@cef-ai/vault-sdk 3.3.0 → 4.0.0

package/dist/core/grant-doc.js

@@ -0,0 +1,603 @@
+// src/core/grant-doc.ts
+//
+// The canonical grant document — the bytes a vault owner signs to say "this
+// person holds this role and these scopes on this vault" — and the check that
+// a served signature is theirs.
+//
+// This is the TypeScript mirror of ddc-node's
+// `pkg/compute/vault/grantsig.go` — the implementation moved there from
+// `internal/compute/vault/authz` when the orchestrator became its second
+// reader, and `authz` is now a delegation shim, so the `authz.*` names used
+// throughout these comments all forward to that file. Its whole reason to
+// exist is
+// that `GET /api/v1/vaults/:vaultId/roster/signed` is only worth serving if a
+// party that is NOT vault-api can check it. If every consumer had to
+// re-implement base64 → ed25519 → schema check by hand, most would check the
+// signature and then read the response's own convenience fields, which is a
+// decorative signature: verifying one thing and enforcing another.
+//
+// # Read role and scopes out of the DOCUMENT, never off the response
+//
+// `SignedGrant.role` and `SignedGrant.scopes` are a RENDERING of `doc` that
+// vault-api provides for display. They are deliberately typed as plain
+// strings here, not as `MemberRole`/`ScopeGrants`, so that feeding them
+// straight into code that decides access is awkward rather than natural.
+// `verifySignedRoster` returns `Grant`s decoded from the verified bytes; those
+// are the values to act on.
+//
+// # The document is verified as received, never re-encoded
+//
+// `verifyGrantSig` checks the signature over the exact bytes it was handed.
+// It does NOT rebuild them with `canonicalGrantBytes` and compare: a verifier
+// that re-encodes is checking bytes it just composed itself, and it would
+// start rejecting perfectly valid documents the moment this encoder and the
+// server's drifted by a space. Go's `DecodeGrantDoc` is a reader for the same
+// reason. `canonicalGrantBytes` exists for the SIGNING side (whoever mints a
+// grant must produce bytes vault-api will accept) and for tests.
+//
+// # Mirroring Go's encoder exactly, in the two places it is not obvious
+//
+// 1. `encoding/json` escapes `<`, `>` and `&` as the six-character escapes
+//    `\u003c`, `\u003e`, `\u0026`
+//    (`SetEscapeHTML` defaults to true), plus U+2028/U+2029. `JSON.stringify`
+//    escapes none of them. A scope named `a<b` would otherwise produce
+//    different bytes on the two sides and a signature that never verifies.
+// 2. Go sorts scope names as raw UTF-8 byte strings, which is code-point
+//    order. JavaScript's `<` compares UTF-16 code units, which disagrees for
+//    astral characters: `"😀" < "Ａ"` is true in UTF-16 and false by code
+//    point. `compareCodePoints` below sorts the way Go does.
+//
+// 3. `issuedAt` and `expiresAt` are STRINGS carried verbatim, never `Date`s.
+//    Go's `encoding/json` would trim trailing zeros off a re-marshalled
+//    fraction (`…:56.100Z` → `…:56.1Z`), so neither side may re-format what
+//    the other signed. Whatever string the signer chose is what goes in the
+//    bytes.
+//
+// 4. `expiresAt` IS ALWAYS PRESENT, and "no expiry" is the EMPTY STRING
+//    (`NO_GRANT_EXPIRY`) rather than a dropped key or a `null`. One document
+//    shape, always: omitting the field would make a never-expires grant
+//    byte-identical to a document minted before the field existed, so every
+//    signature already stored would verify as a brand-new unlimited grant.
+//    See `NO_GRANT_EXPIRY`.
+//
+// Both are pinned by golden vectors produced by running the real Go function
+// (see `grant-doc.test.ts`), not by reading its source and guessing.
+//
+// # A GRANT DOCUMENT IS AUTHORITY ONLY WHEN YOU FETCHED IT YOURSELF
+//
+// This mirrors `pkg/compute/vault/grantsig.go`'s rule, and it is the reason
+// `verifySignedRoster` takes a whole roster rather than a loose grant.
+//
+// A verified signature proves the vault owner once signed these bytes. It does
+// NOT prove the grant still stands: revocation deletes the membership row and
+// cannot reach back and unsign a document somebody already saved. `issuedAt`
+// does not change that — a timestamp bounds how OLD a document is, never
+// whether it was WITHDRAWN.
+//
+// So: fetch the signed roster yourself, verify it, and act on what it
+// contains. Absence from a freshly fetched roster is what revocation looks
+// like, and it is the only signal that carries it. Accepting a document a
+// caller HANDS you and authorising them on it is wrong in a way that passes
+// every test — a revoked member's saved grant verifies forever — and checking
+// that its `issuedAt` is recent does not fix it, it only narrows the window.
+import * as ed from "@noble/ed25519";
+// The `./blake2` SUBPATH, not the package root. Both work at runtime, but
+// 14.0.3's root barrel does not re-export either blake2 name to
+// TypeScript (`encodeAddress` and the rest come through fine), so the
+// root import compiles nowhere. `./blake2` is a declared export subpath.
