@bounded-authority-protocol/verifier 0.2.0

package/dist/src/selector.js

@@ -0,0 +1,142 @@
+import { fail } from "./error.js";
+import { jcsEncode } from "./jcs.js";
+import { utf8Str } from "./json.js";
+import { typedProject } from "./digest.js";
+import { resolve, MAXIMUM_BOUNDS } from "./bounds.js";
+const SELECTOR_KINDS = new Set(["all", "equals", "one_of"]);
+const SELECTOR_MEMBER_SETS = new Set(["kind", "kind,path,value", "kind,path,values"]);
+// Validate + parse a selector from a decoded tagged object. Rejects unknown members, bad shapes.
+export function parseSelector(obj, bounds = MAXIMUM_BOUNDS) {
+    if (obj.t !== "object")
+        fail("selector: object");
+    const kindV = obj.v.get("kind");
+    if (!kindV || kindV.t !== "string")
+        fail("selector: kind");
+    const kind = utf8Str(kindV.v);
+    if (!SELECTOR_KINDS.has(kind))
+        fail("selector: kind closed set");
+    const memberSet = [...obj.v.keys()].sort().join(",");
+    if (!SELECTOR_MEMBER_SETS.has(memberSet))
+        fail("selector: member set");
+    // The reference accepts kind:"all" on any recognized member set. The
+    // path/value(s) are inert and need not satisfy the active-kind shapes.
+    if (kind === "all")
+        return { kind: "all" };
+    // equals / one_of need path + value/values.
+    if (kind === "equals") {
+        if (obj.v.size !== 3)
+            fail("selector: equals members");
+        const path = parsePath(obj.v.get("path"), bounds);
+        const value = obj.v.get("value") ?? fail("selector: value");
+        validateSelectorValue(value, bounds);
+        return { kind: "equals", path, value };
+    }
+    // one_of
+    if (obj.v.size !== 3)
+        fail("selector: one_of members");
+    const path = parsePath(obj.v.get("path"), bounds);
+    const valuesV = obj.v.get("values") ?? fail("selector: values");
+    if (valuesV.t !== "array")
+        fail("selector: values array");
+    if (valuesV.v.length < 1 || valuesV.v.length > resolve(bounds, "one_of_values")) {
+        fail("selector: values count");
+    }
+    const values = valuesV.v.map((v) => { validateSelectorValue(v, bounds); return v; });
+    return { kind: "one_of", path, values };
+}
+function parsePath(pathV, bounds) {
+    if (!pathV || pathV.t !== "array")
+        fail("selector: path array");
+    if (pathV.v.length < 1 || pathV.v.length > resolve(bounds, "path_segments")) {
+        fail("selector: path length");
+    }
+    const names = [];
+    for (const seg of pathV.v) {
+        if (seg.t !== "string")
+            fail("selector: path segment string");
+        const b = seg.v;
+        if (b.length < 1 || b.length > resolve(bounds, "key_bytes"))
+            fail("selector: path segment bytes");
+        names.push(utf8Str(b));
+    }
+    return names;
+}
+function validateSelectorValue(v, bounds) {
+    // Per-node bounds on selector values (depth, members, items, string, magnitude).
+    checkNode(v, 1, bounds);
+}
+function checkNode(v, depth, bounds) {
+    if (depth > resolve(bounds, "depth"))
+        fail("selector: value depth");
+    switch (v.t) {
+        case "string":
+            if (v.v.length > resolve(bounds, "string_bytes"))
+                fail("selector: string bytes");
+            return;
+        case "int":
+            if (Math.abs(v.v) > resolve(bounds, "integer_magnitude"))
+                fail("selector: int magnitude");
+            return;
+        case "float":
+            if (Math.abs(v.v) > resolve(bounds, "float_magnitude"))
+                fail("selector: float magnitude");
+            return;
+        case "array": {
+            if (v.v.length > resolve(bounds, "array_items"))
+                fail("selector: array items");
+            for (const item of v.v)
+                checkNode(item, depth + 1, bounds);
+            return;
+        }
+        case "object": {
+            if (v.v.size > resolve(bounds, "object_members"))
+                fail("selector: object members");
+            for (const [, val] of v.v)
+                checkNode(val, depth + 1, bounds);
+            return;
+        }
+        default: return;
+    }
+}
+// Semantic identity = JCS of the typed-projected form. Returns canonical bytes for comparison.
+export function semanticIdentity(value) {
+    return jcsEncode(typedProject(value));
+}
+// Traverse a path over an OBJECT (paths never index arrays). Returns the value or undefined.
