@estiva-app/identity 0.1.2 → 0.2.0

package/CHANGELOG.md

@@ -1,5 +1,106 @@
 # @estiva-app/identity
 
+## 0.2.0 — 2026-09-07
+
+**MINOR because it adds a peer dependency**, which is a break for a consumer
+that does not already have `@estiva-app/protocol` — ADR 0002 §4b puts the break
+on MINOR within `0.x`. Both consumers already have it, and per §5 both had an
+open upgrade PR before this published.
+
+**`POST /sign` lives here now.** SHA-3 left `estivaIdSigner` behind in the apps
+deliberately — "it knows about Estiva ID, which is this ticket" — and SHA-4's
+handoff comment called it "the one thing left duplicated between ship and
+estiva-agent, byte-identical, and it is yours to remove". This is that.
+
+- **New: `signViaEstivaId(unsigned, { base, token, expectedPubkey })`** — one
+  round trip. What Peek uses, because Peek signs per request with a token it
+  reads fresh each time.
+
+- **New: `estivaIdSigner({ base, pubkey, token, renew })`** — a `Signer` over the
+  same round trip, holding a live bearer and renewing once on a `401`. What Ship
+  uses, because Ship builds one signer at module scope for the life of the page.
+  Neither shape can be expressed as the other without one of them getting worse,
+  so both are here over one implementation.
+
+- **`SignerTokenExpired`** travels with them: "obtain a new token" and "this
+  event was refused" call for different things from the caller, and the status
+  code is the only thing that separates them.
+
+### The guard the three copies had already drifted on
+
+`/sign` **signs as the token's subject regardless of what it is handed.** So a
+token that belongs to somebody else does not produce an error — it produces
+**HTTP 200 carrying a valid event authored by that other person**, and the
+symptom arrives much later as a comment attributed to a colleague, with nothing
+in any log tying it back.
+
+SHA-4's Traps section says both apps must keep the `expectedPubkey` guard. **Only
+Peek's did.** Ship's `estivaIdSigner` — the signer every issue, comment, status
+change and assignment in Ship goes through — never had a pubkey comparison at
+all. That is precisely the drift three copies of one call produce, and the app
+that could least afford it was the one missing it.
+
+Here the guard is not optional on the `estivaIdSigner` path: it is supplied from
+the `pubkey` the signer was built with, whether or not the caller thought about
+it. Two tests cover it and a control asserts a wrong-author refusal does **not**
+trigger a renewal — spending a single-use refresh token on an error a new token
+cannot fix is how one bad signature becomes a revoked chain.
+
+### What stayed in the apps, and why
+
+`localSigner` (a per-browser anonymous key) and `nip07Signer` (a browser
+extension) are still duplicated between `ship` and `estiva-agent`, held by
+`scripts/conformance.test.ts`. Neither knows anything about Estiva ID, which is
+the line this package draws, so neither moved. Worth its own ticket rather than
+a quiet widening of this one.
+
+### The seam property still holds
+
+`@estiva-app/protocol` is a **peer** dependency, following `@estiva-app/interop`.
+Nothing here calls a protocol function — only its types are used — so the
+complete list of imports in the shipped JavaScript is still `./client.js`,
+`./shell.js` and now `./signer.js`. Only the `.d.ts` names protocol.
+
+## 0.1.3 — 2026-09-07
+
+**Fixes a dead end reported from production.** No API change; `expiresAt` is now
+derived differently, so a consumer needs no code change to get the fix.
+
+`expires_in` is a **duration**, so acting on it means adding it to the local
+clock. The service decides with the token's own `exp` claim, against **its**
+clock. Those two answers agree only for as long as the clocks do.
+
+When they diverge in the unsafe direction — a browser clock ahead of the
+service, which is what a machine waking from a night's sleep readily produces —
+the app holds a token it believes is live and every server refuses. And it does
+not merely retry badly, it cannot recover at all:
+
+- `POST /sign` answers `401 Invalid token: "exp" claim timestamp check failed`.
+- `validToken()` keeps returning that same token, because by its own arithmetic
+  the token is fine.
+- So every caller that asks gets the dead token again — including the one Convex
+  asks — and nothing ever renews.
+- Peek's shell then sees a live token plus an unauthenticated verdict and calls
+  it `token_rejected`, whose copy says a configuration problem that signing in
+  again will not fix. It was an expiry, and signing in again was exactly what
+  fixed it. Clearing site data was the only way out.
+
+**Both bounds are now computed and the earlier wins.** `exp` is what the service
+will actually check, so it is the one that matters; `expires_in` is kept because
+it covers a token with no readable `exp`, and a clock running *behind* the
+service's, where `exp` alone would be the more generous of the two. The 30s
+hold-back applies to whichever wins.
+
+Reading the claim is not verification — that is the resource server's job and it
+holds the key. This reads one number out of a payload the app already has, so
+that "is this token still good" is answered by the same fact the service will
+answer it with. A payload that will not parse yields no bound and the token is
+still held: a token this cannot read is still a token.
+
+5 new tests, 59 to 64, including two controls that the `expires_in` fallback is
+untouched. Reverting the clamp fails exactly the two tests that depend on it.
+
+
 ## 0.1.2 — 2026-09-07
 
 **No wire behaviour, no break.** `scheduleRenewal` is new and the guard on

package/README.md

@@ -7,7 +7,8 @@ renewal, sign-out, and the auth-shell state machine.
 npm install @estiva-app/identity
 ```
 
-No runtime dependencies. CI enforces that.
+Nothing from outside the `@estiva-app` foundation, no data layer, and no UI.
+CI enforces all three.
 
 ## The seam this package exists for
 
@@ -68,6 +69,33 @@ const client = createEstivaId({
 export const { validToken, beginSignIn, completeSignIn, beginSignOut } = client
 ```
 
+## Signing is asking, and the answer must be checked
+
+```ts
+// Peek: one round trip, a token read fresh each time
+const event = await signViaEstivaId(unsigned, { base, token, expectedPubkey: myPubkey })
+
+// Ship: a protocol Signer, built once, renewing itself
+const signer = estivaIdSigner({ base, pubkey, token, renew: client.refreshAccessToken })
+```
+
+An app publishes as a person without ever seeing their secret. `@estiva-app/protocol`
+owns how an event gets its signature; this package owns *who is allowed to ask*.
