@opendatalabs/personal-server-ts-core 0.0.1-canary.01ca694 → 0.0.1-canary.052d47e

package/dist/write/attribution.js

@@ -0,0 +1,450 @@
+/**
+ * Builder attribution for delegated writes.
+ *
+ * The write-session token authorizes a write; it does not PROVE who authored
+ * the payload (a bearer token is not a signature). For cryptographic
+ * attribution the builder also signs the payload: a Web3Signed proof over the
+ * exact write request (aud / method / uri / bodyHash / iat / exp), carried in
+ * the `X-Vana-Write-Signature` header and signed by the builder key proven at
+ * handshake. The PS verifies the proof recovers to the session's builder and
+ * that its bodyHash commits to the received bytes, then stores the proof and
+ * the builder identity WITH the record — inside the envelope's `data` under
+ * the reserved `$writtenBy` key (same in-`data` marker idiom as `$binary`),
+ * so attribution travels through the unchanged encrypt / upload / register
+ * path and back out on read. The on-chain shape is untouched.
+ *
+ * The proof binds the write to its context, not just its bytes: the signed
+ * claims carry the request uri (path AND query, see canonicalSignedUri; the
+ * path's last segment is the scope on the ingest route), the method, the
+ * audience (this server's origin) and the session's grantId, which the PS
+ * requires to match the session at ingest. A stored `$writtenBy` therefore
+ * cannot be lifted onto another scope's record or relabelled with a
+ * different grant and still verify. A proof may also carry an optional
+ * `nonce` claim, which is what makes it unique: without one, two identical
+ * requests signed in the same second are byte-identical and the replay guard
+ * refuses the second.
+ *
+ * What the builder signs is the STORED representation, not the wire body:
+ * the compact JSON of the envelope `data` record the PS will write (minus
+ * `$writtenBy`). A third party holding the envelope can therefore verify
+ * authorship from the envelope ALONE (verifyStoredWriterAttribution): recover
+ * the signer over the stored proof's base64url payload (EIP-191), check the
+ * signed claims against the envelope's scope and stored grantId, and hash
+ * JSON.stringify(data minus the server-stamped keys `$writtenBy` and
+ * `$lineage`) against the signed bodyHash.
+ *   - JSON writes: the body IS the stored record, so the builder signs the
+ *     body bytes, which must be compact JSON (what JSON.stringify emits: no
+ *     insignificant whitespace, keys in the order given). JSON.parse /
+ *     JSON.stringify round-trips that byte-for-byte; a body that does not
+ *     round-trip is rejected at write time (WRITE_BODY_NOT_CANONICAL) instead
+ *     of being stored with an attribution nobody can check.
+ *   - Binary writes: the stored record is the `$binary` envelope data (media
+ *     type, filename, caller metadata, size, content hash, base64 content),
+ *     so the builder signs its compact JSON (binaryWriteSignedBytes). That
+ *     binds the caller-controlled representation headers (Content-Type,
+ *     X-Filename / Content-Disposition, X-Vana-Metadata) to the signature and
+ *     makes a JSON-vs-binary switch of the same bytes fail verification.
+ */
+import { computeBodyHash, parseWeb3SignedHeader, verifyWeb3Signed, } from "@opendatalabs/vana-sdk/browser";
+import { recoverMessageAddress } from "viem";
+import { ProtocolError } from "../errors/catalog.js";
+import { hashConnectionToken as sha256HexOf } from "../mcp/connection-api.js";
+import { binaryFilename, binaryMimeType, buildBinaryEnvelopeData, isJsonContentType, normalizeBinaryMimeType, parseMetadataHeader, sha256Hex, } from "../contracts/binary.js";
+import { LINEAGE_KEY, StoredLineageMalformedError, extractLineageField, readStoredLineage, } from "../lineage/lineage.js";
+import { isBinaryEnvelope } from "../contracts/binary.js";
+/** Header carrying the builder's signed-payload proof on a session write. */
+export const WRITE_SIGNATURE_HEADER = "x-vana-write-signature";
+/**
+ * Upper bound on the optional `nonce` claim (a uuid or a short random
+ * string is the intended shape). Bounded so a proof cannot smuggle bulk
+ * data into the replay store's keys.
+ */
+export const MAX_PROOF_NONCE_LENGTH = 128;
+/** HTTP methods that never carry a body on this API. */
+function isBodylessMethod(method) {
+    const upper = method.toUpperCase();
+    return upper === "GET" || upper === "HEAD" || upper === "DELETE";
+}
+/**
+ * Canonical query string: parameters sorted by name and then value. The
+ * signed uri must commit to the query because a query parameter can decide
+ * authorization (`GET /v1/derivatives/questions?derivedScope=X` authorizes
+ * the caller against that scope), and a proof that does not cover it can be
+ * replayed against a different scope. Sorting makes the rule insensitive to
+ * the order a client happens to serialize its parameters in.
+ */
+function canonicalQuery(search) {
+    const entries = [...new URLSearchParams(search).entries()].sort((a, b) => a[0] === b[0]
+        ? a[1] < b[1]
+            ? -1
+            : a[1] > b[1]
+                ? 1
+                : 0
+        : a[0] < b[0]
+            ? -1
+            : 1);
+    const canonical = new URLSearchParams();
+    for (const [name, value] of entries)
+        canonical.append(name, value);
+    return canonical.toString();
+}
+/**
+ * The uri a proof must commit to for a request: the path, plus the canonical
+ * query when the request carries one. A request with no query string signs
+ * the bare path exactly as before.
