@opendatalabs/personal-server-ts-core 1.33.2 → 1.33.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/auth/index.d.ts +1 -0
- package/dist/auth/index.d.ts.map +1 -1
- package/dist/auth/index.js +1 -0
- package/dist/auth/index.js.map +1 -1
- package/dist/auth/request.d.ts +18 -0
- package/dist/auth/request.d.ts.map +1 -1
- package/dist/auth/request.js +33 -0
- package/dist/auth/request.js.map +1 -1
- package/dist/policy/data-write.d.ts.map +1 -1
- package/dist/policy/data-write.js +15 -1
- package/dist/policy/data-write.js.map +1 -1
- package/dist/write/route.d.ts.map +1 -1
- package/dist/write/route.js +6 -1
- package/dist/write/route.js.map +1 -1
- package/dist/write/session.d.ts.map +1 -1
- package/dist/write/session.js +13 -0
- package/dist/write/session.js.map +1 -1
- package/package.json +1 -1
package/dist/auth/index.d.ts
CHANGED
|
@@ -1,3 +1,4 @@
|
|
|
1
1
|
export { authenticateRequest, mapSdkAuthError, type AuthenticatedRequest, type AuthenticateRequestInput, type AuthMechanism, type RequestAuth, type SessionTokenVerifierPort, } from "./request.js";
|
|
2
2
|
export { web3SignedProofId, boundedProofExpiry } from "./proof-id.js";
|
|
3
|
+
export { isWeb3SignedLifetimeError, MAX_WEB3SIGNED_LIFETIME_SEC, TokenLifetimeError, } from "./request.js";
|
|
3
4
|
//# sourceMappingURL=index.d.ts.map
|
package/dist/auth/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,wBAAwB,GAC9B,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,wBAAwB,GAC9B,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,cAAc,CAAC"}
|
package/dist/auth/index.js
CHANGED
|
@@ -1,3 +1,4 @@
|
|
|
1
1
|
export { authenticateRequest, mapSdkAuthError, } from "./request.js";
|
|
2
2
|
export { web3SignedProofId, boundedProofExpiry } from "./proof-id.js";
|
|
3
|
+
export { isWeb3SignedLifetimeError, MAX_WEB3SIGNED_LIFETIME_SEC, TokenLifetimeError, } from "./request.js";
|
|
3
4
|
//# sourceMappingURL=index.js.map
|
package/dist/auth/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,eAAe,GAMhB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,eAAe,GAMhB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,cAAc,CAAC"}
|
package/dist/auth/request.d.ts
CHANGED
|
@@ -1,6 +1,24 @@
|
|
|
1
1
|
import { type Web3SignedPayload } from "@opendatalabs/vana-sdk/browser";
|
|
2
2
|
import { ProtocolError } from "../errors/catalog.js";
|
|
3
3
|
export type AuthMechanism = "web3-signed" | "dev-token" | "control-plane-token" | "cli-session-token";
|
|
4
|
+
/**
|
|
5
|
+
* Longest `exp - iat` window a Web3Signed request may carry. The SDK verifier
|
|
6
|
+
* only checks `exp` and `iat` against the clock (plus skew), so without this
|
|
7
|
+
* bound the signer chooses how long a captured request stays replayable.
|
|
8
|
+
* Mirrors MAX_PROOF_LIFETIME_SEC in ./proof-id.ts, which already bounds the
|
|
9
|
+
* MCP and write-session proofs.
|
|
10
|
+
*/
|
|
11
|
+
export declare const MAX_WEB3SIGNED_LIFETIME_SEC: number;
|
|
12
|
+
/**
|
|
13
|
+
* The request-auth lifetime-cap rejection. Same errorCode as an expired
|
|
14
|
+
* token so clients re-sign; the message names the cap because the fix is a
|
|
15
|
+
* shorter window, not a fresh clock. A distinct class so handshake routes
|
|
16
|
+
* that carry their own proof-lifetime error code can recognise it.