+function traversePath(root, path) {
+    let cur = root;
+    for (const name of path) {
+        if (!cur || cur.t !== "object")
+            return undefined;
+        cur = cur.v.get(name);
+    }
+    return cur;
+}
+// Does this selector match the given cast_arguments? equals/one_of REQUIRE the path to exist
+// (REQ1-SELECTOR-path-required): missing path → no match (not an error).
+export function selectorMatches(sel, castArguments) {
+    if (sel.kind === "all")
+        return true;
+    const target = traversePath(castArguments, sel.path);
+    if (target === undefined)
+        return false; // path required
+    const targetId = semanticIdentity(target);
+    if (sel.kind === "equals") {
+        return bytesEqual(semanticIdentity(sel.value), targetId);
+    }
+    // one_of
+    for (const v of sel.values) {
+        if (bytesEqual(semanticIdentity(v), targetId))
+            return true;
+    }
+    return false;
+}
+function bytesEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    for (let i = 0; i < a.length; i++)
+        if (a[i] !== b[i])
+            return false;
+    return true;
+}
+//# sourceMappingURL=selector.js.map

package/dist/src/selector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"selector.js","sourceRoot":"","sources":["../../src/selector.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAClC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,OAAO,EAAe,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAe,cAAc,EAAkB,MAAM,aAAa,CAAC;AAiBnF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC5D,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,iBAAiB,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAEtF,iGAAiG;AACjG,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,SAAiB,cAAc;IACxE,IAAI,GAAG,CAAC,CAAC,KAAK,QAAQ;QAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,KAAK,QAAQ;QAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACvE,qEAAqE;IACrE,uEAAuE;IACvE,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC3C,4CAA4C;IAC5C,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;YAAE,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC5D,qBAAqB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACrC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACzC,CAAC;IACD,SAAS;IACT,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;QAAE,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,CAAC,KAAK,OAAO;QAAE,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC1D,IAAI,OAAO,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,eAA4B,CAAC,EAAE,CAAC;QAC7F,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,qBAAqB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1C,CAAC;AAED,SAAS,SAAS,CAAC,KAAyB,EAAE,MAAc;IAC1D,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,KAAK,OAAO;QAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAChE,IAAI,KAAK,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,eAA4B,CAAC,EAAE,CAAC;QACzF,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC;QAC1B,IAAI,GAAG,CAAC,CAAC,KAAK,QAAQ;YAAE,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAC9D,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QAChB,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,WAAwB,CAAC;YAAE,IAAI,CAAC,8BAA8B,CAAC,CAAC;QAC/G,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,qBAAqB,CAAC,CAAS,EAAE,MAAc;IACtD,iFAAiF;IACjF,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,SAAS,CAAC,CAAS,EAAE,KAAa,EAAE,MAAc;IACzD,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,OAAoB,CAAC;QAAE,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACjF,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACZ,KAAK,QAAQ;YACX,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,cAA2B,CAAC;gBAAE,IAAI,CAAC,wBAAwB,CAAC,CAAC;YAC9F,OAAO;QACT,KAAK,KAAK;YACR,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,mBAAgC,CAAC;gBAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC;YACvG,OAAO;QACT,KAAK,OAAO;YACV,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,iBAA8B,CAAC;gBAAE,IAAI,CAAC,2BAA2B,CAAC,CAAC;YACvG,OAAO;QACT,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,aAA0B,CAAC;gBAAE,IAAI,CAAC,uBAAuB,CAAC,CAAC;YAC5F,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC;gBAAE,SAAS,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,gBAA6B,CAAC;gBAAE,IAAI,CAAC,0BAA0B,CAAC,CAAC;YAChG,KAAK,MAAM,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,SAAS,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QACD,OAAO,CAAC,CAAC,OAAO;IAClB,CAAC;AACH,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,6FAA6F;AAC7F,SAAS,YAAY,CAAC,IAAY,EAAE,IAAc;IAChD,IAAI,GAAG,GAAuB,IAAI,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACjD,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,6FAA6F;AAC7F,yEAAyE;AACzE,MAAM,UAAU,eAAe,CAAC,GAAa,EAAE,aAAqB;IAClE,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,MAAM,GAAG,YAAY,CAAC,aAAa,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACrD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,CAAC,gBAAgB;IACxD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,UAAU,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC3D,CAAC;IACD,SAAS;IACT,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAC3B,IAAI,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;IAC7D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,CAAa,EAAE,CAAa;IAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACnE,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/src/uri.d.ts

@@ -0,0 +1,4 @@
+import { type Result } from "./error.js";
+import { type Bounds } from "./bounds.js";
+export declare function uriNormalize(input: Uint8Array, bounds?: Bounds): Result<Uint8Array>;
+export declare function localLoopbackHttpUriNormalize(input: Uint8Array, bounds?: Bounds): Result<Uint8Array>;

package/dist/src/uri.js

@@ -0,0 +1,280 @@
+import { fail, ok, err } from "./error.js";
+import { coerceBounds, resolve, MAXIMUM_BOUNDS } from "./bounds.js";
+import { utf8Str, strUtf8 } from "./json.js";
+// Bounded HTTPS URI normalization (spec/bap-v1.md § URI normalization, L201-219; RFC 3986 §6).