+ */
+export function canonicalSignedUri(pathname, search) {
+    const query = canonicalQuery(search);
+    return query ? `${pathname}?${query}` : pathname;
+}
+/** The same canonical form applied to a signed `uri` claim. */
+export function canonicalizeSignedUri(uri) {
+    const mark = uri.indexOf("?");
+    if (mark === -1)
+        return uri;
+    return canonicalSignedUri(uri.slice(0, mark), uri.slice(mark + 1));
+}
+function base64UrlDecode(value) {
+    const base64 = value.replace(/-/g, "+").replace(/_/g, "/");
+    const padded = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), "=");
+    const binary = atob(padded);
+    return new TextDecoder().decode(Uint8Array.from(binary, (char) => char.charCodeAt(0)));
+}
+/**
+ * The proof's optional `nonce` claim. Read from the raw signed payload, not
+ * from the verified claims: the SDK's parser keeps only the claims it knows,
+ * and the nonce is covered by the signature all the same (the signature is
+ * over the base64url payload string).
+ */
+function signedNonce(payloadBase64) {
+    let raw;
+    try {
+        raw = JSON.parse(base64UrlDecode(payloadBase64));
+    }
+    catch {
+        // A payload that does not decode is rejected by verifyWeb3Signed.
+        return undefined;
+    }
+    if (typeof raw !== "object" || raw === null)
+        return undefined;
+    const nonce = raw.nonce;
+    if (nonce === undefined || nonce === null)
+        return undefined;
+    if (typeof nonce !== "string" ||
+        nonce.length === 0 ||
+        nonce.length > MAX_PROOF_NONCE_LENGTH) {
+        throw new ProtocolError(401, "WRITE_ATTRIBUTION_INVALID", `Payload proof nonce must be a string of 1 to ${MAX_PROOF_NONCE_LENGTH} characters`);
+    }
+    return nonce;
+}
+/**
+ * Reserved key inside the envelope's `data` record for builder attribution.
+ * Mirrors the `$binary` marker convention (contracts/binary.ts).
+ */
+export const WRITER_ATTRIBUTION_KEY = "$writtenBy";
+function resolveOrigin(origin) {
+    return typeof origin === "function" ? origin() : origin;
+}
+/**
+ * The bytes a builder signs (as the Web3Signed body) for a BINARY session
+ * write: the compact JSON of the `$binary` record the PS stores for these
+ * headers and bytes. Mirrors ingest exactly (same media-type normalization,
+ * metadata parsing and envelope builder), so the signature covers the stored
+ * representation and verifyStoredWriterAttribution can re-derive it.
+ */
+export async function binaryWriteSignedBytes(input) {
+    const data = buildBinaryEnvelopeData({
+        bytes: input.bytes,
+        mimeType: normalizeBinaryMimeType(input.contentType),
+        filename: input.filename,
+        contentHash: await sha256Hex(input.bytes),
+        metadata: parseMetadataHeader(input.metadataHeader ?? null),
+    });
+    return new TextEncoder().encode(JSON.stringify(data));
+}
+/**
+ * The bytes the proof must commit to for this request: the body itself for
+ * a JSON write, the stored `$binary` representation for anything else.
+ */
+async function signedBytesFor(request, bodyBytes) {
+    // A bodyless method has no stored representation to sign: the proof
+    // commits to the empty body, whatever Content-Type the caller sent.
+    if (isBodylessMethod(request.method))
+        return bodyBytes;
+    if (isJsonContentType(request))
+        return bodyBytes;
+    return binaryWriteSignedBytes({
+        bytes: bodyBytes,
+        contentType: binaryMimeType(request),
+        filename: binaryFilename(request),
+        metadataHeader: request.headers.get("x-vana-metadata") ?? undefined,
+    });
+}
+/**
+ * Verify the `X-Vana-Write-Signature` proof on a session write and produce
+ * the attribution record to store with the data. Throws ProtocolError(401)
+ * when the proof is missing, malformed, expired, fails EIP-191 recovery /
+ * bodyHash binding (the hash covers the stored representation, see
+ * signedBytesFor), recovers to a different key than the session builder, or
+ * does not carry the session's grantId as a signed claim.
+ */
+export async function verifyWriterAttribution(input) {
+    const headerValue = input.request.headers.get(WRITE_SIGNATURE_HEADER) ?? undefined;
+    if (!headerValue) {
+        throw new ProtocolError(401, "WRITE_ATTRIBUTION_REQUIRED", `Session writes must carry a builder-signed payload proof in ${WRITE_SIGNATURE_HEADER}`);
+    }
+    const url = new URL(input.request.url);
+    const bodyBytes = new Uint8Array(await input.request.clone().arrayBuffer());
+    // The proof must commit to the whole request uri, query included. Any
+    // signed uri whose canonical form equals the request's canonical form is
+    // accepted, so parameter order is the client's business; anything else is
+    // handed to verifyWeb3Signed as a URI mismatch against the canonical form.
+    const expectedUri = canonicalSignedUri(url.pathname, url.search);
+    let expectedPath = expectedUri;
+    try {
+        const claimedUri = parseWeb3SignedHeader(headerValue).payload.uri;
+        if (canonicalizeSignedUri(claimedUri) === expectedUri) {
+            expectedPath = claimedUri;
+        }
+    }
+    catch {
+        // Unparseable header: verifyWeb3Signed reports it with its own error.
