@bounded-authority-protocol/verifier 0.2.0

package/LICENSE

@@ -0,0 +1,190 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all other
+      commercial damages or losses), even if such Contributor has been
+      advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright 2026 BaseLabs
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1,10 @@
+@bounded-authority/verifier
+Copyright 2026 BaseLabs
+
+This product includes software developed by BaseLabs.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0

package/README.md

@@ -0,0 +1,183 @@
+# @bounded-authority-protocol/verifier
+
+[![npm](https://img.shields.io/npm/v/@bounded-authority-protocol/verifier)](https://www.npmjs.com/package/@bounded-authority-protocol/verifier)
+[![CI](https://github.com/baselabs/bounded_authority_protocol_typescript/actions/workflows/ci.yml/badge.svg)](https://github.com/baselabs/bounded_authority_protocol_typescript/actions/workflows/ci.yml)
+[![license](https://img.shields.io/badge/license-Apache--2.0-blue)](LICENSE)
+
+Deterministic, fail-closed verification for the **Bounded Authority Protocol** — bounded
+proof-of-possession authority for services and AI agents, in pure TypeScript.
+
+The SDK verifies the protocol's two wire profiles (contract-majors 1 and 2): compact-JWS
+grants, holder proofs, consumption chains, boundary anchors, key transitions, and archived
+exports. It is a TypeScript reimplementation of the reference profile — derived from the
+published specifications and certified conformance corpora, with zero runtime dependencies
+(Ed25519 via `node:crypto`; canonicalization hand-rolled from the RFCs).
+
+**It verifies; it never authorizes.** A successful result proves that caller-supplied bytes
+satisfy caller-supplied trusted inputs and expected context — nothing more. There is no
+`allowed`, no `authorized`, no decision anywhere in the API: results are value-bearing,
+redacted facts, and every failure is a single closed rejection.
+
+## Install
+
+```bash
+npm install @bounded-authority-protocol/verifier
+```
+
+Requires Node.js `>= 22`. Zero runtime dependencies.
+
+## Quickstart — verify a grant
+
+```ts
+import { verifyGrant } from "@bounded-authority-protocol/verifier";
+
+// The raw compact-JWS grant bytes (ASCII), produced out-of-band by an issuer.
+const grantCompact = Buffer.from(
+  "eyJhbGciOiJFZERTQSIsInR5cCI6ImJhK2NhcCIsImtpZCI6Imlzc3Vlci1rZXkifQ." +
+    "<payload>.<signature>",
+  "ascii",
+);
+
+const result = verifyGrant(
+  grantCompact,
+  {
+    keyId: "issuer-key",            // must match the grant header `kid` exactly
+    publicKey: issuerPublicKey32,   // raw 32-byte Ed25519 public key — public keys only
+  },
+  {
+    issuer: "https://issuer.example",
+    audience: "https://resource.example",
+    evaluationTime: 1_731_728_000,  // caller-supplied, seconds since epoch — the SDK reads no clock
+    clockSkew: 60,
+  },
+);
+
+if (result.ok) {
+  const facts = result.value;       // GrantFacts — value-bearing, redacted
+  facts.holderThumbprint;           // Uint8Array(32) — the bound holder key
+  facts.authorization;              // "not_evaluated" — verification is not authority
+} else {
+  // { ok: false } — every structural, signature, header, claim, or time-window
+  // failure lands here. Closed and value-free: no reason, no partial data.
+}
+```
+
+Every public function returns the same `Result<T>` shape — `{ ok: true, value }` or
