@opendatalabs/personal-server-ts-server 1.33.7 → 1.34.0

package/dist/enclave-main.js

@@ -1,5 +1,8 @@
+import { createHash } from "node:crypto";
+import { recoverServerOwner, createGatewayClient, } from "@opendatalabs/vana-sdk/node";
+import { createVanaSyncStorageAdapter } from "@opendatalabs/personal-server-ts-core/storage/adapters";
 import { createPublicOnlyAccount } from "@opendatalabs/personal-server-ts-core/keys";
-import { isAddress, isHex } from "viem";
+import { isAddress, isHex, keccak256, stringToHex, } from "viem";
 import { createServer } from "./bootstrap.js";
 import { createAccessReporter } from "./jobs/access-reporter.js";
 import { loadConfig } from "./config/index.js";
@@ -116,6 +119,7 @@ export async function runEnclaveMain() {
         rootPath,
         hydrateScopes: readHydrateScopes(process.env.PS_HYDRATE_SCOPES),
         ownerSignature: enclaveEnv.ownerSignature,
+        ...(await createEnclaveAdditionsPorts(config, enclaveEnv)),
         serverAccount,
         profile: "enclave",
         readFulfillmentReporter: accessReporter,
@@ -185,4 +189,151 @@ function installGatewayBypass(gatewayUrl, secret) {
         return requestFetch(input, { ...init, headers });
     };
 }
+/** Sandbox adapter: all signing stays behind the node's closed additions RPC. */
+export async function createEnclaveAdditionsPorts(config, env) {
+    const ownerAddress = await recoverServerOwner(env.ownerSignature);
+    const sources = new Map();
+    const sourceFor = (scope) => scope.startsWith("vana.system.additions.")
+        ? scope.slice("vana.system.additions.".length)
+        : sources.get(scope);
+    async function rpc(body) {
+        const response = await fetch(`${env.agentUrl.replace(/\/+$/, "")}/agent/v1/additions/sign`, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${env.accessToken}`,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({
+                ...body,
+                owner: ownerAddress,
+                chainId: config.gateway.chainId,
+            }),
+            redirect: "error",
+            signal: AbortSignal.timeout(15_000),
+        });
+        if (!response.ok) {
+            await response.body?.cancel();
+            throw new Error(`Additions signing refused (${response.status})`);
+        }
+        const result = await response.json();
+        if (typeof result !== "object" || result === null)
+            throw new Error("Invalid additions signing result");
+        return result;
+    }
+    const additionsInventorySigner = {
+        async signRequest(params) {
+            if (params.aud !== new URL(config.gateway.url).origin ||
+                params.method !== "GET" ||
+                params.body ||
+                params.grantId !== undefined)
+                throw new Error("Only inventory signing is supported");
+            const uri = new URL(params.uri, params.aud);
+            if (uri.origin !== params.aud ||
+                !/^\/v1\/data\/0x[0-9a-f]{64}\/versions$/.test(uri.pathname) ||
+                uri.hash ||
+                uri.searchParams.get("user") !== ownerAddress.toLowerCase() ||
+                [...uri.searchParams.keys()].join(",") !== "user,scope,after,limit")
+                throw new Error("Only canonical inventory signing is supported");
+            const source = uri.searchParams.get("scope");
+            if (source && !source.startsWith("vana.system."))
+                sources.set(`vana.system.additions-hash.${keccak256(stringToHex(source)).slice(2)}`, source);
+            const result = await rpc({
+                kind: "inventory",
+                scope: uri.searchParams.get("scope"),
+                after: uri.searchParams.get("after"),
+                limit: uri.searchParams.get("limit"),
+            });
+            if (!("authorization" in result) ||
+                typeof result.authorization !== "string")
