@opendatalabs/personal-server-ts-server 1.34.1 → 1.35.0

package/dist/pdpp/replica-authorization.js

@@ -0,0 +1,234 @@
+import { PdppAuthorizationUnavailableError } from "@opendatalabs/personal-server-ts-core/ports/pdpp-auth";
+import { resolveLocalInstance } from "@opendatalabs/personal-server-ts-core/replication/identity";
+import { PDPP_DATA_ACCESS_TYPE_V02 } from "@opendatalabs/personal-server-ts-core/pdpp";
+import { z } from "zod";
+const nonempty = z.string().min(1);
+const date = nonempty.refine((value) => Number.isFinite(Date.parse(value)));
+const uniqueNames = z
+    .array(nonempty)
+    .min(1)
+    .refine((values) => new Set(values).size === values.length);
+const stream = z
+    .object({
+    name: nonempty,
+    instance_ids: uniqueNames,
+    fields: uniqueNames,
+    resources: z.array(nonempty).optional(),
+    time_constraint: z
+        .object({
+        field: nonempty,
+        since: date.optional(),
+        until: date.optional(),
+    })
+        .strict()
+        .optional(),
+})
+    .strict();
+// This adapter accepts the complete frozen v0.2 grant. The v0.1 wire
+// projection omits retained facts; inventing them here would create authority.
+const introspection = z.object({
+    active: z.literal(true),
+    pdpp_token_kind: z.literal("client"),
+    subject_id: nonempty,
+    grant_id: nonempty,
+    client_id: nonempty,
+    exp: z.number().int().positive(),
+    authorization_details: z.tuple([
+        z.object({
+            type: z.literal(PDPP_DATA_ACCESS_TYPE_V02),
+            grant: z
+                .object({
+                version: z.literal("0.2.0"),
+                grant_id: nonempty,
+                issued_at: date,
+                subject: z.object({ id: nonempty }),
+                client: z.object({ client_id: nonempty }).passthrough(),
+                source: z.object({
+                    kind: z.enum(["connector", "provider_native"]),
+                    id: nonempty,
+                }),
+                source_declaration: z.object({ version: nonempty }),
+                purpose_code: nonempty,
+                access_mode: z.enum(["single_use", "continuous"]),
+                streams: z
+                    .array(stream)
+                    .min(1)
+                    .refine((streams) => new Set(streams.map((entry) => entry.name)).size ===
+                    streams.length),
+                expires_at: date.optional(),
+            })
+                .passthrough(),
+        }),
+    ]),
+});
+async function readContext(response) {
+    if (!response.ok || !response.body) {
+        await response.body?.cancel();
+        throw new PdppAuthorizationUnavailableError();
+    }
+    const reader = response.body.getReader();
+    const chunks = [];
+    let size = 0;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            size += value.byteLength;
+            if (size > 1024 * 1024)
+                throw new PdppAuthorizationUnavailableError();
+            chunks.push(value);
+        }
+        const bytes = new Uint8Array(size);
+        let offset = 0;
+        for (const chunk of chunks) {
+            bytes.set(chunk, offset);
+            offset += chunk.length;
+        }
+        return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+    }
+    finally {
+        await reader.cancel().catch(() => undefined);
+    }
+}
+/**
+ * Replica read authority stays at one configured issuer, with no positive cache.
+ * The host provisions a source-scoped issuer owner token for the existing
+ * authenticated introspection endpoint; it is never accepted as an app token.
+ * This harness-only credential has owner read authority. See the issuer's
+ * acknowledged separated-RS credential gap in pdpp-auth.ts (RFC 7662 route).
+ * No credential, grant, token, or revocation state is imported with records.
+ * This is explicit experimental host wiring, not ordinary bootstrap wiring.
+ * Inactive RFC 7662 results conceal revocation reasons and yield 401; the
+ * co-located issuer can distinguish grant_revoked and returns 403 instead.
+ * The returned grant is a translated local enforcement view. Its grant_id
+ * identifies the immutable issuer grant; never hash this view as consent.
+ */
+export function createReplicaAuthorizationService(options) {
+    if (!options.owner)
+        throw new Error("Replica owner is required");
+    const issuer = new URL(options.issuerOrigin);
+    if (issuer.username ||
+        issuer.password ||
+        issuer.search ||
+        issuer.hash ||
+        issuer.pathname !== "/" ||
+        (issuer.protocol !== "https:" &&
+            !(issuer.protocol === "http:" &&
+                ["127.0.0.1", "[::1]"].includes(issuer.hostname)))) {
+        throw new Error("Replica issuer must be an HTTPS origin or loopback HTTP origin");
+    }
+    const fetcher = options.fetch ?? globalThis.fetch;
+    const now = options.now ?? Date.now;
+    const denied = (reason) => {
+        options.onDecision?.({ outcome: "denied", reason });
+        return { active: false };
+    };
+    const unavailable = (reason) => {
+        options.onDecision?.({ outcome: "unavailable", reason });
+        throw new PdppAuthorizationUnavailableError();
+    };
+    return {
+        async resolveToken(accessToken) {
+            if (!accessToken)
+                return denied("issuer_inactive");
+            let credential;
+            try {
+                credential = await options.credential();
+            }
+            catch {
+                return unavailable("credential_unavailable");
+            }
+            if (!credential)
+                return unavailable("credential_unavailable");
+            let wire;
+            try {
+                const response = await fetcher(`${issuer.origin}/pdpp/v1/introspect`, {
+                    method: "POST",
+                    headers: {
+                        authorization: `Bearer ${credential}`,