+`{ ok: false }` — mirroring the reference's `{:ok, value} | {:error, :invalid}`.
+
+## Wire contract-majors
+
+The protocol versions its wire formats as complete, parallel **contract-majors**. Both live in
+this package; each verifies only its own bytes — there is no fallback or downgrade in either
+direction.
+
+| Major | Import | Selector kinds | Notes |
+|---|---|---|---|
+| 1 | `import { verifyGrant, ... }` | `all`, `equals`, `one_of` | The original profile |
+| 2 | `import { v2 } from "@bounded-authority-protocol/verifier"` | `+ lte`, `gte` | Adds inclusive same-tag range selectors (intervals compose conjunctively) |
+
+The `v2` namespace mirrors the full v1 surface — `v2.verifyGrant`, `v2.checkEnvelope`,
+`v2.grantSigningInput`, and so on — under the major-2 separators, suite name, and `v: 2`
+payloads.
+
+```ts
+import { v2 } from "@bounded-authority-protocol/verifier";
+
+const result = v2.checkEnvelope(grantV2, proofV2, {
+  trustedIssuer: { keyId: "issuer-key", publicKey: issuerPublicKey32 },
+  issuer: "https://issuer.example",
+  audience: "https://resource.example",
+  method: "POST",
+  targetUri: "https://api.example.test/invoke",
+  invocationId: "…", operation: "transfer",
+  castArguments: { t: "object", v: new Map([["amount", { t: "int", v: 5000 }]]) },
+  evaluationTime: 1_731_728_000, clockSkew: 60, proofMaxAge: 300,
+  nonce: { kind: "not_required" },
+});
+// The grant above may carry { kind: "lte", path: ["amount"], value: 5000 } —
+// amount 5001 rejects; 5000 verifies inclusively; cross-tag operands never match.
+```
+
+`castArguments` uses the SDK's tagged JSON algebra (int/float/string/object tags carry the
+selector operand domain); the [`Tagged` type](src/json.ts) is exported from the package root.
+
+## API surface
+
+The v1 façade (the `v2` namespace mirrors it):
+
+| Function | Returns | Purpose |
+|---|---|---|
+| `verifyGrant` | `Result<GrantFacts>` | Verify a compact grant against a trusted issuer + expected context |
+| `checkEnvelope` | `Result<EnvelopeFacts>` | Re-verify the grant and bind the holder proof, request, nonce, and selectors |
+| `decodeGrant` / `decodeProof` | `Result<GrantDecoded \| ProofDecoded>` | Structural decode (verification: not_evaluated) |
+| `untrustedKeyLocator` | `Result<KeyLocator>` | Header-only key id (trust: not_evaluated) |
+| `requestDigest` | `Uint8Array(32)` | Typed, type-preserving request hash (major-bound domain prefix) |
+| `encodeConsumptionEntry` / `checkChain` | `Result<EncodedConsumptionEntry \| ChainFacts>` | Canonical consumption rows + range verification |
+| `grantSigningInput` / `proofSigningInput` | `Result<SigningInput>` | Deterministic producer signing inputs |
+| `assembleCompact` | `Uint8Array` | External signature assembly — the SDK holds no private keys |
+| `boundaryAnchorSigningInput` / `keyTransitionSigningInput` | `Result<SigningInput>` | Anchor and historical-key-transition producers |
+| `encodeAnchoredExport` / `verifyAnchoredExport` | `Result<EncodedAnchoredExport \| AnchoredExportFacts>` | Deterministic archive framing + atomic verification |
+| `verifyHistoricalAnchor` / `verifyKeyTransition` | `Result<AnchorFacts \| KeyTransitionFacts>` | Historical boundary + authenticated rollover verification |
+
+Plus the versioned primitives (`jwkEncodePublic`, `thumbprint`, `uriNormalize`, `boundsNew`,
