@bitspark/archon-server 0.8.2 → 0.10.0

package/dist/src/enroll.d.ts

@@ -0,0 +1,88 @@
+/** How long a pending enrollment lives, in seconds, when the config names no ttl. */
+export declare const ENROLL_DEFAULT_TTL_SECONDS = 300;
+/** A pending enrollment: written once by `prepare`, persisted by the service, never changed —
+ *  completion consumes it, it does not edit it. */
+export interface EnrollmentRecord {
+    transaction: Uint8Array;
+    /** What authorized the enrollment: the session, or the bootstrap credential reserved to this
+     *  record. An identifier, never a secret — a session's id, not its cookie — since the record
+     *  is stored. */
+    authorization: Uint8Array;
+    /** The intended account, opaque to archon. */
+    account: Uint8Array;
+    purpose: string;
+    newKey: Uint8Array;
+    nonce: Uint8Array;
+    /** SHA-256 of the service's immutable intent bytes. */
+    intentDigest: Uint8Array;
+    /** Seconds since the epoch. */
+    expires: number;
+}
+/** What the client needs to prove: the record's public half and the audience. */
+export interface EnrollmentChallenge {
+    transaction: Uint8Array;
+    nonce: Uint8Array;
+    purpose: string;
+    audience: string;
+    intentDigest: Uint8Array;
+    expires: number;
+}
+/** What the service supplies to `prepare`, after validating the authorizing credential. */
+export interface EnrollmentBegin {
+    authorization: Uint8Array;
+    account: Uint8Array;
+    purpose: string;
+    newKey: Uint8Array;
+    /** The immutable intent bytes — what the service will record. archon binds their digest and
+     *  never interprets them. A digest is not confidentiality: keep guessable account data out. */
+    intent: Uint8Array;
+}
+export type EnrollmentOutcome = "completed" | "notPending" | "unavailable";
+/** The service's authorizing integration: its persistence of pending records and its atomic
+ *  completion. */
+export interface EnrollmentIntegration {
+    /** The record for `transaction`, or undefined when there is none. A throw means it cannot
+     *  answer, and the completion fails closed. */
+    load(transaction: Uint8Array): EnrollmentRecord | undefined | Promise<EnrollmentRecord | undefined>;
+    /**
+     * The service's atomic business operation. In one persistence transaction it checks that
+     * `record` is still pending and its authorizing context still acceptable under the service's
+     * policy, records `record.newKey` as `record.account`'s for `record.purpose`, and consumes the
+     * record (and any bootstrap credential reserved to it). Concurrent calls for one record answer
+     * "completed" at most once.
+     */
+    complete(record: EnrollmentRecord): EnrollmentOutcome | Promise<EnrollmentOutcome>;
+}
+export interface EnrollerConfig {
+    /** The configured audience every binding is rebuilt from (docs/request.md §2). */
+    audience: string;
+    /** Required: without it, possession alone would suffice. */
+    integration: EnrollmentIntegration;
+    /** Seconds; defaults to ENROLL_DEFAULT_TTL_SECONDS. */
+    ttl?: number;
+    /** Seconds since the epoch; defaults to the system clock. */
+    clock?: () => number;
+    entropy?: (n: number) => Uint8Array;
+}
+/** Why a completion failed, with the HTTP status a service's route answers: 400 for a malformed
+ *  completion, 401 for a proof that does not verify, 403 for a completion under another
+ *  authorization, 404 for an unknown or expired transaction, 409 for one already completed or no
+ *  longer eligible, 503 when the integration cannot answer. */
+export declare class EnrollmentRefusal extends Error {
+    readonly status: number;
+    constructor(status: number, message: string);
+}
+/** Prepares and completes enrollments under one configuration. */
+export declare class Enroller {
+    #private;
+    constructor(config: EnrollerConfig);
+    /** The pending record for `begin`, and the challenge to send the client. The service persists
+     *  the record; nothing here stores it. */
+    prepare(begin: EnrollmentBegin): Promise<{
+        record: EnrollmentRecord;
+        challenge: EnrollmentChallenge;
+    }>;
+    /** Complete the enrollment `transaction` names, under `authorization`, with `proof`. Returns
+     *  the completed record; throws an EnrollmentRefusal. */
+    complete(transaction: Uint8Array, proof: Uint8Array, authorization: Uint8Array): Promise<EnrollmentRecord>;
+}

package/dist/src/enroll.js

@@ -0,0 +1,157 @@
+// The server's half of key enrollment (ADR 0010 §7; docs/request.md §6, version 1, fixed by
+// ADR 0010's status note of 4 October 2026).
+//
+// An enrollment has a new key prove its own possession while a separate authority — the
+// service's session, or a bootstrap credential — says whose key it is. The sdk holds the binding
+// and the proof. This module holds what only a server can, in two halves:
+//
+// - `prepare` builds the PENDING RECORD, the immutable association of authorizing context,
+//   intended account, purpose, new key, a fresh nonce, the intent's digest and an expiry. The
+//   service calls it only after validating the session or bootstrap credential, persists the
+//   record in its own transaction (reserving a bootstrap credential to it atomically, when there
+//   is one), and sends the client the challenge.
+// - `complete` takes what a completion request carries — the transaction id and the proof — and
+//   the authorization the service extracted from that request. It checks, in order: the record
+//   exists and has not expired; the same authorization began it; the proof verifies under the
+//   record's new key, over the binding rebuilt from the record and the configured audience. Only
+//   then does it call the integration's `complete`, the service's ATOMIC business operation: the
+//   key-account association recorded and the record consumed, in one persistence transaction.
+//   archon cannot promise that atomicity across a callback and a separate database (ADR 0010
+//   §7), so it does not pretend to: the operation is the service's.
+//
+// There is NO "possession alone suffices" mode: the constructor refuses a missing integration.
+// Possession identifies a key; only the service's authority ties it to an account. And a
+// completion cannot substitute anything: it names a record, and the account, key, purpose, nonce
+// and intent all come from that record.
+//
+// archon defines no enrollment route. The service mounts completion wherever it serves its
+// accounts, behind its own session and CSRF protection.
+import { ENROLL_DIGEST_SIZE, ENROLL_MAX_TRANSACTION_SIZE, MIN_NONCE_SIZE, enrollBinding, verifyEnroll } from "@bitspark/archon-sdk";
+/** How long a pending enrollment lives, in seconds, when the config names no ttl. */
+export const ENROLL_DEFAULT_TTL_SECONDS = 300;
+/** The generated transaction id's and nonce's size: the possession scheme's floor, and enough
+ *  that an id is not guessable. */
+const ID_SIZE = MIN_NONCE_SIZE;
+/** Why a completion failed, with the HTTP status a service's route answers: 400 for a malformed
+ *  completion, 401 for a proof that does not verify, 403 for a completion under another
+ *  authorization, 404 for an unknown or expired transaction, 409 for one already completed or no
+ *  longer eligible, 503 when the integration cannot answer. */
+export class EnrollmentRefusal extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
+function equal(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a[i] ^ b[i];
+    return diff === 0;
+}
+function request(r) {
+    return { nonce: r.nonce, transaction: r.transaction, purpose: r.purpose, newKey: r.newKey, intentDigest: r.intentDigest };
+}
+/** Prepares and completes enrollments under one configuration. */
+export class Enroller {
+    #audience;
+    #integration;
+    #ttl;
+    #clock;
+    #entropy;
+    constructor(config) {
+        if (config.integration === undefined || config.integration === null) {
+            throw new Error("enroll: an integration is required — possession identifies a key; only the service's authority ties it to an account");
+        }
+        // The binding's audience rules, checked once here rather than failing every completion.
+        enrollBinding(config.audience, {
+            nonce: new Uint8Array(ID_SIZE),
+            transaction: new Uint8Array(1),
+            purpose: "add-key",
+            newKey: new Uint8Array(32),
+            intentDigest: new Uint8Array(ENROLL_DIGEST_SIZE),
+        });
+        this.#audience = config.audience;
+        this.#integration = config.integration;
+        this.#ttl = config.ttl ?? ENROLL_DEFAULT_TTL_SECONDS;
+        this.#clock = config.clock ?? (() => Math.floor(Date.now() / 1000));
+        this.#entropy = config.entropy ?? ((n) => crypto.getRandomValues(new Uint8Array(n)));
+    }
+    /** The pending record for `begin`, and the challenge to send the client. The service persists
+     *  the record; nothing here stores it. */
+    async prepare(begin) {
+        if (begin.authorization.length === 0)
+            throw new Error("enroll: an enrollment needs the authorization that began it");
+        if (begin.account.length === 0)
+            throw new Error("enroll: an enrollment needs the account it is for");
+        const intent = new Uint8Array(begin.intent);
+        const record = {
+            transaction: this.#entropy(ID_SIZE).slice(),
+            authorization: begin.authorization.slice(),
+            account: begin.account.slice(),
+            purpose: begin.purpose,
+            newKey: begin.newKey.slice(),
+            nonce: this.#entropy(ID_SIZE).slice(),
+            intentDigest: new Uint8Array(await crypto.subtle.digest("SHA-256", intent)),
+            expires: this.#clock() + this.#ttl,
+        };
+        // The sdk's binding rules, refused here rather than at completion.
+        enrollBinding(this.#audience, request(record));
+        return {
+            record,
+            challenge: {
+                transaction: record.transaction,
+                nonce: record.nonce,
+                purpose: record.purpose,
+                audience: this.#audience,
+                intentDigest: record.intentDigest,
+                expires: record.expires,
+            },
+        };
+    }
+    /** Complete the enrollment `transaction` names, under `authorization`, with `proof`. Returns
+     *  the completed record; throws an EnrollmentRefusal. */
+    async complete(transaction, proof, authorization) {
+        if (transaction.length === 0 || transaction.length > ENROLL_MAX_TRANSACTION_SIZE) {
+            throw new EnrollmentRefusal(400, "enroll: malformed transaction id");
+        }
+        let record;
+        try {
+            record = await this.#integration.load(transaction);
+        }
+        catch {
+            throw new EnrollmentRefusal(503, "enroll: the integration cannot load");
+        }
+        if (record === undefined)
+            throw new EnrollmentRefusal(404, "enroll: unknown or expired transaction");
+        // A record for another transaction is an integration fault, and is never verified against.
+        if (!equal(record.transaction, transaction)) {
+            throw new EnrollmentRefusal(503, "enroll: the integration returned another transaction's record");
+        }
+        if (this.#clock() >= record.expires)
+            throw new EnrollmentRefusal(404, "enroll: unknown or expired transaction");
+        // The same authorization that began it — checked before the proof, so a stranger's
+        // completion learns nothing about it.
+        if (authorization.length === 0 || !equal(record.authorization, authorization)) {
+            throw new EnrollmentRefusal(403, "enroll: not the authorization that began this enrollment");
+        }
+        if (!verifyEnroll(this.#audience, request(record), proof)) {
+            throw new EnrollmentRefusal(401, "enroll: the proof does not verify");
+        }
+        let outcome;
+        try {
+            outcome = await this.#integration.complete(record);
+        }
+        catch {
+            outcome = "unavailable";
+        }
+        if (outcome === "completed")
+            return record;
+        if (outcome === "notPending")
+            throw new EnrollmentRefusal(409, "enroll: already completed or no longer eligible");
+        throw new EnrollmentRefusal(503, "enroll: the integration cannot complete");
+    }
+}
+//# sourceMappingURL=enroll.js.map

