@opendatalabs/personal-server-ts-core 0.0.1-canary.00328bf

package/dist/pdpp/types.js

@@ -0,0 +1,40 @@
+/**
+ * PDPP Core v0.1.0 authorization types.
+ *
+ * These mirror the normative field tables in PDPP Core §6 (Selection Request)
+ * and §7 (Grant). Where this file and the spec disagree, the spec wins — §7
+ * says so explicitly about its own TypeScript mirror.
+ *
+ * The PDPP grant model is deliberately separate from the Vana chain grant in
+ * `../grants/`. That one is an EIP-712 payload binding a builder address to
+ * dot-scopes; this one is an RFC 9396 consent artifact binding an OAuth client
+ * to declaration-resolved streams. They are different authorities over
+ * different data and must not be conflated.
+ */
+/** The RFC 9396 `type` value that marks an authorization detail as PDPP. */
+export const PDPP_DATA_ACCESS_TYPE = "https://pdpp.dev/data-access";
+/** The grant schema version this implementation issues and accepts. */
+export const PDPP_GRANT_VERSION = "0.1.0";
+/**
+ * The PDPP HTTP API contract version, sent and echoed in the `PDPP-Version`
+ * header. Normative value from Core §8 "API versioning".
+ *
+ * §7 "Version layering" is explicit that the three version axes MUST NOT be
+ * conflated, and this is the one that is easiest to get wrong: it is the HTTP
+ * *contract* version, not `PDPP_GRANT_VERSION` (the grant schema, `0.1.0`) and
+ * not `source_declaration.version` (an opaque declaration revision). This
+ * previously carried the grant schema version, which meant a client pinning
+ * the spec's own header value was rejected by the AS while the RS accepted it —
+ * a client could reach only half the server.
+ *
+ * Both the AS and RS surfaces import this one constant so they cannot drift
+ * apart again.
+ */
+export const PDPP_API_VERSION = "2026-04-06";
+/**
+ * The one purpose code Core gives a protocol-level consent requirement
+ * (§6 "AI training consent"). Every other code is a structured policy
+ * declaration the AS displays but does not gate on.
+ */
+export const AI_TRAINING_PURPOSE = "https://pdpp.dev/purpose/ai_training";
+//# sourceMappingURL=types.js.map

package/dist/pdpp/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/pdpp/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,qBAAqB,GAAG,8BAA8B,CAAC;AAEpE,uEAAuE;AACvE,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAE1C;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAE7C;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,sCAAsC,CAAC"}

package/dist/pdpp-version.d.ts

@@ -0,0 +1,28 @@
+/**
+ * The single `PDPP-Version` value both the Authorization Server and Resource
+ * Server surfaces of this Personal Server negotiate against (spec-core.md
+ * §8 "API versioning").
+ *
+ * Spec-core.md's own normative example is a date string
+ * (`PDPP-Version: 2026-04-06`), not a semver string — this constant follows
+ * that convention. Both AS and RS route modules MUST import this one
+ * constant rather than declaring their own local copy: an AS and RS that
+ * hard-reject an unrecognized `PDPP-Version` (spec §8 requires this) but
+ * accept mutually exclusive values make half the server unreachable to any
+ * client that pins a version header.
+ *
+ * Found in an independent combined AS+RS review (2026-09-17): the AS lane's
+ * `packages/core/src/pdpp/types.ts` previously declared its own
+ * `PDPP_API_VERSION = "0.1.0"` (a semver-shaped grant/API contract version,
+ * not the spec's `PDPP-Version` header value) alongside this module's
+ * `PDPP-Version = "2026-04-06"` in the RS route files. A client sending
+ * either header value could reach only one half of the server. Fix: one
+ * shared constant, spec-date-shaped, imported by both surfaces. The AS lane
+ * needs to adopt this constant (or reconcile `PDPP_API_VERSION`'s meaning to
+ * something distinct from the `PDPP-Version` header, if that field is
+ * actually meant to version the grant schema rather than the wire protocol)
+ * — that reconciliation was not made unilaterally here since it touches
+ * AS-owned files this lane does not edit.
+ */
+export declare const PDPP_VERSION = "2026-04-06";
+//# sourceMappingURL=pdpp-version.d.ts.map

package/dist/pdpp-version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pdpp-version.d.ts","sourceRoot":"","sources":["../src/pdpp-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,YAAY,eAAe,CAAC"}

