@distilled.cloud/acme 0.0.0-placeholder → 1.0.0-rc.13

package/lib/jose.d.ts

@@ -0,0 +1,66 @@
+/**
+ * JOSE helpers for ACME — hand-written, WebCrypto only (no native code).
+ *
+ * - account keys (ES256 P-256 by default, RS256 accepted)
+ * - JWS in the flattened JSON serialization every ACME POST carries
+ *   (RFC 8555 §6.2), including the HS256 External Account Binding
+ * - RFC 7638 JWK thumbprints, key authorizations and the DNS-01 TXT value
+ */
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { JoseError } from "./errors.ts";
+export type Algorithm = "ES256" | "RS256";
+export interface Jwk {
+    readonly kty: string;
+    readonly crv?: string;
+    readonly x?: string;
+    readonly y?: string;
+    readonly n?: string;
+    readonly e?: string;
+    readonly d?: string;
+    readonly [key: string]: unknown;
+}
+export declare const base64url: (bytes: Uint8Array | ArrayBuffer) => string;
+export declare const base64urlDecode: (text: string) => Uint8Array;
+/** Detect the JWS algorithm for a JWK. */
+export declare const algorithmOf: (jwk: Jwk) => Algorithm;
+/** Generate a fresh account key as a private JWK (JSON text, Redacted). */
+export declare const generateAccountKey: (alg?: Algorithm) => Effect.Effect<Redacted.Redacted<string>>;
+/** Parse a private JWK from its JSON text. */
+export declare const parseJwk: (key: Redacted.Redacted<string> | string) => Effect.Effect<Jwk, JoseError>;
+/** The public half of a JWK, with members in RFC 7638 canonical order. */
+export declare const publicJwk: (jwk: Jwk) => Jwk;
+/** RFC 7638 JWK thumbprint (base64url SHA-256 of the canonical public JWK). */
+export declare const thumbprint: (jwk: Jwk) => Effect.Effect<string>;
+/** `<token>.<thumbprint>` — what a challenge proves the client holds. */
+export declare const keyAuthorization: (token: string, jwk: Jwk) => Effect.Effect<string>;
+/** The TXT record value for a DNS-01 challenge: base64url(SHA-256(keyAuthorization)). */
+export declare const dnsChallengeValue: (token: string, jwk: Jwk) => Effect.Effect<string>;
+export interface FlattenedJws {
+    readonly protected: string;
+    readonly payload: string;
+    readonly signature: string;
+}
+export interface SignOptions {
+    readonly jwk: Jwk;
+    readonly url: string;
+    readonly nonce: string;
+    /** Sent as `kid` when known; otherwise the public JWK is embedded. */
+    readonly kid?: string | undefined;
+    /** `undefined` produces a POST-as-GET (empty payload). */
+    readonly payload?: unknown;
+}
+/** Sign an ACME request body (RFC 8555 §6.2) with the account key. */
+export declare const signRequest: (options: SignOptions) => Effect.Effect<FlattenedJws, JoseError>;
+/**
+ * The External Account Binding JWS (RFC 8555 §7.3.4): HS256 over the
+ * account's public JWK, keyed by the CA-issued HMAC key, with the CA's key
+ * id as `kid`.
+ */
+export declare const signExternalAccountBinding: (options: {
+    readonly jwk: Jwk;
+    readonly url: string;
+    readonly keyId: string;
+    readonly hmacKey: Redacted.Redacted<string> | string;
+}) => Effect.Effect<FlattenedJws, JoseError>;
+//# sourceMappingURL=jose.d.ts.map

package/lib/jose.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jose.d.ts","sourceRoot":"","sources":["../src/jose.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC;AAE1C,MAAM,WAAW,GAAG;IAClB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACjC;AAID,eAAO,MAAM,SAAS,UAAW,UAAU,GAAG,WAAW,KAAG,MAQ3D,CAAC;AAEF,eAAO,MAAM,eAAe,SAAU,MAAM,KAAG,UAM9C,CAAC;AAaF,0CAA0C;AAC1C,eAAO,MAAM,WAAW,QAAS,GAAG,KAAG,SACA,CAAC;AAYxC,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,SACxB,SAAS,KACb,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAgBtC,CAAC;AAEL,8CAA8C;AAC9C,eAAO,MAAM,QAAQ,QACd,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,KACtC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAS3B,CAAC;AAEL,0EAA0E;AAC1E,eAAO,MAAM,SAAS,QAAS,GAAG,KAAG,GAGgB,CAAC;AAEtD,+EAA+E;AAC/E,eAAO,MAAM,UAAU,QAAS,GAAG,KAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CACU,CAAC;AAErE,yEAAyE;AACzE,eAAO,MAAM,gBAAgB,UACpB,MAAM,OACR,GAAG,KACP,MAAM,CAAC,MAAM,CAAC,MAAM,CAC2C,CAAC;AAEnE,yFAAyF;AACzF,eAAO,MAAM,iBAAiB,UACrB,MAAM,OACR,GAAG,KACP,MAAM,CAAC,MAAM,CAAC,MAAM,CAIpB,CAAC;AAEJ,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAClB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,sEAAsE;IACtE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,sEAAsE;AACtE,eAAO,MAAM,WAAW,YACb,WAAW,KACnB,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,CAmCpC,CAAC;AAEL;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,YAAa;IAClD,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAClB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;CACtD,KAAG,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,CAmCrC,CAAC"}

package/lib/jose.js

@@ -0,0 +1,128 @@
+/**
+ * JOSE helpers for ACME — hand-written, WebCrypto only (no native code).