|
|
17
|
+
*/
|
|
18
|
+
export declare class TokenLifetimeError extends ProtocolError {
|
|
19
|
+
constructor(lifetimeSeconds: number);
|
|
20
|
+
}
|
|
21
|
+
export declare function isWeb3SignedLifetimeError(err: unknown): boolean;
|
|
4
22
|
export interface RequestAuth {
|
|
5
23
|
signer: `0x${string}`;
|
|
6
24
|
payload: Partial<Web3SignedPayload>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../src/auth/request.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,iBAAiB,EACvB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAIL,aAAa,EACd,MAAM,sBAAsB,CAAC;AAE9B,MAAM,MAAM,aAAa,GACvB,aAAa,GAAG,WAAW,GAAG,qBAAqB,GAAG,mBAAmB,CAAC;AAE5E,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,KAAK,MAAM,EAAE,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,wBAAwB,CAAC;IAChD,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,EAAE,aAAa,CAAC;IACzB,cAAc,EAAE,OAAO,CAAC;IACxB,SAAS,EAAE,OAAO,CAAC;CACpB;AAsDD,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,aAAa,GAAG,IAAI,CAWlE;AAgBD,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC,oBAAoB,CAAC,
|
|
1
|
+
{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../src/auth/request.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,iBAAiB,EACvB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAIL,aAAa,EACd,MAAM,sBAAsB,CAAC;AAE9B,MAAM,MAAM,aAAa,GACvB,aAAa,GAAG,WAAW,GAAG,qBAAqB,GAAG,mBAAmB,CAAC;AAE5E;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,QAAU,CAAC;AAEnD;;;;;GAKG;AACH,qBAAa,kBAAmB,SAAQ,aAAa;gBACvC,eAAe,EAAE,MAAM;CAYpC;AAED,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAE/D;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,KAAK,MAAM,EAAE,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,wBAAwB,CAAC;IAChD,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,EAAE,aAAa,CAAC;IACzB,cAAc,EAAE,OAAO,CAAC;IACxB,SAAS,EAAE,OAAO,CAAC;CACpB;AAsDD,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,aAAa,GAAG,IAAI,CAWlE;AAgBD,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC,oBAAoB,CAAC,CAwD/B"}
|
package/dist/auth/request.js
CHANGED
|
@@ -1,5 +1,31 @@
|
|
|
1
1
|
import { ExpiredTokenError as SdkExpiredTokenError, InvalidSignatureError as SdkInvalidSignatureError, MissingAuthError as SdkMissingAuthError, verifyWeb3Signed, } from "@opendatalabs/vana-sdk/browser";
|
|
2
2
|
import { ExpiredTokenError, InvalidSignatureError, MissingAuthError, ProtocolError, } from "../errors/catalog.js";
|
|
3
|
+
/**
|
|
4
|
+
* Longest `exp - iat` window a Web3Signed request may carry. The SDK verifier
|
|
5
|
+
* only checks `exp` and `iat` against the clock (plus skew), so without this
|
|
6
|
+
* bound the signer chooses how long a captured request stays replayable.
|
|
7
|
+
* Mirrors MAX_PROOF_LIFETIME_SEC in ./proof-id.ts, which already bounds the
|
|
8
|
+
* MCP and write-session proofs.
|
|
9
|
+
*/
|
|
10
|
+
export const MAX_WEB3SIGNED_LIFETIME_SEC = 15 * 60;
|
|
11
|
+
/**
|
|
12
|
+
* The request-auth lifetime-cap rejection. Same errorCode as an expired
|
|
13
|
+
* token so clients re-sign; the message names the cap because the fix is a
|
|
14
|
+
* shorter window, not a fresh clock. A distinct class so handshake routes
|
|
15
|
+
* that carry their own proof-lifetime error code can recognise it.
|
|
16
|
+
*/
|
|
17
|
+
export class TokenLifetimeError extends ProtocolError {
|
|
18
|
+
constructor(lifetimeSeconds) {
|
|
19
|
+
super(401, "EXPIRED_TOKEN", `Token lifetime (exp - iat) must be between 1 and ${MAX_WEB3SIGNED_LIFETIME_SEC} seconds`, {
|
|
20
|
+
reason: "Token lifetime exceeds the server cap",
|
|
21
|
+
maxLifetimeSeconds: MAX_WEB3SIGNED_LIFETIME_SEC,
|
|
22
|
+
lifetimeSeconds,
|
|
23
|
+
});
|
|
24
|
+
}
|
|
25
|
+
}
|
|
26
|
+
export function isWeb3SignedLifetimeError(err) {
|
|
27
|
+
return err instanceof TokenLifetimeError;
|
|
28
|
+
}
|
|
3
29
|
function resolveOrigin(origin) {
|
|
4
30
|
return typeof origin === "function" ? origin() : origin;
|
|
5
31
|
}
|
|
@@ -89,6 +115,13 @@ export async function authenticateRequest(input) {
|
|
|
89
115
|
bodyBytes: await requestBodyBytes(input.request),
|
|
90
116
|
now: input.now?.(),
|
|
91
117
|
});
|
|
118
|
+
// The SDK already guarantees finite iat/exp (fractional seconds allowed).