+import { blake2AsHex } from "@polkadot/util-crypto/blake2";
+import { decodeBase64, hexToBytes, strip0xHex } from "./canonical.js";
+const enc = new TextEncoder();
+const dec = new TextDecoder();
+/**
+ * The schema string carried INSIDE the signed bytes (`authz.GrantSchema`).
+ *
+ * A v2 changes this string, so a v1 signature can never be replayed as a v2
+ * grant — which is why `decodeGrantDoc` refuses any other value instead of
+ * handing a v2 document's fields to a v1 reader under a signature that is
+ * perfectly valid for the v2 meaning.
+ */
+export const GRANT_SCHEMA = "cere.vault.grant.v1";
+/**
+ * The header a membership write carries the vault owner's grant signature in
+ * (`authz.GrantSignatureHeader`), hex, with or without an `0x` prefix.
+ *
+ * A HEADER OF ITS OWN, not the wallet auth's `X-Signature`, because the two
+ * cover different bytes: `X-Signature` covers the request BODY and
+ * authenticates the CALLER (who may be an admin acting for the owner), while
+ * this covers the canonical grant document and attests the OWNER's
+ * authorisation of that exact grant. The body of `PUT .../members` is
+ * `{"role":…,"timestamp":…}` — the vault id and the member's key are URL
+ * parameters and never enter the signed bytes — so one owner-signed
+ * `{"role":"admin",…}` would otherwise verify identically for every member of
+ * every vault that owner holds.
+ */
+export const GRANT_SIGNATURE_HEADER = "X-Grant-Signature";
+/**
+ * The header carrying the `issuedAt` the signed document was minted with
+ * (`pkgvault.GrantIssuedAtHeader`).
+ *
+ * vault-api does not RECEIVE the grant document, it REBUILDS it — from the URL
+ * parameters, the body, and the other half read back from its store — and then
+ * checks your signature over what it built. Every field must therefore be
+ * something the server can reproduce, and a mint time is the one thing it
+ * cannot: a server-chosen `now` would never equal yours. So it travels beside
+ * the signature.
+ *
+ * NOT the body's `timestamp`, even though every mutation body already carries
+ * one and the wallet middleware already bounds its skew. The signer and the
+ * sender are different parties: the route admits an admin, but the document
+ * must be signed by the VAULT's wallet, so an admin presents a grant their
+ * owner signed out of band. Binding the mint time to the request body would
+ * make the owner predict the admin's exact timestamp string, and the skew
+ * window would expire their pre-signed grant in five minutes.
+ */
+export const GRANT_ISSUED_AT_HEADER = "X-Grant-Issued-At";
+/**
+ * `auth.CanonicalPubKeyHex`, reproduced: `0x`-prefixed lowercase hex, or the
+ * input UNCHANGED when it is not hex at all.
+ *
+ * THE SERVER APPLIES THIS TO THE URL PARAMETER BEFORE IT BUILDS THE DOCUMENT
+ * (`memberPubkeyParam`), so a signer that skips it produces a perfectly valid
+ * signature over bytes the server never derives — the failure that presents
+ * as a key problem rather than a spelling one. Callers have always been
+ * allowed to pass a bare or upper-case key (the store canonicalises on the
+ * way in), so signing their exact spelling would break the writes that work
+ * today.
+ *
+ * A non-hex value passes through untouched, exactly as Go's does: a malformed
+ * key must reach the server as the caller wrote it and be refused there,
+ * rather than be silently rewritten into a different key here.
+ */
+export function canonicalPubkeyHex(s) {
+    // `normalizeHexKey`: TrimPrefix "0x" THEN TrimPrefix "0X" — one each, in
+    // that order — then lower-case. Reproduced literally rather than as one
+    // regex so the two implementations can be read side by side.
+    let bare = s.startsWith("0x") ? s.slice(2) : s;
+    if (bare.startsWith("0X"))
+        bare = bare.slice(2);
+    bare = bare.toLowerCase();
+    // `bare == ""` and a `hex.DecodeString` failure — which includes an
+    // ODD-LENGTH string — both return the input unchanged.
+    if (bare === "" || bare.length % 2 !== 0 || !/^[0-9a-f]+$/.test(bare))
+        return s;
+    return `0x${bare}`;
+}
+/**
+ * The vault id a wallet key owns — `pkgvault.IDFor`, reproduced.
+ *
+ * `"v-"` + blake2b-128 of the key's CANONICAL HEX SPELLING, as 32 lowercase
+ * hex characters.
+ *
+ * # This is a one-way function, and that is the whole point
+ *
+ * It runs pubkey -> id. It does NOT run backwards, and no amount of holding
+ * an id recovers the key that made it: blake2b-128 is a hash. What a caller
+ * holding only a vault id CAN do is the inverse QUESTION rather than the
+ * inverse function — take a candidate key and ask whether it derives that id.
+ * That single check is what turns `verifySignedRoster` from a consistency
+ * test into a verification, because the id came from outside the response
+ * and the key inside it now has to match something the attacker cannot
+ * choose.