+                throw new Error("Invalid inventory authorization");
+            return result.authorization;
+        },
+    };
+    // This account only resolves public storage URLs. Its signing functions stay
+    // unavailable; upload authorization uses the dedicated RPC below.
+    const publicStorage = createVanaSyncStorageAdapter({
+        config,
+        serverOwner: ownerAddress,
+        serverAccount: createPublicOnlyAccount({
+            address: env.serverAddress,
+            publicKey: env.serverPublicKey,
+        }),
+        reads: "public",
+    });
+    const storageEndpoint = (config.storage.config.vana?.apiUrl ?? "https://storage.vana.org").replace(/\/+$/, "");
+    const keyUrl = (address, key) => `${storageEndpoint}/v1/chains/${config.gateway.chainId}/blobs/${address.toLowerCase()}/${key.split("/").map(encodeURIComponent).join("/")}`;
+    const storageAdapter = {
+        urlForKey(key) {
+            return keyUrl(ownerAddress, key);
+        },
+        async upload(key, data) {
+            const parts = key.split("/");
+            if (parts.length !== 2)
+                throw new Error("Invalid checkpoint key");
+            const result = await rpc({
+                kind: "upload",
+                sourceScope: sourceFor(parts[0] ?? ""),
+                scope: parts[0],
+                version: parts[1],
+                bodyHash: `sha256:${createHash("sha256").update(data).digest("hex")}`,
+            });
+            if (!("authorization" in result) ||
+                typeof result.authorization !== "string")
+                throw new Error("Invalid upload authorization");
+            const url = keyUrl(ownerAddress, key);
+            const response = await fetch(url, {
+                method: "PUT",
+                headers: {
+                    Authorization: result.authorization,
+                    "Content-Type": "application/octet-stream",
+                },
+                body: new Uint8Array(data),
+                redirect: "error",
+                signal: AbortSignal.timeout(15_000),
+            });
+            await response.body?.cancel();
+            if (!response.ok)
+                throw new Error(`Checkpoint upload failed (${response.status})`);
+            return url;
+        },
+        async download(url) {
+            return publicStorage.download(url);
+        },
+        async downloadBounded(url, budget) {
+            if (!publicStorage.downloadBounded)
+                throw new Error("Bounded download unavailable");
+            return publicStorage.downloadBounded(url, budget);
+        },
+        async exists(url) {
+            return publicStorage.exists(url);
+        },
+        async delete() {
+            throw new Error("Checkpoint deletion is not authorized");
+        },
+    };
+    return {
+        additionsInventorySigner,
+        additionsWriter: {
+            storageAdapter,
+            gateway: createGatewayClient(config.gateway.url),
+            signer: {
+                async signAddData(message) {
+                    if (message.ownerAddress.toLowerCase() !== ownerAddress.toLowerCase())
+                        throw new Error("Checkpoint owner mismatch");
+                    const result = await rpc({
+                        kind: "register",
+                        sourceScope: sourceFor(message.scope),
+                        scope: message.scope,
+                        version: String(message.expectedVersion),
+                        dataHash: message.dataHash,
+                        metadataHash: message.metadataHash,
+                    });
+                    if (!("signature" in result) || !isHex(result.signature))
+                        throw new Error("Invalid checkpoint signature");
+                    return result.signature;
+                },
+            },
+        },
+    };
+}
 //# sourceMappingURL=enclave-main.js.map