|
|
119
|
+
const lifetime = (auth.payload.exp ?? 0) - (auth.payload.iat ?? 0);
|
|
120
|
+
if (!Number.isFinite(lifetime) ||
|
|
121
|
+
lifetime <= 0 ||
|
|
122
|
+
lifetime > MAX_WEB3SIGNED_LIFETIME_SEC) {
|
|
123
|
+
throw new TokenLifetimeError(lifetime);
|
|
124
|
+
}
|
|
92
125
|
return {
|
|
93
126
|
auth,
|
|
94
127
|
mechanism: "web3-signed",
|
package/dist/auth/request.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"request.js","sourceRoot":"","sources":["../../src/auth/request.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,IAAI,oBAAoB,EACzC,qBAAqB,IAAI,wBAAwB,EACjD,gBAAgB,IAAI,mBAAmB,EACvC,gBAAgB,GAEjB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,EAChB,aAAa,GACd,MAAM,sBAAsB,CAAC;
|
|
1
|
+
{"version":3,"file":"request.js","sourceRoot":"","sources":["../../src/auth/request.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,IAAI,oBAAoB,EACzC,qBAAqB,IAAI,wBAAwB,EACjD,gBAAgB,IAAI,mBAAmB,EACvC,gBAAgB,GAEjB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,EAChB,aAAa,GACd,MAAM,sBAAsB,CAAC;AAK9B;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,GAAG,EAAE,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,OAAO,kBAAmB,SAAQ,aAAa;IACnD,YAAY,eAAuB;QACjC,KAAK,CACH,GAAG,EACH,eAAe,EACf,oDAAoD,2BAA2B,UAAU,EACzF;YACE,MAAM,EAAE,uCAAuC;YAC/C,kBAAkB,EAAE,2BAA2B;YAC/C,eAAe;SAChB,CACF,CAAC;IACJ,CAAC;CACF;AAED,MAAM,UAAU,yBAAyB,CAAC,GAAY;IACpD,OAAO,GAAG,YAAY,kBAAkB,CAAC;AAC3C,CAAC;AA4BD,SAAS,aAAa,CAAC,MAA+B;IACpD,OAAO,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AAC1D,CAAC;AAED,SAAS,mBAAmB;IAC1B,OAAO,IAAI,aAAa,CACtB,GAAG,EACH,uBAAuB,EACvB,0FAA0F,CAC3F,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,WAA0B;IACxD,OAAO;QACL,MAAM,EAAE,WAAW;QACnB,OAAO,EAAE,EAAE;KACZ,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,CAAS,EAAE,CAAS;IACvC,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,IAAI,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IACtC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC/C,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,cAAc,CAAC,WAA0B;IAChD,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,OAAgB;IAEhB,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IAC5E,OAAO,IAAI,UAAU,CAAC,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,eAAe,CAAC,GAAY;IACnC,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;QACvD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAC5B,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACtE,OAAO,OAAkC,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAY;IAC1C,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;QACvC,OAAO,IAAI,gBAAgB,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,GAAG,YAAY,wBAAwB,EAAE,CAAC;QAC5C,OAAO,IAAI,qBAAqB,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;QACxC,OAAO,IAAI,iBAAiB,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CACvB,WAAsC,EACtC,SAAwB,EACxB,cAAuB;IAEvB,IAAI,CAAC,WAAW;QAAE,MAAM,mBAAmB,EAAE,CAAC;IAC9C,OAAO;QACL,IAAI,EAAE,sBAAsB,CAAC,WAAW,CAAC;QACzC,SAAS;QACT,cAAc;QACd,SAAS,EAAE,cAAc;KAC1B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAA+B;IAE/B,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC9D,MAAM,WAAW,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IAE/C,IAAI,KAAK,CAAC,QAAQ,IAAI,UAAU,KAAK,UAAU,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;QAChE,OAAO,gBAAgB,CAAC,KAAK,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;IAChE,CAAC;IAED,IACE,KAAK,CAAC,WAAW;QACjB,WAAW;QACX,WAAW,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,EAC3C,CAAC;QACD,OAAO,gBAAgB,CAAC,KAAK,CAAC,WAAW,EAAE,qBAAqB,EAAE,KAAK,CAAC,CAAC;IAC3E,CAAC;IAED,IACE,KAAK,CAAC,oBAAoB;QAC1B,WAAW;QACX,CAAC,MAAM,KAAK,CAAC,oBAAoB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,EACvD,CAAC;QACD,OAAO,gBAAgB,CAAC,KAAK,CAAC,WAAW,EAAE,mBAAmB,EAAE,KAAK,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC;YAClC,WAAW,EAAE,UAAU,IAAI,SAAS;YACpC,cAAc,EAAE,aAAa,CAAC,KAAK,CAAC,YAAY,CAAC;YACjD,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;YACpC,YAAY,EAAE,GAAG,CAAC,QAAQ;