@opendatalabs/personal-server-ts-server 0.2.0-canary.6e65a3c → 1.0.1

package/dist/routes/auth-device.js

@@ -0,0 +1,581 @@
+/**
+ * Login Flow v2 — Nextcloud-style device login for self-hosted CLI authentication.
+ *
+ * POST /auth/device         — Initiate a login session
+ * GET  /auth/device/poll    — Poll for completion (token= query param)
+ * GET  /auth/device/approve — HTML approval page (session= query param)
+ * POST /auth/device/approve — Approve the session (session= query param)
+ */
+// Load the Hono ContextVariableMap augmentation (auth/authMechanism/etc.) so
+// c.get("authMechanism") is typed in this route's compilation.
+import "../hono-context.js";
+import { randomBytes } from "node:crypto";
+import { Hono } from "hono";
+import { verifyWeb3Signed, } from "@opendatalabs/vana-sdk/node";
+import { approveDeviceSessionContract, createMemoryDeviceSessionStore, DEVICE_POLL_INTERVAL_MS, DEVICE_SESSION_TTL_MS, initiateDeviceSessionContract, pollDeviceSessionContract, provisionDeviceTokenContract, revokeDeviceTokenContract, } from "@opendatalabs/personal-server-ts-core/contracts";
+import { NotOwnerError, ProtocolError, } from "@opendatalabs/personal-server-ts-core/errors";
+import { createWeb3AuthMiddleware, mapSdkAuthError, } from "../middleware/web3-auth.js";
+import { createOwnerCheckMiddleware } from "../middleware/owner-check.js";
+function createInspectableDeviceSessionStore() {
+    const store = createMemoryDeviceSessionStore();
+    const sessionIds = new Set();
+    return {
+        create(input) {
+            const session = store.create(input);
+            sessionIds.add(session.sessionId);
+            return session;
+        },
+        get(sessionId) {
+            return store.get(sessionId);
+        },
+        findByPollToken(pollToken) {
+            return store.findByPollToken(pollToken);
+        },
+        delete(sessionId) {
+            store.delete(sessionId);
+            sessionIds.delete(sessionId);
+        },
+        purgeExpired(now) {
+            store.purgeExpired(now);
+            for (const sessionId of Array.from(sessionIds)) {
+                if (!store.get(sessionId))
+                    sessionIds.delete(sessionId);
+            }
+        },
+        clear() {
+            for (const sessionId of Array.from(sessionIds)) {
+                store.delete(sessionId);
+            }
+            sessionIds.clear();
+        },
+        get size() {
+            return sessionIds.size;
+        },
+        has(sessionId) {
+            return store.get(sessionId) !== undefined;
+        },
+    };
+}
+/** In-memory session store (short-lived device authorization state). */
+const sessions = createInspectableDeviceSessionStore();
+function getRequestOrigin(c) {
+    return new URL(c.req.url).origin;
+}
+function getRequestPath(c) {
+    return new URL(c.req.url).pathname;
+}
+function resolveOrigin(origin) {
+    return typeof origin === "function" ? origin() : origin;
+}
+function isLocalhostRequest(remoteAddr) {
+    if (!remoteAddr)
+        return false;
+    return (remoteAddr === "127.0.0.1" ||
+        remoteAddr === "::1" ||
+        remoteAddr === "localhost" ||
+        remoteAddr.startsWith("127.") ||
+        remoteAddr === "::ffff:127.0.0.1");
+}
+function isLoopbackHost(hostname) {
+    return (hostname === "localhost" ||
+        hostname === "::1" ||
+        hostname === "127.0.0.1" ||
+        hostname.startsWith("127."));
+}
+function isLocalhostOrigin(origin) {
+    try {
+        return isLoopbackHost(new URL(origin).hostname);
+    }
+    catch {
+        return false;
+    }
+}
+function getSocketRemoteAddress(c) {
+    // Access Node.js socket via Hono's env bindings when running on the real server.