+
+**`/sign` signs as the token's subject regardless of what it is handed.** So a
+token belonging to somebody else is not an error — it is **HTTP 200 with a valid
+event authored by that other person**. `expectedPubkey` is a check, not a
+request, and `estivaIdSigner` supplies it unconditionally from the pubkey it was
+built with. There were three copies of this round trip before SHA-4 and only one
+of them checked; the one that did not was Ship's, through which every write in
+Ship passes.
+
+A `401` throws `SignerTokenExpired` rather than a generic failure, and
+`estivaIdSigner` renews **once** and retries. Never twice: a second `401` after
+a successful renewal is a token the service will not accept, and retrying that
+is how one refused signature becomes a hot loop. Anything that is not an expiry
+is rethrown untouched, so a wrong-author refusal never spends a refresh token.
+
 ## Renewal is scheduled, not reactive
 
 ```ts

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,WAAW,EAAyB,MAAM,YAAY,CAAA;AAoCxF,gFAAgF;AAChF,MAAM,MAAM,SAAS,GAAG,CACtB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,KACpE,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,CAAC,CAAA;AAIvE,MAAM,WAAW,cAAc;IAC7B,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAA;IACZ,wEAAwE;IACxE,QAAQ,EAAE,MAAM,CAAA;IAChB;;;OAGG;IACH,WAAW,EAAE,MAAM,MAAM,CAAA;IACzB;;;;;;OAMG;IACH,OAAO,EAAE,MAAM,aAAa,GAAG,IAAI,CAAA;IACnC;;;;;;;;;;;;;;;OAeG;IACH,YAAY,CAAC,EAAE,MAAM,aAAa,GAAG,IAAI,CAAA;IACzC,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAA;IACjB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;IAChC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,KAAK,OAAO,CAAA;IACnD,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,CAAA;CACvC;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAA;IACnB,8EAA8E;IAC9E,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAQD,qBAAa,WAAY,SAAQ,KAAK;CAAG;AAEzC,8FAA8F;AAC9F,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAA;IACxC;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,MAAM,IAAI,CAAA;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,+EAA+E;IAC/E,MAAM,EAAE,MAAM,IAAI,CAAA;CACnB;AASD,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,MAAM,CAAA;IACzB,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;IACpD,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAChF,cAAc,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,KAAK,EAAE,WAAW,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACrF,kBAAkB,EAAE,MAAM,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAA;IACrD,eAAe,EAAE,CAAC,QAAQ,CAAC,EAAE,eAAe,KAAK,eAAe,CAAA;IAChE,WAAW,EAAE,MAAM,WAAW,GAAG,IAAI,CAAA;IACrC,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,KAAK,WAAW,GAAG,IAAI,CAAA;IAChD,UAAU,EAAE,MAAM,OAAO,CAAA;IACzB,kBAAkB,EAAE,MAAM,MAAM,GAAG,SAAS,CAAA;IAC5C,YAAY,EAAE,MAAM,IAAI,CAAA;IACxB,YAAY,EAAE,MAAM,IAAI,CAAA;IACxB,gBAAgB,EAAE,MAAM,OAAO,CAAA;IAC/B,kBAAkB,EAAE,MAAM,IAAI,CAAA;IAC9B,YAAY,EAAE,MAAM,MAAM,GAAG,IAAI,CAAA;IACjC,gBAAgB,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,CAAA;IAC/C,eAAe,EAAE,MAAM,WAAW,GAAG,IAAI,CAAA;CAC1C;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,cAAc,GAAG,cAAc,CAwerE"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,WAAW,EAAyB,MAAM,YAAY,CAAA;AAsCxF,gFAAgF;AAChF,MAAM,MAAM,SAAS,GAAG,CACtB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,KACpE,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,CAAC,CAAA;AAIvE,MAAM,WAAW,cAAc;IAC7B,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAA;IACZ,wEAAwE;IACxE,QAAQ,EAAE,MAAM,CAAA;IAChB;;;OAGG;IACH,WAAW,EAAE,MAAM,MAAM,CAAA;IACzB;;;;;;OAMG;IACH,OAAO,EAAE,MAAM,aAAa,GAAG,IAAI,CAAA;IACnC;;;;;;;;;;;;;;;OAeG;IACH,YAAY,CAAC,EAAE,MAAM,aAAa,GAAG,IAAI,CAAA;IACzC,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAA;IACjB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;IAChC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,KAAK,OAAO,CAAA;IACnD,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,CAAA;CACvC;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAA;IACnB,8EAA8E;IAC9E,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAQD,qBAAa,WAAY,SAAQ,KAAK;CAAG;AAEzC,8FAA8F;AAC9F,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAA;IACxC;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,MAAM,IAAI,CAAA;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,+EAA+E;IAC/E,MAAM,EAAE,MAAM,IAAI,CAAA;CACnB;AASD,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,MAAM,CAAA;IACzB,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;IACpD,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAChF,cAAc,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,KAAK,EAAE,WAAW,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACrF,kBAAkB,EAAE,MAAM,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAA;IACrD,eAAe,EAAE,CAAC,QAAQ,CAAC,EAAE,eAAe,KAAK,eAAe,CAAA;IAChE,WAAW,EAAE,MAAM,WAAW,GAAG,IAAI,CAAA;IACrC,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,KAAK,WAAW,GAAG,IAAI,CAAA;IAChD,UAAU,EAAE,MAAM,OAAO,CAAA;IACzB,kBAAkB,EAAE,MAAM,MAAM,GAAG,SAAS,CAAA;IAC5C,YAAY,EAAE,MAAM,IAAI,CAAA;IACxB,YAAY,EAAE,MAAM,IAAI,CAAA;IACxB,gBAAgB,EAAE,MAAM,OAAO,CAAA;IAC/B,kBAAkB,EAAE,MAAM,IAAI,CAAA;IAC9B,YAAY,EAAE,MAAM,MAAM,GAAG,IAAI,CAAA;IACjC,gBAAgB,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,CAAA;IAC/C,eAAe,EAAE,MAAM,WAAW,GAAG,IAAI,CAAA;CAC1C;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,cAAc,GAAG,cAAc,CAyhBrE"}

package/dist/client.js

@@ -86,18 +86,68 @@ export function createEstivaId(config) {
         const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));
         return base64Url(new Uint8Array(digest));
     };
+    /**
+     * The `exp` claim, in epoch ms, or null if the token does not carry a readable one.
