@opendatalabs/personal-server-ts-core 0.0.1-canary.00328bf

package/dist/pdpp/tokens.js

@@ -0,0 +1,387 @@
+/**
+ * PDPP grant-bound token issuance, introspection, and revocation (§8, §9 AS
+ * items 8–10, 18–20; delivery scope §2).
+ *
+ * This module is the single token-validation authority. The RS resolves every
+ * request through `resolveToken` and enforces only from the result — §8 is
+ * explicit that the separated RS must not make a second AS lookup while
+ * handling a request, and that a co-located RS may use a local equivalent.
+ * `resolveToken` is that local equivalent, and `introspect` is the same
+ * decision rendered onto the RFC 7662 wire shape. They share one code path so
+ * the two deployments cannot drift apart.
+ *
+ * Revocation is immediate here by construction: resolution reads current store
+ * state on every call rather than trusting a cached decision, so a revoked
+ * grant reports `active: false` on the very next call. The 60-second bound in
+ * §8 is the RS's positive-result cache, not slack in the AS.
+ */
+import { verifyCodeVerifier } from "./pkce.js";
+import { newOpaqueToken, } from "./store.js";
+import { PDPP_DATA_ACCESS_TYPE, } from "./types.js";
+/** Default client access-token lifetime. Short: the refresh path renews it. */
+export const DEFAULT_ACCESS_TOKEN_TTL_SECONDS = 60 * 60;
+/** How long an authorization code stays redeemable. RFC 6749 §4.1.2 suggests <=10 min. */
+export const AUTHORIZATION_CODE_TTL_SECONDS = 60;
+/**
+ * Whether a grant may carry a refresh token.
+ *
+ * §9 AS item 20: refresh tokens are issued only for `continuous` grants, or
+ * for a grant package only when *every* child grant is continuous. A
+ * single-use grant with a refresh token would be a contradiction — the grant
+ * is consumed at first issuance, so there is nothing left to refresh into.
+ */
+export function mayIssueRefreshToken(accessModes) {
+    return accessModes.length > 0 && accessModes.every((m) => m === "continuous");
+}
+function grantInactiveReason(store, stored, now) {
+    const status = store.grantStatus(stored, now);
+    if (status === "revoked")
+        return "grant_revoked";
+    if (status === "expired")
+        return "grant_expired";
+    return null;
+}
+export class PdppTokenService {
+    store;
+    accessTtl;
+    constructor(store, options = {}) {
+        this.store = store;
+        this.accessTtl =
+            options.accessTokenTtlSeconds ?? DEFAULT_ACCESS_TOKEN_TTL_SECONDS;
+    }
+    /**
+     * Issue the first client token for a grant, redeeming an authorization code.
+     *
+     * The code is consumed atomically before anything else happens (§9 AS item
+     * 19) and a single-use grant is consumed atomically with the token insert
+     * (§9 AS item 10). Both preconditions live in SQL WHERE clauses, so a
+     * concurrent duplicate redemption loses the race rather than double-issuing.
+     */
+    redeemAuthorizationCode(input) {
+        const now = input.now ?? new Date();
+        const record = this.store.consumeAuthCode(input.code, now);
+        if (!record) {
+            // Unknown, expired, or already redeemed — deliberately one answer, so a
+            // replay cannot be distinguished from a bad code.
+            return {
+                ok: false,
+                failure: {
+                    code: "invalid_grant",
+                    message: "authorization code is invalid, expired, or already redeemed",
+                },
+            };
+        }
+        // RFC 6749 §4.1.3: the client and redirect_uri must match the ones the
+        // code was issued to. The code is already burned at this point, which is
+        // correct — a mismatched redemption attempt must not leave it redeemable.
+        if (record.clientId !== input.clientId) {
+            return {
+                ok: false,
+                failure: {
+                    code: "invalid_grant",
+                    message: "authorization code was not issued to this client",
+                },
+            };
+        }
+        if (record.redirectUri !== input.redirectUri) {
+            return {
+                ok: false,
+                failure: {
+                    code: "invalid_grant",
+                    message: "redirect_uri does not match the authorization request",
+                },
+            };
+        }
+        // RFC 7636 §4.6. Checked after the code is burned, like the client and
+        // redirect checks above: an attacker who intercepted the code must not be
+        // able to probe verifiers against a code that stays alive between guesses.
+        // One wrong verifier costs them the code.
