@opendatalabs/personal-server-ts-core 1.33.8 → 1.34.1

package/dist/grants/pdpp-binding-store.d.ts

@@ -0,0 +1,89 @@
+/**
+ * Durable retention for PDPP ↔ chain grant bindings (scope §6).
+ *
+ * The binding record is the only thing that crosses the gateway/chain
+ * boundary on our side; record payloads stay in PS storage and never enter
+ * this store. What is retained here is an identity join — PDPP grant id,
+ * chain permission ref, owner, grantee — and nothing about the data itself.
+ *
+ * ## Append-only by construction
+ *
+ * The port exposes `put` and `get` but no `update` and no `delete`. That is
+ * deliberate, and it is the mechanism that makes §6's revocation semantics
+ * correct rather than merely intended:
+ *
+ *   - A binding asserts a *historical* fact ("this consent authorized this
+ *     permission"), which does not stop being true when the grant is revoked.
+ *   - Revocation is a *current* fact, and lives on the chain grant, read live
+ *     at verification time.
+ *
+ * If revocation were mirrored into this store, the two would have to be kept
+ * in sync, and every window where they disagreed would be a window where a
+ * revoked grant still read as live. Not storing the status at all removes that
+ * class of bug instead of managing it.
+ *
+ * `putBinding` rejects a conflicting rewrite for the same key rather than
+ * overwriting, so a second binding cannot silently retarget an existing PDPP
+ * grant at a different permission, owner, or app.
+ */
+import { type ChainPermissionRef, type PdppGrantBinding } from "./pdpp-binding.js";
+/**
+ * Durable storage for grant bindings.
+ *
+ * Implementations back this with the deployment's real store (SQLite on
+ * desktop, the supplied runtime's durable state in Enclave). The interface is
+ * intentionally tiny so both can implement it without sharing a schema.
+ */
+export interface PdppGrantBindingStore {
+    /**
+     * Retain a binding. Idempotent for an identical re-put; throws on a
+     * conflicting one.
+     */
+    putBinding(binding: PdppGrantBinding): void;
+    /** Look up by the PDPP grant id (the consent artifact). */
+    getByPdppGrantId(pdppGrantId: string): PdppGrantBinding | null;
+    /**
+     * All bindings recorded against a chain permission, oldest first.
+     *
+     * Plural and non-unique on purpose: distinct PDPP grants can legitimately
+     * bind to the same permission over time (e.g. one consent superseding
+     * another at the chain level), and each retains its own observed
+     * `grantVersion`. Returning a single "the" binding here would silently
+     * pick one and hide the others — callers that need "is any binding for
+     * this permission still live" must check every entry themselves.
+     */
+    getBindingsForPermission(permission: ChainPermissionRef): PdppGrantBinding[];
+}
+/**
+ * True when two bindings agree on every field that defines the binding.
+ *
+ * Both `granteeAddress` (the app's wallet) and `granteeId` (the builder id
+ * the chain grant names) are compared, which makes rotation of either an
+ * explicit conflict rather than a silent follow. That is deliberate. Context
+ * Gateway holds one Privy-custodied wallet per app, keyed `(ownerType,
+ * ownerId)` with a DB unique index, and its schema *models* rotation
+ * (`isCurrent` plus a partial unique index) although no code path performs
+ * one today — so the address is currently immutable per app in practice but
+ * not by design.
+ *
+ * If rotation ever ships, a rotated wallet or builder id is a different
+ * grantee, and the owner's existing consent must not transfer to it without
+ * a new decision. Rejecting the rewrite surfaces that as a failure instead of
+ * quietly repointing a retained grant at an identity the owner never
+ * approved.
+ */
+export declare function bindingsAgree(a: PdppGrantBinding, b: PdppGrantBinding): boolean;
+export declare function permissionKey(p: ChainPermissionRef): string;
+/** New bindings require a version; only migrated rows may retain null. */
+export declare function assertWritableGrantVersion(binding: PdppGrantBinding): void;
+/**
+ * In-memory implementation, used by tests and by callers that have no durable
+ * store yet.
+ *
+ * This is a real implementation of the port's semantics — including the
+ * conflict rejection — not a stub that accepts everything. Tests exercising it
+ * are therefore testing the actual binding rules; only the persistence medium
+ * differs from a deployed store.
+ */
+export declare function createInMemoryPdppGrantBindingStore(): PdppGrantBindingStore;
+//# sourceMappingURL=pdpp-binding-store.d.ts.map

package/dist/grants/pdpp-binding-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pdpp-binding-store.d.ts","sourceRoot":"","sources":["../../src/grants/pdpp-binding-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAIH,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACtB,MAAM,mBAAmB,CAAC;AAE3B;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,UAAU,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC5C,2DAA2D;IAC3D,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAAC;IAC/D;;;;;;;;;OASG;IACH,wBAAwB,CAAC,UAAU,EAAE,kBAAkB,GAAG,gBAAgB,EAAE,CAAC;CAC9E;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,aAAa,CAC3B,CAAC,EAAE,gBAAgB,EACnB,CAAC,EAAE,gBAAgB,GAClB,OAAO,CAUT;AAED,wBAAgB,aAAa,CAAC,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAE3D;AAED,0EAA0E;AAC1E,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAS1E;AAED;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,IAAI,qBAAqB,CAyC3E"}

package/dist/grants/pdpp-binding-store.js

@@ -0,0 +1,112 @@
+/**
+ * Durable retention for PDPP ↔ chain grant bindings (scope §6).