+ *
+ * # Two ways to get this wrong, both of which produce a plausible id
+ *
+ * 1. The key is hashed as its hex TEXT (Go writes `[]byte(walletPubkeyHex)`),
+ *    never as the 32 bytes that text denotes. `@polkadot`'s `blake2AsHex`
+ *    decodes a `0x`-prefixed STRING as hex, so it must be handed encoded
+ *    bytes — passing the spelling straight in silently hashes the wrong
+ *    input.
+ * 2. Because the text is the input, the SPELLING is part of it: `deadbeef`,
+ *    `0xdeadbeef` and `0xDEADBEEF` are three different vault ids in Go.
+ *    Callers have always been allowed any of those spellings, so the
+ *    canonical form is applied first — the same rule the server derives with.
+ *
+ * Both are pinned by golden vectors taken from the running Go function.
+ */
+export function vaultIdFor(walletPubkeyHex) {
+    const canonical = canonicalPubkeyHex(walletPubkeyHex);
+    // `enc.encode` first — see (1) above; `blake2AsHex` returns `0x`-prefixed
+    // hex where Go's `hex.EncodeToString` does not, hence the slice.
+    return `v-${blake2AsHex(enc.encode(canonical), 128).slice(2)}`;
+}
+/**
+ * The ONE spelling of "this membership does not expire": the empty string,
+ * always emitted, never an absent key and never `null`.
+ *
+ * A FIXED SENTINEL so the canonical document has exactly one shape. Two shapes
+ * is how a signature comes to verify against bytes the other side never
+ * builds, and here conditional omission would be worse than ambiguous: a
+ * document that DROPPED `expiresAt` when there is no expiry is byte-identical
+ * to a document minted before the field existed, so every signature already
+ * stored would verify as a brand-new never-expires grant. Emitting `""` makes
+ * those older bytes unbuildable, which is the version gate this change would
+ * otherwise have to spend a new {@link GRANT_SCHEMA} string on.
+ *
+ * The empty string also cannot be mistaken for a moment — no RFC 3339 spelling
+ * is empty — so, unlike a far-future sentinel instant, nothing downstream can
+ * parse it into a date and silently act on the year 9999.
+ */
+export const NO_GRANT_EXPIRY = "";
+/**
+ * Tags a timestamp string as the grant's expiry.
+ *
+ * It does NOT validate: the string is carried into the signed bytes verbatim
+ * and neither side parses or re-formats it, so a check here would be a second
+ * opinion about a value the server rebuilds from what you sent. vault-api DOES
+ * validate — `PUT …/members` 400s an `expiresAt` that is not RFC 3339, because
+ * that value also has to reach a `timestamptz` column — so a malformed expiry
+ * is refused at the one place that can refuse it usefully.
+ *
+ * Pass the SAME string you put in the request body. Formatting a `Date` twice
+ * is how the two copies drift by a trimmed fractional zero.
+ */
+export function grantExpiry(rfc3339) {
+    return rfc3339;
+}
+/**
+ * A signed grant that could not be trusted: the signature does not verify,
+ * the document does not decode, its schema is unknown, or it describes a
+ * different membership from the one it was served under.
+ *
+ * A THROWN error rather than a filtered-out entry, because every one of those
+ * states on an authorization artifact means the response is not what it
+ * claims to be. Silently dropping the bad entry and returning the rest would
+ * hand a caller a shorter roster that looks complete. `memberPubkey` names
+ * the entry so an operator can find it.
+ */
+export class GrantVerificationError extends Error {
+    memberPubkey;
+    constructor(message, 
+    /**
+     * The member the failure is about, or `""` when it is about the ENVELOPE
+     * — a missing anchor, a roster for the wrong vault, a malformed shape —
+     * which belongs to no single entry.
+     */
+    memberPubkey = "") {
+        super(message);
+        this.memberPubkey = memberPubkey;
+        this.name = "GrantVerificationError";
+    }
+}
+/**
+ * The exact bytes a grant signature covers, mirroring
+ * `authz.CanonicalGrantBytes`.
+ *
+ * Every bound value is inside the output: a document proves ONE member's
+ * standing on ONE vault and nothing else. `scopes` is emitted as an ARRAY
+ * sorted by name — not as an object — because the ordering is then this
+ * function's own step and can be tested, where a JSON object would have the
+ * encoder sort the keys and a stability test would pass whatever this code
+ * did.
+ *
+ * An incomplete grant throws rather than producing shorter bytes: a document
+ * naming no vault or no member would verify perfectly and authorise nobody in
+ * particular. `issuedAt` is required on the same grounds — an empty one is a
+ * document with no mint time that verifies exactly as well as one with a mint
+ * time.
+ *
+ * `issuedAt` is LAST BUT ONE and `expiresAt` is LAST, mirroring Go's field and
+ * parameter order. In Go the map between `issuedAt` and the other strings is
+ * what makes a transposition a compile error instead of a valid signature over
+ * the wrong bytes; the one pair the map cannot sit between is `issuedAt` and
+ * `expiresAt`, which Go separates with a defined type and this file mirrors
+ * with {@link GrantExpiry}'s brand.
