@opendatalabs/personal-server-ts-server 1.33.7 → 1.34.0

package/dist/__fixtures__/cg-pdpp-client/pdpp-types.d.ts

@@ -0,0 +1,135 @@
+/**
+ * PDPP Core §8 (Resource Server Interface) request/response types.
+ *
+ * Cited against `PDP-Connect/pdpp` `apps/site/content/docs/spec-core.md`
+ * section 8 (`#resource-server-interface`) as of 2026-09-17. This module is
+ * intentionally the *only* place that names PDPP wire shapes for the Client
+ * role — do not redeclare `PdppRecord`/`PdppListRecordsResponse`/etc. inline
+ * at a call site.
+ *
+ * PS's actual §8 endpoints have not landed yet (no PR in
+ * vana-com/personal-server-ts implements them as of this writing; see
+ * `local/conformance-fleet-0917/scope-lanes.md` Lane B/C in the pdpp repo).
+ * These types are derived directly from the spec text, not from PS's
+ * implementation — per that same plan's warning against reverse-engineering
+ * a vendor's behavior instead of the normative document.
+ */
+/** Spec §8 "Errors": every non-2xx response has this envelope. */
+export interface PdppErrorBody {
+    error: {
+        type: PdppErrorType;
+        code: PdppErrorCode;
+        message: string;
+        param?: string;
+        request_id?: string;
+    };
+}
+export type PdppErrorType = "invalid_request_error" | "authentication_error" | "permission_error" | "not_found_error" | "gone_error" | "rate_limit_error" | "api_error";
+/** Spec §8 error table, `#errors`. */
+export type PdppErrorCode = "invalid_cursor" | "invalid_request" | "invalid_record" | "invalid_record_identity" | "invalid_expand" | "unknown_field" | "unsupported_version" | "authentication_error" | "field_not_granted" | "insufficient_scope" | "grant_stream_not_allowed" | "grant_time_range_exceeded" | "grant_expired" | "grant_revoked" | "grant_invalid" | "blob_not_found" | "not_found" | "cursor_expired" | "rate_limit_exceeded" | "api_error";
+export interface PdppFreshness {
+    captured_at: string | null;
+    status: "current" | "stale" | "unknown";
+    last_attempted_at: string | null;
+}
+/** Spec §8 "List streams". */
+export interface PdppStreamListItem {
+    object: "stream";
+    name: string;
+    record_count: number;
+    last_updated: string;
+    freshness?: PdppFreshness;
+}
+export interface PdppListStreamsResponse {
+    object: "list";
+    data: PdppStreamListItem[];
+}
+/** Spec §8 "Get stream metadata". Not grant-projected. */
+export interface PdppStreamMetadata {
+    object: "stream_metadata";
+    name: string;
+    schema: Record<string, unknown>;
+    primary_key: string[];
+    cursor_field: string;
+    consent_time_field: string;
+    selection: {
+        fields: boolean;
+        resources: boolean;
+    };
+    query?: {
+        range_filters?: Record<string, Array<"gte" | "gt" | "lte" | "lt">>;
+        expand?: Array<{
+            name: string;
+            default_limit: number;
+            max_limit: number;
+        }>;
+    };
+    freshness?: PdppFreshness;
+    views?: Array<{
+        id: string;
+        label: string;
+        fields: string[];
+    }>;
+    relationships?: Array<{
+        name: string;
+        stream: string;
+        foreign_key: string;
+        cardinality: "has_one" | "has_many";
+    }>;
+}
+/** Spec §4 "The RECORD envelope" / §8 list-records response item. */
+export interface PdppRecord {
+    object: "record";
+    id: string;
+    stream: string;
+    data: Record<string, unknown>;
+    emitted_at: string;
+    expanded?: Record<string, PdppRecord[] | PdppRecord>;
+}
+/** Spec §4 "Tombstones": present in `changes_since` responses for deletions. */
+export interface PdppTombstone {
+    object: "tombstone";
+    id: string;
+    stream: string;
+    deleted_at: string;
+}
+/** Spec §8 "Non-fatal warnings", `meta.warnings[]`. */
+export interface PdppWarning {
+    code: string;
+    message: string;
+}
+/** Spec §8 "List records" query parameters — the durable v0.1 base surface. */
+export interface PdppListRecordsParams {
+    limit?: number;
+    cursor?: string;
+    order?: "asc" | "desc";
+    /** `filter[{field}]` and `filter[{field}][gte|gt|lte|lt]`, keyed by field name. */
+    filter?: Record<string, string | Partial<Record<"gte" | "gt" | "lte" | "lt", string>>>;
+    view?: string;
+    fields?: string[];
+    expand?: string[];
+    expand_limit?: Record<string, number>;
+    /** Opaque incremental-sync token — a distinct token space from `cursor`. */
+    changes_since?: string;
+}
+export interface PdppListRecordsResponse {
+    object: "list";
+    url: string;
+    has_more: boolean;
+    next_cursor?: string;
+    /** Present only on the terminal page of a `changes_since` request. */
+    next_changes_since?: string;
+    freshness?: PdppFreshness;
+    data: Array<PdppRecord | PdppTombstone>;
+    meta?: {
+        warnings?: PdppWarning[];
+    };
+}
+export interface PdppGetRecordParams {
+    expand?: string[];
+}
+/** Spec §8 API versioning: request/response header name and stable value used by this client. */
+export declare const PDPP_VERSION_HEADER = "PDPP-Version";
+export declare const PDPP_VERSION = "2026-04-06";
+export declare const PDPP_REQUEST_ID_HEADER = "Request-Id";
+//# sourceMappingURL=pdpp-types.d.ts.map