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    return c.env?.incoming?.socket?.remoteAddress;
+}
+function usesLocalApprovalChannel(c, deps) {
+    const localApprovalOrigin = resolveOrigin(deps.localApprovalOrigin);
+    if (!localApprovalOrigin) {
+        return false;
+    }
+    return getRequestOrigin(c) === localApprovalOrigin;
+}
+function getApprovalOrigin(c, deps) {
+    const requestOrigin = getRequestOrigin(c);
+    const localApprovalOrigin = resolveOrigin(deps.localApprovalOrigin);
+    if (localApprovalOrigin && isLocalhostOrigin(requestOrigin)) {
+        return localApprovalOrigin;
+    }
+    return requestOrigin;
+}
+async function verifyRemoteOwnerApproval(c, serverOwner) {
+    if (!serverOwner) {
+        return c.json({
+            error: {
+                code: 500,
+                errorCode: "SERVER_NOT_CONFIGURED",
+                message: "Server owner address not configured. Set VANA_MASTER_KEY_SIGNATURE environment variable.",
+            },
+        }, 500);
+    }
+    const authHeader = c.req.header("authorization");
+    if (!authHeader) {
+        return c.json({
+            error: {
+                code: 403,
+                message: "Remote approval requires owner wallet authentication. " +
+                    "Connect the server owner wallet and try again.",
+            },
+        }, 403);
+    }
+    try {
+        const auth = await verifyWeb3Signed({
+            headerValue: authHeader,
+            expectedOrigin: getRequestOrigin(c),
+            expectedMethod: c.req.method,
+            expectedPath: getRequestPath(c),
+            bodyBytes: c.req.method === "GET" || c.req.method === "HEAD"
+                ? undefined
+                : new Uint8Array(await c.req.raw.clone().arrayBuffer()),
+        });
+        if (auth.signer.toLowerCase() !== serverOwner.toLowerCase()) {
+            const err = new NotOwnerError({
+                signer: auth.signer,
+                expected: serverOwner,
+            });
+            return c.json(err.toJSON(), 401);
+        }
+        return auth;
+    }
+    catch (err) {
+        const authError = mapSdkAuthError(err);
+        if (authError)
+            return c.json(authError.toJSON(), authError.code);
+        if (err instanceof ProtocolError) {
+            return c.json(err.toJSON(), err.code);
+        }
+        throw err;
+    }
+}
+export function authDeviceRoutes(deps) {
+    const app = new Hono();
+    const allowInteractiveLogin = deps.allowInteractiveLogin !== false;
+    const web3Auth = createWeb3AuthMiddleware({
+        serverOrigin: deps.serverOrigin,
+        devToken: deps.devToken,
+        accessToken: deps.accessToken,
+        tokenStore: deps.tokenStore,
+        serverOwner: deps.serverOwner,
+    });
+    const ownerCheck = createOwnerCheckMiddleware(deps.serverOwner);
+    if (allowInteractiveLogin) {
+        // POST /  — Initiate login flow (no auth required)
+        app.post("/", (c) => {
+            const sessionId = randomBytes(32).toString("hex");
+            const pollToken = randomBytes(32).toString("hex");
+            const result = initiateDeviceSessionContract({
+                sessionStore: sessions,
+                serverOwner: deps.serverOwner,
+                requestOrigin: getRequestOrigin(c),
+                approvalOrigin: getApprovalOrigin(c, deps),
+                sessionId,
+                pollToken,
+                now: Date.now(),
+            });
+            deps.logger.info({ sessionId }, "Login flow initiated");
+            return c.json(result.body, result.status);
+        });
+        // GET /poll  — Poll for completion
+        app.get("/poll", (c) => {
+            const result = pollDeviceSessionContract({
+                sessionStore: sessions,
+                pollToken: c.req.query("token") ?? null,
+                serverOwner: deps.serverOwner,
+                now: Date.now(),
+            });
+            if (result.status === 200) {
+                const body = result.body;
+                deps.logger.info({ server: body.server }, "Login flow completed — token delivered");
+            }
+            return c.json(result.body, result.status);
+        });
+        // GET /approve  — HTML approval page
+        app.get("/approve", (c) => {
+            sessions.purgeExpired(Date.now());
+            const sessionId = c.req.query("session");
+            if (!sessionId) {
+                return c.html(errorPage("Missing session parameter"), 400);
+            }
+            const session = sessions.get(sessionId);
+            if (!session) {
+                return c.html(errorPage("Session expired or invalid"), 404);
+            }
+            if (session.status === "approved") {
+                return c.html(successPage());
+            }
+            const owner = deps.serverOwner ?? "unknown";
+            const localApprovalShortcutEnabled = usesLocalApprovalChannel(c, deps);
+            return c.html(approvePage(session.requestedServerOrigin, owner, sessionId, localApprovalShortcutEnabled));
+        });
+        // POST /approve  — Approve the session
+        app.post("/approve", async (c) => {
+            sessions.purgeExpired(Date.now());
+            const sessionId = c.req.query("session");
+            if (!sessionId) {
+                return c.json({ error: { code: 400, message: "Missing session parameter" } }, 400);
+            }
+            const session = sessions.get(sessionId);
+            if (!session) {
+                return c.json({ error: { code: 404, message: "Session expired or invalid" } }, 404);
+            }
+            if (session.status === "approved") {
+                return c.json({ status: "already_approved" });
+            }
+            // v1: localhost auto-approve — user is physically at the server.
