@opendatalabs/personal-server-ts-server 0.0.1-canary.e9e40b0 → 0.0.1-canary.ee2f3fb

package/dist/api-auth.d.ts

@@ -0,0 +1,31 @@
+import { type SessionTokenVerifierPort } from "@opendatalabs/personal-server-ts-core/auth";
+import type { PersonalServerApiAuthPort } from "@opendatalabs/personal-server-ts-core/api";
+import { type WriteProofReplayStore, type WriteSessionStore } from "@opendatalabs/personal-server-ts-core/write";
+import type { DataStoragePort, RuntimeAvailabilityPort } from "@opendatalabs/personal-server-ts-core/ports";
+import type { GatewayClient } from "@opendatalabs/vana-sdk/node";
+export interface ServerApiAuthDeps {
+    serverOrigin: string | (() => string);
+    serverOwner?: `0x${string}`;
+    gateway: GatewayClient;
+    devToken?: string;
+    accessToken?: string;
+    tokenStore?: SessionTokenVerifierPort;
+    dataStorage?: Pick<DataStoragePort, "findEntry">;
+    runtimeAvailability?: RuntimeAvailabilityPort;
+    /**
+     * Write API sessions. When present, POST /v1/data/:scope accepts a bearer
+     * write-session token (minted by POST /v1/write/session) and authorizes the
+     * write as the session's builder via verifyDataWritePolicy + the
+     * X-Vana-Write-Signature attribution proof. Absent = owner-only ingest,
+     * exactly as before.
+     */
+    writeSessionStore?: WriteSessionStore;
+    /**
+     * Replay guard for per-write proofs (X-Vana-Write-Signature). Defaults to
+     * an in-memory store so replay protection is always on when write sessions
+     * are enabled; hosts may supply a shared store.
+     */
+    writeProofReplayStore?: WriteProofReplayStore;
+}
+export declare function createServerApiAuth(deps: ServerApiAuthDeps): PersonalServerApiAuthPort;
+//# sourceMappingURL=api-auth.d.ts.map

package/dist/api-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-auth.d.ts","sourceRoot":"","sources":["../src/api-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,4CAA4C,CAAC;AACpD,OAAO,KAAK,EACV,yBAAyB,EAG1B,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACvB,MAAM,6CAA6C,CAAC;AAMrD,OAAO,KAAK,EACV,eAAe,EACf,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEjE,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,OAAO,EAAE,aAAa,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,wBAAwB,CAAC;IACtC,WAAW,CAAC,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IACjD,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;IAC9C;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;CAC/C;AA6CD,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,iBAAiB,GACtB,yBAAyB,CAiI3B"}

package/dist/api-auth.js

@@ -0,0 +1,148 @@
+import { authenticateRequest, } from "@opendatalabs/personal-server-ts-core/auth";
+import { verifyDataReadPolicy } from "@opendatalabs/personal-server-ts-core/policy";
+import { createInMemoryWriteProofReplayStore, createWriteSessionAuthorization, } from "@opendatalabs/personal-server-ts-core/write";
+import { NotOwnerError, ProtocolError, UnregisteredBuilderError, } from "@opendatalabs/personal-server-ts-core/errors";
+function serverNotConfigured() {
+    return new ProtocolError(500, "SERVER_NOT_CONFIGURED", "Server owner address not configured. Set VANA_MASTER_KEY_SIGNATURE environment variable.");
+}
+function isOwner(signer, serverOwner) {
+    return Boolean(serverOwner && signer.toLowerCase() === serverOwner.toLowerCase());
+}
+async function authenticate(request, deps) {
+    return authenticateRequest({
+        request,
+        serverOrigin: deps.serverOrigin,
+        devToken: deps.devToken,
+        accessToken: deps.accessToken,
+        sessionTokenVerifier: deps.tokenStore,
+        serverOwner: deps.serverOwner,
+    });
+}
+async function assertRegisteredBuilder(gateway, signer) {
+    // vana-sdk 3.14.0's GatewayClient always exposes isRegisteredBuilder, so the
+    // legacy getBuilder feature-detect fallback is now unreachable (its else
+    // branch narrows the client to `never`). Query registration directly, matching
+    // middleware/builder-check.ts.
+    if (await gateway.isRegisteredBuilder(signer))
+        return;
+    throw new UnregisteredBuilderError();
+}
+export function createServerApiAuth(deps) {
+    const writeProofReplayStore = deps.writeProofReplayStore ?? createInMemoryWriteProofReplayStore();
+    // The write-session half of this port is protocol, not runtime: the browser
+    // build's adapters call the same factory, so a delegated write is checked
+    // identically wherever the Personal Server runs.
+    const writeSessions = createWriteSessionAuthorization({
+        serverOrigin: deps.serverOrigin,
+        serverOwner: deps.serverOwner,
+        sessionStore: deps.writeSessionStore,
+        replayStore: writeProofReplayStore,
+        policyPorts: {
+            authSessionVerifier: deps.gateway,
+            grantVerifier: deps.gateway,
+            runtimeAvailability: deps.runtimeAvailability,
+            // Fee seam intentionally not wired: builder writes are free in the
+            // demo slice (write fee mechanics undecided).
+        },
+    });
+    async function authorizeOwner(request) {
+        const result = await authenticate(request, deps);
+        if (result.isPolicyBypass)
+            return;
+        if (!deps.serverOwner)
+            throw serverNotConfigured();
+        if (!isOwner(result.auth.signer, deps.serverOwner)) {
+            throw new NotOwnerError({
+                signer: result.auth.signer,
+                expected: deps.serverOwner,
+            });
+        }
+    }
+    /**
+     * Delegated ingest. A bearer token that resolves to a live write session
+     * authorizes as the session builder: the write policy re-runs against the
+     * LIVE grant (revocation / expiry / scope coverage stay authoritative per
+     * write), and the builder's X-Vana-Write-Signature payload proof is
+     * verified and returned for the handler to store with the record. Any
+     * other credential (owner Web3Signed, dev token, control-plane token,
+     * unknown bearer) falls through to the owner path unchanged.
+     */
+    async function authorizeWrite(input) {
+        const delegated = await writeSessions.authorizeSessionWrite(input);
+        if (delegated)
+            return delegated;
+        await authorizeOwner(input.request);
+    }
+    /**
+     * Identity-only recognition of a write-session caller: the bearer must
+     * resolve to a live session and the request must carry that builder's
+     * valid proof, but NO grant policy runs (there is no scope to run it
+     * against). Callers use it only to choose between error shapes, never to
+     * release data, so a revoked or narrowed grant getting a 404 instead of a
+     * 401 discloses nothing. Returns undefined for any other credential.
+     */
+    async function authorizeWriteSession(request) {
+        return writeSessions.recognizeWriteSession(request);
+    }
+    return {
+        authorizeOwner,
+        authorizeWrite,
+        authorizeWriteSession,
+        async authorizeBuilderList(request) {
+            const result = await authenticate(request, deps);
+            if (result.isPolicyBypass ||
+                isOwner(result.auth.signer, deps.serverOwner)) {
+                return;
+            }
+            await assertRegisteredBuilder(deps.gateway, result.auth.signer);
+        },
+        async authorizeBuilderRead(input) {
+            const result = await authenticate(input.request, deps);
+            if (result.isPolicyBypass) {
+                return { builder: result.auth.signer, grantId: "policy-bypass" };
+            }
+            // Owner-exempt read paths. We allow two mechanisms here:
+            //   - web3-signed: per-request signature by the owner wallet. Already
+            //     gated on a fresh cryptographic proof per request.
+            //   - control-plane-token: a static bearer set by the parent host
+            //     process at boot. Never crosses an interactive surface, so it
+            //     has the same threat model as the host process itself.
+            // Intentionally NOT exempted:
+            //   - cli-session-token: an interactive bearer issued via /auth/device.
+            //     These flow through terminals / copy-paste / shell history, so we
+            //     keep them on the grant path so that any leaked CLI session can
+            //     still only read what an explicit grant authorizes.
+            // Defense-in-depth justification: any owner-identified credential can
+            // already mint a grant via authorizeOwner, so blocking owner reads in
+            // general does not meaningfully shrink the blast radius of a stolen
+            // token. The cli-session-token exception preserves the audit-log
+            // signal for the one credential class that's most prone to leakage.
+            if (isOwner(result.auth.signer, deps.serverOwner) &&
+                (result.mechanism === "web3-signed" ||
+                    result.mechanism === "control-plane-token")) {
+                return { builder: result.auth.signer, grantId: "owner" };
+            }
+            // Fail closed: a builder grant read can't be authorized if we can't
+            // identify this server's owner to bind the grant to.
+            if (!deps.serverOwner)
+                throw serverNotConfigured();
+            const selectedEntry = deps.dataStorage?.findEntry({
+                scope: input.scope,
+                fileId: input.fileId,
+            });
+            const grant = await verifyDataReadPolicy({
+                signer: result.auth.signer,
+                grantId: result.auth.payload.grantId ?? input.grantId,
+                requestedScope: input.scope,
+                fileId: input.fileId ?? selectedEntry?.fileId ?? undefined,
+                serverOwner: deps.serverOwner,
+            }, {
+                authSessionVerifier: deps.gateway,
+                grantVerifier: deps.gateway,
+                runtimeAvailability: deps.runtimeAvailability,
+            });
+            return { builder: result.auth.signer, grantId: grant.id };
+        },
+    };
+}
+//# sourceMappingURL=api-auth.js.map

