@opendatalabs/personal-server-ts-core 1.5.0 → 1.7.0

package/dist/policy/data-write.js

@@ -0,0 +1,131 @@
+import { scopeMatchesPattern } from "@opendatalabs/vana-sdk/browser";
+import { GrantExpiredError, GrantOwnerMismatchError, GrantRequiredError, GrantRevokedError, InvalidSignatureError, PsUnavailableError, ScopeMismatchError, ServerNotConfiguredError, UnregisteredBuilderError, } from "../errors/catalog.js";
+import { parseGrantExpiresAtSeconds } from "./data-read.js";
+/**
+ * Write-grant encoding: a grant scope entry prefixed with `write:` authorizes
+ * the grantee to WRITE into the scope it names (e.g. `write:notes.entries`,
+ * `write:notes.*`). The suffix uses the same pattern grammar as read scopes
+ * (`*` / `{prefix}.*` / exact), evaluated with the SDK's scopeMatchesPattern.
+ *
+ * Why a scope-entry prefix and not a new grant field: the gateway's grant
+ * shape (GatewayGrantResponse) has no permission axis — `scopes` is its only
+ * capability carrier — and the gateway validates scope entries as opaque
+ * non-empty strings, so `write:`-prefixed entries flow through createGrant /
+ * getGrant / the EIP-712 GrantRegistration signature unchanged. The Personal
+ * Server is the sole interpreter.
+ *
+ * Separation of powers falls out of the encoding:
+ *   - read policy matches the REQUESTED scope against grant entries verbatim
+ *     (scopeCoveredByGrant), and a requested scope never carries the prefix,
+ *     so `write:x` entries can never satisfy a read;
+ *   - write policy (below) only honors `write:`-prefixed entries, so plain
+ *     read entries can never satisfy a write.
+ */
+export const WRITE_SCOPE_PREFIX = "write:";
+export function isWriteScopeEntry(entry) {
+    return entry.startsWith(WRITE_SCOPE_PREFIX);
+}
+/** The scope patterns a grant authorizes for writing (prefix stripped). */
+export function writeScopePatterns(grantScopes) {
+    return grantScopes
+        .filter(isWriteScopeEntry)
+        .map((entry) => entry.slice(WRITE_SCOPE_PREFIX.length))
+        .filter((pattern) => pattern.length > 0);
+}
+export function scopeCoveredByWriteGrant(requestedScope, grantScopes) {
+    return writeScopePatterns(grantScopes).some((pattern) => scopeMatchesPattern(requestedScope, pattern));
+}
+/**
+ * Authorize one builder write against a write-grant. Mirrors
+ * verifyDataReadPolicy invariant-for-invariant (builder registered, grant
+ * present / not revoked / not expired, scope coverage, grantee binding,
+ * owner binding) — but scope coverage only honors `write:`-prefixed grant
+ * entries, so a read-grant never confers write access.
+ */
+export async function verifyDataWritePolicy(input, ports) {
+    const available = await ports.runtimeAvailability?.isAvailable();
+    if (available === false) {
+        throw new PsUnavailableError();
+    }
+    const builder = await ports.authSessionVerifier.getBuilder(input.signer);
+    if (!builder) {
+        throw new UnregisteredBuilderError();
+    }
+    if (!input.grantId) {
+        throw new GrantRequiredError({
+            reason: "No grantId bound to the write session",
+        });
+    }
+    const grant = await ports.grantVerifier.getGrant(input.grantId);
+    if (!grant) {
+        throw new GrantRequiredError({
+            reason: "Grant not found",
+            grantId: input.grantId,
+        });
+    }
+    if (grant.revokedAt !== null) {
+        throw new GrantRevokedError({ grantId: grant.id });
+    }
+    if (!grant.scopes || writeScopePatterns(grant.scopes).length === 0) {
+        throw new ScopeMismatchError({
+            requestedScope: input.requestedScope,
+            reason: "Grant has no write scopes",
+        });
+    }
+    if (grant.expiresAt !== null && grant.expiresAt !== undefined) {
+        const expiresAtSec = parseGrantExpiresAtSeconds(grant.expiresAt);
+        if (expiresAtSec === null) {
+            throw new ScopeMismatchError({
+                requestedScope: input.requestedScope,
+                reason: "Grant expiry is invalid",
+            });
+        }
+        if (expiresAtSec > 0) {
+            const nowSec = Math.floor(Date.now() / 1000);
+            if (expiresAtSec < nowSec) {
+                throw new GrantExpiredError({
+                    expiresAt: expiresAtSec,
+                });
+            }
+        }
+    }
+    if (!scopeCoveredByWriteGrant(input.requestedScope, grant.scopes)) {
+        throw new ScopeMismatchError({
+            requestedScope: input.requestedScope,
+            grantedScopes: grant.scopes,
+            reason: "Grant does not authorize writing to this scope",
+        });
+    }
+    if (builder.id.toLowerCase() !== grant.granteeId.toLowerCase()) {
+        throw new InvalidSignatureError({
+            reason: "Write signer is not the grant builder",
+            expected: grant.granteeId,
+            actual: input.signer,
+        });
+    }
+    // Ownership binding — the grant MUST have been issued by THIS server's
+    // owner (same fail-closed rules as verifyDataReadPolicy: a missing
+    // serverOwner or a grantor-less gateway response rejects, never skips).
+    if (!input.serverOwner) {
+        throw new ServerNotConfiguredError({
+            reason: "serverOwner is required to verify grant ownership",
+        });
+    }
+    if (!grant.grantorAddress ||
+        grant.grantorAddress.toLowerCase() !== input.serverOwner.toLowerCase()) {
+        throw new GrantOwnerMismatchError({
+            grantId: grant.id,
+            expected: input.serverOwner,
+            actual: grant.grantorAddress ?? null,
+        });
+    }
+    // All authorization invariants passed — apply the fee seam last (default
+    // free; see WriteFeeVerifierPort).
+    await ports.writeFeeVerifier?.assertWriteAllowed({
+        builder: input.signer,
+        grant,
+        scope: input.requestedScope,
+    });
+    return grant;
+}
+//# sourceMappingURL=data-write.js.map