package/dist/src/enroll.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enroll.js","sourceRoot":"","sources":["../../src/enroll.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,6CAA6C;AAC7C,EAAE;AACF,wFAAwF;AACxF,iGAAiG;AACjG,0EAA0E;AAC1E,EAAE;AACF,2FAA2F;AAC3F,8FAA8F;AAC9F,6FAA6F;AAC7F,iGAAiG;AACjG,iDAAiD;AACjD,gGAAgG;AAChG,+FAA+F;AAC/F,8FAA8F;AAC9F,iGAAiG;AACjG,iGAAiG;AACjG,8FAA8F;AAC9F,6FAA6F;AAC7F,oEAAoE;AACpE,EAAE;AACF,+FAA+F;AAC/F,yFAAyF;AACzF,iGAAiG;AACjG,wCAAwC;AACxC,EAAE;AACF,2FAA2F;AAC3F,wDAAwD;AACxD,OAAO,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAsB,MAAM,sBAAsB,CAAC;AAExJ,qFAAqF;AACrF,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAE9C;mCACmC;AACnC,MAAM,OAAO,GAAG,cAAc,CAAC;AAwE/B;;;+DAG+D;AAC/D,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAE/B,MAAM;IADjB,YACW,MAAc,EACvB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;sBAHN,MAAM;IAIjB,CAAC;CACF;AAED,SAAS,KAAK,CAAC,CAAa,EAAE,CAAa;IACzC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IACzD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,OAAO,CAAC,CAAmB;IAClC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC;AAC5H,CAAC;AAED,kEAAkE;AAClE,MAAM,OAAO,QAAQ;IACV,SAAS,CAAS;IAClB,YAAY,CAAwB;IACpC,IAAI,CAAS;IACb,MAAM,CAAe;IACrB,QAAQ,CAA4B;IAE7C,YAAY,MAAsB;QAChC,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CAAC,sHAAsH,CAAC,CAAC;QAC1I,CAAC;QACD,wFAAwF;QACxF,aAAa,CAAC,MAAM,CAAC,QAAQ,EAAE;YAC7B,KAAK,EAAE,IAAI,UAAU,CAAC,OAAO,CAAC;YAC9B,WAAW,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC;YAC9B,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,IAAI,UAAU,CAAC,EAAE,CAAC;YAC1B,YAAY,EAAE,IAAI,UAAU,CAAC,kBAAkB,CAAC;SACjD,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,GAAG,IAAI,0BAA0B,CAAC;QACrD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvF,CAAC;IAED;8CAC0C;IAC1C,KAAK,CAAC,OAAO,CAAC,KAAsB;QAClC,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACrH,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACrG,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAqB;YAC/B,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE;YAC3C,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,KAAK,EAAE;YAC1C,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE;YAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE;YAC5B,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE;YACrC,YAAY,EAAE,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YAC3E,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI;SACnC,CAAC;QACF,mEAAmE;QACnE,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/C,OAAO;YACL,MAAM;YACN,SAAS,EAAE;gBACT,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,QAAQ,EAAE,IAAI,CAAC,SAAS;gBACxB,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB;SACF,CAAC;IACJ,CAAC;IAED;6DACyD;IACzD,KAAK,CAAC,QAAQ,CAAC,WAAuB,EAAE,KAAiB,EAAE,aAAyB;QAClF,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,MAAM,GAAG,2BAA2B,EAAE,CAAC;YACjF,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,kCAAkC,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,MAAoC,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,qCAAqC,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,wCAAwC,CAAC,CAAC;QACrG,2FAA2F;QAC3F,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,+DAA+D,CAAC,CAAC;QACpG,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,wCAAwC,CAAC,CAAC;QAChH,mFAAmF;QACnF,sCAAsC;QACtC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,aAAa,CAAC,EAAE,CAAC;YAC9E,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,0DAA0D,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,mCAAmC,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,OAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,aAAa,CAAC;QAC1B,CAAC;QACD,IAAI,OAAO,KAAK,WAAW;YAAE,OAAO,MAAM,CAAC;QAC3C,IAAI,OAAO,KAAK,YAAY;YAAE,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,iDAAiD,CAAC,CAAC;QAClH,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,yCAAyC,CAAC,CAAC;IAC9E,CAAC;CACF"}

package/dist/src/index.d.ts

@@ -1,2 +1,4 @@
 export * from "./login.js";
+export * from "./request.js";
+export * from "./enroll.js";
 export { fromHex, MAX_BODY_BYTES, rfc3339, scanTopLevel, stripMount, toHex } from "./json.js";

package/dist/src/index.js

@@ -7,6 +7,13 @@
 // them. It opens no socket, starts no timer, persists nothing, and interprets no authority:
 // that is ADR 0007 §B, and it is what makes the tier adoptable by a service that has already
 // chosen its stack.
+//
+// It also carries the server's half of request authentication (docs/request.md §7, version 1):
+// a `RequestVerifier` in front of a replay store, under the same constraints. And the server's
+// half of key enrollment (docs/request.md §6, version 1): an `Enroller` that cannot be built
+// without the service's authorizing integration.
 export * from "./login.js";
+export * from "./request.js";
+export * from "./enroll.js";
 export { fromHex, MAX_BODY_BYTES, rfc3339, scanTopLevel, stripMount, toHex } from "./json.js";
 //# sourceMappingURL=index.js.map

package/dist/src/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,EAAE;AACF,+FAA+F;AAC/F,qEAAqE;AACrE,uFAAuF;AACvF,0FAA0F;AAC1F,4FAA4F;AAC5F,6FAA6F;AAC7F,oBAAoB;AACpB,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,EAAE;AACF,+FAA+F;AAC/F,qEAAqE;AACrE,uFAAuF;AACvF,0FAA0F;AAC1F,4FAA4F;AAC5F,6FAA6F;AAC7F,oBAAoB;AACpB,EAAE;AACF,+FAA+F;AAC/F,+FAA+F;AAC/F,6FAA6F;AAC7F,iDAAiD;AACjD,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC"}