+ *
+ * `issuedAt` has NO DEFAULT on purpose: a `new Date().toISOString()` fallback
+ * would be a hidden clock inside the encoder, and a caller who forgot to pass
+ * one would silently sign a different moment from the one they sent. `scopes`
+ * loses its `= {}` default with it — a default that can never be used, because
+ * a required parameter follows, reads as an option and is not one. `expiresAt`
+ * has none for the sharper version of the same reason: its default would be
+ * "never expires", the one wrong answer that looks right.
+ *
+ * `expiresAt` is the ONE parameter with no emptiness check, because `""` is
+ * {@link NO_GRANT_EXPIRY} — a legal, common, deliberate value rather than a
+ * missing one.
+ */
+export function canonicalGrantBytes(vaultId, memberPubkey, role, scopes, issuedAt, expiresAt) {
+    if (vaultId === "")
+        throw new Error("canonical grant: vaultId is required");
+    if (memberPubkey === "")
+        throw new Error("canonical grant: memberPubkey is required");
+    if (role === "")
+        throw new Error("canonical grant: role is required");
+    if (issuedAt === "")
+        throw new Error("canonical grant: issuedAt is required");
+    const names = Object.keys(scopes).sort(compareCodePoints);
+    const parts = names.map((name) => `{"name":${goString(name)},"level":${goString(scopes[name])}}`);
+    // Hand-assembled rather than `JSON.stringify`d because the field ORDER is
+    // the wire contract (Go emits struct fields in declaration order) and
+    // because `goString` has to do the HTML escaping `JSON.stringify` will not.
+    const doc = `{"schema":${goString(GRANT_SCHEMA)},` +
+        `"vaultId":${goString(vaultId)},` +
+        `"memberPubkey":${goString(memberPubkey)},` +
+        `"role":${goString(role)},` +
+        `"scopes":[${parts.join(",")}],` +
+        `"issuedAt":${goString(issuedAt)},` +
+        `"expiresAt":${goString(expiresAt)}}`;
+    return enc.encode(doc);
+}
+/**
+ * Reads a canonical grant document back into its parts, mirroring
+ * `authz.DecodeGrantDoc`. Never re-encodes; the bytes stay the authority.
+ *
+ * Throws on an unknown schema (see `GRANT_SCHEMA`) and on the same three
+ * required fields the encoder refuses to omit.
+ */
+export function decodeGrantDoc(doc) {
+    if (doc.length === 0)
+        throw new Error("decode grant: empty document");
+    let raw;
+    try {
+        raw = JSON.parse(dec.decode(doc));
+    }
+    catch (err) {
+        throw new Error(`decode grant: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+        throw new Error("decode grant: document is not a JSON object");
+    }
+    const obj = raw;
+    const schema = stringField(obj, "schema");
+    if (schema !== GRANT_SCHEMA) {
+        throw new Error(`decode grant: schema ${JSON.stringify(schema)} is not ${JSON.stringify(GRANT_SCHEMA)}`);
+    }
+    const vaultId = stringField(obj, "vaultId");
+    const memberPubkey = stringField(obj, "memberPubkey");
+    const role = stringField(obj, "role");
+    if (vaultId === "" || memberPubkey === "" || role === "") {
+        throw new Error("decode grant: vaultId, memberPubkey and role are all required");
+    }
+    // `scopes` is an array in the document and a map here, exactly as Go's
+    // decoder does it: the array exists so the ENCODER's ordering is a testable
+    // step, and a decoder has no ordering left to prove — every consumer of a
+    // decoded grant asks "what level on scope X", which is a map question.
+    const rawScopes = obj.scopes;
+    if (!Array.isArray(rawScopes)) {
+        throw new Error("decode grant: scopes must be an array");
+    }
+    const scopes = {};
+    for (const entry of rawScopes) {
+        if (typeof entry !== "object" || entry === null || Array.isArray(entry)) {
+            throw new Error("decode grant: a scope entry is not an object");
+        }
+        const name = stringField(entry, "name");
+        if (name === "")
+            throw new Error("decode grant: a scope with no name");
+        scopes[name] = stringField(entry, "level");
+    }
+    // LAST, because the fields are checked in WIRE ORDER and `issuedAt` is the
+    // last field of the document. Required exactly as Go's decoder requires it:
+    // a document predating the field is REFUSED rather than passed on as a
+    // grant with no mint time.
+    const issuedAt = stringField(obj, "issuedAt");
+    if (issuedAt === "")
+        throw new Error("decode grant: issuedAt is required");
+    // PRESENCE, not emptiness, and the asymmetry with `issuedAt` above is the
+    // point: `""` is NO_GRANT_EXPIRY, a legal value most documents carry, while
+    // an ABSENT key is a document minted before the field existed — one whose
+    // signer attested a standing and never its duration. `stringField` already
+    // refuses absent ("got nothing") and `null` ("got object"), which is exactly
+    // what Go's `raw.ExpiresAt == nil` refuses; an `=== ""` guard here would make
+    // "this membership never expires" undecodable.