+ *
+ * - account keys (ES256 P-256 by default, RS256 accepted)
+ * - JWS in the flattened JSON serialization every ACME POST carries
+ *   (RFC 8555 §6.2), including the HS256 External Account Binding
+ * - RFC 7638 JWK thumbprints, key authorizations and the DNS-01 TXT value
+ */
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { JoseError } from "./errors.js";
+const encoder = new TextEncoder();
+export const base64url = (bytes) => {
+    const view = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+    let binary = "";
+    for (const byte of view)
+        binary += String.fromCharCode(byte);
+    return btoa(binary)
+        .replaceAll("+", "-")
+        .replaceAll("/", "_")
+        .replace(/=+$/, "");
+};
+export const base64urlDecode = (text) => {
+    const padded = text.replaceAll("-", "+").replaceAll("_", "/");
+    const binary = atob(padded + "=".repeat((4 - (padded.length % 4)) % 4));
+    const out = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++)
+        out[i] = binary.charCodeAt(i);
+    return out;
+};
+const base64urlJson = (value) => base64url(encoder.encode(JSON.stringify(value)));
+const sha256 = (data) => Effect.promise(async () => {
+    const bytes = typeof data === "string" ? encoder.encode(data) : data;
+    return new Uint8Array(await crypto.subtle.digest("SHA-256", bytes));
+});
+/** Detect the JWS algorithm for a JWK. */
+export const algorithmOf = (jwk) => jwk.kty === "RSA" ? "RS256" : "ES256";
+const importAlgorithm = (alg) => alg === "RS256"
+    ? { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" }
+    : { name: "ECDSA", namedCurve: "P-256" };
+const signAlgorithm = (alg) => alg === "RS256"
+    ? { name: "RSASSA-PKCS1-v1_5" }
+    : { name: "ECDSA", hash: "SHA-256" };
+/** Generate a fresh account key as a private JWK (JSON text, Redacted). */
+export const generateAccountKey = (alg = "ES256") => Effect.promise(async () => {
+    const pair = await crypto.subtle.generateKey(alg === "RS256"
+        ? {
+            name: "RSASSA-PKCS1-v1_5",
+            modulusLength: 2048,
+            publicExponent: new Uint8Array([1, 0, 1]),
+            hash: "SHA-256",
+        }
+        : { name: "ECDSA", namedCurve: "P-256" }, true, ["sign", "verify"]);
+    const jwk = await crypto.subtle.exportKey("jwk", pair.privateKey);
+    return Redacted.make(JSON.stringify(jwk));
+});
+/** Parse a private JWK from its JSON text. */
+export const parseJwk = (key) => Effect.try({
+    try: () => JSON.parse(Redacted.isRedacted(key) ? Redacted.value(key) : key),
+    catch: (cause) => new JoseError({
+        message: "The account key is not a JSON Web Key.",
+        cause,
+    }),
+});
+/** The public half of a JWK, with members in RFC 7638 canonical order. */
+export const publicJwk = (jwk) => jwk.kty === "RSA"
+    ? { e: jwk.e, kty: "RSA", n: jwk.n }
+    : { crv: jwk.crv, kty: "EC", x: jwk.x, y: jwk.y };
+/** RFC 7638 JWK thumbprint (base64url SHA-256 of the canonical public JWK). */
+export const thumbprint = (jwk) => sha256(JSON.stringify(publicJwk(jwk))).pipe(Effect.map(base64url));
+/** `<token>.<thumbprint>` — what a challenge proves the client holds. */
+export const keyAuthorization = (token, jwk) => thumbprint(jwk).pipe(Effect.map((print) => `${token}.${print}`));
+/** The TXT record value for a DNS-01 challenge: base64url(SHA-256(keyAuthorization)). */
+export const dnsChallengeValue = (token, jwk) => keyAuthorization(token, jwk).pipe(Effect.flatMap(sha256), Effect.map(base64url));
+/** Sign an ACME request body (RFC 8555 §6.2) with the account key. */
+export const signRequest = (options) => Effect.tryPromise({
+    try: async () => {
+        const alg = algorithmOf(options.jwk);
+        const header = {
+            alg,
+            nonce: options.nonce,
+            url: options.url,
+            ...(options.kid !== undefined
+                ? { kid: options.kid }
+                : { jwk: publicJwk(options.jwk) }),
+        };
