cAAc,CAAC,EAAE,kBAAkB,CAAC;IACpC;;;OAGG;IACH,iBAAiB,CAAC,EAAE;QAClB,KAAK,EAAE,aAAa,CAAC;QACrB,SAAS,EAAE,kBAAkB,CAAC;KAC/B,GAAG,IAAI,CAAC;IACT,eAAe,CAAC,EAAE,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAChD;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IACvD;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,0BAA0B,CAAC,EAAE,0BAA0B,CAAC;IACxD,mBAAmB,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IAC9C,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;OAGG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAC9C,OAAO,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IACjC,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC1E;;;;;OAKG;IACH,IAAI,CAAC,EAAE;QACL,KAAK,EAAE,eAAe,CAAC;QACvB,IAAI,EAAE,wBAAwB,CAAC;QAC/B,YAAY,EAAE,yBAAyB,CAAC;QACxC,mBAAmB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;QACtD,aAAa,CAAC,EAAE,CACd,MAAM,EAAE,MAAM,KACX,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,SAAS,CAAC,CAAC;QAClD,yEAAyE;QACzE,QAAQ,EAAE,MAAM,CAAC;QACjB,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;KACjC,CAAC;CACH;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CA8Y7C"}

package/dist/app.js

@@ -1,27 +1,52 @@
 import { Hono } from "hono";
-import { cors } from "hono/cors";
 import { ProtocolError } from "@opendatalabs/personal-server-ts-core/errors";
 import { healthRoute } from "./routes/health.js";
+import { corsMiddleware } from "./middleware/cors.js";
+import { requireLoopbackListener } from "./middleware/local-listener.js";
 import { dataRoutes } from "./routes/data.js";
+import { writeSessionRoutes } from "./routes/write-session.js";
+import { createInMemoryWriteProofReplayStore, createInMemoryWriteSessionStore, } from "@opendatalabs/personal-server-ts-core/write";
+import { derivativesRoutes } from "./routes/derivatives.js";
 import { grantsRoutes } from "./routes/grants.js";
 import { accessLogsRoutes } from "./routes/access-logs.js";
 import { syncRoutes } from "./routes/sync.js";
-import { mcpActivityRoutes, mcpConnectionsRoutes, mcpOAuthRoutes, mcpStreamableHttpRoutes, } from "./routes/mcp.js";
+import { executeMcpConnectionRequest, mcpActivityRoutes, mcpConnectionsRoutes, mcpOAuthRoutes, mcpStreamableHttpRoutes, } from "./routes/mcp.js";
+import { enclaveMcpRoutes } from "./routes/enclave-mcp.js";
+import { enclaveFleetRoutes } from "./routes/enclave-fleet.js";
 import { McpActivityRecorder, createInMemoryMcpConnectionStore, createInMemoryMcpOAuthAuthorizationStore, } from "@opendatalabs/personal-server-ts-core/mcp";
 import { uiConfigRoutes } from "./routes/ui-config.js";
 import { uiRegistrationRoutes } from "./routes/ui-registration.js";
 import { uiRoute } from "./routes/ui.js";
 import { authDeviceRoutes, createDeviceSessionLookup, } from "./routes/auth-device.js";
 import { oauthTokenRoutes } from "./routes/oauth-token.js";
+import { enclaveJobRoutes } from "./routes/enclave-jobs.js";
+import { pdppRecordsRoutes } from "./routes/pdpp-records.js";
+import { pdppBlobsRoutes } from "./routes/pdpp-blobs.js";
+import { pdppWellKnownRoutes } from "./routes/pdpp-well-known.js";
 export function createApp(deps) {
     const app = new Hono();
-    // CORS — allow all origins for browser-based clients
-    app.use("*", cors({
-        origin: "*",
-        allowHeaders: ["Content-Type", "Authorization"],
-        allowMethods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"],
-        maxAge: 86400,
-    }));
+    // One store for mint (POST /v1/write/session) and redeem (data ingest and
+    // derivative question registration), and one replay guard for the proofs
+    // both redeeming routes verify.