YAC1B,SAAS,EAAE,MAAM,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC;YAChD,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE;SACnB,CAAC,CAAC;QAEH,0EAA0E;QAC1E,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;QACnE,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC1B,QAAQ,IAAI,CAAC;YACb,QAAQ,GAAG,2BAA2B,EACtC,CAAC;YACD,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACzC,CAAC;QAED,OAAO;YACL,IAAI;YACJ,SAAS,EAAE,aAAa;YACxB,cAAc,EAAE,KAAK;YACrB,SAAS,EAAE,KAAK;SACjB,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,SAAS;YAAE,MAAM,SAAS,CAAC;QAC/B,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"data-write.d.ts","sourceRoot":"","sources":["../../src/policy/data-write.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAa3E,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC7B,MAAM,mBAAmB,CAAC;AAG3B;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,kBAAkB,WAAW,CAAC;AAE3C,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAExD;AAED,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAK3E;AAED,wBAAgB,wBAAwB,CACtC,cAAc,EAAE,MAAM,EACtB,WAAW,EAAE,SAAS,MAAM,EAAE,GAC7B,OAAO,CAIT;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,kBAAkB,CAAC,KAAK,EAAE;QACxB,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;QACvB,KAAK,EAAE,oBAAoB,CAAC;QAC5B,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,KAAK,MAAM,EAAE,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,oBAAoB;IACnC,mBAAmB,EAAE,uBAAuB,CAAC;IAC7C,aAAa,EAAE,iBAAiB,CAAC;IACjC,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;IAC9C,2DAA2D;IAC3D,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;CACzC;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,oBAAoB,EAC3B,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,oBAAoB,CAAC,
|
|
1
|
+
{"version":3,"file":"data-write.d.ts","sourceRoot":"","sources":["../../src/policy/data-write.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAa3E,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC7B,MAAM,mBAAmB,CAAC;AAG3B;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,kBAAkB,WAAW,CAAC;AAE3C,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAExD;AAED,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAK3E;AAED,wBAAgB,wBAAwB,CACtC,cAAc,EAAE,MAAM,EACtB,WAAW,EAAE,SAAS,MAAM,EAAE,GAC7B,OAAO,CAIT;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,kBAAkB,CAAC,KAAK,EAAE;QACxB,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;QACvB,KAAK,EAAE,oBAAoB,CAAC;QAC5B,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,KAAK,MAAM,EAAE,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,oBAAoB;IACnC,mBAAmB,EAAE,uBAAuB,CAAC;IAC7C,aAAa,EAAE,iBAAiB,CAAC;IACjC,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;IAC9C,2DAA2D;IAC3D,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;CACzC;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,oBAAoB,EAC3B,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,oBAAoB,CAAC,CAkH/B"}
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
import { scopeMatchesPattern } from "@opendatalabs/vana-sdk/browser";
|
|
2
2
|
import { GrantExpiredError, GrantOwnerMismatchError, GrantRequiredError, GrantRevokedError, InvalidSignatureError, PsUnavailableError, ScopeMismatchError, ServerNotConfiguredError, UnregisteredBuilderError, } from "../errors/catalog.js";
|
|
3
|
-
import { parseGrantExpiresAtSeconds } from "./data-read.js";
|
|
3
|
+
import { parseGrantExpiresAtSeconds, SENTINEL_GRANT_IDS } from "./data-read.js";
|
|
4
4
|
/**
|
|
5
5
|
* Write-grant encoding: a grant scope entry prefixed with `write:` authorizes
|
|
6
6
|
* the grantee to WRITE into the scope it names (e.g. `write:notes.entries`,
|
|
@@ -56,6 +56,14 @@ export async function verifyDataWritePolicy(input, ports) {
|
|
|
56
56
|
reason: "No grantId bound to the write session",
|
|
57
57
|
});
|
|
58
58
|
}
|
|
59
|
+
// Same reserved-id rule as verifyDataReadPolicy: the auth-result sentinels
|
|
60
|
+
// are never a grant, whether the caller or the gateway supplies them.