+            // SECURITY: Use the direct TCP peer address, NOT X-Forwarded-For
+            // or X-Real-IP headers which are trivially spoofable by remote attackers.
+            const remoteAddr = deps.getRemoteAddress?.(c) ?? getSocketRemoteAddress(c);
+            const allowLocalShortcut = usesLocalApprovalChannel(c, deps) &&
+                isLocalhostRequest(remoteAddr);
+            if (!allowLocalShortcut) {
+                const approvalAuth = await verifyRemoteOwnerApproval(c, deps.serverOwner);
+                if (approvalAuth instanceof Response) {
+                    deps.logger.warn({ remoteAddr, sessionId }, "Remote approval rejected");
+                    return approvalAuth;
+                }
+                deps.logger.info({ remoteAddr, sessionId, signer: approvalAuth.signer }, "Remote approval authenticated with owner wallet");
+            }
+            const accessToken = `vana_ps_${randomBytes(32).toString("hex")}`;
+            const result = await approveDeviceSessionContract({
+                sessionStore: sessions,
+                tokenStore: deps.tokenStore,
+                sessionId,
+                serverOwner: deps.serverOwner,
+                accessToken,
+                now: Date.now(),
+            });
+            deps.logger.info({ sessionId }, "Login flow approved — token generated");
+            return c.json(result.body, result.status);
+        });
+    }
+    // POST /token — add a CLI token to the store (control-plane authenticated)
+    app.post("/token", web3Auth, ownerCheck, async (c) => {
+        if (c.get("authMechanism") !== "control-plane-token") {
+            return c.json({
+                error: {
+                    code: 403,
+                    message: "Only control-plane tokens can provision Personal Server session tokens",
+                },
+            }, 403);
+        }
+        let body;
+        try {
+            body = await c.req.json();
+        }
+        catch {
+            return c.json({ error: { code: 400, message: "Request body must be valid JSON" } }, 400);
+        }
+        const result = await provisionDeviceTokenContract({
+            tokenStore: deps.tokenStore,
+            body,
+            now: Date.now(),
+        });
+        if (result.status !== 201) {
+            return c.json(result.body, result.status);
+        }
+        deps.logger.info("CLI token added via POST /token");
+        return c.json(result.body, 201);
+    });
+    // ── Token revocation ──────────────────────────────────────────────
+    // Called by `vana logout` to invalidate the token server-side.
+    app.delete("/token", async (c) => {
+        const authHeader = c.req.header("authorization");
+        const result = await revokeDeviceTokenContract({
+            tokenStore: deps.tokenStore,
+            bearerToken: authHeader?.startsWith("Bearer ")
+                ? authHeader.slice(7)
+                : null,
+        });
+        if (result.status !== 200) {
+            return c.json(result.body, result.status);
+        }
+        deps.logger.info("Token revoked via DELETE /token");
+        return c.json(result.body);
+    });
+    return app;
+}
+// ── HTML pages ──────────────────────────────────────────────────────
+function approvePage(origin, owner, sessionId, localApprovalShortcutEnabled) {
+    return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>Authorize CLI — Personal Server</title>
+  <style>
+    *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
+    body {
+      font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
+      background: #f5f5f5; color: #1a1a1a;
+      display: flex; justify-content: center; align-items: center;
+      min-height: 100vh; padding: 1rem;
+    }
+    .card {
+      background: #fff; border-radius: 12px; padding: 2rem;
+      max-width: 420px; width: 100%;
+      box-shadow: 0 2px 8px rgba(0,0,0,.08);
+    }
+    h1 { font-size: 1.25rem; margin-bottom: 1.5rem; }
+    .info { background: #f8f9fa; border-radius: 8px; padding: 1rem; margin-bottom: 1.5rem; font-size: 0.875rem; }
+    .info dt { color: #666; margin-bottom: 0.25rem; }
+    .info dd { font-family: monospace; word-break: break-all; margin-bottom: 0.75rem; }
+    .info dd:last-child { margin-bottom: 0; }
+    .btn {
+      display: block; width: 100%; padding: 0.75rem 1.5rem;
+      background: #2563eb; color: #fff; border: none; border-radius: 8px;
+      font-size: 1rem; font-weight: 500; cursor: pointer;
+      transition: background 0.15s;
+    }
+    .btn:hover { background: #1d4ed8; }
+    .btn:disabled { background: #94a3b8; cursor: not-allowed; }
+    #status { text-align: center; margin-top: 1rem; font-size: 0.875rem; color: #666; }
+    .hint { margin-top: 1rem; font-size: 0.875rem; color: #666; line-height: 1.5; }
+  </style>
+</head>
+<body>
+  <div class="card">
+    <h1>A CLI tool is requesting access to your Personal Server</h1>
+    <dl class="info">
+      <dt>Server</dt>
+      <dd>${escapeHtml(origin)}</dd>