package/dist/src/login.d.ts

@@ -7,14 +7,33 @@ export declare const DEFAULT_TTL_SECONDS = 300;
 export declare const DEFAULT_INTERVAL_SECONDS = 5;
 /**
  * Interprets the authority payload — the ONLY place one is interpreted, and archon ships no
- * implementation. THROWING refuses the answer with `403 invalid_grant` and stores nothing.
+ * implementation. It is handed the browser key the delegation is for, the principal that signed
+ * the proof, the opaque payload, and the request the proof is for (`Admitted`: its id and the
+ * scope and validity the person approved, exactly as the proof bound them), so the law evaluates
+ * what was signed rather than what it assumes (#61); a law written for the first three
+ * arguments keeps working. THROWING refuses the answer with `403 invalid_grant` and stores
+ * nothing.
  * Omitting it means the proof alone suffices, which is right for a service whose law needs
  * nothing beyond "this key holder was here and approved this scope".
  *
- * It may be async, and the handler awaits it. See the note on `answer` for why every check it
- * depends on is repeated afterwards.
+ * It may be async, and the handler awaits it. It is called AT MOST ONCE AT A TIME PER
+ * REQUEST, and never for an answer that arrives after another was stored (see `answer`). That
+ * is not an exactly-once boundary: a refused answer's law did run, and a process can stop
+ * after the law returns and before the answer is stored. So it must only validate, or make its
+ * effects idempotent (keyed by the request id it is handed), or leave them until the browser
+ * has collected.
  */
-export type AdmitAuthority = (browser: Uint8Array, principal: Uint8Array, authority: Uint8Array) => void | Promise<void>;
+export type AdmitAuthority = (browser: Uint8Array, principal: Uint8Array, authority: Uint8Array, request: Admitted) => void | Promise<void>;
+/** The request a verified answer is for, as its proof bound it. The law gets copies: nothing it
+ *  does to them reaches the stored request. */
+export interface Admitted {
+    /** The server's request id, unique per login — the key for idempotent effects. */
+    readonly id: Uint8Array;
+    /** The entries the person was shown and approved, in order. */
+    readonly scope: readonly string[];
+    /** The delegation's approved lifetime in seconds. */
+    readonly validFor: number;
+}
 /** Seconds since the Unix epoch. A config field rather than a call to `Date.now()`, which is
  *  the sdk's rule and the reason the suite never sleeps. */
 export type Clock = () => number;

package/dist/src/login.js

@@ -277,6 +277,7 @@ export class Handler {
             expires: this.#clock() + this.ttlSeconds,
             answered: undefined,
             lastPoll: undefined,
+            admission: undefined,
         };
         // A request that cannot produce a binding must not be handed out: the CLI would fetch it,
         // show it, and fail at signing time with nothing to explain.
@@ -481,15 +482,18 @@ export class Handler {
      *
      * THE AWAIT IS THE HAZARD. `AdmitAuthority` is the SERVICE's code and may be async — a
      * database, a network call — and JavaScript hands the runtime to every other pending request
-     * at that `await`. So the state this decision rests on is RE-CHECKED afterwards: a second
-     * CLI answering the same login while the first was being admitted is ordinary (a person with
-     * two terminals), and the loser must get 409 rather than overwrite an answer the browser may
-     * already have collected.
+     * at that `await`. A second CLI answering the same login while the first is being admitted is
+     * ordinary (a person with two terminals), so a verified answer first TAKES THE REQUEST'S
+     * ADMISSION TURN and re-checks the record holding it: one law at a time per request, and none
+     * at all for an answer that arrives after another was stored — it gets 409 without the law
+     * running, where it used to run the law and then lose (#61). A REFUSED answer releases the
+     * turn, so a stranger's refused answer delays the person by the law's running time and never
+     * denies them.
      *
-     * The three server lanes reach the same rule from opposite directions: go and rs must keep
-     * the law OUT of the store's mutex so one slow law cannot decide the throughput of every
-     * login; here there is no mutex to hold, and the danger is the interleaving that an `await`
-     * makes certain rather than merely possible.
+     * The three server lanes reach the same rule from opposite directions: go and rs keep the
+     * law OUT of the store's mutex, behind a per-request turn, so one slow law cannot decide the
+     * throughput of every login; here there is no mutex to hold, and the turn is a promise chained
+     * on the record.
      */
     async #answer(request, idHex) {
         let body;
@@ -533,25 +537,51 @@ export class Handler {
         if (!verifyLogin(principal, this.audience, toRequest(record), possession)) {
             return fail(403, ERR_INVALID_GRANT);
         }
-        if (this.#admit !== undefined) {
-            try {
-                await this.#admit(record.browser, principal, new TextEncoder().encode(authority ?? ""));
+        // Take the turn. Reading the previous holder and installing this one happen with no
+        // `await` between them, so two answers can never both believe they hold it.
+        const previous = record.admission;
+        let release = () => { };
+        const mine = new Promise((resolve) => {
+            release = resolve;
+        });
+        record.admission = mine;
+        try {
+            await previous;
+            // Everything the decision rests on, re-read now that the turn is ours.
+            const live = this.#live(idHex);
+            if (live === undefined)
+                return fail(404, ERR_EXPIRED_TOKEN);
+            if (live.answered !== undefined) {
+                // Another answer was stored while this one waited. Storing here would discard a proof
+                // the browser may already have collected, and running the law for it would be an
+                // admission nobody can use.
+                return fail(409, ERR_INVALID_REQUEST);
             }
-            catch {
-                return fail(403, ERR_INVALID_GRANT);
+            if (this.#admit !== undefined) {
+                try {
+                    await this.#admit(live.browser, principal, new TextEncoder().encode(authority ?? ""), {
+                        id: new Uint8Array(live.id),
+                        scope: [...live.scope],
+                        validFor: live.validFor,
+                    });
+                }
+                catch {
+                    return fail(403, ERR_INVALID_GRANT);
+                }
             }
+            // The record can expire while the law runs. Nothing else can change: only the holder of
+            // the turn stores an answer.
+            const still = this.#live(idHex);
+            if (still === undefined)
+                return fail(404, ERR_EXPIRED_TOKEN);
+            still.answered = { principal: principalText, possession: possessionText, authority };
+            return new Response(null, { status: 204 });
         }
-        // Everything the decision rested on, re-read after the await.
-        const still = this.#live(idHex);
-        if (still === undefined)
-            return fail(404, ERR_EXPIRED_TOKEN);
-        if (still.answered !== undefined) {
-            // Another answer won while this one was being admitted. Storing here would discard a
-            // proof the browser may already have collected.
-            return fail(409, ERR_INVALID_REQUEST);
+        finally {
+            release();
+            if (record.admission === mine)
+                record.admission = undefined;
         }
-        still.answered = { principal: principalText, possession: possessionText, authority };
-        return new Response(null, { status: 204 });
     }
     /**
      * Hands the answer to the browser ONCE and drops the record.