+        const protectedB64 = base64urlJson(header);
+        const payloadB64 = options.payload === undefined ? "" : base64urlJson(options.payload);
+        const key = await crypto.subtle.importKey("jwk", options.jwk, importAlgorithm(alg), false, ["sign"]);
+        const signature = await crypto.subtle.sign(signAlgorithm(alg), key, encoder.encode(`${protectedB64}.${payloadB64}`));
+        return {
+            protected: protectedB64,
+            payload: payloadB64,
+            signature: base64url(signature),
+        };
+    },
+    catch: (cause) => new JoseError({ message: "Signing the ACME request failed.", cause }),
+});
+/**
+ * The External Account Binding JWS (RFC 8555 §7.3.4): HS256 over the
+ * account's public JWK, keyed by the CA-issued HMAC key, with the CA's key
+ * id as `kid`.
+ */
+export const signExternalAccountBinding = (options) => Effect.tryPromise({
+    try: async () => {
+        const raw = Redacted.isRedacted(options.hmacKey)
+            ? Redacted.value(options.hmacKey)
+            : options.hmacKey;
+        const key = await crypto.subtle.importKey("raw", base64urlDecode(raw), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+        const protectedB64 = base64urlJson({
+            alg: "HS256",
+            kid: options.keyId,
+            url: options.url,
+        });
+        const payloadB64 = base64urlJson(publicJwk(options.jwk));
+        const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(`${protectedB64}.${payloadB64}`));
+        return {
+            protected: protectedB64,
+            payload: payloadB64,
+            signature: base64url(signature),
+        };
+    },
+    catch: (cause) => new JoseError({
+        message: "Signing the External Account Binding failed.",
+        cause,
+    }),
+});
+//# sourceMappingURL=jose.js.map

package/lib/jose.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jose.js","sourceRoot":"","sources":["../src/jose.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAexC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,KAA+B,EAAU,EAAE;IACnE,MAAM,IAAI,GAAG,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IACzE,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,IAAI;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC7D,OAAO,IAAI,CAAC,MAAM,CAAC;SAChB,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;SACpB,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;SACpB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAAY,EAAc,EAAE;IAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACxE,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACtE,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,KAAc,EAAU,EAAE,CAC/C,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAEnD,MAAM,MAAM,GAAG,CAAC,IAAyB,EAA6B,EAAE,CACtE,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;IACxB,MAAM,KAAK,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,OAAO,IAAI,UAAU,CACnB,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAgC,CAAC,CACxE,CAAC;AACJ,CAAC,CAAC,CAAC;AAEL,0CAA0C;AAC1C,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,GAAQ,EAAa,EAAE,CACjD,GAAG,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;AAExC,MAAM,eAAe,GAAG,CAAC,GAAc,EAAE,EAAE,CACzC,GAAG,KAAK,OAAO;IACb,CAAC,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE;IAChD,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AAE7C,MAAM,aAAa,GAAG,CAAC,GAAc,EAAE,EAAE,CACvC,GAAG,KAAK,OAAO;IACb,CAAC,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE;IAC/B,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAEzC,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,GAAG,GAAc,OAAO,EACkB,EAAE,CAC5C,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;IACxB,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAC1C,GAAG,KAAK,OAAO;QACb,CAAC,CAAC;YACE,IAAI,EAAE,mBAAmB;YACzB,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YACzC,IAAI,EAAE,SAAS;SAChB;QACH,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EAC1C,IAAI,EACJ,CAAC,MAAM,EAAE,QAAQ,