+ *
+ * The binding record is the only thing that crosses the gateway/chain
+ * boundary on our side; record payloads stay in PS storage and never enter
+ * this store. What is retained here is an identity join — PDPP grant id,
+ * chain permission ref, owner, grantee — and nothing about the data itself.
+ *
+ * ## Append-only by construction
+ *
+ * The port exposes `put` and `get` but no `update` and no `delete`. That is
+ * deliberate, and it is the mechanism that makes §6's revocation semantics
+ * correct rather than merely intended:
+ *
+ *   - A binding asserts a *historical* fact ("this consent authorized this
+ *     permission"), which does not stop being true when the grant is revoked.
+ *   - Revocation is a *current* fact, and lives on the chain grant, read live
+ *     at verification time.
+ *
+ * If revocation were mirrored into this store, the two would have to be kept
+ * in sync, and every window where they disagreed would be a window where a
+ * revoked grant still read as live. Not storing the status at all removes that
+ * class of bug instead of managing it.
+ *
+ * `putBinding` rejects a conflicting rewrite for the same key rather than
+ * overwriting, so a second binding cannot silently retarget an existing PDPP
+ * grant at a different permission, owner, or app.
+ */
+import { InvalidSignatureError } from "../errors/catalog.js";
+import { isValidGrantVersion, samePermission, } from "./pdpp-binding.js";
+/**
+ * True when two bindings agree on every field that defines the binding.
+ *
+ * Both `granteeAddress` (the app's wallet) and `granteeId` (the builder id
+ * the chain grant names) are compared, which makes rotation of either an
+ * explicit conflict rather than a silent follow. That is deliberate. Context
+ * Gateway holds one Privy-custodied wallet per app, keyed `(ownerType,
+ * ownerId)` with a DB unique index, and its schema *models* rotation
+ * (`isCurrent` plus a partial unique index) although no code path performs
+ * one today — so the address is currently immutable per app in practice but
+ * not by design.
+ *
+ * If rotation ever ships, a rotated wallet or builder id is a different
+ * grantee, and the owner's existing consent must not transfer to it without
+ * a new decision. Rejecting the rewrite surfaces that as a failure instead of
+ * quietly repointing a retained grant at an identity the owner never
+ * approved.
+ */
+export function bindingsAgree(a, b) {
+    return (a.pdppGrantId === b.pdppGrantId &&
+        samePermission(a.permission, b.permission) &&
+        a.ownerAddress.toLowerCase() === b.ownerAddress.toLowerCase() &&
+        a.granteeAddress.toLowerCase() === b.granteeAddress.toLowerCase() &&
+        a.granteeId.toLowerCase() === b.granteeId.toLowerCase() &&
+        a.pdppClientId === b.pdppClientId &&
+        a.grantVersion === b.grantVersion);
+}
+export function permissionKey(p) {
+    return `${p.chainId}:${p.contractAddress.toLowerCase()}:${p.permissionId}`;
+}
+/** New bindings require a version; only migrated rows may retain null. */
+export function assertWritableGrantVersion(binding) {
+    if (!isValidGrantVersion(binding.grantVersion)) {
+        throw new InvalidSignatureError({
+            reason: "grantVersion must be a positive decimal uint256 string for a new binding; null is reserved for a preserved legacy row",
+            pdppGrantId: binding.pdppGrantId,
+            grantVersion: binding.grantVersion,
+        });
+    }
+}
+/**
+ * In-memory implementation, used by tests and by callers that have no durable
+ * store yet.
+ *
+ * This is a real implementation of the port's semantics — including the
+ * conflict rejection — not a stub that accepts everything. Tests exercising it
+ * are therefore testing the actual binding rules; only the persistence medium
+ * differs from a deployed store.