package/dist/pdpp-version.js

@@ -0,0 +1,28 @@
+/**
+ * The single `PDPP-Version` value both the Authorization Server and Resource
+ * Server surfaces of this Personal Server negotiate against (spec-core.md
+ * §8 "API versioning").
+ *
+ * Spec-core.md's own normative example is a date string
+ * (`PDPP-Version: 2026-04-06`), not a semver string — this constant follows
+ * that convention. Both AS and RS route modules MUST import this one
+ * constant rather than declaring their own local copy: an AS and RS that
+ * hard-reject an unrecognized `PDPP-Version` (spec §8 requires this) but
+ * accept mutually exclusive values make half the server unreachable to any
+ * client that pins a version header.
+ *
+ * Found in an independent combined AS+RS review (2026-09-17): the AS lane's
+ * `packages/core/src/pdpp/types.ts` previously declared its own
+ * `PDPP_API_VERSION = "0.1.0"` (a semver-shaped grant/API contract version,
+ * not the spec's `PDPP-Version` header value) alongside this module's
+ * `PDPP-Version = "2026-04-06"` in the RS route files. A client sending
+ * either header value could reach only one half of the server. Fix: one
+ * shared constant, spec-date-shaped, imported by both surfaces. The AS lane
+ * needs to adopt this constant (or reconcile `PDPP_API_VERSION`'s meaning to
+ * something distinct from the `PDPP-Version` header, if that field is
+ * actually meant to version the grant schema rather than the wire protocol)
+ * — that reconciliation was not made unilaterally here since it touches
+ * AS-owned files this lane does not edit.
+ */
+export const PDPP_VERSION = "2026-04-06";
+//# sourceMappingURL=pdpp-version.js.map

package/dist/pdpp-version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pdpp-version.js","sourceRoot":"","sources":["../src/pdpp-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,YAAY,CAAC"}

package/dist/policy/data-read.d.ts

@@ -0,0 +1,56 @@
+import type { GatewayGrantResponse } from "@opendatalabs/vana-sdk/browser";
+import { type AuthSessionVerifierPort, type GrantVerifierPort, type RuntimeAvailabilityPort } from "../ports/index.js";
+import type { PdppGrantBindingStore } from "../grants/pdpp-binding-store.js";
+export interface DataReadPolicyInput {
+    signer: `0x${string}`;
+    grantId?: string;
+    requestedScope: string;
+    fileId?: string;
+    /**
+     * This server's owner address. The grant's grantor MUST equal it — a grant
+     * issued by a different owner is rejected. Required (not optional) so that
+     * TypeScript flags any caller that fails to bind the read to the server
+     * owner; the check also fails closed at runtime for untyped/JS callers.
+     */
+    serverOwner: `0x${string}`;
+    /**
+     * The PDPP grant id the caller is reading under, when the read is authorized
+     * through a PDPP grant rather than a bare chain grant (§6).
+     *
+     * Optional because the chain-grant read path predates PDPP and still works
+     * on its own. When present — and only then — the PDPP↔chain binding is
+     * enforced in addition to every existing check, never instead of one.
+     */
+    pdppGrantId?: string;
+}
+export interface DataReadPolicyPorts {
+    authSessionVerifier: AuthSessionVerifierPort;
+    grantVerifier: GrantVerifierPort;
+    /**
+     * Retained PDPP↔chain grant bindings. Required only to serve reads that
+     * present a `pdppGrantId`; a PS with no PDPP surface omits it.
+     */
+    pdppGrantBindings?: PdppGrantBindingStore;
+    /**
+     * The chain deployment this PS is configured against. Required alongside
+     * `pdppGrantBindings` so a binding recorded on one network cannot authorize
+     * a read on another.
+     */
+    chainDeployment?: {
+        chainId: number;
+        contractAddress: `0x${string}`;
+    };
+    runtimeAvailability?: RuntimeAvailabilityPort;
+}
+/**
+ * Parse a grant's `expiresAt` into unix seconds. Accepts the legacy
+ * uint256-seconds string, a numeric value, or the current gateway ISO
+ * timestamp. Returns 0 for "perpetual" encodings (null/undefined/"0") and
+ * null for unparseable input. Shared by the read and write policies so both
+ * stay aligned with the gateway response shape.
+ */
+export declare function parseGrantExpiresAtSeconds(value: unknown): number | null;
+/** Auth-result sentinels; see the reserved-grantId check below. */
+export declare const SENTINEL_GRANT_IDS: Set<string>;
+export declare function verifyDataReadPolicy(input: DataReadPolicyInput, ports: DataReadPolicyPorts): Promise<GatewayGrantResponse>;
+//# sourceMappingURL=data-read.d.ts.map

package/dist/policy/data-read.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-read.d.ts","sourceRoot":"","sources":["../../src/policy/data-read.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAa3E,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC7B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAE7E,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,KAAK,MAAM,EAAE,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IAGvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;IAC3B;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,mBAAmB;IAClC,mBAAmB,EAAE,uBAAuB,CAAC;IAC7C,aAAa,EAAE,iBAAiB,CAAC;IACjC;;;OAGG;IACH,iBAAiB,CAAC,EAAE,qBAAqB,CAAC;IAC1C;;;;OAIG;IACH,eAAe,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,KAAK,MAAM,EAAE,CAAA;KAAE,CAAC;IAKtE,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;CAC/C;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAUxE;AAED,mEAAmE;AACnE,eAAO,MAAM,kBAAkB,aAAsC,CAAC;AAEtE,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,mBAAmB,EAC1B,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,oBAAoB,CAAC,CAuK/B"}