+                        "content-type": "application/x-www-form-urlencoded",
+                    },
+                    body: new URLSearchParams({ token: accessToken }),
+                    redirect: "error",
+                    cache: "no-store",
+                    signal: AbortSignal.timeout(10_000),
+                });
+                wire = await readContext(response);
+            }
+            catch {
+                return unavailable("issuer_unavailable");
+            }
+            if (z
+                .object({ active: z.literal(false) })
+                .strict()
+                .safeParse(wire).success)
+                return denied("issuer_inactive");
+            if (z
+                .object({
+                active: z.literal(true),
+                pdpp_token_kind: z.literal("owner"),
+            })
+                .safeParse(wire).success)
+                return denied("token_kind");
+            const parsed = introspection.safeParse(wire);
+            if (!parsed.success)
+                return unavailable("invalid_response");
+            const context = parsed.data;
+            const grant = context.authorization_details[0].grant;
+            if (context.subject_id !== options.owner ||
+                grant.subject.id !== options.owner)
+                return denied("owner_mismatch");
+            if (grant.grant_id !== context.grant_id ||
+                grant.client.client_id !== context.client_id)
+                return denied("grant_mismatch");
+            const currentTime = now();
+            if (context.exp * 1000 <= currentTime ||
+                (grant.expires_at && Date.parse(grant.expires_at) <= currentTime))
+                return denied("expired");
+            const mappings = options.connections();
+            let mappingFailure;
+            const streams = grant.streams.map((stream) => ({
+                ...stream,
+                instance_ids: stream.instance_ids.map((handle) => {
+                    const matches = mappings.filter((entry) => entry.issuerInstanceId === handle &&
+                        entry.owner === options.owner &&
+                        entry.sourceId === grant.source.id);
+                    const identities = new Set(matches.map((entry) => entry.connectionId));
+                    if (identities.size !== 1) {
+                        mappingFailure =
+                            identities.size === 0 ? "mapping_missing" : "mapping_ambiguous";
+                        return "";
+                    }
+                    let local;
+                    try {
+                        local = resolveLocalInstance({
+                            owner: options.owner,
+                            sourceId: grant.source.id,
+                            connectionId: matches[0].connectionId,
+                        }, mappings);
+                    }
+                    catch {
+                        mappingFailure = "mapping_invalid";
+                    }
+                    if (!local)
+                        mappingFailure ??= "mapping_missing";
+                    return local ?? "";
+                }),
+            }));
+            if (mappingFailure)
+                return denied(mappingFailure);
+            if (streams.some((stream) => new Set(stream.instance_ids).size !== stream.instance_ids.length))
+                return denied("mapping_collapsed");
+            return {
+                active: true,
+                tokenKind: "client",
+                subjectId: context.subject_id,
+                clientId: context.client_id,
+                expiresAt: new Date(context.exp * 1000).toISOString(),
+                grant: { ...grant, streams },
+            };
+        },
+    };
+}
+//# sourceMappingURL=replica-authorization.js.map

package/dist/pdpp/replica-authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"replica-authorization.js","sourceRoot":"","sources":["../../src/pdpp/replica-authorization.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iCAAiC,EAAE,MAAM,uDAAuD,CAAC;AAC1G,OAAO,EAAE,oBAAoB,EAAE,MAAM,4DAA4D,CAAC;AAClG,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAwBxB,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACnC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC5E,MAAM,WAAW,GAAG,CAAC;KAClB,KAAK,CAAC,QAAQ,CAAC;KACf,GAAG,CAAC,CAAC,CAAC;KACN,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC;AAC9D,MAAM,MAAM,GAAG,CAAC;KACb,MAAM,CAAC;IACN,IAAI,EAAE,QAAQ;IACd,YAAY,EAAE,WAAW;IACzB,MAAM,EAAE,WAAW;IACnB,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE;IACvC,eAAe,EAAE,CAAC;SACf,MAAM,CAAC;QACN,KAAK,EAAE,QAAQ;QACf,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE;QACtB,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE;KACvB,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,EAAE;CACd,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,qEAAqE;AACrE,+EAA+E;AAC/E,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACvB,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACpC,UAAU,EAAE,QAAQ;IACpB,QAAQ,EAAE,QAAQ;IAClB,SAAS,EAAE,QAAQ;IACnB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAChC,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC;QAC7B,CAAC,CAAC,MAAM,CAAC;YACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC;YAC1C,KAAK,EAAE,CAAC;iBACL,MAAM,CAAC;gBACN,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;gBAC3B,QAAQ,EAAE,QAAQ;gBAClB,SAAS,EAAE,IAAI;gBACf,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;gBACnC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,WAAW,EAAE;gBACvD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;oBACf,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;oBAC9C,EAAE,EAAE,QAAQ;iBACb,CAAC;gBACF,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;gBACnD,YAAY,EAAE,QAAQ;gBACtB,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;gBACjD,OAAO,EAAE,CAAC;qBACP,KAAK,CAAC,MAAM,CAAC;qBACb,GAAG,CAAC,CAAC,CAAC;qBACN,MAAM,CACL,CAAC,OAAO,EAAE,EAAE,CACV,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;oBAChD,OAAO,CAAC,MAAM,CACjB;gBACH,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE;aAC5B,CAAC;iBACD,WAAW,EAAE;SACjB,CAAC;KACH,CAAC;CACH,CAAC,CAAC;AAEH,KAAK,UAAU,WAAW,CAAC,QAAkB;IAC3C,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9B,MAAM,IAAI,iCAAiC,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC;YACzB,IAAI,IAAI,GAAG,IAAI,GAAG,IAAI;gBAAE,MAAM,IAAI,iCAAiC,EAAE,CAAC;YACtE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;QACzB,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7E,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iCAAiC,CAAC,OAWjD;IACC,IAAI,CAAC,OAAO,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC7C,IACE,MAAM,CAAC,QAAQ;QACf,MAAM,CAAC,QAAQ;QACf,MAAM,CAAC,MAAM;QACb,MAAM,CAAC,IAAI;QACX,MAAM,CAAC,QAAQ,KAAK,GAAG;QACvB,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ;YAC3B,CAAC,CACC,MAAM,CAAC,QAAQ,KAAK,OAAO;gBAC3B,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CACjD,CAAC,EACJ,CAAC;QACD,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAClD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,MAAM,GAAG,CAAC,MAAkC,EAAE,EAAE;QACpD,OAAO,CAAC,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACpD,OAAO,EAAE,MAAM,EAAE,KAAc,EAAE,CAAC;IACpC,CAAC,CAAC;IACF,MAAM,WAAW,GAAG,CAAC,MAAkC,EAAS,EAAE;QAChE,OAAO,CAAC,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC;QACzD,MAAM,IAAI,iCAAiC,EAAE,CAAC;IAChD,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,WAAW;YAC5B,IAAI,CAAC,WAAW;gBAAE,OAAO,MAAM,CAAC,iBAAiB,CAAC,CAAC;YACnD,IAAI,UAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,UAAU,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;YAC1C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,WAAW,CAAC,wBAAwB,CAAC,CAAC;YAC/C,CAAC;YACD,IAAI,CAAC,UAAU;gBAAE,OAAO,WAAW,CAAC,wBAAwB,CAAC,CAAC;YAC9D,IAAI,IAAa,CAAC;YAClB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,qBAAqB,EAAE;oBACpE,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE;wBACP,aAAa,EAAE,UAAU,UAAU,EAAE;wBACrC,cAAc,EAAE,mCAAmC;qBACpD;oBACD,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;oBACjD,QAAQ,EAAE,OAAO;oBACjB,KAAK,EAAE,UAAU;oBACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;iBACpC,CAAC,CAAC;gBACH,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;YACrC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,WAAW,CAAC,oBAAoB,CAAC,CAAC;YAC3C,CAAC;YACD,IACE,CAAC;iBACE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;iBACpC,MAAM,EAAE;iBACR,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO;gBAE1B,OAAO,MAAM,CAAC,iBAAiB,CAAC,CAAC;YACnC,IACE,CAAC;iBACE,MAAM,CAAC;gBACN,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;gBACvB,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;aACpC,CAAC;iBACD,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO;gBAE1B,OAAO,MAAM,CAAC,YAAY,CAAC,CAAC;YAC9B,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,WAAW,CAAC,kBAAkB,CAAC,CAAC;YAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC;YAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YACrD,IACE,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,KAAK;gBACpC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,OAAO,CAAC,KAAK;gBAElC,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAClC,IACE,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ;gBACnC,KAAK,CAAC,MAAM,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;gBAE5C,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAClC,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC;YAC1B,IACE,OAAO,CAAC,GAAG,GAAG,IAAI,IAAI,WAAW;gBACjC,CAAC,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,WAAW,CAAC;gBAEjE,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC;YAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;YACvC,IAAI,cAAsD,CAAC;YAC3D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC7C,GAAG,MAAM;gBACT,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;oBAC/C,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAC7B,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,gBAAgB,KAAK,MAAM;wBACjC,KAAK,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK;wBAC7B,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,MAAM,CAAC,EAAE,CACrC,CAAC;oBACF,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAC3C,CAAC;oBACF,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;wBAC1B,cAAc;4BACZ,UAAU,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,mBAAmB,CAAC;wBAClE,OAAO,EAAE,CAAC;oBACZ,CAAC;oBACD,IAAI,KAAyB,CAAC;oBAC9B,IAAI,CAAC;wBACH,KAAK,GAAG,oBAAoB,CAC1B;4BACE,KAAK,EAAE,OAAO,CAAC,KAAK;4BACpB,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;4BACzB,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY;yBACtC,EACD,QAAQ,CACT,CAAC;oBACJ,CAAC;oBAAC,MAAM,CAAC;wBACP,cAAc,GAAG,iBAAiB,CAAC;oBACrC,CAAC;oBACD,IAAI,CAAC,KAAK;wBAAE,cAAc,KAAK,iBAAiB,CAAC;oBACjD,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,CAAC,CAAC;aACH,CAAC,CAAC,CAAC;YACJ,IAAI,cAAc;gBAAE,OAAO,MAAM,CAAC,cAAc,CAAC,CAAC;YAClD,IACE,OAAO,CAAC,IAAI,CACV,CAAC,MAAM,EAAE,EAAE,CACT,IAAI,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,YAAY,CAAC,MAAM,CACnE;gBAED,OAAO,MAAM,CAAC,mBAAmB,CAAC,CAAC;YACrC,OAAO;gBACL,MAAM,EAAE,IAAI;gBACZ,SAAS,EAAE,QAAQ;gBACnB,SAAS,EAAE,OAAO,CAAC,UAAU;gBAC7B,QAAQ,EAAE,OAAO,CAAC,SAAS;gBAC3B,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;gBACrD,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE;aAC7B,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/pending-blob-deletions.d.ts

@@ -5,6 +5,7 @@ import type { PendingBlobDeletionStore } from "@opendatalabs/personal-server-ts-
  * each. Lives next to `sync-cursor.json` under the server root; written
  * atomically (tmp + rename) like the cursor. A version-1 file (whole scopes)
  * is read as version-less markers the retry expands into exact keys.
+ * `planned` keeps each scope's planned-through watermark in the same write.