+        const pkceFailure = verifyCodeVerifier(input.codeVerifier, record.codeChallenge, record.codeChallengeMethod);
+        if (pkceFailure) {
+            return {
+                ok: false,
+                failure: { code: "invalid_grant", message: pkceFailure.message },
+            };
+        }
+        const stored = this.store.getGrant(record.grantId);
+        if (!stored) {
+            return {
+                ok: false,
+                failure: { code: "invalid_grant", message: "grant not found" },
+            };
+        }
+        const inactive = grantInactiveReason(this.store, stored, now);
+        if (inactive) {
+            return {
+                ok: false,
+                failure: {
+                    code: "invalid_grant",
+                    message: `grant is ${inactive === "grant_revoked" ? "revoked" : "expired"}`,
+                },
+            };
+        }
+        return this.mintForGrant(stored, now);
+    }
+    /**
+     * Rotate a refresh token within its family.
+     *
+     * Reuse of a superseded token revokes the family and every family-linked
+     * access token inside `rotateRefreshToken`, then this returns
+     * `invalid_grant`, which is what §9 AS item 20 requires: reject the reuse
+     * and require fresh authorization.
+     */
+    refresh(input) {
+        const now = input.now ?? new Date();
+        const rotation = this.store.rotateRefreshToken(input.refreshToken, now);
+        if (!rotation.ok) {
+            return {
+                ok: false,
+                failure: {
+                    code: "invalid_grant",
+                    message: rotation.reason === "reuse_detected"
+                        ? "refresh token reuse detected; the token family has been revoked and fresh authorization is required"
+                        : "refresh token is unknown or its family is revoked",
+                },
+            };
+        }
+        const stored = this.store.getGrant(rotation.grantId);
+        if (!stored) {
+            return {
+                ok: false,
+                failure: { code: "invalid_grant", message: "grant not found" },
+            };
+        }
+        const inactive = grantInactiveReason(this.store, stored, now);
+        if (inactive) {
+            return {
+                ok: false,
+                failure: {
+                    code: "invalid_grant",
+                    message: `grant is ${inactive === "grant_revoked" ? "revoked" : "expired"}`,
+                },
+            };
+        }
+        return this.mintForGrant(stored, now, rotation.familyId);
+    }
+    /**
+     * Mint an access token (and, for continuous grants, a refresh token) bound
+     * to a grant.
+     *
+     * `existingFamilyId` carries a rotation into the same family so reuse
+     * detection keeps working across the whole chain; a first issuance creates
+     * the family.
+     */
+    mintForGrant(stored, now, existingFamilyId) {
+        const { grant } = stored;
+        const continuous = mayIssueRefreshToken([grant.access_mode]);
+        let familyId = existingFamilyId ?? null;
+        if (continuous && familyId === null) {
+            familyId = this.store.createRefreshFamily(grant.grant_id);
+        }
+        const accessToken = newOpaqueToken("pdpp_at");
+        // A token must never outlive the grant it is bound to. Clamping here means
+        // the RS's `min(token_exp, 60s)` cache bound can never extend access past
+        // grant expiry either.
+        const ttlExpiry = new Date(now.getTime() + this.accessTtl * 1000);
+        const grantExpiry = grant.expires_at ? new Date(grant.expires_at) : null;
+        const effectiveExpiry = grantExpiry && grantExpiry < ttlExpiry ? grantExpiry : ttlExpiry;
+        const issued = this.store.issueAccessToken({
+            token: accessToken,
+            grantId: grant.grant_id,
+            subjectId: stored.subjectId,
+            clientId: grant.client.client_id,
+            tokenKind: "client",
+            familyId,
+            expiresAt: effectiveExpiry.toISOString(),
+            // A single-use grant is consumed exactly at first client-token issuance.
+            // A rotation is never a first issuance, so it never re-consumes.
+            consumeSingleUse: grant.access_mode === "single_use" && existingFamilyId === undefined,
+            now,
+        });
+        if (!issued) {
+            return {
+                ok: false,
+                failure: {
+                    code: "invalid_grant",
+                    message: "single_use grant has already been consumed; no further access tokens may be issued against it",
+                },
+            };
+        }
+        const expiresIn = Math.max(1, Math.floor((effectiveExpiry.getTime() - now.getTime()) / 1000));
+        let refreshToken;
+        if (continuous && familyId) {
+            refreshToken = newOpaqueToken("pdpp_rt");
+            this.store.insertRefreshToken(refreshToken, familyId, now);
+        }
+        return {
+            ok: true,
+            issued: {
+                access_token: accessToken,
+                token_type: "Bearer",
+                expires_in: expiresIn,
+                ...(refreshToken && { refresh_token: refreshToken }),
+                grant_id: grant.grant_id,
+            },
+        };
+    }
+    /**
+     * The single shared token-validation path (§8 "Grant enforcement").
