@opendatalabs/personal-server-ts-core 1.6.0 → 1.7.0

package/dist/lineage/lineage.d.ts

@@ -0,0 +1,141 @@
+/**
+ * Derivative data: lineage on the write path.
+ *
+ * A derivative is an ordinary write whose body names the data points it was
+ * computed from. The caller's `lineage` field (top level of a JSON body, or
+ * inside the `X-Vana-Metadata` object of a binary write) is a list of data
+ * point ids, `keccak256(abi.encode(owner, scope))`. The Personal Server
+ * validates it against the owner's own data points and mirrors it into the
+ * envelope `data` under the reserved `$lineage` key, the same in-`data`
+ * marker idiom as `$writtenBy` and `$binary`, so lineage rides the unchanged
+ * encrypt / upload / register path and `metadataHash` commits to it.
+ *
+ * The caller's `lineage` field is left in the record untouched: for session
+ * writes it is inside the bytes the builder signed, so the lineage claim is
+ * builder-signed and `$lineage` is the server-validated mirror of it.
+ *
+ * See docs/derivative-data-api.md for the wire contract.
+ */
+import type { DataStoragePort } from "../ports/index.js";
+/** Reserved key inside the envelope `data` record for validated lineage. */
+export declare const LINEAGE_KEY: "$lineage";
+/** The caller-facing field name (JSON body top level / binary metadata). */
+export declare const LINEAGE_FIELD: "lineage";
+/** Upper bound on sources per record; keeps validation and hashing bounded. */
+export declare const MAX_LINEAGE_SOURCES = 256;
+/** Page size of the local index scan the source resolver runs. */
+export declare const LOCAL_SCOPE_SCAN_PAGE = 1000;
+export interface StoredLineage {
+    /** Validated, lowercased source data point ids in the order given. */
+    sources: `0x${string}`[];
+    /** ISO timestamp the Personal Server validated and stamped the lineage. */
+    writtenAt: string;
+}
+/** A source as the resolver saw it (local index or gateway). */
+export interface ResolvedLineageSource {
+    dataPointId: `0x${string}`;
+    scope: string;
+    /** Null while the source is only known locally (not registered yet). */
+    version: string | null;
+    deletedAt: string | null;
+}
+/** The subset of a gateway data-point record the resolver needs. */
+export interface LineageDataPointRecord {
+    dataPointId: string;
+    ownerAddress: string;
+    scope: string;
+    version: string;
+    deletedAt: string | null;
+}
+/**
+ * Gateway lookup for a source that is not in the local index. Must include
+ * deleted (tombstoned) data points: a deleted source is still a valid
+ * lineage target, it is only reported as deleted when the lineage is walked.
+ */
+export interface LineageSourceLookup {
+    getDataPoint(dataPointId: string): Promise<LineageDataPointRecord | null>;
+}
+export declare function hasReservedLineageKey(data: Record<string, unknown>): boolean;
+/** Stamp validated lineage into an envelope `data` record. */
+export declare function stampLineage(data: Record<string, unknown>, lineage: StoredLineage): Record<string, unknown>;
+/**
+ * The stored `$lineage` of a record, or null for a root record. Tolerates
+ * hand-crafted envelopes: anything that is not the exact stamped shape is
+ * treated as no lineage rather than thrown on.
+ */
+export declare class StoredLineageMalformedError extends Error {
+    constructor(detail: string);
+}
+/**
+ * Absent `$lineage` (or a data object that is not a record) is `null`: no
+ * statement. A PRESENT but malformed `$lineage` throws: a corrupted or
+ * hand-crafted derivative must fail closed, never fall through the root
+ * path and get registered as if it made no lineage statement.
+ */
+export declare function readStoredLineage(data: Record<string, unknown> | undefined): StoredLineage | null;
+/**
+ * The caller's `lineage` field from a JSON body or a binary write's parsed
+ * metadata. `undefined` when the container is not an object or carries no
+ * such field, so a bare-string metadata header or a lineage-less body is a
+ * root record.
+ */
+export declare function extractLineageField(container: unknown): unknown;
+/**
+ * Parse the caller's `lineage` value: an array of distinct 0x-prefixed
+ * 32-byte hex strings, at most MAX_LINEAGE_SOURCES long. Ids are lowercased
+ * so equal ids compare equal wherever they are stored. Throws
+ * LineageInvalidError (400).
+ */
+export declare function parseLineageSources(value: unknown): `0x${string}`[];
+/** First dot-segment of a scope (`chatgpt` for `chatgpt.conversations`). */
+export declare function scopeNamespace(scope: string): string;
+/**
+ * The naming rule. Grant patterns are exact, `prefix.*` or `*`; `prefix.*`
+ * covers every scope that starts with `prefix.`. A derived scope and a
+ * source scope are both covered by the same non-universal pattern exactly
+ * when they share their first segment, and that is the one way the current
+ * grammar can leak across a lineage edge (a grant on `chatgpt.*` would read
+ * both `chatgpt.conversations` and a derivative named `chatgpt.summary`).
+ * `*` reads everything by definition and is not a lineage leak.
+ */
+export declare function derivedScopeViolatesNaming(derivedScope: string, sourceScope: string): boolean;
+export declare function assertDerivedScopeNaming(derivedScope: string, sourceScopes: readonly string[]): void;
+export interface ResolveLineageSourcesInput {
+    /** The derived record's scope. */
+    scope: string;
+    sources: readonly `0x${string}`[];
+    serverOwner: `0x${string}`;
+    storage: Pick<DataStoragePort, "listScopes">;
+    /** Absent = sources must be in the local index. */
+    gateway?: LineageSourceLookup;
+}
+/**
+ * Resolve every source id to a data point of this owner. The local index is
+ * consulted first (`keccak256(owner, scope)` over the server's own scopes,
+ * so an unsynced local scope is a valid source), then the gateway with
+ * deleted points included. An id that resolves to nothing, or to another
+ * owner's data point, fails the whole write with 422
+ * LINEAGE_SOURCE_UNKNOWN listing every offending id; a gateway that cannot
+ * be reached fails with 502 so the builder retries instead of being told
+ * its source does not exist.
+ */
+export declare function resolveLineageSources(input: ResolveLineageSourcesInput): Promise<ResolvedLineageSource[]>;
+export interface PrepareLineageInput {
+    scope: string;
+    /** The raw caller value (`body.lineage` / `metadata.lineage`). */
+    field: unknown;
+    serverOwner: `0x${string}` | undefined;
+    storage: Pick<DataStoragePort, "listScopes">;
+    gateway?: LineageSourceLookup;
+    now: () => Date;
+}
+/**
+ * Validate a write's lineage end to end (shape, sources, naming rule) and
+ * produce the `$lineage` record to stamp. An empty list is an EXPLICIT root
+ * statement: it is stamped (`sources: []`) and registered as an attested
+ * root, distinct from an absent field, which makes no lineage statement.
+ * Throws ProtocolErrors; callers on the write path let them propagate
+ * before anything is stored.
+ */
+export declare function prepareLineage(input: PrepareLineageInput): Promise<StoredLineage>;
+//# sourceMappingURL=lineage.d.ts.map