package/dist/policy/data-write.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-write.js","sourceRoot":"","sources":["../../src/policy/data-write.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,sBAAsB,CAAC;AAM9B,OAAO,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AAE5D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,QAAQ,CAAC;AAE3C,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,KAAK,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;AAC9C,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,kBAAkB,CAAC,WAA8B;IAC/D,OAAO,WAAW;SACf,MAAM,CAAC,iBAAiB,CAAC;SACzB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;SACtD,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,cAAsB,EACtB,WAA8B;IAE9B,OAAO,kBAAkB,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CACtD,mBAAmB,CAAC,cAAc,EAAE,OAAO,CAAC,CAC7C,CAAC;AACJ,CAAC;AAsCD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAA2B,EAC3B,KAA2B;IAE3B,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,mBAAmB,EAAE,WAAW,EAAE,CAAC;IACjE,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,kBAAkB,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACzE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,wBAAwB,EAAE,CAAC;IACvC,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,IAAI,kBAAkB,CAAC;YAC3B,MAAM,EAAE,uCAAuC;SAChD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,kBAAkB,CAAC;YAC3B,MAAM,EAAE,iBAAiB;YACzB,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,kBAAkB,CAAC;YAC3B,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,MAAM,EAAE,2BAA2B;SACpC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC9D,MAAM,YAAY,GAAG,0BAA0B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACjE,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,MAAM,EAAE,yBAAyB;aAClC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAC7C,IAAI,YAAY,GAAG,MAAM,EAAE,CAAC;gBAC1B,MAAM,IAAI,iBAAiB,CAAC;oBAC1B,SAAS,EAAE,YAAY;iBACxB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,kBAAkB,CAAC;YAC3B,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,aAAa,EAAE,KAAK,CAAC,MAAM;YAC3B,MAAM,EAAE,gDAAgD;SACzD,CAAC,CAAC;IACL,CAAC;IAED,IAAI,OAAO,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;QAC/D,MAAM,IAAI,qBAAqB,CAAC;YAC9B,MAAM,EAAE,uCAAuC;YAC/C,QAAQ,EAAE,KAAK,CAAC,SAAS;YACzB,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;IACL,CAAC;IAED,uEAAuE;IACvE,mEAAmE;IACnE,wEAAwE;IACxE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACvB,MAAM,IAAI,wBAAwB,CAAC;YACjC,MAAM,EAAE,mDAAmD;SAC5D,CAAC,CAAC;IACL,CAAC;IACD,IACE,CAAC,KAAK,CAAC,cAAc;QACrB,KAAK,CAAC,cAAc,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE,EACtE,CAAC;QACD,MAAM,IAAI,uBAAuB,CAAC;YAChC,OAAO,EAAE,KAAK,CAAC,EAAE;YACjB,QAAQ,EAAE,KAAK,CAAC,WAAW;YAC3B,MAAM,EAAE,KAAK,CAAC,cAAc,IAAI,IAAI;SACrC,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,mCAAmC;IACnC,MAAM,KAAK,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;QAC/C,OAAO,EAAE,KAAK,CAAC,MAAM;QACrB,KAAK;QACL,KAAK,EAAE,KAAK,CAAC,cAAc;KAC5B,CAAC,CAAC;IAEH,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/policy/index.d.ts

@@ -1,2 +1,3 @@
-export { verifyDataReadPolicy, type DataReadPolicyInput, type DataReadPolicyPorts, } from "./data-read.js";
+export { verifyDataReadPolicy, parseGrantExpiresAtSeconds, type DataReadPolicyInput, type DataReadPolicyPorts, } from "./data-read.js";
+export { WRITE_SCOPE_PREFIX, isWriteScopeEntry, writeScopePatterns, scopeCoveredByWriteGrant, verifyDataWritePolicy, type DataWritePolicyInput, type DataWritePolicyPorts, type WriteFeeVerifierPort, } from "./data-write.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/policy/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,GACzB,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,wBAAwB,EACxB,qBAAqB,EACrB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,GAC1B,MAAM,iBAAiB,CAAC"}

package/dist/policy/index.js

@@ -1,2 +1,3 @@
-export { verifyDataReadPolicy, } from "./data-read.js";
+export { verifyDataReadPolicy, parseGrantExpiresAtSeconds, } from "./data-read.js";
+export { WRITE_SCOPE_PREFIX, isWriteScopeEntry, writeScopePatterns, scopeCoveredByWriteGrant, verifyDataWritePolicy, } from "./data-write.js";
 //# sourceMappingURL=index.js.map

package/dist/policy/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,GAGrB,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,0BAA0B,GAG3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,wBAAwB,EACxB,qBAAqB,GAItB,MAAM,iBAAiB,CAAC"}

package/dist/signing/request-signer.d.ts

@@ -8,6 +8,8 @@ export interface RequestSigner {
         method: string;
         uri: string;
         body?: Uint8Array;
+        /** Signed `grantId` claim (the grant view a lineage read asks for). */
+        grantId?: string;
     }): Promise<string>;
 }
 /**

package/dist/signing/request-signer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request-signer.d.ts","sourceRoot":"","sources":["../../src/signing/request-signer.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE/D,MAAM,WAAW,aAAa;IAC5B,WAAW,CAAC,MAAM,EAAE;QAClB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,CAAC,EAAE,UAAU,CAAC;KACnB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,aAAa,GAAG,aAAa,CAYzE"}
+{"version":3,"file":"request-signer.d.ts","sourceRoot":"","sources":["../../src/signing/request-signer.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE/D,MAAM,WAAW,aAAa;IAC5B,WAAW,CAAC,MAAM,EAAE;QAClB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,CAAC,EAAE,UAAU,CAAC;QAClB,uEAAuE;QACvE,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,aAAa,GAAG,aAAa,CAazE"}

package/dist/signing/request-signer.js

@@ -15,6 +15,7 @@ export function createRequestSigner(account) {
                 method: params.method,
                 uri: params.uri,
                 body: params.body,
+                grantId: params.grantId,
             });
         },
     };

package/dist/signing/request-signer.js.map

@@ -1 +1 @@
-{"version":3,"file":"request-signer.js","sourceRoot":"","sources":["../../src/signing/request-signer.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAYvE;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAsB;IACxD,OAAO;QACL,KAAK,CAAC,WAAW,CAAC,MAAM;YACtB,OAAO,qBAAqB,CAAC;gBAC3B,WAAW,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC;gBAC9D,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"request-signer.js","sourceRoot":"","sources":["../../src/signing/request-signer.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAcvE;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAsB;IACxD,OAAO;QACL,KAAK,CAAC,WAAW,CAAC,MAAM;YACtB,OAAO,qBAAqB,CAAC;gBAC3B,WAAW,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC;gBAC9D,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/signing/signer.d.ts

@@ -5,6 +5,7 @@
 import type { ServerAccount } from "../keys/server-account.js";
 import type { GatewayConfig } from "../schemas/server-config.js";
 import { type GrantRegistrationMessage, type GrantRevocationMessage, type AddDataMessage, type RecordDataAccessMessage } from "@opendatalabs/vana-sdk/browser";
+import { type LineageAttestationMessage } from "../lineage/attestation.js";
 export interface ServerSigner {
     /** Address that signs (the server account). */
     readonly address: `0x${string}`;
@@ -27,6 +28,13 @@ export interface ServerSigner {
      * recordId is a per-event bytes32 the contract pins to prevent replay.
      */
     signRecordDataAccess(msg: RecordDataAccessMessage): Promise<`0x${string}`>;
+    /**
+     * LineageAttestation (derivative data): binds a derivative's source list
+     * to the exact (owner, scope, version, dataHash) it is registered with,
+     * under the DataRegistry domain. The gateway requires it on POST /v1/data
+     * with `lineage`; see lineage/attestation.ts for why.
+     */
+    signLineageAttestation(msg: LineageAttestationMessage): Promise<`0x${string}`>;
 }
 export declare function createServerSigner(account: ServerAccount, gatewayConfig: GatewayConfig): ServerSigner;
 //# sourceMappingURL=signer.d.ts.map

package/dist/signing/signer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signer.d.ts","sourceRoot":"","sources":["../../src/signing/signer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAQL,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,cAAc,EACnB,KAAK,uBAAuB,EAC7B,MAAM,gCAAgC,CAAC;AAExC,MAAM,WAAW,YAAY;IAC3B,+CAA+C;IAC/C,QAAQ,CAAC,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;IAChC,qBAAqB,CAAC,GAAG,EAAE,wBAAwB,GAAG,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;IAC7E,mBAAmB,CAAC,GAAG,EAAE,sBAAsB,GAAG,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;IACzE;;;;;OAKG;IACH,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;IACzD;;;;;;;;OAQG;IACH,oBAAoB,CAAC,GAAG,EAAE,uBAAuB,GAAG,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;CAC5E;AAED,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,aAAa,EACtB,aAAa,EAAE,aAAa,GAC3B,YAAY,CAkDd"}
+{"version":3,"file":"signer.d.ts","sourceRoot":"","sources":["../../src/signing/signer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAQL,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,cAAc,EACnB,KAAK,uBAAuB,EAC7B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,2BAA2B,CAAC;AAEnC,MAAM,WAAW,YAAY;IAC3B,+CAA+C;IAC/C,QAAQ,CAAC,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;IAChC,qBAAqB,CAAC,GAAG,EAAE,wBAAwB,GAAG,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;IAC7E,mBAAmB,CAAC,GAAG,EAAE,sBAAsB,GAAG,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;IACzE;;;;;OAKG;IACH,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;IACzD;;;;;;;;OAQG;IACH,oBAAoB,CAAC,GAAG,EAAE,uBAAuB,GAAG,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;IAC3E;;;;;OAKG;IACH,sBAAsB,CACpB,GAAG,EAAE,yBAAyB,GAC7B,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;CAC3B;AAED,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,aAAa,EACtB,aAAa,EAAE,aAAa,GAC3B,YAAY,CA6Dd"}