+     *
+     * Reads live store state every call. That is what makes revocation immediate
+     * in introspection (§9 AS item 8) — there is no AS-side cache to invalidate.
+     */
+    resolveToken(accessToken, now = new Date()) {
+        const record = this.store.getAccessToken(accessToken);
+        if (!record) {
+            return { active: false, inactiveReason: "unknown" };
+        }
+        // Grant state is checked BEFORE the token's own revocation flag, because
+        // revoking a grant also marks its linked tokens revoked. Checking the
+        // token first would report `revoked` for what is really a grant
+        // revocation, and the RS keys 403 `grant_revoked` off this exact reason
+        // (§2 revocation propagation) — it would return the wrong error.
+        if (record.tokenKind === "client" && record.grantId) {
+            const stored = this.store.getGrant(record.grantId);
+            if (!stored) {
+                return { active: false, inactiveReason: "unknown" };
+            }
+            const grantInactive = grantInactiveReason(this.store, stored, now);
+            if (grantInactive) {
+                return { active: false, inactiveReason: grantInactive };
+            }
+        }
+        if (record.revokedAt) {
+            return { active: false, inactiveReason: "revoked" };
+        }
+        if (record.expiresAt && Date.parse(record.expiresAt) <= now.getTime()) {
+            return { active: false, inactiveReason: "expired" };
+        }
+        // A token minted into a family that was later burned by reuse detection is
+        // dead even if its own row was not individually marked — belt and braces
+        // against a token inserted concurrently with the family revocation.
+        if (record.familyId && this.store.isFamilyRevoked(record.familyId)) {
+            return { active: false, inactiveReason: "revoked" };
+        }
+        if (record.tokenKind === "owner") {
+            // An owner token carries no grant. The RS derives subject scope from
+            // `subjectId` and must not synthesize a grant for it (§8).
+            return {
+                active: true,
+                tokenKind: "owner",
+                subjectId: record.subjectId,
+                ...(record.expiresAt && { expiresAt: record.expiresAt }),
+            };
+        }
+        if (!record.grantId) {
+            // A client token with no grant link is unusable by definition.
+            return { active: false, inactiveReason: "unknown" };
+        }
+        const stored = this.store.getGrant(record.grantId);
+        if (!stored) {
+            return { active: false, inactiveReason: "unknown" };
+        }
+        const inactive = grantInactiveReason(this.store, stored, now);
+        if (inactive) {
+            // grant_revoked is the reason the RS turns into 403 grant_revoked.
+            return { active: false, inactiveReason: inactive };
+        }
+        return {
+            active: true,
+            tokenKind: "client",
+            subjectId: stored.subjectId,
+            grant: stored.grant,
+            clientId: stored.grant.client.client_id,
+            ...(record.expiresAt && { expiresAt: record.expiresAt }),
+        };
+    }
+    /**
+     * RFC 7662 introspection.
+     *
+     * An inactive token yields exactly `{ active: false }`. RFC 7662 §2.2 is
+     * clear that the response must not distinguish revoked from expired from
+     * never-issued — the reason stays internal (`resolveToken`) for the
+     * co-located RS, which needs it to pick 403 `grant_revoked`.
+     */
+    introspect(accessToken, now = new Date()) {
+        const context = this.resolveToken(accessToken, now);
+        if (!context.active) {
+            return { active: false };
+        }
+        const base = {
+            active: true,
+            pdpp_token_kind: context.tokenKind,
+            subject_id: context.subjectId,
+            ...(context.expiresAt && {
+                exp: Math.floor(Date.parse(context.expiresAt) / 1000),
+            }),
+        };
+        if (context.tokenKind === "owner" || !context.grant) {
+            return base;
+        }
+        return {
+            ...base,
+            grant_id: context.grant.grant_id,
+            client_id: context.grant.client.client_id,
+            // The complete resolved enforcement context, in one response (§9 item 18).
+            authorization_details: [toAuthorizationDetail(context.grant)],
+        };
+    }
+    /** Revoke a grant and every linked token family. Immediate (§2, §9 item 8). */
+    revokeGrant(grantId, now = new Date()) {
+        return this.store.revokeGrant(grantId, now);
+    }
+    /**
+     * Issue an owner token for a subject.
+     *
+     * An owner token carries no grant (§8 "Authentication"): it scopes to a
+     * single subject's data store, and the RS derives subject scope from it
+     * rather than synthesizing a grant. It is also what authenticates a consent
+     * decision — see `approval.ts` for why the AS requires this rather than
+     * trusting the consent UI's affiliation.