package/dist/lineage/lineage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lineage.d.ts","sourceRoot":"","sources":["../../src/lineage/lineage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AASH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAGzD,4EAA4E;AAC5E,eAAO,MAAM,WAAW,EAAG,UAAmB,CAAC;AAE/C,4EAA4E;AAC5E,eAAO,MAAM,aAAa,EAAG,SAAkB,CAAC;AAEhD,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,MAAM,CAAC;AAEvC,kEAAkE;AAClE,eAAO,MAAM,qBAAqB,OAAO,CAAC;AAI1C,MAAM,WAAW,aAAa;IAC5B,sEAAsE;IACtE,OAAO,EAAE,KAAK,MAAM,EAAE,EAAE,CAAC;IACzB,2EAA2E;IAC3E,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,gEAAgE;AAChE,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,oEAAoE;AACpE,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;CAC3E;AAMD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAE5E;AAED,8DAA8D;AAC9D,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,EAAE,aAAa,GACrB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzB;AAED;;;;GAIG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;gBACxC,MAAM,EAAE,MAAM;CAI3B;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GACxC,aAAa,GAAG,IAAI,CAsBtB;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,CAG/D;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,MAAM,EAAE,EAAE,CAgCnE;AAED,4EAA4E;AAC5E,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGpD;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAClB,OAAO,CAET;AAED,wBAAgB,wBAAwB,CACtC,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,SAAS,MAAM,EAAE,GAC9B,IAAI,CASN;AAED,MAAM,WAAW,0BAA0B;IACzC,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,SAAS,KAAK,MAAM,EAAE,EAAE,CAAC;IAClC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;IAC3B,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;IAC7C,mDAAmD;IACnD,OAAO,CAAC,EAAE,mBAAmB,CAAC;CAC/B;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,qBAAqB,EAAE,CAAC,CA2DlC;AAkCD,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,KAAK,MAAM,EAAE,GAAG,SAAS,CAAC;IACvC,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;IAC7C,OAAO,CAAC,EAAE,mBAAmB,CAAC;IAC9B,GAAG,EAAE,MAAM,IAAI,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,aAAa,CAAC,CAmBxB"}