CAAC,CACnB,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAClE,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;AAC5C,CAAC,CAAC,CAAC;AAEL,8CAA8C;AAC9C,MAAM,CAAC,MAAM,QAAQ,GAAG,CACtB,GAAuC,EACR,EAAE,CACjC,MAAM,CAAC,GAAG,CAAC;IACT,GAAG,EAAE,GAAG,EAAE,CACR,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAQ;IACzE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,IAAI,SAAS,CAAC;QACZ,OAAO,EAAE,wCAAwC;QACjD,KAAK;KACN,CAAC;CACL,CAAC,CAAC;AAEL,0EAA0E;AAC1E,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,GAAQ,EAAO,EAAE,CACzC,GAAG,CAAC,GAAG,KAAK,KAAK;IACf,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE;IACpC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;AAEtD,+EAA+E;AAC/E,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,GAAQ,EAAyB,EAAE,CAC5D,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;AAErE,yEAAyE;AACzE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,KAAa,EACb,GAAQ,EACe,EAAE,CACzB,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;AAEnE,yFAAyF;AACzF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,KAAa,EACb,GAAQ,EACe,EAAE,CACzB,gBAAgB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CAC/B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EACtB,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CACtB,CAAC;AAkBJ,sEAAsE;AACtE,MAAM,CAAC,MAAM,WAAW,GAAG,CACzB,OAAoB,EACoB,EAAE,CAC1C,MAAM,CAAC,UAAU,CAAC;IAChB,GAAG,EAAE,KAAK,IAAI,EAAE;QACd,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG;YACb,GAAG;YACH,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS;gBAC3B,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;gBACtB,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;SACrC,CAAC;QACF,MAAM,YAAY,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,UAAU,GACd,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,OAAO,CAAC,GAAiB,EACzB,eAAe,CAAC,GAAG,CAAC,EACpB,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CACxC,aAAa,CAAC,GAAG,CAAC,EAClB,GAAG,EACH,OAAO,CAAC,MAAM,CAAC,GAAG,YAAY,IAAI,UAAU,EAAE,CAAC,CAChD,CAAC;QACF,OAAO;YACL,SAAS,EAAE,YAAY;YACvB,OAAO,EAAE,UAAU;YACnB,SAAS,EAAE,SAAS,CAAC,SAAS,CAAC;SAChC,CAAC;IACJ,CAAC;IACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,IAAI,SAAS,CAAC,EAAE,OAAO,EAAE,kCAAkC,EAAE,KAAK,EAAE,CAAC;CACxE,CAAC,CAAC;AAEL;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,OAK1C,EAA0C,EAAE,CAC3C,MAAM,CAAC,UAAU,CAAC;IAChB,GAAG,EAAE,KAAK,IAAI,EAAE;QACd,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC;YAC9C,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YACjC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACpB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,eAAe,CAAC,GAAG,CAA4B,EAC/C,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;QACF,MAAM,YAAY,GAAG,aAAa,CAAC;YACjC,GAAG,EAAE,OAAO;YACZ,GAAG,EAAE,OAAO,CAAC,KAAK;YAClB,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,aAAa,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CACxC,MAAM,EACN,GAAG,EACH,OAAO,CAAC,MAAM,CAAC,GAAG,YAAY,IAAI,UAAU,EAAE,CAAC,CAChD,CAAC;QACF,OAAO;YACL,SAAS,EAAE,YAAY;YACvB,OAAO,EAAE,UAAU;YACnB,SAAS,EAAE,SAAS,CAAC,SAAS,CAAC;SAChC,CAAC;IACJ,CAAC;IACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,IAAI,SAAS,CAAC;QACZ,OAAO,EAAE,8CAA8C;QACvD,KAAK;KACN,CAAC;CACL,CAAC,CAAC"}

package/lib/protocol.d.ts

@@ -0,0 +1,27 @@
+import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+import type * as AST from "effect/SchemaAST";
+import * as HttpClient from "effect/http/HttpClient";
+import type * as HttpClientError from "effect/http/HttpClientError";
+import * as API from "@distilled.cloud/core/api";
+import { type ConfigError } from "@distilled.cloud/core/errors";
+import { Credentials } from "./credentials.ts";
+import { type DefaultErrors } from "./errors.ts";
+/**
+ * Error channel shared by every generated ACME operation. Generated service
+ * files annotate operations with `API.OperationMethod<I, O, AcmeOpError,
+ * AcmeOpContext>` explicitly so the compiler never infers these back out of
+ * the schema generics.