package/dist/signing/signer.js

@@ -3,6 +3,7 @@
  * Uses the ServerAccount's derived key for all signatures.
  */
 import { grantRegistrationDomain, grantRevocationDomain, dataRegistryDomain, GRANT_REGISTRATION_TYPES, GRANT_REVOCATION_TYPES, ADD_DATA_TYPES, RECORD_DATA_ACCESS_TYPES, } from "@opendatalabs/vana-sdk/browser";
+import { LINEAGE_ATTESTATION_TYPES, } from "../lineage/attestation.js";
 export function createServerSigner(account, gatewayConfig) {
     return {
         address: account.address,
@@ -34,6 +35,14 @@ export function createServerSigner(account, gatewayConfig) {
                 message: msg,
             });
         },
+        async signLineageAttestation(msg) {
+            return account.signTypedData({
+                domain: dataRegistryDomain(gatewayConfig),
+                types: LINEAGE_ATTESTATION_TYPES,
+                primaryType: "LineageAttestation",
+                message: { ...msg, sources: [...msg.sources] },
+            });
+        },
         async signRecordDataAccess(msg) {
             return account.signTypedData({
                 domain: dataRegistryDomain(gatewayConfig),

package/dist/signing/signer.js.map

@@ -1 +1 @@
-{"version":3,"file":"signer.js","sourceRoot":"","sources":["../../src/signing/signer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,EACtB,cAAc,EACd,wBAAwB,GAKzB,MAAM,gCAAgC,CAAC;AA0BxC,MAAM,UAAU,kBAAkB,CAChC,OAAsB,EACtB,aAA4B;IAE5B,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO;QAExB,KAAK,CAAC,qBAAqB,CACzB,GAA6B;YAE7B,OAAO,OAAO,CAAC,aAAa,CAAC;gBAC3B,MAAM,EAAE,uBAAuB,CAAC,aAAa,CAAC;gBAC9C,KAAK,EAAE,wBAAwB;gBAC/B,WAAW,EAAE,mBAAmB;gBAChC,iDAAiD;gBACjD,iEAAiE;gBACjE,8DAA8D;gBAC9D,0DAA0D;gBAC1D,OAAO,EAAE,GAAyC;aACnD,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,mBAAmB,CACvB,GAA2B;YAE3B,OAAO,OAAO,CAAC,aAAa,CAAC;gBAC3B,MAAM,EAAE,qBAAqB,CAAC,aAAa,CAAC;gBAC5C,KAAK,EAAE,sBAAsB;gBAC7B,WAAW,EAAE,iBAAiB;gBAC9B,OAAO,EAAE,GAAyC;aACnD,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,GAAmB;YACnC,OAAO,OAAO,CAAC,aAAa,CAAC;gBAC3B,MAAM,EAAE,kBAAkB,CAAC,aAAa,CAAC;gBACzC,KAAK,EAAE,cAAc;gBACrB,WAAW,EAAE,SAAS;gBACtB,OAAO,EAAE,GAAyC;aACnD,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,oBAAoB,CACxB,GAA4B;YAE5B,OAAO,OAAO,CAAC,aAAa,CAAC;gBAC3B,MAAM,EAAE,kBAAkB,CAAC,aAAa,CAAC;gBACzC,KAAK,EAAE,wBAAwB;gBAC/B,WAAW,EAAE,kBAAkB;gBAC/B,OAAO,EAAE,GAAyC;aACnD,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"signer.js","sourceRoot":"","sources":["../../src/signing/signer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,EACtB,cAAc,EACd,wBAAwB,GAKzB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,yBAAyB,GAE1B,MAAM,2BAA2B,CAAC;AAmCnC,MAAM,UAAU,kBAAkB,CAChC,OAAsB,EACtB,aAA4B;IAE5B,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO;QAExB,KAAK,CAAC,qBAAqB,CACzB,GAA6B;YAE7B,OAAO,OAAO,CAAC,aAAa,CAAC;gBAC3B,MAAM,EAAE,uBAAuB,CAAC,aAAa,CAAC;gBAC9C,KAAK,EAAE,wBAAwB;gBAC/B,WAAW,EAAE,mBAAmB;gBAChC,iDAAiD;gBACjD,iEAAiE;gBACjE,8DAA8D;gBAC9D,0DAA0D;gBAC1D,OAAO,EAAE,GAAyC;aACnD,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,mBAAmB,CACvB,GAA2B;YAE3B,OAAO,OAAO,CAAC,aAAa,CAAC;gBAC3B,MAAM,EAAE,qBAAqB,CAAC,aAAa,CAAC;gBAC5C,KAAK,EAAE,sBAAsB;gBAC7B,WAAW,EAAE,iBAAiB;gBAC9B,OAAO,EAAE,GAAyC;aACnD,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,GAAmB;YACnC,OAAO,OAAO,CAAC,aAAa,CAAC;gBAC3B,MAAM,EAAE,kBAAkB,CAAC,aAAa,CAAC;gBACzC,KAAK,EAAE,cAAc;gBACrB,WAAW,EAAE,SAAS;gBACtB,OAAO,EAAE,GAAyC;aACnD,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,sBAAsB,CAC1B,GAA8B;YAE9B,OAAO,OAAO,CAAC,aAAa,CAAC;gBAC3B,MAAM,EAAE,kBAAkB,CAAC,aAAa,CAAC;gBACzC,KAAK,EAAE,yBAAyB;gBAChC,WAAW,EAAE,oBAAoB;gBACjC,OAAO,EAAE,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE;aAC/C,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,oBAAoB,CACxB,GAA4B;YAE5B,OAAO,OAAO,CAAC,aAAa,CAAC;gBAC3B,MAAM,EAAE,kBAAkB,CAAC,aAAa,CAAC;gBACzC,KAAK,EAAE,wBAAwB;gBAC/B,WAAW,EAAE,kBAAkB;gBAC/B,OAAO,EAAE,GAAyC;aACnD,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/sync/data-point-id.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Deterministic DPv2 data-point id: `keccak256(abi.encode(owner, scope))`,
+ * the same primary key DataRegistryV2 and the gateway use. Every version of
+ * a scope shares this id; the registry row carries the current version.
+ */
+export declare function computeDataPointId(ownerAddress: string, scope: string): `0x${string}`;
+//# sourceMappingURL=data-point-id.d.ts.map

package/dist/sync/data-point-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-point-id.d.ts","sourceRoot":"","sources":["../../src/sync/data-point-id.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,GACZ,KAAK,MAAM,EAAE,CAaf"}