package/dist/lineage/lineage.js

@@ -0,0 +1,255 @@
+/**
+ * Derivative data: lineage on the write path.
+ *
+ * A derivative is an ordinary write whose body names the data points it was
+ * computed from. The caller's `lineage` field (top level of a JSON body, or
+ * inside the `X-Vana-Metadata` object of a binary write) is a list of data
+ * point ids, `keccak256(abi.encode(owner, scope))`. The Personal Server
+ * validates it against the owner's own data points and mirrors it into the
+ * envelope `data` under the reserved `$lineage` key, the same in-`data`
+ * marker idiom as `$writtenBy` and `$binary`, so lineage rides the unchanged
+ * encrypt / upload / register path and `metadataHash` commits to it.
+ *
+ * The caller's `lineage` field is left in the record untouched: for session
+ * writes it is inside the bytes the builder signed, so the lineage claim is
+ * builder-signed and `$lineage` is the server-validated mirror of it.
+ *
+ * See docs/derivative-data-api.md for the wire contract.
+ */
+import { LineageInvalidError, LineageScopeUnderSourcePrefixError, LineageSourceLookupFailedError, LineageSourceUnknownError, ServerNotConfiguredError, } from "../errors/catalog.js";
+import { computeDataPointId } from "../sync/data-point-id.js";
+/** Reserved key inside the envelope `data` record for validated lineage. */
+export const LINEAGE_KEY = "$lineage";
+/** The caller-facing field name (JSON body top level / binary metadata). */
+export const LINEAGE_FIELD = "lineage";
+/** Upper bound on sources per record; keeps validation and hashing bounded. */
+export const MAX_LINEAGE_SOURCES = 256;
+/** Page size of the local index scan the source resolver runs. */
+export const LOCAL_SCOPE_SCAN_PAGE = 1000;
+const BYTES32_HEX = /^0x[0-9a-fA-F]{64}$/;
+function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+export function hasReservedLineageKey(data) {
+    return Object.prototype.hasOwnProperty.call(data, LINEAGE_KEY);
+}
+/** Stamp validated lineage into an envelope `data` record. */
+export function stampLineage(data, lineage) {
+    return { ...data, [LINEAGE_KEY]: lineage };
+}
+/**
+ * The stored `$lineage` of a record, or null for a root record. Tolerates
+ * hand-crafted envelopes: anything that is not the exact stamped shape is
+ * treated as no lineage rather than thrown on.
+ */
+export class StoredLineageMalformedError extends Error {
+    constructor(detail) {
+        super(`Stored $lineage is malformed: ${detail}`);
+        this.name = "StoredLineageMalformedError";
+    }
+}
+/**
+ * Absent `$lineage` (or a data object that is not a record) is `null`: no
+ * statement. A PRESENT but malformed `$lineage` throws: a corrupted or
+ * hand-crafted derivative must fail closed, never fall through the root
+ * path and get registered as if it made no lineage statement.
+ */
+export function readStoredLineage(data) {
+    if (!isRecord(data) || !(LINEAGE_KEY in data))
+        return null;
+    const value = data[LINEAGE_KEY];
+    if (!isRecord(value)) {
+        throw new StoredLineageMalformedError("not an object");
+    }
+    const sources = value.sources;
+    if (!Array.isArray(sources) ||
+        !sources.every((id) => typeof id === "string" && BYTES32_HEX.test(id))) {
+        throw new StoredLineageMalformedError("sources is not a list of bytes32 ids");
+    }
+    if (typeof value.writtenAt !== "string") {
+        throw new StoredLineageMalformedError("writtenAt is not a string");
+    }
+    return {
+        sources: sources.map((id) => id.toLowerCase()),
+        writtenAt: value.writtenAt,
+    };
+}
+/**
+ * The caller's `lineage` field from a JSON body or a binary write's parsed
+ * metadata. `undefined` when the container is not an object or carries no
+ * such field, so a bare-string metadata header or a lineage-less body is a
+ * root record.
+ */
+export function extractLineageField(container) {
+    if (!isRecord(container))
+        return undefined;
+    return container[LINEAGE_FIELD];
+}
+/**
+ * Parse the caller's `lineage` value: an array of distinct 0x-prefixed
+ * 32-byte hex strings, at most MAX_LINEAGE_SOURCES long. Ids are lowercased
+ * so equal ids compare equal wherever they are stored. Throws
+ * LineageInvalidError (400).
+ */
+export function parseLineageSources(value) {
+    if (!Array.isArray(value)) {
+        throw new LineageInvalidError(`${LINEAGE_FIELD} must be an array of data point ids (0x-prefixed 32-byte hex)`);
+    }
+    if (value.length > MAX_LINEAGE_SOURCES) {
+        throw new LineageInvalidError(`${LINEAGE_FIELD} lists ${value.length} sources; the maximum is ${MAX_LINEAGE_SOURCES}`, { max: MAX_LINEAGE_SOURCES, count: value.length });
+    }
+    const seen = new Set();
+    const sources = [];
+    for (const entry of value) {
+        if (typeof entry !== "string" || !BYTES32_HEX.test(entry)) {
+            throw new LineageInvalidError(`${LINEAGE_FIELD} entries must be 0x-prefixed 32-byte hex data point ids`, { entry: typeof entry === "string" ? entry : typeof entry });
+        }
+        const id = entry.toLowerCase();
+        if (seen.has(id)) {
+            throw new LineageInvalidError(`${LINEAGE_FIELD} lists the same source twice`, { duplicate: id });
+        }
+        seen.add(id);
+        sources.push(id);
+    }
+    return sources;
+}
+/** First dot-segment of a scope (`chatgpt` for `chatgpt.conversations`). */
+export function scopeNamespace(scope) {
+    const dot = scope.indexOf(".");
+    return dot === -1 ? scope : scope.slice(0, dot);
+}
+/**
+ * The naming rule. Grant patterns are exact, `prefix.*` or `*`; `prefix.*`
+ * covers every scope that starts with `prefix.`. A derived scope and a
+ * source scope are both covered by the same non-universal pattern exactly
+ * when they share their first segment, and that is the one way the current
+ * grammar can leak across a lineage edge (a grant on `chatgpt.*` would read
+ * both `chatgpt.conversations` and a derivative named `chatgpt.summary`).
+ * `*` reads everything by definition and is not a lineage leak.
+ */
+export function derivedScopeViolatesNaming(derivedScope, sourceScope) {
+    return scopeNamespace(derivedScope) === scopeNamespace(sourceScope);
+}
+export function assertDerivedScopeNaming(derivedScope, sourceScopes) {
+    for (const sourceScope of sourceScopes) {
+        if (derivedScopeViolatesNaming(derivedScope, sourceScope)) {
+            throw new LineageScopeUnderSourcePrefixError({
+                scope: derivedScope,
+                sourceScope,
+            });
+        }
+    }
+}
+/**
+ * Resolve every source id to a data point of this owner. The local index is
+ * consulted first (`keccak256(owner, scope)` over the server's own scopes,
+ * so an unsynced local scope is a valid source), then the gateway with
+ * deleted points included. An id that resolves to nothing, or to another
+ * owner's data point, fails the whole write with 422
+ * LINEAGE_SOURCE_UNKNOWN listing every offending id; a gateway that cannot
+ * be reached fails with 502 so the builder retries instead of being told
+ * its source does not exist.
+ */
+export async function resolveLineageSources(input) {
+    const ownId = computeDataPointId(input.serverOwner, input.scope);
+    const self = input.sources.find((id) => id === ownId);
+    if (self) {
+        throw new LineageInvalidError("A record cannot list its own data point as a lineage source", { dataPointId: self });
+    }
+    const local = localScopesById(input.storage, input.serverOwner, new Set(input.sources));
+    const resolved = [];
+    const unknown = [];
+    for (const dataPointId of input.sources) {
+        const localScope = local.get(dataPointId);
+        if (localScope !== undefined) {
+            resolved.push({
+                dataPointId,
+                scope: localScope,
+                version: null,
+                deletedAt: null,
+            });
+            continue;
+        }
+        if (!input.gateway) {
+            unknown.push(dataPointId);
+            continue;
+        }
+        let record;
+        try {
+            record = await input.gateway.getDataPoint(dataPointId);
+        }
+        catch (err) {
+            throw new LineageSourceLookupFailedError({
+                dataPointId,
+                error: err instanceof Error ? err.message : String(err),
+            });
+        }
+        if (!record ||
+            record.ownerAddress.toLowerCase() !== input.serverOwner.toLowerCase()) {
+            unknown.push(dataPointId);
+            continue;
+        }
+        resolved.push({
+            dataPointId,
+            scope: record.scope,
+            version: record.version,
+            deletedAt: record.deletedAt,
+        });
+    }
+    if (unknown.length > 0) {
+        throw new LineageSourceUnknownError({ unknown });
+    }
+    return resolved;
+}
+/**
+ * `dataPointId -> scope` for the server's own scopes that appear in
+ * `wanted`. Pages through the whole local index (an unsynced scope is a
+ * valid source wherever it sorts), stopping early once every wanted id has
+ * been found.
+ */
+function localScopesById(storage, serverOwner, wanted) {
+    const byId = new Map();
+    for (let offset = 0;; offset += LOCAL_SCOPE_SCAN_PAGE) {
+        const { scopes, total } = storage.listScopes({
+            limit: LOCAL_SCOPE_SCAN_PAGE,
+            offset,
+        });
+        for (const summary of scopes) {
+            const id = computeDataPointId(serverOwner, summary.scope);
+            if (wanted.has(id))
+                byId.set(id, summary.scope);
+        }
+        if (byId.size === wanted.size ||
+            scopes.length === 0 ||
+            offset + scopes.length >= total) {
+            break;
+        }
+    }
+    return byId;
+}
+/**
+ * Validate a write's lineage end to end (shape, sources, naming rule) and
+ * produce the `$lineage` record to stamp. An empty list is an EXPLICIT root
+ * statement: it is stamped (`sources: []`) and registered as an attested
+ * root, distinct from an absent field, which makes no lineage statement.
+ * Throws ProtocolErrors; callers on the write path let them propagate
+ * before anything is stored.
+ */
+export async function prepareLineage(input) {
+    const sources = parseLineageSources(input.field);
+    if (!input.serverOwner) {
+        throw new ServerNotConfiguredError({
+            reason: "serverOwner is required to validate lineage sources",
+        });
+    }
+    const resolved = await resolveLineageSources({
+        scope: input.scope,
+        sources,
+        serverOwner: input.serverOwner,
+        storage: input.storage,
+        gateway: input.gateway,
+    });
+    assertDerivedScopeNaming(input.scope, resolved.map((source) => source.scope));
+    return { sources, writtenAt: input.now().toISOString() };
+}
+//# sourceMappingURL=lineage.js.map

