@agentlogin/issuer 0.0.0-stage → 0.2.0-beta.2

package/dist/transactions.js

@@ -0,0 +1,449 @@
+// Section 5.3 and Section 6: the Sign-in Transaction.
+import { compactVerify, decodeProtectedHeader, importJWK } from 'jose';
+import { AGENT_KEY_ALGS, ASSERTION_TYP, DISCLOSURE, OWNER_SCOPES, SCOPES } from './constants.js';
+import { OAuthError } from './errors.js';
+import { getLiveKey } from './agents.js';
+import { ownerClaimsAvailable } from './tokens.js';
+import { commit, ended } from './state.js';
+import { TERMINAL, consentRecordReason } from './store.js';
+import { domainServed, handlesEqual, isPlainObject, parseHandle, randomId, randomSecret, sha256, typMatches } from './util.js';
+export const txUrl = (ctx, id) => `${ctx.issuer}/transactions/${id}`;
+/** Section 5.3: create the transaction. */
+export async function createTransaction(ctx, p) {
+    const now = await ctx.store.currentTime(ctx.now());
+    const tx = {
+        id: randomId(),
+        version: 0,
+        continueSecret: randomSecret(),
+        clientId: p.client.clientId,
+        clientPresentation: { type: p.client.type, clientName: p.client.clientName, logoUri: p.client.logoUri,
+            tosUri: p.client.tosUri, policyUri: p.client.policyUri, relayIssuer: p.client.relayIssuer, relayPolicyUri: p.client.relayPolicyUri },
+        redirectUri: p.redirectUri,
+        scopes: p.scopes,
+        state: p.state,
+        nonce: p.nonce,
+        codeChallenge: p.codeChallenge,
+        prompt: p.prompt,
+        maxAge: p.maxAge,
+        loginHint: p.loginHint,
+        disclosure: p.scopes.map((s) => ({ scope: s, ...DISCLOSURE[s] })),
+        requester: p.requester,
+        status: 'awaiting_agent',
+        challenge: randomSecret(),
+        createdAt: now,
+        expiresAt: now + ctx.constants.T_TXN,
+        acceptDisclosure: false,
+        deliverToSession: false,
+        ownerApprovalOutstanding: false,
+        reviewOutstanding: false,
+        passedCap: false,
+        sessionSecretHash: sha256(p.sessionSecret),
+        codeIssued: false,
+    };
+    await ctx.store.insertTransaction(tx);
+    return tx;
+}
+/**
+ * Loads a transaction as it stands now, or throws 404 `invalid_transaction` (Section 6.7); terminal ones are retained
+ * for T_RETAIN. Effective expiry and lifecycle state are computed by a read-only store operation. Polling never
+ * persists a denial or releases a reservation; mutation paths enforce the same state independently.
+ */
+export async function loadTransaction(ctx, id) {
+    const tx = await ctx.store.readTransaction(id, { now: ctx.now(), retainFor: ctx.constants.T_RETAIN });
+    if (!tx)
+        throw new OAuthError(404, 'invalid_transaction');
+    return tx;
+}
+/** Keep displayed terms fixed while authentication, review policy and quota continue to use the current Client. */
+export function presentedClient(tx, client) {
+    const shown = tx.clientPresentation;
+    return { ...client, type: shown?.type ?? client.type, clientName: shown?.clientName, logoUri: shown?.logoUri,
+        tosUri: shown?.tosUri, policyUri: shown?.policyUri, relayIssuer: shown?.relayIssuer, relayPolicyUri: shown?.relayPolicyUri };
+}
+/** Section 6.1: the Transaction Resource as seen by `viewer`. */
+export function resource(ctx, tx, client, viewer) {
+    client = presentedClient(tx, client);
+    const base = txUrl(ctx, tx.id);
+    const r = {
+        transaction_id: tx.id,
+        iss: ctx.issuer,
+        url: base,
+        status: tx.status,
+        next: next(ctx, tx, viewer),
+        expires_at: tx.expiresAt,
+        client: {
+            client_id: client.clientId,
+            client_type: client.type,
+            redirect_host: new URL(tx.redirectUri).host,
+            client_name: client.clientName,
+            logo_uri: client.logoUri,
+            tos_uri: client.tosUri,
+            policy_uri: client.policyUri,
+        },
+        requested_scopes: tx.scopes,
+        disclosure: tx.disclosure,
+    };
+    if (tx.requester)
+        r.requester = tx.requester;
+    if (tx.status === 'awaiting_agent')
+        r.challenge = tx.challenge;
+    if (tx.status === 'awaiting_consent')
+        r.consent_reason = tx.consentReason;
+    if (tx.loginHint)
+        r.login_hint = tx.loginHint;
+    if (tx.status === 'denied')
+        r.reason = tx.reason;
+    return r;
+}
+function next(ctx, tx, viewer) {
+    const base = txUrl(ctx, tx.id);
+    switch (tx.status) {
+        case 'awaiting_agent':
+            return { action: 'assert', method: 'POST', url: `${base}/assertion` };
+        case 'awaiting_owner':
+            return { action: 'await_owner', method: 'GET', url: base, retry_after: 5 };
+        case 'awaiting_consent':
+            return { action: 'review', method: 'POST', url: `${base}/review` };
+        case 'completed':
+            return { action: 'none' };
+        case 'ready':
+        case 'denied':
+        case 'expired': {
+            // Section 6.5: the continue URL goes to the transaction_token holder, and to the Session Holder only
+            // when the accepted assertion carried deliver_to_session.
+            const release = viewer.kind === 'transaction_token' || (viewer.kind === 'session' && tx.deliverToSession);
+            const n = { action: 'continue', method: 'GET' };
+            if (release)
+                n.url = `${base}/continue/${tx.continueSecret}`;
+            return n;
+        }
+    }
+}
+/** Identifies the requester of a transaction resource from its credentials (Section 6.5). */
+export function identifyViewer(tx, bearer, cookieSecret) {
+    if (bearer) {
+        const h = sha256(bearer);
+        if (tx.transactionTokenHash && h === tx.transactionTokenHash)
+            return { kind: 'transaction_token', tokenHash: h };
+        if (tx.sessionSecretHash && h === tx.sessionSecretHash)
+            return { kind: 'session' };
+        throw new OAuthError(401, 'invalid_token', undefined, { 'WWW-Authenticate': 'Bearer error="invalid_token"' });
+    }
+    if (cookieSecret && tx.sessionSecretHash && sha256(cookieSecret) === tx.sessionSecretHash)
+        return { kind: 'session' };
+    return { kind: 'none' };
+}
+/** Section 6.4: whether a review is required, and why. */
+/**
+ * Section 6.4: why a review is required. `record` is a reason that the Agent's acceptance of the disclosure
+ * satisfies (the Consent Record is missing, outdated or expired); `forced` is one that it does not (the request or
+ * the client demands a review).