+// No DNS, IDNA, or network work (REQ1-URI-no-network). Both expected and proof URIs MUST already
+// equal the normal form (REQ1-URI-pre-normalized). Reject-list: HTTP, other scheme, authority-less
+// form, malformed percent escapes, ambiguous authority/port, control/non-ASCII, out-of-range ports
+// (REQ1-URI-reject-list).
+//
+// Normalization: lowercase scheme + host; uppercase percent hex; decode only percent-encoded
+// unreserved octets; preserve percent-encoded reserved octets as path data; remove complete dot
+// segments; empty path → "/"; drop port 443; preserve a valid nondefault port + all other path bytes.
+export function uriNormalize(input, bounds = MAXIMUM_BOUNDS) {
+    try {
+        return ok(strUtf8(normalize(input, coerceBounds(bounds))));
+    }
+    catch (e) {
+        if (e instanceof Error && e.name === "InvalidError")
+            return err();
+        throw e;
+    }
+}
+export function localLoopbackHttpUriNormalize(input, bounds = MAXIMUM_BOUNDS) {
+    try {
+        return ok(strUtf8(normalizeLocalLoopbackHttp(input, coerceBounds(bounds))));
+    }
+    catch (e) {
+        if (e instanceof Error && e.name === "InvalidError")
+            return err();
+        throw e;
+    }
+}
+function normalizeLocalLoopbackHttp(input, bounds) {
+    if (input.length > resolve(bounds, "uri_bytes"))
+        fail("uri: byte bound");
+    const uri = utf8Str(input);
+    if (!bytesEqualUtf8(input, uri) || !/^[\x21-\x7E]+$/.test(uri))
+        fail("uri: ASCII");
+    const match = /^([A-Za-z][A-Za-z0-9+.-]*):\/\/([^/?#]*)([^?#]*)$/.exec(uri);
+    if (match === null || match[1].toLowerCase() !== "http")
+        fail("uri: scheme");
+    const authorityMatch = /^(127\.0\.0\.1|\[::1\])(?::([0-9]+))?$/.exec(match[2]);
+    if (authorityMatch === null)
+        fail("uri: loopback authority");
+    const host = authorityMatch[1];
+    let port = "";
+    if (authorityMatch[2] !== undefined) {
+        const value = Number(authorityMatch[2]);
+        if (!Number.isSafeInteger(value) || value < 1 || value > 65535)
+            fail("uri: port");
+        if (value !== 80)
+            port = `:${value}`;
+    }
+    const normalized = `http://${host}${port}${normalizePath(match[3], true)}`;
+    if (strUtf8(normalized).length > resolve(bounds, "uri_bytes"))
+        fail("uri: byte bound");
+    return normalized;
+}
+function normalize(input, bounds) {
+    if (input.length > resolve(bounds, "uri_bytes"))
+        fail("uri: byte bound");
+    const uri = utf8Str(input);
+    // UTF-8 validity (re-encode check) + ASCII-only (REQ1-URI-reject-list: control/non-ASCII invalid).