package/dist/sync/data-point-id.js

@@ -0,0 +1,16 @@
+import { encodeAbiParameters, keccak256 } from "viem";
+/**
+ * Deterministic DPv2 data-point id: `keccak256(abi.encode(owner, scope))`,
+ * the same primary key DataRegistryV2 and the gateway use. Every version of
+ * a scope shares this id; the registry row carries the current version.
+ */
+export function computeDataPointId(ownerAddress, scope) {
+    // ABI-encoding an address is checksum-insensitive (same bytes either way),
+    // but viem rejects mixed-case strings that fail checksum validation;
+    // normalize so config-sourced owner strings can't trip it.
+    return keccak256(encodeAbiParameters([
+        { name: "ownerAddress", type: "address" },
+        { name: "scope", type: "string" },
+    ], [ownerAddress.toLowerCase(), scope]));
+}
+//# sourceMappingURL=data-point-id.js.map

package/dist/sync/data-point-id.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-point-id.js","sourceRoot":"","sources":["../../src/sync/data-point-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAEtD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,YAAoB,EACpB,KAAa;IAEb,2EAA2E;IAC3E,qEAAqE;IACrE,2DAA2D;IAC3D,OAAO,SAAS,CACd,mBAAmB,CACjB;QACE,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,EAAE;QACzC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE;KAClC,EACD,CAAC,YAAY,CAAC,WAAW,EAAmB,EAAE,KAAK,CAAC,CACrD,CACF,CAAC;AACJ,CAAC"}

package/dist/sync/workers/upload.d.ts

@@ -4,6 +4,8 @@ import type { ServerSigner } from "../../signing/signer.js";
 import type { Logger } from "../../logger/index.js";
 import type { IndexEntry } from "../../storage/index/types.js";
 import type { DataStoragePort } from "../../ports/index.js";
+import type { LineageGatewayPort } from "../../lineage/gateway.js";
+export { computeDataPointId } from "../data-point-id.js";
 export interface UploadWorkerDeps {
     storage: DataStoragePort;
     storageAdapter: StorageAdapter;
@@ -12,6 +14,14 @@ export interface UploadWorkerDeps {
     masterKey: Uint8Array;
     serverOwner: string;
     logger: Logger;
+    /**
+     * Registers derivative records (envelopes stamped with `$lineage`) with
+     * their lineage. The SDK client's registerDataPoint sends only the AddData
+     * fields, so a derivative needs this direct client; without it a derivative
+     * upload fails (and retries next cycle) rather than silently registering as
+     * a root record whose lineage exists only inside the ciphertext.
+     */
+    lineageGateway?: Pick<LineageGatewayPort, "registerDataPoint">;
 }
 export interface UploadResult {
     path: string;
@@ -55,10 +65,4 @@ export declare function uploadOne(deps: UploadWorkerDeps, entry: IndexEntry): Pr
  */
 export declare function uploadAll(deps: UploadWorkerDeps, options?: UploadAllOptions): Promise<UploadResult[]>;
 export declare function parseGatewayNextVersion(message: string): number | null;
-/**
- * Deterministic DPv2 data-point id — `keccak256(abi.encode(owner, scope))`,
- * the same primary key DataRegistryV2 and the gateway use. Lets the upload
- * worker look up the registry's live row for a scope without a list call.
- */
-export declare function computeDataPointId(ownerAddress: string, scope: string): `0x${string}`;
 //# sourceMappingURL=upload.d.ts.map

package/dist/sync/workers/upload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upload.d.ts","sourceRoot":"","sources":["../../../src/sync/workers/upload.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAE5D,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,eAAe,CAAC;IACzB,cAAc,EAAE,cAAc,CAAC;IAC/B,OAAO,EAAE,aAAa,CAAC;IACvB,MAAM,EAAE,YAAY,CAAC;IACrB,SAAS,EAAE,UAAU,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,qEAAqE;IACrE,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;CACrD;AAED;;;;;GAKG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,IAAI,EAAE,MAAM;CAIzB;AAcD;;;;;;;;;GASG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,gBAAgB,EACtB,KAAK,EAAE,UAAU,GAChB,OAAO,CAAC,YAAY,CAAC,CAuNvB;AAED;;;;GAIG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,gBAAgB,EACtB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,YAAY,EAAE,CAAC,CA2BzB;AAsBD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAUtE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,GACZ,KAAK,MAAM,EAAE,CAaf"}
+{"version":3,"file":"upload.d.ts","sourceRoot":"","sources":["../../../src/sync/workers/upload.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAG5D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,eAAe,CAAC;IACzB,cAAc,EAAE,cAAc,CAAC;IAC/B,OAAO,EAAE,aAAa,CAAC;IACvB,MAAM,EAAE,YAAY,CAAC;IACrB,SAAS,EAAE,UAAU,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,IAAI,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,CAAC;CAChE;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,qEAAqE;IACrE,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;CACrD;AAED;;;;;GAKG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,IAAI,EAAE,MAAM;CAIzB;AAcD;;;;;;;;;GASG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,gBAAgB,EACtB,KAAK,EAAE,UAAU,GAChB,OAAO,CAAC,YAAY,CAAC,CA2PvB;AAED;;;;GAIG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,gBAAgB,EACtB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,YAAY,EAAE,CAAC,CA2BzB;AAsBD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAUtE"}

package/dist/sync/workers/upload.js

@@ -1,5 +1,8 @@
-import { encodeAbiParameters, keccak256, stringToHex } from "viem";
+import { keccak256, stringToHex } from "viem";
 import { deriveScopeKey, encryptWithPassword, } from "@opendatalabs/vana-sdk/browser";
+import { computeDataPointId } from "../data-point-id.js";
+import { readStoredLineage } from "../../lineage/lineage.js";
+export { computeDataPointId } from "../data-point-id.js";
 /**
  * Thrown when an unsynced entry's local payload file is gone, so the entry was
  * dropped from the index rather than uploaded. `uploadAll` treats it as a
@@ -104,14 +107,47 @@ export async function uploadOne(deps, entry) {
                 metadataHash,
                 expectedVersion: version,
             });
-            const dataPointResult = await gateway.registerDataPoint({
+            const registration = {
                 ownerAddress: serverOwner,
                 scope: entry.scope,
                 dataHash,
                 metadataHash,
                 expectedVersion: String(version),
                 signature: addDataSignature,
-            });
+            };
+            // A derivative carries its validated `$lineage` inside the envelope;
+            // the gateway stores the same sources next to this (dataPointId,
+            // version) so lineage can be walked without the plaintext. The
+            // AddData signature is unchanged (dataHash already commits to the
+            // plaintext, `$lineage` included); the plaintext list the gateway
+            // keeps is covered by a separate LineageAttestation signature bound
+            // to this version and dataHash, so a replayed registration cannot
+            // swap it (see lineage/attestation.ts).
+            const lineage = readStoredLineage(envelope.data);
+            // An empty `$lineage` is an explicit root statement and is registered
+            // as such (attested empty list); only an ABSENT `$lineage` makes no
+            // statement and goes through the plain client.
+            let dataPointResult;
+            if (lineage) {
+                if (!deps.lineageGateway) {
+                    throw new Error(`Cannot register derivative ${entry.path} (scope=${entry.scope}): lineage registration needs a gateway URL (lineageGateway is not configured)`);
+                }
+                const lineageSignature = await signer.signLineageAttestation({
+                    ownerAddress: serverOwner,
+                    scope: entry.scope,
+                    expectedVersion: version,
+                    dataHash,
+                    sources: lineage.sources,
+                });
+                dataPointResult = await deps.lineageGateway.registerDataPoint({
+                    ...registration,
+                    lineage: lineage.sources,
+                    lineageSignature,
+                });
+            }
+            else {
+                dataPointResult = await gateway.registerDataPoint(registration);
+            }
             const id = dataPointResult.dataPointId ?? null;
             if (!id) {
                 throw new Error(`Gateway registerDataPoint did not return a dataPointId for ${entry.path} (scope=${entry.scope}, version=${version})`);
@@ -269,18 +305,4 @@ export function parseGatewayNextVersion(message) {
         return Number(storedValue[1]) + 1;
     return null;
 }
-/**
- * Deterministic DPv2 data-point id — `keccak256(abi.encode(owner, scope))`,
- * the same primary key DataRegistryV2 and the gateway use. Lets the upload
- * worker look up the registry's live row for a scope without a list call.
- */
-export function computeDataPointId(ownerAddress, scope) {
-    // ABI-encoding an address is checksum-insensitive (same bytes either way),
-    // but viem rejects mixed-case strings that fail checksum validation —
-    // normalize so config-sourced owner strings can't trip it.
-    return keccak256(encodeAbiParameters([
-        { name: "ownerAddress", type: "address" },
-        { name: "scope", type: "string" },
-    ], [ownerAddress.toLowerCase(), scope]));
-}
 //# sourceMappingURL=upload.js.map