+ */
+export function createInMemoryPdppGrantBindingStore() {
+    const byGrantId = new Map();
+    const byPermission = new Map();
+    return {
+        putBinding(binding) {
+            const existingByGrant = byGrantId.get(binding.pdppGrantId);
+            if (existingByGrant) {
+                if (!bindingsAgree(existingByGrant, binding)) {
+                    throw new InvalidSignatureError({
+                        reason: "A different binding already exists for this PDPP grant id",
+                        pdppGrantId: binding.pdppGrantId,
+                    });
+                }
+                return;
+            }
+            assertWritableGrantVersion(binding);
+            const key = permissionKey(binding.permission);
+            const list = byPermission.get(key) ?? [];
+            list.push(binding);
+            byPermission.set(key, list);
+            byGrantId.set(binding.pdppGrantId, binding);
+        },
+        getByPdppGrantId(pdppGrantId) {
+            return byGrantId.get(pdppGrantId) ?? null;
+        },
+        getBindingsForPermission(permission) {
+            const list = byPermission.get(permissionKey(permission)) ?? [];
+            return [...list].sort((a, b) => a.boundAt.localeCompare(b.boundAt) ||
+                a.pdppGrantId.localeCompare(b.pdppGrantId));
+        },
+    };
+}
+//# sourceMappingURL=pdpp-binding-store.js.map

package/dist/grants/pdpp-binding-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pdpp-binding-store.js","sourceRoot":"","sources":["../../src/grants/pdpp-binding-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,OAAO,EACL,mBAAmB,EACnB,cAAc,GAGf,MAAM,mBAAmB,CAAC;AA8B3B;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,aAAa,CAC3B,CAAmB,EACnB,CAAmB;IAEnB,OAAO,CACL,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW;QAC/B,cAAc,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC;QAC1C,CAAC,CAAC,YAAY,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,YAAY,CAAC,WAAW,EAAE;QAC7D,CAAC,CAAC,cAAc,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,cAAc,CAAC,WAAW,EAAE;QACjE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;QACvD,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,YAAY;QACjC,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,YAAY,CAClC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,CAAqB;IACjD,OAAO,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,eAAe,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;AAC7E,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,0BAA0B,CAAC,OAAyB;IAClE,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,qBAAqB,CAAC;YAC9B,MAAM,EACJ,uHAAuH;YACzH,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mCAAmC;IACjD,MAAM,SAAS,GAAG,IAAI,GAAG,EAA4B,CAAC;IACtD,MAAM,YAAY,GAAG,IAAI,GAAG,EAA8B,CAAC;IAE3D,OAAO;QACL,UAAU,CAAC,OAAyB;YAClC,MAAM,eAAe,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YAC3D,IAAI,eAAe,EAAE,CAAC;gBACpB,IAAI,CAAC,aAAa,CAAC,eAAe,EAAE,OAAO,CAAC,EAAE,CAAC;oBAC7C,MAAM,IAAI,qBAAqB,CAAC;wBAC9B,MAAM,EAAE,2DAA2D;wBACnE,WAAW,EAAE,OAAO,CAAC,WAAW;qBACjC,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO;YACT,CAAC;YAED,0BAA0B,CAAC,OAAO,CAAC,CAAC;YAEpC,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAC9C,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACnB,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC5B,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;QAED,gBAAgB,CAAC,WAAmB;YAClC,OAAO,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC;QAC5C,CAAC;QAED,wBAAwB,CACtB,UAA8B;YAE9B,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/D,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CACnB,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC;gBAClC,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAC7C,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/grants/pdpp-binding.d.ts

@@ -0,0 +1,169 @@
+/**
+ * Retains the identity join between a PDPP grant and a Vana gateway grant.
+ * `permissionId` stores GatewayGrantResponse.id, including hex grant IDs.
+ * Builder IDs and wallet addresses are distinct: creation requires a trusted
+ * builder lookup, and verification compares each identity with its counterpart.
+ * Deployment fields bind the record to the PS configuration; they are not
+ * authenticated fields of the gateway response. Revocation is checked live.
+ */
+import type { Builder, GatewayGrantResponse } from "@opendatalabs/vana-sdk/browser";
+/**
+ * The chain-side identity of a grant. This tuple — and not any derived digest
+ * — is the binding key.
+ *
+ * `chainId` and `contractAddress` are the PS's own deployment configuration,
+ * not fields the gateway returns; see the module doc for why they are kept.
+ * `permissionId` is `GatewayGrantResponse.id` (see module doc) — keying on it
+ * alone, without a deployment tag, would also let a record recorded under one
+ * deployment configuration silently authorize a read under another.
+ */
+export interface ChainPermissionRef {
+    /** EIP-155 chain ID of the deployment the PS was configured against when this was recorded. */
+    chainId: number;
+    /** The gateway/contract address the PS was configured against when this was recorded. */
+    contractAddress: `0x${string}`;
+    /** `GatewayGrantResponse.id` — the gateway's grant id (may be hex). */
+    permissionId: string;
+}
+/** The builder evidence a caller must resolve before creating or checking a binding. */
+export type ResolvedBuilder = Pick<Builder, "id" | "granteeAddress">;
+/**
+ * An immutable binding between one resolved PDPP grant and one chain
+ * permission.
+ *
+ * Immutability is the point: this record is written once, at grant creation,
+ * and is never mutated — not even on revocation. Revocation is a *live* fact
+ * read from the chain grant (`revokedAt`), never a field edited here. Copying
+ * a mutable status into an immutable record is how a stale "still valid" claim
+ * survives a revocation, so the two are kept strictly apart.
+ */
+export interface PdppGrantBinding {
+    /** `grant_id` of the resolved PDPP grant (the consent artifact). */
+    pdppGrantId: string;
+    /** Chain identity of the permission that authorizes reads for this grant. */
+    permission: ChainPermissionRef;
+    /**
+     * The data owner. Must equal both the chain grant's `grantorAddress` and the
+     * PS's configured `serverOwner` at read time.
+     */
+    ownerAddress: `0x${string}`;
+    /**
+     * The grantee app's wallet address — the app's *existing* identity, carried
+     * through unchanged.
+     *
+     * §6 requires one grantee identity per Context Gateway builder/app: the
+     * PDPP `client_id`, the issued grant, the ledger grant, and the access-history
+     * grantee must all resolve to this one address. We record the address the app
+     * already has; we do not allocate one.