  */
 export declare function createFilePendingBlobDeletionStore(filePath: string): PendingBlobDeletionStore;
 //# sourceMappingURL=pending-blob-deletions.d.ts.map

package/dist/pending-blob-deletions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pending-blob-deletions.d.ts","sourceRoot":"","sources":["../src/pending-blob-deletions.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAEV,wBAAwB,EACzB,MAAM,6CAA6C,CAAC;AAOrD;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAChD,QAAQ,EAAE,MAAM,GACf,wBAAwB,CA+B1B"}
+{"version":3,"file":"pending-blob-deletions.d.ts","sourceRoot":"","sources":["../src/pending-blob-deletions.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAEV,wBAAwB,EACzB,MAAM,6CAA6C,CAAC;AAarD;;;;;;;GAOG;AACH,wBAAgB,kCAAkC,CAChD,QAAQ,EAAE,MAAM,GACf,wBAAwB,CAmC1B"}

package/dist/pending-blob-deletions.js

@@ -1,12 +1,13 @@
 import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
 import { dirname } from "node:path";
-import { createPendingBlobDeletionStore, normalizePendingBlobDeletions, } from "@opendatalabs/personal-server-ts-core/sync";
+import { createPendingBlobDeletionStore, normalizePendingBlobDeletionPlanned, normalizePendingBlobDeletions, } from "@opendatalabs/personal-server-ts-core/sync";
 /**
  * File-backed retry markers for blob deletions whose gateway tombstone landed
  * but whose storage DELETE did not finish: one exact (scope, version) key
  * each. Lives next to `sync-cursor.json` under the server root; written
  * atomically (tmp + rename) like the cursor. A version-1 file (whole scopes)
  * is read as version-less markers the retry expands into exact keys.
+ * `planned` keeps each scope's planned-through watermark in the same write.
  */
 export function createFilePendingBlobDeletionStore(filePath) {
     const kv = {
@@ -14,7 +15,10 @@ export function createFilePendingBlobDeletionStore(filePath) {
             try {
                 const raw = await readFile(filePath, "utf8");
                 const parsed = JSON.parse(raw);
-                return normalizePendingBlobDeletions(parsed.keys ?? parsed.scopes);
+                return {
+                    keys: normalizePendingBlobDeletions(parsed.keys ?? parsed.scopes),
+                    planned: normalizePendingBlobDeletionPlanned(parsed.planned),
+                };
             }
             catch (err) {
                 if (err instanceof Error &&
@@ -25,10 +29,10 @@ export function createFilePendingBlobDeletionStore(filePath) {
                 throw err;
             }
         },
-        async write(keys) {
+        async write(keys, planned) {
             await mkdir(dirname(filePath), { recursive: true });
             const tmpPath = `${filePath}.tmp`;
-            const state = { version: 2, keys };
+            const state = { version: 2, keys, planned };
             await writeFile(tmpPath, `${JSON.stringify(state, null, 2)}\n`);
             await rename(tmpPath, filePath);
         },

package/dist/pending-blob-deletions.js.map

@@ -1 +1 @@
-{"version":3,"file":"pending-blob-deletions.js","sourceRoot":"","sources":["../src/pending-blob-deletions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EACL,8BAA8B,EAC9B,6BAA6B,GAE9B,MAAM,4CAA4C,CAAC;AAWpD;;;;;;GAMG;AACH,MAAM,UAAU,kCAAkC,CAChD,QAAgB;IAEhB,MAAM,EAAE,GAA0B;QAChC,KAAK,CAAC,IAAI;YACR,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAI5B,CAAC;gBACF,OAAO,6BAA6B,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;YACrE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IACE,GAAG,YAAY,KAAK;oBACpB,MAAM,IAAI,GAAG;oBACZ,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAChD,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,IAAI;YACd,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACpD,MAAM,OAAO,GAAG,GAAG,QAAQ,MAAM,CAAC;YAClC,MAAM,KAAK,GAA6B,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;YAC7D,MAAM,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YAChE,MAAM,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAClC,CAAC;KACF,CAAC;IACF,OAAO,8BAA8B,CAAC,EAAE,CAAC,CAAC;AAC5C,CAAC"}
+{"version":3,"file":"pending-blob-deletions.js","sourceRoot":"","sources":["../src/pending-blob-deletions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EACL,8BAA8B,EAC9B,mCAAmC,EACnC,6BAA6B,GAG9B,MAAM,4CAA4C,CAAC;AAiBpD;;;;;;;GAOG;AACH,MAAM,UAAU,kCAAkC,CAChD,QAAgB;IAEhB,MAAM,EAAE,GAA0B;QAChC,KAAK,CAAC,IAAI;YACR,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAK5B,CAAC;gBACF,OAAO;oBACL,IAAI,EAAE,6BAA6B,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC;oBACjE,OAAO,EAAE,mCAAmC,CAAC,MAAM,CAAC,OAAO,CAAC;iBAC7D,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IACE,GAAG,YAAY,KAAK;oBACpB,MAAM,IAAI,GAAG;oBACZ,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAChD,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO;YACvB,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACpD,MAAM,OAAO,GAAG,GAAG,QAAQ,MAAM,CAAC;YAClC,MAAM,KAAK,GAA6B,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YACtE,MAAM,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YAChE,MAAM,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAClC,CAAC;KACF,CAAC;IACF,OAAO,8BAA8B,CAAC,EAAE,CAAC,CAAC;AAC5C,CAAC"}

package/dist/routes/mcp.d.ts

@@ -19,9 +19,10 @@
 import { Hono } from "hono";
 import type { Logger } from "pino";
 import type { DataPortabilityGatewayConfig, GatewayClient } from "@opendatalabs/vana-sdk/node";
-import { buildMcpUrl, buildStableMcpUrl, type McpProofReplayStore, type McpConnectionRecord, type McpConnectionStore, type McpSessionStore, type McpOAuthAuthorizationStore, type McpActivityRecorder, type McpScopeRequestApprovalUrlHook } from "@opendatalabs/personal-server-ts-core/mcp";
+import { buildMcpUrl, buildStableMcpUrl, type McpProofReplayStore, type McpConnectionRecord, type McpConnectionStore, type McpSessionStore, type McpOAuthAuthorizationStore, type McpOAuthClientStore, type McpActivityRecorder, type McpScopeRequestApprovalUrlHook } from "@opendatalabs/personal-server-ts-core/mcp";
 import type { PersonalServerReadFulfillmentReporter } from "@opendatalabs/personal-server-ts-core/api";
 import type { AccessLogWriter } from "@opendatalabs/personal-server-ts-core/logging/access-log";
+import type { WriteSessionStore } from "@opendatalabs/personal-server-ts-core/write";
 import type { ServerSigner } from "@opendatalabs/personal-server-ts-core/signing";
 import type { HierarchyManagerOptions } from "@opendatalabs/personal-server-ts-core/storage/hierarchy";
 import type { IndexManager } from "@opendatalabs/personal-server-ts-core/storage/index";
@@ -82,6 +83,8 @@ export interface McpRouteDeps {
      * `/mcp/oauth/token`, and the owner approval endpoint.