+`jcsEncode`, `base64urlDecode`/`Encode`, the tagged JSON algebra) and the byte-distinct
+local-development proof profile (`localLoopbackHttpProofSigningInput` and friends — literal
+`127.0.0.1`/`[::1]` targets only, mandatory nonce; standard `dpop+jwt` rejects its bytes).
+The full export list is [`src/index.ts`](src/index.ts).
+
+## Certified, not self-tested
+
+Every release of this SDK is verified against the protocol's published, cryptographically
+certified conformance corpora — **283 vectors** for contract-major 1 and **268** for
+contract-major 2 — recomputing every verdict from scratch, with the corpus `index.json`
+SHA-256 asserted at load so a drifted snapshot fails loudly. Permissiveness bugs (a parser
+accepting what the spec forbids) are invisible to corpus agreement by construction, so the
+suite additionally carries a per-language mutation gate that proves each closure
+**red-capable**: mechanically remove a check, watch its test fail.
+
+CI runs the full matrix on every push: strict typecheck, build, lint (including a library
+purity rule — no I/O, clock, or randomness in `src/`), license check, unit tests, the
+mutation gate, and both conformance corpora against the vendored snapshots.
+
+Releases are published only from this repository's release workflow, via npm trusted
+publishing (GitHub Actions OIDC — no long-lived tokens) with npm provenance on every
+artifact.
+
+## Versioning
+
+Package versions follow SemVer. Wire contract-majors are a separate axis: a new
+contract-major lands **additively** (a minor release — this package already carries majors 1
+and 2 side by side), and a package major is owed only when a shipped profile or public API is
+removed or changes verdicts. Wire artifacts self-declare their major (payload `v`, the
+`BAP<n>-…` suite name, major-bound domain separators), so the package number never needs to
+encode it.
+
+## What this SDK does not do
+
+It is a verifier, not an authority runtime. It holds no private keys, makes no network or
+filesystem calls, reads no clock, and performs no replay reservation, revocation check, or
+policy decision. Selecting trusted keys, reserving replay, and granting execution belong to
+the host — a facts value is evidence, never a credential.
+
+## Protocol documentation
+
+- [BAP v1 specification](https://github.com/baselabs/bounded_authority_protocol/blob/main/spec/bap-v1.md) ·
+  [v2 specification](https://github.com/baselabs/bounded_authority_protocol/blob/main/spec/bap-v2.md)
+- [Certified conformance corpora](https://github.com/baselabs/bounded_authority_protocol/tree/main/priv/conformance/)
+- [ADR 0014 — cross-language verifier SDKs](https://github.com/baselabs/bounded_authority_protocol/blob/main/docs/adr/0014-cross-language-verifier-sdks.md) ·
+  [ADR 0015 — graduation and publish topology](https://github.com/baselabs/bounded_authority_protocol/blob/main/docs/adr/0015-sdk-graduation-and-publish-topology.md)
+
+## Development
+
+```bash
+pnpm install
+pnpm typecheck && pnpm build && pnpm lint && pnpm license-check
+pnpm test                    # unit + struct + façade corpus-vector tests
+pnpm test:permissiveness     # the mutation gate
+pnpm conformance             # 283/283 + key census (vendored v1 snapshot)
+pnpm conformance:v2          # 268/268 + key census (vendored v2 snapshot)
+```
+
+## License
+
+Apache-2.0. See [LICENSE](LICENSE) and [NOTICE](NOTICE).