+     *
+     * Not verification — that is the resource server's job and it holds the key.
+     * This reads one number out of a payload the app already holds, for one
+     * purpose: so that "is this token still good" is answered by the same fact the
+     * service will answer it with.
+     *
+     * Parse failures return null rather than throwing. A token this cannot read is
+     * still a token, and refusing to hold one because its middle segment is not
+     * base64url would be a worse failure than the one this prevents.
+     */
+    const expFromJwt = (accessToken) => {
+        const payload = accessToken.split('.')[1];
+        if (!payload)
+            return null;
+        try {
+            const json = atob(payload.replace(/-/g, '+').replace(/_/g, '/'));
+            const exp = JSON.parse(json).exp;
+            return typeof exp === 'number' && Number.isFinite(exp) ? exp * 1000 : null;
+        }
+        catch {
+            return null;
+        }
+    };
     /**
      * Shape a token response into what is kept.
      *
      * The expiry is deliberately pessimistic by 30s, so a token is never presented
      * in the window where it is technically alive and about to not be.
+     *
+     * ## Why `exp` and not just `expires_in`
+     *
+     * `expires_in` describes a *duration*, so acting on it means adding it to the
+     * local clock — and the service decides using the token's own `exp` against
+     * *its* clock. Those two answers agree only while the clocks do.
+     *
+     * When they diverge in the unsafe direction the app believes a dead token is
+     * live, and the failure is genuinely nasty: `POST /sign` answers
+     * `401 Invalid token: "exp" claim timestamp check failed`, while `validToken`
+     * keeps returning that same token to every caller that asks — including the
+     * one Convex asks — so nothing ever renews and nothing ever recovers. Peek got
+     * into exactly this state overnight on a machine that had slept, and the only
+     * way out was clearing site data and signing in again.
+     *
+     * So both bounds are computed and **the earlier wins**. `exp` is what the
+     * service will actually check; `expires_in` still covers a token with no
+     * readable `exp`, and a clock that is *behind* the service's, where `exp`
+     * alone would be the more generous of the two.
      */
-    const tokenFrom = (body, pubkey) => ({
-        accessToken: body.access_token,
-        expiresAt: now() + Math.max(0, (body.expires_in ?? 600) - 30) * 1000,
-        pubkey,
-        ...(body.refresh_token ? { refreshToken: body.refresh_token } : {}),
-    });
+    const tokenFrom = (body, pubkey) => {
+        const accessToken = body.access_token;
+        const fromDuration = now() + Math.max(0, (body.expires_in ?? 600) - 30) * 1000;
+        const exp = expFromJwt(accessToken);
+        const fromClaim = exp === null ? null : exp - 30_000;
+        return {
+            accessToken,
+            expiresAt: fromClaim === null ? fromDuration : Math.min(fromDuration, fromClaim),
+            pubkey,
+            ...(body.refresh_token ? { refreshToken: body.refresh_token } : {}),
+        };
+    };
     const storedToken = () => {
         const raw = config.storage()?.getItem(TOKEN_KEY);
         if (!raw)

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,OAAO,EAAwC,UAAU,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAkHxF;;;GAGG;AACH,MAAM,YAAY,GAAG,aAAa,CAAA;AAElC,MAAM,OAAO,WAAY,SAAQ,KAAK;CAAG;AAkDzC,MAAM,UAAU,cAAc,CAAC,MAAsB;IACnD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;IAC5C,gFAAgF;IAChF,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,OAAO,CAAA;IACrD,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,IAAI,KAAK,CAAA;IACxC,MAAM,EAAE,GAAG,CAAC,GAAW,EAAE,EAAE;QACzB,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAA;QACpG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IACtB,CAAC,CAAA;IAED,MAAM,YAAY,GAAG,GAAG,MAAM,CAAC,SAAS,eAAe,CAAA;IACvD,MAAM,SAAS,GAAG,GAAG,MAAM,CAAC,SAAS,QAAQ,CAAA;IAC7C,MAAM,UAAU,GAAG,GAAG,MAAM,CAAC,SAAS,WAAW,CAAA;IACjD,MAAM,SAAS,GAAG,GAAG,MAAM,CAAC,SAAS,QAAQ,CAAA;IAC7C,sFAAsF;IACtF,MAAM,UAAU,GAAG,GAAG,MAAM,CAAC,SAAS,cAAc,CAAA;IAEpD,MAAM,SAAS,GAAG,CAAC,KAAiB,EAAU,EAAE;QAC9C,IAAI,CAAC,GAAG,EAAE,CAAA;QACV,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QAClD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC3E,CAAC,CAAA;IAED,MAAM,aAAa,GAAG,CAAC,KAAK,GAAG,EAAE,EAAU,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAEtG,uFAAuF;IACvF,MAAM,aAAa,GAAG,KAAK,EAAE,QAAgB,EAAmB,EAAE;QAChE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;QACxF,OAAO,SAAS,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;IAC1C,CAAC,CAAA;IAED;;;;;OAKG;IACH,MAAM,SAAS,GAAG,CAAC,IAAmB,EAAE,MAAc,EAAe,EAAE,CAAC,CAAC;QACvE,WAAW,EAAE,IAAI,CAAC,YAAsB;QACxC,SAAS,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI;QACpE,MAAM;QACN,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,CAAC,CAAA;IAEF,MAAM,WAAW,GAAG,GAAuB,EAAE;QAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;QAChD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAA;QACrB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAA;YAC7C,OAAO,