+     *
+     * How the owner *obtains* this token is out of scope for Core; this build
+     * mints it from the already-authenticated owner session paths.
+     */
+    issueOwnerToken(input) {
+        const now = input.now ?? new Date();
+        const ttl = input.ttlSeconds ?? this.accessTtl;
+        const token = newOpaqueToken("pdpp_ot");
+        const expiresAt = new Date(now.getTime() + ttl * 1000);
+        this.store.issueAccessToken({
+            token,
+            grantId: null,
+            subjectId: input.subjectId,
+            clientId: null,
+            tokenKind: "owner",
+            expiresAt: expiresAt.toISOString(),
+            consumeSingleUse: false,
+            now,
+        });
+        return { access_token: token, token_type: "Bearer", expires_in: ttl };
+    }
+    /** Revoke a single access token without touching its grant. */
+    revokeAccessToken(token, now = new Date()) {
+        return this.store.revokeAccessToken(token, now);
+    }
+}
+/**
+ * Project a grant onto the RFC 9396 detail the introspection response carries.
+ *
+ * Note what is absent: `client_claims` and `retention` are not enforcement
+ * fields. §6 keeps claims outside introspection rights and RS enforcement
+ * entirely; retention is a policy commitment PDPP does not technically
+ * enforce, so including it would invite an RS to act on it.
+ */
+export function toAuthorizationDetail(grant) {
+    return {
+        type: PDPP_DATA_ACCESS_TYPE,
+        source: grant.source,
+        purpose_code: grant.purpose_code,
+        ...(grant.purpose_description && {
+            purpose_description: grant.purpose_description,
+        }),
+        access_mode: grant.access_mode,
+        streams: grant.streams,
+    };
+}
+//# sourceMappingURL=tokens.js.map

package/dist/pdpp/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/pdpp/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EACL,cAAc,GAGf,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,qBAAqB,GAOtB,MAAM,YAAY,CAAC;AAEpB,+EAA+E;AAC/E,MAAM,CAAC,MAAM,gCAAgC,GAAG,EAAE,GAAG,EAAE,CAAC;AAExD,0FAA0F;AAC1F,MAAM,CAAC,MAAM,8BAA8B,GAAG,EAAE,CAAC;AAuBjD;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAyB;IAC5D,OAAO,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,mBAAmB,CAC1B,KAAoB,EACpB,MAAmB,EACnB,GAAS;IAET,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC9C,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,eAAe,CAAC;IACjD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,eAAe,CAAC;IACjD,OAAO,IAAI,CAAC;AACd,CAAC;AAMD,MAAM,OAAO,gBAAgB;IAIR;IAHF,SAAS,CAAS;IAEnC,YACmB,KAAoB,EACrC,UAAmC,EAAE;QADpB,UAAK,GAAL,KAAK,CAAe;QAGrC,IAAI,CAAC,SAAS;YACZ,OAAO,CAAC,qBAAqB,IAAI,gCAAgC,CAAC;IACtE,CAAC;IAED;;;;;;;OAOG;IACH,uBAAuB,CAAC,KAOvB;QACC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;QAEpC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,wEAAwE;YACxE,kDAAkD;YAClD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,eAAe;oBACrB,OAAO,EACL,6DAA6D;iBAChE;aACF,CAAC;QACJ,CAAC;QAED,uEAAuE;QACvE,yEAAyE;QACzE,0EAA0E;QAC1E,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;YACvC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,kDAAkD;iBAC5D;aACF,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;YAC7C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,uDAAuD;iBACjE;aACF,CAAC;QACJ,CAAC;QAED,uEAAuE;QACvE,0EAA0E;QAC1E,2EAA2E;QAC3E,0CAA0C;QAC1C,MAAM,WAAW,GAAG,kBAAkB,CACpC,KAAK,CAAC,YAAY,EAClB,MAAM,CAAC,aAAa,EACpB,MAAM,CAAC,mBAAmB,CAC3B,CAAC;QACF,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE;aACjE,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,iBAAiB,EAAE;aAC/D,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QAC9D,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,YAAY,QAAQ,KAAK,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE;iBAC5E;aACF,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,KAA2C;QACjD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QAExE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,eAAe;oBACrB,OAAO,EACL,QAAQ,CAAC,MAAM,KAAK,gBAAgB;wBAClC,CAAC,CAAC,qGAAqG;wBACvG,CAAC,CAAC,mDAAmD;iBAC1D;aACF,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,iBAAiB,EAAE;aAC/D,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QAC9D,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,YAAY,QAAQ,KAAK,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE;iBAC5E;aACF,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3D,CAAC;IAED;;;;;;;OAOG;IACK,YAAY,CAClB,MAAmB,EACnB,GAAS,EACT,gBAAyB;QAEzB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;QACzB,MAAM,UAAU,GAAG,oBAAoB,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;QAE7D,IAAI,QAAQ,GAAkB,gBAAgB,IAAI,IAAI,CAAC;QACvD,IAAI,UAAU,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACpC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