+    const writeSessionStore = deps.writeSessionStore ?? createInMemoryWriteSessionStore();
+    const writeProofReplayStore = deps.writeProofReplayStore ?? createInMemoryWriteProofReplayStore();
+    // CORS — allow all origins for browser-based clients. Registered first so
+    // OPTIONS preflights are answered before any route or auth code runs
+    // (route sub-apps only register their real methods).
+    // Dev UI gate — registered BEFORE the permissive global CORS so a
+    // cross-origin preflight for /ui/* is refused rather than answered with
+    // `Access-Control-Allow-Origin: *`. The whole /ui subtree is served only to
+    // connections on the loopback auth listener: the tunnel forwards the main
+    // server port, so without this gate the page (and the dev token it
+    // carries, which is a full owner/policy bypass) is reachable by anyone who
+    // knows the public tunnel URL.
+    const uiLoopbackOnly = requireLoopbackListener({
+        localApprovalPort: deps.localApprovalPort,
+        serverPort: deps.serverPort,
+    });
+    app.use("/ui", uiLoopbackOnly);
+    app.use("/ui/*", uiLoopbackOnly);
+    app.use("*", corsMiddleware());
     // Mount health route
     app.route("/", healthRoute({
         version: deps.version,
@@ -35,6 +60,35 @@ export function createApp(deps) {
         getTunnelStatus: deps.getTunnelStatus,
         runtimeAvailability: deps.runtimeAvailability,
     }));
+    // PDPP §4 record model + §8 Resource Server query surface. Independent of
+    // the legacy DPP fileId/scope routes above; mounted only when a pdpp deps
+    // bundle is supplied.
+    if (deps.pdpp) {
+        app.route("/v1", pdppRecordsRoutes({
+            store: deps.pdpp.store,
+            auth: deps.pdpp.auth,
+            declarations: deps.pdpp.declarations,
+            instancesForSubject: deps.pdpp.instancesForSubject,
+        }));
+        app.route("/v1/blobs", pdppBlobsRoutes({
+            store: deps.pdpp.store,
+            auth: deps.pdpp.auth,
+            declarations: deps.pdpp.declarations,
+            instancesForSubject: deps.pdpp.instancesForSubject,
+            readBlobBytes: deps.pdpp.readBlobBytes,
+        }));
+        app.route("/.well-known", pdppWellKnownRoutes({
+            resource: deps.pdpp.resource,
+            coreQueryBase: "/v1",
+            authorizationServers: deps.pdpp.authorizationServers,
+        }));
+    }
+    if (deps.profile === "enclave" && deps.jobWorker && deps.accessToken) {
+        app.route("/enclave/v1/jobs", enclaveJobRoutes({
+            accessToken: deps.accessToken,
+            executeJob: deps.jobWorker,
+        }));
+    }
     // Mount data routes (ingest + read + delete)
     app.route("/v1/data", dataRoutes({
         indexManager: deps.indexManager,
@@ -44,10 +98,12 @@ export function createApp(deps) {
         serverOwner: deps.serverOwner,
         gateway: deps.gateway,
         accessLogWriter: deps.accessLogWriter,
+        readFulfillmentReporter: deps.readFulfillmentReporter,
         devToken: deps.devToken,
         accessToken: deps.accessToken,
         tokenStore: deps.tokenStore,
         syncManager: deps.syncManager ?? null,
+        scopeDeletions: deps.scopeDeletions,
         runtimeAvailability: deps.runtimeAvailability,
         dataStorage: deps.dataStorage,
         // Powers the RECORD_DATA_ACCESS attestation embedded in X402 challenges.
@@ -60,8 +116,49 @@ export function createApp(deps) {
         gatewayConfig: deps.gatewayConfig,
         gatewayUrl: deps.gatewayUrl ?? deps.config?.gateway.url ?? deps.gatewayConfig?.url,
         paymentEnabled: deps.paymentEnabled,
+        lineageGateway: deps.lineageGateway,
+        writeSessionStore,
+        writeProofReplayStore,
+        // A new local version of a scope marks every question that reads it
+        // stale; the recompute waits for a reader.