+    const expiresAt = stringField(obj, "expiresAt");
+    return { schema, vaultId, memberPubkey, role, scopes, issuedAt, expiresAt };
+}
+/**
+ * Is `sigHex` `orgWalletPubkeyHex`'s ed25519 signature over `doc`?
+ *
+ * A boolean, not a throw, because nothing here can be undecided: both inputs
+ * are in hand and the check is arithmetic. Malformed inputs (a key or
+ * signature of the wrong length, non-hex) are `false` rather than an
+ * exception, mirroring `authz.VerifyGrantSig` — the caller that needs to tell
+ * "nothing was sent" from "it does not verify" looks at the inputs itself.
+ *
+ * Hex is accepted with or without an `0x` prefix, in either case, because
+ * wallets and SDKs disagree about both.
+ */
+export async function verifyGrantSig(orgWalletPubkeyHex, doc, sigHex) {
+    if (doc.length === 0 || sigHex === "")
+        return false;
+    let pub;
+    let sig;
+    try {
+        pub = hexToBytes(strip0xHex(orgWalletPubkeyHex).toLowerCase());
+        sig = hexToBytes(strip0xHex(sigHex).toLowerCase());
+    }
+    catch {
+        return false;
+    }
+    if (pub.length !== 32 || sig.length !== 64)
+        return false;
+    try {
+        return await ed.verifyAsync(sig, doc, pub);
+    }
+    catch {
+        // @noble throws on a point that is not on the curve; that is a failed
+        // verification, not a caller error.
+        return false;
+    }
+}
+/**
+ * Verifies EVERY grant in a signed roster against the vault owner's key and
+ * returns the grants decoded from the verified bytes.
+ *
+ * This is the whole point of the signed roster: after this call you hold
+ * values that came out of bytes the vault owner signed, and you can throw the
+ * response away. Enforce on the returned `Grant`s — never on
+ * `SignedGrant.role` / `SignedGrant.scopes`, which are vault-api's rendering
+ * of the same document and are not covered by anything you checked.
+ *
+ * Three bindings are checked per entry, and the last two matter as much as
+ * the signature: the document must carry the schema this SDK understands, it
+ * must name the vault the roster is FOR, and it must name the member it was
+ * served UNDER. A document that verifies but describes a different membership
+ * is a valid signature over somebody else's grant — the substitution the
+ * canonical bytes bind all four values to prevent.
+ *
+ * Fail-closed: the FIRST unverifiable entry throws
+ * `GrantVerificationError` and no partial list is returned. An authorization
+ * artifact with one entry you cannot prove is not a shorter roster, it is a
+ * roster you cannot trust.
+ *
+ * # `expectedVaultId` is the trust anchor, and it is why this is a
+ * # verification rather than a consistency check
+ *
+ * PASS THE ID YOU ASKED FOR — the same one handed to
+ * `sdk.memberships.signedRoster()`. It is required, and the requirement is
+ * the fix for the hole it closes:
+ *
+ * Every other value used here arrives INSIDE the response. Given only a
+ * roster, "verify it" can mean no more than "does this agree with itself?" —
+ * and it always does, because whoever composed it chose every field. Anyone
+ * able to answer on this address could sign a roster with a key of their own,
+ * name that key as `orgWalletPubkey`, and watch it verify.
+ *
+ * One externally-held value breaks the circle. `vaultIdFor` is a one-way
+ * derivation, so a key that derives `expectedVaultId` cannot be picked; it
+ * can only be the vault's actual owner. The two checks are therefore:
+ *
+ *   1. the roster must be FOR the vault asked about (`roster.vaultId`), which
+ *      is the binding the two separate calls otherwise leave open — a
+ *      response about somebody else's vault used to verify perfectly; and
+ *   2. `orgWalletPubkey` must DERIVE that vault, which pins the signing key
+ *      to an identity the response did not get to choose.
+ *
+ * Both run BEFORE any signature is checked, mirroring
+ * `RosterAuthority.verifyRoster` in ddc-node: until the anchor holds, every
+ * byte of the envelope is attacker-supplied, including the key the
+ * signatures would be checked against.
+ *
+ * A caller who holds the OWNER KEY rather than the id needs nothing extra —
+ * `vaultIdFor(ownerKey)` is the id. That direction works; the reverse does
+ * not exist.
+ *
+ * This anchors the roster to a vault, which is all a hash can do. It does not
+ * tell you the id itself is the vault you meant: if `expectedVaultId` was
+ * itself learned from an untrusted party, the result is trust in THAT party's
+ * choice of vault. Anchor it to something you already knew.
+ */
+export async function verifySignedRoster(roster, expectedVaultId) {
+    if (typeof expectedVaultId !== "string" || expectedVaultId === "") {
+        throw new GrantVerificationError("expectedVaultId is required: verifying a roster against the vault id it " +
+            "carries only proves the response agrees with itself");
+    }
+    // The envelope is checked as SHAPE before anything is read out of it. A
+    // `grants: null` used to reach the `for` loop and surface as a bare
+    // TypeError — an error the caller cannot distinguish from a bug in their
+    // own code, on a path whose entire job is to report untrustworthy input.