package/dist/api-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-auth.js","sourceRoot":"","sources":["../src/api-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,GAGpB,MAAM,4CAA4C,CAAC;AAMpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8CAA8C,CAAC;AACpF,OAAO,EACL,mCAAmC,EACnC,+BAA+B,GAGhC,MAAM,6CAA6C,CAAC;AACrD,OAAO,EACL,aAAa,EACb,aAAa,EACb,wBAAwB,GACzB,MAAM,8CAA8C,CAAC;AAgCtD,SAAS,mBAAmB;IAC1B,OAAO,IAAI,aAAa,CACtB,GAAG,EACH,uBAAuB,EACvB,0FAA0F,CAC3F,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CACd,MAAc,EACd,WAAsC;IAEtC,OAAO,OAAO,CACZ,WAAW,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,WAAW,EAAE,CAClE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,OAAgB,EAChB,IAAuB;IAEvB,OAAO,mBAAmB,CAAC;QACzB,OAAO;QACP,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,oBAAoB,EAAE,IAAI,CAAC,UAAU;QACrC,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,OAAsB,EACtB,MAAqB;IAErB,6EAA6E;IAC7E,yEAAyE;IACzE,+EAA+E;IAC/E,+BAA+B;IAC/B,IAAI,MAAM,OAAO,CAAC,mBAAmB,CAAC,MAAM,CAAC;QAAE,OAAO;IACtD,MAAM,IAAI,wBAAwB,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,IAAuB;IAEvB,MAAM,qBAAqB,GACzB,IAAI,CAAC,qBAAqB,IAAI,mCAAmC,EAAE,CAAC;IACtE,4EAA4E;IAC5E,0EAA0E;IAC1E,iDAAiD;IACjD,MAAM,aAAa,GAAG,+BAA+B,CAAC;QACpD,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,YAAY,EAAE,IAAI,CAAC,iBAAiB;QACpC,WAAW,EAAE,qBAAqB;QAClC,WAAW,EAAE;YACX,mBAAmB,EAAE,IAAI,CAAC,OAAO;YACjC,aAAa,EAAE,IAAI,CAAC,OAAO;YAC3B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,mEAAmE;YACnE,8CAA8C;SAC/C;KACF,CAAC,CAAC;IAEH,KAAK,UAAU,cAAc,CAAC,OAAgB;QAC5C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,MAAM,CAAC,cAAc;YAAE,OAAO;QAClC,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,MAAM,mBAAmB,EAAE,CAAC;QACnD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,aAAa,CAAC;gBACtB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;gBAC1B,QAAQ,EAAE,IAAI,CAAC,WAAW;aAC3B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,UAAU,cAAc,CAAC,KAAmC;QAC/D,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACnE,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC;QAChC,MAAM,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,UAAU,qBAAqB,CAAC,OAAgB;QACnD,OAAO,aAAa,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACtD,CAAC;IAED,OAAO;QACL,cAAc;QACd,cAAc;QACd,qBAAqB;QAErB,KAAK,CAAC,oBAAoB,CAAC,OAAO;YAChC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACjD,IACE,MAAM,CAAC,cAAc;gBACrB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,EAC7C,CAAC;gBACD,OAAO;YACT,CAAC;YACD,MAAM,uBAAuB,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClE,CAAC;QAED,KAAK,CAAC,oBAAoB,CAAC,KAAkC;YAC3D,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACvD,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;gBAC1B,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;YACnE,CAAC;YACD,yDAAyD;YACzD,sEAAsE;YACtE,wDAAwD;YACxD,kEAAkE;YAClE,mEAAmE;YACnE,4DAA4D;YAC5D,8BAA8B;YAC9B,wEAAwE;YACxE,uEAAuE;YACvE,qEAAqE;YACrE,yDAAyD;YACzD,sEAAsE;YACtE,sEAAsE;YACtE,oEAAoE;YACpE,iEAAiE;YACjE,oEAAoE;YACpE,IACE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC;gBAC7C,CAAC,MAAM,CAAC,SAAS,KAAK,aAAa;oBACjC,MAAM,CAAC,SAAS,KAAK,qBAAqB,CAAC,EAC7C,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;YAC3D,CAAC;YAED,oEAAoE;YACpE,qDAAqD;YACrD,IAAI,CAAC,IAAI,CAAC,WAAW;gBAAE,MAAM,mBAAmB,EAAE,CAAC;YAEnD,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC;gBAChD,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,oBAAoB,CACtC;gBACE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;gBAC1B,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO;gBACrD,cAAc,EAAE,KAAK,CAAC,KAAK;gBAC3B,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,aAAa,EAAE,MAAM,IAAI,SAAS;gBAC1D,WAAW,EAAE,IAAI,CAAC,WAAW;aAC9B,EACD;gBACE,mBAAmB,EAAE,IAAI,CAAC,OAAO;gBACjC,aAAa,EAAE,IAAI,CAAC,OAAO;gBAC3B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;aAC9C,CACF,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QAC5D,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/api.d.ts