+        onDataWritten: deps.derivativeCompute
+            ? (event) => deps.derivativeCompute?.scheduler.markSourceChanged(event.scope, {
+                lineageSources: event.lineageSources,
+            })
+            : undefined,
+        // And an authorized read of a derived scope is that reader.
+        onDataRead: deps.derivativeCompute
+            ? (event) => deps.derivativeCompute?.scheduler.markDemand(event.scope)
+            : undefined,
         mountPath: "/v1/data",
     }));
+    // Derivative compute: question registration + readiness for builders.
+    app.route("/v1/derivatives", derivativesRoutes({
+        logger: deps.logger,
+        serverOrigin: deps.serverOrigin,
+        serverOwner: deps.serverOwner,
+        gateway: deps.gateway,
+        devToken: deps.devToken,
+        accessToken: deps.accessToken,
+        tokenStore: deps.tokenStore,
+        dataStorage: deps.dataStorage,
+        runtimeAvailability: deps.runtimeAvailability,
+        writeSessionStore,
+        writeProofReplayStore,
+        compute: deps.derivativeCompute ?? null,
+        mountPath: "/v1/derivatives",
+    }));
+    // Mount the Write API session handshake (delegated builder writes).
+    app.route("/v1/write", writeSessionRoutes({
+        logger: deps.logger,
+        serverOrigin: deps.serverOrigin,
+        serverOwner: deps.serverOwner,
+        gateway: deps.gateway,
+        devToken: deps.devToken,
+        accessToken: deps.accessToken,
+        tokenStore: deps.tokenStore,
+        sessionStore: writeSessionStore,
+    }));
     // Mount grants routes (POST /verify is public, GET / and POST / need owner auth)
     app.route("/v1/grants", grantsRoutes({
         logger: deps.logger,
@@ -111,13 +208,16 @@ export function createApp(deps) {
         logger: deps.logger,
         serverOrigin: deps.serverOrigin,
         serverOwner: deps.serverOwner,
+        serverAddress: deps.identity?.address,
         serverSigner: deps.serverSigner,
         gateway: deps.gateway,
         gatewayConfig: deps.gatewayConfig,
+        paymentEnabled: deps.paymentEnabled,
         devToken: deps.devToken,
         accessToken: deps.accessToken,
         tokenStore: deps.tokenStore,
         accessLogWriter: deps.accessLogWriter,
+        readFulfillmentReporter: deps.readFulfillmentReporter,
         indexManager: deps.indexManager,
         hierarchyOptions: deps.hierarchyOptions,
         dataStorage: deps.dataStorage,
@@ -131,6 +231,34 @@ export function createApp(deps) {
     app.route("/v1/mcp/connections", mcpConnectionsRoutes(mcpRouteDeps));
     app.route("/v1/mcp/activity", mcpActivityRoutes(mcpRouteDeps));
     app.route("/mcp", mcpStreamableHttpRoutes(mcpRouteDeps));
+    if (deps.profile === "enclave" && deps.accessToken && deps.serverOwner) {
+        app.route("/enclave/v1/fleet", enclaveFleetRoutes({
+            accessToken: deps.accessToken,
+            hydrate: async (scopes) => {
+                if (!deps.mcpHydrateScopes)
+                    throw new Error("Scoped hydration unavailable");
+                await deps.mcpHydrateScopes(scopes);
+            },
+            observe: async (scope) => {
+                const storage = deps.dataStorage;
+                const entry = storage?.findEntry({ scope });
+                const ready = entry && storage?.hasScopeBlocks
+                    ? await storage.hasScopeBlocks(scope, entry.collectedAt)
+                    : false;
+                return { dataVersion: entry?.version ?? null, ready };
+            },
+        }));
+        app.route("/enclave/v1/mcp", enclaveMcpRoutes({
+            accessToken: deps.accessToken,
+            serverOwner: deps.serverOwner,
+            execute: async (request, connection) => {
+                await deps.mcpHydrateScopes?.([
+                    ...new Set(connection.grants.flatMap((grant) => grant.scopes)),
+                ]);
+                return executeMcpConnectionRequest(request, connection, mcpRouteDeps);
+            },
+        }));
+    }
     // Mount login flow v2 routes (self-hosted CLI auth, no auth required)
     if (deps.tokenStore) {
         app.route("/auth/device", authDeviceRoutes({
@@ -153,7 +281,8 @@ export function createApp(deps) {
             deviceSessions: createDeviceSessionLookup(),
         }));
     }
-    // Mount dev UI routes when dev token is available
+    // Mount dev UI routes when dev token is available. The /ui subtree is
+    // already gated to the loopback auth listener above.