package/dist/src/login.js.map

@@ -1 +1 @@
-{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/login.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,2FAA2F;AAC3F,yFAAyF;AACzF,+DAA+D;AAC/D,EAAE;AACF,qEAAqE;AACrE,0FAA0F;AAC1F,0FAA0F;AAC1F,6FAA6F;AAC7F,4FAA4F;AAC5F,sBAAsB;AACtB,EAAE;AACF,+DAA+D;AAC/D,EAAE;AACF,4DAA4D;AAC5D,oFAAoF;AACpF,kFAAkF;AAClF,+FAA+F;AAC/F,EAAE;AACF,6FAA6F;AAC7F,2FAA2F;AAC3F,6FAA6F;AAC7F,iEAAiE;AACjE,EAAE;AACF,6FAA6F;AAC7F,0FAA0F;AAE1F,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,WAAW,EAAqB,MAAM,sBAAsB,CAAC;AAErI,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAEvG;yFACyF;AACzF,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAC9C,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAC1C,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAC1C,MAAM,WAAW,GAAG,uBAAuB,CAAC;AAC5C,MAAM,aAAa,GAAG,WAAW,CAAC;AAElC;iFACiF;AACjF,MAAM,CAAC,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAE/C,6BAA6B;AAC7B,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AACvC,6BAA6B;AAC7B,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAE1C;;+CAE+C;AAC/C,MAAM,WAAW,GAAG,EAAE,CAAC;AAoFvB;;6EAE6E;AAC7E,SAAS,YAAY,CAAC,KAAY,EAAE,KAAe,EAAE,QAAgB;IACnE,OAAO,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3H,CAAC;AAED,MAAM,YAAY,GAAG,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;AAEzF;;yDAEyD;AACzD,SAAS,IAAI,CAAC,MAAc,EAAE,IAAY;IACxC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,EAAE,CAAC,MAAc,EAAE,IAAa;IACvC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,4FAA4F;AAC5F,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,CAAC,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,MAAe;IAChC,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,OAAO;IACT,QAAQ,CAAS;IACjB,KAAK,CAAS;IACd,IAAI,CAAqB;IACzB,UAAU,CAAS;IACnB,eAAe,CAAS;IACxB,MAAM,CAA6B;IACnC,MAAM,CAAQ;IACd,QAAQ,CAAU;IAClB,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;IACtC,OAAO,GAAG,IAAI,GAAG,EAAiB,CAAC;IAE5C;;;;;;;;;;;;;OAaG;IACH,YAAY,MAAc;QACxB,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,4FAA4F,CAAC,CAAC;QAChH,CAAC;QACD,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,cAAc,CAAC,GAAG,MAAM,CAAC,QAAQ,WAAW,CAAC,CAAC,QAAQ,CAAC;QACnE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,mBAAmB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,MAAM,CAAC,KAAK,CAAC,uBAAuB,CACzG,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACb,mBAAmB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,0CAA0C;gBAC1F,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,6CAA6C;gBACvE,aAAa,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,uBAAuB,CAC9D,CAAC;QACJ,CAAC;QACD,mFAAmF;QACnF,oFAAoF;QACpF,uFAAuF;QACvF,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CACb,eAAe,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,wEAAwE,CACnH,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,mBAAmB,CAAC;QAC3D,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,IAAI,wBAAwB,CAAC;QAC1E,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvF,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,MAAM,CAAC,OAAgB;QAC3B,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACnE,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAE5C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;YACzG,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;YACvH,OAAO,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAW,CAAC;QAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YAChD,IAAI,MAAM,KAAK,MAAM;gBAAE,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACxD,IAAI,MAAM,KAAK,KAAK;gBAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IACtC,CAAC;IAED;;;gBAGY;IACZ,KAAK;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1B,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1C,IAAI,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC1B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC1B,OAAO,IAAI,CAAC,CAAC;YACf,CAAC;QACH,CAAC;QACD,iFAAiF;QACjF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;gBACnC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC1B,OAAO,IAAI,CAAC,CAAC;YACf,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;;sCASkC;IAClC,KAAK,CAAC,MAAM,CAAC,OAAgB;QAC3B,IAAI,IAA6B,CAAC;QAClC,IAAI,CAAC;YACH,CAAC,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC,MAAM,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAClG,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACxC,CAAC;QAED,0FAA0F;QAC1F,yFAAyF;QACzF,0FAA0F;QAC1F,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;QACnC,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACvG,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC,IAAI,QAAQ,GAAG,UAAU,EAAE,CAAC;YAC1G,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,KAAK,IAAI,QAAqB,EAAE,CAAC;YAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;YACrE,IAAI,CAAC;gBACH,eAAe,CAAC,KAAK,CAAC,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;YACxC,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;QACD,uFAAuF;QACvF,+EAA+E;QAC/E,IAAI,SAA6B,CAAC;QAClC,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3B,wFAAwF;YACxF,oFAAoF;YACpF,iFAAiF;YACjF,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;YACpE,uFAAuF;YACvF,sFAAsF;YACtF,6DAA6D;YAC7D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;YACvD,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;YACxD,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC;YAC1C,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;QACD,IAAI,OAAmB,CAAC;QACxB,IAAI,CAAC;YACH,OAAO,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACxC,CAAC;QAED,MAAM,MAAM,GAAY;YACtB,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC9B,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;YACjC,OAAO;YACP,KAAK;YACL,QAAQ;YACR,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU;YACxC,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,SAAS;SACpB,CAAC;QACF,0FAA0F;QAC1F,6DAA6D;QAC7D,IAAI,CAAC;YACH,YAAY,CAAC,gBAAgB,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACxC,CAAC;QAED,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAC1D,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC;QAC5C,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACnC,CAAC;QACD,yFAAyF;QACzF,kFAAkF;QAClF,OAAO,EAAE,CAAC,GAAG,EAAE;YACb,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC;YAC1B,OAAO,EAAE,WAAW;YACpB,KAAK;YACL,SAAS,EAAE,QAAQ;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,IAAI,CAAC,eAAe;YAC9B,gBAAgB,EAAE,GAAG,IAAI,CAAC,QAAQ,UAAU,KAAK,EAAE;SACpD,CAAC,CAAC;IACL,CAAC;IAED;;;0DAGsD;IACtD,WAAW,CAAC,IAAY,EAAE,KAAe,EAAE,QAAgB;QACzD,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QAC7D,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACvE,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACjF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;iGAG6F;IAC7F,UAAU,CAAC,IAAY,EAAE,KAAa,EAAE,MAAe;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtE,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC;QAC1C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,KAAK,KAAK,SAAS;YAAE,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC;QAC/C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;kEAO8D;IAC9D,KAAK,CAAC,MAAM,CAAC,OAAgB;QAC3B,IAAI,IAA6B,CAAC;QAClC,IAAI,CAAC;YACH,CAAC,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC,MAAM,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;QACtF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACjH,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC,IAAI,QAAQ,GAAG,UAAU,EAAE,CAAC;YAC1G,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,KAAK,IAAI,QAAqB,EAAE,CAAC;YAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;YACrE,IAAI,CAAC;gBACH,eAAe,CAAC,KAAK,CAAC,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;YACxC,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;QACD,2FAA2F;QAC3F,uFAAuF;QACvF,4FAA4F;QAC5F,2FAA2F;QAC3F,0EAA0E;QAC1E,IAAI,CAAC;YACH,YAAY,CAAC,gBAAgB,EAAE,IAAI,CAAC,QAAQ,EAAE;gBAC5C,EAAE,EAAE,IAAI,UAAU,CAAC,WAAW,CAAC;gBAC/B,KAAK,EAAE,IAAI,UAAU,CAAC,WAAW,CAAC;gBAClC,OAAO,EAAE,IAAI,UAAU,CAAC,EAAE,CAAC;gBAC3B,KAAK;gBACL,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACxC,CAAC;QAED,sFAAsF;QACtF,oFAAoF;QACpF,2FAA2F;QAC3F,qCAAqC;QACrC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QAC/E,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QAEtG,MAAM,QAAQ,GAA4B;YACxC,IAAI;YACJ,KAAK;YACL,SAAS,EAAE,QAAQ;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,IAAI,CAAC,eAAe;SAC/B,CAAC;QACF,2FAA2F;QAC3F,2DAA2D;QAC3D,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;QACvE,OAAO,EAAE,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC3B,CAAC;IAED;;;;;;;;;;sEAUkE;IAClE,UAAU,CAAC,IAAY;QACrB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QAC7D,OAAO,EAAE,CAAC,GAAG,EAAE;YACb,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,QAAQ;YACzB,kEAAkE;YAClE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI;YAC9B,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;SAChC,CAAC,CAAC;IACL,CAAC;IAED;;;uEAGmE;IACnE,YAAY,CAAC,KAAY,EAAE,GAAW;QACpC,IAAI,GAAG,IAAI,KAAK,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QACvC,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAChD,OAAO,MAAM,KAAK,SAAS,IAAI,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC;IACtD,CAAC;IAED;wFACoF;IACpF,UAAU,CAAC,IAAY;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC1B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;iEAE6D;IAC7D,KAAK,CAAC,KAAa;QACjB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QAC9D,OAAO,EAAE,CAAC,GAAG,EAAE;YACb,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC;YAC1B,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC;YAClC,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;SACjC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,OAAO,CAAC,OAAgB,EAAE,KAAa;QAC3C,IAAI,IAA6B,CAAC;QAClC,IAAI,SAA6B,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC;YAChG,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;YACnB,oFAAoF;YACpF,qFAAqF;YACrF,yCAAyC;YACzC,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC5C,IAAI,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC;gBACvF,oFAAoF;gBACpF,gFAAgF;gBAChF,iDAAiD;gBACjD,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;QACxC,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;QAC1C,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;YAC5E,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,SAAqB,CAAC;QAC1B,IAAI,UAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,SAAS,GAAG,SAAS,CAAC,aAAa,CAAC,CAAC;YACrC,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACxC,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QAC9D,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QAEzE,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC;YAC1E,OAAO,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QACtC,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;YAC1F,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QAED,8DAA8D;QAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QAC7D,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACjC,qFAAqF;YACrF,gDAAgD;YAChD,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACxC,CAAC;QACD,KAAK,CAAC,QAAQ,GAAG,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;QACrF,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,OAAgB,EAAE,KAAa;QACtC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACnD,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QAChF,IAAI,KAAiB,CAAC;QACtB,IAAI,CAAC;YACH,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QACtC,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1B,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,GAAG,GAAG,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;YAClF,OAAO,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QAEjG,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC/B,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACxD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAE5B,wFAAwF;QACxF,0FAA0F;QAC1F,kEAAkE;QAClE,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,MAAM,CAAC,SAAS,EAAE,CAAC;QAC3F,MAAM,IAAI,GACR,gBAAgB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG;YACnD,gBAAgB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC;QACnE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;IACpE,CAAC;IAED;iGAC6F;IAC7F,KAAK,CAAC,KAAa;QACjB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC3C,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/login.