package/dist/lineage/lineage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lineage.js","sourceRoot":"","sources":["../../src/lineage/lineage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EACL,mBAAmB,EACnB,kCAAkC,EAClC,8BAA8B,EAC9B,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,4EAA4E;AAC5E,MAAM,CAAC,MAAM,WAAW,GAAG,UAAmB,CAAC;AAE/C,4EAA4E;AAC5E,MAAM,CAAC,MAAM,aAAa,GAAG,SAAkB,CAAC;AAEhD,+EAA+E;AAC/E,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEvC,kEAAkE;AAClE,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAE1C,MAAM,WAAW,GAAG,qBAAqB,CAAC;AAoC1C,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAA6B;IACjE,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;AACjE,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,YAAY,CAC1B,IAA6B,EAC7B,OAAsB;IAEtB,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IACpD,YAAY,MAAc;QACxB,KAAK,CAAC,iCAAiC,MAAM,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAyC;IAEzC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;IAChC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,2BAA2B,CAAC,eAAe,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QACvB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EACtE,CAAC;QACD,MAAM,IAAI,2BAA2B,CACnC,sCAAsC,CACvC,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,2BAA2B,CAAC,2BAA2B,CAAC,CAAC;IACrE,CAAC;IACD,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EAAmB,CAAC;QAC/D,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAkB;IACpD,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,OAAO,SAAS,CAAC,aAAa,CAAC,CAAC;AAClC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,mBAAmB,CAC3B,GAAG,aAAa,+DAA+D,CAChF,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;QACvC,MAAM,IAAI,mBAAmB,CAC3B,GAAG,aAAa,UAAU,KAAK,CAAC,MAAM,4BAA4B,mBAAmB,EAAE,EACvF,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAClD,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,mBAAmB,CAC3B,GAAG,aAAa,yDAAyD,EACzE,EAAE,KAAK,EAAE,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE,CAC5D,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,GAAG,KAAK,CAAC,WAAW,EAAmB,CAAC;QAChD,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,mBAAmB,CAC3B,GAAG,aAAa,8BAA8B,EAC9C,EAAE,SAAS,EAAE,EAAE,EAAE,CAClB,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CACxC,YAAoB,EACpB,WAAmB;IAEnB,OAAO,cAAc,CAAC,YAAY,CAAC,KAAK,cAAc,CAAC,WAAW,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,YAAoB,EACpB,YAA+B;IAE/B,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,IAAI,0BAA0B,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,kCAAkC,CAAC;gBAC3C,KAAK,EAAE,YAAY;gBACnB,WAAW;aACZ,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAYD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAiC;IAEjC,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;IACtD,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,IAAI,mBAAmB,CAC3B,6DAA6D,EAC7D,EAAE,WAAW,EAAE,IAAI,EAAE,CACtB,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,eAAe,CAC3B,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,WAAW,EACjB,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CACvB,CAAC;IACF,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,WAAW,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACxC,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,QAAQ,CAAC,IAAI,CAAC;gBACZ,WAAW;gBACX,KAAK,EAAE,UAAU;gBACjB,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,IAAI,MAAqC,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,8BAA8B,CAAC;gBACvC,WAAW;gBACX,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;QACL,CAAC;QACD,IACE,CAAC,MAAM;YACP,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE,EACrE,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC;YACZ,WAAW;YACX,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,yBAAyB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CACtB,OAA4C,EAC5C,WAA0B,EAC1B,MAA2B;IAE3B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,IAAI,MAAM,GAAG,CAAC,GAAI,MAAM,IAAI,qBAAqB,EAAE,CAAC;QACvD,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC;YAC3C,KAAK,EAAE,qBAAqB;YAC5B,MAAM;SACP,CAAC,CAAC;QACH,KAAK,MAAM,OAAO,IAAI,MAAM,EAAE,CAAC;YAC7B,MAAM,EAAE,GAAG,kBAAkB,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YAC1D,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAClD,CAAC;QACD,IACE,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;YACzB,MAAM,CAAC,MAAM,KAAK,CAAC;YACnB,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,KAAK,EAC/B,CAAC;YACD,MAAM;QACR,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAYD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAA0B;IAE1B,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACvB,MAAM,IAAI,wBAAwB,CAAC;YACjC,MAAM,EAAE,qDAAqD;SAC9D,CAAC,CAAC;IACL,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC;QAC3C,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO;QACP,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IACH,wBAAwB,CACtB,KAAK,CAAC,KAAK,EACX,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CACvC,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;AAC3D,CAAC"}