package/dist/__fixtures__/cg-pdpp-client/pdpp-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pdpp-types.d.ts","sourceRoot":"","sources":["../../../src/__fixtures__/cg-pdpp-client/pdpp-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE;QACL,IAAI,EAAE,aAAa,CAAC;QACpB,IAAI,EAAE,aAAa,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAED,MAAM,MAAM,aAAa,GACrB,uBAAuB,GACvB,sBAAsB,GACtB,kBAAkB,GAClB,iBAAiB,GACjB,YAAY,GACZ,kBAAkB,GAClB,WAAW,CAAC;AAEhB,sCAAsC;AACtC,MAAM,MAAM,aAAa,GACrB,gBAAgB,GAChB,iBAAiB,GACjB,gBAAgB,GAChB,yBAAyB,GACzB,gBAAgB,GAChB,eAAe,GACf,qBAAqB,GACrB,sBAAsB,GACtB,mBAAmB,GACnB,oBAAoB,GACpB,0BAA0B,GAC1B,2BAA2B,GAC3B,eAAe,GACf,eAAe,GACf,eAAe,GACf,gBAAgB,GAChB,WAAW,GACX,gBAAgB,GAChB,qBAAqB,GACrB,WAAW,CAAC;AAEhB,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;IACxC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,8BAA8B;AAC9B,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,QAAQ,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,kBAAkB,EAAE,CAAC;CAC5B;AAED,0DAA0D;AAC1D,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;IACnD,KAAK,CAAC,EAAE;QACN,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC;QACnE,MAAM,CAAC,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,aAAa,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAC5E,CAAC;IACF,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IAC/D,aAAa,CAAC,EAAE,KAAK,CAAC;QACpB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,SAAS,GAAG,UAAU,CAAC;KACrC,CAAC,CAAC;CACJ;AAED,qEAAqE;AACrE,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,QAAQ,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,UAAU,CAAC,CAAC;CACtD;AAED,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,WAAW,CAAC;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,uDAAuD;AACvD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,+EAA+E;AAC/E,MAAM,WAAW,qBAAqB;IACpC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACvB,mFAAmF;IACnF,MAAM,CAAC,EAAE,MAAM,CACb,MAAM,EACN,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC,CAC9D,CAAC;IACF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,4EAA4E;IAC5E,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,IAAI,EAAE,KAAK,CAAC,UAAU,GAAG,aAAa,CAAC,CAAC;IACxC,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,WAAW,EAAE,CAAA;KAAE,CAAC;CACrC;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,iGAAiG;AACjG,eAAO,MAAM,mBAAmB,iBAAiB,CAAC;AAClD,eAAO,MAAM,YAAY,eAAe,CAAC;AACzC,eAAO,MAAM,sBAAsB,eAAe,CAAC"}

package/dist/__fixtures__/cg-pdpp-client/pdpp-types.js

@@ -0,0 +1,21 @@
+/**
+ * PDPP Core §8 (Resource Server Interface) request/response types.
+ *
+ * Cited against `PDP-Connect/pdpp` `apps/site/content/docs/spec-core.md`
+ * section 8 (`#resource-server-interface`) as of 2026-09-17. This module is
+ * intentionally the *only* place that names PDPP wire shapes for the Client
+ * role — do not redeclare `PdppRecord`/`PdppListRecordsResponse`/etc. inline
+ * at a call site.
+ *
+ * PS's actual §8 endpoints have not landed yet (no PR in
+ * vana-com/personal-server-ts implements them as of this writing; see
+ * `local/conformance-fleet-0917/scope-lanes.md` Lane B/C in the pdpp repo).
+ * These types are derived directly from the spec text, not from PS's
+ * implementation — per that same plan's warning against reverse-engineering
+ * a vendor's behavior instead of the normative document.
+ */
+/** Spec §8 API versioning: request/response header name and stable value used by this client. */
+export const PDPP_VERSION_HEADER = "PDPP-Version";
+export const PDPP_VERSION = "2026-04-06";
+export const PDPP_REQUEST_ID_HEADER = "Request-Id";
+//# sourceMappingURL=pdpp-types.js.map

package/dist/__fixtures__/cg-pdpp-client/pdpp-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pdpp-types.js","sourceRoot":"","sources":["../../../src/__fixtures__/cg-pdpp-client/pdpp-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAkJH,iGAAiG;AACjG,MAAM,CAAC,MAAM,mBAAmB,GAAG,cAAc,CAAC;AAClD,MAAM,CAAC,MAAM,YAAY,GAAG,YAAY,CAAC;AACzC,MAAM,CAAC,MAAM,sBAAsB,GAAG,YAAY,CAAC"}

package/dist/api-auth.d.ts

@@ -1,7 +1,8 @@
 import { type SessionTokenVerifierPort } from "@opendatalabs/personal-server-ts-core/auth";
-import type { PersonalServerApiAuthPort } from "@opendatalabs/personal-server-ts-core/api";
+import type { PersonalServerApiAuthPort, PersonalServerScopeAuthInput } from "@opendatalabs/personal-server-ts-core/api";
 import { type WriteProofReplayStore, type WriteSessionStore } from "@opendatalabs/personal-server-ts-core/write";
 import type { DataStoragePort, RuntimeAvailabilityPort } from "@opendatalabs/personal-server-ts-core/ports";
+import type { PdppAuthorizationService } from "@opendatalabs/personal-server-ts-core/ports/pdpp-auth";
 import type { GatewayClient } from "@opendatalabs/vana-sdk/node";
 export interface ServerApiAuthDeps {
     serverOrigin: string | (() => string);
@@ -26,6 +27,21 @@ export interface ServerApiAuthDeps {
      * are enabled; hosts may supply a shared store.
      */
     writeProofReplayStore?: WriteProofReplayStore;
+    /**
+     * PDPP owner bearer bridge for the legacy reconciler path. When supplied,
+     * POST /v1/data/:scope and GET /v1/data/:scope/versions may accept a PDPP
+     * owner token, but only when the token's live instance scope maps to the
+     * legacy source namespace. It never authorizes DELETE or broad owner reads.