+    }
+    let verified;
+    try {
+        verified = await verifyWeb3Signed({
+            headerValue,
+            expectedOrigin: resolveOrigin(input.serverOrigin),
+            expectedMethod: input.request.method,
+            expectedPath,
+            bodyBytes: await signedBytesFor(input.request, bodyBytes),
+        });
+    }
+    catch (err) {
+        throw new ProtocolError(401, "WRITE_ATTRIBUTION_INVALID", err instanceof Error ? err.message : String(err));
+    }
+    if (verified.signer.toLowerCase() !== input.builderAddress.toLowerCase()) {
+        throw new ProtocolError(401, "WRITE_ATTRIBUTION_SIGNER_MISMATCH", "Payload proof is not signed by the session builder", { expected: input.builderAddress, actual: verified.signer });
+    }
+    // The grant is a signed claim, so the stored attribution's grantId is
+    // covered by the builder's signature rather than being a bare label.
+    if (verified.payload.grantId !== input.grantId) {
+        throw new ProtocolError(401, "WRITE_ATTRIBUTION_GRANT_MISMATCH", "Payload proof must carry the write session's grantId as a signed claim", { expected: input.grantId, actual: verified.payload.grantId ?? null });
+    }
+    // The compact `{payload}.{signature}` form (scheme prefix stripped) is what
+    // gets stored, so verifiers don't need to know the header framing; the raw
+    // payload is also where the optional `nonce` claim is read from.
+    const { payloadBase64, signature } = parseWeb3SignedHeader(headerValue);
+    const nonce = signedNonce(payloadBase64);
+    // Bodyless methods (the derivative read / delete routes) never carry a
+    // body: skip the canonical-JSON rule explicitly instead of running it over
+    // empty bytes, where isJsonContentType's missing-header default would send
+    // it into a swallowed JSON.parse throw.
+    if (!isBodylessMethod(input.request.method) &&
+        bodyBytes.byteLength > 0 &&
+        isJsonContentType(input.request)) {
+        assertCanonicalJsonBody(bodyBytes);
+    }
+    // Replay guard, last: only a proof that passed every check is consumed,
+    // so a rejected request never burns a proof.
+    //
+    // Without a `nonce` claim the key is the proof itself, so two identical
+    // requests signed in the same second (a naive poll of GET /questions/:id)
+    // produce byte-identical proofs and the second is refused. A proof that
+    // carries a nonce is keyed by (builder, nonce) instead: the builder makes
+    // each call distinct, and re-using a nonce is a replay even if the rest of
+    // the payload changed.
+    let releaseProof;
+    if (input.replayStore) {
+        const store = input.replayStore;
+        const proofId = await sha256HexOf(nonce === undefined
+            ? headerValue
+            : `nonce:${input.builderAddress.toLowerCase()}:${nonce}`);
+        const replayed = await store.consume(proofId, verified.payload.exp * 1000);
+        if (replayed) {
+            throw new ProtocolError(401, "WRITE_ATTRIBUTION_REPLAY", nonce === undefined
+                ? "Payload proof already used; sign a fresh proof for each call (or add a unique nonce claim so repeated reads stay distinct)"
+                : "Payload proof nonce already used; each nonce is single use");
+        }
+        releaseProof = async () => {
+            await store.release?.(proofId);
+        };
+    }
+    return {
+        builder: input.builderAddress,
+        grantId: input.grantId,
+        signature: `${payloadBase64}.${signature}`,
+        bodyHash: verified.payload.bodyHash,
+        writtenAt: (input.now?.() ?? new Date()).toISOString(),
+        ...(releaseProof ? { releaseProof } : {}),
+    };
+}
+/**
+ * Stamp attribution into an envelope `data` record. The reserved key must not
+ * appear in the caller's payload — a builder must not be able to forge (or
+ * shadow) its own attribution.
+ */
+export function stampWriterAttribution(data, attribution) {
+    return { ...data, [WRITER_ATTRIBUTION_KEY]: attribution };
+}
+export function hasReservedWriterKey(data) {
+    return Object.prototype.hasOwnProperty.call(data, WRITER_ATTRIBUTION_KEY);
+}
+/**
+ * A JSON session write must be the compact serialization of its own parsed
+ * value, so the record stored after JSON.parse re-serializes to the signed
+ * bytes. Bodies that do not parse are left to the ingest path, which reports
+ * the parse error itself.
+ */
+function assertCanonicalJsonBody(bodyBytes) {
+    const text = new TextDecoder().decode(bodyBytes);
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return;
+    }
+    if (JSON.stringify(parsed) !== text) {
+        throw new ProtocolError(400, "WRITE_BODY_NOT_CANONICAL", "Session writes must send compact JSON (the JSON.stringify form) so the stored record re-serializes to the signed bytes and the attribution bodyHash stays verifiable");
+    }
+}
+/** Proof scheme prefix the compact stored signature was stripped of. */
+const WEB3_SIGNED_SCHEME = "Web3Signed";
+export class WriterAttributionVerificationError extends Error {
+    reason;
+    constructor(reason, message) {
+        super(message);
+        this.reason = reason;
+        this.name = "WriterAttributionVerificationError";
+    }
+}
+function isWriterAttribution(value) {
+    if (typeof value !== "object" || value === null)
+        return false;
+    const v = value;
+    return (typeof v.builder === "string" &&
+        v.builder.startsWith("0x") &&
+        typeof v.grantId === "string" &&
+        typeof v.signature === "string" &&
+        typeof v.bodyHash === "string" &&
+        typeof v.writtenAt === "string");
+}
+/** Last path segment of the signed request uri, i.e. the scope written to. */
+function signedScopeOf(uri) {
+    const path = uri.split("?")[0] ?? "";
+    const segment = path.slice(path.lastIndexOf("/") + 1);
+    if (!segment)
+        return null;
+    try {
+        return decodeURIComponent(segment);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Verify builder attribution from a stored envelope alone (no request, no
+ * server state, no expiry check: the proof is evidence of who wrote the
+ * record at the time, not a live credential). Checks, in order: the envelope
+ * carries an attribution; the stored representation (compact JSON of the
+ * data minus the server-stamped `$writtenBy` and `$lineage` keys, for JSON
+ * and `$binary` records alike) re-hashes
+ * to the signed bodyHash; the proof parses and recovers to the attributed
+ * builder; and the signed claims bind the proof to THIS record: a POST whose
+ * path names the envelope's scope, the stored grantId, and (when given) the
+ * server origin. Throws WriterAttributionVerificationError with the reason.