     if (deps.devToken) {
         app.route("/ui", uiRoute({
             devToken: deps.devToken,
@@ -173,6 +302,7 @@ export function createApp(deps) {
         app.route("/ui/api", uiRegistrationRoutes({
             devToken: deps.devToken,
             ownerPrivateKey: deps.ownerPrivateKey,
+            onRegistered: deps.onServerRegistered,
         }));
     }
     // Global error handler

package/dist/app.js.map

@@ -1 +1 @@
-{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,8CAA8C,CAAC;AAU7E,OAAO,EAAE,WAAW,EAAmB,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,cAAc,EACd,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,mBAAmB,EACnB,gCAAgC,EAChC,wCAAwC,GAGzC,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACzC,OAAO,EACL,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAiE3D,MAAM,UAAU,SAAS,CAAC,IAAa;IACrC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,qDAAqD;IACrD,GAAG,CAAC,GAAG,CACL,GAAG,EACH,IAAI,CAAC;QACH,MAAM,EAAE,GAAG;QACX,YAAY,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC;QAC/C,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC;QACzD,MAAM,EAAE,KAAK;KACd,CAAC,CACH,CAAC;IAEF,qBAAqB;IACrB,GAAG,CAAC,KAAK,CACP,GAAG,EACH,WAAW,CAAC;QACV,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;KAC9C,CAAC,CACH,CAAC;IAEF,6CAA6C;IAC7C,GAAG,CAAC,KAAK,CACP,UAAU,EACV,UAAU,CAAC;QACT,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;QACrC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,yEAAyE;QACzE,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO;QACrC,mEAAmE;QACnE,mEAAmE;QACnE,iEAAiE;QACjE,mDAAmD;QACnD,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EACR,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,aAAa,EAAE,GAAG;QACxE,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,SAAS,EAAE,UAAU;KACtB,CAAC,CACH,CAAC;IAEF,iFAAiF;IACjF,GAAG,CAAC,KAAK,CACP,YAAY,EACZ,YAAY,CAAC;QACX,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,SAAS,EAAE,YAAY;KACxB,CAAC,CACH,CAAC;IAEF,4CAA4C;IAC5C,GAAG,CAAC,KAAK,CACP,iBAAiB,EACjB,gBAAgB,CAAC;QACf,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,SAAS,EAAE,iBAAiB;KAC7B,CAAC,CACH,CAAC;IAEF,qCAAqC;IACrC,GAAG,CAAC,KAAK,CACP,UAAU,EACV,UAAU,CAAC;QACT,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;QACrC,SAAS,EAAE,UAAU;KACtB,CAAC,CACH,CAAC;IAEF,2DAA2D;IAC3D,0EAA0E;IAC1E,0EAA0E;IAC1E,qBAAqB;IACrB,MAAM,kBAAkB,GACtB,IAAI,CAAC,kBAAkB,IAAI,gCAAgC,EAAE,CAAC;IAChE,MAAM,0BAA0B,GAC9B,IAAI,CAAC,0BAA0B;QAC/B,wCAAwC,EAAE,CAAC;IAC7C,MAAM,mBAAmB,GACvB,IAAI,CAAC,mBAAmB,IAAI,IAAI,mBAAmB,EAAE,CAAC;IACxD,MAAM,YAAY,GAAG;QACnB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,eAAe,EAAE,kBAAkB;QACnC,uBAAuB,EAAE,0BAA0B;QACnD,gBAAgB,EAAE,IAAI,CAAC,mBAAmB;QAC1C,gBAAgB,EAAE,mBAAmB;KACtC,CAAC;IAEF,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,cAAc,CAAC,YAAY,CAAC,CAAC,CAAC;IAC7C,GAAG,CAAC,KAAK,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,YAAY,CAAC,CAAC,CAAC;IACrE,GAAG,CAAC,KAAK,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAC;IAC/D,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,uBAAuB,CAAC,YAAY,CAAC,CAAC,CAAC;IAEzD,sEAAsE;IACtE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,GAAG,CAAC,KAAK,CACP,cAAc,EACd,gBAAgB,CAAC;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