+     */
+    pdppOwnerBearer?: {
+        auth: PdppAuthorizationService;
+        configuredMethods: Map<string, string[]>;
+        ownerSubjectId?: string;
+        instancesForSubject?: (subjectId: string) => string[];
+        instancesForSource?: (subjectId: string, sourceId: string) => string[];
+    };
 }
-export declare function createServerApiAuth(deps: ServerApiAuthDeps): PersonalServerApiAuthPort;
+export declare function createServerApiAuth(deps: ServerApiAuthDeps): PersonalServerApiAuthPort & {
+    authorizeOwnerScope(input: PersonalServerScopeAuthInput): Promise<void>;
+};
 //# sourceMappingURL=api-auth.d.ts.map

package/dist/api-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-auth.d.ts","sourceRoot":"","sources":["../src/api-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,4CAA4C,CAAC;AACpD,OAAO,KAAK,EACV,yBAAyB,EAG1B,MAAM,2CAA2C,CAAC;AAKnD,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACvB,MAAM,6CAA6C,CAAC;AAKrD,OAAO,KAAK,EACV,eAAe,EACf,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEjE,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,OAAO,EAAE,aAAa,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,wBAAwB,CAAC;IACtC,WAAW,CAAC,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IACjD,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;IAC9C;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;CAC/C;AAiCD,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,iBAAiB,GACtB,yBAAyB,CAmJ3B"}
+{"version":3,"file":"api-auth.d.ts","sourceRoot":"","sources":["../src/api-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,4CAA4C,CAAC;AACpD,OAAO,KAAK,EACV,yBAAyB,EAGzB,4BAA4B,EAE7B,MAAM,2CAA2C,CAAC;AAKnD,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACvB,MAAM,6CAA6C,CAAC;AAKrD,OAAO,KAAK,EACV,eAAe,EACf,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EACV,wBAAwB,EAEzB,MAAM,uDAAuD,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEjE,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,OAAO,EAAE,aAAa,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,wBAAwB,CAAC;IACtC,WAAW,CAAC,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IACjD,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;IAC9C;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAC9C;;;;;OAKG;IACH,eAAe,CAAC,EAAE;QAChB,IAAI,EAAE,wBAAwB,CAAC;QAC/B,iBAAiB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACzC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,mBAAmB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;QACtD,kBAAkB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;KACxE,CAAC;CACH;AAoDD,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,iBAAiB,GACtB,yBAAyB,GAAG;IAC7B,mBAAmB,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzE,CAwRA"}

package/dist/api-auth.js

@@ -18,6 +18,19 @@ async function authenticate(request, deps) {
         serverOwner: deps.serverOwner,
     });
 }
+function bearerToken(request) {
+    const header = request.headers.get("authorization");
+    if (!header)
+        return undefined;
+    const match = /^Bearer\s+(.+)$/i.exec(header.trim());
+    return match?.[1]?.trim();
+}
+function legacyNamespace(scope) {
+    return scope.split(".", 1)[0] ?? "";
+}
+function pdppBridgeError(errorCode, message, details) {
+    return new ProtocolError(403, errorCode, message, details);
+}
 export function createServerApiAuth(deps) {
     const writeProofReplayStore = deps.writeProofReplayStore ?? createInMemoryWriteProofReplayStore();
     // The write-session half of this port is protocol, not runtime: the browser
@@ -49,6 +62,70 @@ export function createServerApiAuth(deps) {
             });
         }
     }
+    async function authorizePdppOwnerBearerForScope(input) {
+        if (!deps.pdppOwnerBearer)
+            return false;
+        const token = bearerToken(input.request);
+        if (!token)
+            return false;
+        const context = await deps.pdppOwnerBearer.auth.resolveToken(token);
+        if (!context.active)
+            return false;
+        assertPdppOwnerBearerForScope(context, input.scope, deps);
+        return true;
+    }
+    function assertPdppOwnerBearerForScope(context, scope, authDeps) {
+        const bridge = authDeps.pdppOwnerBearer;
+        if (!bridge)
+            return;
+        if (context.tokenKind !== "owner") {
+            throw pdppBridgeError("PDPP_CLIENT_BEARER_NOT_OWNER", "PDPP client bearer tokens cannot authorize legacy data owner writes");
+        }
+        if (!context.subjectId ||
+            !bridge.ownerSubjectId ||
+            context.subjectId.toLowerCase() !== bridge.ownerSubjectId.toLowerCase()) {
+            throw pdppBridgeError("PDPP_OWNER_BEARER_FOREIGN", "PDPP owner bearer token belongs to a different subject", {
+                subjectId: context.subjectId,
+                expectedSubjectId: bridge.ownerSubjectId,
+            });
+        }
+        if (context.sourceId) {
+            const namespace = legacyNamespace(scope);
+            const configured = bridge.configuredMethods.get(context.sourceId) ?? [];
+            const sourceNamespace = context.sourceId.split("/").filter(Boolean).at(-1) ?? context.sourceId;
+            if (namespace !== sourceNamespace || configured.length !== 1) {
+                throw pdppBridgeError("PDPP_OWNER_BEARER_SCOPE_MISMATCH", "PDPP owner bearer token is not scoped to the requested legacy source namespace", { scope, sourceId: context.sourceId });
+            }
+            if (context.instanceIds) {
+                const liveInstances = new Set(bridge.instancesForSource?.(context.subjectId, context.sourceId) ??
+                    []);
+                if (context.instanceIds.length === 0 ||
+                    context.instanceIds.some((instance) => !liveInstances.has(instance))) {
+                    throw pdppBridgeError("PDPP_OWNER_BEARER_FOREIGN", "PDPP owner bearer token is not scoped to currently available source instances", { sourceId: context.sourceId, instanceIds: context.instanceIds });
+                }
+            }
+            return;
+        }
+        if (!context.instanceIds || context.instanceIds.length !== 1) {
+            throw pdppBridgeError("PDPP_OWNER_BEARER_UNSCOPED_INSTANCE", "PDPP owner bearer token must be scoped to exactly one legacy source instance");
+        }
+        const currentInstances = bridge.instancesForSubject?.(context.subjectId);
+        if (!currentInstances || currentInstances.length === 0) {
+            throw pdppBridgeError("PDPP_OWNER_BEARER_FOREIGN", "PDPP owner bearer token is not scoped to a currently owned instance", { subjectId: context.subjectId });
+        }
+        const current = new Set(currentInstances);
+        const liveInstanceIds = context.instanceIds.filter((instance) => current.has(instance));
+        if (liveInstanceIds.length === 0) {
+            throw pdppBridgeError("PDPP_OWNER_BEARER_FOREIGN", "PDPP owner bearer token is not scoped to a currently owned instance", { subjectId: context.subjectId });
+        }
+        const namespace = legacyNamespace(scope);
+        const [liveInstance] = liveInstanceIds;
+        const matchesScope = liveInstance.split(":", 1)[0] === namespace &&
+            bridge.configuredMethods.has(liveInstance);
+        if (!matchesScope) {
+            throw pdppBridgeError("PDPP_OWNER_BEARER_SCOPE_MISMATCH", "PDPP owner bearer token is not scoped to the requested legacy source namespace", { scope, instanceIds: liveInstanceIds });
+        }
+    }
     /**
      * Delegated ingest. A bearer token that resolves to a live write session
      * authorizes as the session builder: the write policy re-runs against the
@@ -62,6 +139,8 @@ export function createServerApiAuth(deps) {
         const delegated = await writeSessions.authorizeSessionWrite(input);
         if (delegated)
             return delegated;
+        if (await authorizePdppOwnerBearerForScope(input))
+            return;
         await authorizeOwner(input.request);
     }
     /**
@@ -75,34 +154,47 @@ export function createServerApiAuth(deps) {
     async function authorizeWriteSession(request) {
         return writeSessions.recognizeWriteSession(request);
     }
+    async function authorizeBuilderList(request, options) {
+        const result = await authenticate(request, deps);
+        if (result.isPolicyBypass ||
+            isOwner(result.auth.signer, deps.serverOwner)) {
+            return;
+        }
+        // A builder lists only what its grants cover, bound to this server's
+        // owner like a read; fail closed when we can't identify the owner.