,WAAW,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QAC9C,2EAA2E;QAC3E,0EAA0E;QAC1E,uBAAuB;QACvB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;QAClE,MAAM,WAAW,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACzE,MAAM,eAAe,GACnB,WAAW,IAAI,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;QAEnE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC;YACzC,KAAK,EAAE,WAAW;YAClB,OAAO,EAAE,KAAK,CAAC,QAAQ;YACvB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;YAChC,SAAS,EAAE,QAAQ;YACnB,QAAQ;YACR,SAAS,EAAE,eAAe,CAAC,WAAW,EAAE;YACxC,yEAAyE;YACzE,iEAAiE;YACjE,gBAAgB,EACd,KAAK,CAAC,WAAW,KAAK,YAAY,IAAI,gBAAgB,KAAK,SAAS;YACtE,GAAG;SACJ,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE;oBACP,IAAI,EAAE,eAAe;oBACrB,OAAO,EACL,+FAA+F;iBAClG;aACF,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CACxB,CAAC,EACD,IAAI,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAC/D,CAAC;QAEF,IAAI,YAAgC,CAAC;QACrC,IAAI,UAAU,IAAI,QAAQ,EAAE,CAAC;YAC3B,YAAY,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,YAAY,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE;gBACN,YAAY,EAAE,WAAW;gBACzB,UAAU,EAAE,QAAQ;gBACpB,UAAU,EAAE,SAAS;gBACrB,GAAG,CAAC,YAAY,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;gBACpD,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB;SACF,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,YAAY,CAAC,WAAmB,EAAE,MAAY,IAAI,IAAI,EAAE;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;QACtD,CAAC;QAED,yEAAyE;QACzE,sEAAsE;QACtE,gEAAgE;QAChE,wEAAwE;QACxE,iEAAiE;QACjE,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;YACtD,CAAC;YACD,MAAM,aAAa,GAAG,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;YACnE,IAAI,aAAa,EAAE,CAAC;gBAClB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC;YAC1D,CAAC;QACH,CAAC;QAED,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;QACtD,CAAC;QAED,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YACtE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;QACtD,CAAC;QAED,2EAA2E;QAC3E,yEAAyE;QACzE,oEAAoE;QACpE,IAAI,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;QACtD,CAAC;QAED,IAAI,MAAM,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;YACjC,qEAAqE;YACrE,2DAA2D;YAC3D,OAAO;gBACL,MAAM,EAAE,IAAI;gBACZ,SAAS,EAAE,OAAO;gBAClB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;aACzD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,+DAA+D;YAC/D,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;QACtD,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;QACtD,CAAC;QAED,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QAC9D,IAAI,QAAQ,EAAE,CAAC;YACb,mEAAmE;YACnE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC;QACrD,CAAC;QAED,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,QAAQ;YACnB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS;YACvC,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;SACzD,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,UAAU,CACR,WAAmB,EACnB,MAAY,IAAI,IAAI,EAAE;QAEtB,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;QAED,MAAM,IAAI,GAA8B;YACtC,MAAM,EAAE,IAAI;YACZ,eAAe,EAAE,OAAO,CAAC,SAAS;YAClC,UAAU,EAAE,OAAO,CAAC,SAAS;YAC7B,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI;gBACvB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;aACtD,CAAC;SACH,CAAC;QAEF,IAAI,OAAO,CAAC,SAAS,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACpD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO;YACL,GAAG,IAAI;YACP,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ;YAChC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS;YACzC,2EAA2E;YAC3E,qBAAqB,EAAE,CAAC,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;SAC9D,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,WAAW,CAAC,OAAe,EAAE,MAAY,IAAI,IAAI,EAAE;QACjD,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,KAIf;QACC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,SAAS,CAAC;QAC/C,MAAM,KAAK,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC;QAEvD,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC;YAC1B,KAAK;YACL,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,OAAO;YAClB,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;YAClC,gBAAgB,EAAE,KAAK;YACvB,GAAG;SACJ,CAAC,CAAC;QAEH,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IACxE,CAAC;IAED,+DAA+D;IAC/D,iBAAiB,CAAC,KAAa,EAAE,MAAY,IAAI,IAAI,EAAE;QACrD,OAAO,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAClD,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAY;IAChD,OAAO;QACL,IAAI,EAAE,qBAAqB;QAC3B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,GAAG,CAAC,KAAK,CAAC,mBAAmB,IAAI;YAC/B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;SAC/C,CAAC;QACF,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;AACJ,CAAC"}

package/dist/pdpp/types.d.ts

@@ -0,0 +1,258 @@
+/**
+ * PDPP Core v0.1.0 authorization types.