,qBAAqB,EAAE,CAAC,IAAI,CAAC,SAAS;SACvC,CAAC,CACH,CAAC;QAEF,0EAA0E;QAC1E,8DAA8D;QAC9D,0EAA0E;QAC1E,GAAG,CAAC,KAAK,CACP,cAAc,EACd,gBAAgB,CAAC;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,kBAAkB,EAAE,IAAI,CAAC,WAAW;YACpC,cAAc,EAAE,yBAAyB,EAAE;SAC5C,CAAC,CACH,CAAC;IACJ,CAAC;IAED,kDAAkD;IAClD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,GAAG,CAAC,KAAK,CACP,KAAK,EACL,OAAO,CAAC;YACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,eAAe,EAAE,IAAI,CAAC,cAAc;gBAClC,CAAC,CAAC;oBACE,cAAc,EAAE,IAAI,CAAC,cAAc;oBACnC,MAAM,EAAE,IAAI,CAAC,MAAM;iBACpB;gBACH,CAAC,CAAC,IAAI;SACT,CAAC,CACH,CAAC;QAEF,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,GAAG,CAAC,KAAK,CACP,SAAS,EACT,cAAc,CAAC;gBACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,CAAC,CACH,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,KAAK,CACP,SAAS,EACT,oBAAoB,CAAC;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,eAAe,EAAE,IAAI,CAAC,eAAe;SACtC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,uBAAuB;IACvB,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACrB,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACvC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,IAA6B,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,iBAAiB,CAAC,CAAC;QAC9C,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE;gBACL,IAAI,EAAE,GAAG;gBACT,SAAS,EAAE,gBAAgB;gBAC3B,OAAO,EAAE,uBAAuB;aACjC;SACF,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,eAAe;IACf,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE;QACjB,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE;gBACL,IAAI,EAAE,GAAG;gBACT,SAAS,EAAE,WAAW;gBACtB,OAAO,EAAE,WAAW;aACrB;SACF,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,MAAM,8CAA8C,CAAC;AAW7E,OAAO,EAAE,WAAW,EAAmB,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EACL,mCAAmC,EACnC,+BAA+B,GAGhC,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EACL,2BAA2B,EAC3B,iBAAiB,EACjB,oBAAoB,EACpB,cAAc,EACd,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EACL,mBAAmB,EACnB,gCAAgC,EAChC,wCAAwC,GAGzC,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACzC,OAAO,EACL,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAiB3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAG5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAyHlE,MAAM,UAAU,SAAS,CAAC,IAAa;IACrC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,0EAA0E;IAC1E,yEAAyE;IACzE,gCAAgC;IAChC,MAAM,iBAAiB,GACrB,IAAI,CAAC,iBAAiB,IAAI,+BAA+B,EAAE,CAAC;IAC9D,MAAM,qBAAqB,GACzB,IAAI,CAAC,qBAAqB,IAAI,mCAAmC,EAAE,CAAC;IAEtE,0EAA0E;IAC1E,qEAAqE;IACrE,qDAAqD;IACrD,kEAAkE;IAClE,wEAAwE;IACxE,4EAA4E;IAC5E,0EAA0E;IAC1E,mEAAmE;IACnE,2EAA2E;IAC3E,+BAA+B;IAC/B,MAAM,cAAc,GAAG,uBAAuB,CAAC;QAC7C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IAC/B,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAEjC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,EAAE,CAAC,CAAC;IAE/B,qBAAqB;IACrB,GAAG,CAAC,KAAK,CACP,GAAG,EACH,WAAW,CAAC;QACV,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;KAC9C,CAAC,CACH,CAAC;IAEF,0EAA0E;IAC1E,0EAA0E;IAC1E,sBAAsB;IACtB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,GAAG,CAAC,KAAK,CACP,KAAK,EACL,iBAAiB,CAAC;YAChB,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;YACtB,