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC,CAAA;IAED,MAAM,UAAU,GAAG,CAAC,EAAE,GAAG,GAAG,EAAE,EAAsB,EAAE;QACpD,MAAM,CAAC,GAAG,WAAW,EAAE,CAAA;QACvB,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACzC,CAAC,CAAA;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,MAAM,YAAY,GAAG,GAAS,EAAE;QAC9B,MAAM,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,SAAS,CAAC,CAAA;QACvC,4EAA4E;QAC5E,yEAAyE;QACzE,qEAAqE;QACrE,OAAO,EAAE,EAAE,UAAU,CAAC,UAAU,CAAC,CAAA;IACnC,CAAC,CAAA;IAED;;;;;;;OAOG;IACH,MAAM,kBAAkB,GAAG,GAAS,EAAE;QACpC,MAAM,CAAC,GAAG,OAAO,EAAE,CAAA;QACnB,IAAI,CAAC,CAAC;YAAE,OAAM;QACd,KAAK,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,UAAU,CAAC;YAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IACxE,CAAC,CAAA;IAED,MAAM,gBAAgB,GAAG,CAAC,MAAmB,EAAQ,EAAE;QACrD,OAAO,EAAE,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;IACxC,CAAC,CAAA;IAED,0EAA0E;IAC1E,MAAM,eAAe,GAAG,GAAuB,EAAE;QAC/C,MAAM,CAAC,GAAG,OAAO,EAAE,CAAA;QACnB,MAAM,GAAG,GAAG,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;QAClC,IAAI,GAAG;YAAE,CAAC,EAAE,UAAU,CAAC,UAAU,CAAC,CAAA;QAClC,OAAQ,GAA0B,IAAI,IAAI,CAAA;IAC5C,CAAC,CAAA;IAED;;;;;;OAMG;IACH,MAAM,YAAY,GAAG,GAAkB,EAAE;QACvC,MAAM,CAAC,GAAG,OAAO,EAAE,CAAA;QACnB,MAAM,GAAG,GAAG,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;QAClC,IAAI,GAAG;YAAE,CAAC,EAAE,UAAU,CAAC,UAAU,CAAC,CAAA;QAClC,OAAO,GAAG,IAAI,IAAI,CAAA;IACpB,CAAC,CAAA;IAED;;;;;;;;;;;;OAYG;IACH,MAAM,cAAc,GAAG,KAAK,IAAiC,EAAE;QAC7D,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAA;QAC1B,MAAM,OAAO,GAAG,WAAW,EAAE,CAAA;QAC7B,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY;YAAE,OAAO,IAAI,CAAA;QAE7C,IAAI,QAAwC,CAAA;QAC5C,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;gBACjE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,SAAS,EAAE,eAAe;oBAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;oBAClC,QAAQ,EAAE,MAAM,CAAC,QAAQ;iBAC1B,CAAC;aACH,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;YACxE,yEAAyE;YACzE,yBAAyB;YACzB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,YAAY,EAAE,CAAA;YACd,OAAO,IAAI,CAAA;QACb,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkB,CAAA;QACrD,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,YAAY,EAAE,CAAA;YACd,OAAO,IAAI,CAAA;QACb,CAAC;QAED,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;QAC3D,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;QAC1C,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,IAAI,UAAU,GAAuC,IAAI,CAAA;IAEzD,MAAM,kBAAkB,GAAG,GAAgC,EAAE;QAC3D,IAAI,UAAU;YAAE,OAAO,UAAU,CAAA;QACjC,UAAU,GAAG,cAAc,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACzC,UAAU,GAAG,IAAI,CAAA;QACnB,CAAC,CAAC,CAAA;QACF,OAAO,UAAU,CAAA;IACnB,CAAC,CAAA;IAGD,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,aAAa;QACb,WAAW;QACX,UAAU;QACV,YAAY;QACZ,kBAAkB;QAClB,gBAAgB;QAChB,eAAe;QACf,YAAY;QAEZ,UAAU,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,KAAK,IAAI;QAEvC;;;;;;;;WAQG;QACH,kBAAkB,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,EAAE,WAAW;QAEnD;;;;;;;WAOG;QACH,gBAAgB,EAAE,GAAG,EAAE;YACrB,MAAM,CAAC,GAAG,OAAO,EAAE,CAAA;YACnB,OAAO,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAA;QAClE,CAAC;QAED;;;;;;;WAOG;QACH,KAAK,CAAC,WAAW,CAAC,QAAgB,EAAE,EAAE,MAAM,GAAG,KAAK,KAA2B,EAAE;YAC/E,MAAM,CAAC,GAAG,OAAO,EAAE,CAAA;YACnB,IAAI,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;YAErD,MAAM,QAAQ,GAAG,aAAa,EAAE,CAAA;YAChC,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,CAAC,CAAA;YAC/B,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAA;YACjC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;YAC3B,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;YAE/B;;;;;;;;;;;;;;;;;;;cAmBE;YACF,IAAI,MAAM;gBAAE,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;YAE/B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;YAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;YAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;YAC1D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAA;YAC7C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAA;YACrE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAA;YACrD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;YAEpC;;;;cAIE;YACF,IAAI,MAAM;gBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;YAElD,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAA;QACpB,CAAC;QAED;;;;;;WAMG;QACH,KAAK,CAAC,cAAc,CAAC,MAAc;YACjC,MAAM,CAAC,GAAG,OAAO,EAAE,CAAA;YACnB,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,EAAE,CAAA;YACrC,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY;gBAAE,MAAM,IAAI,WAAW,CAAC,4BAA4B,CAAC,CAAA;YAE5E,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAA;YAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACjC,IAAI,KAAK;gBAAE,MAAM,IAAI,WAAW,CAAC,kCAAkC,KAAK,IAAI,CAAC,CAAA;YAE7E,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACjC,MAAM,aAAa,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;YAC1C,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;YACxC,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,GAAG,CAAA;YAE7C,2EAA2E;YAC3E,kEAAkE;YAClE,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAA;YACvB,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAA;YAC1B,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;YAExB,