package/dist/sync/workers/upload.js.map

@@ -1 +1 @@
-{"version":3,"file":"upload.js","sourceRoot":"","sources":["../../../src/sync/workers/upload.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,MAAM,CAAC;AAEnE,OAAO,EACL,cAAc,EACd,mBAAmB,GAEpB,MAAM,gCAAgC,CAAC;AAiCxC;;;;;GAKG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,IAAY;QACtB,KAAK,CAAC,mDAAmD,IAAI,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED;;;;;;;GAOG;AACH,SAAS,qBAAqB,CAAC,GAAY;IACzC,OAAO,GAAG,YAAY,KAAK,IAAK,GAA0B,CAAC,IAAI,KAAK,QAAQ,CAAC;AAC/E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAsB,EACtB,KAAiB;IAEjB,MAAM,EACJ,OAAO,EACP,cAAc,EACd,OAAO,EACP,MAAM,EACN,SAAS,EACT,WAAW,EACX,MAAM,GACP,GAAG,IAAI,CAAC;IAET,0BAA0B;IAC1B,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uEAAuE;QACvE,sEAAsE;QACtE,sEAAsE;QACtE,oEAAoE;QACpE,yEAAyE;QACzE,0DAA0D;QAC1D,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;YAC5D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5D,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,CAAC,IAAI,CACT,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,EACxC,6DAA6D,CAC9D,CAAC;gBACF,MAAM,IAAI,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,uDAAuD;IACvD,MAAM,QAAQ,GAAG,cAAc,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACxD,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAEzC,oDAAoD;IACpD,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAEpE,uCAAuC;IACvC,4EAA4E;IAC5E,mEAAmE;IACnE,oEAAoE;IACpE,4EAA4E;IAC5E,uEAAuE;IACvE,0EAA0E;IAC1E,oEAAoE;IACpE,uEAAuE;IACvE,4EAA4E;IAC5E,2EAA2E;IAC3E,6EAA6E;IAC7E,2CAA2C;IAC3C,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,YAAY,GAAG,SAAS,CAC5B,WAAW,CACT,IAAI,CAAC,SAAS,CAAC;QACb,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS,EAAE,SAAS,CAAC,UAAU;KAChC,CAAC,CACH,CACF,CAAC;IAEF,sEAAsE;IACtE,mEAAmE;IACnE,sEAAsE;IACtE,uEAAuE;IACvE,qDAAqD;IACrD,MAAM,UAAU,GAAG,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;IACrD,IAAI,GAAG,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAE7D,yEAAyE;IACzE,2EAA2E;IAC3E,0EAA0E;IAC1E,IAAI,WAAmB,CAAC;IACxB,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IAClC,CAAC;SAAM,CAAC;QACN,MAAM,UAAU,GAAG,KAAK,EAAE,OAAe,EAAmB,EAAE;YAC5D,MAAM,gBAAgB,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC;gBAChD,YAAY,EAAE,WAA4B;gBAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,QAAQ;gBACR,YAAY;gBACZ,eAAe,EAAE,OAAO;aACzB,CAAC,CAAC;YAEH,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC;gBACtD,YAAY,EAAE,WAAW;gBACzB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,QAAQ;gBACR,YAAY;gBACZ,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC;gBAChC,SAAS,EAAE,gBAAgB;aAC5B,CAAC,CAAC;YAEH,MAAM,EAAE,GAAG,eAAe,CAAC,WAAW,IAAI,IAAI,CAAC;YAC/C,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,MAAM,IAAI,KAAK,CACb,8DAA8D,KAAK,CAAC,IAAI,WAAW,KAAK,CAAC,KAAK,aAAa,OAAO,GAAG,CACtH,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QAEF,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;YAC5C,uEAAuE;YACvE,wEAAwE;YACxE,oEAAoE;YACpE,oEAAoE;YACpE,kEAAkE;YAClE,8BAA8B;YAC9B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CACvC,kBAAkB,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,CAC7C,CAAC;YAEF,IAAI,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;gBACvE,sEAAsE;gBACtE,sEAAsE;gBACtE,iCAAiC;gBACjC,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC;gBACxB,qEAAqE;gBACrE,sEAAsE;gBACtE,oEAAoE;gBACpE,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;gBACtD,IAAI,cAAc,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;oBACrC,iEAAiE;oBACjE,mEAAmE;oBACnE,8DAA8D;oBAC9D,2DAA2D;oBAC3D,kEAAkE;oBAClE,6DAA6D;oBAC7D,iEAAiE;oBACjE,uBAAuB;oBACvB,MAAM,UAAU,GAAG,GAAG,KAAK,CAAC,KAAK,IAAI,cAAc,EAAE,CAAC;oBACtD,MAAM,iBAAiB,GAAG,MAAM,cAAc,CAAC,MAAM,CACnD,cAAc,CAAC,SAAS,CAAC,UAAU,CAAC,CACrC,CAAC;oBACF,IAAI,CAAC,iBAAiB,EAAE,CAAC;wBACvB,MAAM,CAAC,IAAI,CACT,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,EAC5D,kFAAkF,CACnF,CAAC;wBACF,GAAG,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;oBAC3D,CAAC;oBACD,MAAM,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;gBAC/D,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,qEAAqE;gBACrE,4BAA4B;gBAC5B,qEAAqE;gBACrE,6CAA6C;gBAC7C,+DAA+D;gBAC/D,qEAAqE;gBACrE,sEAAsE;gBACtE,4DAA4D;gBAC5D,wCAAwC;gBACxC,kEAAkE;gBAClE,kEAAkE;gBAClE,0CAA0C;gBAC1C,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACnE,MAAM,SAAS,GAAG,uBAAuB,CAAE,GAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACvE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;gBAC/C,IAAI,MAAM,IAAI,CAAC;oBAAE,MAAM,GAAG,CAAC;gBAC3B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC/B,oEAAoE;gBACpE,mEAAmE;gBACnE,sEAAsE;gBACtE,oEAAoE;gBACpE,sEAAsE;gBACtE,qEAAqE;gBACrE,uEAAuE;gBACvE,oEAAoE;gBACpE,mEAAmE;gBACnE,kEAAkE;gBAClE,wEAAwE;gBACxE,sEAAsE;gBACtE,uEAAuE;gBACvE,+DAA+D;gBAC/D,aAAa;gBACb,GAAG,GAAG,MAAM,cAAc,CAAC,MAAM,CAC/B,GAAG,KAAK,CAAC,KAAK,IAAI,OAAO,EAAE,EAC3B,SAAS,CACV,CAAC;gBACF,qEAAqE;gBACrE,oEAAoE;gBACpE,mCAAmC;gBACnC,WAAW,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;gBACxC,MAAM,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,MAAM,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,CAAC,IAAI,CACT;QACE,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG;QACH,WAAW;KACZ,EACD,yCAAyC,CAC1C,CAAC;IAEF,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAsB,EACtB,OAA0B;IAE1B,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAChE,MAAM,OAAO,GAAmB,EAAE,CAAC;IAEnC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC5C,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qEAAqE;YACrE,mEAAmE;YACnE,qEAAqE;YACrE,sEAAsE;YACtE,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;gBACtC,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,GAAY,CAAC;YAC3B,OAAO,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,EAC9D,wBAAwB,CACzB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,KAAiB;IACnC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CACzE,EAAE,CACH,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,0EAA0E;AAC1E,0EAA0E;AAC1E,SAAS,sBAAsB,CAAC,GAAY;IAC1C,OAAO,GAAG,YAAY,KAAK,IAAI,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAC1E,CAAC;AAED,8EAA8E;AAC9E,8EAA8E;AAC9E,yEAAyE;AACzE,0EAA0E;AAC1E,yEAAyE;AACzE,2EAA2E;AAC3E,8CAA8C;AAC9C,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAChE,IAAI,SAAS;QAAE,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC7D,IAAI,YAAY;QAAE,OAAO,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACrD,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAC/B,+CAA+C,CAChD,CAAC;IACF,IAAI,WAAW;QAAE,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,YAAoB,EACpB,KAAa;IAEb,2EAA2E;IAC3E,sEAAsE;IACtE,2DAA2D;IAC3D,OAAO,SAAS,CACd,mBAAmB,CACjB;QACE,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,EAAE;QACzC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE;KAClC,EACD,CAAC,YAAY,CAAC,WAAW,EAAmB,EAAE,KAAK,CAAC,CACrD,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"upload.js","sourceRoot":"","sources":["../../../src/sync/workers/upload.