package/dist/enclave-main.js.map

@@ -1 +1 @@
-{"version":3,"file":"enclave-main.js","sourceRoot":"","sources":["../src/enclave-main.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAAE,SAAS,EAAE,KAAK,EAA0B,MAAM,MAAM,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,MAAM,YAAY,GAAG;IACnB,2BAA2B;IAC3B,iBAAiB;IACjB,mBAAmB;IACnB,sBAAsB;IACtB,mBAAmB;CACX,CAAC;AACX,MAAM,aAAa,GAAG,OAAO,CAAC;AAC9B,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,wBAAwB,GAAG;IAC/B,CAAC,gBAAgB,CAAC,EAAE,0BAA0B;IAC9C,CAAC,eAAe,CAAC,EAAE,8BAA8B;CACzC,CAAC;AACX,MAAM,YAAY,GAAG;IACnB,sBAAsB,EAAE,cAAc;IACtC,gCAAgC,EAAE,uBAAuB;IACzD,kCAAkC,EAAE,yBAAyB;IAC7D,qCAAqC,EAAE,4BAA4B;CAC3D,CAAC;AAUX,MAAM,UAAU,cAAc,CAAC,GAAsB;IACnD,IAAI,GAAG,CAAC,sBAAsB,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,iCAAiC,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,GAAG,CAAC,yBAAmC,CAAC;IAC/D,MAAM,WAAW,GAAG,GAAG,CAAC,eAAyB,CAAC;IAClD,MAAM,aAAa,GAAG,GAAG,CAAC,iBAA2B,CAAC;IACtD,MAAM,eAAe,GAAG,GAAG,CAAC,oBAA8B,CAAC;IAC3D,MAAM,QAAQ,GAAG,GAAG,CAAC,iBAA2B,CAAC;IAEjD,gFAAgF;IAChF,OAAO,GAAG,CAAC,yBAAyB,CAAC;IAErC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,aAAa,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IAE7C,OAAO;QACL,cAAc;QACd,WAAW;QACX,aAAa;QACb,eAAe;QACf,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;IACvD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,CAAC,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;IACjC,KAAK,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACnE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,SAAS;QACX,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,qBAAqB,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC;IACnD,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QAC5B,MAAM,CAAC,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IAC/C,CAAC;IACD,MAAM,kBAAkB,GACtB,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,wBAAwB,CAAC,OAAO,CAAC,CAAC;IACnE,IAAI,kBAAkB,EAAE,CAAC;QACvB,IAAI,aAAkB,CAAC;QACvB,IAAI,CAAC;YACH,aAAa,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,aAAa,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG;YAC3B,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI;YAC7B,MAAM,EAAE,kBAAkB;SAC3B,CAAC;IACJ,CAAC;IACD,4EAA4E;IAC5E,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC;QACzC,oBAAoB,CAClB,MAAM,CAAC,OAAO,CAAC,GAAG,EAClB,OAAO,CAAC,GAAG,CAAC,wBAAwB,CACrC,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,aAAa,CAAC;IACjE,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC;IAC7B,MAAM,CAAC,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;IAE9B,MAAM,aAAa,GAAG,uBAAuB,CAAC;QAC5C,OAAO,EAAE,UAAU,CAAC,aAAa;QACjC,SAAS,EAAE,UAAU,CAAC,eAAe;KACtC,CAAC,CAAC;IACH,sEAAsE;IACtE,+DAA+D;IAC/D,MAAM,cAAc,GAAG,oBAAoB,CAAC;QAC1C,aAAa,EAAE,UAAU,CAAC,QAAQ;QAClC,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,OAAO;KACR,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE;QACzC,QAAQ;QACR,aAAa,EAAE,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC/D,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,aAAa;QACb,OAAO,EAAE,SAAS;QAClB,uBAAuB,EAAE,cAAc;QACvC,eAAe,EAAE;YACf,eAAe,EAAE,kBAAkB;YACnC,aAAa,EAAE,UAAU,CAAC,QAAQ;YAClC,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,OAAO;SACR;KACF,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;QACpC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK;QACxB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI;QACxB,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YACpB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,wBAAwB,CAAC,CAAC;QACrE,CAAC;KACF,CAAC,CAAC;IAEH,KAAK,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAEvC,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,EAAE;QAClC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC;QAC5D,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;YAChB,KAAK,cAAc,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAyB;IAClD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAG;QACb,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;KAC1D,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAElB,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC;AAED,SAAS,aAAa,CAAC,KAAa,EAAE,IAAY;IAChD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,uCAAuC,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,uCAAuC,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAyB;IAC5C,MAAM,OAAO,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtE,IAAI,OAAO,KAAK,gBAAgB,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,oBAAoB,CAAC,UAAkB,EAAE,MAAc;IAC9D,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;IACjD,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC;IACtC,UAAU,CAAC,KAAK,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACjC,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CACxD,CAAC;QACF,IAAI,UAAU,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;YACxC,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,OAAO,CACzB,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CACrD,CAAC;QACF,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QAC5E,OAAO,CAAC,GAAG,CAAC,4BAA4B,EAAE,MAAM,CAAC,CAAC;QAElD,OAAO,YAAY,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"enclave-main.js","sourceRoot":"","sources":["../src/enclave-main.