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YACpB,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY;YACpC,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,mBAAmB;SACnD,CAAC,CACH,CAAC;QACF,GAAG,CAAC,KAAK,CACP,WAAW,EACX,eAAe,CAAC;YACd,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;YACtB,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YACpB,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY;YACpC,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,mBAAmB;YAClD,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa;SACvC,CAAC,CACH,CAAC;QACF,GAAG,CAAC,KAAK,CACP,cAAc,EACd,mBAAmB,CAAC;YAClB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;YAC5B,aAAa,EAAE,KAAK;YACpB,oBAAoB,EAAE,IAAI,CAAC,IAAI,CAAC,oBAAoB;SACrD,CAAC,CACH,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrE,GAAG,CAAC,KAAK,CACP,kBAAkB,EAClB,gBAAgB,CAAC;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU,EAAE,IAAI,CAAC,SAAS;SAC3B,CAAC,CACH,CAAC;IACJ,CAAC;IAED,6CAA6C;IAC7C,GAAG,CAAC,KAAK,CACP,UAAU,EACV,UAAU,CAAC;QACT,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;QACrD,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;QACrC,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,yEAAyE;QACzE,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO;QACrC,mEAAmE;QACnE,mEAAmE;QACnE,iEAAiE;QACjE,mDAAmD;QACnD,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EACR,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,aAAa,EAAE,GAAG;QACxE,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,iBAAiB;QACjB,qBAAqB;QACrB,oEAAoE;QACpE,2CAA2C;QAC3C,aAAa,EAAE,IAAI,CAAC,iBAAiB;YACnC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,CAAC,iBAAiB,EAAE,SAAS,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE;gBAC/D,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC,CAAC;YACN,CAAC,CAAC,SAAS;QACb,4DAA4D;QAC5D,UAAU,EAAE,IAAI,CAAC,iBAAiB;YAChC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,EAAE,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC;YACtE,CAAC,CAAC,SAAS;QACb,SAAS,EAAE,UAAU;KACtB,CAAC,CACH,CAAC;IAEF,sEAAsE;IACtE,GAAG,CAAC,KAAK,CACP,iBAAiB,EACjB,iBAAiB,CAAC;QAChB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,iBAAiB;QACjB,qBAAqB;QACrB,OAAO,EAAE,IAAI,CAAC,iBAAiB,IAAI,IAAI;QACvC,SAAS,EAAE,iBAAiB;KAC7B,CAAC,CACH,CAAC;IAEF,oEAAoE;IACpE,GAAG,CAAC,KAAK,CACP,WAAW,EACX,kBAAkB,CAAC;QACjB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,YAAY,EAAE,iBAAiB;KAChC,CAAC,CACH,CAAC;IAEF,iFAAiF;IACjF,GAAG,CAAC,KAAK,CACP,YAAY,EACZ,YAAY,CAAC;QACX,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,SAAS,EAAE,YAAY;KACxB,CAAC,CACH,CAAC;IAEF,4CAA4C;IAC5C,GAAG,CAAC,KAAK,CACP,iBAAiB,EACjB,gBAAgB,CAAC;QACf,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,SAAS,EAAE,iBAAiB;KAC7B,CAAC,CACH,CAAC;IAEF,qCAAqC;IACrC,GAAG,CAAC,KAAK,CACP,UAAU,EACV,UAAU,CAAC;QACT,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;QACrC,SAAS,EAAE,UAAU;KACtB,CAAC,CACH,CAAC;IAEF,2DAA2D;IAC3D,0EAA0E;IAC1E,0EAA0E;IAC1E,qBAAqB;IACrB,MAAM,kBAAkB,GACtB,IAAI,CAAC,kBAAkB,IAAI,gCAAgC,EAAE,CAAC;IAChE,MAAM,0BAA0B,GAC9B,IAAI,CAAC,0BAA0B;QAC/B,wCAAwC,EAAE,CAAC;IAC7C,MAAM,mBAAmB,GACvB,IAAI,CAAC,mBAAmB,IAAI,IAAI,mBAAmB,EAAE,CAAC;IACxD,MAAM,YAAY,GAAG;QACnB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO;QACrC,