|
|
61
|
+
if (SENTINEL_GRANT_IDS.has(input.grantId)) {
|
|
62
|
+
throw new GrantRequiredError({
|
|
63
|
+
reason: "Reserved grantId",
|
|
64
|
+
grantId: input.grantId,
|
|
65
|
+
});
|
|
66
|
+
}
|
|
59
67
|
const grant = await ports.grantVerifier.getGrant(input.grantId);
|
|
60
68
|
if (!grant) {
|
|
61
69
|
throw new GrantRequiredError({
|
|
@@ -63,6 +71,12 @@ export async function verifyDataWritePolicy(input, ports) {
|
|
|
63
71
|
grantId: input.grantId,
|
|
64
72
|
});
|
|
65
73
|
}
|
|
74
|
+
if (SENTINEL_GRANT_IDS.has(grant.id)) {
|
|
75
|
+
throw new GrantRequiredError({
|
|
76
|
+
reason: "Grant resolved to a reserved id",
|
|
77
|
+
grantId: input.grantId,
|
|
78
|
+
});
|
|
79
|
+
}
|
|
66
80
|
if (grant.revokedAt !== null) {
|
|
67
81
|
throw new GrantRevokedError({ grantId: grant.id });
|
|
68
82
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"data-write.js","sourceRoot":"","sources":["../../src/policy/data-write.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,sBAAsB,CAAC;AAM9B,OAAO,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;
|
|
1
|
+
{"version":3,"file":"data-write.js","sourceRoot":"","sources":["../../src/policy/data-write.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,sBAAsB,CAAC;AAM9B,OAAO,EAAE,0BAA0B,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEhF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,QAAQ,CAAC;AAE3C,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,KAAK,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;AAC9C,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,kBAAkB,CAAC,WAA8B;IAC/D,OAAO,WAAW;SACf,MAAM,CAAC,iBAAiB,CAAC;SACzB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;SACtD,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,cAAsB,EACtB,WAA8B;IAE9B,OAAO,kBAAkB,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CACtD,mBAAmB,CAAC,cAAc,EAAE,OAAO,CAAC,CAC7C,CAAC;AACJ,CAAC;AAsCD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAA2B,EAC3B,KAA2B;IAE3B,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,mBAAmB,EAAE,WAAW,EAAE,CAAC;IACjE,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,kBAAkB,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACzE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,wBAAwB,EAAE,CAAC;IACvC,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,IAAI,kBAAkB,CAAC;YAC3B,MAAM,EAAE,uCAAuC;SAChD,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,sEAAsE;IACtE,IAAI,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,kBAAkB,CAAC;YAC3B,MAAM,EAAE,kBAAkB;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,kBAAkB,CAAC;YAC3B,MAAM,EAAE,iBAAiB;YACzB,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,kBAAkB,CAAC;YAC3B,MAAM,EAAE,iCAAiC;YACzC,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,kBAAkB,CAAC;YAC3B,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,MAAM,EAAE,2BAA2B;SACpC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC9D,MAAM,YAAY,GAAG,0BAA0B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACjE,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,MAAM,EAAE,yBAAyB;aAClC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAC7C,IAAI,YAAY,GAAG,MAAM,EAAE,CAAC;gBAC1B,MAAM,IAAI,iBAAiB,CAAC;oBAC1B,SAAS,EAAE,YAAY;iBACxB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,kBAAkB,CAAC;YAC3B,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,aAAa,EAAE,KAAK,CAAC,MAAM;YAC3B,MAAM,EAAE,gDAAgD;SACzD,CAAC,CAAC;IACL,CAAC;IAED,IAAI,OAAO,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;QAC/D,MAAM,IAAI,qBAAqB,CAAC;YAC9B,MAAM,EAAE,uCAAuC;YAC/C,QAAQ,EAAE,KAAK,CAAC,SAAS;YACzB,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;IACL,CAAC;IAED,uEAAuE;IACvE,mEAAmE;IACnE,wEAAwE;IACxE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACvB,MAAM,IAAI,wBAAwB,CAAC;YACjC,MAAM,EAAE,mDAAmD;SAC5D,CAAC,CAAC;IACL,CAAC;IACD,IACE,CAAC,KAAK,CAAC,cAAc;QACrB,KAAK,CAAC,cAAc,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE,EACtE,CAAC;QACD,MAAM,IAAI,uBAAuB,CAAC;YAChC,OAAO,EAAE,KAAK,CAAC,EAAE;YACjB,QAAQ,EAAE,KAAK,CAAC,WAAW;YAC3B,MAAM,EAAE,KAAK,CAAC,cAAc,IAAI,IAAI;SACrC,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,mCAAmC;IACnC,MAAM,KAAK,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;QAC/C,OAAO,EAAE,KAAK,CAAC,MAAM;QACrB,KAAK;QACL,KAAK,EAAE,KAAK,CAAC,cAAc;KAC5B,CAAC,CAAC;IAEH,OAAO,KAAK,CAAC;AACf,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../src/write/route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;
|
|
1
|
+
{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../src/write/route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAMH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAGjE,OAAO,KAAK,EACV,uBAAuB,EACvB,iBAAiB,EAClB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACvB,MAAM,cAAc,CAAC;AAEtB,MAAM,WAAW,uBAAuB;IACtC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/D,KAAK,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjE;AAED,MAAM,WAAW,6BAA6B;IAC5C,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B;;;;OAIG;IACH,YAAY,EAAE,iBAAiB,CAAC;IAChC,6EAA6E;IAC7E,WAAW,CAAC,EAAE,qBAAqB,CAAC;IACpC,mBAAmB,EAAE,uBAAuB,CAAC;IAC7C,aAAa,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,wBAAwB,CAAC;IACtC,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,MAAM,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,uBAAuB,CAAC;CAClC;AAED,MAAM,WAAW,wBAAwB;IACvC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;CACf;AA2CD;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,6BAA6B,GAClC,OAAO,CAAC,QAAQ,CAAC,CAkHnB"}
|
package/dist/write/route.js
CHANGED
|
@@ -17,7 +17,7 @@
|
|
|
17
17
|
* wrapper around it, and the browser runtime dispatches to it directly. There
|
|
18
18
|
* is one implementation of who may open a write session.