+    if (typeof roster !== "object" || roster === null) {
+        throw new GrantVerificationError(`signed roster is not an object (got ${typeOf(roster)})`);
+    }
+    if (typeof roster.vaultId !== "string" || roster.vaultId === "") {
+        throw new GrantVerificationError("signed roster carries no vaultId");
+    }
+    if (typeof roster.orgWalletPubkey !== "string" || roster.orgWalletPubkey === "") {
+        throw new GrantVerificationError("signed roster carries no orgWalletPubkey");
+    }
+    if (!Array.isArray(roster.grants)) {
+        throw new GrantVerificationError(`signed roster's grants is not an array (got ${typeOf(roster.grants)})`);
+    }
+    // THE ANCHOR, both halves, before a single signature is checked.
+    if (roster.vaultId !== expectedVaultId) {
+        throw new GrantVerificationError(`signed roster names vault ${roster.vaultId}, asked about ${expectedVaultId}`);
+    }
+    if (vaultIdFor(roster.orgWalletPubkey) !== expectedVaultId) {
+        throw new GrantVerificationError(`orgWalletPubkey ${roster.orgWalletPubkey} does not derive vault ${expectedVaultId}`);
+    }
+    const out = [];
+    for (const grant of roster.grants) {
+        if (typeof grant !== "object" || grant === null) {
+            throw new GrantVerificationError(`signed roster holds a grant that is not an object`);
+        }
+        out.push(await verifyGrant(expectedVaultId, roster.orgWalletPubkey, grant));
+    }
+    return out;
+}
+/** `typeof`, but naming `null` and arrays, for a message a caller can act on. */
+function typeOf(v) {
+    if (v === null)
+        return "null";
+    return Array.isArray(v) ? "an array" : typeof v;
+}
+/**
+ * One entry of `verifySignedRoster`, exposed for a caller holding a single
+ * grant (a member proving their own standing, say) rather than a whole
+ * roster. Same bindings, same fail-closed throw.
+ *
+ * `vaultId` and `orgWalletPubkey` must CORRESPOND — the same anchor
+ * `verifySignedRoster` applies, checked here too because both arguments are
+ * the caller's and the natural way to fill them is straight off a response,
+ * which is exactly the unanchored call this check refuses.
+ */
+export async function verifyGrant(vaultId, orgWalletPubkey, grant) {
+    if (vaultIdFor(orgWalletPubkey) !== vaultId) {
+        throw new GrantVerificationError(`orgWalletPubkey ${orgWalletPubkey} does not derive vault ${vaultId}`, grant.memberPubkey);
+    }
+    let doc;
+    try {
+        doc = decodeBase64(grant.doc);
+    }
+    catch (err) {
+        throw new GrantVerificationError(`grant document is not valid base64: ${err instanceof Error ? err.message : String(err)}`, grant.memberPubkey);
+    }
+    if (!(await verifyGrantSig(orgWalletPubkey, doc, grant.sig))) {
+        throw new GrantVerificationError(`grant document is not signed by the vault owner (${orgWalletPubkey})`, grant.memberPubkey);
+    }
+    let decoded;
+    try {
+        decoded = decodeGrantDoc(doc);
+    }
+    catch (err) {
+        throw new GrantVerificationError(err instanceof Error ? err.message : String(err), grant.memberPubkey);
+    }
+    if (decoded.vaultId !== vaultId || decoded.memberPubkey !== grant.memberPubkey) {
+        throw new GrantVerificationError(`grant document describes a different membership: it names ` +
+            `${decoded.memberPubkey} on ${decoded.vaultId}, and was served as ` +
+            `${grant.memberPubkey} on ${vaultId}`, grant.memberPubkey);
+    }
+    return decoded;
+}
+/** A required string field, or a typed failure naming it. */
+function stringField(obj, key) {
+    const v = obj[key];
+    if (typeof v !== "string") {
+        throw new Error(`decode grant: ${key} must be a string, got ${v === undefined ? "nothing" : typeof v}`);
+    }
+    return v;
+}
+/**
+ * `encoding/json`'s string encoding, which `JSON.stringify` does not
+ * reproduce: `<`, `>`, `&` and U+2028/U+2029 are escaped. Everything else is
+ * left to `JSON.stringify`, so the two agree on quotes, control characters
+ * and lone surrogates.
+ */
+function goString(s) {
+    return JSON.stringify(s)
+        .replace(/</g, "\\u003c")
+        .replace(/>/g, "\\u003e")
+        .replace(/&/g, "\\u0026")
+        .replace(/\u2028/g, "\\u2028")
+        .replace(/\u2029/g, "\\u2029");
+}
+/**
+ * Sorts the way Go sorts strings — by UTF-8 bytes, which is code-point order.
+ * JavaScript's `<` compares UTF-16 code units and disagrees for astral
+ * characters, so `[...]sort()` would order a scope named "😀" (U+1F600)
+ * BEFORE one named "Ａ" (U+FF21) while Go puts it after, and the signature
+ * over the resulting bytes would never verify.