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,WAAW,CAAC,4CAA4C,CAAC,CAAA;YAC9E,IAAI,CAAC,QAAQ,IAAI,CAAC,aAAa,EAAE,CAAC;gBAChC,MAAM,IAAI,WAAW,CAAC,+DAA+D,CAAC,CAAA;YACxF,CAAC;YACD,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;gBAC5B,mEAAmE;gBACnE,uEAAuE;gBACvE,MAAM,IAAI,WAAW,CAAC,oDAAoD,CAAC,CAAA;YAC7E,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;gBACvE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,mCAAmC;gBACnC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,SAAS,EAAE,oBAAoB;oBAC/B,IAAI;oBACJ,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE;oBACjC,YAAY,EAAE,QAAQ;iBACvB,CAAC;aACH,CAAC,CAAA;YAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,WAAW,CACnB,QAAQ,CAAC,MAAM,KAAK,GAAG;oBACrB,CAAC,CAAC,oFAAoF;oBACtF,CAAC,CAAC,sBAAsB,QAAQ,CAAC,MAAM,uBAAuB,CACjE,CAAA;YACH,CAAC;YAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkB,CAAA;YACrD,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,WAAW,CAAC,8BAA8B,CAAC,CAAA;YAE7F,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;YAC1C,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;YACtD,0EAA0E;YAC1E,UAAU,CAAC,CAAC,CAAC,CAAA;YACb,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAA;QAC5B,CAAC;QAED,kBAAkB;QAElB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAiCG;QACH,eAAe,CAAC,WAA4B,EAAE;YAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAA;YACtE,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAA;YAE1E,IAAI,MAAM,GAAY,IAAI,CAAA;YAC1B,IAAI,SAAS,GAAG,KAAK,CAAA;YAErB,MAAM,GAAG,GAAG,GAAS,EAAE;gBACrB,MAAM,KAAK,GAAG,WAAW,EAAE,CAAA;gBAC3B,yEAAyE;gBACzE,oDAAoD;gBACpD,IAAI,CAAC,KAAK;oBAAE,OAAM;gBAElB;;;;;;;kBAOE;gBACF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,EAAE,YAAY,CAAC,CAAA;gBAE1E,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE;oBACrB,MAAM,GAAG,IAAI,CAAA;oBACb,KAAK,kBAAkB,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;wBACtC,IAAI,SAAS;4BAAE,OAAM;wBACrB,IAAI,CAAC,IAAI,EAAE,CAAC;4BACV,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAA;4BACpB,OAAM;wBACR,CAAC;wBACD,QAAQ,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,CAAA;wBAC1B,kEAAkE;wBAClE,oEAAoE;wBACpE,GAAG,EAAE,CAAA;oBACP,CAAC,CAAC,CAAA;gBACJ,CAAC,EAAE,KAAK,CAAC,CAAA;YACX,CAAC,CAAA;YAED,GAAG,EAAE,CAAA;YAEL,OAAO;gBACL,MAAM;oBACJ,SAAS,GAAG,IAAI,CAAA;oBAChB,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;wBACpB,UAAU,CAAC,MAAM,CAAC,CAAA;wBAClB,MAAM,GAAG,IAAI,CAAA;oBACf,CAAC;gBACH,CAAC;aACF,CAAA;QACH,CAAC;QAGD;;;;;;;;;;;WAWG;QACH,YAAY;YACV,YAAY,EAAE,CAAA;YACd,wEAAwE;YACxE,wCAAwC;YACxC,kBAAkB,EAAE,CAAA;YACpB,gBAAgB,CAAC,YAAY,CAAC,CAAA;YAC9B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;YAC3C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;YAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,0BAA0B,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;YACtE,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAA;QACpB,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,OAAO,EAAwC,UAAU,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAoHxF;;;GAGG;AACH,MAAM,YAAY,GAAG,aAAa,CAAA;AAElC,MAAM,OAAO,WAAY,SAAQ,KAAK;CAAG;AAkDzC,MAAM,UAAU,cAAc,CAAC,MAAsB;IACnD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;IAC5C,gFAAgF;IAChF,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,OAAO,CAAA;IACrD,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,IAAI,KAAK,CAAA;IACxC,MAAM,EAAE,GAAG,CAAC,GAAW,EAAE,EAAE;QACzB,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAA;QACpG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IACtB,CAAC,CAAA;IAED,MAAM,YAAY,GAAG,GAAG,MAAM,CAAC,SAAS,eAAe,CAAA;IACvD,MAAM,SAAS,GAAG,GAAG,MAAM,CAAC,SAAS,QAAQ,CAAA;IAC7C,MAAM,UAAU,GAAG,GAAG,MAAM,CAAC,SAAS,WAAW,CAAA;IACjD,MAAM,SAAS,GAAG,GAAG,MAAM,CAAC,SAAS,QAAQ,CAAA;IAC7C,sFAAsF;IACtF,MAAM,UAAU,GAAG,GAAG,MAAM,CAAC,SAAS,cAAc,CAAA;IAEpD,MAAM,SAAS,GAAG,CAAC,KAAiB,EAAU,EAAE;QAC9C,IAAI,CAAC,GAAG,EAAE,CAAA;QACV,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QAClD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC3E,CAAC,CAAA;IAED,MAAM,aAAa,GAAG,CAAC,KAAK,GAAG,EAAE,EAAU,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAEtG,uFAAuF;IACvF,MAAM,aAAa,GAAG,KAAK,EAAE,QAAgB,EAAmB,EAAE;QAChE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;QACxF,OAAO,SAAS,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;IAC1C,CAAC,CAAA;IAED;;;;;;;;;;;OAWG;IACH,MAAM,UAAU,GAAG,CAAC,WAAmB,EAAiB,EAAE;QACxD,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QACzC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAA;QACzB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAA;YAChE,MAAM,GAAG,GAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAuB,CAAC,GAAG,CAAA;YACvD,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;QAC5E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC,CAAA;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,MAAM,SAAS,GAAG,CAAC,IAAmB,EAAE,MAAc,EAAe,EAAE;QACrE,MAAM,WAAW,GAAG,IAAI,CAAC,YAAsB,CAAA;QAC/C,MAAM,YAAY,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAA;QAC9E,MAAM,GAAG,GAAG,UAAU,CAAC,WAAW,CAAC,CAAA;QACnC,MAAM,SAAS,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,MAAM,CAAA;QACpD,OAAO;YACL,WAAW;YACX,SAAS,EAAE,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,SAAS,CAAC;YAChF,MAAM;YACN,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpE,CAAA;IACH,CAAC,CAAA;IAED,MAAM,WAAW,GAAG,GAAuB,EAAE;QAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;QAChD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAA;QACrB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAA;YAC7C,OAAO,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC,CAAA;IAED,MAAM,UAAU,GAAG,CAAC,EAAE,GAAG,GAAG,EAAE,EAAsB,EAAE;QACpD,MAAM,CAAC,GAAG,WAAW,EAAE,CAAA;QACvB,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACzC,CAAC,CAAA;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,MAAM,YAAY,GAAG,GAAS,EAAE;QAC9B,MAAM,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,SAAS,CAAC,CAAA;QACvC,4EAA4E;QAC5E,yEAAyE;QACzE,qEAAqE;QACrE,OAAO,EAAE,EAAE,UAAU,CAAC,UAAU,CAAC,CAAA;IACnC,CAAC,CAAA;IAED;;;;;;;OAOG;IACH,MAAM,kBAAkB,GAAG,GAAS,EAAE;QACpC,MAAM,CAAC,GAAG,OAAO,EAAE,CAAA;QACnB,IAAI,CAAC,CAAC;YAAE,OAAM;QACd,KAAK,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,UAAU,CAAC;YAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IACxE,CAAC,CAAA;IAED,MAAM,gBAAgB,GAAG,CAAC,MAAmB,EAAQ,EAAE;QACrD,OAAO,EAAE,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;IACxC,CAAC,CAAA;IAED,0EAA0E;IAC1E,MAAM,eAAe,GAAG,GAAuB,EAAE;QAC/C,MAAM,CAAC,GAAG,OAAO,EAAE,CAAA;QACnB,MAAM,GAAG,GAAG,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;QAClC,IAAI,GAAG;YAAE,CAAC,EAAE,UAAU,CAAC,UAAU,CAAC,CAAA;QAClC,OAAQ,GAA0B,IAAI,IAAI,CAAA;IAC5C,CAAC,CAAA;IAED;;;;;;OAMG;IACH,MAAM,YAAY,GAAG,GAAkB,EAAE;QACvC,MAAM,CAAC,GAAG,OAAO,EAAE,CAAA;QACnB,MAAM,GAAG,GAAG,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;QAClC,IAAI,GAAG;YAAE,CAAC,EAAE,UAAU,CAAC,UAAU,CAAC,CAAA;QAClC,OAAO,GAAG,IAAI,IAAI,CAAA;IACpB,CAAC,CAAA;IAED;;;;;;;;;;;;OAYG;IACH,MAAM,cAAc,GAAG,KAAK,IAAiC,EAAE;QAC7D,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAA;QAC1B,MAAM,OAAO,GAAG,WAAW,EAAE,CAAA;QAC7B,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY;YAAE,OAAO,IAAI,CAAA;QAE7C,IAAI,QAAwC,CAAA;QAC5C,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;gBACjE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,SAAS,EAAE,eAAe;oBAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;oBAClC,QAAQ,EAAE,MAAM,CAAC,QAAQ;iBAC1B,CAAC;aACH,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;YACxE,yEAAyE;YACzE,yBAAyB;YACzB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,YAAY,EAAE,CAAA;YACd,OAAO,IAAI,CAAA;QACb,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkB,CAAA;QACrD,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,YAAY,EAAE,CAAA;YACd,OAAO,IAAI,CAAA;QACb,CAAC;QAED,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;QAC3D,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;QAC1C,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,IAAI,UAAU,GAAuC,IAAI,CAAA;IAEzD,MAAM,kBAAkB,GAAG,GAAgC,EAAE;QAC3D,IAAI,UAAU;YAAE,OAAO,UAAU,CAAA;QACjC,UAAU,GAAG,cAAc,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACzC,UAAU,GAAG,IAAI,CAAA;QACnB,CAAC,CAAC,CAAA;QACF,OAAO,UAAU,CAAA;IACnB,CAAC,CAAA;IAGD,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,aAAa;QACb,WAAW;QACX,UAAU;QACV,YAAY;QACZ,kBAAkB;QAClB,gBAAgB;QAChB,eAAe;QACf,YAAY;QAEZ,UAAU,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,KAAK,IAAI;QAEvC;;;;;;;;WAQG;QACH,kBAAkB,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,EAAE,WAAW;QAEnD;;;;;;;WAOG;QACH,gBAAgB,EAAE,GAAG,EAAE;YACrB,MAAM,CAAC,GAAG,OAAO,EAAE,CAAA;YACnB,OAAO,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAA;QAClE,CAAC;QAED;;;;;;;WAOG;QACH,KAAK,CAAC,WAAW,CAAC,QAAgB,EAAE,EAAE,MAAM,GAAG,KAAK,KAA2B,EAAE;YAC/E,MAAM,CAAC,GAAG,OAAO,EAAE,CAAA;YACnB,IAAI,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;YAErD,MAAM,QAAQ,GAAG,aAAa,EAAE,CAAA;YAChC,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,CAAC,CAAA;YAC/B,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAA;YACjC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;YAC3B,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;YAE/B;;;;;;;;;;;;;;;;;;;cAmBE;YACF,IAAI,MAAM;gBAAE,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;YAE/B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;YAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;YAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;YAC1D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAA;YAC7C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAA;YACrE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAA;YACrD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;YAEpC;;;;cAIE;YACF,IAAI,MAAM;gBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;YAElD,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAA;QACpB,CAAC;QAED;;;;;;WAMG;QACH,KAAK,CAAC,cAAc,CAAC,MAAc;YACjC,MAAM,CAAC,GAAG,OAAO,EAAE,CAAA;YACnB,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,EAAE,CAAA;YACrC,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY;gBAAE,MAAM,IAAI,WAAW,CAAC,4BAA4B,CAAC,CAAA;YAE5E,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAA;YAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACjC,IAAI,KAAK;gBAAE,MAAM,IAAI,WAAW,CAAC,kCAAkC,KAAK,IAAI,CAAC,CAAA;YAE7E,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACjC,MAAM,aAAa,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;YAC1C,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;YACxC,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