|
|
19
19
|
*/
|
|
20
|
-
import { authenticateRequest } from "../auth/index.js";
|
|
20
|
+
import { authenticateRequest, isWeb3SignedLifetimeError, } from "../auth/index.js";
|
|
21
21
|
import { ProtocolError } from "../errors/catalog.js";
|
|
22
22
|
import { web3SignedProofId, boundedProofExpiry } from "../auth/proof-id.js";
|
|
23
23
|
import { createWriteSession, } from "./session.js";
|
|
@@ -71,6 +71,11 @@ export async function handleWriteSessionRequest(request, deps) {
|
|
|
71
71
|
if (!(err instanceof ProtocolError)) {
|
|
72
72
|
return internalError(deps.logger, err, "authenticate");
|
|
73
73
|
}
|
|
74
|
+
// The request-auth lifetime cap fires before boundedProofExpiry below;
|
|
75
|
+
// keep the handshake's own error code for an over-long proof.
|
|
76
|
+
if (isWeb3SignedLifetimeError(err)) {
|
|
77
|
+
return jsonResponse(jsonError(401, "WRITE_SESSION_PROOF_LIFETIME", err.message), 401);
|
|
78
|
+
}
|
|
74
79
|
return jsonResponse(jsonError(401, "WRITE_SESSION_AUTH_FAILED", err.message), 401);
|
|
75
80
|
}
|
|
76
81
|
// A bearer credential (dev token, control-plane token, CLI session) proves
|
package/dist/write/route.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"route.js","sourceRoot":"","sources":["../../src/write/route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,
|
|
1
|
+
{"version":3,"file":"route.js","sourceRoot":"","sources":["../../src/write/route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EACL,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAK5E,OAAO,EACL,kBAAkB,GAGnB,MAAM,cAAc,CAAC;AAsCtB,SAAS,SAAS,CAAC,MAAc,EAAE,SAAiB,EAAE,OAAe;IACnE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC;AACzD,CAAC;AAED,SAAS,YAAY,CAAC,IAAa,EAAE,MAAc;IACjD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CACpB,MAA2C,EAC3C,GAAY,EACZ,KAAa;IAEb,MAAM,EAAE,KAAK,EAAE,CACb,EAAE,GAAG,EAAE,KAAK,EAAE,EACd,yDAAyD,CAC1D,CAAC;IACF,OAAO,YAAY,CACjB,SAAS,CAAC,GAAG,EAAE,gBAAgB,EAAE,uBAAuB,CAAC,EACzD,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB;IACzB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CACrC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CACnC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,OAAO,cAAc,GAAG,EAAE,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAgB,EAChB,IAAmC;IAEnC,0EAA0E;IAC1E,4DAA4D;IAC5D,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtB,OAAO,YAAY,CACjB,SAAS,CAAC,GAAG,EAAE,uBAAuB,EAAE,gCAAgC,CAAC,EACzE,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,CAAC;IACf,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,mBAAmB,CAAC;YACrC,OAAO;YACP,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,oBAAoB,EAAE,IAAI,CAAC,UAAU;YACrC,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,CAAC,GAAG,YAAY,aAAa,CAAC,EAAE,CAAC;YACpC,OAAO,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;QACzD,CAAC;QACD,uEAAuE;QACvE,8DAA8D;QAC9D,IAAI,yBAAyB,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,OAAO,YAAY,CACjB,SAAS,CAAC,GAAG,EAAE,8BAA8B,EAAE,GAAG,CAAC,OAAO,CAAC,EAC3D,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,OAAO,YAAY,CACjB,SAAS,CAAC,GAAG,EAAE,2BAA2B,EAAE,GAAG,CAAC,OAAO,CAAC,EACxD,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,yEAAyE;IACzE,IAAI,UAAU,CAAC,SAAS,KAAK,aAAa,EAAE,CAAC;QAC3C,OAAO,YAAY,CACjB,SAAS,CACP,GAAG,EACH,8BAA8B,EAC9B,8EAA8E,CAC/E,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;IAChD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,YAAY,CACjB,SAAS,CACP,GAAG,EACH,mBAAmB,EACnB,mFAAmF,CACpF,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,kBAAkB,CACpC,UAAU,CAAC,IAAI,CAAC,OAAO,EACvB,8BAA8B,CAC/B,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,iBAAiB,CACrC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,EAC1C,UAAU,CAAC,IAAI,CAAC,MAAM,CACvB,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,kBAAkB,CACtC;YACE,cAAc,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM;YACtC,OAAO;YACP,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE;SACpC,EACD;YACE,KAAK,EAAE,IAAI,CAAC,YAAY;YACxB,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,kBAAkB;YACnD,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;YAC1D,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;YACpD,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS;gBAChC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;SACvC,CACF,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CACjB;YACE,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM;YAC/B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,EACD,sBAAsB,CACvB,CAAC;QACF,MAAM,IAAI,GAA6B;YACrC,YAAY,EAAE,OAAO,CAAC,WAAW;YACjC,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,OAAO,CAAC,gBAAgB;YACpC,mEAAmE;YACnE,2BAA2B;YAC3B,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;SACrC,CAAC;QACF,OAAO,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YACjC,OAAO,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/write/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EACL,iCAAiC,EACjC,KAAK,mBAAmB,EACzB,MAAM,mBAAmB,CAAC;
|
|
1
|
+
{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/write/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EACL,iCAAiC,EACjC,KAAK,mBAAmB,EACzB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,KAAK,EACV,uBAAuB,EACvB,iBAAiB,EAClB,MAAM,mBAAmB,CAAC;AAc3B,MAAM,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AACxD,eAAO,MAAM,mCAAmC,0CACb,CAAC;AACpC,eAAO,MAAM,qBAAqB,4BAAsB,CAAC;AAEzD,MAAM,WAAW,kBAAkB;IACjC,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,cAAc,EAAE,KAAK,MAAM,EAAE,CAAC;IAC9B,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,qDAAqD;IACrD,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;CACvE;AAED;;;;;GAKG;AACH,wBAAgB,+BAA+B,IAAI,iBAAiB,CAgBnE;AAID,MAAM,WAAW,uBAAuB;IACtC,cAAc,EAAE,KAAK,MAAM,EAAE,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,KAAK,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7C;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,iBAAiB,CAAC;IACzB,mBAAmB,EAAE,uBAAuB,CAAC;IAC7C,aAAa,EAAE,iBAAiB,CAAC;IACjC;;;;;OAKG;IACH,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;IAC3B,WAAW,EAAE,MAAM,MAAM,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,yEAAyE;IACzE,WAAW,CAAC,EAAE,qBAAqB,CAAC;CACrC;AAED,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,uBAAuB,EAC9B,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,wBAAwB,CAAC,CAyGnC"}
|
package/dist/write/session.js
CHANGED
|
@@ -19,6 +19,7 @@
|
|
|
19
19
|
import { hashConnectionToken } from "../mcp/connection-api.js";
|
|
20
20
|
import { createInMemoryMcpProofReplayStore, } from "../mcp/session.js";
|
|
21
21
|
import { writeScopePatterns } from "../policy/data-write.js";
|
|
22
|
+
import { SENTINEL_GRANT_IDS } from "../policy/data-read.js";
|
|
22
23
|
import { GrantOwnerMismatchError, GrantRequiredError, GrantRevokedError, InvalidSignatureError, ProtocolError, ScopeMismatchError, UnregisteredBuilderError, } from "../errors/catalog.js";
|
|
23
24
|
export const createInMemoryWriteProofReplayStore = createInMemoryMcpProofReplayStore;
|
|
24
25
|
export const hashWriteSessionToken = hashConnectionToken;
|
|
@@ -59,6 +60,12 @@ export async function createWriteSession(input, options) {
|
|
|
59
60
|
const builder = await options.authSessionVerifier.getBuilder(input.builderAddress);
|
|
60
61
|
if (!builder)
|
|
61
62
|
throw new UnregisteredBuilderError();
|
|
63
|
+
if (SENTINEL_GRANT_IDS.has(input.grantId)) {
|
|
64
|
+
throw new GrantRequiredError({
|
|
65
|
+
reason: "Reserved grantId",
|
|
66
|
+
grantId: input.grantId,
|
|
67
|
+
});
|
|
68
|
+
}
|
|
62
69
|
const grant = await options.grantVerifier.getGrant(input.grantId);
|
|
63
70
|
if (!grant) {
|
|
64
71
|
throw new GrantRequiredError({
|
|
@@ -66,6 +73,12 @@ export async function createWriteSession(input, options) {
|
|
|
66
73
|