+ */
+function compareCodePoints(a, b) {
+    const ai = Array.from(a);
+    const bi = Array.from(b);
+    const n = Math.min(ai.length, bi.length);
+    for (let i = 0; i < n; i++) {
+        const x = ai[i].codePointAt(0);
+        const y = bi[i].codePointAt(0);
+        if (x !== y)
+            return x - y;
+    }
+    return ai.length - bi.length;
+}
+//# sourceMappingURL=grant-doc.js.map

package/dist/core/grant-doc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-doc.js","sourceRoot":"","sources":["../../src/core/grant-doc.ts"],"names":[],"mappings":"AAAA,wBAAwB;AACxB,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,gCAAgC;AAChC,EAAE;AACF,8CAA8C;AAC9C,wEAAwE;AACxE,yEAAyE;AACzE,4EAA4E;AAC5E,0EAA0E;AAC1E,WAAW;AACX,8EAA8E;AAC9E,qEAAqE;AACrE,6EAA6E;AAC7E,4EAA4E;AAC5E,mEAAmE;AACnE,EAAE;AACF,qEAAqE;AACrE,EAAE;AACF,4EAA4E;AAC5E,uEAAuE;AACvE,wEAAwE;AACxE,yEAAyE;AACzE,+EAA+E;AAC/E,4BAA4B;AAC5B,EAAE;AACF,2DAA2D;AAC3D,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,0EAA0E;AAC1E,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,iEAAiE;AACjE,EAAE;AACF,wEAAwE;AACxE,EAAE;AACF,2EAA2E;AAC3E,kCAAkC;AAClC,8EAA8E;AAC9E,uEAAuE;AACvE,2EAA2E;AAC3E,yEAAyE;AACzE,6EAA6E;AAC7E,yEAAyE;AACzE,6DAA6D;AAC7D,EAAE;AACF,6EAA6E;AAC7E,wEAAwE;AACxE,4EAA4E;AAC5E,4EAA4E;AAC5E,YAAY;AACZ,EAAE;AACF,wEAAwE;AACxE,6EAA6E;AAC7E,wEAAwE;AACxE,4EAA4E;AAC5E,2EAA2E;AAC3E,4BAA4B;AAC5B,EAAE;AACF,6EAA6E;AAC7E,qEAAqE;AACrE,EAAE;AACF,oEAAoE;AACpE,EAAE;AACF,4EAA4E;AAC5E,uEAAuE;AACvE,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAC9E,6EAA6E;AAC7E,yEAAyE;AACzE,4BAA4B;AAC5B,EAAE;AACF,sEAAsE;AACtE,2EAA2E;AAC3E,0EAA0E;AAC1E,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAE7E,OAAO,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACrC,0EAA0E;AAC1E,gEAAgE;AAChE,sEAAsE;AACtE,yEAAyE;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAGtE,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAC9B,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAE9B;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,qBAAqB,CAAC;AAElD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AAE1D;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AAE1D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kBAAkB,CAAC,CAAS;IAC1C,yEAAyE;IACzE,wEAAwE;IACxE,6DAA6D;IAC7D,IAAI,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChD,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC1B,oEAAoE;IACpE,uDAAuD;IACvD,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IAChF,OAAO,KAAK,IAAI,EAAE,CAAC;AACrB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,UAAU,CAAC,eAAuB;IAChD,MAAM,SAAS,GAAG,kBAAkB,CAAC,eAAe,CAAC,CAAC;IACtD,0EAA0E;IAC1E,iEAAiE;IACjE,OAAO,KAAK,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AACjE,CAAC;AAqBD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,EAAiB,CAAC;AAEjD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,OAAO,OAAsB,CAAC;AAChC,CAAC;AA8CD;;;;;;;;;;GAUG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAQpC;IAPX,YACE,OAAe;IACf;;;;OAIG;IACM,eAAuB,EAAE;QAElC,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,iBAAY,GAAZ,YAAY,CAAa;QAGlC,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAGD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAe,EACf,YAAoB,EACpB,IAAY,EACZ,MAA8B,EAC9B,QAAgB,EAChB,SAAsB;IAEtB,IAAI,OAAO,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC5E,IAAI,YAAY,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACtF,IAAI,IAAI,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACtE,IAAI,QAAQ,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAE9E,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CACrB,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,QAAQ,CAAC,IAAI,CAAC,YAAY,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAW,CAAC,GAAG,CACnF,CAAC;IACF,0EAA0E;IAC1E,sEAAsE;IACtE,4EAA4E;IAC5E,MAAM,GAAG,GACP,aAAa,QAAQ,CAAC,YAAY,CAAC,GAAG;QACtC,aAAa,QAAQ,CAAC,OAAO,CAAC,GAAG;QACjC,kBAAkB,QAAQ,CAAC,YAAY,CAAC,GAAG;QAC3C,UAAU,QAAQ,CAAC,IAAI,CAAC,GAAG;QAC3B,aAAa,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI;QAChC,cAAc,QAAQ,CAAC,QAAQ,CAAC,GAAG;QACnC,eAAe,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC;IACxC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,GAAe;IAC5C,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACtE,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,iBAAiB