+ */
+export function reviewReasons(ctx, tx, client, consent, now = ctx.now()) {
+    client = presentedClient(tx, client);
+    const record = consentRecordReason(consent, { scopes: tx.scopes, redirectHost: new URL(tx.redirectUri).host,
+        clientName: client.clientName, tosUri: client.tosUri, policyUri: client.policyUri }, now - ctx.constants.T_CONSENT) ?? null;
+    const forced = tx.prompt === 'consent' ? 'prompt_consent' : client.requireReview ? 'policy' : null;
+    return { record, forced };
+}
+/** Effects committed atomically with the transition; a delayed request cannot grant consent to a replacement Agent. */
+function transitionEffects(ctx, tx, client, grantConsent = false) {
+    client = presentedClient(tx, client);
+    const consentContext = tx.handle ? { handle: tx.handle, clientId: tx.clientId, scopes: tx.scopes, redirectHost: new URL(tx.redirectUri).host,
+        clientName: client.clientName, tosUri: client.tosUri, policyUri: client.policyUri } : undefined;
+    return {
+        maxSignups: client.maxSignupsPerOwner,
+        expireConsentBefore: ctx.now() - ctx.constants.T_CONSENT,
+        consent: grantConsent ? consentContext : undefined,
+        consentContext,
+        touchConsent: tx.status === 'ready' && tx.consentRelied,
+    };
+}
+/**
+ * Section 6.7 precedence: `invalid_transaction` (loading), then `invalid_token`, then `transaction_expired`, then any
+ * other error. The two guards below are applied in that order before a request body or the status is looked at.
+ */
+export function requireTransactionToken(viewer) {
+    if (viewer.kind !== 'transaction_token')
+        throw new OAuthError(401, 'invalid_token', undefined, { 'WWW-Authenticate': 'Bearer error="invalid_token"' });
+}
+export function requireOpen(tx) {
+    if (TERMINAL.has(tx.status))
+        throw new OAuthError(410, 'transaction_expired');
+}
+/**
+ * Section 6.3: verify an assertion and advance the transaction. Returns the transaction as accepted and its
+ * transaction_token. Steps 6 and 7 are one conditional write: of several assertions for one transaction, at whatever
+ * issuer process they arrive, one is accepted and the others are answered `assertion_replayed`.
+ */
+export async function assert(ctx, loaded, client, body) {
+    const tx = loaded;
+    requireOpen(tx);
+    if (!isPlainObject(body) || typeof body.assertion !== 'string')
+        throw new OAuthError(400, 'invalid_request', 'assertion required');
+    const jws = body.assertion;
+    const c = ctx.constants;
+    const bad = (d) => new OAuthError(400, 'invalid_assertion', d);
+    // Step 1: size, header, parse.
+    if (Buffer.byteLength(jws) > c.N_ASSERTION)
+        throw bad('assertion too large');
+    let header;
+    try {
+        header = decodeProtectedHeader(jws);
+    }
+    catch {
+        throw bad('malformed JWS');
+    }
+    if (!AGENT_KEY_ALGS.includes(header.alg))
+        throw bad('alg not permitted');
+    if (!typMatches(header.typ, ASSERTION_TYP))
+        throw bad('typ');
+    if (typeof header.kid !== 'string')
+        throw bad('kid required');
+    for (const f of ['jwk', 'jku', 'x5u', 'x5c', 'crit'])
+        if (header[f] !== undefined)
+            throw bad(`header ${f} not permitted`);
+    let payload;
+    try {
+        const parts = jws.split('.');
+        payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'));
+        if (!isPlainObject(payload))
+            throw new Error();
+    }
+    catch {
+        throw bad('malformed payload');
+    }
+    if (typeof payload.iss !== 'string' || payload.sub !== payload.iss)
+        throw bad('iss and sub must both be the handle');
+    const parsed = parseHandle(payload.iss);
+    if (!parsed)
+        throw bad('handle syntax');
+    // Step 2: resolve the key.
+    const key = await getLiveKey(ctx, header.kid, parsed.handle);
+    if (!key || !handlesEqual(key.handle, parsed.handle) || !domainServed(parsed.domain, ctx.handleDomains))
+        throw new OAuthError(401, 'unknown_key');
+    if (key.status !== 'active' || (await ctx.store.currentTime(ctx.now())) >= key.expiresAt)
+        throw new OAuthError(401, 'key_revoked');
+    if (header.alg !== 'ES256')
+        throw bad('alg does not match the key'); // only P-256 keys are enrolled
+    // Step 3: signature.
+    try {
+        await compactVerify(jws, await importJWK(key.jwk, 'ES256'), { algorithms: ['ES256'] });
+    }
+    catch {
+        throw new OAuthError(401, 'invalid_signature');
+    }
+    // Step 4: claims.
+    const now = await ctx.store.currentTime(ctx.now());
+    if (payload.aud !== ctx.issuer)
+        throw bad('aud');
+    if (payload.txn !== tx.id)
+        throw bad('txn');
+    if (tx.status !== 'awaiting_agent' || payload.nonce !== tx.challenge) {
+        if (tx.status !== 'awaiting_agent')
+            throw new OAuthError(409, 'assertion_replayed');
+        throw bad('nonce');
+    }
+    const iat = payload.iat;
+    const exp = payload.exp;
+    if (typeof iat !== 'number' || typeof exp !== 'number')
+        throw bad('iat and exp required');
+    if (exp > iat + c.T_ASSERT)
+        throw bad('exp too far from iat');
+    if (now >= exp)
+        throw bad('expired');
+    if (iat < now - c.T_ASSERT || iat > now + c.T_SKEW)
+        throw bad('iat outside window');
+    if (typeof payload.jti !== 'string')
+        throw bad('jti required');
+    if (payload.accept_disclosure !== undefined && typeof payload.accept_disclosure !== 'boolean')
+        throw bad('accept_disclosure');
+    if (payload.deliver_to_session !== undefined && typeof payload.deliver_to_session !== 'boolean')
+        throw bad('deliver_to_session');
+    // Step 5: login_hint.