      */
     oauthAuthorizationStore?: McpOAuthAuthorizationStore;
+    /** DCR client metadata, read back at authorize to name the connection. */
+    oauthClientStore?: McpOAuthClientStore;
     /** Activity recorder for live MCP call visibility. */
     activityRecorder?: McpActivityRecorder;
     /**
@@ -95,6 +98,19 @@ export interface McpRouteDeps {
      * user. Absent: the agent is told to wait for approval in Vana.
      */
     scopeRequestApprovalUrl?: McpScopeRequestApprovalUrlHook;
+    /**
+     * MCP writes (`remember`): the store the data route redeems write sessions
+     * from, and a dispatcher into the mounted data route. Absent: MCP stays
+     * read-only and `remember` answers write_unavailable.
+     */
+    mcpWrites?: {
+        sessionStore: WriteSessionStore;
+        dispatch(request: Request): Promise<Response>;
+    };
+    /** Loopback auth listener port; requests on it are local MCP clients. */
+    localApprovalPort?: number;
+    /** Main (tunneled) port; a collision with `localApprovalPort` disables local MCP. */
+    serverPort?: number;
 }
 /** Shared engine for ordinary MCP connections and authenticated TEE dispatch. */
 export declare function executeMcpConnectionRequest(request: Request, connection: McpConnectionRecord, deps: McpRouteDeps): Promise<Response>;
@@ -109,7 +125,7 @@ export declare function mcpConnectionsRoutes(deps: McpRouteDeps): Hono;
  * Mount at `/` so the well-known documents are served from the PS origin and
  * Claude can discover auth for the stable `/mcp` resource.
  */
-export type McpOAuthRouteDeps = Pick<McpRouteDeps, "connectionStore" | "oauthAuthorizationStore" | "oauthApprovalUrl" | "serverOrigin" | "serverOwner" | "gateway" | "devToken" | "accessToken" | "tokenStore" | "gatewayConfig" | "serverSigner" | "mcpGrantTtlSeconds">;
+export type McpOAuthRouteDeps = Pick<McpRouteDeps, "connectionStore" | "oauthAuthorizationStore" | "oauthClientStore" | "oauthApprovalUrl" | "serverOrigin" | "serverOwner" | "gateway" | "devToken" | "accessToken" | "tokenStore" | "gatewayConfig" | "serverSigner" | "mcpGrantTtlSeconds" | "localApprovalPort" | "serverPort">;
 export declare function mcpOAuthRoutes(deps: McpOAuthRouteDeps): Hono;
 /**
  * Hono sub-app for the Claude-facing Streamable HTTP endpoint.

package/dist/routes/mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../src/routes/mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AACnC,OAAO,KAAK,EACV,4BAA4B,EAC5B,aAAa,EACd,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAML,WAAW,EACX,iBAAiB,EAWjB,KAAK,mBAAmB,EAwBxB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,0BAA0B,EAC/B,KAAK,mBAAmB,EACxB,KAAK,8BAA8B,EACpC,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAGV,qCAAqC,EACtC,MAAM,2CAA2C,CAAC;AAUnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAChG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+CAA+C,CAAC;AAClF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yDAAyD,CAAC;AACvG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACxF,OAAO,KAAK,EACV,eAAe,EACf,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAIpD,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,+EAA+E;IAC/E,aAAa,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC9B,YAAY,CAAC,EAAE,IAAI,CACjB,YAAY,EACZ,uBAAuB,GAAG,sBAAsB,CACjD,CAAC;IACF,OAAO,EAAE,aAAa,CAAC;IACvB,aAAa,CAAC,EAAE,CAAC,4BAA4B,GAAG;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;IACzE;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,eAAe,EAAE,eAAe,CAAC;IACjC,uBAAuB,CAAC,EAAE,qCAAqC,CAAC;IAChE,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAC3C,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;IAC9C,2DAA2D;IAC3D,eAAe,CAAC,EAAE,kBAAkB,CAAC;IACrC;;;;OAIG;IACH,YAAY,CAAC,EAAE,eAAe,CAAC;IAC/B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,mBAAmB,CAAC;IACvC;;;OAGG;IACH,uBAAuB,CAAC,EAAE,0BAA0B,CAAC;IACrD,sDAAsD;IACtD,gBAAgB,CAAC,EAAE,mBAAmB,CAAC;IACvC;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IAC3C;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,8BAA8B,CAAC;CAC1D;AAuJD,iFAAiF;AACjF,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,OAAO,EAChB,UAAU,EAAE,mBAAmB,EAC/B,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,QAAQ,CAAC,CAoBnB;AA2BD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAqO7D;AAED;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAClC,YAAY,EACV,iBAAiB,GACjB,yBAAyB,GACzB,kBAAkB,GAClB,cAAc,GACd,aAAa,GACb,SAAS,GACT,UAAU,GACV,aAAa,GACb,YAAY,GACZ,eAAe,GACf,cAAc,GACd,oBAAoB,CACvB,CAAC;AAEF,wBAAgB,cAAc,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI,CAwU5D;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAwThE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAkC1D;AAED,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC"}
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../src/routes/mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AACnC,OAAO,KAAK,EACV,4BAA4B,EAC5B,aAAa,EACd,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAML,WAAW,EACX,iBAAiB,EAYjB,KAAK,mBAAmB,EA2BxB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,0BAA0B,EAE/B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,8BAA8B,EACpC,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAGV,qCAAqC,EACtC,MAAM,2CAA2C,CAAC;AAWnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAChG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,6CAA6C,CAAC;AAErF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+CAA+C,CAAC;AAClF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yDAAyD,CAAC;AACvG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACxF,OAAO,KAAK,EACV,eAAe,EACf,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAIpD,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,+EAA+E;IAC/E,aAAa,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC9B,YAAY,CAAC,EAAE,IAAI,CACjB,YAAY,EACZ,uBAAuB,GAAG,sBAAsB,CACjD,CAAC;IACF,OAAO,EAAE,aAAa,CAAC;IACvB,aAAa,CAAC,EAAE,CAAC,4BAA4B,GAAG;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;IACzE;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,eAAe,EAAE,eAAe,CAAC;IACjC,uBAAuB,CAAC,EAAE,qCAAqC,CAAC;IAChE,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAC3C,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;IAC9C,2DAA2D;IAC3D,eAAe,CAAC,EAAE,kBAAkB,CAAC;IACrC;;;;OAIG;IACH,YAAY,CAAC,EAAE,eAAe,CAAC;IAC/B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,mBAAmB,CAAC;IACvC;;;OAGG;IACH,uBAAuB,CAAC,EAAE,0BAA0B,CAAC;IACrD,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,mBAAmB,CAAC;IACvC,sDAAsD;IACtD,gBAAgB,CAAC,EAAE,mBAAmB,CAAC;IACvC;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IAC3C;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,8BAA8B,CAAC;IACzD;;;;OAIG;IACH,SAAS,CAAC,EAAE;QACV,YAAY,EAAE,iBAAiB,CAAC;QAChC,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;KAC/C,CAAC;IACF,yEAAyE;IACzE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,qFAAqF;IACrF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAgPD,iFAAiF;AACjF,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,OAAO,EAChB,UAAU,EAAE,mBAAmB,EAC/B,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,QAAQ,CAAC,CAsBnB;AA2BD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAqO7D;AAED;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAClC,YAAY,EACV,iBAAiB,GACjB,yBAAyB,GACzB,kBAAkB,GAClB,kBAAkB,GAClB,cAAc,GACd,aAAa,GACb,SAAS,GACT,UAAU,GACV,aAAa,GACb,YAAY,GACZ,eAAe,GACf,cAAc,GACd,oBAAoB,GACpB,mBAAmB,GACnB,YAAY,CACf,CAAC;AAEF,wBAAgB,cAAc,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI,CA+V5D;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CA6ThE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAkC1D;AAED,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC"}

package/dist/routes/mcp.js

@@ -18,16 +18,40 @@
  */
 import { randomBytes } from "node:crypto";
 import { Hono } from "hono";
-import { approveMcpOAuthAuthorization, approveMcpOAuthAuthorizationWithScopes, approveMcpConnection, approveMcpScopeAccessRequest, buildMcpProtectedResourceMetadataUrl, buildMcpUrl, buildStableMcpUrl, createInMemoryMcpOAuthAuthorizationStore, createMcpConnection, createMcpOAuthAuthorization, createInMemoryMcpConnectionStore, createInMemoryMcpSessionStore, createInMemoryMcpProofReplayStore, createMcpSession, createMcpSessionAuthPort, buildMcpSessionConnection, createMcpDataReadClient, denyMcpScopeAccessRequest, getMcpConnectionView, handleMcpStreamableHttpRequest, hashConnectionToken, listMcpConnectionViews, loadMcpGranteeAccount, MCP_CONNECTION_NOT_FOUND, McpConnectionNotFoundError, McpConnectionStateError, McpOAuthAuthorizationError, isAllowedOAuthRedirectUri, McpScopeRequestError, MCP_SCOPE_REQUEST_NOT_FOUND, MCP_SCOPE_REQUEST_TOKEN_HEADER, readMcpScopeRequestWithToken, redeemMcpOAuthAuthorizationCode, refreshMcpOAuthToken, requestMcpScopeAccess, toMcpOAuthAuthorizationView, revokeMcpConnection, toMcpConnectionView, } from "@opendatalabs/personal-server-ts-core/mcp";
+import { approveMcpOAuthAuthorization, approveMcpOAuthAuthorizationWithScopes, approveMcpConnection, approveMcpScopeAccessRequest, buildMcpProtectedResourceMetadataUrl, buildMcpUrl, buildStableMcpUrl, createInMemoryMcpOAuthAuthorizationStore, createInMemoryMcpOAuthClientStore, createMcpConnection, createMcpOAuthAuthorization, createInMemoryMcpConnectionStore, createInMemoryMcpSessionStore, createInMemoryMcpProofReplayStore, createMcpSession, createMcpSessionAuthPort, buildMcpSessionConnection, createMcpDataReadClient, createMcpDataWriteClient, denyMcpScopeAccessRequest, getMcpConnectionView, handleMcpStreamableHttpRequest, hashConnectionToken, listMcpConnectionViews, loadMcpGranteeAccount, MCP_CONNECTION_NOT_FOUND, McpConnectionNotFoundError, McpConnectionStateError, McpIngress, McpOAuthAuthorizationError, isAllowedOAuthRedirectUri, McpScopeRequestError, MCP_SCOPE_REQUEST_NOT_FOUND, MCP_SCOPE_REQUEST_TOKEN_HEADER, readMcpScopeRequestWithToken, redeemMcpOAuthAuthorizationCode, refreshMcpOAuthToken, requestMcpScopeAccess, toMcpOAuthAuthorizationView, revokeMcpConnection, toMcpConnectionView, } from "@opendatalabs/personal-server-ts-core/mcp";
 import { ProtocolError } from "@opendatalabs/personal-server-ts-core/errors";
 import { createServerApiAuth } from "../api-auth.js";
 import { createBodyLimit, DEFAULT_MAX_SIZE } from "../middleware/body-limit.js";
+import { arrivedOnLoopbackListener } from "../middleware/local-listener.js";
 import { authenticateRequest, isWeb3SignedLifetimeError, web3SignedProofId, boundedProofExpiry, } from "@opendatalabs/personal-server-ts-core/auth";
+import { verifyDataWritePolicy } from "@opendatalabs/personal-server-ts-core/policy";
 import { withLegacyProjection } from "@opendatalabs/personal-server-ts-core/storage/legacy-projection";
 import { createNodeDataStorage } from "../storage/node-data-storage.js";
 function resolveOrigin(origin) {
     return typeof origin === "function" ? origin() : origin;
 }
+/** Which listener accepted the request: the loopback one or the tunneled main one. */
+function requestIngress(c, deps) {
+    const listeners = {
+        localApprovalPort: deps.localApprovalPort,
+        serverPort: deps.serverPort,
+    };
+    return arrivedOnLoopbackListener(c, listeners)
+        ? McpIngress.Loopback
+        : McpIngress.Public;
+}
+/**
+ * The origin every OAuth/discovery URL in this response must name. A local
+ * client on the loopback listener gets the exact origin it called (RFC 9728:
+ * the advertised resource must match the URL the client used, so `localhost`
+ * and `127.0.0.1` differ); everyone else gets the public origin.