+ */
+export async function verifyStoredWriterAttribution(envelope, options = {}) {
+    const data = envelope.data;
+    const attribution = data[WRITER_ATTRIBUTION_KEY];
+    if (!isWriterAttribution(attribution)) {
+        throw new WriterAttributionVerificationError("ATTRIBUTION_MISSING", `Record carries no ${WRITER_ATTRIBUTION_KEY} attribution`);
+    }
+    // Every server-stamped reserved key is stripped, not just the attribution:
+    // `$lineage` is the server's validated mirror of the caller's `lineage`
+    // field (the field itself stays inside the signed bytes), so a derivative
+    // record re-hashes to the same signed bodyHash as a root record.
+    const { [WRITER_ATTRIBUTION_KEY]: _attribution, [LINEAGE_KEY]: storedLineage, ...payloadData } = data;
+    const bodyHash = computeBodyHash(new TextEncoder().encode(JSON.stringify(payloadData)));
+    if (bodyHash !== attribution.bodyHash) {
+        throw new WriterAttributionVerificationError("BODY_HASH_MISMATCH", "Stored record does not hash to the attribution bodyHash");
+    }
+    let proof;
+    let signer;
+    try {
+        proof = parseWeb3SignedHeader(`${WEB3_SIGNED_SCHEME} ${attribution.signature}`);
+        signer = await recoverMessageAddress({
+            message: proof.payloadBase64,
+            signature: proof.signature,
+        });
+    }
+    catch (err) {
+        throw new WriterAttributionVerificationError("PROOF_INVALID", err instanceof Error ? err.message : String(err));
+    }
+    if (proof.payload.bodyHash !== bodyHash) {
+        throw new WriterAttributionVerificationError("BODY_HASH_MISMATCH", "Stored proof does not commit to the attribution bodyHash");
+    }
+    if (signer.toLowerCase() !== attribution.builder.toLowerCase()) {
+        throw new WriterAttributionVerificationError("SIGNER_MISMATCH", "Stored proof is not signed by the attributed builder");
+    }
+    // Context binding: the signed claims must describe a write of THIS record.
+    if (proof.payload.method !== "POST" ||
+        signedScopeOf(proof.payload.uri) !== envelope.scope) {
+        throw new WriterAttributionVerificationError("SCOPE_MISMATCH", `Stored proof is not a write to scope ${envelope.scope}`);
+    }
+    if (proof.payload.grantId !== attribution.grantId) {
+        throw new WriterAttributionVerificationError("GRANT_MISMATCH", "Stored grantId is not the grant the builder signed");
+    }
+    if (options.expectedOrigin !== undefined &&
+        proof.payload.aud !== options.expectedOrigin) {
+        throw new WriterAttributionVerificationError("AUDIENCE_MISMATCH", "Stored proof was not addressed to this server");
+    }
+    // The stripped mirror is not unauthenticated for that: it must restate
+    // the builder-signed `lineage` field (body top level, or the binary
+    // record's metadata object) in both directions, so a `$lineage` edited
+    // after the write, or one removed to hide a derivative's sources, is
+    // caught even though it is outside the hashed bytes. A signed list
+    // (empty included: an explicit root statement) must have its mirror; an
+    // absent signed field must have none.
+    const signedField = extractLineageField(isBinaryEnvelope({ data: payloadData })
+        ? payloadData.metadata
+        : payloadData);
+    // Absent or null means "no statement". Anything else that is not a list
+    // of strings is a malformed signed field: an independently constructed
+    // record must not pass verification just because its lineage claim is
+    // unreadable, so it is a mismatch, never "absent".