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,MAAM,CAAC;AAE9C,OAAO,EACL,cAAc,EACd,mBAAmB,GAEpB,MAAM,gCAAgC,CAAC;AAKxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAG7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAqCzD;;;;;GAKG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,IAAY;QACtB,KAAK,CAAC,mDAAmD,IAAI,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED;;;;;;;GAOG;AACH,SAAS,qBAAqB,CAAC,GAAY;IACzC,OAAO,GAAG,YAAY,KAAK,IAAK,GAA0B,CAAC,IAAI,KAAK,QAAQ,CAAC;AAC/E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAsB,EACtB,KAAiB;IAEjB,MAAM,EACJ,OAAO,EACP,cAAc,EACd,OAAO,EACP,MAAM,EACN,SAAS,EACT,WAAW,EACX,MAAM,GACP,GAAG,IAAI,CAAC;IAET,0BAA0B;IAC1B,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uEAAuE;QACvE,sEAAsE;QACtE,sEAAsE;QACtE,oEAAoE;QACpE,yEAAyE;QACzE,0DAA0D;QAC1D,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;YAC5D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5D,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,CAAC,IAAI,CACT,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,EACxC,6DAA6D,CAC9D,CAAC;gBACF,MAAM,IAAI,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,uDAAuD;IACvD,MAAM,QAAQ,GAAG,cAAc,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACxD,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAEzC,oDAAoD;IACpD,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAEpE,uCAAuC;IACvC,4EAA4E;IAC5E,mEAAmE;IACnE,oEAAoE;IACpE,4EAA4E;IAC5E,uEAAuE;IACvE,0EAA0E;IAC1E,oEAAoE;IACpE,uEAAuE;IACvE,4EAA4E;IAC5E,2EAA2E;IAC3E,6EAA6E;IAC7E,2CAA2C;IAC3C,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,YAAY,GAAG,SAAS,CAC5B,WAAW,CACT,IAAI,CAAC,SAAS,CAAC;QACb,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS,EAAE,SAAS,CAAC,UAAU;KAChC,CAAC,CACH,CACF,CAAC;IAEF,sEAAsE;IACtE,mEAAmE;IACnE,sEAAsE;IACtE,uEAAuE;IACvE,qDAAqD;IACrD,MAAM,UAAU,GAAG,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;IACrD,IAAI,GAAG,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAE7D,yEAAyE;IACzE,2EAA2E;IAC3E,0EAA0E;IAC1E,IAAI,WAAmB,CAAC;IACxB,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IAClC,CAAC;SAAM,CAAC;QACN,MAAM,UAAU,GAAG,KAAK,EAAE,OAAe,EAAmB,EAAE;YAC5D,MAAM,gBAAgB,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC;gBAChD,YAAY,EAAE,WAA4B;gBAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,QAAQ;gBACR,YAAY;gBACZ,eAAe,EAAE,OAAO;aACzB,CAAC,CAAC;YAEH,MAAM,YAAY,GAAG;gBACnB,YAAY,EAAE,WAAW;gBACzB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,QAAQ;gBACR,YAAY;gBACZ,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC;gBAChC,SAAS,EAAE,gBAAgB;aAC5B,CAAC;YACF,qEAAqE;YACrE,iEAAiE;YACjE,+DAA+D;YAC/D,kEAAkE;YAClE,kEAAkE;YAClE,oEAAoE;YACpE,kEAAkE;YAClE,wCAAwC;YACxC,MAAM,OAAO,GAAG,iBAAiB,CAC/B,QAAQ,CAAC,IAA2C,CACrD,CAAC;YACF,sEAAsE;YACtE,oEAAoE;YACpE,+CAA+C;YAC/C,IAAI,eAAe,CAAC;YACpB,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;oBACzB,MAAM,IAAI,KAAK,CACb,8BAA8B,KAAK,CAAC,IAAI,WAAW,KAAK,CAAC,KAAK,gFAAgF,CAC/I,CAAC;gBACJ,CAAC;gBACD,MAAM,gBAAgB,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC;oBAC3D,YAAY,EAAE,WAA4B;oBAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,eAAe,EAAE,OAAO;oBACxB,QAAQ;oBACR,OAAO,EAAE,OAAO,CAAC,OAAO;iBACzB,CAAC,CAAC;gBACH,eAAe,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC;oBAC5D,GAAG,YAAY;oBACf,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,gBAAgB;iBACjB,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,eAAe,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,EAAE,GAAG,eAAe,CAAC,WAAW,IAAI,IAAI,CAAC;YAC/C,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,MAAM,IAAI,KAAK,CACb,8DAA8D,KAAK,CAAC,IAAI,WAAW,KAAK,CAAC,KAAK,aAAa,OAAO,GAAG,CACtH,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QAEF,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;YAC5C,uEAAuE;YACvE,wEAAwE;YACxE,oEAAoE;YACpE,oEAAoE;YACpE,kEAAkE;YAClE,8BAA8B;YAC9B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CACvC,kBAAkB,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,CAC7C,CAAC;YAEF,IAAI,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;gBACvE,sEAAsE;gBACtE,sEAAsE;gBACtE,iCAAiC;gBACjC,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC;gBACxB,qEAAqE;gBACrE,sEAAsE;gBACtE,oEAAoE;gBACpE,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;gBACtD,IAAI,cAAc,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;oBACrC,iEAAiE;oBACjE,mEAAmE;oBACnE,8DAA8D;oBAC9D,2DAA2D;oBAC3D,kEAAkE;oBAClE,6DAA6D;oBAC7D,iEAAiE;oBACjE,uBAAuB;oBACvB,MAAM,UAAU,GAAG,GAAG,KAAK,CAAC,KAAK,IAAI,cAAc,EAAE,CAAC;oBACtD,MAAM,iBAAiB,GAAG,MAAM,cAAc,CAAC,MAAM,CACnD,cAAc,CAAC,SAAS,CAAC,UAAU,CAAC,CACrC,CAAC;oBACF,IAAI,CAAC,iBAAiB,EAAE,CAAC;wBACvB,MAAM,CAAC,IAAI,CACT,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,EAC5D,kFAAkF,CACnF,CAAC;wBACF,GAAG,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;oBAC3D,CAAC;oBACD,MAAM,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;gBAC/D,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,qEAAqE;gBACrE,4BAA4B;gBAC5B,qEAAqE;gBACrE,6CAA6C;gBAC7C,+DAA+D;gBAC/D,qEAAqE;gBACrE,sEAAsE;gBACtE,4DAA4D;gBAC5D,wCAAwC;gBACxC,kEAAkE;gBAClE,kEAAkE;gBAClE,0CAA0C;gBAC1C,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACnE,MAAM,SAAS,GAAG,uBAAuB,CAAE,GAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACvE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;gBAC/C,IAAI,MAAM,IAAI,CAAC;oBAAE,MAAM,GAAG,CAAC;gBAC3B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC/B,oEAAoE;gBACpE,mEAAmE;gBACnE,sEAAsE;gBACtE,oEAAoE;gBACpE,sEAAsE;gBACtE,qEAAqE;gBACrE,uEAAuE;gBACvE,oEAAoE;gBACpE,mEAAmE;gBACnE,kEAAkE;gBAClE,wEAAwE;gBACxE,sEAAsE;gBACtE,uEAAuE;gBACvE,+DAA+D;gBAC/D,aAAa;gBACb,GAAG,GAAG,MAAM,cAAc,CAAC,MAAM,CAC/B,GAAG,KAAK,CAAC,KAAK,IAAI,OAAO,EAAE,EAC3B,SAAS,CACV,CAAC;gBACF,qEAAqE;gBACrE,oEAAoE;gBACpE,mCAAmC;gBACnC,WAAW,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;gBACxC,MAAM,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,MAAM,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,CAAC,IAAI,CACT;QACE,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG;QACH,WAAW;KACZ,EACD,yCAAyC,CAC1C,CAAC;IAEF,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAsB,EACtB,OAA0B;IAE1B,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAChE,MAAM,OAAO,GAAmB,EAAE,CAAC;IAEnC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC5C,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qEAAqE;YACrE,mEAAmE;YACnE,qEAAqE;YACrE,sEAAsE;YACtE,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;gBACtC,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,GAAY,CAAC;YAC3B,OAAO,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,EAC9D,wBAAwB,CACzB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,KAAiB;IACnC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CACzE,EAAE,CACH,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,0EAA0E;AAC1E,0EAA0E;AAC1E,SAAS,sBAAsB,CAAC,GAAY;IAC1C,OAAO,GAAG,YAAY,KAAK,IAAI,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAC1E,CAAC;AAED,8EAA8E;AAC9E,8EAA8E;AAC9E,yEAAyE;AACzE,0EAA0E;AAC1E,yEAAyE;AACzE,2EAA2E;AAC3E,8CAA8C;AAC9C,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAChE,IAAI,SAAS;QAAE,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC7D,IAAI,YAAY;QAAE,OAAO,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACrD,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAC/B,+CAA+C,CAChD,CAAC;IACF,IAAI,WAAW;QAAE,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/write/attribution.d.ts