+ */
+function requestOrigin(c, deps) {
+    if (requestIngress(c, deps) === McpIngress.Public) {
+        return resolveOrigin(deps.serverOrigin);
+    }
+    return new URL(c.req.url).origin;
+}
 function jsonError(status, errorCode, message) {
     return {
         error: { code: status, errorCode, message },
@@ -59,6 +83,33 @@ const SUPPORTED_GRANT_TYPES = [
 function isSupportedGrantType(value) {
     return SUPPORTED_GRANT_TYPES.includes(value);
 }
+/** Longest DCR client_name kept, in code points; it labels the connection. */
+const MAX_CLIENT_NAME_CHARS = 64;
+const MAX_CLIENT_URI_CHARS = 2048;
+/** Control and format chars: NUL, newlines, bidi overrides, zero-width. */
+const INVISIBLE_CHARS = /[\p{Cc}\p{Cf}]/gu;
+const WEB_PROTOCOLS = new Set(["https:", "http:"]);
+/** A printable label from an untrusted string, e.g. " Maple\u202e " → "Maple". */
+function cleanClientName(value) {
+    if (typeof value !== "string")
+        return undefined;
+    const visible = value.replace(INVISIBLE_CHARS, "").trim();
+    const capped = Array.from(visible).slice(0, MAX_CLIENT_NAME_CHARS).join("");
+    return capped.trim() || undefined;
+}
+/** An http(s) URL or nothing: the owner may be shown it as a link. */
+function cleanClientUri(value) {
+    if (typeof value !== "string" || value.length > MAX_CLIENT_URI_CHARS) {
+        return undefined;
+    }
+    try {
+        const url = new URL(value.trim());
+        return WEB_PROTOCOLS.has(url.protocol) ? url.href : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 function authorizationServerMetadata(origin) {
     return {
         issuer: origin,
@@ -140,6 +191,31 @@ function buildDataApiDeps(deps) {
         logger: deps.logger,
     };
 }
+/** Writes as the connection grantee, when the host wired MCP writes. */
+function buildWriteClient(deps, granteeAccount, storage) {
+    const serverOwner = deps.serverOwner;
+    if (!deps.mcpWrites || !serverOwner)
+        return undefined;
+    return createMcpDataWriteClient({
+        serverOrigin: resolveOrigin(deps.serverOrigin),
+        granteeAccount,
+        storage,
+        sessionStore: deps.mcpWrites.sessionStore,
+        dispatch: deps.mcpWrites.dispatch,
+        authorize: async ({ scope, grantId }) => {
+            await verifyDataWritePolicy({
+                signer: granteeAccount.address,
+                grantId,
+                requestedScope: scope,
+                serverOwner,
+            }, {
+                authSessionVerifier: deps.gateway,
+                grantVerifier: deps.gateway,
+                runtimeAvailability: deps.runtimeAvailability,
+            });
+        },
+    });
+}
 /** Shared engine for ordinary MCP connections and authenticated TEE dispatch. */
 export function executeMcpConnectionRequest(request, connection, deps) {
     const granteeAccount = loadMcpGranteeAccount({
@@ -147,13 +223,15 @@ export function executeMcpConnectionRequest(request, connection, deps) {
         publicKey: connection.granteePublicKey,
         encryptedPrivateKey: connection.encryptedGranteePrivateKey,
     });
+    const dataApiDeps = buildDataApiDeps(deps);
     return handleMcpStreamableHttpRequest(request, {
         connection,
         readClient: createMcpDataReadClient({
             serverOrigin: resolveOrigin(deps.serverOrigin),
             granteeAccount,
-            dataApiDeps: buildDataApiDeps(deps),
+            dataApiDeps,
         }),
+        writeClient: buildWriteClient(deps, granteeAccount, dataApiDeps.storage),
         activityRecorder: deps.activityRecorder,
         // Denied tool calls are recorded by the wrapper, not the read path.