+    if (tx.loginHint && !handlesEqual(tx.loginHint, parsed.handle))
+        throw bad('login_hint mismatch');
+    const agent = await ctx.store.getAgent(key.handle);
+    if (!agent || !agent.enabled || agent.sub !== key.agentSub)
+        throw new OAuthError(401, 'unknown_key');
+    const token = randomSecret();
+    const account = await ctx.store.getAccount(agent.handle, tx.clientId);
+    const subject = { handle: agent.handle, kid: key.kid, keyEnrollment: key.enrollment, clientId: tx.clientId, agentSub: agent.sub, agentVersion: agent.authorizationVersion, accountVersion: account?.authorizationVersion ?? 0 };
+    for (let current = tx;;) {
+        // Step 6: one assertion per transaction. Decided again on every attempt, against the transaction as it is now.
+        if (TERMINAL.has(current.status))
+            throw new OAuthError(410, 'transaction_expired');
+        if (current.status !== 'awaiting_agent')
+            throw new OAuthError(409, 'assertion_replayed');
+        if (payload.nonce !== current.challenge)
+            throw bad('nonce');
+        // Permissions can change while gates are being planned. Each attempt stays bound to the verified enrollment.
+        const currentKey = await ctx.store.getKey(key.kid, key.handle);
+        if (!currentKey || currentKey.enrollment !== key.enrollment || currentKey.agentSub !== key.agentSub)
+            throw new OAuthError(401, 'unknown_key');
+        // Step 7: the challenge is consumed and the authentication event recorded.
+        let next = {
+            ...current,
+            challenge: undefined,
+            ...subject,
+            ownerId: agent.ownerId,
+            assertedAt: now,
+            acceptDisclosure: payload.accept_disclosure === true,
+            deliverToSession: payload.deliver_to_session === true,
+            transactionTokenHash: sha256(token),
+        };
+        let grantConsent = false;
+        // Cap admission and assertion acceptance are a single conditional store operation. A losing assertion owns no cleanup.
+        if (account?.status === 'disabled')
+            next = ended(ctx, next, 'denied', 'access_denied');
+        else
+            ({ next, grantConsent } = await gates(ctx, next, client, currentKey.permissions.share_owner, agent.ownerId));
+        if (await commit(ctx, next, current.version, { ...transitionEffects(ctx, next, client, grantConsent), expectedShareOwner: currentKey.permissions.share_owner, assertionWindow: { notBefore: iat - c.T_SKEW, expiresAt: exp } })) {
+            return { tx: next, token };
+        }
+        current = await loadTransaction(ctx, tx.id);
+    }
+}
+/** Step 10 of Section 6.3: the outstanding gates and the status they lead to. */
+async function gates(ctx, tx, client, shareOwner, ownerId) {
+    const next = { ...tx };
+    const wantsOwner = next.scopes.some((s) => OWNER_SCOPES.includes(s));
+    if (wantsOwner) {
+        // Section 6.6: a requested Owner Claim that cannot be issued for this Owner ends the sign-in; it is never omitted.
+        const owner = await ctx.store.getOwner(ownerId);
+        if (!owner || !ownerClaimsAvailable(owner, next.scopes))
+            return { next: ended(ctx, next, 'denied', 'access_denied'), grantConsent: false };
+    }
+    next.ownerApprovalOutstanding = wantsOwner && !shareOwner;
+    const consent = await ctx.store.getConsent(next.handle, next.clientId);
+    const { record, forced } = reviewReasons(ctx, next, client, consent, await ctx.store.currentTime(ctx.now()));
+    // accept_disclosure answers for the Consent Record only; a review that the request or the client demands stays due.
+    const recordOutstanding = record !== null && !next.acceptDisclosure;
+    next.reviewOutstanding = recordOutstanding || forced !== null;
+    next.consentReason = (recordOutstanding ? record : forced) ?? undefined;
+    next.consentRelied = consent !== undefined && record === null;
+    if (next.prompt === 'none' && next.reviewOutstanding)
+        return { next: ended(ctx, next, 'denied', 'consent_required'), grantConsent: false };
+    if (next.prompt === 'none' && next.ownerApprovalOutstanding)
+        return { next: ended(ctx, next, 'denied', 'interaction_required'), grantConsent: false };
+    if (next.ownerApprovalOutstanding) {
+        next.status = 'awaiting_owner';
+        next.expiresAt = Math.max(next.expiresAt, next.createdAt + ctx.constants.T_OWNER); // Section 6.6
+    }
+    else if (next.reviewOutstanding)
+        next.status = 'awaiting_consent';
+    else
+        next.status = 'ready';
+    return { next, grantConsent: next.acceptDisclosure && !next.reviewOutstanding };
+}
+/** Section 6.4: the review decision, authorised by the transaction_token only. Returns the transaction as changed. */
+export async function review(ctx, loaded, client, viewer, body) {
+    requireTransactionToken(viewer); // the session binding does not authorise this step
+    for (let current = loaded;;) {
+        if (viewer.tokenHash !== current.transactionTokenHash)
+            throw new OAuthError(401, 'invalid_token', undefined, { 'WWW-Authenticate': 'Bearer error="invalid_token"' });
+        requireOpen(current);
+        if (current.status !== 'awaiting_consent')
+            throw new OAuthError(400, 'invalid_request', 'no review is outstanding');
+        if (!isPlainObject(body) || (body.decision !== 'allow' && body.decision !== 'deny'))
+            throw new OAuthError(400, 'invalid_request', 'decision must be allow or deny');
+        const allow = body.decision === 'allow';
+        const next = allow
+            ? { ...current, reviewOutstanding: false, status: current.ownerApprovalOutstanding ? 'awaiting_owner' : 'ready' }
+            : ended(ctx, current, 'denied', 'cancelled');
+        if (await commit(ctx, next, current.version, { ...transitionEffects(ctx, next, client, allow), transactionTokenHash: viewer.tokenHash })) {
+            return next;
+        }
+        current = await reload(ctx, loaded.id);
+    }
+}
+/** Section 6.6: the Owner's decision, given with an Owner Credential of the asserting Agent's Owner. */
+export async function ownerDecision(ctx, loaded, client, ownerId, decision) {
+    for (let current = loaded;;) {
+        requireOpen(current);
+        if (current.status !== 'awaiting_owner')
+            throw new OAuthError(400, 'invalid_request', 'no approval is outstanding');
+        if (current.ownerId !== ownerId)
+            throw new OAuthError(404, 'invalid_transaction');
+        if (decision !== 'approve' && decision !== 'refuse')
+            throw new OAuthError(400, 'invalid_request', 'decision must be approve or refuse');
+        const next = decision === 'refuse'
+            ? ended(ctx, current, 'denied', 'owner_declined')
+            : { ...current, ownerApprovalOutstanding: false, status: current.reviewOutstanding ? 'awaiting_consent' : 'ready' };
+        if (await commit(ctx, next, current.version, transitionEffects(ctx, next, client))) {
+            return next;
+        }
+        current = await reload(ctx, loaded.id);
+    }
+}
+async function reload(ctx, id) {
+    return loadTransaction(ctx, id);
+}
+/**
+ * Section 6.5: follow the continue URL. Completion, code insertion and Account counting are one conditional store
+ * transaction. Only the request that commits receives the code: of several requests, at whatever issuer process, one receives a
+ * code and the others `transaction_expired`.