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;QACrD,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,eAAe,EAAE,kBAAkB;QACnC,uBAAuB,EAAE,0BAA0B;QACnD,gBAAgB,EAAE,IAAI,CAAC,mBAAmB;QAC1C,gBAAgB,EAAE,mBAAmB;KACtC,CAAC;IAEF,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,cAAc,CAAC,YAAY,CAAC,CAAC,CAAC;IAC7C,GAAG,CAAC,KAAK,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,YAAY,CAAC,CAAC,CAAC;IACrE,GAAG,CAAC,KAAK,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAC;IAC/D,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,uBAAuB,CAAC,YAAY,CAAC,CAAC,CAAC;IACzD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACvE,GAAG,CAAC,KAAK,CACP,mBAAmB,EACnB,kBAAkB,CAAC;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;gBACxB,IAAI,CAAC,IAAI,CAAC,gBAAgB;oBACxB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;gBAClD,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACtC,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBACvB,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC;gBACjC,MAAM,KAAK,GAAG,OAAO,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC5C,MAAM,KAAK,GACT,KAAK,IAAI,OAAO,EAAE,cAAc;oBAC9B,CAAC,CAAC,MAAM,OAAO,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC;oBACxD,CAAC,CAAC,KAAK,CAAC;gBACZ,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC;YACxD,CAAC;SACF,CAAC,CACH,CAAC;QACF,GAAG,CAAC,KAAK,CACP,iBAAiB,EACjB,gBAAgB,CAAC;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE;gBACrC,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBAC5B,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;iBAC/D,CAAC,CAAC;gBACH,OAAO,2BAA2B,CAAC,OAAO,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;YACxE,CAAC;SACF,CAAC,CACH,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,GAAG,CAAC,KAAK,CACP,cAAc,EACd,gBAAgB,CAAC;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,qBAAqB,EAAE,CAAC,IAAI,CAAC,SAAS;SACvC,CAAC,CACH,CAAC;QAEF,0EAA0E;QAC1E,8DAA8D;QAC9D,0EAA0E;QAC1E,GAAG,CAAC,KAAK,CACP,cAAc,EACd,gBAAgB,CAAC;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,kBAAkB,EAAE,IAAI,CAAC,WAAW;YACpC,cAAc,EAAE,yBAAyB,EAAE;SAC5C,CAAC,CACH,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,qDAAqD;IACrD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,GAAG,CAAC,KAAK,CACP,KAAK,EACL,OAAO,CAAC;YACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,eAAe,EAAE,IAAI,CAAC,cAAc;gBAClC,CAAC,CAAC;oBACE,cAAc,EAAE,IAAI,CAAC,cAAc;oBACnC,MAAM,EAAE,IAAI,CAAC,MAAM;iBACpB;gBACH,CAAC,CAAC,IAAI;SACT,CAAC,CACH,CAAC;QAEF,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,GAAG,CAAC,KAAK,CACP,SAAS,EACT,cAAc,CAAC;gBACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,CAAC,CACH,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,KAAK,CACP,SAAS,EACT,oBAAoB,CAAC;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,YAAY,EAAE,IAAI,CAAC,kBAAkB;SACtC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,uBAAuB;IACvB,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACrB,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACvC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,IAA6B,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,iBAAiB,CAAC,CAAC;QAC9C,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE;gBACL,IAAI,EAAE,GAAG;gBACT,SAAS,EAAE,gBAAgB;gBAC3B,OAAO,EAAE,uBAAuB;aACjC;SACF,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,eAAe;IACf,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE;QACjB,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE;gBACL,IAAI,EAAE,GAAG;gBACT,SAAS,EAAE,WAAW;gBACtB,OAAO,EAAE,WAAW;aACrB;SACF,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/bootstrap.d.ts