+        // resolveDataListGrantScopes does the one builder lookup (and throws
+        // UnregisteredBuilderError), so no separate registration check here.
+        if (!deps.serverOwner)
+            throw serverNotConfigured();
+        const grantedScopes = await resolveDataListGrantScopes({
+            signer: result.auth.signer,
+            grantId: result.auth.payload.grantId ?? options?.grantId,
+            serverOwner: deps.serverOwner,
+        }, {
+            authSessionVerifier: deps.gateway,
+            grantVerifier: deps.gateway,
+            grantLister: deps.gateway,
+            runtimeAvailability: deps.runtimeAvailability,
+        });
+        return { grantedScopes };
+    }
     return {
         authorizeOwner,
         authorizeWrite,
         authorizeWriteSession,
-        async authorizeBuilderList(request, options) {
-            const result = await authenticate(request, deps);
-            if (result.isPolicyBypass ||
-                isOwner(result.auth.signer, deps.serverOwner)) {
+        async authorizeOwnerScope(input) {
+            if (await authorizePdppOwnerBearerForScope(input))
                 return;
-            }
-            // A builder lists only what its grants cover, bound to this server's
-            // owner like a read; fail closed when we can't identify the owner.
-            // resolveDataListGrantScopes does the one builder lookup (and throws
-            // UnregisteredBuilderError), so no separate registration check here.
-            if (!deps.serverOwner)
-                throw serverNotConfigured();
-            const grantedScopes = await resolveDataListGrantScopes({
-                signer: result.auth.signer,
-                grantId: result.auth.payload.grantId ?? options?.grantId,
-                serverOwner: deps.serverOwner,
-            }, {
-                authSessionVerifier: deps.gateway,
-                grantVerifier: deps.gateway,
-                grantLister: deps.gateway,
-                runtimeAvailability: deps.runtimeAvailability,
-            });
-            return { grantedScopes };
+            await authorizeOwner(input.request);
+        },
+        async authorizeScopeVersions(input) {
+            if (await authorizePdppOwnerBearerForScope(input))
+                return;
+            // Any other credential is held to the listing rules: a builder sees the
+            // versions of a scope only when one of its grants covers it.
+            return authorizeBuilderList(input.request, { grantId: input.grantId });
         },
+        authorizeBuilderList,
         async authorizeBuilderRead(input) {
             const result = await authenticate(input.request, deps);
             if (result.isPolicyBypass) {

package/dist/api-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-auth.js","sourceRoot":"","sources":["../src/api-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,GAGpB,MAAM,4CAA4C,CAAC;AAMpD,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,mCAAmC,EACnC,+BAA+B,GAGhC,MAAM,6CAA6C,CAAC;AACrD,OAAO,EACL,aAAa,EACb,aAAa,GACd,MAAM,8CAA8C,CAAC;AAgCtD,SAAS,mBAAmB;IAC1B,OAAO,IAAI,aAAa,CACtB,GAAG,EACH,uBAAuB,EACvB,0FAA0F,CAC3F,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CACd,MAAc,EACd,WAAsC;IAEtC,OAAO,OAAO,CACZ,WAAW,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,WAAW,EAAE,CAClE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,OAAgB,EAChB,IAAuB;IAEvB,OAAO,mBAAmB,CAAC;QACzB,OAAO;QACP,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,oBAAoB,EAAE,IAAI,CAAC,UAAU;QACrC,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,IAAuB;IAEvB,MAAM,qBAAqB,GACzB,IAAI,CAAC,qBAAqB,IAAI,mCAAmC,EAAE,CAAC;IACtE,4EAA4E;IAC5E,0EAA0E;IAC1E,iDAAiD;IACjD,MAAM,aAAa,GAAG,+BAA+B,CAAC;QACpD,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,YAAY,EAAE,IAAI,CAAC,iBAAiB;QACpC,WAAW,EAAE,qBAAqB;QAClC,WAAW,EAAE;YACX,mBAAmB,EAAE,IAAI,CAAC,OAAO;YACjC,aAAa,EAAE,IAAI,CAAC,OAAO;YAC3B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,mEAAmE;YACnE,8CAA8C;SAC/C;KACF,CAAC,CAAC;IAEH,KAAK,UAAU,cAAc,CAAC,OAAgB;QAC5C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,MAAM,CAAC,cAAc;YAAE,OAAO;QAClC,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,MAAM,mBAAmB,EAAE,CAAC;QACnD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,aAAa,CAAC;gBACtB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;gBAC1B,QAAQ,EAAE,IAAI,CAAC,WAAW;aAC3B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,UAAU,cAAc,CAAC,KAAmC;QAC/D,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACnE,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC;QAChC,MAAM,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,UAAU,qBAAqB,CAAC,OAAgB;QACnD,OAAO,aAAa,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACtD,CAAC;IAED,OAAO;QACL,cAAc;QACd,cAAc;QACd,qBAAqB;QAErB,KAAK,CAAC,oBAAoB,CAAC,OAAO,EAAE,OAAO;YACzC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACjD,IACE,MAAM,CAAC,cAAc;gBACrB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,EAC7C,CAAC;gBACD,OAAO;YACT,CAAC;YACD,qEAAqE;YACrE,mEAAmE;YACnE,qEAAqE;YACrE,qEAAqE;YACrE,IAAI,CAAC,IAAI,CAAC,WAAW;gBAAE,MAAM,mBAAmB,EAAE,CAAC;YACnD,MAAM,aAAa,GAAG,MAAM,0BAA0B,CACpD;gBACE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;gBAC1B,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,EAAE,OAAO;gBACxD,WAAW,EAAE,IAAI,CAAC,WAAW;aAC9B,EACD;gBACE,mBAAmB,EAAE,IAAI,CAAC,OAAO;gBACjC,aAAa,EAAE,IAAI,CAAC,OAAO;gBAC3B,WAAW,EAAE,IAAI,CAAC,OAAO;gBACzB,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;aAC9C,CACF,CAAC;YACF,OAAO,EAAE,aAAa,EAAE,CAAC;QAC3B,CAAC;QAED,KAAK,CAAC,oBAAoB,CAAC,KAAkC;YAC3D,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACvD,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;gBAC1B,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;YACnE,CAAC;YACD,yDAAyD;YACzD,sEAAsE;YACtE,wDAAwD;YACxD,kEAAkE;YAClE,mEAAmE;YACnE,4DAA4D;YAC5D,8BAA8B;YAC9B,wEAAwE;YACxE,uEAAuE;YACvE,qEAAqE;YACrE,yDAAyD;YACzD,sEAAsE;YACtE,sEAAsE;YACtE,oEAAoE;YACpE,iEAAiE;YACjE,oEAAoE;YACpE,IACE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC;gBAC7C,CAAC,MAAM,CAAC,SAAS,KAAK,aAAa;oBACjC,MAAM,CAAC,SAAS,KAAK,qBAAqB,CAAC,EAC7C,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;YAC3D,CAAC;YAED,oEAAoE;YACpE,qDAAqD;YACrD,IAAI,CAAC,IAAI,CAAC,WAAW;gBAAE,MAAM,mBAAmB,EAAE,CAAC;YAEnD,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC;gBAChD,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,oBAAoB,CACtC;gBACE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;gBAC1B,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO;gBACrD,cAAc,EAAE,KAAK,CAAC,KAAK;gBAC3B,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,aAAa,EAAE,MAAM,IAAI,SAAS;gBAC1D,WAAW,EAAE,IAAI,CAAC,WAAW;aAC9B,EACD;gBACE,mBAAmB,EAAE,IAAI,CAAC,OAAO;gBACjC,aAAa,EAAE,IAAI,CAAC,OAAO;gBAC3B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;aAC9C,CACF,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QAC5D,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"api-auth.js","sourceRoot":"","sources":["../src/api-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,GAGpB,MAAM,4CAA4C,CAAC;AAQpD,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,mCAAmC,EACnC,+BAA+B,GAGhC,MAAM,6CAA6C,CAAC;AACrD,OAAO,EACL,aAAa,EACb,aAAa,GACd,MAAM,8CAA8C,CAAC;AAiDtD,SAAS,mBAAmB;IAC1B,OAAO,IAAI,aAAa,CACtB,GAAG,EACH,uBAAuB,EACvB,0FAA0F,CAC3F,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CACd,MAAc,EACd,WAAsC;IAEtC,OAAO,OAAO,CACZ,WAAW,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,WAAW,EAAE,CAClE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,OAAgB,EAChB,IAAuB;IAEvB,OAAO,mBAAmB,CAAC;QACzB,OAAO;QACP,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,oBAAoB,EAAE,IAAI,CAAC,UAAU;QACrC,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,OAAgB;IACnC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,eAAe,CACtB,SAAiB,EACjB,OAAe,EACf,OAAiC;IAEjC,OAAO,IAAI,aAAa,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,IAAuB;IAIvB,MAAM,qBAAqB,GACzB,IAAI,CAAC,qBAAqB,IAAI,mCAAmC,EAAE,CAAC;IACtE,4EAA4E;IAC5E,0EAA0E;IAC1E,iDAAiD;IACjD,MAAM,aAAa,GAAG,+BAA+B,CAAC;QACpD,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,YAAY,EAAE,IAAI,CAAC,iBAAiB;QACpC,WAAW,EAAE,qBAAqB;QAClC,WAAW,EAAE;YACX,mBAAmB,EAAE,IAAI,CAAC,OAAO;YACjC,aAAa,EAAE,IAAI,CAAC,OAAO;YAC3B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,mEAAmE;YACnE,8CAA8C;SAC/C;KACF,CAAC,CAAC;IAEH,KAAK,UAAU,cAAc,CAAC,OAAgB;QAC5C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,MAAM,CAAC,cAAc;YAAE,OAAO;QAClC,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,MAAM,mBAAmB,EAAE,CAAC;QACnD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,aAAa,CAAC;gBACtB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;gBAC1B,QAAQ,EAAE,IAAI,CAAC,WAAW;aAC3B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,UAAU,gCAAgC,CAC7C,KAAmC;QAEnC,IAAI,CAAC,IAAI,CAAC,eAAe;YAAE,OAAO,KAAK,CAAC;QACxC,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QAEzB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACpE,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAClC,6BAA6B,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,SAAS,6BAA6B,CACpC,OAAyB,EACzB,KAAa,EACb,QAA2B;QAE3B,MAAM,MAAM,GAAG,QAAQ,CAAC,eAAe,CAAC;QACxC,IAAI,CAAC,MAAM;YAAE,OAAO;QAEpB,IAAI,OAAO,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;YAClC,MAAM,eAAe,CACnB,8BAA8B,EAC9B,qEAAqE,CACtE,CAAC;QACJ,CAAC;QAED,IACE,CAAC,OAAO,CAAC,SAAS;YAClB,CAAC,MAAM,CAAC,cAAc;YACtB,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,EACvE,CAAC;YACD,MAAM,eAAe,CACnB,2BAA2B,EAC3B,wDAAwD,EACxD;gBACE,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,iBAAiB,EAAE,MAAM,CAAC,cAAc;aACzC,CACF,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;YACzC,MAAM,UAAU,GAAG,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxE,MAAM,eAAe,GACnB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC;YACzE,IAAI,SAAS,KAAK,eAAe,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7D,MAAM,eAAe,CACnB,kCAAkC,EAClC,gFAAgF,EAChF,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CACtC,