package/dist/signing/request-signer.d.ts

@@ -8,6 +8,8 @@ export interface RequestSigner {
         method: string;
         uri: string;
         body?: Uint8Array;
+        /** Signed `grantId` claim (the grant view a lineage read asks for). */
+        grantId?: string;
     }): Promise<string>;
 }
 /**

package/dist/signing/request-signer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request-signer.d.ts","sourceRoot":"","sources":["../../src/signing/request-signer.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE/D,MAAM,WAAW,aAAa;IAC5B,WAAW,CAAC,MAAM,EAAE;QAClB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,CAAC,EAAE,UAAU,CAAC;KACnB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,aAAa,GAAG,aAAa,CAYzE"}
+{"version":3,"file":"request-signer.d.ts","sourceRoot":"","sources":["../../src/signing/request-signer.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE/D,MAAM,WAAW,aAAa;IAC5B,WAAW,CAAC,MAAM,EAAE;QAClB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,CAAC,EAAE,UAAU,CAAC;QAClB,uEAAuE;QACvE,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,aAAa,GAAG,aAAa,CAazE"}

package/dist/signing/request-signer.js

@@ -15,6 +15,7 @@ export function createRequestSigner(account) {
                 method: params.method,
                 uri: params.uri,
                 body: params.body,
+                grantId: params.grantId,
             });
         },
     };

package/dist/signing/request-signer.js.map

@@ -1 +1 @@
-{"version":3,"file":"request-signer.js","sourceRoot":"","sources":["../../src/signing/request-signer.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAYvE;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAsB;IACxD,OAAO;QACL,KAAK,CAAC,WAAW,CAAC,MAAM;YACtB,OAAO,qBAAqB,CAAC;gBAC3B,WAAW,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC;gBAC9D,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"request-signer.js","sourceRoot":"","sources":["../../src/signing/request-signer.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAcvE;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAsB;IACxD,OAAO;QACL,KAAK,CAAC,WAAW,CAAC,MAAM;YACtB,OAAO,qBAAqB,CAAC;gBAC3B,WAAW,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC;gBAC9D,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/signing/signer.d.ts