+      <dt>Owner</dt>
+      <dd>${escapeHtml(owner)}</dd>
+    </dl>
+    <button class="btn" id="approveBtn" onclick="approve()">Approve</button>
+    <div id="status"></div>
+    <p class="hint" id="hint"></p>
+  </div>
+  <script>
+    const SESSION_ID = ${JSON.stringify(sessionId)};
+    const OWNER_ADDRESS = ${JSON.stringify(owner)};
+    const LOCAL_APPROVAL_SHORTCUT_ENABLED = ${JSON.stringify(localApprovalShortcutEnabled)};
+    const EMPTY_BODY_SHA256 =
+      "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";
+
+    function base64urlEncodeUtf8(input) {
+      const bytes = new TextEncoder().encode(input);
+      let binary = "";
+      for (const byte of bytes) binary += String.fromCharCode(byte);
+      return btoa(binary).replace(/\\+/g, "-").replace(/\\//g, "_").replace(/=+$/, "");
+    }
+
+    function utf8ToHex(input) {
+      const bytes = new TextEncoder().encode(input);
+      return (
+        "0x" +
+        Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("")
+      );
+    }
+
+    async function signPersonalMessage(message, address) {
+      const hexMessage = utf8ToHex(message);
+      try {
+        return await window.ethereum.request({
+          method: "personal_sign",
+          params: [hexMessage, address],
+        });
+      } catch (err) {
+        return window.ethereum.request({
+          method: "personal_sign",
+          params: [address, hexMessage],
+        });
+      }
+    }
+
+    async function buildRemoteApprovalHeader() {
+      if (!window.ethereum) {
+        throw new Error("No wallet found in this browser. Open this page in a wallet-enabled browser.");
+      }
+
+      const accounts = await window.ethereum.request({
+        method: "eth_requestAccounts",
+      });
+      const signer = accounts && accounts[0];
+      if (!signer) {
+        throw new Error("No wallet account available.");
+      }
+      if (signer.toLowerCase() !== OWNER_ADDRESS.toLowerCase()) {
+        throw new Error(
+          "Connected wallet does not match the Personal Server owner."
+        );
+      }
+
+      const now = Math.floor(Date.now() / 1000);
+      const payload = {
+        aud: window.location.origin,
+        bodyHash: EMPTY_BODY_SHA256,
+        exp: now + 300,
+        iat: now,
+        method: "POST",
+        uri: window.location.pathname,
+      };
+      const orderedPayload = {};
+      for (const key of Object.keys(payload).sort()) {
+        orderedPayload[key] = payload[key];
+      }
+      const payloadBase64 = base64urlEncodeUtf8(JSON.stringify(orderedPayload));
+      const signature = await signPersonalMessage(payloadBase64, signer);
+      return "Web3Signed " + payloadBase64 + "." + signature;
+    }
+
+    const remoteApproval = !LOCAL_APPROVAL_SHORTCUT_ENABLED;
+    const btn = document.getElementById("approveBtn");
+    const status = document.getElementById("status");
+    const hint = document.getElementById("hint");
+
+    if (remoteApproval) {
+      btn.textContent = "Connect wallet and approve";
+      hint.textContent =
+        "Remote approvals require a signature from the Personal Server owner wallet.";
+    } else {
+      hint.textContent =
+        "This browser is on the same machine as the Personal Server, so approval stays local.";
+    }
+
+    async function approve() {
+      btn.disabled = true;
+      btn.textContent = remoteApproval ? 'Signing...' : 'Authorizing...';
+      status.textContent = "";
+      try {
+        const headers = {};
+        if (remoteApproval) {
+          headers["Authorization"] = await buildRemoteApprovalHeader();
+          btn.textContent = 'Authorizing...';
+        }
+
+        const res = await fetch('/auth/device/approve?session=' + encodeURIComponent(SESSION_ID), {
+          method: 'POST',
+          headers,
+        });
+        if (res.ok) {
+          document.querySelector('.card').innerHTML =
+            '<h1 style="color:#16a34a">Device authorized!</h1>' +
+            '<p style="margin-top:1rem;color:#666">You can close this tab.</p>';
+        } else {
+          const data = await res.json();
+          status.textContent = data.error?.message || 'Authorization failed';
+          status.style.color = '#dc2626';
+          btn.disabled = false;
+          btn.textContent = 'Approve';
+        }
+      } catch (err) {
+        status.textContent = 'Network error — please try again';
+        status.style.color = '#dc2626';
+        btn.disabled = false;
+        btn.textContent = 'Approve';
+      }
+    }
+  </script>
+</body>
+</html>`;
+}
+function successPage() {
+    return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>Authorized — Personal Server</title>
+  <style>
+    body {
+      font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
+      background: #f5f5f5; color: #1a1a1a;
+      display: flex; justify-content: center; align-items: center;
+      min-height: 100vh;
+    }
+    .card {
+      background: #fff; border-radius: 12px; padding: 2rem;