+    const signedAbsent = signedField === undefined || signedField === null;
+    const signedWellFormed = Array.isArray(signedField) &&
+        signedField.every((id) => typeof id === "string");
+    const signed = signedAbsent || !signedWellFormed
+        ? null
+        : signedField.map((id) => id.toLowerCase());
+    let mirror;
+    try {
+        mirror = storedLineage === undefined ? null : readStoredLineage(data);
+    }
+    catch (error) {
+        if (error instanceof StoredLineageMalformedError) {
+            throw new WriterAttributionVerificationError("LINEAGE_MISMATCH", `stored $lineage mirror is malformed: ${error.message}`);
+        }
+        throw error;
+    }
+    const consistent = !signedAbsent && !signedWellFormed
+        ? false
+        : signed === null
+            ? storedLineage === undefined
+            : mirror !== null &&
+                signed.length === mirror.sources.length &&
+                signed.every((id, i) => id === mirror.sources[i]);
+    if (!consistent) {
+        throw new WriterAttributionVerificationError("LINEAGE_MISMATCH", "Stored $lineage does not restate the builder-signed lineage field");
+    }
+    return {
+        builder: attribution.builder,
+        grantId: attribution.grantId,
+        bodyHash,
+        payload: proof.payload,
+    };
+}
+//# sourceMappingURL=attribution.js.map

package/dist/write/attribution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attribution.js","sourceRoot":"","sources":["../../src/write/attribution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,gBAAgB,GAEjB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,qBAAqB,EAAE,MAAM,MAAM,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,mBAAmB,IAAI,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAE9E,OAAO,EACL,cAAc,EACd,cAAc,EACd,uBAAuB,EACvB,iBAAiB,EACjB,uBAAuB,EACvB,mBAAmB,EACnB,SAAS,GACV,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,WAAW,EACX,2BAA2B,EAC3B,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D,6EAA6E;AAC7E,MAAM,CAAC,MAAM,sBAAsB,GAAG,wBAAwB,CAAC;AAE/D;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAE1C,wDAAwD;AACxD,SAAS,gBAAgB,CAAC,MAAc;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACnC,OAAO,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,QAAQ,CAAC;AACnE,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,MAAc;IACpC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACvE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACX,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACX,CAAC,CAAC,CAAC,CAAC;YACJ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACX,CAAC,CAAC,CAAC;gBACH,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACX,CAAC,CAAC,CAAC,CAAC;YACJ,CAAC,CAAC,CAAC,CACR,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,eAAe,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO;QAAE,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACnE,OAAO,SAAS,CAAC,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB,EAAE,MAAc;IACjE,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACrC,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;AACnD,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,IAAI,KAAK,CAAC,CAAC;QAAE,OAAO,GAAG,CAAC;IAC5B,OAAO,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAC1B,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAC/C,GAAG,CACJ,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAC7B,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CACtD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,aAAqB;IACxC,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;QAClE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC9D,MAAM,KAAK,GAAI,GAA+B,CAAC,KAAK,CAAC;IACrD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5D,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,MAAM,GAAG,sBAAsB,EACrC,CAAC;QACD,MAAM,IAAI,aAAa,CACrB,GAAG,EACH,2BAA2B,EAC3B,gDAAgD,sBAAsB,aAAa,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,YAAqB,CAAC;AAgD5D,SAAS,aAAa,CAAC,MAA+B;IACpD,OAAO,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AAC1D,CAAC;AAaD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAkC;IAElC,MAAM,IAAI,GAAG,uBAAuB,CAAC;QACnC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ,EAAE,uBAAuB,CAAC,KAAK,CAAC,WAAW,CAAC;QACpD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,MAAM,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC;QACzC,QAAQ,EAAE,mBAAmB,CAAC,KAAK,CAAC,cAAc,IAAI,IAAI,CAAC;KAC5D,CAAC,CAAC;IACH,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,cAAc,CAC3B,OAAgB,EAChB,SAAqB;IAErB,oEAAoE;IACpE,oEAAoE;IACpE,IAAI,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IACvD,IAAI,iBAAiB,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IACjD,OAAO,sBAAsB,CAAC;QAC5B,KAAK,EAAE,SAAS;QAChB,WAAW,EAAE,cAAc,CAAC,OAAO,CAAC;QACpC,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC;QACjC,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,SAAS;KACpE,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAmC;IAEnC,MAAM,WAAW,GACf,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,SAAS,CAAC;IACjE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,aAAa,CACrB,GAAG,EACH,4BAA4B,EAC5B,+DAA+D,sBAAsB,EAAE,CACxF,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAE5E,sEAAsE;IACtE,yEAAyE;IACzE,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,WAAW,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACjE,IAAI,YAAY,GAAG,WAAW,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;QAClE,IAAI,qBAAqB,CAAC,UAAU,CAAC,KAAK,WAAW,EAAE,CAAC;YACtD,YAAY,GAAG,UAAU,CAAC;QAC5B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;IACxE,CAAC;IAED,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,gBAAgB,CAAC;YAChC,WAAW;YACX,cAAc,EAAE,aAAa,CAAC,KAAK,CAAC,YAAY,CAAC;YACjD,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;YACpC,YAAY;YACZ,SAAS,EAAE,MAAM,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC;SAC1D,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,aAAa,CACrB,GAAG,EACH,2BAA2B,EAC3B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,cAAc,CAAC,WAAW,EAAE,EAAE,CAAC;QACzE,MAAM,IAAI,aAAa,CACrB,GAAG,EACH,mCAAmC,EACnC,oDAAoD,EACpD,EAAE,QAAQ,EAAE,KAAK,CAAC,cAAc,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAC5D,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,qEAAqE;IACrE,IAAI,QAAQ,CAAC,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;QAC/C,MAAM,IAAI,aAAa,CACrB,GAAG,EACH,kCAAkC,EAClC,wEAAwE,EACxE,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,IAAI,IAAI,EAAE,CACtE,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAC;IACxE,MAAM,KAAK,GAAG,WAAW,CAAC,aAAa,CAAC,CAAC;IAEzC,uEAAuE;IACvE,2EAA2E;IAC3E,2EAA2E;IAC3E,wCAAwC;IACxC,IACE,CAAC,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACvC,SAAS,CAAC,UAAU,GAAG,CAAC;QACxB,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,EAChC,CAAC;QACD,uBAAuB,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;IAED,wEAAwE;IACxE,6CAA6C;IAC7C,EAAE;IACF,wEAAwE;IACxE,0EAA0E;IAC1E,wEAAwE;IACxE,0EAA0E;IAC1E,2EAA2E;IAC3E,uBAAuB;IACvB,IAAI,YAA+C,CAAC;IACpD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,WAAW,CAC/B,KAAK,KAAK,SAAS;YACjB,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,SAAS,KAAK,CAAC,cAAc,CAAC,WAAW,EAAE,IAAI,KAAK,EAAE,CAC3D,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;QAC3E,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,aAAa,CACrB,GAAG,EACH,0BAA0B,EAC1B,KAAK,KAAK,SAAS;gBACjB,CAAC,CAAC,4HAA4H;gBAC9H,CAAC,CAAC,4DAA4D,CACjE,CAAC;QACJ,CAAC;QACD,YAAY,GAAG,KAAK,IAAI,EAAE;YACxB,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,cAAc;QAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,GAAG,aAAa,IAAI,SAAS,EAAE;QAC1C,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ;QACnC,SAAS,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;QACtD,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,IAA6B,EAC7B,WAA8B;IAE9B,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC,sBAAsB,CAAC,EAAE,WAAW,EAAE,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAA6B;IAChE,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,SAAqB;IACpD,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QACpC,MAAM,IAAI,aAAa,CACrB,GAAG,EACH,0BAA0B,EAC1B,sKAAsK,CACvK,CAAC;IACJ,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,MAAM,kBAAkB,GAAG,YAAY,CAAC;AAExC,MAAM,OAAO,kCAAmC,SAAQ,KAAK;IAEzC;IADlB,YACkB,MAQM,EACtB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAXC,WAAM,GAAN,MAAM,CAQA;QAItB,IAAI,CAAC,IAAI,GAAG,oCAAoC,CAAC;IACnD,CAAC;CACF;AAYD,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,OAAO,CACL,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;QAC7B,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;QAC7B,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAC9B,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAChC,CAAC;AACJ,CAAC;AAWD,8EAA8E;AAC9E,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,QAA0D,EAC1D,UAAgD,EAAE;IAElD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,MAAM,WAAW,GAAG,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACjD,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,kCAAkC,CAC1C,qBAAqB,EACrB,qBAAqB,sBAAsB,cAAc,CAC1D,CAAC;IACJ,CAAC;IACD,2EAA2E;IAC3E,wEAAwE;IACxE,0EAA0E;IAC1E,iEAAiE;IACjE,MAAM,EACJ,CAAC,sBAAsB,CAAC,EAAE,YAAY,EACtC,CAAC,WAAW,CAAC,EAAE,aAAa,EAC5B,GAAG,WAAW,EACf,GAAG,IAAI,CAAC;IACT,MAAM,QAAQ,GAAG,eAAe,CAC9B,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CACtD,CAAC;IACF,IAAI,QAAQ,KAAK,WAAW,CAAC,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,kCAAkC,CAC1C,oBAAoB,EACpB,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IAED,IAAI,KAA+C,CAAC;IACpD,IAAI,MAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,KAAK,GAAG,qBAAqB,CAC3B,GAAG,kBAAkB,IAAI,WAAW,CAAC,SAAS,EAAE,CACjD,CAAC;QACF,MAAM,GAAG,MAAM,qBAAqB,CAAC;YACnC,OAAO,EAAE,KAAK,CAAC,aAAa;YAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,kCAAkC,CAC1C,eAAe,EACf,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,kCAAkC,CAC1C,oBAAoB,EACpB,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;QAC/D,MAAM,IAAI,kCAAkC,CAC1C,iBAAiB,EACjB,sDAAsD,CACvD,CAAC;IACJ,CAAC;IACD,2EAA2E;IAC3E,IACE,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM;QAC/B,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,KAAK,EACnD,CAAC;QACD,MAAM,IAAI,kCAAkC,CAC1C,gBAAgB,EAChB,wCAAwC,QAAQ,CAAC,KAAK,EAAE,CACzD,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,KAAK,WAAW,CAAC,OAAO,EAAE,CAAC;QAClD,MAAM,IAAI,kCAAkC,CAC1C,gBAAgB,EAChB,oDAAoD,CACrD,CAAC;IACJ,CAAC;IACD,IACE,OAAO,CAAC,cAAc,KAAK,SAAS;QACpC,KAAK,CAAC,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,cAAc,EAC5C,CAAC;QACD,MAAM,IAAI,kCAAkC,CAC1C,mBAAmB,EACnB,+CAA+C,CAChD,CAAC;IACJ,CAAC;IACD,uEAAuE;IACvE,oEAAoE;IACpE,uEAAuE;IACvE,qEAAqE;IACrE,mEAAmE;IACnE,wEAAwE;IACxE,sCAAsC;IACtC,MAAM,WAAW,GAAG,mBAAmB,CACrC,gBAAgB,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACrC,CAAC,CAAC,WAAW,CAAC,QAAQ;QACtB,CAAC,CAAC,WAAW,CAChB,CAAC;IACF,wEAAwE;IACxE,uEAAuE;IACvE,sEAAsE;IACtE,mDAAmD;IACnD,MAAM,YAAY,GAAG,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,IAAI,CAAC;IACvE,MAAM,gBAAgB,GACpB,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;QAC1B,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC;IACpD,MAAM,MAAM,GACV,YAAY,IAAI,CAAC,gBAAgB;QAC/B,CAAC,CAAC,IAAI;QACN,CAAC,CAAE,WAAwB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9D,IAAI,MAA4C,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,GAAG,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,2BAA2B,EAAE,CAAC;YACjD,MAAM,IAAI,kCAAkC,CAC1C,kBAAkB,EAClB,wCAAwC,KAAK,CAAC,OAAO,EAAE,CACxD,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GACd,CAAC,YAAY,IAAI,CAAC,gBAAgB;QAChC,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,MAAM,KAAK,IAAI;YACf,CAAC,CAAC,aAAa,KAAK,SAAS;YAC7B,CAAC,CAAC,MAAM,KAAK,IAAI;gBACf,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,OAAO,CAAC,MAAM;gBACvC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,kCAAkC,CAC1C,kBAAkB,EAClB,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,WAAW,CAAC,OAAO;QAC5B,OAAO,EAAE,WAAW,CAAC,OAAO;QAC5B,QAAQ;QACR,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;AACJ,CAAC"}

package/dist/write/authorize.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Delegated-write authorization, shared by every build.