+ */
+export async function cont(ctx, loaded, secret, viewer) {
+    for (let tx = await loadTransaction(ctx, loaded.id);;) {
+        if (viewer.kind === 'transaction_token' && viewer.tokenHash !== tx.transactionTokenHash)
+            throw new OAuthError(401, 'invalid_token', undefined, { 'WWW-Authenticate': 'Bearer error="invalid_token"' });
+        const release = viewer.kind === 'transaction_token' || (viewer.kind === 'session' && tx.deliverToSession);
+        if (!release)
+            throw new OAuthError(401, 'invalid_token', undefined, { 'WWW-Authenticate': 'Bearer error="invalid_token"' });
+        if (secret !== tx.continueSecret)
+            throw new OAuthError(404, 'invalid_transaction');
+        const u = new URL(tx.redirectUri);
+        u.searchParams.set('state', tx.state);
+        u.searchParams.set('iss', ctx.issuer);
+        if (tx.status === 'completed')
+            throw new OAuthError(410, 'transaction_expired');
+        if (tx.status === 'denied' || tx.status === 'expired') {
+            const { error, description } = redirectError(tx);
+            u.searchParams.set('error', error);
+            if (description)
+                u.searchParams.set('error_description', description);
+            return { redirect: u.href };
+        }
+        if (tx.status !== 'ready')
+            throw new OAuthError(400, 'invalid_request', 'transaction is not ready');
+        const next = { ...ended(ctx, tx, 'completed'), codeIssued: true };
+        const code = randomSecret();
+        const now = await ctx.store.currentTime(ctx.now());
+        const completed = await ctx.store.completeTransaction(next, tx.version, {
+            hash: sha256(code), txnId: next.id, clientId: next.clientId, redirectUri: next.redirectUri,
+            codeChallenge: next.codeChallenge, nonce: next.nonce, scopes: next.scopes,
+            handle: next.handle, kid: next.kid, keyEnrollment: next.keyEnrollment,
+            agentSub: next.agentSub, agentVersion: next.agentVersion, accountVersion: next.accountVersion,
+            authTime: next.assertedAt, maxAge: next.maxAge, expiresAt: now + ctx.constants.T_CODE, used: false, voided: false,
+        }, now, viewer.kind === 'transaction_token' ? viewer.tokenHash : undefined);
+        if (!completed || completed.status !== 'completed') {
+            tx = completed ?? await loadTransaction(ctx, tx.id);
+            continue;
+        }
+        u.searchParams.set('code', code);
+        return { redirect: u.href };
+    }
+}
+/** Section 5.5 table. */
+export function redirectError(tx) {
+    if (tx.status === 'expired')
+        return { error: 'access_denied', description: 'transaction_expired' };
+    switch (tx.reason) {
+        case 'owner_declined':
+            return { error: 'access_denied', description: 'owner_declined' };
+        case 'consent_required':
+            return { error: 'consent_required' };
+        case 'interaction_required':
+            return { error: 'interaction_required' };
+        case 'login_required':
+            return { error: 'login_required' };
+        case 'signup_limit_reached':
+            return { error: 'signup_limit_reached' };
+        default:
+            return { error: 'access_denied' };
+    }
+}
+export const isTerminal = (s) => TERMINAL.has(s);
+export const scopeList = (raw) => [...new Set(raw.split(' ').filter((s) => SCOPES.includes(s)))];
+//# sourceMappingURL=transactions.js.map

package/dist/transactions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transactions.js","sourceRoot":"","sources":["../src/transactions.ts"],"names":[],"mappings":"AAAA,sDAAsD;AACtD,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAc,MAAM,gBAAgB,CAAC;AAE7G,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAA2H,MAAM,YAAY,CAAC;AACpL,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAsB/H,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,GAAkB,EAAE,EAAU,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,iBAAiB,EAAE,EAAE,CAAC;AAE5F,2CAA2C;AAC3C,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAkB,EAAE,CAAe;IACzE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;IACnD,MAAM,EAAE,GAAgB;QACtB,EAAE,EAAE,QAAQ,EAAE;QACd,OAAO,EAAE,CAAC;QACV,cAAc,EAAE,YAAY,EAAE;QAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ;QAC3B,kBAAkB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO;YACnG,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE;QACtI,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACjE,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,MAAM,EAAE,gBAAgB;QACxB,SAAS,EAAE,YAAY,EAAE;QACzB,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,KAAK;QACpC,gBAAgB,EAAE,KAAK;QACvB,gBAAgB,EAAE,KAAK;QACvB,wBAAwB,EAAE,KAAK;QAC/B,iBAAiB,EAAE,KAAK;QACxB,SAAS,EAAE,KAAK;QAChB,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC;QAC1C,UAAU,EAAE,KAAK;KAClB,CAAC;IACF,MAAM,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACtC,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAkB,EAAE,EAAU;IAClE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;IACtG,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;IAC1D,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,mHAAmH;AACnH,MAAM,UAAU,eAAe,CAAC,EAAe,EAAE,MAAc;IAC7D,MAAM,KAAK,GAAG,EAAE,CAAC,kBAAkB,CAAC;IACpC,OAAO,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO;QAC1G,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;AACjI,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,QAAQ,CAAC,GAAkB,EAAE,EAAe,EAAE,MAAc,EAAE,MAA4B;IACxG,MAAM,GAAG,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/B,MAAM,CAAC,GAA4B;QACjC,cAAc,EAAE,EAAE,CAAC,EAAE;QACrB,GAAG,EAAE,GAAG,CAAC,MAAM;QACf,GAAG,EAAE,IAAI;QACT,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC;QAC3B,UAAU,EAAE,EAAE,CAAC,SAAS;QACxB,MAAM,EAAE;YACN,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,WAAW,EAAE,MAAM,CAAC,IAAI;YACxB,aAAa,EAAE,IAAI,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,IAAI;YAC3C,WAAW,EAAE,MAAM,CAAC,UAAU;YAC9B,QAAQ,EAAE,MAAM,CAAC,OAAO;YACxB,OAAO,EAAE,MAAM,CAAC,MAAM;YACtB,UAAU,EAAE,MAAM,CAAC,SAAS;SAC7B;QACD,gBAAgB,EAAE,EAAE,CAAC,MAAM;QAC3B,UAAU,EAAE,EAAE,CAAC,UAAU;KAC1B,CAAC;IACF,IAAI,EAAE,CAAC,SAAS;QAAE,CAAC,CAAC,SAAS,GAAG,EAAE,CAAC,SAAS,CAAC;IAC7C,IAAI,EAAE,CAAC,MAAM,KAAK,gBAAgB;QAAE,CAAC,CAAC,SAAS,GAAG,EAAE,CAAC,SAAS,CAAC;IAC/D,IAAI,EAAE,CAAC,MAAM,KAAK,kBAAkB;QAAE,CAAC,CAAC,cAAc,GAAG,EAAE,CAAC,aAAa,CAAC;IAC1E,IAAI,EAAE,CAAC,SAAS;QAAE,CAAC,CAAC,UAAU,GAAG,EAAE,CAAC,SAAS,CAAC;IAC9C,IAAI,EAAE,CAAC,MAAM,KAAK,QAAQ;QAAE,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC;IACjD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,IAAI,CAAC,GAAkB,EAAE,EAAe,EAAE,MAA4B;IAC7E,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/B,QAAQ,EAAE,CAAC,MAAM,EAAE,CAAC;QAClB,KAAK,gBAAgB;YACnB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,YAAY,EAAE,CAAC;QACxE,KAAK,gBAAgB;YACnB,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;QAC7E,KAAK,kBAAkB;YACrB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,SAAS,EAAE,CAAC;QACrE,KAAK,WAAW;YACd,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC5B,KAAK,OAAO,CAAC;QACb,KAAK,QAAQ,CAAC;QACd,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,qGAAqG;YACrG,0DAA0D;YAC1D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,KAAK,mBAAmB,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,CAAC,gBAAgB,CAAC,CAAC;YAC1G,MAAM,CAAC,GAA4B,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YACzE,IAAI,OAAO;gBAAE,CAAC,CAAC,GAAG,GAAG,GAAG,IAAI,aAAa,EAAE,CAAC,cAAc,EAAE,CAAC;YAC7D,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,cAAc,CAAC,EAAe,EAAE,MAAqB,EAAE,YAA2B;IAChG,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QACzB,IAAI,EAAE,CAAC,oBAAoB,IAAI,CAAC,KAAK,EAAE,CAAC,oBAAoB;YAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QACjH,IAAI,EAAE,CAAC,iBAAiB,IAAI,CAAC,KAAK,EAAE,CAAC,iBAAiB;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACnF,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,eAAe,EAAE,SAAS,EAAE,EAAE,kBAAkB,EAAE,8BAA8B,EAAE,CAAC,CAAC;IAChH,CAAC;IACD,IAAI,YAAY,IAAI,EAAE,CAAC,iBAAiB,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,iBAAiB;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACtH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1B,CAAC;AAED,0DAA0D;AAC1D;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAkB,EAAE,EAAe,EAAE,MAAc,EAAE,OAA4B,EAAE,GAAG,GAAG,GAAG,CAAC,GAAG,EAAE;IAC9H,MAAM,GAAG,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACrC,MAAM,MAAM,GAAyB,mBAAmB,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,IAAI;QAC/H,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;IAC9H,MAAM,MAAM,GAAyB,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACzH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC;AAED,uHAAuH;AACvH,SAAS,iBAAiB,CAAC,GAAkB,EAAE,EAAe,EAAE,MAAc,EAAE,YAAY,GAAG,KAAK;IAClG,MAAM,GAAG,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACrC,MAAM,cAAc,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,IAAI;QAC1I,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAClG,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,kBAAkB;QACrC,mBAAmB,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,SAAS;QACxD,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;QAClD,cAAc;QACd,YAAY,EAAE,EAAE,CAAC,MAAM,KAAK,OAAO,IAAI,EAAE,CAAC,aAAa;KACxD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAc;IACpD,IAAI,MAAM,CAAC,IAAI,KAAK,mBAAmB;QAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,eAAe,EAAE,SAAS,EAAE,EAAE,kBAAkB,EAAE,8BAA8B,EAAE,CAAC,CAAC;AACzJ,CAAC;AACD,MAAM,UAAU,WAAW,CAAC,EAAe;IACzC,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,GAAkB,EAAE,MAAmB,EAAE,MAAc,EAAE,IAAa;IACjG,MAAM,EAAE,GAAG,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,CAAC,CAAC;IAChB,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;QAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,iBAAiB,EAAE,oBAAoB,CAAC,CAAC;IACnI,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC;IAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,SAAS,CAAC;IACxB,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC,GAAG,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC;IAEvE,+BAA+B;IAC/B,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW;QAAE,MAAM,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAC7E,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,CAAC,eAAe,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAY,CAAC;QAAE,MAAM,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAClF,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,aAAa,CAAC;QAAE,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7D,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,GAAG,CAAC,cAAc,CAAC,CAAC;IAC9D,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAU;QAAE,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,MAAM,GAAG,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;IACnI,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3E,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG;QAAE,MAAM,GAAG,CAAC,qCAAqC,CAAC,CAAC;IACrH,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,MAAM,GAAG,CAAC,eAAe,CAAC,CAAC;IAExC,2BAA2B;IAC3B,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7D,IAAI,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,aAAa,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAClJ,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,SAAS;QAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IACnI,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO;QAAE,MAAM,GAAG,CAAC,4BAA4B,CAAC,CAAC,CAAC,+BAA+B;IAEpG,qBAAqB;IACrB,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,GAAG,EAAE,MAAM,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IACjD,CAAC;IAED,kBAAkB;IAClB,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;IACnD,IAAI,OAAO,CAAC,GAAG,KAAK,GAAG,CAAC,MAAM;QAAE,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,OAAO,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE;QAAE,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,EAAE,CAAC,MAAM,KAAK,gBAAgB,IAAI,OAAO,CAAC,KAAK,KAAK,EAAE,CAAC,SAAS,EAAE,CAAC;QACrE,IAAI,EAAE,CAAC,MAAM,KAAK,gBAAgB;YAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