+ */
+export type AcmeOpError = DefaultErrors | ConfigError | HttpClientError.HttpClientError;
+/** Context (requirements) shared by every generated ACME operation. */
+export type AcmeOpContext = Credentials | HttpClient.HttpClient;
+export declare const AcmeProtocol: Layer.Layer<API.Protocol>;
+/** Forget cached directories and nonces (tests, CA switches). */
+export declare const resetProtocolCaches: () => void;
+/** @internal re-exported for tests */
+export declare const _internal: {
+    getAnn: (ast: AST.AST, symbol: symbol) => unknown;
+    Redacted: typeof Redacted;
+};
+//# sourceMappingURL=protocol.d.ts.map

package/lib/protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../src/protocol.ts"],"names":[],"mappings":"AA+BA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAG5C,OAAO,KAAK,KAAK,GAAG,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AACrD,OAAO,KAAK,KAAK,eAAe,MAAM,6BAA6B,CAAC;AAGpE,OAAO,KAAK,GAAG,MAAM,2BAA2B,CAAC;AAajD,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,8BAA8B,CAAC;AAKtC,OAAO,EAAE,WAAW,EAAe,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAKL,KAAK,aAAa,EACnB,MAAM,aAAa,CAAC;AAQrB;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GACnB,aAAa,GACb,WAAW,GACX,eAAe,CAAC,eAAe,CAAC;AAEpC,uEAAuE;AACvE,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,UAAU,CAAC,UAAU,CAAC;AA4dhE,eAAO,MAAM,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAOlD,CAAC;AAEF,iEAAiE;AACjE,eAAO,MAAM,mBAAmB,QAAO,IAGtC,CAAC;AAEF,sCAAsC;AACtC,eAAO,MAAM,SAAS;;;CAAuB,CAAC"}

package/lib/protocol.js

@@ -0,0 +1,410 @@
+/**
+ * AcmeProtocol — hand-written.
+ *
+ * ACME (RFC 8555) is JSON over HTTPS with two twists the generic REST
+ * protocol cannot express:
+ *
+ *   signing:    every POST body is a flattened JWS (RFC 8555 §6.2) signed by
+ *               the account key from `Credentials`, carrying a fresh
+ *               anti-replay nonce and the request URL in its protected
+ *               header. `newAccount` embeds the public JWK; every later
+ *               request references the account URL as `kid`. A CA-issued
+ *               External Account Binding is attached to `newAccount` when
+ *               the credentials carry one. Reads are "POST-as-GET" (empty
+ *               payload).
+ *
+ *   addressing: the provider endpoint is the CA's **directory URL**. The
+ *               protocol fetches the directory once per CA and resolves
+ *               `newNonce`/`newAccount`/`newOrder`/`revokeCert` from it;
+ *               every other operation names its resource by the absolute
+ *               URL the CA returned (`url` label).
+ *
+ * Responses are JSON; `Location` (account/order URL), `Replay-Nonce` and
+ * `Link` headers are folded into declared output members. Failures are
+ * RFC 7807 problem documents matched on their `type` URN against the
+ * operation's typed error classes; an unmatched URN is `UnknownAcmeError`.
+ */
+import { isStrict, validateResponse, } from "@distilled.cloud/core/response-validation";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+import * as Schema from "effect/Schema";
+import * as HttpClient from "effect/http/HttpClient";
+import * as HttpClientRequest from "effect/http/HttpClientRequest";
+import * as API from "@distilled.cloud/core/api";
+import { getAnn, getProps, hasPropAnn, mapKeys, } from "@distilled.cloud/core/protocol-http";
+import { unwrapRedactedDeep } from "@distilled.cloud/core/protocol-rest";
+import { getErrorMatchers, httpSymbol, labelSymbol, } from "@distilled.cloud/core/trait";
+import { HTTP_STATUS_MAP, InternalServerError, } from "@distilled.cloud/core/errors";
+import { parseRetryAfter, parseRetryAfterForStatus, } from "@distilled.cloud/core/retry-after";
+import { Credentials } from "./credentials.js";
+import { AcmeParseError, DirectoryMissingResource, JoseError, UnknownAcmeError, } from "./errors.js";
+import { parseJwk, signExternalAccountBinding, signRequest, } from "./jose.js";
+// =============================================================================
+// Directory + nonce caches (per CA, process-wide)
+// =============================================================================
+const DirectorySchema = Schema.Struct({
+    newNonce: Schema.String,
+    newAccount: Schema.String,
+    newOrder: Schema.String,
+    revokeCert: Schema.String,
+    newAuthz: Schema.optional(Schema.String),
+    keyChange: Schema.optional(Schema.String),
+    meta: Schema.optional(Schema.Record(Schema.String, Schema.Unknown)),
+});
+const directories = new Map();
+/** The last unused `Replay-Nonce` per directory URL. Nonces are single-use. */
+const nonces = new Map();
+// HTTP request copies preserve the body identity; entries live only with a request.