+    if (!bytesEqualUtf8(input, uri))
+        fail("uri: UTF-8");
+    if (!/^[\x21-\x7E]+$/.test(uri))
+        fail("uri: ASCII");
+    const match = /^([A-Za-z][A-Za-z0-9+.-]*):\/\/([^/?#]*)([^?#]*)$/.exec(uri);
+    if (match === null)
+        fail("uri: hierarchical shape");
+    if (match[1].toLowerCase() !== "https")
+        fail("uri: scheme");
+    const authority = match[2];
+    if (authority.length === 0 || authority.includes("@"))
+        fail("uri: authority");
+    let host = "";
+    let port = "";
+    if (authority.startsWith("[")) {
+        const close = authority.indexOf("]");
+        if (close <= 1)
+            fail("uri: IPv6 host");
+        const literal = authority.slice(1, close);
+        const kind = ipv6Kind(literal);
+        if (kind === null)
+            fail("uri: IP-literal syntax");
+        host = kind === "future" ? `[${literal}]` : `[${literal.toLowerCase()}]`;
+        const suffix = authority.slice(close + 1);
+        if (suffix !== "" && !/^:\d+$/.test(suffix))
+            fail("uri: IPv6 port");
+        port = suffix.slice(1);
+    }
+    else {
+        const colonCount = (authority.match(/:/g) ?? []).length;
+        if (colonCount > 1)
+            fail("uri: host/port ambiguity");
+        const separator = authority.lastIndexOf(":");
+        if (separator >= 0) {
+            host = authority.slice(0, separator);
+            port = authority.slice(separator + 1);
+            if (port.length === 0)
+                fail("uri: empty port");
+        }
+        else {
+            host = authority;
+        }
+        if (host.length === 0)
+            fail("uri: host");
+        if (/^[0-9.]+$/.test(host)) {
+            if (!isCanonicalIpv4(host))
+                fail("uri: IPv4 syntax");
+        }
+        else {
+            assertRegName(host);
+            host = lowercaseOutsideEscapes(normalizePercentEncoding(host));
+        }
+    }
+    if (port !== "") {
+        if (!/^\d+$/.test(port))
+            fail("uri: port");
+        const portNumber = Number(port);
+        if (portNumber < 1 || portNumber > 65535)
+            fail("uri: port range");
+        port = portNumber === 443 ? "" : `:${portNumber}`;
+    }
+    return `https://${host}${port}${normalizePath(match[3], true)}`;
+}
+function normalizePath(path, enforcePchar = false) {
+    const raw = path === "" ? "/" : path;
+    if (enforcePchar) {
+        for (const ch of raw) {
+            if (ch !== "%" && !/[A-Za-z0-9\-._~!$&'()*+,;=:@/]/.test(ch))
+                fail("uri: path character");
+        }
+    }
+    const normalized = removeDotSegments(normalizePercentEncoding(raw));
+    if (!normalized.startsWith("/"))
+        fail("uri: absolute path");
+    return normalized;
+}
+function bytesEqualUtf8(bytes, s) {
+    return strUtf8(s).length === bytes.length && strUtf8(s).every((b, i) => b === bytes[i]);
+}
+function isCanonicalIpv4(host) {
+    const octets = host.split(".");
+    return (octets.length === 4 &&
+        octets.every((o) => /^(?:0|[1-9]\d{0,2})$/.test(o) && Number(o) <= 255));
+}
+const REG_NAME_CHAR = /[A-Za-z0-9\-._~!$&'()*+,;=]/;
+function assertRegName(host) {
+    for (let i = 0; i < host.length; i++) {
+        const ch = host[i];
+        if (REG_NAME_CHAR.test(ch))
+            continue;
+        if (ch === "%" &&
+            i + 2 < host.length &&
+            /^[0-9A-Fa-f]{2}$/.test(host.slice(i + 1, i + 3))) {
+            i += 2;
+            continue;
+        }
+        fail("uri: reg-name");
+    }
+}
+const UNRESERVED = /[A-Za-z0-9\-._~]/;
+function normalizePercentEncoding(value) {
+    let result = "";
+    for (let i = 0; i < value.length; i++) {
+        if (value[i] !== "%") {
+            result += value[i];
+            continue;
+        }
+        if (i + 2 >= value.length || !/^[0-9A-Fa-f]{2}$/.test(value.slice(i + 1, i + 3))) {
+            fail("uri: escape");
+        }
+        const octet = Number.parseInt(value.slice(i + 1, i + 3), 16);
+        const ch = String.fromCharCode(octet);
+        result += UNRESERVED.test(ch)
+            ? ch
+            : `%${octet.toString(16).toUpperCase().padStart(2, "0")}`;
+        i += 2;
+    }
+    return result;
+}
+function lowercaseOutsideEscapes(value) {
+    let result = "";
+    for (let i = 0; i < value.length; i++) {
+        if (value[i] === "%") {
+            result += value.slice(i, i + 3);
+            i += 2;
+        }
+        else {
+            result += value[i].toLowerCase();
+        }
+    }
+    return result;
+}
+// RFC 3986 §6.2.2.3 dot-segment removal (the canonical algorithm).
+function removeDotSegments(path) {
+    let input = path;
+    let output = "";
+    while (input.length > 0) {
+        if (input.startsWith("../"))
+            input = input.slice(3);
+        else if (input.startsWith("./"))
+            input = input.slice(2);
+        else if (input.startsWith("/./"))
+            input = input.slice(2);
+        else if (input === "/.")