@@ -0,0 +1,167 @@
+/**
+ * Builder attribution for delegated writes.
+ *
+ * The write-session token authorizes a write; it does not PROVE who authored
+ * the payload (a bearer token is not a signature). For cryptographic
+ * attribution the builder also signs the payload: a Web3Signed proof over the
+ * exact write request (aud / method / uri / bodyHash / iat / exp), carried in
+ * the `X-Vana-Write-Signature` header and signed by the builder key proven at
+ * handshake. The PS verifies the proof recovers to the session's builder and
+ * that its bodyHash commits to the received bytes, then stores the proof and
+ * the builder identity WITH the record — inside the envelope's `data` under
+ * the reserved `$writtenBy` key (same in-`data` marker idiom as `$binary`),
+ * so attribution travels through the unchanged encrypt / upload / register
+ * path and back out on read. The on-chain shape is untouched.
+ *
+ * The proof binds the write to its context, not just its bytes: the signed
+ * claims carry the request path (whose last segment is the scope), the
+ * method, the audience (this server's origin) and the session's grantId,
+ * which the PS requires to match the session at ingest. A stored `$writtenBy`
+ * therefore cannot be lifted onto another scope's record or relabelled with a
+ * different grant and still verify.
+ *
+ * What the builder signs is the STORED representation, not the wire body:
+ * the compact JSON of the envelope `data` record the PS will write (minus
+ * `$writtenBy`). A third party holding the envelope can therefore verify
+ * authorship from the envelope ALONE (verifyStoredWriterAttribution): recover
+ * the signer over the stored proof's base64url payload (EIP-191), check the
+ * signed claims against the envelope's scope and stored grantId, and hash
+ * JSON.stringify(data minus the server-stamped keys `$writtenBy` and
+ * `$lineage`) against the signed bodyHash.
+ *   - JSON writes: the body IS the stored record, so the builder signs the
+ *     body bytes, which must be compact JSON (what JSON.stringify emits: no
+ *     insignificant whitespace, keys in the order given). JSON.parse /
+ *     JSON.stringify round-trips that byte-for-byte; a body that does not
+ *     round-trip is rejected at write time (WRITE_BODY_NOT_CANONICAL) instead
+ *     of being stored with an attribution nobody can check.
+ *   - Binary writes: the stored record is the `$binary` envelope data (media
+ *     type, filename, caller metadata, size, content hash, base64 content),
+ *     so the builder signs its compact JSON (binaryWriteSignedBytes). That
+ *     binds the caller-controlled representation headers (Content-Type,
+ *     X-Filename / Content-Disposition, X-Vana-Metadata) to the signature and
+ *     makes a JSON-vs-binary switch of the same bytes fail verification.
+ */
+import { type Web3SignedPayload } from "@opendatalabs/vana-sdk/browser";
+import type { WriteProofReplayStore } from "./session.js";
+/** Header carrying the builder's signed-payload proof on a session write. */
+export declare const WRITE_SIGNATURE_HEADER = "x-vana-write-signature";
+/**
+ * Reserved key inside the envelope's `data` record for builder attribution.
+ * Mirrors the `$binary` marker convention (contracts/binary.ts).
+ */
+export declare const WRITER_ATTRIBUTION_KEY: "$writtenBy";
+export interface WriterAttribution {
+    /** The builder address the proof recovered to. */
+    builder: `0x${string}`;
+    /** The write-grant the record was written under. */
+    grantId: string;
+    /**
+     * The builder's compact Web3Signed proof (`{base64url(payload)}.{sig}`,
+     * scheme prefix stripped). Verifiable offline: recover the EIP-191 signer
+     * over the base64url payload string; the decoded payload's `bodyHash`
+     * commits to the written bytes.
+     */
+    signature: string;
+    /** `bodyHash` claim from the proof (sha-256 of the request body bytes). */
+    bodyHash: string;
+    /** ISO timestamp the PS accepted the write. */
+    writtenAt: string;
+}
+export interface VerifyWriterAttributionInput {
+    request: Request;
+    /** The builder address bound to the write session at handshake. */
+    builderAddress: `0x${string}`;
+    /** The grant the session (and therefore this write) is bound to. */
+    grantId: string;
+    serverOrigin: string | (() => string);
+    now?: () => Date;
+    /**
+     * Replay guard for the per-write proof. When supplied, a proof is consumed
+     * on successful verification (keyed by a digest of the exact header,
+     * remembered until the proof's own expiry) and a second write carrying the
+     * same proof is rejected: holding the session bearer plus one captured
+     * signed request must not allow re-storing it until the proof expires.
+     */
+    replayStore?: WriteProofReplayStore;
+}
+/** verifyWriterAttribution's result: the record to store plus a rollback. */
+export interface VerifiedWriterAttribution extends WriterAttribution {
+    /**
+     * Present when a replay store consumed the proof. Callers whose write then
+     * FAILS before the record is committed should call it so the builder can
+     * retry with the same still-valid proof (a retry after success is a replay).
+     */
+    releaseProof?: () => Promise<void>;
+}
+export interface BinaryWriteSignedBytesInput {
+    /** The raw body bytes the write will send. */
+    bytes: Uint8Array;
+    /** The Content-Type header the write will send (parameters are ignored). */
+    contentType: string;
+    /** The X-Filename header value the write will send, if any. */
+    filename?: string;
+    /** The exact X-Vana-Metadata header value the write will send, if any. */
+    metadataHeader?: string;
+}
+/**
+ * The bytes a builder signs (as the Web3Signed body) for a BINARY session
+ * write: the compact JSON of the `$binary` record the PS stores for these
+ * headers and bytes. Mirrors ingest exactly (same media-type normalization,
+ * metadata parsing and envelope builder), so the signature covers the stored
+ * representation and verifyStoredWriterAttribution can re-derive it.
+ */
+export declare function binaryWriteSignedBytes(input: BinaryWriteSignedBytesInput): Promise<Uint8Array>;
+/**
+ * Verify the `X-Vana-Write-Signature` proof on a session write and produce
+ * the attribution record to store with the data. Throws ProtocolError(401)
+ * when the proof is missing, malformed, expired, fails EIP-191 recovery /
+ * bodyHash binding (the hash covers the stored representation, see
+ * signedBytesFor), recovers to a different key than the session builder, or
+ * does not carry the session's grantId as a signed claim.
+ */
+export declare function verifyWriterAttribution(input: VerifyWriterAttributionInput): Promise<VerifiedWriterAttribution>;
+/**
+ * Stamp attribution into an envelope `data` record. The reserved key must not
+ * appear in the caller's payload — a builder must not be able to forge (or
+ * shadow) its own attribution.
+ */
+export declare function stampWriterAttribution(data: Record<string, unknown>, attribution: WriterAttribution): Record<string, unknown>;
+export declare function hasReservedWriterKey(data: Record<string, unknown>): boolean;
+export declare class WriterAttributionVerificationError extends Error {
+    readonly reason: "ATTRIBUTION_MISSING" | "BODY_HASH_MISMATCH" | "PROOF_INVALID" | "SIGNER_MISMATCH" | "SCOPE_MISMATCH" | "GRANT_MISMATCH" | "AUDIENCE_MISMATCH" | "LINEAGE_MISMATCH";
+    constructor(reason: "ATTRIBUTION_MISSING" | "BODY_HASH_MISMATCH" | "PROOF_INVALID" | "SIGNER_MISMATCH" | "SCOPE_MISMATCH" | "GRANT_MISMATCH" | "AUDIENCE_MISMATCH" | "LINEAGE_MISMATCH", message: string);
+}
+export interface StoredWriterAttributionVerification {
+    /** Signer recovered from the stored proof (equals the stored builder). */
+    builder: `0x${string}`;
+    grantId: string;
+    /** Hash re-derived from the stored data; equals the proof's bodyHash. */
+    bodyHash: string;
+    /** The signed claims (aud / method / uri / bodyHash / iat / exp). */
+    payload: Web3SignedPayload;
+}
+export interface VerifyStoredWriterAttributionOptions {
+    /**
+     * When known, the origin of the Personal Server the record was written to;
+     * the proof's signed audience must match it. Omit for records whose server
+     * is not known to the verifier.
+     */
+    expectedOrigin?: string;
+}
+/**
+ * Verify builder attribution from a stored envelope alone (no request, no
+ * server state, no expiry check: the proof is evidence of who wrote the
+ * record at the time, not a live credential). Checks, in order: the envelope
+ * carries an attribution; the stored representation (compact JSON of the
+ * data minus the server-stamped `$writtenBy` and `$lineage` keys, for JSON
+ * and `$binary` records alike) re-hashes
+ * to the signed bodyHash; the proof parses and recovers to the attributed
+ * builder; and the signed claims bind the proof to THIS record: a POST whose
+ * path names the envelope's scope, the stored grantId, and (when given) the
+ * server origin. Throws WriterAttributionVerificationError with the reason.
+ */
+export declare function verifyStoredWriterAttribution(envelope: {
+    scope: string;
+    data: Record<string, unknown>;
+}, options?: VerifyStoredWriterAttributionOptions): Promise<StoredWriterAttributionVerification>;
+//# sourceMappingURL=attribution.d.ts.map