@@ -1,4 +1,5 @@
 import type { ServerConfig } from "@opendatalabs/personal-server-ts-core/schemas";
+import type { PersonalServerReadFulfillmentReporter } from "@opendatalabs/personal-server-ts-core/api";
 import { type Logger } from "./logger/index.js";
 import { type IndexManager } from "./storage/index-manager.js";
 import type { GatewayClient } from "@opendatalabs/vana-sdk/node";
@@ -6,8 +7,11 @@ import type { AccessLogReader } from "@opendatalabs/personal-server-ts-core/logg
 import type { ServerAccount } from "@opendatalabs/personal-server-ts-core/keys";
 import type { ServerSigner } from "@opendatalabs/personal-server-ts-core/signing";
 import { type SyncManager } from "@opendatalabs/personal-server-ts-core/sync";
+import type { DataPointFeedPort } from "@opendatalabs/personal-server-ts-core/ports";
 import type { Hono } from "hono";
 import { TunnelManager } from "./tunnel/index.js";
+import { type InferenceProvider } from "@opendatalabs/personal-server-ts-core/derivatives";
+import { type JobWorkerDeps } from "./jobs/worker.js";
 export interface ServerContext {
     app: Hono;
     logger: Logger;
@@ -31,11 +35,38 @@ export interface ServerContext {
 }
 export interface CreateServerOptions {
     rootPath?: string;
+    /** Exact owner scopes to hydrate before the first full sync pass. */
+    hydrateScopes?: string[];
+    /**
+     * Inference provider for the derivative compute layer. Defaults to the
+     * OpenAI-compatible client on `config.inference` (env overrides:
+     * INFERENCE_BASE_URL, INFERENCE_MODEL, INFERENCE_API_KEY). Tests inject
+     * a fake.
+     */
+    inferenceProvider?: InferenceProvider;
     /** @deprecated Use rootPath instead. */
     serverDir?: string;
     dataDir?: string;
     ownerSignature?: `0x${string}`;
+    jobResultUpload?: JobWorkerDeps["resultUpload"];
     gatewayClient?: GatewayClient;
+    /**
+     * Deletion-aware gateway feed (`includeDeleted=true` listings + tombstone
+     * lookups). Defaults to a REST feed on `config.gateway.url`; inject with a
+     * mock gateway in tests.
+     */
+    dataPointFeed?: DataPointFeedPort;
+    readFulfillmentReporter?: PersonalServerReadFulfillmentReporter;
+    /**
+     * MCP OAuth approval page URL (or a lazy getter for it). When set, the MCP
+     * OAuth router advertises discovery metadata and redirects authorization
+     * requests to this page for owner approval; when absent, MCP OAuth
+     * endpoints report MCP_OAUTH_NOT_CONFIGURED. Hosts that render their own
+     * approval surface (e.g. the desktop app) pass it here.
+     */
+    mcpOAuthApprovalUrl?: string | (() => string);
+    profile?: "standard" | "enclave";
+    serverAccount?: ServerAccount;
 }
 export declare function createServer(config: ServerConfig, options?: CreateServerOptions): Promise<ServerContext>;
 //# sourceMappingURL=bootstrap.d.ts.map