package/dist/policy/data-read.js

@@ -0,0 +1,176 @@
+import { scopeCoveredByGrant } from "@opendatalabs/vana-sdk/browser";
+import { GrantExpiredError, GrantOwnerMismatchError, GrantRequiredError, GrantRevokedError, InvalidSignatureError, PsUnavailableError, ScopeMismatchError, ServerNotConfiguredError, UnregisteredBuilderError, } from "../errors/catalog.js";
+import { verifyPdppGrantBinding } from "../grants/pdpp-binding.js";
+/**
+ * Parse a grant's `expiresAt` into unix seconds. Accepts the legacy
+ * uint256-seconds string, a numeric value, or the current gateway ISO
+ * timestamp. Returns 0 for "perpetual" encodings (null/undefined/"0") and
+ * null for unparseable input. Shared by the read and write policies so both
+ * stay aligned with the gateway response shape.
+ */
+export function parseGrantExpiresAtSeconds(value) {
+    if (value === null || value === undefined || value === "0")
+        return 0;
+    if (typeof value === "number")
+        return Number.isFinite(value) ? value : null;
+    if (typeof value !== "string")
+        return null;
+    const numeric = Number(value);
+    if (Number.isFinite(numeric))
+        return numeric;
+    const millis = Date.parse(value);
+    return Number.isNaN(millis) ? null : Math.floor(millis / 1000);
+}
+/** Auth-result sentinels; see the reserved-grantId check below. */
+export const SENTINEL_GRANT_IDS = new Set(["owner", "policy-bypass"]);
+export async function verifyDataReadPolicy(input, ports) {
+    const available = await ports.runtimeAvailability?.isAvailable();
+    if (available === false) {
+        throw new PsUnavailableError();
+    }
+    const builder = await ports.authSessionVerifier.getBuilder(input.signer);
+    if (!builder) {
+        throw new UnregisteredBuilderError();
+    }
+    if (!input.grantId) {
+        throw new GrantRequiredError({
+            reason: "No grantId in authorization payload",
+        });
+    }
+    // "owner" / "policy-bypass" are server-internal auth-result sentinels that
+    // confer the unredacted owner view and the x402 payment exemption. Neither
+    // caller input nor a gateway-supplied grant id may ever occupy them.
+    if (SENTINEL_GRANT_IDS.has(input.grantId)) {
+        throw new GrantRequiredError({
+            reason: "Reserved grantId",
+            grantId: input.grantId,
+        });
+    }
+    const grant = await ports.grantVerifier.getGrant(input.grantId);
+    if (!grant) {
+        throw new GrantRequiredError({
+            reason: "Grant not found",
+            grantId: input.grantId,
+        });
+    }
+    if (SENTINEL_GRANT_IDS.has(grant.id)) {
+        throw new GrantRequiredError({
+            reason: "Grant resolved to a reserved id",
+            grantId: input.grantId,
+        });
+    }
+    if (grant.revokedAt !== null) {
+        throw new GrantRevokedError({ grantId: grant.id });
+    }
+    // Canary GatewayGrantResponse is flat — scopes is a top-level string[]
+    // and expiresAt is a decimal-string uint256 (`null` = perpetual). The
+    // legacy signed `grant` JSON blob and `fileIds` pinning are gone.
+    if (!grant.scopes || grant.scopes.length === 0) {
+        throw new ScopeMismatchError({
+            requestedScope: input.requestedScope,
+            reason: "Grant has no scopes",
+        });
+    }
+    if (grant.expiresAt !== null && grant.expiresAt !== undefined) {
+        // DPv2 may surface either the legacy uint256-seconds string or the
+        // current gateway ISO timestamp. Parse both so the policy stays aligned
+        // with the gateway response shape.
+        const expiresAtSec = parseGrantExpiresAtSeconds(grant.expiresAt);
+        if (expiresAtSec === null) {
+            throw new ScopeMismatchError({
+                requestedScope: input.requestedScope,
+                reason: "Grant expiry is invalid",
+            });
+        }
+        if (expiresAtSec > 0) {
+            const nowSec = Math.floor(Date.now() / 1000);
+            if (expiresAtSec < nowSec) {
+                throw new GrantExpiredError({
+                    expiresAt: expiresAtSec,
+                });
+            }
+        }
+    }
+    if (!scopeCoveredByGrant(input.requestedScope, grant.scopes)) {
+        throw new ScopeMismatchError({
+            requestedScope: input.requestedScope,
+            grantedScopes: grant.scopes,
+        });
+    }
+    if (builder.id.toLowerCase() !== grant.granteeId.toLowerCase()) {
+        throw new InvalidSignatureError({
+            reason: "Request signer is not the grant builder",
+            expected: grant.granteeId,
+            actual: input.signer,
+        });
+    }
+    // Ownership binding — the grant MUST have been issued by THIS server's owner.
+    // Otherwise any PS holding the requested scope's data would serve it under a
+    // grant issued by a *different* owner (the happy-path binding is the app
+    // resolving the grantor's own PS via serverAddress — a convention, not an
+    // enforcement). Fail CLOSED: a missing serverOwner (server misconfig) or a
+    // grant with no grantor (gateway responses are untrusted runtime data,
+    // despite their type) must reject, never skip the check.
+    if (!input.serverOwner) {
+        throw new ServerNotConfiguredError({
+            reason: "serverOwner is required to verify grant ownership",
+        });
+    }
+    if (!grant.grantorAddress ||
+        grant.grantorAddress.toLowerCase() !== input.serverOwner.toLowerCase()) {
+        throw new GrantOwnerMismatchError({
+            grantId: grant.id,
+            expected: input.serverOwner,
+            actual: grant.grantorAddress ?? null,
+        });
+    }
+    // §6 — PDPP↔chain binding. Runs last, so it strengthens the chain-grant
+    // checks above rather than substituting for them: a read presenting a PDPP
+    // grant must satisfy BOTH authorities.
+    if (input.pdppGrantId !== undefined) {
+        // Fail closed. A PS that cannot check the binding must not serve the read
+        // as if there were nothing to check — that would make the binding
+        // bypassable by simply omitting the store.
+        //
+        // The client is told only that no binding authorizes the read. Reporting
+        // "this server is misconfigured" would disclose the operator's deployment
+        // state to an unauthorized caller, and the distinction is useless to a
+        // client either way: both mean "not authorized here". `misconfigured` is
+        // carried in the details for the operator's logs.
+        if (!ports.pdppGrantBindings || !ports.chainDeployment) {
+            throw new GrantRequiredError({
+                reason: "No binding authorizes this PDPP grant",
+                pdppGrantId: input.pdppGrantId,
+                misconfigured: true,
+            });
+        }
+        const binding = ports.pdppGrantBindings.getByPdppGrantId(input.pdppGrantId);
+        if (!binding) {
+            throw new GrantRequiredError({
+                reason: "No retained binding for this PDPP grant",
+                pdppGrantId: input.pdppGrantId,
+            });
+        }
+        // The binding must point at the very chain grant we just validated;
+        // otherwise a caller could pair a valid PDPP grant with an unrelated
+        // chain grant that happens to pass on its own.
+        if (binding.permission.permissionId !== grant.id) {
+            throw new ScopeMismatchError({
+                requestedScope: input.requestedScope,
+                reason: "PDPP binding does not reference the presented chain grant",
+                expected: binding.permission.permissionId,
+                actual: grant.id,
+            });
+        }
+        verifyPdppGrantBinding({
+            binding,
+            pdppGrantId: input.pdppGrantId,
+            serverOwner: input.serverOwner,
+            requestSigner: input.signer,
+            chainGrant: grant,
+            deployment: ports.chainDeployment,
+        });
+    }
+    return grant;
+}
+//# sourceMappingURL=data-read.js.map