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,4BAA4B,EAAE,MAAM,wDAAwD,CAAC;AAGtG,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EACL,SAAS,EACT,KAAK,EACL,SAAS,EACT,WAAW,GAGZ,MAAM,MAAM,CAAC;AACd,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,MAAM,YAAY,GAAG;IACnB,2BAA2B;IAC3B,iBAAiB;IACjB,mBAAmB;IACnB,sBAAsB;IACtB,mBAAmB;CACX,CAAC;AACX,MAAM,aAAa,GAAG,OAAO,CAAC;AAC9B,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,wBAAwB,GAAG;IAC/B,CAAC,gBAAgB,CAAC,EAAE,0BAA0B;IAC9C,CAAC,eAAe,CAAC,EAAE,8BAA8B;CACzC,CAAC;AACX,MAAM,YAAY,GAAG;IACnB,sBAAsB,EAAE,cAAc;IACtC,gCAAgC,EAAE,uBAAuB;IACzD,kCAAkC,EAAE,yBAAyB;IAC7D,qCAAqC,EAAE,4BAA4B;CAC3D,CAAC;AAUX,MAAM,UAAU,cAAc,CAAC,GAAsB;IACnD,IAAI,GAAG,CAAC,sBAAsB,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,iCAAiC,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,GAAG,CAAC,yBAAmC,CAAC;IAC/D,MAAM,WAAW,GAAG,GAAG,CAAC,eAAyB,CAAC;IAClD,MAAM,aAAa,GAAG,GAAG,CAAC,iBAA2B,CAAC;IACtD,MAAM,eAAe,GAAG,GAAG,CAAC,oBAA8B,CAAC;IAC3D,MAAM,QAAQ,GAAG,GAAG,CAAC,iBAA2B,CAAC;IAEjD,gFAAgF;IAChF,OAAO,GAAG,CAAC,yBAAyB,CAAC;IAErC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,aAAa,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IAE7C,OAAO;QACL,cAAc;QACd,WAAW;QACX,aAAa;QACb,eAAe;QACf,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;IACvD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,CAAC,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;IACjC,KAAK,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACnE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,SAAS;QACX,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,qBAAqB,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC;IACnD,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QAC5B,MAAM,CAAC,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IAC/C,CAAC;IACD,MAAM,kBAAkB,GACtB,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,wBAAwB,CAAC,OAAO,CAAC,CAAC;IACnE,IAAI,kBAAkB,EAAE,CAAC;QACvB,IAAI,aAAkB,CAAC;QACvB,IAAI,CAAC;YACH,aAAa,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,aAAa,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG;YAC3B,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI;YAC7B,MAAM,EAAE,kBAAkB;SAC3B,CAAC;IACJ,CAAC;IACD,4EAA4E;IAC5E,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC;QACzC,oBAAoB,CAClB,MAAM,CAAC,OAAO,CAAC,GAAG,EAClB,OAAO,CAAC,GAAG,CAAC,wBAAwB,CACrC,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,aAAa,CAAC;IACjE,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC;IAC7B,MAAM,CAAC,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;IAE9B,MAAM,aAAa,GAAG,uBAAuB,CAAC;QAC5C,OAAO,EAAE,UAAU,CAAC,aAAa;QACjC,SAAS,EAAE,UAAU,CAAC,eAAe;KACtC,CAAC,CAAC;IACH,sEAAsE;IACtE,+DAA+D;IAC/D,MAAM,cAAc,GAAG,oBAAoB,CAAC;QAC1C,aAAa,EAAE,UAAU,CAAC,QAAQ;QAClC,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,OAAO;KACR,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE;QACzC,QAAQ;QACR,aAAa,EAAE,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC/D,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,GAAG,CAAC,MAAM,2BAA2B,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAC1D,aAAa;QACb,OAAO,EAAE,SAAS;QAClB,uBAAuB,EAAE,cAAc;QACvC,eAAe,EAAE;YACf,eAAe,EAAE,kBAAkB;YACnC,aAAa,EAAE,UAAU,CAAC,QAAQ;YAClC,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,OAAO;SACR;KACF,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;QACpC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK;QACxB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI;QACxB,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YACpB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,wBAAwB,CAAC,CAAC;QACrE,CAAC;KACF,CAAC,CAAC;IAEH,KAAK,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAEvC,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,EAAE;QAClC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC;QAC5D,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;YAChB,KAAK,cAAc,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAyB;IAClD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAG;QACb,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;KAC1D,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAElB,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC;AAED,SAAS,aAAa,CAAC,KAAa,EAAE,IAAY;IAChD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,uCAAuC,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,uCAAuC,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAyB;IAC5C,MAAM,OAAO,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtE,IAAI,OAAO,KAAK,gBAAgB,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,oBAAoB,CAAC,UAAkB,EAAE,MAAc;IAC9D,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;IACjD,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC;IACtC,UAAU,CAAC,KAAK,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACjC,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CACxD,CAAC;QACF,IAAI,UAAU,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;YACxC,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,OAAO,CACzB,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CACrD,CAAC;QACF,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QAC5E,OAAO,CAAC,GAAG,CAAC,4BAA4B,EAAE,MAAM,CAAC,CAAC;QAElD,OAAO,YAAY,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,MAAoB,EACpB,GAAe;IAIf,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,EAAE,CAClC,KAAK,CAAC,UAAU,CAAC,wBAAwB,CAAC;QACxC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,wBAAwB,CAAC,MAAM,CAAC;QAC9C,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,KAAK,UAAU,GAAG,CAAC,IAA6B;QAC9C