@@ -1,2 +1,6 @@
 export { createServer, type CreateServerOptions, type ServerContext, } from "./bootstrap.js";
+export { startPersonalServer, type StartPersonalServerNodeOptions, } from "./client.js";
+export type { PersonalServerHandle, PersonalServerClientErrorBody, PersonalServerDataVersion, PersonalServerHealthRegistration, PersonalServerIdentity, PersonalServerInfo, PersonalServerAuthRequestOptions, PersonalServerListDataOptions, PersonalServerListDataResult, PersonalServerListVersionsOptions, PersonalServerListVersionsResult, PersonalServerReadDataOptions, PersonalServerRegistrationRequest, PersonalServerStatus, PersonalServerSyncTriggerResult, PersonalServerUrls, } from "@opendatalabs/personal-server-ts-core/client";
+export { PersonalServerClientError, dataListPath, dataReadPath, dataVersionsPath, parsePersonalServerJsonResponse, } from "@opendatalabs/personal-server-ts-core/client";
+export { DEFAULT_ROOT_PATH, DEFAULT_CONFIG_PATH, DEFAULT_DATA_DIR, DEFAULT_SERVER_DIR, DEFAULT_VANA_DIR, expandHomePath, loadConfig, resolveRootPath, type LoadConfigOptions, } from "./config/index.js";
 //# sourceMappingURL=api.d.ts.map

package/dist/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,KAAK,mBAAmB,EACxB,KAAK,aAAa,GACnB,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,KAAK,mBAAmB,EACxB,KAAK,aAAa,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,KAAK,8BAA8B,GACpC,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,oBAAoB,EACpB,6BAA6B,EAC7B,yBAAyB,EACzB,gCAAgC,EAChC,sBAAsB,EACtB,kBAAkB,EAClB,gCAAgC,EAChC,6BAA6B,EAC7B,4BAA4B,EAC5B,iCAAiC,EACjC,gCAAgC,EAChC,6BAA6B,EAC7B,iCAAiC,EACjC,oBAAoB,EACpB,+BAA+B,EAC/B,kBAAkB,GACnB,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,yBAAyB,EACzB,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,+BAA+B,GAChC,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,UAAU,EACV,eAAe,EACf,KAAK,iBAAiB,GACvB,MAAM,mBAAmB,CAAC"}

package/dist/api.js

@@ -1,2 +1,5 @@
 export { createServer, } from "./bootstrap.js";
+export { startPersonalServer, } from "./client.js";
+export { PersonalServerClientError, dataListPath, dataReadPath, dataVersionsPath, parsePersonalServerJsonResponse, } from "@opendatalabs/personal-server-ts-core/client";
+export { DEFAULT_ROOT_PATH, DEFAULT_CONFIG_PATH, DEFAULT_DATA_DIR, DEFAULT_SERVER_DIR, DEFAULT_VANA_DIR, expandHomePath, loadConfig, resolveRootPath, } from "./config/index.js";
 //# sourceMappingURL=api.js.map

package/dist/api.js.map

@@ -1 +1 @@
-{"version":3,"file":"api.js","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,GAGb,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,GAGb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,mBAAmB,GAEpB,MAAM,aAAa,CAAC;AAmBrB,OAAO,EACL,yBAAyB,EACzB,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,+BAA+B,GAChC,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,UAAU,EACV,eAAe,GAEhB,MAAM,mBAAmB,CAAC"}