+     */
+    granteeAddress: `0x${string}`;
+    /** The PDPP OAuth `client_id` that the above address belongs to. */
+    pdppClientId: string;
+    /**
+     * The resolved builder's id (`Builder.id`), as the chain grant's
+     * `granteeId` reports it. This is a distinct bytes32-shaped identifier,
+     * NOT the wallet address above — see the module doc.
+     */
+    granteeId: string;
+    /** Gateway version verified at binding time. Later versions invalidate this consent.
+     * `null` denotes a preserved legacy row and always denies access.
+     */
+    grantVersion: string | null;
+    /** When the binding was recorded (ISO 8601). Provenance, not status. */
+    boundAt: string;
+}
+export declare function isValidGrantVersion(value: unknown): value is string;
+/** Re-registration can clear revocation, so even a newer version requires new consent. */
+export declare function grantVersionStillAuthorizes(retainedVersion: string | null, liveVersion: unknown): boolean;
+/**
+ * Compare two chain permission references. All three components must match —
+ * see `ChainPermissionRef` for why the address and chain ID are load-bearing.
+ */
+export declare function samePermission(a: ChainPermissionRef, b: ChainPermissionRef): boolean;
+export interface CreateBindingInput {
+    pdppGrantId: string;
+    permission: ChainPermissionRef;
+    /** The PS's configured owner address. */
+    serverOwner: `0x${string}`;
+    /** The app's existing grantee wallet address. */
+    granteeAddress: `0x${string}`;
+    pdppClientId: string;
+    /**
+     * Trusted, already-resolved builder evidence for `granteeAddress` — e.g.
+     * `await gateway.getBuilder(granteeAddress)`. This is what lets the binding
+     * check the chain grant's `granteeId` (a builder id) against the right
+     * counterpart instead of against the wallet address directly.
+     */
+    resolvedBuilder: ResolvedBuilder;
+    /** The chain grant this PDPP grant is being bound to, as the gateway reports it. */
+    chainGrant: GatewayGrantResponse;
+    now?: Date;
+}
+/**
+ * Create the binding at grant-creation time, refusing to record one that is
+ * already inconsistent.
+ *
+ * This is the *creation* boundary check. It is deliberately strict: a binding
+ * written now is trusted later, so anything we fail to verify here becomes an
+ * unverifiable assertion at read time. Specifically it rejects:
+ *
+ *  - a chain grant whose `grantorAddress` is not this server's owner (binding
+ *    another owner's grant to our PDPP consent),
+ *  - a `resolvedBuilder` whose wallet is not the app's requested address
+ *    (the caller resolved the wrong builder),
+ *  - a chain grant whose `granteeId` is not the resolved builder's id
+ *    (binding a grant issued to a *different* app),
+ *  - a chain grant that is already revoked (never record a dead grant as live),
+ *  - a chain grant whose id does not match the permission being bound,
+ *  - a chain grant whose `grantVersion` is missing or not a valid positive
+ *    decimal uint256 string (a new binding must pin a real version; `null`
+ *    is reserved for legacy rows a schema migration preserved, never for
+ *    something created through this function).
+ */
+export declare function createPdppGrantBinding(input: CreateBindingInput): PdppGrantBinding;
+export interface VerifyBindingInput {
+    /** The retained, immutable binding record. */
+    binding: PdppGrantBinding;
+    /** The PDPP grant id presented by the caller. */
+    pdppGrantId: string;
+    /** The PS's configured owner address, at read time. */
+    serverOwner: `0x${string}`;
+    /** The address that signed this request (the app's grantee wallet). */
+    requestSigner: `0x${string}`;
+    /**
+     * The chain grant as read *now*. Revocation is read live from here; it is
+     * never taken from the binding record.
+     */
+    chainGrant: GatewayGrantResponse | null;
+    /** The deployment the PS is configured against, at read time. */
+    deployment: {
+        chainId: number;
+        contractAddress: `0x${string}`;
+    };
+}
+/**
+ * Verify a binding at read time.
+ *
+ * Every axis §6 names is checked against the *retained* binding, so a
+ * mismatch on any one of owner, app, chain/contract, or record fails closed:
+ *
+ *  - **record**: the presented PDPP grant id must be the one bound,
+ *  - **chain/contract**: the binding must have been recorded under the same
+ *    deployment configuration the PS is running under now (see module doc —
+ *    this is an operator-misconfiguration guard, not gateway-supplied
+ *    evidence, since the gateway response carries no chain/contract fields),
+ *  - **owner**: the binding's owner must still be this server's owner, and the
+ *    live chain grant's grantor must agree,
+ *  - **app**: the request signer (a wallet) must be the bound grantee
+ *    address, and the live chain grant's `granteeId` (a builder id) must
+ *    still agree with the `granteeId` retained on the binding — these two
+ *    checks are deliberately against different fields, because a wallet and
+ *    a builder id are different values,
+ *  - **revocation**: the live chain grant must exist and be unrevoked.
+ *
+ * No chain I/O happens in this function — the caller supplies the already-read
+ * `chainGrant`. That keeps this usable on the hot read path without adding a
+ * network round trip per request.