;QACpF,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,MAAM,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAC1F,IAAI,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC,QAAQ;QAAE,MAAM,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAC9D,IAAI,GAAG,IAAI,GAAG;QAAE,MAAM,GAAG,CAAC,SAAS,CAAC,CAAC;IACrC,IAAI,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC,QAAQ,IAAI,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC,MAAM;QAAE,MAAM,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACpF,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,GAAG,CAAC,cAAc,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,iBAAiB,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,iBAAiB,KAAK,SAAS;QAAE,MAAM,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC9H,IAAI,OAAO,CAAC,kBAAkB,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,kBAAkB,KAAK,SAAS;QAAE,MAAM,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAEjI,sBAAsB;IACtB,IAAI,EAAE,CAAC,SAAS,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC;QAAE,MAAM,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACjG,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,GAAG,KAAK,GAAG,CAAC,QAAQ;QAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IACrG,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE,KAAK,CAAC,oBAAoB,EAAE,cAAc,EAAE,OAAO,EAAE,oBAAoB,IAAI,CAAC,EAAE,CAAC;IAEhO,KAAK,IAAI,OAAO,GAAG,EAAE,IAAM,CAAC;QAC1B,+GAA+G;QAC/G,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;QACnF,IAAI,OAAO,CAAC,MAAM,KAAK,gBAAgB;YAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;QACzF,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,SAAS;YAAE,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC;QAE5D,6GAA6G;QAC7G,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/D,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,UAAU,KAAK,GAAG,CAAC,UAAU,IAAI,UAAU,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ;YAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAE9I,2EAA2E;QAC3E,IAAI,IAAI,GAAgB;YACtB,GAAG,OAAO;YACV,SAAS,EAAE,SAAS;YACpB,GAAG,OAAO;YACV,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU,EAAE,GAAG;YACf,gBAAgB,EAAE,OAAO,CAAC,iBAAiB,KAAK,IAAI;YACpD,gBAAgB,EAAE,OAAO,CAAC,kBAAkB,KAAK,IAAI;YACrD,oBAAoB,EAAE,MAAM,CAAC,KAAK,CAAC;SACpC,CAAC;QACF,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,uHAAuH;QACvH,IAAI,OAAO,EAAE,MAAM,KAAK,UAAU;YAAE,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;;YAClF,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAClH,IAAI,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,GAAG,iBAAiB,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,kBAAkB,EAAE,UAAU,CAAC,WAAW,CAAC,WAAW,EAAE,eAAe,EAAE,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC;YAChO,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC7B,CAAC;QACD,OAAO,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,KAAK,UAAU,KAAK,CAAC,GAAkB,EAAE,EAAe,EAAE,MAAc,EAAE,UAAmB,EAAE,OAAe;IAC5G,MAAM,IAAI,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC;IACvB,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,IAAI,UAAU,EAAE,CAAC;QACf,mHAAmH;QACnH,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;IAC7I,CAAC;IACD,IAAI,CAAC,wBAAwB,GAAG,UAAU,IAAI,CAAC,UAAU,CAAC;IAC1D,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,MAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC7G,oHAAoH;IACpH,MAAM,iBAAiB,GAAG,MAAM,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC;IACpE,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,IAAI,MAAM,KAAK,IAAI,CAAC;IAC9D,IAAI,CAAC,aAAa,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC;IACxE,IAAI,CAAC,aAAa,GAAG,OAAO,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,CAAC;IAC9D,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,CAAC,iBAAiB;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,kBAAkB,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;IAC3I,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,CAAC,wBAAwB;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,sBAAsB,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;IACtJ,IAAI,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,gBAAgB,CAAC;QAC/B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc;IACnG,CAAC;SAAM,IAAI,IAAI,CAAC,iBAAiB;QAAE,IAAI,CAAC,MAAM,GAAG,kBAAkB,CAAC;;QAC/D,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC;IAC3B,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;AAClF,CAAC;AAED,sHAAsH;AACtH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,GAAkB,EAAE,MAAmB,EAAE,MAAc,EAAE,MAAc,EAAE,IAAa;IACjH,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC,mDAAmD;IACpF,KAAK,IAAI,OAAO,GAAG,MAAM,IAAM,CAAC;QAC9B,IAAI,MAAM,CAAC,SAAS,KAAK,OAAO,CAAC,oBAAoB;YAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,eAAe,EAAE,SAAS,EAAE,EAAE,kBAAkB,EAAE,8BAA8B,EAAE,CAAC,CAAC;QACrK,WAAW,CAAC,OAAO,CAAC,CAAC;QACrB,IAAI,OAAO,CAAC,MAAM,KAAK,kBAAkB;YAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,iBAAiB,EAAE,0BAA0B,CAAC,CAAC;QACpH,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,iBAAiB,EAAE,gCAAgC,CAAC,CAAC;QACpK,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC;QACxC,MAAM,IAAI,GAAgB,KAAK;YAC7B,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,wBAAwB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,EAAE;YACjH,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;QAC/C,IAAI,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,GAAG,iBAAiB,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,oBAAoB,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;YACzI,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED,wGAAwG;AACxG,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAkB,EAAE,MAAmB,EAAE,MAAc,EAAE,OAAe,EAAE,QAAiB;IAC7H,KAAK,IAAI,OAAO,GAAG,MAAM,IAAM,CAAC;QAC9B,WAAW,CAAC,OAAO,CAAC,CAAC;QACrB,IAAI,OAAO,CAAC,MAAM,KAAK,gBAAgB;YAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,iBAAiB,EAAE,4BAA4B,CAAC,CAAC;QACpH,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO;YAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;QAClF,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