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,0BAA0B,EAC7D;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,GAAG,CAAC,WAAW,EAAE;gBAC1C,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,GAAG,IAAI;gBACP,KAAK,EAAE,YAAY;gBACnB,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO;aAChC,CAAC;YACF,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CACF,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,8BAA8B,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,MAAM,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC9C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAC/C,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,wBAAwB,GAE1B;QACF,KAAK,CAAC,WAAW,CAAC,MAAM;YACtB,IACE,MAAM,CAAC,GAAG,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM;gBACjD,MAAM,CAAC,MAAM,KAAK,KAAK;gBACvB,MAAM,CAAC,IAAI;gBACX,MAAM,CAAC,OAAO,KAAK,SAAS;gBAE5B,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACzD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;YAC5C,IACE,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,GAAG;gBACzB,CAAC,wCAAwC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAC5D,GAAG,CAAC,IAAI;gBACR,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,YAAY,CAAC,WAAW,EAAE;gBAC3D,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,wBAAwB;gBAEnE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACnE,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC7C,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,cAAc,CAAC;gBAC9C,OAAO,CAAC,GAAG,CACT,8BAA8B,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EACvE,MAAM,CACP,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;gBACvB,IAAI,EAAE,WAAW;gBACjB,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC;gBACpC,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC;gBACpC,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC;aACrC,CAAC,CAAC;YACH,IACE,CAAC,CAAC,eAAe,IAAI,MAAM,CAAC;gBAC5B,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ;gBAExC,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACrD,OAAO,MAAM,CAAC,aAAa,CAAC;QAC9B,CAAC;KACF,CAAC;IACF,6EAA6E;IAC7E,kEAAkE;IAClE,MAAM,aAAa,GAAG,4BAA4B,CAAC;QACjD,MAAM;QACN,WAAW,EAAE,YAAY;QACzB,aAAa,EAAE,uBAAuB,CAAC;YACrC,OAAO,EAAE,GAAG,CAAC,aAAa;YAC1B,SAAS,EAAE,GAAG,CAAC,eAAe;SAC/B,CAAC;QACF,KAAK,EAAE,QAAQ;KAChB,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,CACtB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,IAAI,0BAA0B,CACjE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtB,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,GAAW,EAAE,EAAE,CAC9C,GAAG,eAAe,cAAc,MAAM,CAAC,OAAO,CAAC,OAAO,UAAU,OAAO,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAC9I,MAAM,cAAc,GAEE;QACpB,SAAS,CAAC,GAAG;YACX,OAAO,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QACnC,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI;YACpB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAClE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;gBACvB,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBACtC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;gBACf,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;gBACjB,QAAQ,EAAE,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;aACtE,CAAC,CAAC;YACH,IACE,CAAC,CAAC,eAAe,IAAI,MAAM,CAAC;gBAC5B,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ;gBAExC,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YAClD,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;YACtC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAChC,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE;oBACP,aAAa,EAAE,MAAM,CAAC,aAAa;oBACnC,cAAc,EAAE,0BAA0B;iBAC3C;gBACD,IAAI,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC;gBAC1B,QAAQ,EAAE,OAAO;gBACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACpC,CAAC,CAAC;YACH,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9B,IAAI,CAAC,QAAQ,CAAC,EAAE;gBACd,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YACnE,OAAO,GAAG,CAAC;QACb,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,GAAG;YAChB,OAAO,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;QACD,KAAK,CAAC,eAAe,CAAC,GAAG,EAAE,MAAM;YAC/B,IAAI,CAAC,aAAa,CAAC,eAAe;gBAChC,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YAClD,OAAO,aAAa,CAAC,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACpD,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,GAAG;YACd,OAAO,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;QACD,KAAK,CAAC,MAAM;YACV,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;KACF,CAAC;IACF,OAAO;QACL,wBAAwB;QACxB,eAAe,EAAE;YACf,cAAc;YACd,OAAO,EAAE,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;YAChD,MAAM,EAAE;gBACN,KAAK,CAAC,WAAW,CAAC,OAAO;oBACvB,IAAI,OAAO,CAAC,YAAY,CAAC,WAAW,EAAE,KAAK,YAAY,CAAC,WAAW,EAAE;wBACnE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;oBAC/C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;wBACvB,IAAI,EAAE,UAAU;wBAChB,WAAW,EAAE,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC;wBACrC,KAAK,EAAE,OAAO,CAAC,KAAK;wBACpB,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC;wBACxC,QAAQ,EAAE,OAAO,CAAC,QAAQ;wBAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;qBACnC,CAAC,CAAC;oBACH,IAAI,CAAC,CAAC,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC;wBACtD,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;oBAClD,OAAO,MAAM,CAAC,SAAS,CAAC;gBAC1B,CAAC;aACF;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/middleware/body-limit.d.ts