@@ -5,6 +5,7 @@
 import type { ServerAccount } from "../keys/server-account.js";
 import type { GatewayConfig } from "../schemas/server-config.js";
 import { type GrantRegistrationMessage, type GrantRevocationMessage, type AddDataMessage, type RecordDataAccessMessage } from "@opendatalabs/vana-sdk/browser";
+import { type LineageAttestationMessage } from "../lineage/attestation.js";
 export interface ServerSigner {
     /** Address that signs (the server account). */
     readonly address: `0x${string}`;
@@ -27,6 +28,13 @@ export interface ServerSigner {
      * recordId is a per-event bytes32 the contract pins to prevent replay.
      */
     signRecordDataAccess(msg: RecordDataAccessMessage): Promise<`0x${string}`>;
+    /**
+     * LineageAttestation (derivative data): binds a derivative's source list
+     * to the exact (owner, scope, version, dataHash) it is registered with,
+     * under the DataRegistry domain. The gateway requires it on POST /v1/data
+     * with `lineage`; see lineage/attestation.ts for why.
+     */
+    signLineageAttestation(msg: LineageAttestationMessage): Promise<`0x${string}`>;
 }
 export declare function createServerSigner(account: ServerAccount, gatewayConfig: GatewayConfig): ServerSigner;
 //# sourceMappingURL=signer.d.ts.map

package/dist/signing/signer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signer.d.ts","sourceRoot":"","sources":["../../src/signing/signer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAQL,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,cAAc,EACnB,KAAK,uBAAuB,EAC7B,MAAM,gCAAgC,CAAC;AAExC,MAAM,WAAW,YAAY;IAC3B,+CAA+C;IAC/C,QAAQ,CAAC,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;IAChC,qBAAqB,CAAC,GAAG,EAAE,wBAAwB,GAAG,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;IAC7E,mBAAmB,CAAC,GAAG,EAAE,sBAAsB,GAAG,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;IACzE;;;;;OAKG;IACH,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;IACzD;;;;;;;;OAQG;IACH,oBAAoB,CAAC,GAAG,EAAE,uBAAuB,GAAG,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;CAC5E;AAED,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,aAAa,EACtB,aAAa,EAAE,aAAa,GAC3B,YAAY,CAkDd"}
+{"version":3,"file":"signer.d.ts","sourceRoot":"","sources":["../../src/signing/signer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAQL,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,cAAc,EACnB,KAAK,uBAAuB,EAC7B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,2BAA2B,CAAC;AAEnC,MAAM,WAAW,YAAY;IAC3B,+CAA+C;IAC/C,QAAQ,CAAC,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;IAChC,qBAAqB,CAAC,GAAG,EAAE,wBAAwB,GAAG,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;IAC7E,mBAAmB,CAAC,GAAG,EAAE,sBAAsB,GAAG,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;IACzE;;;;;OAKG;IACH,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;IACzD;;;;;;;;OAQG;IACH,oBAAoB,CAAC,GAAG,EAAE,uBAAuB,GAAG,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;IAC3E;;;;;OAKG;IACH,sBAAsB,CACpB,GAAG,EAAE,yBAAyB,GAC7B,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;CAC3B;AAED,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,aAAa,EACtB,aAAa,EAAE,aAAa,GAC3B,YAAY,CA6Dd"}

package/dist/signing/signer.js

@@ -3,6 +3,7 @@
  * Uses the ServerAccount's derived key for all signatures.
  */
 import { grantRegistrationDomain, grantRevocationDomain, dataRegistryDomain, GRANT_REGISTRATION_TYPES, GRANT_REVOCATION_TYPES, ADD_DATA_TYPES, RECORD_DATA_ACCESS_TYPES, } from "@opendatalabs/vana-sdk/browser";
+import { LINEAGE_ATTESTATION_TYPES, } from "../lineage/attestation.js";
 export function createServerSigner(account, gatewayConfig) {
     return {
         address: account.address,
@@ -34,6 +35,14 @@ export function createServerSigner(account, gatewayConfig) {
                 message: msg,
             });
         },
+        async signLineageAttestation(msg) {
+            return account.signTypedData({
+                domain: dataRegistryDomain(gatewayConfig),
+                types: LINEAGE_ATTESTATION_TYPES,
+                primaryType: "LineageAttestation",
+                message: { ...msg, sources: [...msg.sources] },
+            });
+        },
         async signRecordDataAccess(msg) {
             return account.signTypedData({
                 domain: dataRegistryDomain(gatewayConfig),