+ *
+ * `authorizeWrite` / `authorizeWriteSession` are the two write-session halves
+ * of `PersonalServerApiAuthPort`. They were originally written inside the Node
+ * server's auth adapter (packages/server/src/api-auth.ts); the checks they run
+ * are pure protocol — a token hash, a live grant re-check, an EIP-191 payload
+ * proof and a replay reservation — with nothing Node-specific in them, so they
+ * live here and BOTH the Node server adapter and the browser (PS-Lite)
+ * adapters call the same code. There is exactly one implementation of the
+ * write policy; a browser build cannot drift into a weaker one.
+ *
+ * The two entry points differ in what they are allowed to decide:
+ *
+ *   - `authorizeSessionWrite` authorizes a write to a NAMED scope. It
+ *     re-runs `verifyDataWritePolicy` against the LIVE grant on every call,
+ *     so revocation, expiry, grantee binding, owner binding and scope
+ *     coverage stay authoritative per write rather than being frozen at
+ *     handshake, and it verifies the builder's per-write payload proof.
+ *   - `recognizeWriteSession` is identity only: the bearer must resolve to a
+ *     live session and the request must carry that builder's valid proof, but
+ *     NO grant policy runs (there is no scope to run one against). Callers use
+ *     it only to choose between error shapes, never to release data.
+ *
+ * Both fail closed: an unknown bearer, an unknown session, a missing server
+ * owner, or any failing proof check returns/raises rather than falling back to
+ * a weaker credential. A request that is not a write-session request at all
+ * returns `undefined`, and the caller applies its own owner gate.
+ */
+import { ProtocolError } from "../errors/catalog.js";
+import { type DataWritePolicyPorts } from "../policy/data-write.js";
+import type { PersonalServerWriteAuthInput, PersonalServerWriteAuthResult, PersonalServerWriteSessionResult } from "../api/index.js";
+import { type WriteProofReplayStore, type WriteSessionStore } from "./session.js";
+export interface WriteSessionAuthorizationDeps {
+    /**
+     * This server's origin. Every payload proof must name it as its audience,
+     * so a proof signed for another Personal Server cannot be relayed here.
+     */
+    serverOrigin: string | (() => string);
+    /**
+     * The owner every grant must have been issued by. Absent = fail closed:
+     * a delegated write cannot be bound to an owner we cannot name.
+     */
+    serverOwner?: `0x${string}`;
+    /**
+     * Live write sessions (minted by POST /v1/write/session). Absent = the host
+     * does not support delegated writes and every request falls through to the
+     * caller's owner gate.
+     */
+    sessionStore?: WriteSessionStore;
+    /** Replay guard for the per-write `X-Vana-Write-Signature` proofs. */
+    replayStore: WriteProofReplayStore;
+    /** Live builder/grant verification, re-run on every delegated write. */
+    policyPorts: DataWritePolicyPorts;
+    now?: () => Date;
+}
+export interface WriteSessionAuthorization {
+    /**
+     * Authorize a delegated write to `input.scope`, or `undefined` when the
+     * request carries no live write-session credential (the caller then applies
+     * its owner gate, exactly as before write sessions existed).
+     */
+    authorizeSessionWrite(input: PersonalServerWriteAuthInput): Promise<PersonalServerWriteAuthResult | undefined>;
+    /**
+     * Identity-only recognition of a write-session caller. Never releases data.
+     */
+    recognizeWriteSession(request: Request): Promise<PersonalServerWriteSessionResult | undefined>;
+}
+/** The bearer credential a write session is presented under. */
+export declare function writeSessionBearerToken(request: Request): string | null;
+/**
+ * Same shape and message as the auth layer's own missing-owner failure, so a
+ * host that never configured an owner reports one thing, not two.