package/dist/app.d.ts

@@ -5,12 +5,19 @@ import type { DataPortabilityGatewayConfig, GatewayClient } from "@opendatalabs/
 import type { ServerConfig } from "@opendatalabs/personal-server-ts-core/schemas";
 import type { AccessLogWriter } from "@opendatalabs/personal-server-ts-core/logging/access-log";
 import type { AccessLogReader } from "@opendatalabs/personal-server-ts-core/logging/access-reader";
+import type { PersonalServerReadFulfillmentReporter } from "@opendatalabs/personal-server-ts-core/api";
 import { type HealthDeps } from "./routes/health.js";
-import type { SyncManager } from "@opendatalabs/personal-server-ts-core/sync";
+import { type WriteProofReplayStore, type WriteSessionStore } from "@opendatalabs/personal-server-ts-core/write";
+import { McpActivityRecorder, type McpConnectionStore, type McpOAuthAuthorizationStore } from "@opendatalabs/personal-server-ts-core/mcp";
+import type { ScopeDeletionTracker, SyncManager } from "@opendatalabs/personal-server-ts-core/sync";
 import type { ServerSigner } from "@opendatalabs/personal-server-ts-core/signing";
-import type { DataStoragePort, FeeVerifierPort, RuntimeAvailabilityPort } from "@opendatalabs/personal-server-ts-core/ports";
+import type { LineageGatewayPort } from "@opendatalabs/personal-server-ts-core/lineage";
+import type { QuestionStore, RecomputeScheduler } from "@opendatalabs/personal-server-ts-core/derivatives";
+import type { DataStoragePort, RuntimeAvailabilityPort } from "@opendatalabs/personal-server-ts-core/ports";
 import type { TokenStore } from "./token-store.js";
 import type { Logger } from "pino";
+import type { JobRequestEnvelope } from "@opendatalabs/vana-sdk/protocol/jobs";
+import type { JobExecuteResponse } from "./jobs/types.js";
 export interface IdentityInfo {
     address: `0x${string}`;
     publicKey: `0x${string}`;
@@ -33,19 +40,79 @@ export interface AppDeps {
     config?: ServerConfig;
     accessLogWriter: AccessLogWriter;
     accessLogReader: AccessLogReader;
+    readFulfillmentReporter?: PersonalServerReadFulfillmentReporter;
     cloudMode?: boolean;
     devToken?: string;
+    /**
+     * Port of the loopback-only auth listener. The dev UI subtree is served
+     * only to connections that arrived on it (never via the tunnel).
+     */
+    localApprovalPort?: number;
+    /** Main server port; a loopback-port collision disables the dev UI. */
+    serverPort?: number;
     ownerSignature?: `0x${string}`;
     ownerPrivateKey?: `0x${string}`;
     accessToken?: string;
     configPath?: string;
     syncManager?: SyncManager | null;
+    /** Read-side tombstone memory; reads of a deleted scope answer 410. */
+    scopeDeletions?: ScopeDeletionTracker;
     serverSigner?: ServerSigner;
     tokenStore?: TokenStore;
-    feeVerifier?: FeeVerifierPort;
     runtimeAvailability?: RuntimeAvailabilityPort;
     dataStorage?: DataStoragePort;
+    /**
+     * Gateway base URL — wired into the data route so the GET handler can
+     * forward validated X-PAYMENTs to POST /v1/escrow/pay via direct fetch.
+     */
+    gatewayUrl?: string;
+    /**
+     * When true, GET /v1/data/:scope enforces X402 payment on every read.
+     * Off-by-default to keep dev / test setups frictionless.
+     */
+    paymentEnabled?: boolean;
+    /** Derivative data: gateway lineage access for the data routes. */
+    lineageGateway?: LineageGatewayPort;
+    /**
+     * Derivative compute layer (docs/derivative-data-api.md, "Compute").
+     * Absent = /v1/derivatives answers 503 and writes trigger no recompute.
+     */
+    derivativeCompute?: {
+        store: QuestionStore;
+        scheduler: RecomputeScheduler;
+    } | null;
     getTunnelStatus?: HealthDeps["getTunnelStatus"];
+    /**
+     * Invoked when the /ui/api registration route confirms the server is
+     * registered with the gateway (fresh or pre-existing), so a
+     * registration-gated tunnel can start immediately instead of waiting for
+     * the bootstrap's gateway poll (BUI-611).
+     */
+    onServerRegistered?: (serverId: string | null) => void;
+    /**
+     * MCP connection store shared between the `/mcp/:token` Streamable HTTP
+     * endpoint and the owner `/v1/mcp/connections` management surface. Defaults
+     * to an in-memory store so the routes are wired up out of the box; pass an
+     * IndexedDB-backed (or persistent) store for production.
+     */
+    mcpConnectionStore?: McpConnectionStore;
+    mcpOAuthAuthorizationStore?: McpOAuthAuthorizationStore;
+    mcpOAuthApprovalUrl?: string | (() => string);
+    mcpActivityRecorder?: McpActivityRecorder;
+    mcpHydrateScopes?: (scopes: string[]) => Promise<void>;
+    /**
+     * Write API session store shared between POST /v1/write/session (which
+     * mints tokens) and the ingest endpoint (which redeems them). Defaults to
+     * an in-memory store, mirroring the MCP connection store default.
+     */
+    writeSessionStore?: WriteSessionStore;
+    /**
+     * Replay guard for per-write proofs on delegated ingest. Defaults to an
+     * in-memory store (api-auth); hosts may supply a shared one.
+     */
+    writeProofReplayStore?: WriteProofReplayStore;
+    profile?: "standard" | "enclave";
+    jobWorker?: (envelope: JobRequestEnvelope) => Promise<JobExecuteResponse>;
 }
 export declare function createApp(deps: AppDeps): Hono;
 //# sourceMappingURL=app.d.ts.map

package/dist/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACxF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yDAAyD,CAAC;AACvG,OAAO,KAAK,EACV,4BAA4B,EAC5B,aAAa,EACd,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+CAA+C,CAAC;AAClF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAChG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAe,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAalE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4CAA4C,CAAC;AAC9E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+CAA+C,CAAC;AAClF,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EACf,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAEnC,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,KAAK,MAAM,EAAE,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,YAAY,EAAE,YAAY,CAAC;IAC3B,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,mBAAmB,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;IAC1D,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,OAAO,EAAE,aAAa,CAAC;IACvB,aAAa,CAAC,EAAE,4BAA4B,GAAG;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAChE,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,eAAe,EAAE,eAAe,CAAC;IACjC,eAAe,EAAE,eAAe,CAAC;IACjC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC/B,eAAe,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACjC,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;IAC9C,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,eAAe,CAAC,EAAE,UAAU,CAAC,iBAAiB,CAAC,CAAC;CACjD;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CA6L7C"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACxF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yDAAyD,CAAC;AACvG,OAAO,KAAK,EACV,4BAA4B,EAC5B,aAAa,EACd,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+CAA+C,CAAC;AAClF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAChG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,2CAA2C,CAAC;AACvG,OAAO,EAAe,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAKlE,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACvB,MAAM,6CAA6C,CAAC;AAcrD,OAAO,EACL,mBAAmB,EAGnB,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,EAChC,MAAM,2CAA2C,CAAC;AASnD,OAAO,KAAK,EACV,oBAAoB,EACpB,WAAW,EACZ,MAAM,4CAA4C,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+CAA+C,CAAC;AAClF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,+CAA+C,CAAC;AACxF,OAAO,KAAK,EACV,aAAa,EACb,kBAAkB,EACnB,MAAM,mDAAmD,CAAC;AAC3D,OAAO,KAAK,EACV,eAAe,EACf,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAEnC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC/E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAE1D,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,KAAK,MAAM,EAAE,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,YAAY,EAAE,YAAY,CAAC;IAC3B,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,mBAAmB,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;IAC1D,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,OAAO,EAAE,aAAa,CAAC;IACvB,aAAa,CAAC,EAAE,4BAA4B,GAAG;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAChE,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,eAAe,EAAE,eAAe,CAAC;IACjC,eAAe,EAAE,eAAe,CAAC;IACjC,uBAAuB,CAAC,EAAE,qCAAqC,CAAC;IAChE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC/B,eAAe,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACjC,uEAAuE;IACvE,cAAc,CAAC,EAAE,oBAAoB,CAAC;IACtC,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;IAC9C,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,mEAAmE;IACnE,cAAc,CAAC,EAAE,kBAAkB,CAAC;IACpC;;;OAGG;IACH,iBAAiB,CAAC,EAAE;QAClB,KAAK,EAAE,aAAa,CAAC;QACrB,SAAS,EAAE,kBAAkB,CAAC;KAC/B,GAAG,IAAI,CAAC;IACT,eAAe,CAAC,EAAE,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAChD;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IACvD;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,0BAA0B,CAAC,EAAE,0BAA0B,CAAC;IACxD,mBAAmB,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IAC9C,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;OAGG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAC9C,OAAO,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IACjC,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAC3E;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CA6W7C"}