package/dist/signing/signer.js.map

@@ -1 +1 @@
-{"version":3,"file":"signer.js","sourceRoot":"","sources":["../../src/signing/signer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,EACtB,cAAc,EACd,wBAAwB,GAKzB,MAAM,gCAAgC,CAAC;AA0BxC,MAAM,UAAU,kBAAkB,CAChC,OAAsB,EACtB,aAA4B;IAE5B,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO;QAExB,KAAK,CAAC,qBAAqB,CACzB,GAA6B;YAE7B,OAAO,OAAO,CAAC,aAAa,CAAC;gBAC3B,MAAM,EAAE,uBAAuB,CAAC,aAAa,CAAC;gBAC9C,KAAK,EAAE,wBAAwB;gBAC/B,WAAW,EAAE,mBAAmB;gBAChC,iDAAiD;gBACjD,iEAAiE;gBACjE,8DAA8D;gBAC9D,0DAA0D;gBAC1D,OAAO,EAAE,GAAyC;aACnD,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,mBAAmB,CACvB,GAA2B;YAE3B,OAAO,OAAO,CAAC,aAAa,CAAC;gBAC3B,MAAM,EAAE,qBAAqB,CAAC,aAAa,CAAC;gBAC5C,KAAK,EAAE,sBAAsB;gBAC7B,WAAW,EAAE,iBAAiB;gBAC9B,OAAO,EAAE,GAAyC;aACnD,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,GAAmB;YACnC,OAAO,OAAO,CAAC,aAAa,CAAC;gBAC3B,MAAM,EAAE,kBAAkB,CAAC,aAAa,CAAC;gBACzC,KAAK,EAAE,cAAc;gBACrB,WAAW,EAAE,SAAS;gBACtB,OAAO,EAAE,GAAyC;aACnD,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,oBAAoB,CACxB,GAA4B;YAE5B,OAAO,OAAO,CAAC,aAAa,CAAC;gBAC3B,MAAM,EAAE,kBAAkB,CAAC,aAAa,CAAC;gBACzC,KAAK,EAAE,wBAAwB;gBAC/B,WAAW,EAAE,kBAAkB;gBAC/B,OAAO,EAAE,GAAyC;aACnD,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"signer.js","sourceRoot":"","sources":["../../src/signing/signer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,EACtB,cAAc,EACd,wBAAwB,GAKzB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,yBAAyB,GAE1B,MAAM,2BAA2B,CAAC;AAmCnC,MAAM,UAAU,kBAAkB,CAChC,OAAsB,EACtB,aAA4B;IAE5B,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO;QAExB,KAAK,CAAC,qBAAqB,CACzB,GAA6B;YAE7B,OAAO,OAAO,CAAC,aAAa,CAAC;gBAC3B,MAAM,EAAE,uBAAuB,CAAC,aAAa,CAAC;gBAC9C,KAAK,EAAE,wBAAwB;gBAC/B,WAAW,EAAE,mBAAmB;gBAChC,iDAAiD;gBACjD,iEAAiE;gBACjE,8DAA8D;gBAC9D,0DAA0D;gBAC1D,OAAO,EAAE,GAAyC;aACnD,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,mBAAmB,CACvB,GAA2B;YAE3B,OAAO,OAAO,CAAC,aAAa,CAAC;gBAC3B,MAAM,EAAE,qBAAqB,CAAC,aAAa,CAAC;gBAC5C,KAAK,EAAE,sBAAsB;gBAC7B,WAAW,EAAE,iBAAiB;gBAC9B,OAAO,EAAE,GAAyC;aACnD,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,GAAmB;YACnC,OAAO,OAAO,CAAC,aAAa,CAAC;gBAC3B,MAAM,EAAE,kBAAkB,CAAC,aAAa,CAAC;gBACzC,KAAK,EAAE,cAAc;gBACrB,WAAW,EAAE,SAAS;gBACtB,OAAO,EAAE,GAAyC;aACnD,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,sBAAsB,CAC1B,GAA8B;YAE9B,OAAO,OAAO,CAAC,aAAa,CAAC;gBAC3B,MAAM,EAAE,kBAAkB,CAAC,aAAa,CAAC;gBACzC,KAAK,EAAE,yBAAyB;gBAChC,WAAW,EAAE,oBAAoB;gBACjC,OAAO,EAAE,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE;aAC/C,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,oBAAoB,CACxB,GAA4B;YAE5B,OAAO,OAAO,CAAC,aAAa,CAAC;gBAC3B,MAAM,EAAE,kBAAkB,CAAC,aAAa,CAAC;gBACzC,KAAK,EAAE,wBAAwB;gBAC/B,WAAW,EAAE,kBAAkB;gBAC/B,OAAO,EAAE,GAAyC;aACnD,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/sync/data-point-id.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Deterministic DPv2 data-point id: `keccak256(abi.encode(owner, scope))`,
+ * the same primary key DataRegistryV2 and the gateway use. Every version of
+ * a scope shares this id; the registry row carries the current version.
+ */
+export declare function computeDataPointId(ownerAddress: string, scope: string): `0x${string}`;
+//# sourceMappingURL=data-point-id.d.ts.map

package/dist/sync/data-point-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-point-id.d.ts","sourceRoot":"","sources":["../../src/sync/data-point-id.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,GACZ,KAAK,MAAM,EAAE,CAaf"}