,GAAG,CAAA;YAE7C,2EAA2E;YAC3E,kEAAkE;YAClE,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAA;YACvB,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAA;YAC1B,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;YAExB,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,WAAW,CAAC,4CAA4C,CAAC,CAAA;YAC9E,IAAI,CAAC,QAAQ,IAAI,CAAC,aAAa,EAAE,CAAC;gBAChC,MAAM,IAAI,WAAW,CAAC,+DAA+D,CAAC,CAAA;YACxF,CAAC;YACD,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;gBAC5B,mEAAmE;gBACnE,uEAAuE;gBACvE,MAAM,IAAI,WAAW,CAAC,oDAAoD,CAAC,CAAA;YAC7E,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;gBACvE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,mCAAmC;gBACnC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,SAAS,EAAE,oBAAoB;oBAC/B,IAAI;oBACJ,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE;oBACjC,YAAY,EAAE,QAAQ;iBACvB,CAAC;aACH,CAAC,CAAA;YAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,WAAW,CACnB,QAAQ,CAAC,MAAM,KAAK,GAAG;oBACrB,CAAC,CAAC,oFAAoF;oBACtF,CAAC,CAAC,sBAAsB,QAAQ,CAAC,MAAM,uBAAuB,CACjE,CAAA;YACH,CAAC;YAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkB,CAAA;YACrD,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,WAAW,CAAC,8BAA8B,CAAC,CAAA;YAE7F,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;YAC1C,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;YACtD,0EAA0E;YAC1E,UAAU,CAAC,CAAC,CAAC,CAAA;YACb,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAA;QAC5B,CAAC;QAED,kBAAkB;QAElB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAiCG;QACH,eAAe,CAAC,WAA4B,EAAE;YAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAA;YACtE,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAA;YAE1E,IAAI,MAAM,GAAY,IAAI,CAAA;YAC1B,IAAI,SAAS,GAAG,KAAK,CAAA;YAErB,MAAM,GAAG,GAAG,GAAS,EAAE;gBACrB,MAAM,KAAK,GAAG,WAAW,EAAE,CAAA;gBAC3B,yEAAyE;gBACzE,oDAAoD;gBACpD,IAAI,CAAC,KAAK;oBAAE,OAAM;gBAElB;;;;;;;kBAOE;gBACF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,EAAE,YAAY,CAAC,CAAA;gBAE1E,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE;oBACrB,MAAM,GAAG,IAAI,CAAA;oBACb,KAAK,kBAAkB,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;wBACtC,IAAI,SAAS;4BAAE,OAAM;wBACrB,IAAI,CAAC,IAAI,EAAE,CAAC;4BACV,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAA;4BACpB,OAAM;wBACR,CAAC;wBACD,QAAQ,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,CAAA;wBAC1B,kEAAkE;wBAClE,oEAAoE;wBACpE,GAAG,EAAE,CAAA;oBACP,CAAC,CAAC,CAAA;gBACJ,CAAC,EAAE,KAAK,CAAC,CAAA;YACX,CAAC,CAAA;YAED,GAAG,EAAE,CAAA;YAEL,OAAO;gBACL,MAAM;oBACJ,SAAS,GAAG,IAAI,CAAA;oBAChB,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;wBACpB,UAAU,CAAC,MAAM,CAAC,CAAA;wBAClB,MAAM,GAAG,IAAI,CAAA;oBACf,CAAC;gBACH,CAAC;aACF,CAAA;QACH,CAAC;QAGD;;;;;;;;;;;WAWG;QACH,YAAY;YACV,YAAY,EAAE,CAAA;YACd,wEAAwE;YACxE,wCAAwC;YACxC,kBAAkB,EAAE,CAAA;YACpB,gBAAgB,CAAC,YAAY,CAAC,CAAA;YAC9B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;YAC3C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;YAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,0BAA0B,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;YACtE,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAA;QACpB,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/index.d.ts

@@ -46,7 +46,8 @@
  * The thing that made it possible was not cleverness — it was that a browser API
  * an app must inject is also a browser API a test can observe.
  */
-export declare const IDENTITY_VERSION = "0.1.2";
+export declare const IDENTITY_VERSION = "0.2.0";
 export { type KeyValueStore, type ShellPhase, type ShellReason, type ShellState, type BootObservation, type BootAction, type ShellEvent, isRecoverable, SHELL_COPY, CONTINUE_LABEL, RETRY_LABEL, PROBE_TIMEOUT_MS, GUARD_TTL_MS, GUARD_KEY, decideBoot, reasonForCallbackError, readGuard, markGuard, clearGuard, logShellEvent, } from './shell.js';
 export { type EstivaIdConfig, type EstivaIdClient, type StoredToken, type FetchLike, type RenewalHandlers, type RenewalSchedule, SignInError, createEstivaId, } from './client.js';
+export { type SignViaEstivaIdOptions, type EstivaIdSignerOptions, type SignFetchLike, SignerTokenExpired, signViaEstivaId, estivaIdSigner, } from './signer.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,eAAO,MAAM,gBAAgB,UAAU,CAAA;AAEvC,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,aAAa,EACb,UAAU,EACV,cAAc,EACd,WAAW,EACX,gBAAgB,EAChB,YAAY,EACZ,SAAS,EACT,UAAU,EACV,sBAAsB,EACtB,SAAS,EACT,SAAS,EACT,UAAU,EACV,aAAa,GACd,MAAM,YAAY,CAAA;AAEnB,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,WAAW,EACX,cAAc,GACf,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,eAAO,MAAM,gBAAgB,UAAU,CAAA;AAEvC,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,aAAa,EACb,UAAU,EACV,cAAc,EACd,WAAW,EACX,gBAAgB,EAChB,YAAY,EACZ,SAAS,EACT,UAAU,EACV,sBAAsB,EACtB,SAAS,EACT,SAAS,EACT,UAAU,EACV,aAAa,GACd,MAAM,YAAY,CAAA;AAEnB,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,WAAW,EACX,cAAc,GACf,MAAM,aAAa,CAAA;AAEpB,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,aAAa,EAClB,kBAAkB,EAClB,eAAe,EACf,cAAc,GACf,MAAM,aAAa,CAAA"}

package/dist/index.js

@@ -46,7 +46,8 @@
  * The thing that made it possible was not cleverness — it was that a browser API
  * an app must inject is also a browser API a test can observe.