+            input = "/";
+        else if (input.startsWith("/../")) {
+            input = input.slice(3);
+            output = output.replace(/\/?[^/]*$/, "");
+        }
+        else if (input === "/..") {
+            input = "/";
+            output = output.replace(/\/?[^/]*$/, "");
+        }
+        else if (input === "." || input === "..") {
+            input = "";
+        }
+        else {
+            const startAt = input.startsWith("/") ? 1 : 0;
+            const nextSlash = input.indexOf("/", startAt);
+            const end = nextSlash === -1 ? input.length : nextSlash;
+            output += input.slice(0, end);
+            input = input.slice(end);
+        }
+    }
+    return output;
+}
+function ipv6Kind(literal) {
+    if (/^[0-9A-Fa-f:.]+$/.test(literal) && validIpv6Literal(literal))
+        return 6;
+    if (/^v[0-9A-Fa-f]+\.[A-Za-z0-9._~!$&'()*+,;=:-]+$/.test(literal))
+        return "future";
+    return null;
+}
+// Structural IPv6 validation mirroring the reference (uri.ex:181-226 valid_ipv6_literal? /
+// ipv6_side_length / ipv6_groups_length). Rejects malformed literals like ":::", "1:2:3:4:5:6:7:8:9"
+// (too many groups), and a "::" that does not actually compress (< 8 groups required). The prior
+// implementation only checked the character class, so structurally-invalid literals normalized.
+function validIpv6Literal(literal) {
+    const parts = literal.split("::");
+    if (parts.length === 1) {
+        return ipv6SideLength(parts[0]) === 8;
+    }
+    if (parts.length === 2) {
+        const left = ipv6SideLength(parts[0]);
+        const right = ipv6SideLength(parts[1]);
+        if (left === null || right === null)
+            return false;
+        return left + right < 8;
+    }
+    return false; // multiple "::" compressions
+}
+// Count groups on one side of "::". Returns null if any group is malformed.
+function ipv6SideLength(side) {
+    if (side === "")
+        return 0;
+    const groups = side.split(":");
+    let total = 0;
+    for (let i = 0; i < groups.length; i++) {
+        const group = groups[i];
+        const isLast = i === groups.length - 1;
+        if (group.includes(".")) {
+            // An IPv4-style group is valid ONLY in the tail position (reference ipv6_groups_length checks
+            // non-last groups as hex-only via valid_hex_group?). A non-tail IPv4 group is a malformed
+            // literal the reference rejects.
+            if (!isLast || !isCanonicalIpv4(group))
+                return null;
+            total += 2;
+        }
+        else {
+            if (!(group.length >= 1 && group.length <= 4) || !/^[0-9A-Fa-f]+$/.test(group))
+                return null;
+            total += 1;
+        }
+    }
+    return total;
+}
+//# sourceMappingURL=uri.js.map

package/dist/src/uri.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"uri.js","sourceRoot":"","sources":["../../src/uri.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAe,EAAE,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,OAAO,EAAe,cAAc,EAAkB,MAAM,aAAa,CAAC;AACjG,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE7C,+FAA+F;AAC/F,iGAAiG;AACjG,mGAAmG;AACnG,mGAAmG;AACnG,0BAA0B;AAC1B,EAAE;AACF,6FAA6F;AAC7F,gGAAgG;AAChG,sGAAsG;AAEtG,MAAM,UAAU,YAAY,CAAC,KAAiB,EAAE,SAAiB,cAAc;IAC7E,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc;YAAE,OAAO,GAAG,EAAE,CAAC;QAClE,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,KAAiB,EACjB,SAAiB,cAAc;IAE/B,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,OAAO,CAAC,0BAA0B,CAAC,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc;YAAE,OAAO,GAAG,EAAE,CAAC;QAClE,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAiB,EAAE,MAAc;IACnE,IAAI,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,WAAwB,CAAC;QAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACtF,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACnF,MAAM,KAAK,GAAG,mDAAmD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5E,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,KAAK,MAAM;QAAE,IAAI,CAAC,aAAa,CAAC,CAAC;IAE9E,MAAM,cAAc,GAAG,wCAAwC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAChF,IAAI,cAAc,KAAK,IAAI;QAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAE7D,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,CAAE,CAAC;IAChC,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,cAAc,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,KAAK;YAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAClF,IAAI,KAAK,KAAK,EAAE;YAAE,IAAI,GAAG,IAAI,KAAK,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,UAAU,GAAG,UAAU,IAAI,GAAG,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,IAAI,CAAC,EAAE,CAAC;IAC5E,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,WAAwB,CAAC;QAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACpG,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,SAAS,CAAC,KAAiB,EAAE,MAAc;IAClD,IAAI,