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,2FAA2F;AAC3F,yFAAyF;AACzF,+DAA+D;AAC/D,EAAE;AACF,qEAAqE;AACrE,0FAA0F;AAC1F,0FAA0F;AAC1F,6FAA6F;AAC7F,4FAA4F;AAC5F,sBAAsB;AACtB,EAAE;AACF,+DAA+D;AAC/D,EAAE;AACF,4DAA4D;AAC5D,oFAAoF;AACpF,kFAAkF;AAClF,+FAA+F;AAC/F,EAAE;AACF,6FAA6F;AAC7F,2FAA2F;AAC3F,6FAA6F;AAC7F,iEAAiE;AACjE,EAAE;AACF,6FAA6F;AAC7F,0FAA0F;AAE1F,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,WAAW,EAAqB,MAAM,sBAAsB,CAAC;AAErI,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAEvG;yFACyF;AACzF,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAC9C,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAC1C,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAC1C,MAAM,WAAW,GAAG,uBAAuB,CAAC;AAC5C,MAAM,aAAa,GAAG,WAAW,CAAC;AAElC;iFACiF;AACjF,MAAM,CAAC,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAE/C,6BAA6B;AAC7B,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AACvC,6BAA6B;AAC7B,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAE1C;;+CAE+C;AAC/C,MAAM,WAAW,GAAG,EAAE,CAAC;AA4GvB;;6EAE6E;AAC7E,SAAS,YAAY,CAAC,KAAY,EAAE,KAAe,EAAE,QAAgB;IACnE,OAAO,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3H,CAAC;AAED,MAAM,YAAY,GAAG,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;AAEzF;;yDAEyD;AACzD,SAAS,IAAI,CAAC,MAAc,EAAE,IAAY;IACxC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,EAAE,CAAC,MAAc,EAAE,IAAa;IACvC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,4FAA4F;AAC5F,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,CAAC,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,MAAe;IAChC,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,OAAO;IACT,QAAQ,CAAS;IACjB,KAAK,CAAS;IACd,IAAI,CAAqB;IACzB,UAAU,CAAS;IACnB,eAAe,CAAS;IACxB,MAAM,CAA6B;IACnC,MAAM,CAAQ;IACd,QAAQ,CAAU;IAClB,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;IACtC,OAAO,GAAG,IAAI,GAAG,EAAiB,CAAC;IAE5C;;;;;;;;;;;;;OAaG;IACH,YAAY,MAAc;QACxB,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,4FAA4F,CAAC,CAAC;QAChH,CAAC;QACD,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,cAAc,CAAC,GAAG,MAAM,CAAC,QAAQ,WAAW,CAAC,CAAC,QAAQ,CAAC;QACnE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,mBAAmB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,MAAM,CAAC,KAAK,CAAC,uBAAuB,CACzG,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACb,mBAAmB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,0CAA0C;gBAC1F,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,6CAA6C;gBACvE,aAAa,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,uBAAuB,CAC9D,CAAC;QACJ,CAAC;QACD,mFAAmF;QACnF,oFAAoF;QACpF,uFAAuF;QACvF,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CACb,eAAe,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,wEAAwE,CACnH,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,mBAAmB,CAAC;QAC3D,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,IAAI,wBAAwB,CAAC;QAC1E,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvF,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,MAAM,CAAC,OAAgB;QAC3B,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACnE,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAE5C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;YACzG,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;YACvH,OAAO,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAW,CAAC;QAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YAChD,IAAI,MAAM,KAAK,MAAM;gBAAE,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACxD,IAAI,MAAM,KAAK,KAAK;gBAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IACtC,CAAC;IAED;;;gBAGY;IACZ,KAAK;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1B,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1C,IAAI,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC1B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC1B,OAAO,IAAI,CAAC,CAAC;YACf,CAAC;QACH,CAAC;QACD,iFAAiF;QACjF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;gBACnC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC1B,OAAO,IAAI,CAAC,CAAC;YACf,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;;sCASkC;IAClC,KAAK,CAAC,MAAM,CAAC,OAAgB;QAC3B,IAAI,IAA6B,CAAC;QAClC,IAAI,CAAC;YACH,CAAC,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC,MAAM,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAClG,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACxC,CAAC;QAED,0FAA0F;QAC1F,yFAAyF;QACzF,0FAA0F;QAC1F,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;QACnC,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACvG,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC,IAAI,QAAQ,GAAG,UAAU,EAAE,CAAC;YAC1G,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,KAAK,IAAI,QAAqB,EAAE,CAAC;YAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;YACrE,IAAI,CAAC;gBACH,eAAe,CAAC,KAAK,CAAC,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;YACxC,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;QACD,uFAAuF;QACvF,+EAA+E;QAC/E,IAAI,SAA6B,CAAC;QAClC,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3B,wFAAwF;YACxF,oFAAoF;YACpF,iFAAiF;YACjF,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;YACpE,uFAAuF;YACvF,sFAAsF;YACtF,6DAA6D;YAC7D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;YACvD,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;YACxD,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC;YAC1C,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;QACD,IAAI,OAAmB,CAAC;QACxB,IAAI,CAAC;YACH,OAAO,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACxC,CAAC;QAED,MAAM,MAAM,GAAY;YACtB,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC9B,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;YACjC,OAAO;YACP,KAAK;YACL,QAAQ;YACR,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU;YACxC,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,SAAS;YACnB,SAAS,EAAE,SAAS;SACrB,CAAC;QACF,0FAA0F;QAC1F,6DAA6D;QAC7D,IAAI,CAAC;YACH,YAAY,CAAC,gBAAgB,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACxC,CAAC;QAED,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAC1D,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC;QAC5C,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACnC,CAAC;QACD,yFAAyF;QACzF,kFAAkF;QAClF,OAAO,EAAE,CAAC,GAAG,EAAE;YACb,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC;YAC1B,OAAO,EAAE,WAAW;YACpB,KAAK;YACL,SAAS,EAAE,QAAQ;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,IAAI,CAAC,eAAe;YAC9B,gBAAgB,EAAE,GAAG,IAAI,CAAC,QAAQ,UAAU,KAAK,EAAE;SACpD,CAAC,CAAC;IACL,CAAC;IAED;;;0DAGsD;IACtD,WAAW,CAAC,IAAY,EAAE,KAAe,EAAE,QAAgB;QACzD,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QAC7D,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACvE,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACjF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;iGAG6F;IAC7F,UAAU,CAAC,IAAY,EAAE,KAAa,EAAE,MAAe;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtE,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC;QAC1C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,KAAK,KAAK,SAAS;YAAE,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC;QAC/C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;kEAO8D;IAC9D,KAAK,CAAC,MAAM,CAAC,OAAgB;QAC3B,IAAI,IAA6B,CAAC;QAClC,IAAI,CAAC;YACH,CAAC,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC,MAAM,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;QACtF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACjH,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC,IAAI,QAAQ,GAAG,UAAU,EAAE,CAAC;YAC1G,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,KAAK,IAAI,QAAqB,EAAE,CAAC;YAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;YACrE,IAAI,CAAC;gBACH,eAAe,CAAC,KAAK,CAAC,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;YACxC,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;QACD,2FAA2F;QAC3F,uFAAuF;QACvF,4FAA4F;QAC5F,2FAA2F;QAC3F,0EAA0E;QAC1E,IAAI,CAAC;YACH,YAAY,CAAC,gBAAgB,EAAE,IAAI,CAAC,QAAQ,EAAE;gBAC5C,EAAE,EAAE,IAAI,UAAU,CAAC,WAAW,CAAC;gBAC/B,KAAK,EAAE,IAAI,UAAU,CAAC,WAAW,CAAC;gBAClC,OAAO,EAAE,IAAI,UAAU,CAAC,EAAE,CAAC;gBAC3B,KAAK;gBACL,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACxC,CAAC;QAED,sFAAsF;QACtF,oFAAoF;QACpF,2FAA2F;QAC3F,qCAAqC;QACrC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QAC/E,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QAEtG,MAAM,QAAQ,GAA4B;YACxC,IAAI;YACJ,KAAK;YACL,SAAS,EAAE,QAAQ;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,IAAI,CAAC,eAAe;SAC/B,CAAC;QACF,2FAA2F;QAC3F,2DAA2D;QAC3D,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;QACvE,OAAO,EAAE,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC3B,CAAC;IAED;;;;;;;;;;sEAUkE;IAClE,UAAU,CAAC,IAAY;QACrB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QAC7D,OAAO,EAAE,CAAC,GAAG,EAAE;YACb,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,QAAQ;YACzB,kEAAkE;YAClE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI;YAC9B,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;SAChC,CAAC,CAAC;IACL,CAAC;IAED;;;uEAGmE;IACnE,YAAY,CAAC,KAAY,EAAE,GAAW;QACpC,IAAI,GAAG,IAAI,KAAK,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QACvC,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAChD,OAAO,MAAM,KAAK,SAAS,IAAI,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC;IACtD,CAAC;IAED;wFACoF;IACpF,UAAU,CAAC,IAAY;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC1B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;iEAE6D;IAC7D,KAAK,CAAC,KAAa;QACjB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QAC9D,OAAO,EAAE,CAAC,GAAG,EAAE;YACb,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC;YAC1B,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC;YAClC,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;SACjC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,OAAO,CAAC,OAAgB,EAAE,KAAa;QAC3C,IAAI,IAA6B,CAAC;QAClC,IAAI,SAA6B,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC;YAChG,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;YACnB,oFAAoF;YACpF,qFAAqF;YACrF,yCAAyC;YACzC,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC5C,IAAI,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC;gBACvF,oFAAoF;gBACpF,gFAAgF;gBAChF,iDAAiD;gBACjD,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;QACxC,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;QAC1C,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;YAC5E,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,SAAqB,CAAC;QAC1B,IAAI,UAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,SAAS,GAAG,SAAS,CAAC,aAAa,CAAC,CAAC;YACrC,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACxC,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QAC9D,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QAEzE,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC;YAC1E,OAAO,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QACtC,CAAC;QAED,oFAAoF;QACpF,4EAA4E;QAC5E,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC;QAClC,IAAI,OAAO,GAAe,GAAG,EAAE,GAAE,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACzC,OAAO,GAAG,OAAO,CAAC;QACpB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC;YAEf,uEAAuE;YACvE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;YAC5D,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAChC,sFAAsF;gBACtF,iFAAiF;gBACjF,4BAA4B;gBAC5B,OAAO,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;YACxC,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC9B,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE;wBACpF,EAAE,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC3B,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC;wBACtB,QAAQ,EAAE,IAAI,CAAC,QAAQ;qBACxB,CAAC,CAAC;gBACL,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;gBACtC,CAAC;YACH,CAAC;YAED,wFAAwF;YACxF,6BAA6B;YAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;YAC7D,KAAK,CAAC,QAAQ,GAAG,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;YACrF,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7C,CAAC;gBAAS,CAAC;YACT,OAAO,EAAE,CAAC;YACV,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI;gBAAE,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;QAC9D,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,OAAgB,EAAE,KAAa;QACtC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACnD,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QAChF,IAAI,KAAiB,CAAC;QACtB,IAAI,CAAC;YACH,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QACtC,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1B,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,GAAG,GAAG,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;YAClF,OAAO,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QAEjG,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC/B,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACxD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAE5B,wFAAwF;QACxF,0FAA0F;QAC1F,kEAAkE;QAClE,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,MAAM,CAAC,SAAS,EAAE,CAAC;QAC3F,MAAM,IAAI,GACR,gBAAgB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG;YACnD,gBAAgB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC;QACnE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;IACpE,CAAC;IAED;iGAC6F;IAC7F,KAAK,CAAC,KAAa;QACjB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC3C,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/src/request.d.ts