@@ -1,5 +1,5 @@
 import type { MiddlewareHandler } from "hono";
-/** 50 MB — max body size for data ingest routes */
+/** 512 MiB — max body size for legacy data ingest routes */
 export declare const DATA_INGEST_MAX_SIZE: number;
 /** 1 MB — default max body size for general routes */
 export declare const DEFAULT_MAX_SIZE: number;

package/dist/middleware/body-limit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"body-limit.d.ts","sourceRoot":"","sources":["../../src/middleware/body-limit.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAE9C,mDAAmD;AACnD,eAAO,MAAM,oBAAoB,QAAmB,CAAC;AAErD,sDAAsD;AACtD,eAAO,MAAM,gBAAgB,QAAkB,CAAC;AAEhD;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,CAalE"}
+{"version":3,"file":"body-limit.d.ts","sourceRoot":"","sources":["../../src/middleware/body-limit.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAG9C,4DAA4D;AAC5D,eAAO,MAAM,oBAAoB,QAAoB,CAAC;AAEtD,sDAAsD;AACtD,eAAO,MAAM,gBAAgB,QAAkB,CAAC;AAEhD;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,CAmBlE"}

package/dist/middleware/body-limit.js

@@ -1,13 +1,14 @@
 import { bodyLimit } from "hono/body-limit";
-/** 50 MB — max body size for data ingest routes */
-export const DATA_INGEST_MAX_SIZE = 50 * 1024 * 1024;
+import { cacheRequestBodyBytes } from "@opendatalabs/personal-server-ts-core/auth";
+/** 512 MiB — max body size for legacy data ingest routes */
+export const DATA_INGEST_MAX_SIZE = 512 * 1024 * 1024;
 /** 1 MB — default max body size for general routes */
 export const DEFAULT_MAX_SIZE = 1 * 1024 * 1024;
 /**
  * Creates a Hono body-limit middleware that returns 413 JSON on overflow.
  */
 export function createBodyLimit(maxSize) {
-    return bodyLimit({
+    const enforceLimit = bodyLimit({
         maxSize,
         onError: (c) => {
             return c.json({
@@ -16,5 +17,9 @@ export function createBodyLimit(maxSize) {
             }, 413);
         },
     });
+    return (c, next) => enforceLimit(c, async () => {
+        await cacheRequestBodyBytes(c.req.raw, maxSize);
+        await next();
+    });
 }
 //# sourceMappingURL=body-limit.js.map

package/dist/middleware/body-limit.js.map

@@ -1 +1 @@
-{"version":3,"file":"body-limit.js","sourceRoot":"","sources":["../../src/middleware/body-limit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAG5C,mDAAmD;AACnD,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAErD,sDAAsD;AACtD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAEhD;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,OAAO,SAAS,CAAC;QACf,OAAO;QACP,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACb,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,mBAAmB;gBAC1B,OAAO,EAAE,wCAAwC,OAAO,QAAQ;aACjE,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"body-limit.js","sourceRoot":"","sources":["../../src/middleware/body-limit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AAEnF,4DAA4D;AAC5D,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAEtD,sDAAsD;AACtD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAEhD;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,YAAY,GAAG,SAAS,CAAC;QAC7B,OAAO;QACP,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACb,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,mBAAmB;gBAC1B,OAAO,EAAE,wCAAwC,OAAO,QAAQ;aACjE,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CACjB,YAAY,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE;QACzB,MAAM,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/middleware/cors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../src/middleware/cors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,kEAAkE;AAClE,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAe/C,CAAC;AAEF,mEAAmE;AACnE,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAIhD,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAM/C,CAAC;AAEF,wBAAgB,cAAc,qCAQ7B"}
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../src/middleware/cors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,kEAAkE;AAClE,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAe/C,CAAC;AAEF,mEAAmE;AACnE,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAKhD,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAM/C,CAAC;AAEF,wBAAgB,cAAc,qCAQ7B"}