package/dist/policy/data-read.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-read.js","sourceRoot":"","sources":["../../src/policy/data-read.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,sBAAsB,CAAC;AAM9B,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAiDnE;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAc;IACvD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,CAAC,CAAC;IACrE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5E,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3C,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAE7C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AACjE,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC;AAEtE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAA0B,EAC1B,KAA0B;IAE1B,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,mBAAmB,EAAE,WAAW,EAAE,CAAC;IACjE,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,kBAAkB,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACzE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,wBAAwB,EAAE,CAAC;IACvC,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,IAAI,kBAAkB,CAAC;YAC3B,MAAM,EAAE,qCAAqC;SAC9C,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,2EAA2E;IAC3E,qEAAqE;IACrE,IAAI,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,kBAAkB,CAAC;YAC3B,MAAM,EAAE,kBAAkB;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,kBAAkB,CAAC;YAC3B,MAAM,EAAE,iBAAiB;YACzB,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,kBAAkB,CAAC;YAC3B,MAAM,EAAE,iCAAiC;YACzC,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,uEAAuE;IACvE,sEAAsE;IACtE,kEAAkE;IAClE,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,kBAAkB,CAAC;YAC3B,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,MAAM,EAAE,qBAAqB;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC9D,mEAAmE;QACnE,wEAAwE;QACxE,mCAAmC;QACnC,MAAM,YAAY,GAAG,0BAA0B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACjE,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,MAAM,EAAE,yBAAyB;aAClC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAC7C,IAAI,YAAY,GAAG,MAAM,EAAE,CAAC;gBAC1B,MAAM,IAAI,iBAAiB,CAAC;oBAC1B,SAAS,EAAE,YAAY;iBACxB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,kBAAkB,CAAC;YAC3B,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,aAAa,EAAE,KAAK,CAAC,MAAM;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,IAAI,OAAO,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;QAC/D,MAAM,IAAI,qBAAqB,CAAC;YAC9B,MAAM,EAAE,yCAAyC;YACjD,QAAQ,EAAE,KAAK,CAAC,SAAS;YACzB,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAC9E,6EAA6E;IAC7E,yEAAyE;IACzE,0EAA0E;IAC1E,2EAA2E;IAC3E,uEAAuE;IACvE,yDAAyD;IACzD,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACvB,MAAM,IAAI,wBAAwB,CAAC;YACjC,MAAM,EAAE,mDAAmD;SAC5D,CAAC,CAAC;IACL,CAAC;IACD,IACE,CAAC,KAAK,CAAC,cAAc;QACrB,KAAK,CAAC,cAAc,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE,EACtE,CAAC;QACD,MAAM,IAAI,uBAAuB,CAAC;YAChC,OAAO,EAAE,KAAK,CAAC,EAAE;YACjB,QAAQ,EAAE,KAAK,CAAC,WAAW;YAC3B,MAAM,EAAE,KAAK,CAAC,cAAc,IAAI,IAAI;SACrC,CAAC,CAAC;IACL,CAAC;IAED,wEAAwE;IACxE,2EAA2E;IAC3E,uCAAuC;IACvC,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACpC,0EAA0E;QAC1E,kEAAkE;QAClE,2CAA2C;QAC3C,EAAE;QACF,yEAAyE;QACzE,0EAA0E;QAC1E,uEAAuE;QACvE,yEAAyE;QACzE,kDAAkD;QAClD,IAAI,CAAC,KAAK,CAAC,iBAAiB,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;YACvD,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,MAAM,EAAE,uCAAuC;gBAC/C,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,aAAa,EAAE,IAAI;aACpB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC5E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,MAAM,EAAE,yCAAyC;gBACjD,WAAW,EAAE,KAAK,CAAC,WAAW;aAC/B,CAAC,CAAC;QACL,CAAC;QAED,oEAAoE;QACpE,qEAAqE;QACrE,+CAA+C;QAC/C,IAAI,OAAO,CAAC,UAAU,CAAC,YAAY,KAAK,KAAK,CAAC,EAAE,EAAE,CAAC;YACjD,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,MAAM,EAAE,2DAA2D;gBACnE,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,YAAY;gBACzC,MAAM,EAAE,KAAK,CAAC,EAAE;aACjB,CAAC,CAAC;QACL,CAAC;QAED,sBAAsB,CAAC;YACrB,OAAO;YACP,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,aAAa,EAAE,KAAK,CAAC,MAAM;YAC3B,UAAU,EAAE,KAAK;YACjB,UAAU,EAAE,KAAK,CAAC,eAAe;SAClC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/policy/data-write.d.ts