+ */
+export declare function verifyPdppGrantBinding(input: VerifyBindingInput): void;
+//# sourceMappingURL=pdpp-binding.d.ts.map

package/dist/grants/pdpp-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pdpp-binding.d.ts","sourceRoot":"","sources":["../../src/grants/pdpp-binding.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AASH,OAAO,KAAK,EACV,OAAO,EACP,oBAAoB,EACrB,MAAM,gCAAgC,CAAC;AAExC;;;;;;;;;GASG;AACH,MAAM,WAAW,kBAAkB;IACjC,+FAA+F;IAC/F,OAAO,EAAE,MAAM,CAAC;IAChB,yFAAyF;IACzF,eAAe,EAAE,KAAK,MAAM,EAAE,CAAC;IAC/B,uEAAuE;IACvE,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,wFAAwF;AACxF,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,GAAG,gBAAgB,CAAC,CAAC;AAErE;;;;;;;;;GASG;AACH,MAAM,WAAW,gBAAgB;IAC/B,oEAAoE;IACpE,WAAW,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,UAAU,EAAE,kBAAkB,CAAC;IAC/B;;;OAGG;IACH,YAAY,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B;;;;;;;;OAQG;IACH,cAAc,EAAE,KAAK,MAAM,EAAE,CAAC;IAC9B,oEAAoE;IACpE,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;CACjB;AAMD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAInE;AAED,0FAA0F;AAC1F,wBAAgB,2BAA2B,CACzC,eAAe,EAAE,MAAM,GAAG,IAAI,EAC9B,WAAW,EAAE,OAAO,GACnB,OAAO,CAIT;AAOD;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,CAAC,EAAE,kBAAkB,EACrB,CAAC,EAAE,kBAAkB,GACpB,OAAO,CAMT;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,kBAAkB,CAAC;IAC/B,yCAAyC;IACzC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;IAC3B,iDAAiD;IACjD,cAAc,EAAE,KAAK,MAAM,EAAE,CAAC;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,eAAe,EAAE,eAAe,CAAC;IACjC,oFAAoF;IACpF,UAAU,EAAE,oBAAoB,CAAC;IACjC,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,kBAAkB,GACxB,gBAAgB,CAsElB;AAED,MAAM,WAAW,kBAAkB;IACjC,8CAA8C;IAC9C,OAAO,EAAE,gBAAgB,CAAC;IAC1B,iDAAiD;IACjD,WAAW,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;IAC3B,uEAAuE;IACvE,aAAa,EAAE,KAAK,MAAM,EAAE,CAAC;IAC7B;;;OAGG;IACH,UAAU,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACxC,iEAAiE;IACjE,UAAU,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,KAAK,MAAM,EAAE,CAAA;KAAE,CAAC;CACjE;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI,CA0GtE"}

package/dist/grants/pdpp-binding.js

@@ -0,0 +1,236 @@
+/**
+ * Retains the identity join between a PDPP grant and a Vana gateway grant.
+ * `permissionId` stores GatewayGrantResponse.id, including hex grant IDs.
+ * Builder IDs and wallet addresses are distinct: creation requires a trusted
+ * builder lookup, and verification compares each identity with its counterpart.
+ * Deployment fields bind the record to the PS configuration; they are not
+ * authenticated fields of the gateway response. Revocation is checked live.
+ */
+import { GrantOwnerMismatchError, GrantRevokedError, InvalidSignatureError, ScopeMismatchError, } from "../errors/catalog.js";
+/** Gateway versions are positive decimal uint256 strings without leading zeros. */
+const POSITIVE_DECIMAL_UINT256 = /^(0|[1-9][0-9]*)$/;
+const UINT256_MAX = 2n ** 256n - 1n;
+export function isValidGrantVersion(value) {
+    if (typeof value !== "string")
+        return false;
+    if (!POSITIVE_DECIMAL_UINT256.test(value) || value === "0")
+        return false;
+    return BigInt(value) <= UINT256_MAX;
+}
+/** Re-registration can clear revocation, so even a newer version requires new consent. */
+export function grantVersionStillAuthorizes(retainedVersion, liveVersion) {
+    if (retainedVersion === null)
+        return false;
+    if (!isValidGrantVersion(liveVersion))
+        return false;
+    return retainedVersion === liveVersion;
+}
+/** Case-insensitive comparison for hex-ish strings (addresses or bytes32 ids). */
+function sameHex(a, b) {
+    return typeof a === "string" && a.toLowerCase() === b.toLowerCase();
+}
+/**
+ * Compare two chain permission references. All three components must match —
+ * see `ChainPermissionRef` for why the address and chain ID are load-bearing.
+ */
+export function samePermission(a, b) {
+    return (a.chainId === b.chainId &&
+        a.contractAddress.toLowerCase() === b.contractAddress.toLowerCase() &&
+        a.permissionId === b.permissionId);
+}
+/**
+ * Create the binding at grant-creation time, refusing to record one that is
+ * already inconsistent.
+ *
+ * This is the *creation* boundary check. It is deliberately strict: a binding
+ * written now is trusted later, so anything we fail to verify here becomes an
+ * unverifiable assertion at read time. Specifically it rejects:
+ *
+ *  - a chain grant whose `grantorAddress` is not this server's owner (binding
+ *    another owner's grant to our PDPP consent),
+ *  - a `resolvedBuilder` whose wallet is not the app's requested address
+ *    (the caller resolved the wrong builder),
+ *  - a chain grant whose `granteeId` is not the resolved builder's id
+ *    (binding a grant issued to a *different* app),
+ *  - a chain grant that is already revoked (never record a dead grant as live),
+ *  - a chain grant whose id does not match the permission being bound,
+ *  - a chain grant whose `grantVersion` is missing or not a valid positive
+ *    decimal uint256 string (a new binding must pin a real version; `null`
+ *    is reserved for legacy rows a schema migration preserved, never for
+ *    something created through this function).