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;gBACxB,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,MAAM,CAAC,kBAAkB,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC;oBAC9D,EAAE,CACL,CAAC;gBACF,IACE,OAAO,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;oBAChC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EACpE,CAAC;oBACD,MAAM,eAAe,CACnB,2BAA2B,EAC3B,+EAA+E,EAC/E,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CACjE,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7D,MAAM,eAAe,CACnB,qCAAqC,EACrC,8EAA8E,CAC/E,CAAC;QACJ,CAAC;QAED,MAAM,gBAAgB,GAAG,MAAM,CAAC,mBAAmB,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACzE,IAAI,CAAC,gBAAgB,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvD,MAAM,eAAe,CACnB,2BAA2B,EAC3B,qEAAqE,EACrE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CACjC,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC1C,MAAM,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC9D,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CACtB,CAAC;QACF,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,eAAe,CACnB,2BAA2B,EAC3B,qEAAqE,EACrE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CACjC,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,CAAC,YAAY,CAAC,GAAG,eAAe,CAAC;QACvC,MAAM,YAAY,GAChB,YAAY,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;YAC3C,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAE7C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,eAAe,CACnB,kCAAkC,EAClC,gFAAgF,EAChF,EAAE,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,CACxC,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,UAAU,cAAc,CAAC,KAAmC;QAC/D,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACnE,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC;QAChC,IAAI,MAAM,gCAAgC,CAAC,KAAK,CAAC;YAAE,OAAO;QAC1D,MAAM,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,UAAU,qBAAqB,CAAC,OAAgB;QACnD,OAAO,aAAa,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,UAAU,oBAAoB,CACjC,OAAgB,EAChB,OAA8B;QAE9B,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACjD,IACE,MAAM,CAAC,cAAc;YACrB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,EAC7C,CAAC;YACD,OAAO;QACT,CAAC;QACD,qEAAqE;QACrE,mEAAmE;QACnE,qEAAqE;QACrE,qEAAqE;QACrE,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,MAAM,mBAAmB,EAAE,CAAC;QACnD,MAAM,aAAa,GAAG,MAAM,0BAA0B,CACpD;YACE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;YAC1B,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,EAAE,OAAO;YACxD,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,EACD;YACE,mBAAmB,EAAE,IAAI,CAAC,OAAO;YACjC,aAAa,EAAE,IAAI,CAAC,OAAO;YAC3B,WAAW,EAAE,IAAI,CAAC,OAAO;YACzB,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;SAC9C,CACF,CAAC;QACF,OAAO,EAAE,aAAa,EAAE,CAAC;IAC3B,CAAC;IAED,OAAO;QACL,cAAc;QACd,cAAc;QACd,qBAAqB;QACrB,KAAK,CAAC,mBAAmB,CAAC,KAAmC;YAC3D,IAAI,MAAM,gCAAgC,CAAC,KAAK,CAAC;gBAAE,OAAO;YAC1D,MAAM,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;QAED,KAAK,CAAC,sBAAsB,CAAC,KAAK;YAChC,IAAI,MAAM,gCAAgC,CAAC,KAAK,CAAC;gBAAE,OAAO;YAC1D,wEAAwE;YACxE,6DAA6D;YAC7D,OAAO,oBAAoB,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,oBAAoB;QAEpB,KAAK,CAAC,oBAAoB,CAAC,KAAkC;YAC3D,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACvD,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;gBAC1B,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;YACnE,CAAC;YACD,yDAAyD;YACzD,sEAAsE;YACtE,wDAAwD;YACxD,kEAAkE;YAClE,mEAAmE;YACnE,4DAA4D;YAC5D,8BAA8B;YAC9B,wEAAwE;YACxE,uEAAuE;YACvE,qEAAqE;YACrE,yDAAyD;YACzD,sEAAsE;YACtE,sEAAsE;YACtE,oEAAoE;YACpE,iEAAiE;YACjE,oEAAoE;YACpE,IACE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC;gBAC7C,CAAC,MAAM,CAAC,SAAS,KAAK,aAAa;oBACjC,MAAM,CAAC,SAAS,KAAK,qBAAqB,CAAC,EAC7C,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;YAC3D,CAAC;YAED,oEAAoE;YACpE,qDAAqD;YACrD,IAAI,CAAC,IAAI,CAAC,WAAW;gBAAE,MAAM,mBAAmB,EAAE,CAAC;YAEnD,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC;gBAChD,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,oBAAoB,CACtC;gBACE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;gBAC1B,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO;gBACrD,cAAc,EAAE,KAAK,CAAC,KAAK;gBAC3B,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,aAAa,EAAE,MAAM,IAAI,SAAS;gBAC1D,WAAW,EAAE,IAAI,CAAC,WAAW;aAC9B,EACD;gBACE,mBAAmB,EAAE,IAAI,CAAC,OAAO;gBACjC,aAAa,EAAE,IAAI,CAAC,OAAO;gBAC3B,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;aAC9C,CACF,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QAC5D,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/app.d.ts

@@ -1,3 +1,4 @@
+import type { DurableAdditionsService } from "@opendatalabs/personal-server-ts-core/additions";
 import { Hono } from "hono";
 import type { IndexManager } from "@opendatalabs/personal-server-ts-core/storage/index";
 import type { HierarchyManagerOptions } from "@opendatalabs/personal-server-ts-core/storage/hierarchy";
@@ -9,7 +10,9 @@ import type { PersonalServerReadFulfillmentReporter } from "@opendatalabs/person
 import { type HealthDeps } from "./routes/health.js";