+ *
+ * These mirror the normative field tables in PDPP Core §6 (Selection Request)
+ * and §7 (Grant). Where this file and the spec disagree, the spec wins — §7
+ * says so explicitly about its own TypeScript mirror.
+ *
+ * The PDPP grant model is deliberately separate from the Vana chain grant in
+ * `../grants/`. That one is an EIP-712 payload binding a builder address to
+ * dot-scopes; this one is an RFC 9396 consent artifact binding an OAuth client
+ * to declaration-resolved streams. They are different authorities over
+ * different data and must not be conflated.
+ */
+/** The RFC 9396 `type` value that marks an authorization detail as PDPP. */
+export declare const PDPP_DATA_ACCESS_TYPE = "https://pdpp.dev/data-access";
+/** The grant schema version this implementation issues and accepts. */
+export declare const PDPP_GRANT_VERSION = "0.1.0";
+/**
+ * The PDPP HTTP API contract version, sent and echoed in the `PDPP-Version`
+ * header. Normative value from Core §8 "API versioning".
+ *
+ * §7 "Version layering" is explicit that the three version axes MUST NOT be
+ * conflated, and this is the one that is easiest to get wrong: it is the HTTP
+ * *contract* version, not `PDPP_GRANT_VERSION` (the grant schema, `0.1.0`) and
+ * not `source_declaration.version` (an opaque declaration revision). This
+ * previously carried the grant schema version, which meant a client pinning
+ * the spec's own header value was rejected by the AS while the RS accepted it —
+ * a client could reach only half the server.
+ *
+ * Both the AS and RS surfaces import this one constant so they cannot drift
+ * apart again.
+ */
+export declare const PDPP_API_VERSION = "2026-04-06";
+/**
+ * The one purpose code Core gives a protocol-level consent requirement
+ * (§6 "AI training consent"). Every other code is a structured policy
+ * declaration the AS displays but does not gate on.
+ */
+export declare const AI_TRAINING_PURPOSE = "https://pdpp.dev/purpose/ai_training";
+export type AccessMode = "single_use" | "continuous";
+/**
+ * Provenance class. A selection request never carries this — the AS derives it
+ * from the declaration it accepted for `source.id` (§6 "Source kinds").
+ */
+export type SourceKind = "connector" | "provider_native";
+/** RFC 7591-aligned inline client metadata, minus the redundant `client_` prefix. */
+export interface ClientDisplay {
+    name: string;
+    uri?: string;
+    logo_uri?: string;
+    policy_uri?: string;
+    tos_uri?: string;
+}
+export interface TimeRange {
+    /** Inclusive lower bound (>=). */
+    since?: string;
+    /** Exclusive upper bound (<). */
+    until?: string;
+}
+export interface StreamRequest {
+    /** Stream name, or `*` for every stream in the retained declaration. */
+    name: string;
+    /** `required` (default) or `optional`; optional streams become owner choices. */
+    necessity?: "required" | "optional";
+    instance_ids?: string[];
+    time_range?: TimeRange;
+    /** Named AS view. Mutually exclusive with `fields`. */
+    view?: string;
+    /** Field allowlist, top-level names only. Mutually exclusive with `view`. */
+    fields?: string[];
+    /** Canonical key strings for specific records. */
+    resources?: string[];
+}
+/**
+ * Client-authored, unverifiable statements about this specific request.
+ * Request-scoped, not entity-scoped. These never enter the resolved grant.