,QAAQ;YAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,iBAAiB,EAAE,oCAAoC,CAAC,CAAC;QACxI,MAAM,IAAI,GAAgB,QAAQ,KAAK,QAAQ;YAC7C,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,CAAC;YACjD,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,wBAAwB,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QACtH,IAAI,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,iBAAiB,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;YACnF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,GAAkB,EAAE,EAAU;IAClD,OAAO,eAAe,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AAClC,CAAC;AAID;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,GAAkB,EAAE,MAAmB,EAAE,MAAc,EAAE,MAAc;IAChG,KAAK,IAAI,EAAE,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC,IAAM,CAAC;QACxD,IAAI,MAAM,CAAC,IAAI,KAAK,mBAAmB,IAAI,MAAM,CAAC,SAAS,KAAK,EAAE,CAAC,oBAAoB;YAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,eAAe,EAAE,SAAS,EAAE,EAAE,kBAAkB,EAAE,8BAA8B,EAAE,CAAC,CAAC;QACvM,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,KAAK,mBAAmB,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,CAAC,gBAAgB,CAAC,CAAC;QAC1G,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,eAAe,EAAE,SAAS,EAAE,EAAE,kBAAkB,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAC5H,IAAI,MAAM,KAAK,EAAE,CAAC,cAAc;YAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;QACnF,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC;QAClC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,EAAE,CAAC,MAAM,KAAK,WAAW;YAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;QAChF,IAAI,EAAE,CAAC,MAAM,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACtD,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;YACjD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACnC,IAAI,WAAW;gBAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC;YACtE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9B,CAAC;QACD,IAAI,EAAE,CAAC,MAAM,KAAK,OAAO;YAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,iBAAiB,EAAE,0BAA0B,CAAC,CAAC;QACpG,MAAM,IAAI,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QAClE,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,EAAE;YACtE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW;YAC1F,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM;YACzE,MAAM,EAAE,IAAI,CAAC,MAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAI,EAAE,aAAa,EAAE,IAAI,CAAC,aAAc;YACxE,QAAQ,EAAE,IAAI,CAAC,QAAS,EAAE,YAAY,EAAE,IAAI,CAAC,YAAa,EAAE,cAAc,EAAE,IAAI,CAAC,cAAe;YAChG,QAAQ,EAAE,IAAI,CAAC,UAAW,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK;SACnH,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5E,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACnD,EAAE,GAAG,SAAS,IAAI,MAAM,eAAe,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;YACpD,SAAS;QACX,CAAC;QACD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACjC,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,yBAAyB;AACzB,MAAM,UAAU,aAAa,CAAC,EAAe;IAC3C,IAAI,EAAE,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,qBAAqB,EAAE,CAAC;IACnG,QAAQ,EAAE,CAAC,MAAM,EAAE,CAAC;QAClB,KAAK,gBAAgB;YACnB,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;QACnE,KAAK,kBAAkB;YACrB,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;QACvC,KAAK,sBAAsB;YACzB,OAAO,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;QAC3C,KAAK,gBAAgB;YACnB,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;QACrC,KAAK,sBAAsB;YACzB,OAAO,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;QAC3C;YACE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;IACtC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAW,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC3D,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,GAAW,EAAW,EAAE,CAChD,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,MAA4B,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAY,CAAC"}

package/dist/util.d.ts

@@ -0,0 +1,29 @@
+export declare const b64u: (buf: Uint8Array) => string;
+/** Random bearer secret: 256 bits, base64url (N_ENTROPY is 128 bits). */
+export declare const randomSecret: () => string;
+/** Random identifier: 128 bits, base64url, 22 characters. */
+export declare const randomId: () => string;
+export declare const sha256: (s: string) => string;
+export declare const nowSeconds: () => number;
+export declare function safeEqual(a: string, b: string): boolean;
+/** Section 2.1: local "@" domain; local is RFC 5322 dot-atom-text, ASCII; domain as lower-case A-labels. */
+export interface Handle {
+    handle: string;
+    local: string;
+    domain: string;
+}
+export declare function parseHandle(input: string): Handle | null;
+/** Section 2.1 and RFC 7565 Section 7: the `acct:` URI of a handle, with octets of `local` outside `userpart` percent-encoded. */
+export declare function acctUri(handle: string): string;
+/** The handle named by an `acct:` URI, or null. The userpart is percent-decoded once; the host is not. */
+export declare function parseAcctUri(uri: string): Handle | null;
+/** Equality per Section 2.1: local octet-equal, domains equal after lower-casing. */
+export declare function handlesEqual(a: string, b: string): boolean;
+/** Section 2.4 `handle_domains`: exact match, or `*.example.com` matching one or more labels below example.com. */
+export declare function domainServed(domain: string, handleDomains: string[]): boolean;
+/** Section 5.3: JSON is chosen when application/json is the highest-weighted acceptable type and outranks text/html. */
+export declare function prefersJson(accept: string | undefined): boolean;
+export declare function parseBearer(authorization: string | undefined): string | null;
+/** Section 4.1.9 of RFC 7515: `typ` compared case-insensitively, with an implied `application/` prefix. */
+export declare function typMatches(typ: unknown, expected: string): boolean;
+export declare function isPlainObject(v: unknown): v is Record<string, unknown>;

package/dist/util.js

@@ -0,0 +1,113 @@
+// Small helpers shared by the issuer: randomness, hashing, time, handles, Accept negotiation.