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,GAAG,GAAG,GAA8B,CAAC;IAC3C,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC1C,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACtC,IAAI,OAAO,KAAK,EAAE,IAAI,YAAY,KAAK,EAAE,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IACD,uEAAuE;IACvE,4EAA4E;IAC5E,0EAA0E;IAC1E,uEAAuE;IACvE,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC;IAC7B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,KAAgC,EAAE,MAAM,CAAC,CAAC;QACnE,IAAI,IAAI,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACvE,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,KAAgC,EAAE,OAAO,CAAC,CAAC;IACxE,CAAC;IACD,2EAA2E;IAC3E,4EAA4E;IAC5E,uEAAuE;IACvE,2BAA2B;IAC3B,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC9C,IAAI,QAAQ,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,0EAA0E;IAC1E,2EAA2E;IAC3E,6EAA6E;IAC7E,8EAA8E;IAC9E,+CAA+C;IAC/C,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,WAAW,CAAgB,CAAC;IAC/D,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,kBAA0B,EAC1B,GAAe,EACf,MAAc;IAEd,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,GAAe,CAAC;IACpB,IAAI,GAAe,CAAC;IACpB,IAAI,CAAC;QACH,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/D,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACzD,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,oCAAoC;QACpC,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAoB,EACpB,eAAuB;IAEvB,IAAI,OAAO,eAAe,KAAK,QAAQ,IAAI,eAAe,KAAK,EAAE,EAAE,CAAC;QAClE,MAAM,IAAI,sBAAsB,CAC9B,0EAA0E;YACxE,qDAAqD,CACxD,CAAC;IACJ,CAAC;IACD,wEAAwE;IACxE,oEAAoE;IACpE,yEAAyE;IACzE,yEAAyE;IACzE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,IAAI,sBAAsB,CAAC,uCAAuC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,KAAK,EAAE,EAAE,CAAC;QAChE,MAAM,IAAI,sBAAsB,CAAC,kCAAkC,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,eAAe,KAAK,QAAQ,IAAI,MAAM,CAAC,eAAe,KAAK,EAAE,EAAE,CAAC;QAChF,MAAM,IAAI,sBAAsB,CAAC,0CAA0C,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,sBAAsB,CAC9B,+CAA+C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CACxE,CAAC;IACJ,CAAC;IAED,iEAAiE;IACjE,IAAI,MAAM,CAAC,OAAO,KAAK,eAAe,EAAE,CAAC;QACvC,MAAM,IAAI,sBAAsB,CAC9B,6BAA6B,MAAM,CAAC,OAAO,iBAAiB,eAAe,EAAE,CAC9E,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,eAAe,EAAE,CAAC;QAC3D,MAAM,IAAI,sBAAsB,CAC9B,mBAAmB,MAAM,CAAC,eAAe,0BAA0B,eAAe,EAAE,CACrF,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAY,EAAE,CAAC;IACxB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAChD,MAAM,IAAI,sBAAsB,CAAC,mDAAmD,CAAC,CAAC;QACxF,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iFAAiF;AACjF,SAAS,MAAM,CAAC,CAAU;IACxB,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAC9B,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAe,EACf,eAAuB,EACvB,KAAkB;IAElB,IAAI,UAAU,CAAC,eAAe,CAAC,KAAK,OAAO,EAAE,CAAC;QAC5C,MAAM,IAAI,sBAAsB,CAC9B,mBAAmB,eAAe,0BAA0B,OAAO,EAAE,EACrE,KAAK,CAAC,YAAY,CACnB,CAAC;IACJ,CAAC;IACD,IAAI,GAAe,CAAC;IACpB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,sBAAsB,CAC9B,uCAAuC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACzF,KAAK,CAAC,YAAY,CACnB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,eAAe,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,sBAAsB,CAC9B,oDAAoD,eAAe,GAAG,EACtE,KAAK,CAAC,YAAY,CACnB,CAAC;IACJ,CAAC;IACD,IAAI,OAAc,CAAC;IACnB,IAAI,CAAC;QACH,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,sBAAsB,CAC9B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAChD,KAAK,CAAC,YAAY,CACnB,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,IAAI,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,EAAE,CAAC;QAC/E,MAAM,IAAI,sBAAsB,CAC9B,4DAA4D;YAC1D,GAAG,OAAO,CAAC,YAAY,OAAO,OAAO,CAAC,OAAO,sBAAsB;YACnE,GAAG,KAAK,CAAC,YAAY,OAAO,OAAO,EAAE,EACvC,KAAK,CAAC,YAAY,CACnB,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,6DAA6D;AAC7D,SAAS,WAAW,CAAC,GAA4B,EAAE,GAAW;IAC5D,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,iBAAiB,GAAG,0BAA0B,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1G,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,CAAS;IACzB,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC;SAC7B,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAI,EAAE,CAAC,CAAC,CAAY,CAAC,WAAW,CAAC,CAAC,CAAW,CAAC;QACrD,MAAM,CAAC,GAAI,EAAE,CAAC,CAAC,CAAY,CAAC,WAAW,CAAC,CAAC,CAAW,CAAC;QACrD,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC;AAC/B,CAAC"}