@@ -0,0 +1,69 @@
+import type { GatewayGrantResponse } from "@opendatalabs/vana-sdk/browser";
+import { type AuthSessionVerifierPort, type GrantVerifierPort, type RuntimeAvailabilityPort } from "../ports/index.js";
+/**
+ * Write-grant encoding: a grant scope entry prefixed with `write:` authorizes
+ * the grantee to WRITE into the scope it names (e.g. `write:notes.entries`,
+ * `write:notes.*`). The suffix uses the same pattern grammar as read scopes
+ * (`*` / `{prefix}.*` / exact), evaluated with the SDK's scopeMatchesPattern.
+ *
+ * Why a scope-entry prefix and not a new grant field: the gateway's grant
+ * shape (GatewayGrantResponse) has no permission axis — `scopes` is its only
+ * capability carrier — and the gateway validates scope entries as opaque
+ * non-empty strings, so `write:`-prefixed entries flow through createGrant /
+ * getGrant / the EIP-712 GrantRegistration signature unchanged. The Personal
+ * Server is the sole interpreter.
+ *
+ * Separation of powers falls out of the encoding:
+ *   - read policy matches the REQUESTED scope against grant entries verbatim
+ *     (scopeCoveredByGrant), and a requested scope never carries the prefix,
+ *     so `write:x` entries can never satisfy a read;
+ *   - write policy (below) only honors `write:`-prefixed entries, so plain
+ *     read entries can never satisfy a write.
+ */
+export declare const WRITE_SCOPE_PREFIX = "write:";
+export declare function isWriteScopeEntry(entry: string): boolean;
+/** The scope patterns a grant authorizes for writing (prefix stripped). */
+export declare function writeScopePatterns(grantScopes: readonly string[]): string[];
+export declare function scopeCoveredByWriteGrant(requestedScope: string, grantScopes: readonly string[]): boolean;
+/**
+ * Fee seam for builder writes. Write fee mechanics are undecided — the
+ * default (no port wired) is FREE. When a fee model lands (x402-style like
+ * reads, or something else), implement this port and wire it into
+ * DataWritePolicyPorts; the policy calls it after all authorization
+ * invariants pass, so a fee rejection never masks an auth failure.
+ */
+export interface WriteFeeVerifierPort {
+    assertWriteAllowed(input: {
+        builder: `0x${string}`;
+        grant: GatewayGrantResponse;
+        scope: string;
+    }): Promise<void>;
+}
+export interface DataWritePolicyInput {
+    signer: `0x${string}`;
+    grantId?: string;
+    requestedScope: string;
+    /**
+     * This server's owner address. The grant's grantor MUST equal it — a grant
+     * issued by a different owner is rejected. Required (not optional) so that
+     * TypeScript flags any caller that fails to bind the write to the server
+     * owner; the check also fails closed at runtime for untyped/JS callers.
+     */
+    serverOwner: `0x${string}`;
+}
+export interface DataWritePolicyPorts {
+    authSessionVerifier: AuthSessionVerifierPort;
+    grantVerifier: GrantVerifierPort;
+    runtimeAvailability?: RuntimeAvailabilityPort;
+    /** Absent = writes are free (see WriteFeeVerifierPort). */
+    writeFeeVerifier?: WriteFeeVerifierPort;
+}
+/**
+ * Authorize one builder write against a write-grant. Mirrors
+ * verifyDataReadPolicy invariant-for-invariant (builder registered, grant
+ * present / not revoked / not expired, scope coverage, grantee binding,
+ * owner binding) — but scope coverage only honors `write:`-prefixed grant
+ * entries, so a read-grant never confers write access.
+ */
+export declare function verifyDataWritePolicy(input: DataWritePolicyInput, ports: DataWritePolicyPorts): Promise<GatewayGrantResponse>;
+//# sourceMappingURL=data-write.d.ts.map