+ */
+export function createPdppGrantBinding(input) {
+    const { chainGrant, serverOwner, granteeAddress, resolvedBuilder, permission, } = input;
+    if (chainGrant.id !== permission.permissionId) {
+        throw new InvalidSignatureError({
+            reason: "Chain grant id does not match the permission being bound",
+            expected: permission.permissionId,
+            actual: chainGrant.id,
+        });
+    }
+    if (!sameHex(chainGrant.grantorAddress, serverOwner)) {
+        throw new GrantOwnerMismatchError({
+            grantId: chainGrant.id,
+            expected: serverOwner,
+            actual: chainGrant.grantorAddress ?? null,
+        });
+    }
+    // The caller's resolved builder must actually BE the requested app's
+    // wallet — otherwise everything below verifies the wrong builder.
+    if (!sameHex(resolvedBuilder.granteeAddress, granteeAddress)) {
+        throw new InvalidSignatureError({
+            reason: "Resolved builder wallet does not match the requested app address",
+            expected: granteeAddress,
+            actual: resolvedBuilder.granteeAddress,
+        });
+    }
+    // Bind to the app's EXISTING grantee identity. If the chain grant was
+    // issued to a different builder, this PDPP consent does not describe it.
+    // `granteeId` is the builder's bytes32 id, NOT its wallet address — compare
+    // against `resolvedBuilder.id`, never against `granteeAddress` directly.
+    if (!sameHex(chainGrant.granteeId, resolvedBuilder.id)) {
+        throw new InvalidSignatureError({
+            reason: "Chain grant grantee does not match the app's builder id",
+            expected: resolvedBuilder.id,
+            actual: chainGrant.granteeId,
+        });
+    }
+    if (chainGrant.revokedAt !== null && chainGrant.revokedAt !== undefined) {
+        throw new GrantRevokedError({ grantId: chainGrant.id });
+    }
+    if (!isValidGrantVersion(chainGrant.grantVersion)) {
+        throw new InvalidSignatureError({
+            reason: "Chain grant grantVersion is missing or malformed",
+            grantId: chainGrant.id,
+            actual: chainGrant.grantVersion,
+        });
+    }
+    return Object.freeze({
+        pdppGrantId: input.pdppGrantId,
+        permission,
+        ownerAddress: serverOwner,
+        granteeAddress,
+        pdppClientId: input.pdppClientId,
+        granteeId: chainGrant.granteeId,
+        grantVersion: chainGrant.grantVersion,
+        boundAt: (input.now ?? new Date()).toISOString(),
+    });
+}
+/**
+ * Verify a binding at read time.
+ *
+ * Every axis §6 names is checked against the *retained* binding, so a
+ * mismatch on any one of owner, app, chain/contract, or record fails closed:
+ *
+ *  - **record**: the presented PDPP grant id must be the one bound,
+ *  - **chain/contract**: the binding must have been recorded under the same
+ *    deployment configuration the PS is running under now (see module doc —
+ *    this is an operator-misconfiguration guard, not gateway-supplied
+ *    evidence, since the gateway response carries no chain/contract fields),
+ *  - **owner**: the binding's owner must still be this server's owner, and the
+ *    live chain grant's grantor must agree,
+ *  - **app**: the request signer (a wallet) must be the bound grantee
+ *    address, and the live chain grant's `granteeId` (a builder id) must
+ *    still agree with the `granteeId` retained on the binding — these two
+ *    checks are deliberately against different fields, because a wallet and
+ *    a builder id are different values,
+ *  - **revocation**: the live chain grant must exist and be unrevoked.
+ *
+ * No chain I/O happens in this function — the caller supplies the already-read
+ * `chainGrant`. That keeps this usable on the hot read path without adding a
+ * network round trip per request.
+ */
+export function verifyPdppGrantBinding(input) {
+    const { binding, chainGrant, deployment } = input;
+    // Record binding: the consent artifact presented must be the bound one.
+    if (binding.pdppGrantId !== input.pdppGrantId) {
+        throw new ScopeMismatchError({
+            requestedScope: "pdpp:binding",
+            reason: "PDPP grant id does not match the binding record",
+            expected: binding.pdppGrantId,
+            actual: input.pdppGrantId,
+        });
+    }
+    // Deployment binding: a record from another PS deployment configuration is
+    // not evidence here. See module doc — this cannot be checked against the
+    // gateway response (it carries no chain/contract fields); it guards
+    // against the PS itself being reconfigured to a different deployment
+    // between when the binding was recorded and when it is read.
+    if (binding.permission.chainId !== deployment.chainId ||
+        binding.permission.contractAddress.toLowerCase() !==
+            deployment.contractAddress.toLowerCase()) {
+        throw new ScopeMismatchError({
+            requestedScope: "pdpp:binding",
+            reason: "Binding is for a different chain deployment",
+            expected: `${deployment.chainId}:${deployment.contractAddress}`,
+            actual: `${binding.permission.chainId}:${binding.permission.contractAddress}`,
+        });
+    }
+    // Owner binding, against the server's current configuration.