@@ -0,0 +1,114 @@
+import { type RequestPolicy, type VerifiedRequest } from "@bitspark/archon-sdk";
+/** The largest body a verifier reads to recompute the digest. A larger one is refused, never
+ *  truncated: a digest over part of a body verifies nothing. */
+export declare const REQUEST_MAX_BODY_BYTES: number;
+export type ReplayOutcome = "inserted" | "alreadyPresent" | "unavailable";
+/** What a replay store remembers. Never the signature bytes: a signature is one spelling of a
+ *  proof, the identifier is the proof's. */
+export interface ReplayKey {
+    /** REQUEST_TAG. */
+    profile: string;
+    audience: string;
+    /** The canonical key text. */
+    principal: string;
+    /** Hex. */
+    nonce: string;
+}
+/** One insertion: the key, and the window in which any verifier could accept the proof — `from`
+ *  is created − δ, `until` is expires + δ, both in seconds since the epoch. A store retains the
+ *  key at least until `until`; `from` is what lets a store that lost its memory refuse proofs it
+ *  might have seen. */
+export interface ReplayEntry {
+    key: ReplayKey;
+    from: number;
+    until: number;
+}
+/**
+ * Makes a proof usable at most once. Requirements (ADR 0010 §5): one winner across every
+ * verifier in the acceptance scope — concurrent inserts of one key return "inserted" at most
+ * once; a key retained at least until its `until`, when no verifier can still accept the proof;
+ * and a store that cannot guarantee both answers "unavailable" rather than "inserted".
+ */
+export interface ReplayStore {
+    insertIfAbsent(entry: ReplayEntry): ReplayOutcome | Promise<ReplayOutcome>;
+}
+/**
+ * The reference ReplayStore: one process, in memory. It is correct for exactly one verifier
+ * process, and its RESTART POLICY is what makes it correct across a restart at all (ADR 0010 §5:
+ * losing accepted identifiers reopens old proofs).
+ *
+ * A proof is acceptable from `entry.from` (created − δ). A process started at `start` cannot know
+ * what an earlier process accepted, so it admits only proofs whose window opened at or after
+ * `start`, and answers "unavailable" for anything older — waiting out, rather than guessing about,
+ * the proofs a previous incarnation could have seen. A deployment with more than one verifier, or
+ * that cannot afford the wait, supplies a shared store with the same contract.
+ */
+export declare class MemoryReplayStore implements ReplayStore {
+    #private;
+    readonly start: number;
+    /** `start`: when this incarnation began, in seconds since the epoch. */
+    constructor(start: number);
+    insertIfAbsent(entry: ReplayEntry): ReplayOutcome;
+    /** Forgets every identifier whose `until` is not after `now`, and returns how many. Optional
+     *  and caller-driven: nothing here starts a timer, and retaining a key longer is always safe. */
+    sweep(now: number): number;
+}
+/** ADR 0010 §6's `AuthenticatedRequest`: a request that verified and was admitted by the replay
+ *  store — the principal, and the request descriptor authentication verified. Authorization
+ *  evaluates this, not a re-parse. (Go and Rust name it `request.Authenticated`, as the sdk names
+ *  `VerifiedRequest` `request.Verified` there: the module supplies the noun.) */
+export type AuthenticatedRequest = VerifiedRequest;
+/** Why a request was not authenticated, with the HTTP status to answer: 400 for a request the
+ *  profile does not accept as transported, 401 for one that does not authenticate, 413 for an
+ *  oversized body, 503 when the replay store is unavailable. */
+export declare class RequestRefusal extends Error {
+    readonly status: number;
+    constructor(status: number, message: string);
+}
+/** A request as received: the method, the raw request-target, every header field in order, the
+ *  body after transfer framing, and the trailer fields (any is refused in v1). */
+export interface RawRequest {
+    method: string;
+    requestTarget: string;
+    headers: ReadonlyArray<readonly [string, string]>;
+    body: Uint8Array;
+    trailers?: ReadonlyArray<readonly [string, string]>;
+}
+/** The shape of node:http's IncomingMessage that `readNodeRequest` reads — structural, so this
+ *  package depends on no server. */
+export interface NodeRequestLike extends AsyncIterable<Uint8Array | string> {
+    method?: string | undefined;
+    url?: string | undefined;
+    rawHeaders: string[];
+    rawTrailers: string[];
+}
+/** Read a node:http request as received: its raw request-target, its raw header lines, its body
+ *  (refused, not truncated, past REQUEST_MAX_BODY_BYTES) and its trailers.
+ *
+ *  Past the limit it keeps no more bytes but reads on to the end, as node:http itself drains an
+ *  unread body: abandoning the stream would destroy the socket, and the client would get a reset
+ *  instead of the 413. The server's request timeout bounds how long that can take. */
+export declare function readNodeRequest(req: NodeRequestLike): Promise<RawRequest>;
+export interface VerifierConfig {
+    policy: RequestPolicy;
+    store: ReplayStore;
+    /** Seconds since the epoch; defaults to the system clock. */
+    clock?: () => number;
+}
+/** Authenticates requests under one policy against one replay store. */
+export declare class RequestVerifier {
+    #private;
+    constructor(config: VerifierConfig);
+    /** Authenticate a request as received. Throws a RequestRefusal. */
+    authenticateRaw(raw: RawRequest): Promise<AuthenticatedRequest>;
+    /** Authenticate a fetch Request — the normalised request a fetch application routes on — and
+     *  return the body it read alongside. Throws a RequestRefusal. */
+    authenticate(request: Request): Promise<{
+        auth: AuthenticatedRequest;
+        body: Uint8Array<ArrayBuffer>;
+    }>;
+    /** The fetch-style middleware: authenticate every request before `next` sees it. A refused
+     *  request never reaches `next`; it is answered with the refusal's status and a one-line reason.
+     *  `next` gets a fresh Request carrying the body that was verified. */
+    guard(next: (request: Request, auth: AuthenticatedRequest) => Response | Promise<Response>): (request: Request) => Promise<Response>;
+}