+      max-width: 420px; text-align: center;
+      box-shadow: 0 2px 8px rgba(0,0,0,.08);
+    }
+    h1 { color: #16a34a; font-size: 1.25rem; }
+    p { margin-top: 1rem; color: #666; }
+  </style>
+</head>
+<body>
+  <div class="card">
+    <h1>Device authorized!</h1>
+    <p>You can close this tab.</p>
+  </div>
+</body>
+</html>`;
+}
+function errorPage(message) {
+    return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>Error — Personal Server</title>
+  <style>
+    body {
+      font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
+      background: #f5f5f5; color: #1a1a1a;
+      display: flex; justify-content: center; align-items: center;
+      min-height: 100vh;
+    }
+    .card {
+      background: #fff; border-radius: 12px; padding: 2rem;
+      max-width: 420px; text-align: center;
+      box-shadow: 0 2px 8px rgba(0,0,0,.08);
+    }
+    h1 { color: #dc2626; font-size: 1.25rem; }
+    p { margin-top: 1rem; color: #666; }
+  </style>
+</head>
+<body>
+  <div class="card">
+    <h1>Error</h1>
+    <p>${escapeHtml(message)}</p>
+  </div>
+</body>
+</html>`;
+}
+function escapeHtml(str) {
+    return str
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#39;");
+}
+// Export for testing
+export { sessions, DEVICE_SESSION_TTL_MS as SESSION_TTL_MS, DEVICE_POLL_INTERVAL_MS as POLL_INTERVAL_MS, };
+/**
+ * Read-only adapter exposing the device-flow session map to the standard
+ * RFC 8628 token endpoint (`POST /oauth/token` with
+ * `grant_type=urn:ietf:params:oauth:grant-type:device_code`). The
+ * `pollToken` issued at `POST /auth/device` is the OAuth2 `device_code`.
+ */
+export function createDeviceSessionLookup() {
+    return {
+        findByDeviceCode(deviceCode) {
+            sessions.purgeExpired(Date.now());
+            const session = sessions.findByPollToken(deviceCode);
+            if (!session)
+                return null;
+            return {
+                status: session.status,
+                accessToken: session.accessToken,
+                accessTokenExpiresAt: session.accessTokenExpiresAt,
+                sessionId: session.sessionId,
+            };
+        },
+        consume(sessionId) {
+            sessions.delete(sessionId);
+        },
+    };
+}
+//# sourceMappingURL=auth-device.js.map

package/dist/routes/auth-device.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-device.js","sourceRoot":"","sources":["../../src/routes/auth-device.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,6EAA6E;AAC7E,+DAA+D;AAC/D,OAAO,oBAAoB,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAC;AAE1C,OAAO,EACL,gBAAgB,GAEjB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,4BAA4B,EAC5B,8BAA8B,EAC9B,uBAAuB,EACvB,qBAAqB,EACrB,6BAA6B,EAC7B,yBAAyB,EACzB,4BAA4B,EAC5B,yBAAyB,GAE1B,MAAM,iDAAiD,CAAC;AACzD,OAAO,EACL,aAAa,EACb,aAAa,GACd,MAAM,8CAA8C,CAAC;AAEtD,OAAO,EACL,wBAAwB,EACxB,eAAe,GAChB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAoB1E,SAAS,mCAAmC;IAC1C,MAAM,KAAK,GAAG,8BAA8B,EAAE,CAAC;IAC/C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,OAAO;QACL,MAAM,CAAC,KAAK;YACV,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACpC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAClC,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,GAAG,CAAC,SAAS;YACX,OAAO,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9B,CAAC;QACD,eAAe,CAAC,SAAS;YACvB,OAAO,KAAK,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,CAAC,SAAS;YACd,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACxB,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC/B,CAAC;QACD,YAAY,CAAC,GAAG;YACd,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YACxB,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;oBAAE,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QACD,KAAK;YACH,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/C,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC1B,CAAC;YACD,UAAU,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;QACD,IAAI,IAAI;YACN,OAAO,UAAU,CAAC,IAAI,CAAC;QACzB,CAAC;QACD,GAAG,CAAC,SAAiB;YACnB,OAAO,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC;QAC5C,CAAC;KACF,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,QAAQ,GAAG,mCAAmC,EAAE,CAAC;AAEvD,SAAS,gBAAgB,CAAC,CAAU;IAClC,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;AACnC,CAAC;AAED,SAAS,cAAc,CAAC,CAAU;IAChC,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;AACrC,CAAC;AAED,SAAS,aAAa,CACpB,MAAuD;IAEvD,OAAO,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AAC1D,CAAC;AAED,SAAS,kBAAkB,CAAC,UAA8B;IACxD,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,OAAO,CACL,UAAU,KAAK,WAAW;QAC1B,UAAU,KAAK,KAAK;QACpB,UAAU,KAAK,WAAW;QAC1B,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC;QAC7B,UAAU,KAAK,kBAAkB,CAClC,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO,CACL,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,KAAK;QAClB,QAAQ,KAAK,WAAW;QACxB,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAC5B,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc;IACvC,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