package/dist/sync/data-point-id.js

@@ -0,0 +1,16 @@
+import { encodeAbiParameters, keccak256 } from "viem";
+/**
+ * Deterministic DPv2 data-point id: `keccak256(abi.encode(owner, scope))`,
+ * the same primary key DataRegistryV2 and the gateway use. Every version of
+ * a scope shares this id; the registry row carries the current version.
+ */
+export function computeDataPointId(ownerAddress, scope) {
+    // ABI-encoding an address is checksum-insensitive (same bytes either way),
+    // but viem rejects mixed-case strings that fail checksum validation;
+    // normalize so config-sourced owner strings can't trip it.
+    return keccak256(encodeAbiParameters([
+        { name: "ownerAddress", type: "address" },
+        { name: "scope", type: "string" },
+    ], [ownerAddress.toLowerCase(), scope]));
+}
+//# sourceMappingURL=data-point-id.js.map

package/dist/sync/data-point-id.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-point-id.js","sourceRoot":"","sources":["../../src/sync/data-point-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAEtD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,YAAoB,EACpB,KAAa;IAEb,2EAA2E;IAC3E,qEAAqE;IACrE,2DAA2D;IAC3D,OAAO,SAAS,CACd,mBAAmB,CACjB;QACE,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,EAAE;QACzC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE;KAClC,EACD,CAAC,YAAY,CAAC,WAAW,EAAmB,EAAE,KAAK,CAAC,CACrD,CACF,CAAC;AACJ,CAAC"}

package/dist/sync/workers/upload.d.ts

@@ -4,6 +4,8 @@ import type { ServerSigner } from "../../signing/signer.js";
 import type { Logger } from "../../logger/index.js";
 import type { IndexEntry } from "../../storage/index/types.js";
 import type { DataStoragePort } from "../../ports/index.js";
+import type { LineageGatewayPort } from "../../lineage/gateway.js";
+export { computeDataPointId } from "../data-point-id.js";
 export interface UploadWorkerDeps {
     storage: DataStoragePort;
     storageAdapter: StorageAdapter;
@@ -12,6 +14,14 @@ export interface UploadWorkerDeps {
     masterKey: Uint8Array;
     serverOwner: string;
     logger: Logger;
+    /**
+     * Registers derivative records (envelopes stamped with `$lineage`) with
+     * their lineage. The SDK client's registerDataPoint sends only the AddData
+     * fields, so a derivative needs this direct client; without it a derivative
+     * upload fails (and retries next cycle) rather than silently registering as
+     * a root record whose lineage exists only inside the ciphertext.
+     */
+    lineageGateway?: Pick<LineageGatewayPort, "registerDataPoint">;
 }
 export interface UploadResult {
     path: string;
@@ -55,10 +65,4 @@ export declare function uploadOne(deps: UploadWorkerDeps, entry: IndexEntry): Pr
  */
 export declare function uploadAll(deps: UploadWorkerDeps, options?: UploadAllOptions): Promise<UploadResult[]>;
 export declare function parseGatewayNextVersion(message: string): number | null;
-/**
- * Deterministic DPv2 data-point id — `keccak256(abi.encode(owner, scope))`,
- * the same primary key DataRegistryV2 and the gateway use. Lets the upload
- * worker look up the registry's live row for a scope without a list call.
- */
-export declare function computeDataPointId(ownerAddress: string, scope: string): `0x${string}`;
 //# sourceMappingURL=upload.d.ts.map

package/dist/sync/workers/upload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upload.d.ts","sourceRoot":"","sources":["../../../src/sync/workers/upload.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAE5D,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,eAAe,CAAC;IACzB,cAAc,EAAE,cAAc,CAAC;IAC/B,OAAO,EAAE,aAAa,CAAC;IACvB,MAAM,EAAE,YAAY,CAAC;IACrB,SAAS,EAAE,UAAU,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,qEAAqE;IACrE,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;CACrD;AAED;;;;;GAKG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,IAAI,EAAE,MAAM;CAIzB;AAcD;;;;;;;;;GASG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,gBAAgB,EACtB,KAAK,EAAE,UAAU,GAChB,OAAO,CAAC,YAAY,CAAC,CAuNvB;AAED;;;;GAIG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,gBAAgB,EACtB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,YAAY,EAAE,CAAC,CA2BzB;AAsBD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAUtE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,GACZ,KAAK,MAAM,EAAE,CAaf"}
+{"version":3,"file":"upload.d.ts","sourceRoot":"","sources":["../../../src/sync/workers/upload.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAG5D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,eAAe,CAAC;IACzB,cAAc,EAAE,cAAc,CAAC;IAC/B,OAAO,EAAE,aAAa,CAAC;IACvB,MAAM,EAAE,YAAY,CAAC;IACrB,SAAS,EAAE,UAAU,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,IAAI,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,CAAC;CAChE;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,qEAAqE;IACrE,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;CACrD;AAED;;;;;GAKG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,IAAI,EAAE,MAAM;CAIzB;AAcD;;;;;;;;;GASG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,gBAAgB,EACtB,KAAK,EAAE,UAAU,GAChB,OAAO,CAAC,YAAY,CAAC,CA2PvB;AAED;;;;GAIG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,gBAAgB,EACtB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,YAAY,EAAE,CAAC,CA2BzB;AAsBD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAUtE"}