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,WAAwB,CAAC;QAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACtF,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,mGAAmG;IACnG,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC;QAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACpD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,mDAAmD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5E,IAAI,KAAK,KAAK,IAAI;QAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACpD,IAAI,KAAK,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,KAAK,OAAO;QAAE,IAAI,CAAC,aAAa,CAAC,CAAC;IAE7D,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IAC5B,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC9E,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,IAAI,GAAG,EAAE,CAAC;IAEd,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,KAAK,IAAI,CAAC;YAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,IAAI,IAAI,KAAK,IAAI;YAAE,IAAI,CAAC,wBAAwB,CAAC,CAAC;QAClD,IAAI,GAAG,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC;QACzE,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC1C,IAAI,MAAM,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACpE,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;SAAM,CAAC;QACN,MAAM,UAAU,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACxD,IAAI,UAAU,GAAG,CAAC;YAAE,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACnB,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YACrC,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;YACtC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACjD,CAAC;aAAM,CAAC;YACN,IAAI,GAAG,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACzC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACvD,CAAC;aAAM,CAAC;YACN,aAAa,CAAC,IAAI,CAAC,CAAC;YACpB,IAAI,GAAG,uBAAuB,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAED,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAChB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,UAAU,GAAG,CAAC,IAAI,UAAU,GAAG,KAAK;YAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAClE,IAAI,GAAG,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,UAAU,EAAE,CAAC;IACpD,CAAC;IAED,OAAO,WAAW,IAAI,GAAG,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,IAAI,CAAC,EAAE,CAAC;AACnE,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,YAAY,GAAG,KAAK;IACvD,MAAM,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACrC,IAAI,YAAY,EAAE,CAAC;QACjB,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,iBAAiB,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC5D,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,cAAc,CAAC,KAAiB,EAAE,CAAS;IAClD,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,CACL,MAAM,CAAC,MAAM,KAAK,CAAC;QACnB,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CACxE,CAAC;AACJ,CAAC;AAED,MAAM,aAAa,GAAG,6BAA6B,CAAC;AACpD,SAAS,aAAa,CAAC,IAAY;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACpB,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,SAAS;QACrC,IACE,EAAE,KAAK,GAAG;YACV,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM;YACnB,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EACjD,CAAC;YACD,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,GAAG,kBAAkB,CAAC;AACtC,SAAS,wBAAwB,CAAC,KAAa;IAC7C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;YACnB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,IAAI,CAAC,aAAa,CAAC,CAAC;QACtB,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7D,MAAM,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QAC5D,CAAC,IAAI,CAAC,CAAC;IACT,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAa;IAC5C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAChC,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC;QACpC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,mEAAmE;AACnE,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,KAAK,GAAG,IAAI,CAAC;IACjB,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;aAC/C,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;aACnD,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;aACpD,IAAI,KAAK,KAAK,IAAI;YAAE,KAAK,GAAG,GAAG,CAAC;aAChC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACvB,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC3C,CAAC;aAAM,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;YAC3B,KAAK,GAAG,GAAG,CAAC;YACZ,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC3C,CAAC;aAAM,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAC3C,KAAK,GAAG,EAAE,CAAC;QACb,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC9C,MAAM,GAAG,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC9B,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,QAAQ,CAAC,OAAe;IAC/B,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,gBAAgB,CAAC,OAAO,CAAC;QAAE,OAAO,CAAC,CAAC;IAC5E,IAAI,+CAA+C,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,QAAQ,CAAC;IACnF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2FAA2F;AAC3F,qGAAqG;AACrG,iGAAiG;AACjG,gGAAgG;AAChG,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;QACxC,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAClD,OAAO,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,6BAA6B;AAC7C,CAAC;AAED,4EAA4E;AAC5E,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,CAAC,CAAC;IAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;QACzB,MAAM,MAAM,GAAG,CAAC,KAAK,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QACvC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,8FAA8F;YAC9F,0FAA0F;YAC1F,iCAAiC;YACjC,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpD,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC5F,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/src/v1.d.ts