package/dist/middleware/cors.js

@@ -32,6 +32,7 @@ export const CORS_ALLOW_HEADERS = [
 /** Response headers a browser client must be able to read back. */
 export const CORS_EXPOSE_HEADERS = [
     "X-Vana-Metadata",
+    "X-Vana-Data-Source",
     "X-PAYMENT-RESPONSE",
     "Content-Disposition",
 ];

package/dist/middleware/cors.js.map

@@ -1 +1 @@
-{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../src/middleware/cors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AACrF,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAE3F,kEAAkE;AAClE,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,cAAc;IACd,eAAe;IACf,8DAA8D;IAC9D,wDAAwD;IACxD,sBAAsB;IACtB,uDAAuD;IACvD,iBAAiB;IACjB,YAAY;IACZ,qBAAqB;IACrB,wBAAwB;IACxB,eAAe;IACf,WAAW;IACX,oEAAoE;IACpE,8BAA8B;CAC/B,CAAC;AAEF,mEAAmE;AACnE,MAAM,CAAC,MAAM,mBAAmB,GAAsB;IACpD,iBAAiB;IACjB,oBAAoB;IACpB,qBAAqB;CACtB,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,KAAK;IACL,MAAM;IACN,KAAK;IACL,QAAQ;IACR,SAAS;CACV,CAAC;AAEF,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,CAAC;QACV,MAAM,EAAE,GAAG;QACX,YAAY,EAAE,CAAC,GAAG,kBAAkB,CAAC;QACrC,aAAa,EAAE,CAAC,GAAG,mBAAmB,CAAC;QACvC,YAAY,EAAE,CAAC,GAAG,kBAAkB,CAAC;QACrC,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../src/middleware/cors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AACrF,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAE3F,kEAAkE;AAClE,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,cAAc;IACd,eAAe;IACf,8DAA8D;IAC9D,wDAAwD;IACxD,sBAAsB;IACtB,uDAAuD;IACvD,iBAAiB;IACjB,YAAY;IACZ,qBAAqB;IACrB,wBAAwB;IACxB,eAAe;IACf,WAAW;IACX,oEAAoE;IACpE,8BAA8B;CAC/B,CAAC;AAEF,mEAAmE;AACnE,MAAM,CAAC,MAAM,mBAAmB,GAAsB;IACpD,iBAAiB;IACjB,oBAAoB;IACpB,oBAAoB;IACpB,qBAAqB;CACtB,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,KAAK;IACL,MAAM;IACN,KAAK;IACL,QAAQ;IACR,SAAS;CACV,CAAC;AAEF,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,CAAC;QACV,MAAM,EAAE,GAAG;QACX,YAAY,EAAE,CAAC,GAAG,kBAAkB,CAAC;QACrC,aAAa,EAAE,CAAC,GAAG,mBAAmB,CAAC;QACvC,YAAY,EAAE,CAAC,GAAG,kBAAkB,CAAC;QACrC,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;AACL,CAAC"}

package/dist/package.json

@@ -28,6 +28,10 @@
       "types": "./dist/config/index.d.ts",
       "import": "./dist/config/index.js"
     },
+    "./witness": {
+      "types": "./dist/storage/declaration-witness.d.ts",
+      "import": "./dist/storage/declaration-witness.js"
+    },
     "./runtime": {
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
@@ -54,14 +58,18 @@
     "@opendatalabs/personal-server-ts-core": "*",
     "@opendatalabs/personal-server-ts-lite": "*",
     "@opendatalabs/vana-sdk": "3.23.0-pr.211.36da1d8",
+    "ajv": "^8.20.0",
     "better-sqlite3": "^12.11.1",
     "hono": "^4.13.12",
     "pino": "^10.3.1",
     "pino-pretty": "^13.0.0",
+    "undici": "^7.29.1",
     "viem": "^2.54.2"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.0",
-    "esbuild": "0.28.1"
+    "@types/node-forge": "^1.3.14",
+    "esbuild": "0.28.1",
+    "node-forge": "^1.4.0"
   }
 }