package/dist/app.js

@@ -1,25 +1,49 @@
 import { Hono } from "hono";
-import { cors } from "hono/cors";
 import { ProtocolError } from "@opendatalabs/personal-server-ts-core/errors";
 import { healthRoute } from "./routes/health.js";
+import { corsMiddleware } from "./middleware/cors.js";
+import { requireLoopbackListener } from "./middleware/local-listener.js";
 import { dataRoutes } from "./routes/data.js";
+import { writeSessionRoutes } from "./routes/write-session.js";
+import { createInMemoryWriteProofReplayStore, createInMemoryWriteSessionStore, } from "@opendatalabs/personal-server-ts-core/write";
+import { derivativesRoutes } from "./routes/derivatives.js";
 import { grantsRoutes } from "./routes/grants.js";
 import { accessLogsRoutes } from "./routes/access-logs.js";
 import { syncRoutes } from "./routes/sync.js";
+import { executeMcpConnectionRequest, mcpActivityRoutes, mcpConnectionsRoutes, mcpOAuthRoutes, mcpStreamableHttpRoutes, } from "./routes/mcp.js";
+import { enclaveMcpRoutes } from "./routes/enclave-mcp.js";
+import { enclaveFleetRoutes } from "./routes/enclave-fleet.js";
+import { McpActivityRecorder, createInMemoryMcpConnectionStore, createInMemoryMcpOAuthAuthorizationStore, } from "@opendatalabs/personal-server-ts-core/mcp";
 import { uiConfigRoutes } from "./routes/ui-config.js";
 import { uiRegistrationRoutes } from "./routes/ui-registration.js";
 import { uiRoute } from "./routes/ui.js";
 import { authDeviceRoutes, createDeviceSessionLookup, } from "./routes/auth-device.js";
 import { oauthTokenRoutes } from "./routes/oauth-token.js";
+import { enclaveJobRoutes } from "./routes/enclave-jobs.js";
 export function createApp(deps) {
     const app = new Hono();
-    // CORS — allow all origins for browser-based clients
-    app.use("*", cors({
-        origin: "*",
-        allowHeaders: ["Content-Type", "Authorization"],
-        allowMethods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"],
-        maxAge: 86400,
-    }));
+    // One store for mint (POST /v1/write/session) and redeem (data ingest and
+    // derivative question registration), and one replay guard for the proofs
+    // both redeeming routes verify.
+    const writeSessionStore = deps.writeSessionStore ?? createInMemoryWriteSessionStore();
+    const writeProofReplayStore = deps.writeProofReplayStore ?? createInMemoryWriteProofReplayStore();
+    // CORS — allow all origins for browser-based clients. Registered first so
+    // OPTIONS preflights are answered before any route or auth code runs
+    // (route sub-apps only register their real methods).
+    // Dev UI gate — registered BEFORE the permissive global CORS so a
+    // cross-origin preflight for /ui/* is refused rather than answered with
+    // `Access-Control-Allow-Origin: *`. The whole /ui subtree is served only to
+    // connections on the loopback auth listener: the tunnel forwards the main
+    // server port, so without this gate the page (and the dev token it
+    // carries, which is a full owner/policy bypass) is reachable by anyone who
+    // knows the public tunnel URL.
+    const uiLoopbackOnly = requireLoopbackListener({
+        localApprovalPort: deps.localApprovalPort,
+        serverPort: deps.serverPort,
+    });
+    app.use("/ui", uiLoopbackOnly);
+    app.use("/ui/*", uiLoopbackOnly);
+    app.use("*", corsMiddleware());
     // Mount health route
     app.route("/", healthRoute({
         version: deps.version,
@@ -33,6 +57,12 @@ export function createApp(deps) {
         getTunnelStatus: deps.getTunnelStatus,
         runtimeAvailability: deps.runtimeAvailability,
     }));
+    if (deps.profile === "enclave" && deps.jobWorker && deps.accessToken) {
+        app.route("/enclave/v1/jobs", enclaveJobRoutes({
+            accessToken: deps.accessToken,
+            executeJob: deps.jobWorker,
+        }));
+    }
     // Mount data routes (ingest + read + delete)
     app.route("/v1/data", dataRoutes({
         indexManager: deps.indexManager,
@@ -42,22 +72,79 @@ export function createApp(deps) {
         serverOwner: deps.serverOwner,
         gateway: deps.gateway,
         accessLogWriter: deps.accessLogWriter,
+        readFulfillmentReporter: deps.readFulfillmentReporter,
         devToken: deps.devToken,
+        accessToken: deps.accessToken,
         tokenStore: deps.tokenStore,
         syncManager: deps.syncManager ?? null,
-        feeVerifier: deps.feeVerifier,
+        scopeDeletions: deps.scopeDeletions,
         runtimeAvailability: deps.runtimeAvailability,
         dataStorage: deps.dataStorage,
+        // Powers the RECORD_DATA_ACCESS attestation embedded in X402 challenges.
+        serverSigner: deps.serverSigner,
+        serverAddress: deps.identity?.address,
+        // Required for X402: gatewayConfig provides the EIP-712 domain for
+        // payment signature recovery; gatewayUrl is the forward target for
+        // POST /v1/escrow/pay (direct fetch — bypasses the SDK client to
+        // preserve the gateway's structured error bodies).
+        gatewayConfig: deps.gatewayConfig,
+        gatewayUrl: deps.gatewayUrl ?? deps.config?.gateway.url ?? deps.gatewayConfig?.url,
+        paymentEnabled: deps.paymentEnabled,
+        lineageGateway: deps.lineageGateway,
+        writeSessionStore,
+        writeProofReplayStore,
+        // A new local version of a scope marks every question that reads it
+        // stale; the recompute waits for a reader.
+        onDataWritten: deps.derivativeCompute
+            ? (event) => deps.derivativeCompute?.scheduler.markSourceChanged(event.scope, {
+                lineageSources: event.lineageSources,
+            })
+            : undefined,
+        // And an authorized read of a derived scope is that reader.
+        onDataRead: deps.derivativeCompute
+            ? (event) => deps.derivativeCompute?.scheduler.markDemand(event.scope)
+            : undefined,
+        mountPath: "/v1/data",
+    }));
+    // Derivative compute: question registration + readiness for builders.
+    app.route("/v1/derivatives", derivativesRoutes({
+        logger: deps.logger,
+        serverOrigin: deps.serverOrigin,
+        serverOwner: deps.serverOwner,
+        gateway: deps.gateway,