+const signedRequests = new WeakMap();
+const resolveCredentials = Effect.gen(function* () {
+    const resolve = yield* Credentials;
+    return yield* resolve;
+});
+const fetchDirectory = (directoryUrl) => Effect.gen(function* () {
+    const cached = directories.get(directoryUrl);
+    if (cached)
+        return cached;
+    const client = yield* HttpClient.HttpClient;
+    const response = yield* client.get(directoryUrl);
+    rememberNonce(directoryUrl, response);
+    if (response.status >= 400) {
+        const text = yield* response.text;
+        return yield* fail(new UnknownAcmeError({
+            message: `GET ${directoryUrl} answered ${response.status}`,
+            status: response.status,
+            body: Redacted.make(text),
+        }));
+    }
+    const text = yield* response.text;
+    const json = yield* parseJson(text);
+    const directory = yield* Schema.decodeUnknownEffect(DirectorySchema)(json).pipe(Effect.mapError(() => parseError("Invalid ACME directory response")));
+    directories.set(directoryUrl, directory);
+    return directory;
+});
+const rememberNonce = (directoryUrl, response) => {
+    const nonce = response.headers["replay-nonce"];
+    if (typeof nonce === "string" && nonce.length > 0) {
+        nonces.set(directoryUrl, nonce);
+    }
+};
+/** Take the cached nonce for this CA, or fetch a fresh one from `newNonce`. */
+const takeNonce = (directoryUrl, directory) => Effect.gen(function* () {
+    const cached = nonces.get(directoryUrl);
+    if (cached !== undefined) {
+        nonces.delete(directoryUrl);
+        return cached;
+    }
+    const client = yield* HttpClient.HttpClient;
+    const response = yield* client.execute(HttpClientRequest.head(directory.newNonce));
+    const nonce = response.headers["replay-nonce"];
+    if (typeof nonce !== "string" || nonce.length === 0) {
+        return yield* fail(new UnknownAcmeError({
+            message: `HEAD ${directory.newNonce} returned no Replay-Nonce header`,
+            status: response.status,
+            body: undefined,
+        }));
+    }
+    return nonce;
+});
+// =============================================================================
+// Encode
+// =============================================================================
+/**
+ * The generated operations carry no name at runtime; the input's `T.Http`
+ * uri (from the Smithy model) identifies which ACME resource an
+ * operation addresses.
+ */
+const OPERATIONS_BY_URI = {
+    "/directory": "GetDirectory",
+    "/newNonce": "NewNonce",
+    "/newAccount": "NewAccount",
+    "/account/{url}": "UpdateAccount",
+    "/newOrder": "NewOrder",
+    "/order/{url}": "GetOrder",
+    "/finalize/{url}": "FinalizeOrder",
+    "/authz/{url}": "GetAuthorization",
+    "/authz/{url}/deactivate": "DeactivateAuthorization",
+    "/challenge/{url}": "RespondChallenge",
+    "/cert/{url}": "DownloadCertificate",
+    "/revokeCert": "RevokeCertificate",
+};
+const operationOf = (inputAst) => {
+    const http = getAnn(inputAst, httpSymbol);
+    return OPERATIONS_BY_URI[http?.uri ?? ""] ?? "";
+};
+/** Operations resolved from the directory rather than an input `url`. */
+const DIRECTORY_OPERATIONS = {
+    NewNonce: "newNonce",
+    NewAccount: "newAccount",
+    NewOrder: "newOrder",
+    RevokeCertificate: "revokeCert",
+};
+/** Operations whose payload is the empty POST-as-GET. */
+const POST_AS_GET = new Set([
+    "GetOrder",
+    "GetAuthorization",
+    "DownloadCertificate",
+]);
+const JOSE_ACCEPT = "application/json, application/pem-certificate-chain";
+const encode = ({ input, inputAst, }) => Effect.gen(function* () {
+    const creds = yield* resolveCredentials;
+    const operation = operationOf(inputAst);
+    if (operation === "") {
+        return yield* fail(new JoseError({
+            message: "The operation's input carries no known ACME `T.Http` uri.",
+        }));
+    }
+    if (operation === "GetDirectory") {
+        return HttpClientRequest.get(creds.directoryUrl).pipe(HttpClientRequest.setHeader("Accept", "application/json"));
+    }
+    const directory = yield* fetchDirectory(creds.directoryUrl);
+    if (operation === "NewNonce") {
+        return HttpClientRequest.head(directory.newNonce);
+    }
+    // Resolve the request URL: from the directory for the well-known
+    // resources, else the absolute `url` label the CA handed back.