 import { type WriteProofReplayStore, type WriteSessionStore } from "@opendatalabs/personal-server-ts-core/write";
 import { McpActivityRecorder, type McpConnectionStore, type McpOAuthAuthorizationStore, type McpScopeRequestApprovalUrlHook } from "@opendatalabs/personal-server-ts-core/mcp";
-import type { ScopeDeletionTracker, SyncManager } from "@opendatalabs/personal-server-ts-core/sync";
+import { type PdppAuthRouteDeps } from "./routes/pdpp-auth.js";
+import type { MutableDeclarationRegistry } from "./pdpp/declaration-registry.js";
+import type { PdppImporter, ScopeDeletionTracker, SyncManager } from "@opendatalabs/personal-server-ts-core/sync";
 import type { ServerSigner } from "@opendatalabs/personal-server-ts-core/signing";
 import type { LineageGatewayPort } from "@opendatalabs/personal-server-ts-core/lineage";
 import type { QuestionStore, RecomputeScheduler } from "@opendatalabs/personal-server-ts-core/derivatives";
@@ -18,12 +21,18 @@ import type { TokenStore } from "./token-store.js";
 import type { Logger } from "pino";
 import type { JobRequestEnvelope } from "@opendatalabs/vana-sdk/protocol/jobs";
 import type { JobExecuteResponse } from "./jobs/types.js";
+import { type PdppConnectionRouteDeps } from "./routes/pdpp-connections.js";
+import type { createSqliteRecordStore } from "./storage/pdpp-records-sqlite-store.js";
+import type { PdppAuthorizationService } from "@opendatalabs/personal-server-ts-core/ports/pdpp-auth";
+import type { LegacyScopeViewPort } from "@opendatalabs/personal-server-ts-core/storage/legacy-scope-view";
+import type { PdppRecordStore, StreamDeclarationRegistry } from "@opendatalabs/personal-server-ts-core/storage/pdpp-records";
 export interface IdentityInfo {
     address: `0x${string}`;
     publicKey: `0x${string}`;
     serverId: string | null;
 }
 export interface AppDeps {
+    additions?: DurableAdditionsService;
     logger: Logger;
     version: string;
     startedAt: Date;
@@ -65,6 +74,8 @@ export interface AppDeps {
     tokenStore?: TokenStore;
     runtimeAvailability?: RuntimeAvailabilityPort;
     dataStorage?: DataStoragePort;
+    /** Canonical latest bodies for GET /v1/data; absent = file reads only. */
+    legacyScopeView?: LegacyScopeViewPort;
     /**
      * Gateway base URL — wired into the data route so the GET handler can
      * forward validated X-PAYMENTs to POST /v1/escrow/pay via direct fetch.
@@ -91,6 +102,14 @@ export interface AppDeps {
         store: QuestionStore;
         scheduler: RecomputeScheduler;
     } | null;
+    /**
+     * PDPP record importer for locally-ingested envelopes. The bootstrap passes
+     * the same stable delegate it gives the sync download worker, so both
+     * arrival routes — gateway sync and local owner-authenticated POST —
+     * import through one importer into one store. Absent = no PDPP mounted,
+     * and `$pdpp` envelopes are stored and indexed exactly as before.
+     */
+    pdppImporter?: PdppImporter;
     getTunnelStatus?: HealthDeps["getTunnelStatus"];
     /**
      * Invoked when the /ui/api registration route confirms the server is
@@ -108,6 +127,27 @@ export interface AppDeps {
     mcpConnectionStore?: McpConnectionStore;
     mcpOAuthAuthorizationStore?: McpOAuthAuthorizationStore;
     mcpOAuthApprovalUrl?: string | (() => string);
+    /**
+     * PDPP Core v0.1 Authorization Server. Absent = the `/pdpp/v1` surface is
+     * not mounted, and existing OAuth/MCP behavior is unchanged. This is a
+     * separate authority from `tokenStore`: PDPP tokens are grant-bound and
+     * live in their own store (spec §8 forbids a second grant authority behind
+     * one enforcement path).
+     */
+    pdppAuth?: PdppAuthRouteDeps;
+    /** Connection registry routes can run with canonical record routes off. */
+    pdppConnections?: PdppConnectionRouteDeps;
+    /**
+     * Operator-authenticated declaration submission. Absent (or with no
+     * operator token) leaves the route unmounted and the declaration set
+     * exactly as config made it — the pre-existing behavior.
+     */
+    pdppDeclarations?: {
+        registry: MutableDeclarationRegistry;
+        supportedConnectors: string[];
+        /** Absent = the route is not mounted at all. */
+        operatorToken?: string;
+    };
     /** See `CreateServerOptions.mcpScopeRequestApprovalUrl`. */
     mcpScopeRequestApprovalUrl?: McpScopeRequestApprovalUrlHook;
     mcpActivityRecorder?: McpActivityRecorder;
@@ -125,6 +165,25 @@ export interface AppDeps {
     writeProofReplayStore?: WriteProofReplayStore;
     profile?: "standard" | "enclave";
     jobWorker?: (envelope: JobRequestEnvelope) => Promise<JobExecuteResponse>;
+    /**
+     * PDPP §4/§8 record model + Resource Server query surface. Absent = the
+     * PDPP routes are not mounted; existing deployments are unaffected. When
+     * present, all three must be present together (record store, token
+     * resolution, and stream declarations are mutually required).