package/dist/pdpp/bootstrap.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Boot the PDPP Authorization Server for a real Personal Server.
+ *
+ * This is the seam between "the AS exists as a library" and "this running
+ * server is a PDPP authorization server". It opens the persistent store,
+ * derives the declaration trust policy from what the deployment actually
+ * serves, and hands the route module the owner-proof wiring so consent
+ * decisions authenticate against the same wallet signature every other owner
+ * route uses.
+ *
+ * Returns undefined when PDPP is disabled and no connection registry is
+ * configured. It also returns undefined when no declarations or connection
+ * methods remain, so `/pdpp/v1` is mounted only when it can issue tokens.
+ */
+import type { Logger } from "pino";
+import type { ServerConfig } from "@opendatalabs/personal-server-ts-core/schemas";
+import type { IndexManager } from "@opendatalabs/personal-server-ts-core/storage/index";
+import type { DeclarationSnapshot } from "@opendatalabs/personal-server-ts-core/pdpp";
+import type { PdppAuthRouteDeps } from "../routes/pdpp-auth.js";
+import type { TokenStore } from "../token-store.js";
+import { type MutableDeclarationRegistry } from "./declaration-registry.js";
+export interface CreatePdppAuthDepsOptions {
+    config: ServerConfig;
+    storageRoot: string;
+    logger: Logger;
+    indexManager: IndexManager;
+    serverOrigin: string | (() => string);
+    serverOwner?: `0x${string}`;
+    devToken?: string;
+    accessToken?: string;
+    tokenStore?: TokenStore;
+}
+/**
+ * The mounted AS plus the snapshots it retained.
+ *
+ * The Resource Server derives its per-stream shapes from these exact
+ * snapshots rather than re-reading config, so both halves enforce against the
+ * same retained document a grant was frozen against.
+ */
+export type PdppAuthBootResult = PdppAuthRouteDeps & {
+    retainedDeclarations: DeclarationSnapshot[];
+    /**
+     * The exact documents behind `retainedDeclarations`, keyed by source id.
+     *
+     * The sync importer verifies a producer's claimed declaration digest, and
+     * the only honest thing to digest is the bytes that were actually
+     * retrieved. The auth store persists a parsed snapshot rather than the
+     * document, so re-digesting from storage would compare a re-serialization
+     * against a digest taken over the original — a check that can fail for
+     * formatting alone and proves nothing about what the producer read. These
+     * are those original bytes, carried forward from boot.
+     */
+    retainedDocuments: Map<string, string>;
+    /** Configured artifact methods resolved through their retained declaration paths. */
+    configuredMethods: {
+        sourceId: string;
+        methodId: string;
+    }[];
+    /** Connection methods remain available when canonical record declarations are off. */
+    connectionMethods: Map<string, string[]>;
+    /**
+     * The live registry behind `resolveDeclaration`. Handed out so the
+     * submission route can write to the same object the AS reads from — a
+     * submission that updated a copy would accept a declaration the grant path
+     * still cannot see, which is the restart problem wearing a new hat.
+     */
+    declarationRegistry: MutableDeclarationRegistry;
+    /** The connector gate this boot derived, so callers do not recompute it. */
+    supportedConnectors: string[];
+};
+export declare function createPdppAuthDeps(options: CreatePdppAuthDepsOptions): Promise<PdppAuthBootResult | undefined>;
+//# sourceMappingURL=bootstrap.d.ts.map

package/dist/pdpp/bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../../src/pdpp/bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AACnC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+CAA+C,CAAC;AAClF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACxF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAC;AAStF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAOpD,OAAO,EAEL,KAAK,0BAA0B,EAChC,MAAM,2BAA2B,CAAC;AAEnC,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,YAAY,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,YAAY,CAAC;IAC3B,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACtC,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG,iBAAiB,GAAG;IACnD,oBAAoB,EAAE,mBAAmB,EAAE,CAAC;IAC5C;;;;;;;;;;OAUG;IACH,iBAAiB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,qFAAqF;IACrF,iBAAiB,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC5D,sFAAsF;IACtF,iBAAiB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACzC;;;;;OAKG;IACH,mBAAmB,EAAE,0BAA0B,CAAC;IAChD,4EAA4E;IAC5E,mBAAmB,EAAE,MAAM,EAAE,CAAC;CAC/B,CAAC;AAEF,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAqPzC"}