grantId: input.grantId,
|
|
67
74
|
});
|
|
68
75
|
}
|
|
76
|
+
if (SENTINEL_GRANT_IDS.has(grant.id)) {
|
|
77
|
+
throw new GrantRequiredError({
|
|
78
|
+
reason: "Grant resolved to a reserved id",
|
|
79
|
+
grantId: input.grantId,
|
|
80
|
+
});
|
|
81
|
+
}
|
|
69
82
|
if (grant.revokedAt !== null) {
|
|
70
83
|
throw new GrantRevokedError({ grantId: grant.id });
|
|
71
84
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/write/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EACL,iCAAiC,GAElC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;
|
|
1
|
+
{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/write/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EACL,iCAAiC,GAElC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAK5D,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,sBAAsB,CAAC;AAM9B,MAAM,CAAC,MAAM,mCAAmC,GAC9C,iCAAiC,CAAC;AACpC,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AAqBzD;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B;IAC7C,MAAM,MAAM,GAAG,IAAI,GAAG,EAA8B,CAAC;IACrD,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,MAAM;YACjB,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACvC,CAAC;QACD,KAAK,CAAC,cAAc,CAAC,SAAS;YAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACrC,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,IAAI,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACrC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACzB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAwC9C;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAA8B,EAC9B,OAAkC;IAElC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,UAAU,CAC1D,KAAK,CAAC,cAAc,CACrB,CAAC;IACF,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,wBAAwB,EAAE,CAAC;IAEnD,IAAI,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,kBAAkB,CAAC;YAC3B,MAAM,EAAE,kBAAkB;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,kBAAkB,CAAC;YAC3B,MAAM,EAAE,iBAAiB;YACzB,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,kBAAkB,CAAC;YAC3B,MAAM,EAAE,iCAAiC;YACzC,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IACxD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,kBAAkB,CAAC;YAC3B,MAAM,EACJ,uEAAuE;YACzE,aAAa,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE;SAClC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;QAC/D,MAAM,IAAI,qBAAqB,CAAC;YAC9B,MAAM,EAAE,2CAA2C;YACnD,QAAQ,EAAE,KAAK,CAAC,SAAS;YACzB,MAAM,EAAE,KAAK,CAAC,cAAc;SAC7B,CAAC,CAAC;IACL,CAAC;IACD,mEAAmE;IACnE,4DAA4D;IAC5D,IACE,CAAC,KAAK,CAAC,cAAc;QACrB,KAAK,CAAC,cAAc,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,CAAC,WAAW,EAAE,EACxE,CAAC;QACD,MAAM,IAAI,uBAAuB,CAAC;YAChC,OAAO,EAAE,KAAK,CAAC,EAAE;YACjB,QAAQ,EAAE,OAAO,CAAC,WAAW;YAC7B,MAAM,EAAE,KAAK,CAAC,cAAc,IAAI,IAAI;SACrC,CAAC,CAAC;IACL,CAAC;IAED,0EAA0E;IAC1E,+DAA+D;IAC/D,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,sBAAsB,CAAC;IACtD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAE5C,2EAA2E;IAC3E,wDAAwD;IACxD,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;IACrE,IAAI,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAChD,KAAK,CAAC,KAAK,CAAC,EAAE,EACd,KAAK,CAAC,KAAK,CAAC,WAAW,CACxB,CAAC;QACF,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,aAAa,CACrB,GAAG,EACH,4BAA4B,EAC5B,kDAAkD,CACnD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;YACzB,SAAS;YACT,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,OAAO,EAAE,KAAK,CAAC,EAAE;YACjB,WAAW,EAAE,QAAQ;YACrB,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE;YACxC,WAAW,EAAE,KAAK,GAAG,KAAK;SAC3B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0EAA0E;QAC1E,yDAAyD;QACzD,IAAI,gBAAgB,IAAI,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC;YACpE,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,OAAO;QACL,WAAW,EAAE,KAAK;QAClB,gBAAgB,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;QAC1C,OAAO,EAAE,KAAK,CAAC,EAAE;QACjB,WAAW,EAAE,QAAQ;KACtB,CAAC;AACJ,CAAC"}
|