,CAAU;IACxC,iFAAiF;IACjF,8DAA8D;IAC9D,OAAQ,CAAC,CAAC,GAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC;AACzD,CAAC;AAED,SAAS,wBAAwB,CAAC,CAAU,EAAE,IAAiB;IAC7D,MAAM,mBAAmB,GAAG,aAAa,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACpE,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,gBAAgB,CAAC,CAAC,CAAC,KAAK,mBAAmB,CAAC;AACrD,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAU,EAAE,IAAiB;IACtD,MAAM,aAAa,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAC1C,MAAM,mBAAmB,GAAG,aAAa,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAEpE,IAAI,mBAAmB,IAAI,iBAAiB,CAAC,aAAa,CAAC,EAAE,CAAC;QAC5D,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IAED,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,CAAU,EACV,WAAsC;IAEtC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE;gBACL,IAAI,EAAE,GAAG;gBACT,SAAS,EAAE,uBAAuB;gBAClC,OAAO,EACL,0FAA0F;aAC7F;SACF,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACjD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE;gBACL,IAAI,EAAE,GAAG;gBACT,OAAO,EACL,wDAAwD;oBACxD,gDAAgD;aACnD;SACF,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC;YAClC,WAAW,EAAE,UAAU;YACvB,cAAc,EAAE,gBAAgB,CAAC,CAAC,CAAC;YACnC,cAAc,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM;YAC5B,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC;YAC/B,SAAS,EACP,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM;gBAC/C,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC;SAC5D,CAAC,CAAC;QAEH,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,WAAW,EAAE,EAAE,CAAC;YAC5D,MAAM,GAAG,GAAG,IAAI,aAAa,CAAC;gBAC5B,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,WAAW;aACtB,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QACnC,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,SAAS;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,IAAW,CAAC,CAAC;QACxE,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YACjC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,IAAiB,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAiB;IAChD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,qBAAqB,GAAG,IAAI,CAAC,qBAAqB,KAAK,KAAK,CAAC;IACnE,MAAM,QAAQ,GAAG,wBAAwB,CAAC;QACxC,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,0BAA0B,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAEhE,IAAI,qBAAqB,EAAE,CAAC;QAC1B,mDAAmD;QACnD,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE;YAClB,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAClD,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAClD,MAAM,MAAM,GAAG,6BAA6B,CAAC;gBAC3C,YAAY,EAAE,QAAQ;gBACtB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,aAAa,EAAE,gBAAgB,CAAC,CAAC,CAAC;gBAClC,cAAc,EAAE,iBAAiB,CAAC,CAAC,EAAE,IAAI,CAAC;gBAC1C,SAAS;gBACT,SAAS;gBACT,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;aAChB,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,sBAAsB,CAAC,CAAC;YACxD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAmB,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;QAEH,mCAAmC;QACnC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACrB,MAAM,MAAM,GAAG,yBAAyB,CAAC;gBACvC,YAAY,EAAE,QAAQ;gBACtB,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI;gBACvC,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;aAChB,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC1B,MAAM,IAAI,GAAG,MAAM,CAAC,IAA2B,CAAC;gBAChD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EACvB,wCAAwC,CACzC,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAqC,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;QAEH,qCAAqC;QACrC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE;YACxB,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAElC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,2BAA2B,CAAC,EAAE,GAAG,CAAC,CAAC;YAC7D,CAAC;YAED,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACxC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,4BAA4B,CAAC,EAAE,GAAG,CAAC,CAAC;YAC9D,CAAC;YAED,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBAClC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAC/B,CAAC;YAED,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,IAAI,SAAS,CAAC;YAC5C,MAAM,4BAA4B,GAAG,wBAAwB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YAEvE,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT,OAAO,CAAC,qBAAqB,EAC7B,KAAK,EACL,SAAS,EACT,4BAA4B,CAC7B,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,uCAAuC;QACvC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC/B,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAElC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,2BAA2B,EAAE,EAAE,EAC9D,GAAG,CACJ,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACxC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,4BAA4B,EAAE,EAAE,EAC/D,GAAG,CACJ,CAAC;YACJ,CAAC;YAED,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBAClC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAChD,CAAC;YAED,iEAAiE;YACjE,iEAAiE;YACjE,0EAA0E;YAC1E,MAAM,UAAU,GACd,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,IAAI,sBAAsB,CAAC,CAAC,CAAC,CAAC;YAC1D,MAAM,kBAAkB,GACtB,wBAAwB,CAAC,CAAC,EAAE,IAAI,CAAC;gBACjC,kBAAkB,CAAC,UAAgC,CAAC,CAAC;YAEvD,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACxB,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAClD,CAAC,EACD,IAAI,CAAC,WAAW,CACjB,CAAC;gBACF,IAAI,YAAY,YAAY,QAAQ,EAAE,CAAC;oBACrC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,EAAE,UAAU,EAAE,SAAS,EAAE,EACzB,0BAA0B,CAC3B,CAAC;oBACF,OAAO,YAAY,CAAC;gBACtB,CAAC;gBAED,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,EACtD,iDAAiD,CAClD,CAAC;YACJ,CAAC;YAED,MAAM,WAAW,GAAG,WAAW,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACjE,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC;gBAChD,YAAY,EAAE,QAAQ;gBACtB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,SAAS;gBACT,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,WAAW;gBACX,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;aAChB,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,uCAAuC,CAAC,CAAC;YACzE,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAA+B,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnD,IAAI,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,qBAAqB,EAAE,CAAC;YACrD,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE;oBACL,IAAI,EAAE,GAAG;oBACT,OAAO,EACL,wEAAwE;iBAC3E;aACF,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,iCAAiC,EAAE,EAAE,EACpE,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC;YAChD,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,IAAI;YACJ,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;SAChB,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1B,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAa,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACpD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,+DAA+D;IAE/D,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/B,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC;YAC7C,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,WAAW,EAAE,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC;gBAC5C,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;gBACrB,CAAC,CAAC,IAAI;SACT,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1B,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAa,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACpD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,uEAAuE;AAEvE,SAAS,WAAW,CAClB,MAAc,EACd,KAAa,EACb,SAAiB,EACjB,4BAAqC;IAErC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAyCG,UAAU,CAAC,MAAM,CAAC;;YAElB,UAAU,CAAC,KAAK,CAAC;;;;;;;yBAOJ,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;4BACtB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;8CACH,IAAI,CAAC,SAAS,CAAC,4BAA4B,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAuHlF,CAAC;AACT,CAAC;AAED,SAAS,WAAW;IAClB,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA4BD,CAAC;AACT,CAAC;AAED,SAAS,SAAS,CAAC,OAAe;IAChC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;SAyBA,UAAU,CAAC,OAAO,CAAC;;;QAGpB,CAAC;AACT,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,GAAG;SACP,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,qBAAqB;AACrB,OAAO,EACL,QAAQ,EACR,qBAAqB,IAAI,cAAc,EACvC,uBAAuB,IAAI,gBAAgB,GAC5C,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB;IACvC,OAAO;QACL,gBAAgB,CAAC,UAAkB;YACjC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;YACrD,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAC1B,OAAO;gBACL,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;gBAClD,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,SAAiB;YACvB,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/routes/data.d.ts

@@ -1,9 +1,13 @@
 import { Hono } from "hono";
+import { type PersonalServerApiDispatchOptions, type PersonalServerReadFulfillmentReporter } from "@opendatalabs/personal-server-ts-core/api";
 import type { HierarchyManagerOptions } from "@opendatalabs/personal-server-ts-core/storage/hierarchy";
 import type { IndexManager } from "@opendatalabs/personal-server-ts-core/storage/index";
-import type { GatewayClient } from "@opendatalabs/personal-server-ts-core/gateway";
+import type { DataPortabilityGatewayConfig, GatewayClient } from "@opendatalabs/vana-sdk/node";
 import type { AccessLogWriter } from "@opendatalabs/personal-server-ts-core/logging/access-log";
 import type { SyncManager } from "@opendatalabs/personal-server-ts-core/sync";
+import type { DataStoragePort, RuntimeAvailabilityPort } from "@opendatalabs/personal-server-ts-core/ports";
+import type { ServerSigner } from "@opendatalabs/personal-server-ts-core/signing";
+import type { TokenStore } from "../token-store.js";
 import type { Logger } from "pino";
 export interface DataRouteDeps {
     indexManager: IndexManager;
@@ -12,9 +16,46 @@ export interface DataRouteDeps {
     serverOrigin: string | (() => string);
     serverOwner?: `0x${string}`;
     gateway: GatewayClient;
+    /**
+     * Required for the X402 flow on GET /v1/data/:scope. Provides the EIP-712
+     * domain (escrowPaymentDomain + dataRegistryDomain) the server uses to
+     * recover X-PAYMENT signatures and the embedded accessRecord signatures.