package/dist/policy/data-write.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-write.d.ts","sourceRoot":"","sources":["../../src/policy/data-write.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAa3E,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC7B,MAAM,mBAAmB,CAAC;AAG3B;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,kBAAkB,WAAW,CAAC;AAE3C,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAExD;AAED,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAK3E;AAED,wBAAgB,wBAAwB,CACtC,cAAc,EAAE,MAAM,EACtB,WAAW,EAAE,SAAS,MAAM,EAAE,GAC7B,OAAO,CAIT;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,kBAAkB,CAAC,KAAK,EAAE;QACxB,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;QACvB,KAAK,EAAE,oBAAoB,CAAC;QAC5B,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,KAAK,MAAM,EAAE,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,oBAAoB;IACnC,mBAAmB,EAAE,uBAAuB,CAAC;IAC7C,aAAa,EAAE,iBAAiB,CAAC;IACjC,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;IAC9C,2DAA2D;IAC3D,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;CACzC;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,oBAAoB,EAC3B,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,oBAAoB,CAAC,CAkG/B"}

package/dist/policy/data-write.js

@@ -0,0 +1,131 @@
+import { scopeMatchesPattern } from "@opendatalabs/vana-sdk/browser";
+import { GrantExpiredError, GrantOwnerMismatchError, GrantRequiredError, GrantRevokedError, InvalidSignatureError, PsUnavailableError, ScopeMismatchError, ServerNotConfiguredError, UnregisteredBuilderError, } from "../errors/catalog.js";
+import { parseGrantExpiresAtSeconds } from "./data-read.js";
+/**
+ * Write-grant encoding: a grant scope entry prefixed with `write:` authorizes
+ * the grantee to WRITE into the scope it names (e.g. `write:notes.entries`,
+ * `write:notes.*`). The suffix uses the same pattern grammar as read scopes
+ * (`*` / `{prefix}.*` / exact), evaluated with the SDK's scopeMatchesPattern.
+ *
+ * Why a scope-entry prefix and not a new grant field: the gateway's grant
+ * shape (GatewayGrantResponse) has no permission axis — `scopes` is its only
+ * capability carrier — and the gateway validates scope entries as opaque
+ * non-empty strings, so `write:`-prefixed entries flow through createGrant /
+ * getGrant / the EIP-712 GrantRegistration signature unchanged. The Personal
+ * Server is the sole interpreter.
+ *
+ * Separation of powers falls out of the encoding:
+ *   - read policy matches the REQUESTED scope against grant entries verbatim
+ *     (scopeCoveredByGrant), and a requested scope never carries the prefix,
+ *     so `write:x` entries can never satisfy a read;
+ *   - write policy (below) only honors `write:`-prefixed entries, so plain
+ *     read entries can never satisfy a write.
+ */
+export const WRITE_SCOPE_PREFIX = "write:";
+export function isWriteScopeEntry(entry) {
+    return entry.startsWith(WRITE_SCOPE_PREFIX);
+}
+/** The scope patterns a grant authorizes for writing (prefix stripped). */
+export function writeScopePatterns(grantScopes) {
+    return grantScopes
+        .filter(isWriteScopeEntry)
+        .map((entry) => entry.slice(WRITE_SCOPE_PREFIX.length))
+        .filter((pattern) => pattern.length > 0);
+}
+export function scopeCoveredByWriteGrant(requestedScope, grantScopes) {
+    return writeScopePatterns(grantScopes).some((pattern) => scopeMatchesPattern(requestedScope, pattern));
+}
+/**
+ * Authorize one builder write against a write-grant. Mirrors
+ * verifyDataReadPolicy invariant-for-invariant (builder registered, grant
+ * present / not revoked / not expired, scope coverage, grantee binding,
+ * owner binding) — but scope coverage only honors `write:`-prefixed grant
+ * entries, so a read-grant never confers write access.
+ */
+export async function verifyDataWritePolicy(input, ports) {
+    const available = await ports.runtimeAvailability?.isAvailable();
+    if (available === false) {
+        throw new PsUnavailableError();
+    }
+    const builder = await ports.authSessionVerifier.getBuilder(input.signer);
+    if (!builder) {
+        throw new UnregisteredBuilderError();
+    }
+    if (!input.grantId) {
+        throw new GrantRequiredError({
+            reason: "No grantId bound to the write session",
+        });
+    }
+    const grant = await ports.grantVerifier.getGrant(input.grantId);
+    if (!grant) {
+        throw new GrantRequiredError({
+            reason: "Grant not found",
+            grantId: input.grantId,
+        });
+    }
+    if (grant.revokedAt !== null) {
+        throw new GrantRevokedError({ grantId: grant.id });
+    }
+    if (!grant.scopes || writeScopePatterns(grant.scopes).length === 0) {
+        throw new ScopeMismatchError({
+            requestedScope: input.requestedScope,
+            reason: "Grant has no write scopes",
+        });
+    }
+    if (grant.expiresAt !== null && grant.expiresAt !== undefined) {
+        const expiresAtSec = parseGrantExpiresAtSeconds(grant.expiresAt);
+        if (expiresAtSec === null) {
+            throw new ScopeMismatchError({