+ */
+export interface ClientClaims {
+    commitments?: string[];
+}
+export interface Retention {
+    /** ISO 8601 duration. */
+    max_duration: string;
+    /** `archive` is not supported in v0.1. */
+    on_expiry: "delete" | "anonymize";
+}
+/** One RFC 9396 `authorization_details` entry of PDPP type. */
+export interface SelectionRequest {
+    type: typeof PDPP_DATA_ACCESS_TYPE;
+    /** A request carries `id` alone; provenance is derived, never asserted. */
+    source: {
+        id: string;
+    };
+    purpose_code: string;
+    purpose_description?: string;
+    access_mode: AccessMode;
+    retention?: Retention;
+    /** Required unless `selection_preset` is used. Exactly one of the two. */
+    streams?: StreamRequest[];
+    /** Alternative to explicit streams. Exactly one of the two. */
+    selection_preset?: string;
+    client_claims?: ClientClaims;
+}
+export interface TimeConstraint {
+    /** Frozen `consent_time_field` from the retained declaration. */
+    field: string;
+    /** Inclusive (>=). */
+    since?: string;
+    /** Exclusive (<). A hard cap: applies to future records as well as past. */
+    until?: string;
+}
+export interface StreamGrant {
+    /** Always concrete. Issued grants never contain wildcards. */
+    name: string;
+    /** Unique, non-empty. Fan-in only when more than one handle is listed. */
+    instance_ids: string[];
+    /** Unique, non-empty, resolved. Authoritative for RS enforcement. */
+    fields: string[];
+    time_constraint?: TimeConstraint;
+    /** Canonical key strings. Absent means all records in the stream. */
+    resources?: string[];
+}
+export interface Grant {
+    /** This contract requires exactly `0.1.0`. */
+    version: string;
+    grant_id: string;
+    issued_at: string;
+    subject: {
+        id: string;
+    };
+    client: {
+        client_id: string;
+        client_display?: ClientDisplay;
+    };
+    /** Retained verbatim from the accepted declaration. */
+    source: {
+        kind: SourceKind;
+        id: string;
+    };
+    /** Opaque revision of the exact snapshot used, not a live lookup authority. */
+    source_declaration: {
+        version: string;
+    };
+    purpose_code: string;
+    purpose_description?: string;
+    access_mode: AccessMode;
+    streams: StreamGrant[];
+    /** Informational; the resolved streams stay authoritative. */
+    selection_preset?: string;
+    retention?: Retention;
+    /** Absent means no expiry. */
+    expires_at?: string;
+}
+export interface DeclaredStream {
+    name: string;
+    /**
+     * How records in this stream behave over time (§5).
+     *
+     * `mutable_state` records are upserted by key and carry version history;
+     * `append_only` records are immutable, so a duplicate key is a no-op rather
+     * than an update. Optional, defaulting to `mutable_state`, so declarations
+     * written before this field existed keep their current meaning exactly.
+     *
+     * Before this existed the RS hardcoded `mutable_state` for every stream,
+     * which made an `append_only` declaration silently coerced and the field
+     * unfalsifiable for an ingesting producer.
+     */
+    semantics?: "mutable_state" | "append_only";
+    /** Top-level field names the stream's schema defines. */
+    fields: string[];
+    /**
+     * Fields a record of this stream cannot be valid without. Always included in
+     * a resolved field set regardless of the requested allowlist — the per-stream
+     * consent floor (§6 "Note on `fields`").
+     */
+    required_fields: string[];
+    /**
+     * Presence is the authoritative signal that the stream is time-range-capable
+     * (§6 "Note on `time_range`").
+     */
+    consent_time_field?: string;
+    /** Arity of the primary key; `resources` entries are validated against it. */
+    primary_key: string[];
+    /** The stream's JSON Schema from a normative §5 declaration, when present. */
+    schema?: Record<string, unknown>;
+    /** Declared selection capabilities, e.g. `{ fields: true, resources: false }`. */
+    selection?: Record<string, unknown>;
+}
+export interface DeclaredView {
+    name: string;
+    fields: string[];
+}
+export interface DeclaredPreset {
+    name: string;
+    streams: StreamRequest[];
+}
+/**
+ * The exact declaration snapshot retained through validation, consent,
+ * issuance, and consent evidence. A later current declaration never
+ * substitutes for it (§9 AS item 16).
+ */
+export interface DeclarationSnapshot {
+    source_id: string;
+    source_kind: SourceKind;
+    /** Opaque revision identifier recorded into the grant. */
+    version: string;
+    /** Digest over the retrieved document, verified before the snapshot is trusted. */
+    digest: string;
+    streams: DeclaredStream[];
+    views?: DeclaredView[];
+    selection_presets?: DeclaredPreset[];
+}
+export type PdppTokenKind = "owner" | "client";
+export interface PdppAuthorizationDetail {
+    type: typeof PDPP_DATA_ACCESS_TYPE;
+    source: {
+        kind: SourceKind;
+        id: string;
+    };
+    purpose_code: string;
+    purpose_description?: string;
+    access_mode: AccessMode;
+    streams: StreamGrant[];
+}
+/**
+ * RFC 7662 introspection response with the PDPP extension members. An inactive
+ * token returns exactly `{ active: false }` — RFC 7662 §2.2 forbids leaking
+ * anything else about a token that is revoked, expired, or simply unknown.