package/dist/src/request.js

@@ -0,0 +1,242 @@
+// The server's half of request authentication (ADR 0010 §5–§6; docs/request.md §7 steps 8–9,
+// version 1, fixed by ADR 0010's status note of 4 October 2026).
+//
+// The sdk's verifyRequest checks a proof: one spelling, the coverage, the audience echo, the
+// digest, freshness and the signature. It does not remember. This module adds what only a
+// server can: the HTTP extraction, the clock, and the REPLAY STORE — the one operation that makes
+// a proof usable at most once:
+//
+//   insertIfAbsent({key: (profile, audience, principal, nonce), from, until}) → inserted | alreadyPresent | unavailable
+//
+// A request reaches the application only as an AuthenticatedRequest, and only after a proof verified
+// AND its identifier was inserted. `alreadyPresent` is a replay; `unavailable` FAILS CLOSED — a
+// store that cannot answer, or throws, is never permission to skip the check.
+//
+// Two ways in, because a fetch-style Request has already lost the request line:
+//
+// - `authenticateRaw` takes the request as received. `readNodeRequest` builds one from
+//   node:http's IncomingMessage — its raw `url` and `rawHeaders` — so a Node server verifies
+//   exactly what arrived, as the Go and Rust lanes do.
+// - `authenticate` (and `guard`) take a fetch Request, and verify against its URL's pathname and
+//   search. The WHATWG URL parser has normalised those (dot segments resolved, `\` read as `/`,
+//   some characters percent-encoded), and a Headers object has joined repeated fields with ", ".
+//   That normalised request is the only one a fetch application ever sees and routes on, so it is
+//   the one verified: what authentication checked and what authorization evaluates stay the same
+//   request. A proof signed over any other spelling is refused.
+//
+// Like the login handler, nothing here opens a socket, starts a timer or depends on a framework.
+import { REQUEST_TAG, verifyRequest } from "@bitspark/archon-sdk";
+/** The largest body a verifier reads to recompute the digest. A larger one is refused, never
+ *  truncated: a digest over part of a body verifies nothing. */
+export const REQUEST_MAX_BODY_BYTES = 1 << 20;
+/**
+ * The reference ReplayStore: one process, in memory. It is correct for exactly one verifier
+ * process, and its RESTART POLICY is what makes it correct across a restart at all (ADR 0010 §5:
+ * losing accepted identifiers reopens old proofs).
+ *
+ * A proof is acceptable from `entry.from` (created − δ). A process started at `start` cannot know
+ * what an earlier process accepted, so it admits only proofs whose window opened at or after
+ * `start`, and answers "unavailable" for anything older — waiting out, rather than guessing about,
+ * the proofs a previous incarnation could have seen. A deployment with more than one verifier, or
+ * that cannot afford the wait, supplies a shared store with the same contract.
+ */
+export class MemoryReplayStore {
+    start;
+    #seen = new Map();
+    /** `start`: when this incarnation began, in seconds since the epoch. */
+    constructor(start) {
+        this.start = start;
+    }
+    insertIfAbsent(entry) {
+        if (entry.from < this.start)
+            return "unavailable";
+        const k = JSON.stringify([entry.key.profile, entry.key.audience, entry.key.principal, entry.key.nonce]);
+        if (this.#seen.has(k))
+            return "alreadyPresent";
+        this.#seen.set(k, entry.until);
+        return "inserted";
+    }
+    /** Forgets every identifier whose `until` is not after `now`, and returns how many. Optional
+     *  and caller-driven: nothing here starts a timer, and retaining a key longer is always safe. */
+    sweep(now) {
+        let n = 0;
+        for (const [k, until] of this.#seen) {
+            if (until <= now) {
+                this.#seen.delete(k);
+                n++;
+            }
+        }
+        return n;
+    }
+}
+/** Why a request was not authenticated, with the HTTP status to answer: 400 for a request the
+ *  profile does not accept as transported, 401 for one that does not authenticate, 413 for an
+ *  oversized body, 503 when the replay store is unavailable. */
+export class RequestRefusal extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
+function pairs(flat) {
+    const out = [];
+    for (let i = 0; i + 1 < flat.length; i += 2)
+        out.push([flat[i], flat[i + 1]]);
+    return out;
+}
+function concat(chunks, total) {
+    const out = new Uint8Array(total);
+    let at = 0;
+    for (const c of chunks) {
+        out.set(c, at);
+        at += c.length;
+    }
+    return out;
+}
+function tooLarge() {
+    return new RequestRefusal(413, "request: the body is over the verifier's limit");
+}
+/** Read a node:http request as received: its raw request-target, its raw header lines, its body
+ *  (refused, not truncated, past REQUEST_MAX_BODY_BYTES) and its trailers.
+ *
+ *  Past the limit it keeps no more bytes but reads on to the end, as node:http itself drains an
+ *  unread body: abandoning the stream would destroy the socket, and the client would get a reset
+ *  instead of the 413. The server's request timeout bounds how long that can take. */
+export async function readNodeRequest(req) {
+    const chunks = [];
+    let total = 0;
+    for await (const chunk of req) {
+        const bytes = typeof chunk === "string" ? new TextEncoder().encode(chunk) : chunk;
+        total += bytes.length;
+        if (total > REQUEST_MAX_BODY_BYTES) {
+            chunks.length = 0;
+            continue;
+        }
+        chunks.push(bytes);
+    }
+    if (total > REQUEST_MAX_BODY_BYTES)
+        throw tooLarge();
+    return {
+        method: req.method ?? "",
+        requestTarget: req.url ?? "",
+        headers: pairs(req.rawHeaders),
+        body: concat(chunks, total),
+        trailers: pairs(req.rawTrailers),
+    };
+}
+async function readBounded(body) {
+    if (body === null)
+        return new Uint8Array(0);
+    const reader = body.getReader();
+    const chunks = [];
+    let total = 0;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        total += value.length;
+        if (total > REQUEST_MAX_BODY_BYTES) {
+            await reader.cancel().catch(() => { });
+            throw tooLarge();
+        }
+        chunks.push(value);
+    }
+    return concat(chunks, total);
+}
+/** Authenticates requests under one policy against one replay store. */
+export class RequestVerifier {
+    #policy;
+    #store;
+    #clock;
+    constructor(config) {
+        this.#policy = config.policy;
+        this.#store = config.store;
+        this.#clock = config.clock ?? (() => Math.floor(Date.now() / 1000));
+    }
+    /** Authenticate a request as received. Throws a RequestRefusal. */
+    async authenticateRaw(raw) {
+        if (raw.body.length > REQUEST_MAX_BODY_BYTES)
+            throw tooLarge();
+        // v1 accepts no content coding and no trailers (ADR 0010 §4): the digest is over the content
+        // as received, and a coded body would make "as received" ambiguous.
+        if (raw.headers.some(([n]) => n.toLowerCase() === "content-encoding") || (raw.trailers?.length ?? 0) > 0) {
+            throw new RequestRefusal(400, "request: content codings and trailers are not accepted in v1");
+        }
+        let verified;
+        try {
+            verified = verifyRequest(this.#policy, this.#clock(), {
+                method: raw.method,
+                requestTarget: raw.requestTarget,
+                headers: raw.headers,
+                body: raw.body,
+            });
+        }
+        catch (e) {
+            throw new RequestRefusal(401, e instanceof Error ? e.message : String(e));
+        }
+        // Only now, after the proof and its freshness verified (ADR 0010 §5: verify before
+        // inserting), is the identifier remembered — until no verifier can still accept it.
+        let outcome;
+        try {
+            outcome = await this.#store.insertIfAbsent({
+                key: {
+                    profile: REQUEST_TAG,
+                    audience: this.#policy.audience,
+                    principal: verified.keyText,
+                    nonce: Array.from(verified.nonce, (b) => b.toString(16).padStart(2, "0")).join(""),
+                },
+                from: verified.created - this.#policy.skew,
+                until: verified.expires + this.#policy.skew,
+            });
+        }
+        catch {
+            outcome = "unavailable";
+        }
+        if (outcome === "inserted")
+            return verified;
+        if (outcome === "alreadyPresent")
+            throw new RequestRefusal(401, "request: replayed");
+        throw new RequestRefusal(503, "request: the replay store is unavailable");
+    }
+    /** Authenticate a fetch Request — the normalised request a fetch application routes on — and
+     *  return the body it read alongside. Throws a RequestRefusal. */
+    async authenticate(request) {
+        const body = await readBounded(request.body);
+        const url = new URL(request.url);
+        const auth = await this.authenticateRaw({
+            method: request.method,
+            requestTarget: url.pathname + url.search,
+            headers: [...request.headers],
+            body,
+        });
+        return { auth, body };
+    }
+    /** The fetch-style middleware: authenticate every request before `next` sees it. A refused
+     *  request never reaches `next`; it is answered with the refusal's status and a one-line reason.
+     *  `next` gets a fresh Request carrying the body that was verified. */
+    guard(next) {
+        return async (request) => {
+            let verified;
+            try {
+                verified = await this.authenticate(request);
+            }
+            catch (e) {
+                const status = e instanceof RequestRefusal ? e.status : 401;
+                return new Response(`${e instanceof Error ? e.message : String(e)}\n`, {
+                    status,
+                    headers: { "content-type": "text/plain; charset=utf-8" },
+                });
+            }
+            const bodiless = request.method === "GET" || request.method === "HEAD";
+            const forward = new Request(request.url, {
+                method: request.method,
+                headers: request.headers,
+                body: bodiless ? null : verified.body,
+                signal: request.signal,
+            });
+            return next(forward, verified.auth);
+        };
+    }
+}
+//# sourceMappingURL=request.js.map