+        devToken: deps.devToken,
+        accessToken: deps.accessToken,
+        tokenStore: deps.tokenStore,
+        dataStorage: deps.dataStorage,
+        runtimeAvailability: deps.runtimeAvailability,
+        writeSessionStore,
+        writeProofReplayStore,
+        compute: deps.derivativeCompute ?? null,
+        mountPath: "/v1/derivatives",
+    }));
+    // Mount the Write API session handshake (delegated builder writes).
+    app.route("/v1/write", writeSessionRoutes({
+        logger: deps.logger,
+        serverOrigin: deps.serverOrigin,
+        serverOwner: deps.serverOwner,
+        gateway: deps.gateway,
+        devToken: deps.devToken,
+        accessToken: deps.accessToken,
+        tokenStore: deps.tokenStore,
+        sessionStore: writeSessionStore,
     }));
     // Mount grants routes (POST /verify is public, GET / and POST / need owner auth)
     app.route("/v1/grants", grantsRoutes({
         logger: deps.logger,
         gateway: deps.gateway,
+        gatewayConfig: deps.gatewayConfig,
         serverOwner: deps.serverOwner,
         serverOrigin: deps.serverOrigin,
         devToken: deps.devToken,
+        accessToken: deps.accessToken,
         tokenStore: deps.tokenStore,
         serverSigner: deps.serverSigner,
+        mountPath: "/v1/grants",
     }));
     // Mount access-logs routes (all owner auth)
     app.route("/v1/access-logs", accessLogsRoutes({
@@ -65,18 +152,87 @@ export function createApp(deps) {
         accessLogReader: deps.accessLogReader,
         serverOrigin: deps.serverOrigin,
         serverOwner: deps.serverOwner,
+        gateway: deps.gateway,
         devToken: deps.devToken,
+        accessToken: deps.accessToken,
         tokenStore: deps.tokenStore,
+        mountPath: "/v1/access-logs",
     }));
     // Mount sync routes (all owner auth)
     app.route("/v1/sync", syncRoutes({
         logger: deps.logger,
         serverOrigin: deps.serverOrigin,
         serverOwner: deps.serverOwner,
+        gateway: deps.gateway,
         devToken: deps.devToken,
+        accessToken: deps.accessToken,
         tokenStore: deps.tokenStore,
         syncManager: deps.syncManager ?? null,
+        mountPath: "/v1/sync",
     }));
+    // MCP — Phase 1 / 260604-PLAN-vana-mcp-personal-server.md.
+    // Owner endpoints + Claude-facing Streamable HTTP endpoint share a single
+    // connection store so the management API and the data path agree on which
+    // connections exist.
+    const mcpConnectionStore = deps.mcpConnectionStore ?? createInMemoryMcpConnectionStore();
+    const mcpOAuthAuthorizationStore = deps.mcpOAuthAuthorizationStore ??
+        createInMemoryMcpOAuthAuthorizationStore();
+    const mcpActivityRecorder = deps.mcpActivityRecorder ?? new McpActivityRecorder();
+    const mcpRouteDeps = {
+        logger: deps.logger,
+        serverOrigin: deps.serverOrigin,
+        serverOwner: deps.serverOwner,
+        serverAddress: deps.identity?.address,
+        serverSigner: deps.serverSigner,
+        gateway: deps.gateway,
+        gatewayConfig: deps.gatewayConfig,
+        paymentEnabled: deps.paymentEnabled,
+        devToken: deps.devToken,
+        accessToken: deps.accessToken,
+        tokenStore: deps.tokenStore,
+        accessLogWriter: deps.accessLogWriter,
+        readFulfillmentReporter: deps.readFulfillmentReporter,
+        indexManager: deps.indexManager,
+        hierarchyOptions: deps.hierarchyOptions,
+        dataStorage: deps.dataStorage,
+        runtimeAvailability: deps.runtimeAvailability,
+        connectionStore: mcpConnectionStore,
+        oauthAuthorizationStore: mcpOAuthAuthorizationStore,
+        oauthApprovalUrl: deps.mcpOAuthApprovalUrl,
+        activityRecorder: mcpActivityRecorder,
+    };
+    app.route("/", mcpOAuthRoutes(mcpRouteDeps));
+    app.route("/v1/mcp/connections", mcpConnectionsRoutes(mcpRouteDeps));
+    app.route("/v1/mcp/activity", mcpActivityRoutes(mcpRouteDeps));
+    app.route("/mcp", mcpStreamableHttpRoutes(mcpRouteDeps));
+    if (deps.profile === "enclave" && deps.accessToken && deps.serverOwner) {
+        app.route("/enclave/v1/fleet", enclaveFleetRoutes({
+            accessToken: deps.accessToken,
+            hydrate: async (scopes) => {
+                if (!deps.mcpHydrateScopes)
+                    throw new Error("Scoped hydration unavailable");
+                await deps.mcpHydrateScopes(scopes);
+            },
+            observe: async (scope) => {
+                const storage = deps.dataStorage;
+                const entry = storage?.findEntry({ scope });
+                const ready = entry && storage?.hasScopeBlocks
+                    ? await storage.hasScopeBlocks(scope, entry.collectedAt)
+                    : false;
+                return { dataVersion: entry?.version ?? null, ready };
+            },
+        }));
+        app.route("/enclave/v1/mcp", enclaveMcpRoutes({
+            accessToken: deps.accessToken,
+            serverOwner: deps.serverOwner,
+            execute: async (request, connection) => {
+                await deps.mcpHydrateScopes?.([
+                    ...new Set(connection.grants.flatMap((grant) => grant.scopes)),
+                ]);
+                return executeMcpConnectionRequest(request, connection, mcpRouteDeps);
+            },
+        }));
+    }
     // Mount login flow v2 routes (self-hosted CLI auth, no auth required)
     if (deps.tokenStore) {
         app.route("/auth/device", authDeviceRoutes({
@@ -99,7 +255,8 @@ export function createApp(deps) {
             deviceSessions: createDeviceSessionLookup(),
         }));
     }
-    // Mount dev UI routes when dev token is available
+    // Mount dev UI routes when dev token is available. The /ui subtree is
+    // already gated to the loopback auth listener above.
     if (deps.devToken) {
         app.route("/ui", uiRoute({
             devToken: deps.devToken,
@@ -119,6 +276,7 @@ export function createApp(deps) {
         app.route("/ui/api", uiRegistrationRoutes({
             devToken: deps.devToken,
             ownerPrivateKey: deps.ownerPrivateKey,
+            onRegistered: deps.onServerRegistered,
         }));
     }
     // Global error handler