         reporterDeps: {
@@ -401,6 +479,7 @@ export function mcpOAuthRoutes(deps) {
     app.use("*", createBodyLimit(DEFAULT_MAX_SIZE));
     const connectionStore = deps.connectionStore ?? createInMemoryMcpConnectionStore();
     const authorizationStore = deps.oauthAuthorizationStore ?? createInMemoryMcpOAuthAuthorizationStore();
+    const clientStore = deps.oauthClientStore ?? createInMemoryMcpOAuthClientStore();
     const ownerAuth = createServerApiAuth({
         serverOrigin: deps.serverOrigin,
         serverOwner: deps.serverOwner,
@@ -422,10 +501,10 @@ export function mcpOAuthRoutes(deps) {
         }
     }
     app.get("/.well-known/oauth-protected-resource/mcp", (c) => resolveApprovalUrl(deps)
-        ? c.json(protectedResourceMetadata(resolveOrigin(deps.serverOrigin)))
+        ? c.json(protectedResourceMetadata(requestOrigin(c, deps)))
         : c.json(jsonError(404, "MCP_OAUTH_NOT_CONFIGURED", "MCP OAuth is not configured"), 404));
     app.get("/.well-known/oauth-authorization-server", (c) => resolveApprovalUrl(deps)
-        ? c.json(authorizationServerMetadata(resolveOrigin(deps.serverOrigin)))
+        ? c.json(authorizationServerMetadata(requestOrigin(c, deps)))
         : c.json(jsonError(404, "MCP_OAUTH_NOT_CONFIGURED", "MCP OAuth is not configured"), 404));
     app.post("/mcp/oauth/register", async (c) => {
         if (!resolveApprovalUrl(deps)) {
@@ -445,9 +524,20 @@ export function mcpOAuthRoutes(deps) {
                 error_description: "One or more redirect_uris are not allowed",
             }, 400);
         }
+        // Kept so /authorize can name the connection after the client.
+        const clientName = cleanClientName(body.client_name);
+        const clientUri = cleanClientUri(body.client_uri);
+        const client = {
+            clientId: `mcp-client-${crypto.randomUUID()}`,
+            ...(clientName ? { clientName } : {}),
+            ...(clientUri ? { clientUri } : {}),
+            createdAt: new Date().toISOString(),
+        };
+        await clientStore.create(client);
         return c.json({
-            client_id: `mcp-client-${crypto.randomUUID()}`,
-            client_name: body.client_name ?? "Claude",
+            client_id: client.clientId,
+            ...(clientName ? { client_name: clientName } : {}),
+            ...(clientUri ? { client_uri: clientUri } : {}),
             redirect_uris: Array.isArray(body.redirect_uris)
                 ? body.redirect_uris
                 : [],
@@ -460,7 +550,7 @@ export function mcpOAuthRoutes(deps) {
         if (!resolveApprovalUrl(deps)) {
             return c.json(jsonError(404, "MCP_OAUTH_NOT_CONFIGURED", "MCP OAuth is not configured"), 404);
         }
-        const origin = resolveOrigin(deps.serverOrigin);
+        const origin = requestOrigin(c, deps);
         const url = new URL(c.req.url);
         const responseType = url.searchParams.get("response_type");
         const clientId = url.searchParams.get("client_id") ?? "";
@@ -473,13 +563,18 @@ export function mcpOAuthRoutes(deps) {
             return redirectWithOAuthError(redirectUri, "unsupported_response_type", "Only response_type=code is supported", state);
         }
         try {
+            // Unknown ids (registered elsewhere or before) get the default name.
+            const client = clientId ? await clientStore.getById(clientId) : null;
             const created = await createMcpOAuthAuthorization({
                 clientId,
+                clientName: client?.clientName,
+                clientUri: client?.clientUri,
                 redirectUri,
                 codeChallenge,
                 codeChallengeMethod,
                 scope,
                 ...(state ? { state } : {}),
+                ingress: requestIngress(c, deps),
             }, {
                 connectionStore,
                 authorizationStore,
@@ -491,7 +586,8 @@ export function mcpOAuthRoutes(deps) {
             }
             const approve = new URL(approvalUrl);
             approve.searchParams.set("mcp_authorization", created.authorizationId);
-            approve.searchParams.set("ps_origin", origin);
+            // The approver signs for the registered public origin, never loopback.
+            approve.searchParams.set("ps_origin", resolveOrigin(deps.serverOrigin));
             return c.redirect(approve.toString(), 302);
         }
         catch (err) {
@@ -652,6 +748,7 @@ export function mcpStreamableHttpRoutes(deps) {
         const response = await handleMcpStreamableHttpRequest(c.req.raw, {
             connection: record,
             readClient,
+            writeClient: buildWriteClient(deps, granteeAccount, dataApiDeps.storage),
             activityRecorder: deps.activityRecorder,
             requestScopeAccess: async (input) => {
                 return requestMcpScopeAccess({ connectionId: record.id, ...input }, { store });
@@ -744,19 +841,22 @@ export function mcpStreamableHttpRoutes(deps) {
             if (!options.oauthChallenge) {
                 return c.json(jsonError(401, "INVALID_TOKEN", "Missing MCP connection token"), 401);
             }
-            return mcpUnauthorized(resolveOrigin(deps.serverOrigin));
+            return mcpUnauthorized(requestOrigin(c, deps));
         }
         const tokenHash = await hashConnectionToken(rawToken);
         const record = await store.getByTokenHash(tokenHash);
-        if (record)
+        // A token presented on the other listener reads as unknown.
+        const ingress = record?.ingress ?? McpIngress.Public;
+        if (record && ingress === requestIngress(c, deps)) {
             return handleConnectionRead(c, record);
+        }
         const session = await sessionStore.getByTokenHash(tokenHash);
         if (session)
             return handleSessionRead(c, session);
         if (!options.oauthChallenge) {
             return c.json(jsonError(401, "INVALID_TOKEN", "Unknown or revoked MCP connection"), 401);
         }
-        return mcpUnauthorized(resolveOrigin(deps.serverOrigin), "Unknown or revoked MCP connection");
+        return mcpUnauthorized(requestOrigin(c, deps), "Unknown or revoked MCP connection");
     }
     // Self-signing handshake (Option A): the app proves control of its key + DCR
     // grant with a Web3Signed proof, and gets a short-lived bearer session token.