package/dist/src/request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.js","sourceRoot":"","sources":["../../src/request.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,iEAAiE;AACjE,EAAE;AACF,6FAA6F;AAC7F,0FAA0F;AAC1F,kGAAkG;AAClG,+BAA+B;AAC/B,EAAE;AACF,wHAAwH;AACxH,EAAE;AACF,qGAAqG;AACrG,gGAAgG;AAChG,8EAA8E;AAC9E,EAAE;AACF,gFAAgF;AAChF,EAAE;AACF,uFAAuF;AACvF,6FAA6F;AAC7F,uDAAuD;AACvD,iGAAiG;AACjG,gGAAgG;AAChG,iGAAiG;AACjG,kGAAkG;AAClG,iGAAiG;AACjG,gEAAgE;AAChE,EAAE;AACF,iGAAiG;AACjG,OAAO,EAAE,WAAW,EAAE,aAAa,EAA4C,MAAM,sBAAsB,CAAC;AAE5G;gEACgE;AAChE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,IAAI,EAAE,CAAC;AAoC9C;;;;;;;;;;GAUG;AACH,MAAM,OAAO,iBAAiB;IAIP,KAAK;IAHjB,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE3C,wEAAwE;IACxE,YAAqB,KAAa;qBAAb,KAAK;IAAW,CAAC;IAEtC,cAAc,CAAC,KAAkB;QAC/B,IAAI,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK;YAAE,OAAO,aAAa,CAAC;QAClD,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QACxG,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,gBAAgB,CAAC;QAC/C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/B,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;qGACiG;IACjG,KAAK,CAAC,GAAW;QACf,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACpC,IAAI,KAAK,IAAI,GAAG,EAAE,CAAC;gBACjB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACrB,CAAC,EAAE,CAAC;YACN,CAAC;QACH,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;CACF;AAQD;;gEAEgE;AAChE,MAAM,OAAO,cAAe,SAAQ,KAAK;IAE5B,MAAM;IADjB,YACW,MAAc,EACvB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;sBAHN,MAAM;IAIjB,CAAC;CACF;AAqBD,SAAS,KAAK,CAAC,IAAuB;IACpC,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,CAAC,CAAC;IAChF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,MAAM,CAAC,MAA6B,EAAE,KAAa;IAC1D,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACf,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC;IACjB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,QAAQ;IACf,OAAO,IAAI,cAAc,CAAC,GAAG,EAAE,gDAAgD,CAAC,CAAC;AACnF,CAAC;AAED;;;;;sFAKsF;AACtF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAoB;IACxD,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAClF,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;QACtB,IAAI,KAAK,GAAG,sBAAsB,EAAE,CAAC;YACnC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;YAClB,SAAS;QACX,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,IAAI,KAAK,GAAG,sBAAsB;QAAE,MAAM,QAAQ,EAAE,CAAC;IACrD,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE;QACxB,aAAa,EAAE,GAAG,CAAC,GAAG,IAAI,EAAE;QAC5B,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC;QAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC;QAC3B,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC;KACjC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAuC;IAChE,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAChC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,SAAS,CAAC;QACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,IAAI;YAAE,MAAM;QAChB,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;QACtB,IAAI,KAAK,GAAG,sBAAsB,EAAE,CAAC;YACnC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACtC,MAAM,QAAQ,EAAE,CAAC;QACnB,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAC/B,CAAC;AASD,wEAAwE;AACxE,MAAM,OAAO,eAAe;IACjB,OAAO,CAAgB;IACvB,MAAM,CAAc;IACpB,MAAM,CAAe;IAE9B,YAAY,MAAsB;QAChC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,mEAAmE;IACnE,KAAK,CAAC,eAAe,CAAC,GAAe;QACnC,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,sBAAsB;YAAE,MAAM,QAAQ,EAAE,CAAC;QAC/D,6FAA6F;QAC7F,oEAAoE;QACpE,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YACzG,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,8DAA8D,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,QAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE;gBACpD,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,IAAI,EAAE,GAAG,CAAC,IAAI;aACf,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5E,CAAC;QACD,mFAAmF;QACnF,oFAAoF;QACpF,IAAI,OAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;gBACzC,GAAG,EAAE;oBACH,OAAO,EAAE,WAAW;oBACpB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;oBAC/B,SAAS,EAAE,QAAQ,CAAC,OAAO;oBAC3B,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;iBACnF;gBACD,IAAI,EAAE,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI;gBAC1C,KAAK,EAAE,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI;aAC5C,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,aAAa,CAAC;QAC1B,CAAC;QACD,IAAI,OAAO,KAAK,UAAU;YAAE,OAAO,QAAQ,CAAC;QAC5C,IAAI,OAAO,KAAK,gBAAgB;YAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACrF,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,0CAA0C,CAAC,CAAC;IAC5E,CAAC;IAED;sEACkE;IAClE,KAAK,CAAC,YAAY,CAAC,OAAgB;QACjC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC;YACtC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,aAAa,EAAE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM;YACxC,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;YAC7B,IAAI;SACL,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;IAED;;2EAEuE;IACvE,KAAK,CAAC,IAAoF;QACxF,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;YACvB,IAAI,QAAuE,CAAC;YAC5E,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YAC9C,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,MAAM,GAAG,CAAC,YAAY,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;gBAC5D,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE;oBACrE,MAAM;oBACN,OAAO,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE;iBACzD,CAAC,CAAC;YACL,CAAC;YACD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC;YACvE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE;gBACvC,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI;gBACrC,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC,CAAC;IACJ,CAAC;CACF"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@bitspark/archon-server",
-  "version": "0.8.2",
-  "description": "archon login: the service-side handler — four routes, law-free, store-minimal. A fetch-style handler that opens no socket.",
+  "version": "0.10.0",
+  "description": "archon's service side: the login handler (four routes, law-free, store-minimal), the request profile's verifier with its replay store, and key enrollment's server half. Fetch-style; opens no socket.",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -22,8 +22,8 @@
     "test": "tsc -p tsconfig.json && node --test dist/test/*.test.js"
   },
   "dependencies": {
-    "@bitspark/archon": "^0.8.2",
-    "@bitspark/archon-sdk": "^0.8.2"
+    "@bitspark/archon": "^0.10.0",
+    "@bitspark/archon-sdk": "^0.10.0"
   },
   "devDependencies": {
     "@types/node": "^26",