@@ -0,0 +1,211 @@
+import { type Result } from "./error.js";
+import { type Tagged } from "./json.js";
+import { base64urlDecode, base64urlEncode } from "./base64url.js";
+import { type SigningInput } from "./compact.js";
+import { jwkEncodePublic, jwkDecodePublic, thumbprint } from "./jwk.js";
+import { sha256 } from "./ed25519.js";
+import { REQUEST_PREFIX, typedProject } from "./digest.js";
+import { parseSelector, selectorMatches, type Selector } from "./selector.js";
+import { uriNormalize } from "./uri.js";
+import { boundsNew, boundsMaximum, MAXIMUM_BOUNDS, MAXIMA, type Bounds, type MaximaKey } from "./bounds.js";
+import type { GrantFacts, EnvelopeFacts, ChainFacts, AnchorFacts, KeyTransitionFacts, AnchoredExportFacts, GrantDecoded, ProofDecoded, KeyLocator } from "./facts.js";
+export declare const ROW_PREFIX: Uint8Array<ArrayBuffer>;
+export declare const ARCHIVE_PREFIX: Uint8Array<ArrayBufferLike>;
+export interface TrustedIssuer {
+    readonly keyId: string;
+    readonly publicKey: Uint8Array;
+}
+export interface ExpectedGrant {
+    readonly issuer: string;
+    readonly audience: string;
+    readonly evaluationTime: number;
+    readonly clockSkew: number;
+    readonly bounds?: Bounds;
+}
+export interface HistoricalPublicKey {
+    readonly keyId: string;
+    readonly publicKey: Uint8Array;
+    readonly validFrom: number;
+    readonly validBefore: number | null;
+}
+export interface ExpectedAnchor {
+    readonly anchorId: string;
+    readonly anchoredAt: number;
+    readonly chainId: string;
+    readonly sequence: number;
+    readonly chainHash: Uint8Array;
+    readonly keyId: string;
+    readonly keyFingerprint: Uint8Array;
+    readonly bounds?: Bounds;
+}
+export interface ExpectedKeyTransition {
+    readonly transitionId: string;
+    readonly chainId: string;
+    readonly effectiveAt: number;
+    readonly currentKeyId: string;
+    readonly currentKeyFingerprint: Uint8Array;
+    readonly nextKeyId: string;
+    readonly nextKeyFingerprint: Uint8Array;
+    readonly bounds?: Bounds;
+}
+export interface ConsumptionEntry {
+    readonly chainId: string;
+    readonly sequence: number;
+    readonly previousHash: Uint8Array;
+    readonly commitment: Uint8Array;
+}
+export interface ChainInput {
+    readonly rows: Uint8Array[];
+    readonly chainId: string;
+    readonly firstSequence: number;
+    readonly lastSequence: number;
+    readonly rowCount: number;
+    readonly previousHash: Uint8Array;
+    readonly lastHash: Uint8Array;
+}
+export interface ExpectedChain {
+    readonly chainId: string;
+    readonly firstSequence: number;
+    readonly lastSequence: number;
+    readonly rowCount: number;
+    readonly previousHash: Uint8Array;
+    readonly lastHash: Uint8Array;
+    readonly bounds?: Bounds;
+}
+export interface ExpectedRequest {
+    readonly trustedIssuer: TrustedIssuer;
+    readonly issuer: string;
+    readonly audience: string;
+    readonly method: string;
+    readonly targetUri: string;
+    readonly invocationId: string;
+    readonly operation: string;
+    readonly castArguments: Tagged;
+    readonly evaluationTime: number;
+    readonly clockSkew: number;
+    readonly proofMaxAge: number;
+    readonly nonce: {
+        kind: "not_required";
+    } | {
+        kind: "required";
+        value: string;
+    };
+    readonly bounds?: Bounds;
+}
+export type SelectorInput = "all" | {
+    readonly kind: "all";
+} | {
+    readonly kind: "equals";
+    readonly path: string[];
+    readonly value: Tagged;
+} | {
+    readonly kind: "one_of";
+    readonly path: string[];
+    readonly values: Tagged[];
+};
+export interface OperationInput {
+    readonly name: string;
+    readonly selectors: SelectorInput[];
+}
+export interface GrantProducer {
+    readonly keyId: string;
+    readonly issuer: string;
+    readonly grantId: string;
+    readonly audiences: string[];
+    readonly issuedAt: number;
+    readonly notBefore: number;
+    readonly expiresAt: number;
+    readonly holderThumbprint: string;
+    readonly operations: OperationInput[];
+}
+export interface ProofProducer {
+    readonly holderPublicKey: Uint8Array;
+    readonly proofId: string;
+    readonly method: string;