+     */
+    pdpp?: {
+        store: PdppRecordStore;
+        bindingStore: ReturnType<typeof createSqliteRecordStore>;
+        configuredMethods: Map<string, string[]>;
+        auth: PdppAuthorizationService;
+        declarations: StreamDeclarationRegistry;
+        instancesForSubject?: (subjectId: string) => string[];
+        instancesForSource?: (subjectId: string, sourceId: string) => string[];
+        readBlobBytes?: (blobId: string) => Promise<Uint8Array<ArrayBuffer> | undefined>;
+        /** This resource server's own identifier, RFC 9728 `resource` member. */
+        resource: string;
+        authorizationServers?: string[];
+    };
 }
 export declare function createApp(deps: AppDeps): Hono;
 //# sourceMappingURL=app.d.ts.map

package/dist/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACxF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yDAAyD,CAAC;AACvG,OAAO,KAAK,EACV,4BAA4B,EAC5B,aAAa,EACd,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+CAA+C,CAAC;AAClF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAChG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,2CAA2C,CAAC;AACvG,OAAO,EAAe,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAKlE,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACvB,MAAM,6CAA6C,CAAC;AAcrD,OAAO,EACL,mBAAmB,EAGnB,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,EAC/B,KAAK,8BAA8B,EACpC,MAAM,2CAA2C,CAAC;AASnD,OAAO,KAAK,EACV,oBAAoB,EACpB,WAAW,EACZ,MAAM,4CAA4C,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+CAA+C,CAAC;AAClF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,+CAA+C,CAAC;AACxF,OAAO,KAAK,EACV,aAAa,EACb,kBAAkB,EACnB,MAAM,mDAAmD,CAAC;AAC3D,OAAO,KAAK,EACV,eAAe,EACf,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAEnC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC/E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAE1D,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,KAAK,MAAM,EAAE,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,YAAY,EAAE,YAAY,CAAC;IAC3B,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,mBAAmB,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;IAC1D,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,OAAO,EAAE,aAAa,CAAC;IACvB,aAAa,CAAC,EAAE,4BAA4B,GAAG;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAChE,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,eAAe,EAAE,eAAe,CAAC;IACjC,eAAe,EAAE,eAAe,CAAC;IACjC,uBAAuB,CAAC,EAAE,qCAAqC,CAAC;IAChE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC/B,eAAe,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACjC,uEAAuE;IACvE,cAAc,CAAC,EAAE,oBAAoB,CAAC;IACtC,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;IAC9C,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,mEAAmE;IACnE,cAAc,CAAC,EAAE,kBAAkB,CAAC;IACpC;;;OAGG;IACH,iBAAiB,CAAC,EAAE;QAClB,KAAK,EAAE,aAAa,CAAC;QACrB,SAAS,EAAE,kBAAkB,CAAC;KAC/B,GAAG,IAAI,CAAC;IACT,eAAe,CAAC,EAAE,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAChD;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IACvD;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,0BAA0B,CAAC,EAAE,0BAA0B,CAAC;IACxD,mBAAmB,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IAC9C,4DAA4D;IAC5D,0BAA0B,CAAC,EAAE,8BAA8B,CAAC;IAC5D,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;OAGG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAC9C,OAAO,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IACjC,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAC3E;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CA6X7C"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iDAAiD,CAAC;AAC/F,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACxF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yDAAyD,CAAC;AACvG,OAAO,KAAK,EACV,4BAA4B,EAC5B,aAAa,EACd,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+CAA+C,CAAC;AAClF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAChG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,2CAA2C,CAAC;AACvG,OAAO,EAAe,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAKlE,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACvB,MAAM,6CAA6C,CAAC;AAcrD,OAAO,EACL,mBAAmB,EAGnB,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,EAC/B,KAAK,8BAA8B,EACpC,MAAM,2CAA2C,CAAC;AASnD,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AACjF,OAAO,KAAK,EACV,YAAY,EACZ,oBAAoB,EACpB,WAAW,EACZ,MAAM,4CAA4C,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+CAA+C,CAAC;AAClF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,+CAA+C,CAAC;AACxF,OAAO,KAAK,EACV,aAAa,EACb,kBAAkB,EACnB,MAAM,mDAAmD,CAAC;AAC3D,OAAO,KAAK,EACV,eAAe,EACf,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAEnC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC/E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAG1D,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,8BAA8B,CAAC;AAGtC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iEAAiE,CAAC;AAC3G,OAAO,KAAK,EACV,eAAe,EACf,yBAAyB,EAC1B,MAAM,4DAA4D,CAAC;AAEpE,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,KAAK,MAAM,EAAE,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,OAAO;IACtB,SAAS,CAAC,EAAE,uBAAuB,CAAC;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,YAAY,EAAE,YAAY,CAAC;IAC3B,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,mBAAmB,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;IAC1D,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,OAAO,EAAE,aAAa,CAAC;IACvB,aAAa,CAAC,EAAE,4BAA4B,GAAG;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAChE,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,eAAe,EAAE,eAAe,CAAC;IACjC,eAAe,EAAE,eAAe,CAAC;IACjC,uBAAuB,CAAC,EAAE,qCAAqC,CAAC;IAChE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC/B,eAAe,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACjC,uEAAuE;IACvE,cAAc,CAAC,EAAE,oBAAoB,CAAC;IACtC,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;IAC9C,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,0EAA0E;IAC1E,eAAe,CAAC,EAAE,mBAAmB,CAAC;IACtC;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,mEAAmE;IACnE,cAAc,CAAC,EAAE,kBAAkB,CAAC;IACpC;;;OAGG;IACH,iBAAiB,CAAC,EAAE;QAClB,KAAK,EAAE,aAAa,CAAC;QACrB,SAAS,EAAE,kBAAkB,CAAC;KAC/B,GAAG,IAAI,CAAC;IACT;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,eAAe,CAAC,EAAE,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAChD;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IACvD;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,0BAA0B,CAAC,EAAE,0BAA0B,CAAC;IACxD,mBAAmB,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IAC9C;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,2EAA2E;IAC3E,eAAe,CAAC,EAAE,uBAAuB,CAAC;IAC1C;;;;OAIG;IACH,gBAAgB,CAAC,EAAE;QACjB,QAAQ,EAAE,0BAA0B,CAAC;QACrC,mBAAmB,EAAE,MAAM,EAAE,CAAC;QAC9B,gDAAgD;QAChD,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,4DAA4D;IAC5D,0BAA0B,CAAC,EAAE,8BAA8B,CAAC;IAC5D,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;OAGG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAC9C,OAAO,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IACjC,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC1E;;;;;OAKG;IACH,IAAI,CAAC,EAAE;QACL,KAAK,EAAE,eAAe,CAAC;QACvB,YAAY,EAAE,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC;QACzD,iBAAiB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACzC,IAAI,EAAE,wBAAwB,CAAC;QAC/B,YAAY,EAAE,yBAAyB,CAAC;QACxC,mBAAmB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;QACtD,kBAAkB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;QACvE,aAAa,CAAC,EAAE,CACd,MAAM,EAAE,MAAM,KACX,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,SAAS,CAAC,CAAC;QAClD,yEAAyE;QACzE,QAAQ,EAAE,MAAM,CAAC;QACjB,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;KACjC,CAAC;CACH;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAyhB7C"}