+                requestedScope: input.requestedScope,
+                reason: "Grant expiry is invalid",
+            });
+        }
+        if (expiresAtSec > 0) {
+            const nowSec = Math.floor(Date.now() / 1000);
+            if (expiresAtSec < nowSec) {
+                throw new GrantExpiredError({
+                    expiresAt: expiresAtSec,
+                });
+            }
+        }
+    }
+    if (!scopeCoveredByWriteGrant(input.requestedScope, grant.scopes)) {
+        throw new ScopeMismatchError({
+            requestedScope: input.requestedScope,
+            grantedScopes: grant.scopes,
+            reason: "Grant does not authorize writing to this scope",
+        });
+    }
+    if (builder.id.toLowerCase() !== grant.granteeId.toLowerCase()) {
+        throw new InvalidSignatureError({
+            reason: "Write signer is not the grant builder",
+            expected: grant.granteeId,
+            actual: input.signer,
+        });
+    }
+    // Ownership binding — the grant MUST have been issued by THIS server's
+    // owner (same fail-closed rules as verifyDataReadPolicy: a missing
+    // serverOwner or a grantor-less gateway response rejects, never skips).
+    if (!input.serverOwner) {
+        throw new ServerNotConfiguredError({
+            reason: "serverOwner is required to verify grant ownership",
+        });
+    }
+    if (!grant.grantorAddress ||
+        grant.grantorAddress.toLowerCase() !== input.serverOwner.toLowerCase()) {
+        throw new GrantOwnerMismatchError({
+            grantId: grant.id,
+            expected: input.serverOwner,
+            actual: grant.grantorAddress ?? null,
+        });
+    }
+    // All authorization invariants passed — apply the fee seam last (default
+    // free; see WriteFeeVerifierPort).
+    await ports.writeFeeVerifier?.assertWriteAllowed({
+        builder: input.signer,
+        grant,
+        scope: input.requestedScope,
+    });
+    return grant;
+}
+//# sourceMappingURL=data-write.js.map

package/dist/policy/data-write.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-write.js","sourceRoot":"","sources":["../../src/policy/data-write.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,sBAAsB,CAAC;AAM9B,OAAO,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AAE5D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,QAAQ,CAAC;AAE3C,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,KAAK,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;AAC9C,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,kBAAkB,CAAC,WAA8B;IAC/D,OAAO,WAAW;SACf,MAAM,CAAC,iBAAiB,CAAC;SACzB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;SACtD,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,cAAsB,EACtB,WAA8B;IAE9B,OAAO,kBAAkB,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CACtD,mBAAmB,CAAC,cAAc,EAAE,OAAO,CAAC,CAC7C,CAAC;AACJ,CAAC;AAsCD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAA2B,EAC3B,KAA2B;IAE3B,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,mBAAmB,EAAE,WAAW,EAAE,CAAC;IACjE,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,kBAAkB,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACzE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,wBAAwB,EAAE,CAAC;IACvC,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,IAAI,kBAAkB,CAAC;YAC3B,MAAM,EAAE,uCAAuC;SAChD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,kBAAkB,CAAC;YAC3B,MAAM,EAAE,iBAAiB;YACzB,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,kBAAkB,CAAC;YAC3B,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,MAAM,EAAE,2BAA2B;SACpC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC9D,MAAM,YAAY,GAAG,0BAA0B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACjE,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,MAAM,EAAE,yBAAyB;aAClC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAC7C,IAAI,YAAY,GAAG,MAAM,EAAE,CAAC;gBAC1B,MAAM,IAAI,iBAAiB,CAAC;oBAC1B,SAAS,EAAE,YAAY;iBACxB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,kBAAkB,CAAC;YAC3B,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,aAAa,EAAE,KAAK,CAAC,MAAM;YAC3B,MAAM,EAAE,gDAAgD;SACzD,CAAC,CAAC;IACL,CAAC;IAED,IAAI,OAAO,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;QAC/D,MAAM,IAAI,qBAAqB,CAAC;YAC9B,MAAM,EAAE,uCAAuC;YAC/C,QAAQ,EAAE,KAAK,CAAC,SAAS;YACzB,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;IACL,CAAC;IAED,uEAAuE;IACvE,mEAAmE;IACnE,wEAAwE;IACxE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACvB,MAAM,IAAI,wBAAwB,CAAC;YACjC,MAAM,EAAE,mDAAmD;SAC5D,CAAC,CAAC;IACL,CAAC;IACD,IACE,CAAC,KAAK,CAAC,cAAc;QACrB,KAAK,CAAC,cAAc,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE,EACtE,CAAC;QACD,MAAM,IAAI,uBAAuB,CAAC;YAChC,OAAO,EAAE,KAAK,CAAC,EAAE;YACjB,QAAQ,EAAE,KAAK,CAAC,WAAW;YAC3B,MAAM,EAAE,KAAK,CAAC,cAAc,IAAI,IAAI;SACrC,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,mCAAmC;IACnC,MAAM,KAAK,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;QAC/C,OAAO,EAAE,KAAK,CAAC,MAAM;QACrB,KAAK;QACL,KAAK,EAAE,KAAK,CAAC,cAAc;KAC5B,CAAC,CAAC;IAEH,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/policy/index.d.ts