+    const inputObj = (unwrapRedactedDeep(input) ?? {});
+    const directoryKey = DIRECTORY_OPERATIONS[operation];
+    let url;
+    if (directoryKey !== undefined) {
+        const resolved = directory[directoryKey];
+        if (typeof resolved !== "string") {
+            return yield* fail(new DirectoryMissingResource({
+                resource: directoryKey,
+                directoryUrl: creds.directoryUrl,
+            }));
+        }
+        url = resolved;
+    }
+    else {
+        const label = getProps(inputAst).find((p) => hasPropAnn(p, labelSymbol));
+        const value = label ? inputObj[String(label.name)] : undefined;
+        if (typeof value !== "string") {
+            return yield* fail(new JoseError({
+                message: `${operation} needs the resource URL the CA returned (\`url\`).`,
+            }));
+        }
+        url = value;
+    }
+    // The payload: every input member that isn't the URL label, or the
+    // empty POST-as-GET for reads.
+    let payload;
+    if (!POST_AS_GET.has(operation)) {
+        const body = {};
+        for (const prop of getProps(inputAst)) {
+            if (hasPropAnn(prop, labelSymbol))
+                continue;
+            const key = String(prop.name);
+            if (inputObj[key] !== undefined)
+                body[key] = inputObj[key];
+        }
+        payload = body;
+    }
+    const jwk = yield* parseJwk(creds.accountKey);
+    // `newAccount` proves the key by embedding it; a CA that requires an
+    // External Account Binding gets it from the credentials unless the
+    // caller built one.
+    const embedKey = operation === "NewAccount" || creds.accountUrl === undefined;
+    if (operation === "NewAccount" &&
+        creds.externalAccountBinding !== undefined &&
+        payload.externalAccountBinding === undefined) {
+        payload.externalAccountBinding =
+            yield* signExternalAccountBinding({
+                jwk,
+                url,
+                keyId: creds.externalAccountBinding.keyId,
+                hmacKey: creds.externalAccountBinding.hmacKey,
+            });
+    }
+    const nonce = yield* takeNonce(creds.directoryUrl, directory);
+    const signing = {
+        jwk,
+        url,
+        kid: embedKey ? undefined : creds.accountUrl,
+        payload,
+        directoryUrl: creds.directoryUrl,
+    };
+    const request = yield* signedRequest(signing, nonce);
+    signedRequests.set(request.body, signing);
+    return request;
+});
+const signedRequest = (signing, nonce) => Effect.gen(function* () {
+    const jws = yield* signRequest({ ...signing, nonce });
+    return HttpClientRequest.post(signing.url).pipe(HttpClientRequest.setHeader("Accept", JOSE_ACCEPT), HttpClientRequest.bodyText(JSON.stringify(jws), "application/jose+json"));
+});
+const isProblem = (value) => isObject(value) && typeof value.type === "string";
+/**
+ * Match a problem document against the operation's typed error classes by
+ * its `type` URN (the matcher's `message` rule is applied to the URN, so a
+ * patch writes `{ "message": { "matches": "^urn:ietf:params:acme:error:badNonce$" } }`).
+ */
+const matchProblem = (errorClasses, status, problem, headers) => {
+    const urn = problem.type ?? "";
+    let best;
+    for (const cls of errorClasses) {
+        const matchers = getErrorMatchers(cls);
+        if (!matchers)
+            continue;
+        for (const m of matchers) {
+            if (m.status !== undefined && m.status !== status)
+                continue;
+            if (m.code !== undefined && m.code !== status)
+                continue;
+            const rule = m.message;
+            let hit = false;
+            if (rule === undefined)
+                hit = true;
+            else if (typeof rule === "string")
+                hit = rule === urn;
+            else if (rule.matches !== undefined)
+                hit = new RegExp(rule.matches).test(urn);
+            else if (rule.includes !== undefined)
+                hit = urn.includes(rule.includes);
+            if (!hit)
+                continue;
+            const specificity = (m.status !== undefined ? 1 : 0) + (rule !== undefined ? 2 : 0);
+            if (!best || specificity > best.specificity)
+                best = { cls, specificity };
+        }
+    }
+    if (!best)
+        return undefined;
+    return new best.cls({
+        code: status,
+        message: problem.detail ?? urn,
+        type: urn,
+        detail: problem.detail,
+        subproblems: problem.subproblems,
+        ...(urn === "urn:ietf:params:acme:error:rateLimited"
+            ? { retryAfter: parseRetryAfter(headers) }
+            : {}),
+    });
+};
+const parseLinkAlternates = (link) => {
+    if (!link)
+        return [];
+    const out = [];
+    for (const part of link.split(",")) {
+        const match = part.match(/<([^>]+)>\s*;\s*rel="?alternate"?/);
+        if (match)
+            out.push(match[1]);
+    }
+    return out;
+};
+const decode = ({ response, outputAst, errors: errorClasses, }) => Effect.gen(function* () {
+    const signing = signedRequests.get(response.request.body);
+    signedRequests.delete(response.request.body);
+    const directoryUrl = signing?.directoryUrl ?? (yield* resolveCredentials).directoryUrl;
+    for (let retries = 0;; retries++) {
+        const headers = response.headers;
+        const status = response.status;
+        const isNewNonce = response.request.method === "HEAD";
+        const isCertificate = (headers["content-type"] ?? "").includes("pem-certificate-chain");
+        const text = isNewNonce ? "" : yield* response.text;
+        const json = isNewNonce || (isCertificate && status < 400)
+            ? undefined
+            : yield* parseJson(text).pipe(
+            // A non-JSON 2xx fails only in strict mode; lenient returns
+            // the text as read.