+ */
+export declare function writeServerNotConfigured(): ProtocolError;
+export declare function createWriteSessionAuthorization(deps: WriteSessionAuthorizationDeps): WriteSessionAuthorization;
+//# sourceMappingURL=authorize.d.ts.map

package/dist/write/authorize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../src/write/authorize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EACV,4BAA4B,EAC5B,6BAA6B,EAC7B,gCAAgC,EACjC,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACvB,MAAM,cAAc,CAAC;AAEtB,MAAM,WAAW,6BAA6B;IAC5C;;;OAGG;IACH,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC;;;OAGG;IACH,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B;;;;OAIG;IACH,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC,sEAAsE;IACtE,WAAW,EAAE,qBAAqB,CAAC;IACnC,wEAAwE;IACxE,WAAW,EAAE,oBAAoB,CAAC;IAClC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,yBAAyB;IACxC;;;;OAIG;IACH,qBAAqB,CACnB,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,6BAA6B,GAAG,SAAS,CAAC,CAAC;IACtD;;OAEG;IACH,qBAAqB,CACnB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,gCAAgC,GAAG,SAAS,CAAC,CAAC;CAC1D;AAED,gEAAgE;AAChE,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAIvE;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,IAAI,aAAa,CAMxD;AAED,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,6BAA6B,GAClC,yBAAyB,CA6D3B"}

package/dist/write/authorize.js

@@ -0,0 +1,109 @@
+/**
+ * Delegated-write authorization, shared by every build.
+ *
+ * `authorizeWrite` / `authorizeWriteSession` are the two write-session halves
+ * of `PersonalServerApiAuthPort`. They were originally written inside the Node
+ * server's auth adapter (packages/server/src/api-auth.ts); the checks they run
+ * are pure protocol — a token hash, a live grant re-check, an EIP-191 payload
+ * proof and a replay reservation — with nothing Node-specific in them, so they
+ * live here and BOTH the Node server adapter and the browser (PS-Lite)
+ * adapters call the same code. There is exactly one implementation of the
+ * write policy; a browser build cannot drift into a weaker one.
+ *
+ * The two entry points differ in what they are allowed to decide:
+ *
+ *   - `authorizeSessionWrite` authorizes a write to a NAMED scope. It
+ *     re-runs `verifyDataWritePolicy` against the LIVE grant on every call,
+ *     so revocation, expiry, grantee binding, owner binding and scope
+ *     coverage stay authoritative per write rather than being frozen at
+ *     handshake, and it verifies the builder's per-write payload proof.
+ *   - `recognizeWriteSession` is identity only: the bearer must resolve to a
+ *     live session and the request must carry that builder's valid proof, but
+ *     NO grant policy runs (there is no scope to run one against). Callers use
+ *     it only to choose between error shapes, never to release data.
+ *
+ * Both fail closed: an unknown bearer, an unknown session, a missing server
+ * owner, or any failing proof check returns/raises rather than falling back to
+ * a weaker credential. A request that is not a write-session request at all
+ * returns `undefined`, and the caller applies its own owner gate.
+ */
+import { ProtocolError } from "../errors/catalog.js";
+import { verifyDataWritePolicy, } from "../policy/data-write.js";
+import { verifyWriterAttribution } from "./attribution.js";
+import { hashWriteSessionToken, } from "./session.js";
+/** The bearer credential a write session is presented under. */
+export function writeSessionBearerToken(request) {
+    const header = request.headers.get("authorization");
+    if (!header?.startsWith("Bearer "))
+        return null;
+    return header.slice(7);
+}
+/**
+ * Same shape and message as the auth layer's own missing-owner failure, so a
+ * host that never configured an owner reports one thing, not two.
+ */
+export function writeServerNotConfigured() {
+    return new ProtocolError(500, "SERVER_NOT_CONFIGURED", "Server owner address not configured. Set VANA_MASTER_KEY_SIGNATURE environment variable.");
+}
+export function createWriteSessionAuthorization(deps) {
+    async function liveSession(request) {
+        const token = writeSessionBearerToken(request);
+        if (!token || !deps.sessionStore)
+            return null;
+        return deps.sessionStore.getByTokenHash(await hashWriteSessionToken(token));
+    }
+    return {
+        async authorizeSessionWrite(input) {
+            const session = await liveSession(input.request);
+            if (!session)
+                return undefined;
+            if (!deps.serverOwner)
+                throw writeServerNotConfigured();
+            // The grant is re-checked live on EVERY write: a session token minted
+            // an hour ago against a grant that has since been revoked, narrowed or
+            // expired authorizes nothing.
+            const grant = await verifyDataWritePolicy({
+                signer: session.builderAddress,
+                grantId: session.grantId,
+                requestedScope: input.scope,
+                serverOwner: deps.serverOwner,
+            }, deps.policyPorts);
+            // releaseProof is a rollback hook for the handler, never part of the
+            // stored attribution record.
+            const { releaseProof, ...attribution } = await verifyWriterAttribution({
+                request: input.request,
+                builderAddress: session.builderAddress,
+                grantId: grant.id,
+                serverOrigin: deps.serverOrigin,
+                replayStore: deps.replayStore,
+                now: deps.now,
+            });
+            return {
+                builder: session.builderAddress,
+                grantId: grant.id,
+                grantScopes: grant.scopes ?? [],
+                attribution,
+                releaseProof,
+            };
+        },
+        async recognizeWriteSession(request) {
+            const session = await liveSession(request);
+            if (!session)
+                return undefined;
+            const { releaseProof } = await verifyWriterAttribution({
+                request,
+                builderAddress: session.builderAddress,
+                grantId: session.grantId,
+                serverOrigin: deps.serverOrigin,
+                replayStore: deps.replayStore,
+                now: deps.now,
+            });
+            return {
+                builder: session.builderAddress,
+                grantId: session.grantId,
+                releaseProof,
+            };
+        },
+    };
+}
+//# sourceMappingURL=authorize.js.map