package/dist/write/attribution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attribution.d.ts","sourceRoot":"","sources":["../../src/write/attribution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,gCAAgC,CAAC;AAIxC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAkB1D,6EAA6E;AAC7E,eAAO,MAAM,sBAAsB,2BAA2B,CAAC;AAE/D;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAG,YAAqB,CAAC;AAE5D,MAAM,WAAW,iBAAiB;IAChC,kDAAkD;IAClD,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;IACvB,oDAAoD;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,OAAO,CAAC;IACjB,mEAAmE;IACnE,cAAc,EAAE,KAAK,MAAM,EAAE,CAAC;IAC9B,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,qBAAqB,CAAC;CACrC;AAED,6EAA6E;AAC7E,MAAM,WAAW,yBAA0B,SAAQ,iBAAiB;IAClE;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAMD,MAAM,WAAW,2BAA2B;IAC1C,8CAA8C;IAC9C,KAAK,EAAE,UAAU,CAAC;IAClB,4EAA4E;IAC5E,WAAW,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,UAAU,CAAC,CASrB;AAmBD;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,yBAAyB,CAAC,CAsFpC;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,WAAW,EAAE,iBAAiB,GAC7B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzB;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAE3E;AA4BD,qBAAa,kCAAmC,SAAQ,KAAK;aAEzC,MAAM,EAClB,qBAAqB,GACrB,oBAAoB,GACpB,eAAe,GACf,iBAAiB,GACjB,gBAAgB,GAChB,gBAAgB,GAChB,mBAAmB,GACnB,kBAAkB;gBARN,MAAM,EAClB,qBAAqB,GACrB,oBAAoB,GACpB,eAAe,GACf,iBAAiB,GACjB,gBAAgB,GAChB,gBAAgB,GAChB,mBAAmB,GACnB,kBAAkB,EACtB,OAAO,EAAE,MAAM;CAKlB;AAED,MAAM,WAAW,mCAAmC;IAClD,0EAA0E;IAC1E,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,OAAO,EAAE,iBAAiB,CAAC;CAC5B;AAeD,MAAM,WAAW,oCAAoC;IACnD;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAcD;;;;;;;;;;;GAWG;AACH,wBAAsB,6BAA6B,CACjD,QAAQ,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,EAC1D,OAAO,GAAE,oCAAyC,GACjD,OAAO,CAAC,mCAAmC,CAAC,CAyI9C"}