+    if (!sameHex(binding.ownerAddress, input.serverOwner)) {
+        throw new GrantOwnerMismatchError({
+            grantId: binding.permission.permissionId,
+            expected: input.serverOwner,
+            actual: binding.ownerAddress,
+        });
+    }
+    // App binding: the caller must BE the bound grantee wallet, not merely
+    // know its grant id.
+    if (!sameHex(input.requestSigner, binding.granteeAddress)) {
+        throw new InvalidSignatureError({
+            reason: "Request signer is not the bound grantee for this PDPP grant",
+            expected: binding.granteeAddress,
+            actual: input.requestSigner,
+        });
+    }
+    // Revocation is read live. A missing chain grant is treated as revoked
+    // rather than as "unknown": failing open here would let a deleted or
+    // unreachable permission authorize reads.
+    if (!chainGrant) {
+        throw new GrantRevokedError({
+            grantId: binding.permission.permissionId,
+            reason: "Chain grant not found",
+        });
+    }
+    if (chainGrant.id !== binding.permission.permissionId) {
+        throw new ScopeMismatchError({
+            requestedScope: "pdpp:binding",
+            reason: "Chain grant id does not match the binding record",
+            expected: binding.permission.permissionId,
+            actual: chainGrant.id,
+        });
+    }
+    if (chainGrant.revokedAt !== null && chainGrant.revokedAt !== undefined) {
+        throw new GrantRevokedError({ grantId: chainGrant.id });
+    }
+    if (!grantVersionStillAuthorizes(binding.grantVersion, chainGrant.grantVersion)) {
+        throw new InvalidSignatureError({
+            reason: "Chain grant version no longer matches the bound grantVersion",
+            expected: binding.grantVersion,
+            actual: chainGrant.grantVersion,
+        });
+    }
+    // The live chain grant must still agree with the binding on both parties.
+    // These can diverge from the record only if the gateway is serving a
+    // different grant under the same id, which we must not paper over.
+    if (!sameHex(chainGrant.grantorAddress, binding.ownerAddress)) {
+        throw new GrantOwnerMismatchError({
+            grantId: chainGrant.id,
+            expected: binding.ownerAddress,
+            actual: chainGrant.grantorAddress ?? null,
+        });
+    }
+    // Compare the live grant's builder id (`granteeId`) against the builder id
+    // retained on the binding (`binding.granteeId`) — NOT against
+    // `binding.granteeAddress`, which is a wallet. The wallet is what
+    // `requestSigner` proves above; this checks the separate, gateway-reported
+    // builder-id axis has not drifted.
+    if (!sameHex(chainGrant.granteeId, binding.granteeId)) {
+        throw new InvalidSignatureError({
+            reason: "Chain grant grantee no longer matches the bound grantee",
+            expected: binding.granteeId,
+            actual: chainGrant.granteeId,
+        });
+    }
+}
+//# sourceMappingURL=pdpp-binding.js.map

package/dist/grants/pdpp-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pdpp-binding.js","sourceRoot":"","sources":["../../src/grants/pdpp-binding.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AA2E9B,mFAAmF;AACnF,MAAM,wBAAwB,GAAG,mBAAmB,CAAC;AACrD,MAAM,WAAW,GAAG,EAAE,IAAI,IAAI,GAAG,EAAE,CAAC;AAEpC,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACzE,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC;AACtC,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,2BAA2B,CACzC,eAA8B,EAC9B,WAAoB;IAEpB,IAAI,eAAe,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,OAAO,eAAe,KAAK,WAAW,CAAC;AACzC,CAAC;AAED,kFAAkF;AAClF,SAAS,OAAO,CAAC,CAA4B,EAAE,CAAS;IACtD,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;AACtE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,CAAqB,EACrB,CAAqB;IAErB,OAAO,CACL,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO;QACvB,CAAC,CAAC,eAAe,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,eAAe,CAAC,WAAW,EAAE;QACnE,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,YAAY,CAClC,CAAC;AACJ,CAAC;AAsBD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAyB;IAEzB,MAAM,EACJ,UAAU,EACV,WAAW,EACX,cAAc,EACd,eAAe,EACf,UAAU,GACX,GAAG,KAAK,CAAC;IAEV,IAAI,UAAU,CAAC,EAAE,KAAK,UAAU,CAAC,YAAY,EAAE,CAAC;QAC9C,MAAM,IAAI,qBAAqB,CAAC;YAC9B,MAAM,EAAE,0DAA0D;YAClE,QAAQ,EAAE,UAAU,CAAC,YAAY;YACjC,MAAM,EAAE,UAAU,CAAC,EAAE;SACtB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,EAAE,WAAW,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,uBAAuB,CAAC;YAChC,OAAO,EAAE,UAAU,CAAC,EAAE;YACtB,QAAQ,EAAE,WAAW;YACrB,MAAM,EAAE,UAAU,CAAC,cAAc,IAAI,IAAI;SAC1C,CAAC,CAAC;IACL,CAAC;IAED,qEAAqE;IACrE,kEAAkE;IAClE,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,cAAc,EAAE,cAAc,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,qBAAqB,CAAC;YAC9B,MAAM,EACJ,kEAAkE;YACpE,QAAQ,EAAE,cAAc;YACxB,MAAM,EAAE,eAAe,CAAC,cAAc;SACvC,CAAC,CAAC;IACL,CAAC;IAED,sEAAsE;IACtE,yEAAyE;IACzE,4EAA4E;IAC5E,yEAAyE;IACzE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,qBAAqB,CAAC;YAC9B,MAAM,EAAE,yDAAyD;YACjE,QAAQ,EAAE,eAAe,CAAC,EAAE;YAC5B,MAAM,EAAE,UAAU,CAAC,SAAS;SAC7B,CAAC,CAAC;IACL,CAAC;IAED,IAAI,UAAU,CAAC,SAAS,KAAK,IAAI,IAAI,UAAU,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACxE,MAAM,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,qBAAqB,CAAC;YAC9B,MAAM,EAAE,kDAAkD;YAC1D,OAAO,EAAE,UAAU,CAAC,EAAE;YACtB,MAAM,EAAE,UAAU,CAAC,YAAY;SAChC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU;QACV,YAAY,EAAE,WAAW;QACzB,cAAc;QACd,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;KACjD,CAAC,CAAC;AACL,CAAC;AAoBD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAyB;IAC9D,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IAElD,wEAAwE;IACxE,IAAI,OAAO,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,IAAI,kBAAkB,CAAC;YAC3B,cAAc,EAAE,cAAc;YAC9B,MAAM,EAAE,iDAAiD;YACzD,QAAQ,EAAE,OAAO,CAAC,WAAW;YAC7B,MAAM,EAAE,KAAK,CAAC,WAAW;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,yEAAyE;IACzE,oEAAoE;IACpE,qEAAqE;IACrE,6DAA6D;IAC7D,IACE,OAAO,CAAC,UAAU,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO;QACjD,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,WAAW,EAAE;YAC9C,UAAU,CAAC,eAAe,CAAC,WAAW,EAAE,EAC1C,CAAC;QACD,MAAM,IAAI,kBAAkB,CAAC;YAC3B,cAAc,EAAE,cAAc;YAC9B,MAAM,EAAE,6CAA6C;YACrD,QAAQ,EAAE,GAAG,UAAU,CAAC,OAAO,IAAI,UAAU,CAAC,eAAe,EAAE;YAC/D,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,eAAe,EAAE;SAC9E,CAAC,CAAC;IACL,CAAC;IAED,6DAA6D;IAC7D,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,uBAAuB,CAAC;YAChC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,YAAY;YACxC,QAAQ,EAAE,KAAK,CAAC,WAAW;YAC3B,MAAM,EAAE,OAAO,CAAC,YAAY;SAC7B,CAAC,CAAC;IACL,CAAC;IAED,uEAAuE;IACvE,qBAAqB;IACrB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,qBAAqB,CAAC;YAC9B,MAAM,EAAE,6DAA6D;YACrE,QAAQ,EAAE,OAAO,CAAC,cAAc;YAChC,MAAM,EAAE,KAAK,CAAC,aAAa;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,uEAAuE;IACvE,qEAAqE;IACrE,0CAA0C;IAC1C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,iBAAiB,CAAC;YAC1B,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,YAAY;YACxC,MAAM,EAAE,uBAAuB;SAChC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,UAAU,CAAC,EAAE,KAAK,OAAO,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC;QACtD,MAAM,IAAI,kBAAkB,CAAC;YAC3B,cAAc,EAAE,cAAc;YAC9B,MAAM,EAAE,kDAAkD;YAC1D,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,YAAY;YACzC,MAAM,EAAE,UAAU,CAAC,EAAE;SACtB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,UAAU,CAAC,SAAS,KAAK,IAAI,IAAI,UAAU,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACxE,MAAM,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,IACE,CAAC,2BAA2B,CAAC,OAAO,CAAC,YAAY,EAAE,UAAU,CAAC,YAAY,CAAC,EAC3E,CAAC;QACD,MAAM,IAAI,qBAAqB,CAAC;YAC9B,MAAM,EAAE,8DAA8D;YACtE,QAAQ,EAAE,OAAO,CAAC,YAAY;YAC9B,MAAM,EAAE,UAAU,CAAC,YAAY;SAChC,CAAC,CAAC;IACL,CAAC;IAED,0EAA0E;IAC1E,qEAAqE;IACrE,mEAAmE;IACnE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,uBAAuB,CAAC;YAChC,OAAO,EAAE,UAAU,CAAC,EAAE;YACtB,QAAQ,EAAE,OAAO,CAAC,YAAY;YAC9B,MAAM,EAAE,UAAU,CAAC,cAAc,IAAI,IAAI;SAC1C,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,8DAA8D;IAC9D,kEAAkE;IAClE,2EAA2E;IAC3E,mCAAmC;IACnC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,qBAAqB,CAAC;YAC9B,MAAM,EAAE,yDAAyD;YACjE,QAAQ,EAAE,OAAO,CAAC,SAAS;YAC3B,MAAM,EAAE,UAAU,CAAC,SAAS;SAC7B,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}