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+export const b64u = (buf) => Buffer.from(buf).toString('base64url');
+/** Random bearer secret: 256 bits, base64url (N_ENTROPY is 128 bits). */
+export const randomSecret = () => b64u(randomBytes(32));
+/** Random identifier: 128 bits, base64url, 22 characters. */
+export const randomId = () => b64u(randomBytes(16));
+export const sha256 = (s) => createHash('sha256').update(s).digest('base64url');
+export const nowSeconds = () => Math.floor(Date.now() / 1000);
+export function safeEqual(a, b) {
+    const ab = Buffer.from(a);
+    const bb = Buffer.from(b);
+    return ab.length === bb.length && timingSafeEqual(ab, bb);
+}
+const ATEXT = /^[A-Za-z0-9!#$%&'*+\-/=?^_`{|}~]+(\.[A-Za-z0-9!#$%&'*+\-/=?^_`{|}~]+)*$/;
+const LABEL = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/;
+export function parseHandle(input) {
+    if (typeof input !== 'string' || input.length > 254)
+        return null;
+    const at = input.lastIndexOf('@');
+    if (at <= 0 || at === input.length - 1)
+        return null;
+    const local = input.slice(0, at);
+    const domain = input.slice(at + 1).toLowerCase();
+    if (Buffer.byteLength(local) > 64 || !ATEXT.test(local))
+        return null;
+    if (domain.length > 253)
+        return null;
+    const labels = domain.split('.');
+    if (labels.length < 2 || !labels.every((l) => LABEL.test(l)))
+        return null;
+    return { handle: `${local}@${domain}`, local, domain };
+}
+/** Section 2.1 and RFC 7565 Section 7: the `acct:` URI of a handle, with octets of `local` outside `userpart` percent-encoded. */
+export function acctUri(handle) {
+    const at = handle.lastIndexOf('@');
+    const userpart = [...Buffer.from(handle.slice(0, at), 'utf8')].map((b) => (/[A-Za-z0-9\-._~!$&'()*+,;=]/.test(String.fromCharCode(b)) ? String.fromCharCode(b) : `%${b.toString(16).toUpperCase().padStart(2, '0')}`)).join('');
+    return `acct:${userpart}@${handle.slice(at + 1)}`;
+}
+/** The handle named by an `acct:` URI, or null. The userpart is percent-decoded once; the host is not. */
+export function parseAcctUri(uri) {
+    if (!uri.startsWith('acct:'))
+        return null;
+    const rest = uri.slice(5);
+    const at = rest.lastIndexOf('@');
+    if (at <= 0)
+        return null;
+    let local;
+    try {
+        local = decodeURIComponent(rest.slice(0, at));
+    }
+    catch {
+        return null;
+    }
+    return parseHandle(`${local}@${rest.slice(at + 1)}`);
+}
+/** Equality per Section 2.1: local octet-equal, domains equal after lower-casing. */
+export function handlesEqual(a, b) {
+    const pa = parseHandle(a);
+    const pb = parseHandle(b);
+    return !!pa && !!pb && pa.local === pb.local && pa.domain === pb.domain;
+}
+/** Section 2.4 `handle_domains`: exact match, or `*.example.com` matching one or more labels below example.com. */
+export function domainServed(domain, handleDomains) {
+    return handleDomains.some((d) => (d.startsWith('*.') ? domain.endsWith(d.slice(1)) && domain.length > d.length - 1 : d === domain));
+}
+/** Section 5.3: JSON is chosen when application/json is the highest-weighted acceptable type and outranks text/html. */
+export function prefersJson(accept) {
+    if (!accept)
+        return false;
+    let json = 0;
+    let html = 0;
+    for (const part of accept.split(',')) {
+        const [typeRaw, ...params] = part.trim().split(';');
+        const type = (typeRaw ?? '').trim().toLowerCase();
+        let q = 1;
+        for (const p of params) {
+            const [k, v] = p.trim().split('=');
+            if (k?.trim() === 'q' && v !== undefined)
+                q = Number.parseFloat(v) || 0;
+        }
+        if (type === 'application/json')
+            json = Math.max(json, q);
+        else if (type === 'text/html')
+            html = Math.max(html, q);
+        else if (type === 'application/*')
+            json = Math.max(json, q * 0.999);
+        else if (type === 'text/*')
+            html = Math.max(html, q * 0.999);
+        else if (type === '*/*') {
+            json = Math.max(json, q * 0.998);
+            html = Math.max(html, q * 0.998);
+        }
+    }
+    return json > 0 && json > html;
+}
+export function parseBearer(authorization) {
+    if (!authorization)
+        return null;
+    const m = /^Bearer\s+([A-Za-z0-9\-._~+/]+=*)$/i.exec(authorization.trim());
+    return m ? m[1] : null;
+}
+/** Section 4.1.9 of RFC 7515: `typ` compared case-insensitively, with an implied `application/` prefix. */
+export function typMatches(typ, expected) {
+    if (typeof typ !== 'string')
+        return false;
+    const t = typ.toLowerCase();
+    return t === expected || t === `application/${expected}`;
+}
+export function isPlainObject(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+//# sourceMappingURL=util.js.map

package/dist/util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"util.js","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvE,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,GAAe,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAExF,yEAAyE;AACzE,MAAM,CAAC,MAAM,YAAY,GAAG,GAAW,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;AAChE,6DAA6D;AAC7D,MAAM,CAAC,MAAM,QAAQ,GAAG,GAAW,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;AAC5D,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAChG,MAAM,CAAC,MAAM,UAAU,GAAG,GAAW,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AAEtE,MAAM,UAAU,SAAS,CAAC,CAAS,EAAE,CAAS;IAC5C,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,OAAO,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,IAAI,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AAC5D,CAAC;AAID,MAAM,KAAK,GAAG,yEAAyE,CAAC;AACxF,MAAM,KAAK,GAAG,sCAAsC,CAAC;AACrD,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IACjE,MAAM,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1E,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,IAAI,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACzD,CAAC;AACD,kIAAkI;AAClI,MAAM,UAAU,OAAO,CAAC,MAAc;IACpC,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,6BAA6B,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChO,OAAO,QAAQ,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;AACpD,CAAC;AACD,0GAA0G;AAC1G,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,WAAW,CAAC,GAAG,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;AACvD,CAAC;AACD,qFAAqF;AACrF,MAAM,UAAU,YAAY,CAAC,CAAS,EAAE,CAAS;IAC/C,MAAM,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC1B,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,CAAC;AAC1E,CAAC;AACD,mHAAmH;AACnH,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,aAAuB;IAClE,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC;AACtI,CAAC;AAED,wHAAwH;AACxH,MAAM,UAAU,WAAW,CAAC,MAA0B;IACpD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAClD,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,KAAK,SAAS;gBAAE,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,IAAI,KAAK,kBAAkB;YAAE,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;aACrD,IAAI,IAAI,KAAK,WAAW;YAAE,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;aACnD,IAAI,IAAI,KAAK,eAAe;YAAE,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC;aAC/D,IAAI,IAAI,KAAK,QAAQ;YAAE,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC;aACxD,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YACxB,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC;YACjC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,IAAI,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,aAAiC;IAC3D,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,CAAC,GAAG,qCAAqC,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3E,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1B,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,UAAU,CAAC,GAAY,EAAE,QAAgB;IACvD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAC5B,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,eAAe,QAAQ,EAAE,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,CAAU;IACtC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC"}