@@ -0,0 +1,4 @@
+export { verifyDataReadPolicy, parseGrantExpiresAtSeconds, type DataReadPolicyInput, type DataReadPolicyPorts, } from "./data-read.js";
+export { deriveBuilderId, verifySignedArtifacts, type SignedArtifactInput, type SignedBuilder, type SignedGrant, } from "./signed-artifacts.js";
+export { WRITE_SCOPE_PREFIX, isWriteScopeEntry, writeScopePatterns, scopeCoveredByWriteGrant, verifyDataWritePolicy, type DataWritePolicyInput, type DataWritePolicyPorts, type WriteFeeVerifierPort, } from "./data-write.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/policy/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,WAAW,GACjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,wBAAwB,EACxB,qBAAqB,EACrB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,GAC1B,MAAM,iBAAiB,CAAC"}

package/dist/policy/index.js

@@ -0,0 +1,4 @@
+export { verifyDataReadPolicy, parseGrantExpiresAtSeconds, } from "./data-read.js";
+export { deriveBuilderId, verifySignedArtifacts, } from "./signed-artifacts.js";
+export { WRITE_SCOPE_PREFIX, isWriteScopeEntry, writeScopePatterns, scopeCoveredByWriteGrant, verifyDataWritePolicy, } from "./data-write.js";
+//# sourceMappingURL=index.js.map

package/dist/policy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,0BAA0B,GAG3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,eAAe,EACf,qBAAqB,GAItB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,wBAAwB,EACxB,qBAAqB,GAItB,MAAM,iBAAiB,CAAC"}

package/dist/policy/signed-artifacts.d.ts

@@ -0,0 +1,17 @@
+import { type Builder, type DataPortabilityGatewayConfig, type GatewayGrantResponse } from "@opendatalabs/vana-sdk/browser";
+import { type Address, type Hex } from "viem";
+export type SignedGrant = GatewayGrantResponse & {
+    signature?: string;
+};
+export type SignedBuilder = Builder & {
+    signature?: string;
+};
+export interface SignedArtifactInput {
+    grant: SignedGrant;
+    builder: SignedBuilder;
+    gatewayConfig: DataPortabilityGatewayConfig;
+    ownerAddress: Address;
+}
+export declare function verifySignedArtifacts(input: SignedArtifactInput): Promise<void>;
+export declare function deriveBuilderId(builder: Pick<Builder, "ownerAddress" | "granteeAddress" | "publicKey" | "appUrl">, gatewayConfig: DataPortabilityGatewayConfig): Hex;
+//# sourceMappingURL=signed-artifacts.d.ts.map

package/dist/policy/signed-artifacts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signed-artifacts.d.ts","sourceRoot":"","sources":["../../src/policy/signed-artifacts.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,OAAO,EACZ,KAAK,4BAA4B,EACjC,KAAK,oBAAoB,EAC1B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAML,KAAK,OAAO,EACZ,KAAK,GAAG,EACT,MAAM,MAAM,CAAC;AAQd,MAAM,MAAM,WAAW,GAAG,oBAAoB,GAAG;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AACxE,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAgB7D,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,EAAE,aAAa,CAAC;IACvB,aAAa,EAAE,4BAA4B,CAAC;IAC5C,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,IAAI,CAAC,CAiEf;AAED,wBAAgB,eAAe,CAC7B,OAAO,EAAE,IAAI,CACX,OAAO,EACP,cAAc,GAAG,gBAAgB,GAAG,WAAW,GAAG,QAAQ,CAC3D,EACD,aAAa,EAAE,4BAA4B,GAC1C,GAAG,CAoCL"}