+ */
+export interface PdppIntrospectionResponse {
+    active: boolean;
+    pdpp_token_kind?: PdppTokenKind;
+    subject_id?: string;
+    grant_id?: string;
+    client_id?: string;
+    /** Unix epoch seconds. Omitted when the token never expires. */
+    exp?: number;
+    authorization_details?: PdppAuthorizationDetail[];
+}
+/** Why a token did not resolve. Drives the RS error; never echoed to the client. */
+export type InactiveReason = "unknown" | "expired" | "revoked" | "grant_revoked" | "grant_expired";
+/**
+ * The co-located equivalent of an introspection call. The RS resolves a token
+ * through this one path and enforces only from the result (§8 "Grant
+ * enforcement"): no second authority, no live declaration lookup.
+ */
+export interface PdppTokenContext {
+    active: boolean;
+    tokenKind?: PdppTokenKind;
+    subjectId?: string;
+    /** Client tokens only. An owner token carries no grant. */
+    grant?: Grant;
+    clientId?: string;
+    expiresAt?: string;
+    inactiveReason?: InactiveReason;
+}
+export type GrantStatus = "active" | "expired" | "revoked";
+//# sourceMappingURL=types.d.ts.map

package/dist/pdpp/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/pdpp/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,4EAA4E;AAC5E,eAAO,MAAM,qBAAqB,iCAAiC,CAAC;AAEpE,uEAAuE;AACvE,eAAO,MAAM,kBAAkB,UAAU,CAAC;AAE1C;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,gBAAgB,eAAe,CAAC;AAE7C;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,yCAAyC,CAAC;AAE1E,MAAM,MAAM,UAAU,GAAG,YAAY,GAAG,YAAY,CAAC;AAErD;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG,iBAAiB,CAAC;AAEzD,qFAAqF;AACrF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAMD,MAAM,WAAW,SAAS;IACxB,kCAAkC;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb,iFAAiF;IACjF,SAAS,CAAC,EAAE,UAAU,GAAG,UAAU,CAAC;IACpC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,CAAC,EAAE,SAAS,CAAC;IACvB,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,SAAS;IACxB,yBAAyB;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,0CAA0C;IAC1C,SAAS,EAAE,QAAQ,GAAG,WAAW,CAAC;CACnC;AAED,+DAA+D;AAC/D,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,OAAO,qBAAqB,CAAC;IACnC,2EAA2E;IAC3E,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,WAAW,EAAE,UAAU,CAAC;IACxB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,0EAA0E;IAC1E,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;IAC1B,+DAA+D;IAC/D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,YAAY,CAAC;CAC9B;AAMD,MAAM,WAAW,cAAc;IAC7B,iEAAiE;IACjE,KAAK,EAAE,MAAM,CAAC;IACd,sBAAsB;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,qEAAqE;IACrE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,eAAe,CAAC,EAAE,cAAc,CAAC;IACjC,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,KAAK;IACpB,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACxB,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,aAAa,CAAA;KAAE,CAAC;IAC9D,uDAAuD;IACvD,MAAM,EAAE;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,+EAA+E;IAC/E,kBAAkB,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,WAAW,EAAE,UAAU,CAAC;IACxB,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,8DAA8D;IAC9D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,8BAA8B;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAMD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,EAAE,eAAe,GAAG,aAAa,CAAC;IAC5C,yDAAyD;IACzD,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB;;;;OAIG;IACH,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,8EAA8E;IAC9E,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,kFAAkF;IAClF,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,aAAa,EAAE,CAAC;CAC1B;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,UAAU,CAAC;IACxB,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,KAAK,CAAC,EAAE,YAAY,EAAE,CAAC;IACvB,iBAAiB,CAAC,EAAE,cAAc,EAAE,CAAC;CACtC;AAMD,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE/C,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,OAAO,qBAAqB,CAAC;IACnC,MAAM,EAAE;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,WAAW,EAAE,UAAU,CAAC;IACxB,OAAO,EAAE,WAAW,EAAE,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,OAAO,CAAC;IAChB,eAAe,CAAC,EAAE,aAAa,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qBAAqB,CAAC,EAAE,uBAAuB,EAAE,CAAC;CACnD;AAED,oFAAoF;AACpF,MAAM,MAAM,cAAc,GACxB,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,eAAe,GAAG,eAAe,CAAC;AAExE;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2DAA2D;IAC3D,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC"}