package/dist/app.js.map

@@ -1 +1 @@
-{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,8CAA8C,CAAC;AAU7E,OAAO,EAAE,WAAW,EAAmB,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACzC,OAAO,EACL,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AA+C3D,MAAM,UAAU,SAAS,CAAC,IAAa;IACrC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,qDAAqD;IACrD,GAAG,CAAC,GAAG,CACL,GAAG,EACH,IAAI,CAAC;QACH,MAAM,EAAE,GAAG;QACX,YAAY,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC;QAC/C,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC;QACzD,MAAM,EAAE,KAAK;KACd,CAAC,CACH,CAAC;IAEF,qBAAqB;IACrB,GAAG,CAAC,KAAK,CACP,GAAG,EACH,WAAW,CAAC;QACV,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;KAC9C,CAAC,CACH,CAAC;IAEF,6CAA6C;IAC7C,GAAG,CAAC,KAAK,CACP,UAAU,EACV,UAAU,CAAC;QACT,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;QACrC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC,CACH,CAAC;IAEF,iFAAiF;IACjF,GAAG,CAAC,KAAK,CACP,YAAY,EACZ,YAAY,CAAC;QACX,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,YAAY,EAAE,IAAI,CAAC,YAAY;KAChC,CAAC,CACH,CAAC;IAEF,4CAA4C;IAC5C,GAAG,CAAC,KAAK,CACP,iBAAiB,EACjB,gBAAgB,CAAC;QACf,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC,CACH,CAAC;IAEF,qCAAqC;IACrC,GAAG,CAAC,KAAK,CACP,UAAU,EACV,UAAU,CAAC;QACT,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;KACtC,CAAC,CACH,CAAC;IAEF,sEAAsE;IACtE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,GAAG,CAAC,KAAK,CACP,cAAc,EACd,gBAAgB,CAAC;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,qBAAqB,EAAE,CAAC,IAAI,CAAC,SAAS;SACvC,CAAC,CACH,CAAC;QAEF,0EAA0E;QAC1E,8DAA8D;QAC9D,0EAA0E;QAC1E,GAAG,CAAC,KAAK,CACP,cAAc,EACd,gBAAgB,CAAC;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,kBAAkB,EAAE,IAAI,CAAC,WAAW;YACpC,cAAc,EAAE,yBAAyB,EAAE;SAC5C,CAAC,CACH,CAAC;IACJ,CAAC;IAED,kDAAkD;IAClD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,GAAG,CAAC,KAAK,CACP,KAAK,EACL,OAAO,CAAC;YACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,eAAe,EAAE,IAAI,CAAC,cAAc;gBAClC,CAAC,CAAC;oBACE,cAAc,EAAE,IAAI,CAAC,cAAc;oBACnC,MAAM,EAAE,IAAI,CAAC,MAAM;iBACpB;gBACH,CAAC,CAAC,IAAI;SACT,CAAC,CACH,CAAC;QAEF,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,GAAG,CAAC,KAAK,CACP,SAAS,EACT,cAAc,CAAC;gBACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,CAAC,CACH,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,KAAK,CACP,SAAS,EACT,oBAAoB,CAAC;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,eAAe,EAAE,IAAI,CAAC,eAAe;SACtC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,uBAAuB;IACvB,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACrB,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACvC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,IAA6B,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,iBAAiB,CAAC,CAAC;QAC9C,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE;gBACL,IAAI,EAAE,GAAG;gBACT,SAAS,EAAE,gBAAgB;gBAC3B,OAAO,EAAE,uBAAuB;aACjC;SACF,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,eAAe;IACf,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE;QACjB,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE;gBACL,IAAI,EAAE,GAAG;gBACT,SAAS,EAAE,WAAW;gBACtB,OAAO,EAAE,WAAW;aACrB;SACF,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,MAAM,8CAA8C,CAAC;AAW7E,OAAO,EAAE,WAAW,EAAmB,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EACL,mCAAmC,EACnC,+BAA+B,GAGhC,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EACL,2BAA2B,EAC3B,iBAAiB,EACjB,oBAAoB,EACpB,cAAc,EACd,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EACL,mBAAmB,EACnB,gCAAgC,EAChC,wCAAwC,GAGzC,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACzC,OAAO,EACL,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAiB3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAoG5D,MAAM,UAAU,SAAS,CAAC,IAAa;IACrC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,0EAA0E;IAC1E,yEAAyE;IACzE,gCAAgC;IAChC,MAAM,iBAAiB,GACrB,IAAI,CAAC,iBAAiB,IAAI,+BAA+B,EAAE,CAAC;IAC9D,MAAM,qBAAqB,GACzB,IAAI,CAAC,qBAAqB,IAAI,mCAAmC,EAAE,CAAC;IAEtE,0EAA0E;IAC1E,qEAAqE;IACrE,qDAAqD;IACrD,kEAAkE;IAClE,wEAAwE;IACxE,4EAA4E;IAC5E,0EAA0E;IAC1E,mEAAmE;IACnE,2EAA2E;IAC3E,+BAA+B;IAC/B,MAAM,cAAc,GAAG,uBAAuB,CAAC;QAC7C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IAC/B,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAEjC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,EAAE,CAAC,CAAC;IAE/B,qBAAqB;IACrB,GAAG,CAAC,KAAK,CACP,GAAG,EACH,WAAW,CAAC;QACV,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;KAC9C,CAAC,CACH,CAAC;IAEF,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrE,GAAG,CAAC,KAAK,CACP,kBAAkB,EAClB,gBAAgB,CAAC;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU,EAAE,IAAI,CAAC,SAAS;SAC3B,CAAC,CACH,CAAC;IACJ,CAAC;IAED,6CAA6C;IAC7C,GAAG,CAAC,KAAK,CACP,UAAU,EACV,UAAU,CAAC;QACT,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;QACrD,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;QACrC,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,yEAAyE;QACzE,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO;QACrC,mEAAmE;QACnE,mEAAmE;QACnE,iEAAiE;QACjE,mDAAmD;QACnD,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EACR,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,aAAa,EAAE,GAAG;QACxE,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,iBAAiB;QACjB,qBAAqB;QACrB,oEAAoE;QACpE,2CAA2C;QAC3C,aAAa,EAAE,IAAI,CAAC,iBAAiB;YACnC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,CAAC,iBAAiB,EAAE,SAAS,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE;gBAC/D,cAAc,EAAE,KAAK,CAAC,cAAc;aACrC,CAAC;YACN,CAAC,CAAC,SAAS;QACb,4DAA4D;QAC5D,UAAU,EAAE,IAAI,CAAC,iBAAiB;YAChC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,EAAE,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC;YACtE,CAAC,CAAC,SAAS;QACb,SAAS,EAAE,UAAU;KACtB,CAAC,CACH,CAAC;IAEF,sEAAsE;IACtE,GAAG,CAAC,KAAK,CACP,iBAAiB,EACjB,iBAAiB,CAAC;QAChB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,iBAAiB;QACjB,qBAAqB;QACrB,OAAO,EAAE,IAAI,CAAC,iBAAiB,IAAI,IAAI;QACvC,SAAS,EAAE,iBAAiB;KAC7B,CAAC,CACH,CAAC;IAEF,oEAAoE;IACpE,GAAG,CAAC,KAAK,CACP,WAAW,EACX,kBAAkB,CAAC;QACjB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,YAAY,EAAE,iBAAiB;KAChC,CAAC,CACH,CAAC;IAEF,iFAAiF;IACjF,GAAG,CAAC,KAAK,CACP,YAAY,EACZ,YAAY,CAAC;QACX,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,SAAS,EAAE,YAAY;KACxB,CAAC,CACH,CAAC;IAEF,4CAA4C;IAC5C,GAAG,CAAC,KAAK,CACP,iBAAiB,EACjB,gBAAgB,CAAC;QACf,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,SAAS,EAAE,iBAAiB;KAC7B,CAAC,CACH,CAAC;IAEF,qCAAqC;IACrC,GAAG,CAAC,KAAK,CACP,UAAU,EACV,UAAU,CAAC;QACT,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;QACrC,SAAS,EAAE,UAAU;KACtB,CAAC,CACH,CAAC;IAEF,2DAA2D;IAC3D,0EAA0E;IAC1E,0EAA0E;IAC1E,qBAAqB;IACrB,MAAM,kBAAkB,GACtB,IAAI,CAAC,kBAAkB,IAAI,gCAAgC,EAAE,CAAC;IAChE,MAAM,0BAA0B,GAC9B,IAAI,CAAC,0BAA0B;QAC/B,wCAAwC,EAAE,CAAC;IAC7C,MAAM,mBAAmB,GACvB,IAAI,CAAC,mBAAmB,IAAI,IAAI,mBAAmB,EAAE,CAAC;IACxD,MAAM,YAAY,GAAG;QACnB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO;QACrC,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;QACrD,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,eAAe,EAAE,kBAAkB;QACnC,uBAAuB,EAAE,0BAA0B;QACnD,gBAAgB,EAAE,IAAI,CAAC,mBAAmB;QAC1C,gBAAgB,EAAE,mBAAmB;KACtC,CAAC;IAEF,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,cAAc,CAAC,YAAY,CAAC,CAAC,CAAC;IAC7C,GAAG,CAAC,KAAK,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,YAAY,CAAC,CAAC,CAAC;IACrE,GAAG,CAAC,KAAK,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAC;IAC/D,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,uBAAuB,CAAC,YAAY,CAAC,CAAC,CAAC;IACzD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACvE,GAAG,CAAC,KAAK,CACP,mBAAmB,EACnB,kBAAkB,CAAC;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;gBACxB,IAAI,CAAC,IAAI,CAAC,gBAAgB;oBACxB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;gBAClD,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACtC,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBACvB,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC;gBACjC,MAAM,KAAK,GAAG,OAAO,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC5C,MAAM,KAAK,GACT,KAAK,IAAI,OAAO,EAAE,cAAc;oBAC9B,CAAC,CAAC,MAAM,OAAO,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC;oBACxD,CAAC,CAAC,KAAK,CAAC;gBACZ,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC;YACxD,CAAC;SACF,CAAC,CACH,CAAC;QACF,GAAG,CAAC,KAAK,CACP,iBAAiB,EACjB,gBAAgB,CAAC;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE;gBACrC,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBAC5B,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;iBAC/D,CAAC,CAAC;gBACH,OAAO,2BAA2B,CAAC,OAAO,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;YACxE,CAAC;SACF,CAAC,CACH,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,GAAG,CAAC,KAAK,CACP,cAAc,EACd,gBAAgB,CAAC;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,qBAAqB,EAAE,CAAC,IAAI,CAAC,SAAS;SACvC,CAAC,CACH,CAAC;QAEF,0EAA0E;QAC1E,8DAA8D;QAC9D,0EAA0E;QAC1E,GAAG,CAAC,KAAK,CACP,cAAc,EACd,gBAAgB,CAAC;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,kBAAkB,EAAE,IAAI,CAAC,WAAW;YACpC,cAAc,EAAE,yBAAyB,EAAE;SAC5C,CAAC,CACH,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,qDAAqD;IACrD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,GAAG,CAAC,KAAK,CACP,KAAK,EACL,OAAO,CAAC;YACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,eAAe,EAAE,IAAI,CAAC,cAAc;gBAClC,CAAC,CAAC;oBACE,cAAc,EAAE,IAAI,CAAC,cAAc;oBACnC,MAAM,EAAE,IAAI,CAAC,MAAM;iBACpB;gBACH,CAAC,CAAC,IAAI;SACT,CAAC,CACH,CAAC;QAEF,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,GAAG,CAAC,KAAK,CACP,SAAS,EACT,cAAc,CAAC;gBACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,CAAC,CACH,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,KAAK,CACP,SAAS,EACT,oBAAoB,CAAC;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,YAAY,EAAE,IAAI,CAAC,kBAAkB;SACtC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,uBAAuB;IACvB,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACrB,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACvC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,IAA6B,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,iBAAiB,CAAC,CAAC;QAC9C,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE;gBACL,IAAI,EAAE,GAAG;gBACT,SAAS,EAAE,gBAAgB;gBAC3B,OAAO,EAAE,uBAAuB;aACjC;SACF,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,eAAe;IACf,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE;QACjB,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE;gBACL,IAAI,EAAE,GAAG;gBACT,SAAS,EAAE,WAAW;gBACtB,OAAO,EAAE,WAAW;aACrB;SACF,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}