+            Effect.catchTag("AcmeParseError", (error) => status >= 400
+                ? Effect.succeed(undefined)
+                : Effect.flatMap(isStrict, (strict) => strict
+                    ? Effect.fail(error)
+                    : Effect.succeed(text))));
+        const problem = status >= 400 && isProblem(json) ? json : undefined;
+        const badNonce = problem?.type === "urn:ietf:params:acme:error:badNonce";
+        if (badNonce) {
+            const nonce = headers["replay-nonce"];
+            // Rejection nonces belong only to this request, never to the shared cache.
+            if (signing && nonce && retries < 2) {
+                const client = yield* HttpClient.HttpClient;
+                response = yield* client.execute(yield* signedRequest(signing, nonce));
+                continue;
+            }
+        }
+        else {
+            rememberNonce(directoryUrl, response);
+        }
+        if (status >= 400) {
+            if (problem) {
+                const typed = matchProblem(errorClasses, status, problem, headers);
+                if (typed !== undefined)
+                    return yield* fail(typed);
+                return yield* fail(new UnknownAcmeError({
+                    type: problem.type,
+                    detail: problem.detail,
+                    subproblems: problem.subproblems,
+                    message: problem.detail ?? problem.type,
+                    status,
+                    body: Redacted.make(json),
+                }));
+            }
+            const message = `HTTP ${status}`;
+            const StatusClass = HTTP_STATUS_MAP[status];
+            if (StatusClass) {
+                return yield* fail(new StatusClass({
+                    message,
+                    retryAfter: parseRetryAfterForStatus(status, headers),
+                }));
+            }
+            if (status >= 500) {
+                return yield* fail(new InternalServerError({
+                    message,
+                    retryAfter: parseRetryAfterForStatus(status, headers),
+                }));
+            }
+            return yield* fail(new UnknownAcmeError({
+                message,
+                status,
+                body: Redacted.make(json ?? text),
+            }));
+        }
+        let body;
+        if (isNewNonce) {
+            body = { replayNonce: headers["replay-nonce"] || undefined };
+        }
+        else if (isCertificate) {
+            body = {
+                chain: text,
+                alternates: parseLinkAlternates(headers["link"]),
+            };
+        }
+        else if (isObject(json)) {
+            body = json;
+            const location = headers["location"];
+            if (location)
+                body = { ...body, location };
+        }
+        else {
+            // Lenient mode returns a non-object body as read.
+            if (!(yield* isStrict))
+                return json;
+            return yield* fail(parseError("Expected a JSON object"));
+        }
+        // Strict mode (core/response-validation) checks the output schema.
+        return yield* validateResponse(outputAst, mapKeys(outputAst, body, "decode"), () => parseError("Response does not match the output schema"));
+    }
+});
+const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const parseError = (cause) => new AcmeParseError({
+    body: "[REDACTED]",
+    cause,
+});
+const parseJson = (text) => Effect.try({
+    try: () => (text.trim().length > 0 ? JSON.parse(text) : {}),
+    catch: () => parseError("Invalid JSON response"),
+});
+const fail = (error) => Effect.fail(error);
+export const AcmeProtocol = Layer.succeed(API.Protocol, API.Protocol.of({
+    encode: (args) => encode(args),
+    decode: (args) => decode(args),
+}));
+/** Forget cached directories and nonces (tests, CA switches). */
+export const resetProtocolCaches = () => {
+    directories.clear();
+    nonces.clear();
+};
+/** @internal re-exported for tests */
+export const _internal = { getAnn, Redacted };
+//# sourceMappingURL=protocol.js.map