package/dist/src/base64url.d.ts

@@ -0,0 +1,2 @@
+export declare function base64urlDecode(input: Uint8Array, maxDecodedBytes?: number): Uint8Array;
+export declare function base64urlEncode(input: Uint8Array): Uint8Array;

package/dist/src/base64url.js

@@ -0,0 +1,115 @@
+import { fail } from "./error.js";
+// Unpadded base64url decode + encode, canonical per REQ1-B64-* (spec/bap-v1.md):
+//   - REQ1-B64-alphabet: only A-Za-z0-9-_ (no +/, no padding =, no whitespace)
+//   - REQ1-B64-no-padding: padding/whitespace forbidden
+//   - REQ1-B64-length: length mod 4 == 1 is invalid (cannot decode)
+//   - REQ1-B64-canonical: decode succeeds only if unpadded re-encode reproduces the input exactly
+//
+// Derived from spec/bap-v1.md § base64url + RFC 4648 §5. NOT using Buffer.from(s, "base64url") for
+// decode because Node's base64url accepts padding/whitespace and is permissive; the bounds-checked
+// canonical decoder is hand-rolled.
+const ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+const REV = new Int8Array(128).fill(-1);
+for (let i = 0; i < ALPHABET.length; i++)
+    REV[ALPHABET.charCodeAt(i)] = i;
+// Reject any byte that is not in the alphabet (covers +, /, = padding, whitespace, control chars).
+function classifyByte(byte) {
+    return byte >= 0 && byte < 128 ? REV[byte] : -1;
+}
+export function base64urlDecode(input, maxDecodedBytes) {
+    const len = input.length;
+    // REQ1-B64-length: length mod 4 == 1 is structurally invalid.
+    if (len % 4 === 1)
+        fail("base64url: invalid length mod 4 == 1");
+    // The decoded length is deterministic from the input length + tail.
+    let outLen = (len >> 2) * 3;
+    if (len % 4 === 2)
+        outLen += 1;
+    else if (len % 4 === 3)
+        outLen += 2;
+    if (maxDecodedBytes !== undefined && outLen > maxDecodedBytes) {
+        fail("base64url: decoded length exceeds bound");
+    }
+    const out = new Uint8Array(outLen);
+    let op = 0;
+    let i = 0;
+    // Full 4-char groups → 3 bytes.
+    const full = len - (len % 4 === 0 ? 0 : len % 4);
+    while (i < full) {
+        const a = classifyByte(input[i++]);
+        const b = classifyByte(input[i++]);
+        const c = classifyByte(input[i++]);
+        const d = classifyByte(input[i++]);
+        if (a < 0 || b < 0 || c < 0 || d < 0)
+            fail("base64url: non-alphabet byte");
+        out[op++] = (a << 2) | (b >> 4);
+        out[op++] = (b << 4) | (c >> 2);
+        out[op++] = (c << 6) | d;
+    }
+    // Tail group.
+    const rem = len - i;
+    if (rem === 2) {
+        const a = classifyByte(input[i++]);
+        const b = classifyByte(input[i++]);
+        if (a < 0 || b < 0)
+            fail("base64url: non-alphabet byte");
+        out[op++] = (a << 2) | (b >> 4);
+    }
+    else if (rem === 3) {
+        const a = classifyByte(input[i++]);
+        const b = classifyByte(input[i++]);
+        const c = classifyByte(input[i++]);
+        if (a < 0 || b < 0 || c < 0)
+            fail("base64url: non-alphabet byte");
+        out[op++] = (a << 2) | (b >> 4);
+        out[op++] = (b << 4) | (c >> 2);
+    }
+    // REQ1-B64-canonical: re-encode the decoded bytes; the unpadded form must reproduce the input.
+    const reEncoded = base64urlEncode(out.subarray(0, op));
+    if (reEncoded.length !== len || !bytesEqual(reEncoded, input)) {
+        fail("base64url: non-canonical input");
+    }
+    return out.subarray(0, op);
+}
+export function base64urlEncode(input) {
+    const len = input.length;
+    const outLen = ((len + 2) / 3 | 0) * 4;
+    // Trim the padding: unpadded output length.
+    const rem = len % 3;
+    const padded = rem === 0 ? outLen : outLen - (3 - rem);
+    const out = new Uint8Array(padded);
+    let op = 0;
+    let i = 0;
+    const full = len - rem;
+    while (i < full) {
+        const a = input[i++];
+        const b = input[i++];
+        const c = input[i++];
+        out[op++] = ALPHABET.charCodeAt(a >> 2);
+        out[op++] = ALPHABET.charCodeAt(((a & 0x03) << 4) | (b >> 4));
+        out[op++] = ALPHABET.charCodeAt(((b & 0x0f) << 2) | (c >> 6));
+        out[op++] = ALPHABET.charCodeAt(c & 0x3f);
+    }
+    if (rem === 1) {
+        const a = input[i++];
+        out[op++] = ALPHABET.charCodeAt(a >> 2);
+        out[op++] = ALPHABET.charCodeAt((a & 0x03) << 4);
+    }
+    else if (rem === 2) {
+        const a = input[i++];
+        const b = input[i++];
+        out[op++] = ALPHABET.charCodeAt(a >> 2);
+        out[op++] = ALPHABET.charCodeAt(((a & 0x03) << 4) | (b >> 4));
+        out[op++] = ALPHABET.charCodeAt((b & 0x0f) << 2);
+    }
+    return out;
+}
+function bytesEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    for (let i = 0; i < a.length; i++)
+        if (a[i] !== b[i])
+            return false;
+    return true;
+}
+//# sourceMappingURL=base64url.js.map