+    readonly targetUri: string;
+    readonly issuedAt: number;
+    readonly invocationId: string;
+    readonly operation: string;
+    readonly grantCompact: Uint8Array;
+    readonly castArguments: Tagged;
+    readonly nonce?: string;
+}
+export interface BoundaryAnchorProducer {
+    readonly anchorId: string;
+    readonly anchoredAt: number;
+    readonly chainId: string;
+    readonly sequence: number;
+    readonly chainHash: Uint8Array;
+    readonly keyId: string;
+    readonly publicKey: Uint8Array;
+}
+export interface KeyTransitionProducer {
+    readonly transitionId: string;
+    readonly chainId: string;
+    readonly effectiveAt: number;
+    readonly currentKeyId: string;
+    readonly currentPublicKey: Uint8Array;
+    readonly nextKeyId: string;
+    readonly nextPublicKey: Uint8Array;
+}
+export interface AnchoredExportInput {
+    readonly rows: Uint8Array[];
+    readonly startAnchor: Uint8Array;
+    readonly endAnchor: Uint8Array;
+    readonly transitions: Uint8Array[];
+    readonly chainId: string;
+    readonly firstSequence: number;
+    readonly lastSequence: number;
+    readonly rowCount: number;
+    readonly previousHash: Uint8Array;
+    readonly lastHash: Uint8Array;
+}
+export interface ExpectedExport {
+    readonly chain: ExpectedChain;
+    readonly digest: Uint8Array;
+    readonly startAnchor: ExpectedAnchor;
+    readonly endAnchor: ExpectedAnchor;
+    readonly transitions: ExpectedKeyTransition[];
+    readonly objectVersion: string;
+    readonly bounds?: Bounds;
+}
+export interface ArchivedObject {
+    readonly chunks: Uint8Array[];
+    readonly version: string;
+}
+export interface HistoricalKeyChain {
+    readonly keys: HistoricalPublicKey[];
+}
+export declare function untrustedKeyLocator(compact: Uint8Array, bounds?: Bounds): Result<KeyLocator>;
+export declare function decodeGrant(compact: Uint8Array, bounds?: Bounds): Result<GrantDecoded>;
+export declare function decodeProof(compact: Uint8Array, bounds?: Bounds): Result<ProofDecoded>;
+export declare function decodeLocalLoopbackHttpProof(compact: Uint8Array, bounds?: Bounds): Result<ProofDecoded>;
+export declare function verifyGrant(compact: Uint8Array, trusted: TrustedIssuer, expected: ExpectedGrant): Result<GrantFacts>;
+export declare function checkEnvelope(grantCompact: Uint8Array, proofCompact: Uint8Array, expected: ExpectedRequest): Result<EnvelopeFacts>;
+export declare function checkLocalLoopbackHttpEnvelope(grantCompact: Uint8Array, proofCompact: Uint8Array, expected: ExpectedRequest): Result<EnvelopeFacts>;
+export declare function requestDigest(operation: string, castArguments: Tagged, bounds?: Bounds): Result<Uint8Array>;
+export interface EncodedConsumptionEntry {
+    readonly bytes: Uint8Array;
+    readonly hash: Uint8Array;
+}
+export declare function encodeConsumptionEntry(entry: ConsumptionEntry, bounds?: Bounds): Result<EncodedConsumptionEntry>;
+export declare function checkChain(chain: ChainInput, expected: ExpectedChain): Result<ChainFacts>;
+export declare function grantSigningInput(grant: GrantProducer, bounds?: Bounds): Result<SigningInput>;
+export declare function proofSigningInput(proof: ProofProducer, bounds?: Bounds): Result<SigningInput>;
+export declare function localLoopbackHttpProofSigningInput(proof: ProofProducer, bounds?: Bounds): Result<SigningInput>;
+export declare function assembleCompact(input: SigningInput, signature: Uint8Array, bounds?: Bounds): Result<Uint8Array>;
+export declare function assembleLocalLoopbackHttpCompact(input: SigningInput, signature: Uint8Array, bounds?: Bounds): Result<Uint8Array>;
+export declare function boundaryAnchorSigningInput(anchor: BoundaryAnchorProducer, bounds?: Bounds): Result<SigningInput>;
+export declare function keyTransitionSigningInput(t: KeyTransitionProducer, bounds?: Bounds): Result<SigningInput>;
+export interface EncodedAnchoredExport {
+    readonly archive: Uint8Array;
+    readonly digest: Uint8Array;
+}
+export declare function encodeAnchoredExport(input: AnchoredExportInput, expected: ExpectedExport): Result<EncodedAnchoredExport>;
+export declare function verifyHistoricalAnchor(compact: Uint8Array, key: HistoricalPublicKey, expected: ExpectedAnchor): Result<AnchorFacts>;
+export declare function verifyKeyTransition(compact: Uint8Array, oldKey: HistoricalPublicKey, newKey: HistoricalPublicKey, expected: ExpectedKeyTransition): Result<KeyTransitionFacts>;
+export declare function verifyAnchoredExport(archived: ArchivedObject, keyChain: HistoricalKeyChain, expected: ExpectedExport): Result<AnchoredExportFacts>;
+export { jwkEncodePublic, jwkDecodePublic, thumbprint, sha256, base64urlDecode, base64urlEncode };
+export { boundsNew, boundsMaximum, MAXIMUM_BOUNDS, MAXIMA };
+export { uriNormalize, parseSelector, selectorMatches, typedProject, REQUEST_PREFIX };
+export type { Bounds, SigningInput, Selector, MaximaKey };