+     */
+    gatewayConfig?: DataPortabilityGatewayConfig;
+    /**
+     * Gateway base URL. Used by the X402 forward path — the handler `fetch`es
+     * POST /v1/escrow/pay directly so it can inspect the gateway's structured
+     * error body (the SDK's gateway.payForOperation discards it).
+     */
+    gatewayUrl?: string;
+    /**
+     * When true, GET /v1/data/:scope enforces the X402 challenge / X-PAYMENT
+     * cycle on every read. Off-by-default so dev / test setups don't require
+     * builder-side payment signing.
+     */
+    paymentEnabled?: boolean;
     accessLogWriter: AccessLogWriter;
+    readFulfillmentReporter?: PersonalServerReadFulfillmentReporter;
     syncManager?: SyncManager | null;
     devToken?: string;
+    accessToken?: string;
+    tokenStore?: TokenStore;
+    dataStorage?: DataStoragePort;
+    runtimeAvailability?: RuntimeAvailabilityPort;
+    /**
+     * Powers the RECORD_DATA_ACCESS attestation embedded in 402 challenges.
+     * When supplied alongside serverOwner + paymentEnabled, every challenge
+     * carries a server-signed accessRecord. Required for the on-chain
+     * recordDataAccess to be scheduled by gateway.settle later.
+     */
+    serverSigner?: ServerSigner;
+    /**
+     * Personal server's own EOA address. Needed by the X402 verifier so it
+     * can confirm that the accessRecord echoed back in X-PAYMENT was signed
+     * by this server (not forged by a malicious builder).
+     */
+    serverAddress?: `0x${string}`;
+    mountPath?: PersonalServerApiDispatchOptions["basePath"];
 }
 export declare function dataRoutes(deps: DataRouteDeps): Hono;
 //# sourceMappingURL=data.d.ts.map

package/dist/routes/data.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"data.d.ts","sourceRoot":"","sources":["../../src/routes/data.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAS5B,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yDAAyD,CAAC;AACvG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACxF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+CAA+C,CAAC;AACnF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAChG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4CAA4C,CAAC;AAC9E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAWnC,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,YAAY,CAAC;IAC3B,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,OAAO,EAAE,aAAa,CAAC;IACvB,eAAe,EAAE,eAAe,CAAC;IACjC,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI,CAoRpD"}
+{"version":3,"file":"data.d.ts","sourceRoot":"","sources":["../../src/routes/data.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAEL,KAAK,gCAAgC,EACrC,KAAK,qCAAqC,EAC3C,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yDAAyD,CAAC;AACvG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACxF,OAAO,KAAK,EACV,4BAA4B,EAC5B,aAAa,EACd,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAChG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4CAA4C,CAAC;AAC9E,OAAO,KAAK,EACV,eAAe,EACf,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+CAA+C,CAAC;AAClF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAQnC,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,YAAY,CAAC;IAC3B,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,OAAO,EAAE,aAAa,CAAC;IACvB;;;;OAIG;IACH,aAAa,CAAC,EAAE,4BAA4B,CAAC;IAC7C;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,eAAe,EAAE,eAAe,CAAC;IACjC,uBAAuB,CAAC,EAAE,qCAAqC,CAAC;IAChE,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;IAC9C;;;;;OAKG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B;;;;OAIG;IACH,aAAa,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC9B,SAAS,CAAC,EAAE,gCAAgC,CAAC,UAAU,CAAC,CAAC;CAC1D;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI,CAmDpD"}