package/dist/src/base64url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64url.js","sourceRoot":"","sources":["../../src/base64url.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAElC,iFAAiF;AACjF,+EAA+E;AAC/E,wDAAwD;AACxD,oEAAoE;AACpE,kGAAkG;AAClG,EAAE;AACF,mGAAmG;AACnG,mGAAmG;AACnG,oCAAoC;AAEpC,MAAM,QAAQ,GAAG,kEAAkE,CAAC;AACpF,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE;IAAE,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAE1E,mGAAmG;AACnG,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAiB,EAAE,eAAwB;IACzE,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IACzB,8DAA8D;IAC9D,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,sCAAsC,CAAC,CAAC;IAChE,oEAAoE;IACpE,IAAI,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,CAAC,CAAC;SAC1B,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,CAAC,CAAC;IACpC,IAAI,eAAe,KAAK,SAAS,IAAI,MAAM,GAAG,eAAe,EAAE,CAAC;QAC9D,IAAI,CAAC,yCAAyC,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,gCAAgC;IAChC,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;QAChB,MAAM,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAE,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAE,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAE,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAE,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,8BAA8B,CAAC,CAAC;QAC3E,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAChC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAChC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IACD,cAAc;IACd,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC;IACpB,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAE,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAE,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,8BAA8B,CAAC,CAAC;QACzD,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAClC,CAAC;SAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAE,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAE,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAE,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,8BAA8B,CAAC,CAAC;QAClE,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAChC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,+FAA+F;IAC/F,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACvD,IAAI,SAAS,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC,gCAAgC,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAiB;IAC/C,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IACzB,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;IACvC,4CAA4C;IAC5C,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC;IACpB,MAAM,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,MAAM,IAAI,GAAG,GAAG,GAAG,GAAG,CAAC;IACvB,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;QAChB,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,EAAE,CAAE,CAAC;QACtB,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,EAAE,CAAE,CAAC;QACtB,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,EAAE,CAAE,CAAC;QACtB,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACxC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9D,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9D,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,EAAE,CAAE,CAAC;QACtB,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACxC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACnD,CAAC;SAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,EAAE,CAAE,CAAC;QACtB,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,EAAE,CAAE,CAAC;QACtB,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACxC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9D,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,CAAa,EAAE,CAAa;IAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACnE,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/src/bounds.d.ts

@@ -0,0 +1,50 @@
+export declare const MAXIMA: {
+    readonly compact_bytes: 65536;
+    readonly encoded_segment_bytes: 32768;
+    readonly decoded_segment_bytes: 24576;
+    readonly json_bytes: 65536;
+    readonly depth: 32;
+    readonly object_members: 64;
+    readonly array_items: 256;
+    readonly total_nodes: 4096;
+    readonly string_bytes: 8192;
+    readonly key_bytes: 128;
+    readonly number_lexeme_bytes: 64;
+    readonly integer_magnitude: 9007199254740991;
+    readonly float_magnitude: 9007199254740991;
+    readonly kid_bytes: 128;
+    readonly jcs_bytes: 65536;
+    readonly uri_bytes: 8192;
+    readonly identifier_bytes: 512;
+    readonly nonce_bytes: 512;
+    readonly method_bytes: 32;
+    readonly operation_bytes: 128;
+    readonly audiences: 64;
+    readonly operations: 64;
+    readonly selectors: 64;
+    readonly path_segments: 32;
+    readonly one_of_values: 256;
+    readonly public_key_bytes: 32;
+    readonly signature_bytes: 64;
+    readonly digest_bytes: 32;
+    readonly clock_skew: 60;
+    readonly proof_max_age: 300;
+    readonly chain_row_bytes: 4096;
+    readonly chain_rows: 65536;
+    readonly anchor_bytes: 8192;
+    readonly archive_header_bytes: 8192;
+    readonly archive_chunks: 65796;
+    readonly archive_bytes: 270820384;
+    readonly object_version_bytes: 512;
+    readonly key_transitions: 256;
+};
+export type MaximaKey = keyof typeof MAXIMA;
+export interface Bounds {
+    readonly maximum: typeof MAXIMA;
+    readonly overrides: ReadonlyMap<MaximaKey, number>;
+}
+export declare const MAXIMUM_BOUNDS: Bounds;
+export declare function boundsMaximum(): Bounds;
+export declare function boundsNew(tightening?: Readonly<Record<string, number>>): Bounds;
+export declare function coerceBounds(b: Bounds): Bounds;
+export declare function resolve(b: Bounds, key: MaximaKey): number;