  */
-export const IDENTITY_VERSION = '0.1.2';
+export const IDENTITY_VERSION = '0.2.0';
 export { isRecoverable, SHELL_COPY, CONTINUE_LABEL, RETRY_LABEL, PROBE_TIMEOUT_MS, GUARD_TTL_MS, GUARD_KEY, decideBoot, reasonForCallbackError, readGuard, markGuard, clearGuard, logShellEvent, } from './shell.js';
 export { SignInError, createEstivaId, } from './client.js';
+export { SignerTokenExpired, signViaEstivaId, estivaIdSigner, } from './signer.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAA;AAEvC,OAAO,EAQL,aAAa,EACb,UAAU,EACV,cAAc,EACd,WAAW,EACX,gBAAgB,EAChB,YAAY,EACZ,SAAS,EACT,UAAU,EACV,sBAAsB,EACtB,SAAS,EACT,SAAS,EACT,UAAU,EACV,aAAa,GACd,MAAM,YAAY,CAAA;AAEnB,OAAO,EAOL,WAAW,EACX,cAAc,GACf,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAA;AAEvC,OAAO,EAQL,aAAa,EACb,UAAU,EACV,cAAc,EACd,WAAW,EACX,gBAAgB,EAChB,YAAY,EACZ,SAAS,EACT,UAAU,EACV,sBAAsB,EACtB,SAAS,EACT,SAAS,EACT,UAAU,EACV,aAAa,GACd,MAAM,YAAY,CAAA;AAEnB,OAAO,EAOL,WAAW,EACX,cAAc,GACf,MAAM,aAAa,CAAA;AAEpB,OAAO,EAIL,kBAAkB,EAClB,eAAe,EACf,cAAc,GACf,MAAM,aAAa,CAAA"}

package/dist/signer.d.ts

@@ -0,0 +1,135 @@
+/**
+ * Signing by asking Estiva ID, holding no key at all.
+ *
+ * The point of the whole seam: an app publishes as a person without ever seeing
+ * their secret. `POST /sign` takes a bearer token and an unsigned event and
+ * returns a signed one.
+ *
+ * ## Why this is identity's and not protocol's
+ *
+ * `@estiva-app/protocol` owns how an event gets its signature — the id
+ * computation, the serialization, the bytes. It owns the {@link Signer} seam and
+ * the raw-secret-key implementation of it. What it deliberately does not own is
+ * *who is allowed to ask*: the token, its renewal, and the round trip to an
+ * identity service. That is this package, and `ship/lib/nostr/signer.ts` has
+ * said so in a header comment since SHA-3 — "it is `@estiva-app/identity`'s
+ * remit — SHA-4. Until then this file is the app's copy."
+ *
+ * There were three copies until this file existed:
+ *
+ * | where | what |
+ * | --- | --- |
+ * | `ship/lib/nostr/signer.ts` | `estivaIdSigner` |
+ * | `estiva-agent/lib/nostr/signer.ts` | byte-identical to it |
+ * | `peek/src/nostr/bridge.ts` | `signViaEstivaId`, a third |
+ *
+ * Three implementations of the one call that decides who authored an event, and
+ * they had already drifted on the thing that matters most — see the guard below.
+ *
+ * ## Two exports over one round trip
+ *
+ * The consumers genuinely want different shapes, and this is not the same kind
+ * of difference as `storage` or `clientId`. Peek signs *per request* with a token
+ * it reads fresh each time (`signViaEstivaId`); Ship builds a `Signer` **once**,
+ * at module scope, which then holds a live bearer for the life of the page and
+ * renews it on a `401`. Neither can be expressed as the other without one of
+ * them getting worse, so both are here, over one implementation of the round
+ * trip and one copy of the guard.
+ *
+ * `@estiva-app/protocol` is a **peer** dependency, following `@estiva-app/interop`.
+ * Nothing here calls a protocol function — only its types are used — so the
+ * emitted `.js` imports nothing, and `dist/` keeps the property SHA-4's seam was
+ * verified by: the complete list of imports in the shipped JavaScript is
+ * `./client.js` and `./shell.js`.
+ */
+import type { SignedEvent, Signer, UnsignedEvent } from '@estiva-app/protocol';
+/**
+ * `fetch`, again, and for the same reason as in `client.ts` — `lib.es2022` has
+ * no such global, and this package compiles with `types: []` and no `lib: dom`
+ * so one published `.d.ts` works in every consumer (ADR 0002 §4a).
+ *
+ * Note this module needs a *slightly* wider `fetch` than `client.ts` does: it
+ * reads `text()` rather than `json()`, because `/sign`'s error bodies are not
+ * reliably JSON and the raw text is the only thing worth showing a person.
+ */
+declare const fetch: (url: string, init: {
+    method: string;
+    headers: Record<string, string>;
+    body: string;
+}) => Promise<{
+    ok: boolean;
+    status: number;
+    text(): Promise<string>;
+}>;
+/** Just the part of `fetch` this module uses. A parameter as well as a global. */
+export type SignFetchLike = typeof fetch;
+/** Distinguishes "sign in again" from "this event was refused". */
+export declare class SignerTokenExpired extends Error {
+    constructor();
+}
+export interface SignViaEstivaIdOptions {
+    /** Origin of the identity service, e.g. `https://id.estiva.app`. */
+    base: string;
+    /** A bearer token from `POST /token`, audience-bound to this app. */
+    token: string;
+    /**
+     * The pubkey the returned event **must** be authored by.
+     *
+     * Not a request. `/sign` ignores any pubkey it is handed and signs as the
+     * token's subject, always — so this is a *check*, and the reason one is needed
+     * at all is that a mismatch comes back as **HTTP 200 with a perfectly valid
+     * event authored by somebody else**. Without it the failure is invisible at
+     * the call site and surfaces later as a message attributed to the wrong
+     * person, which is not a bug anybody can debug from the symptom.
+     *
+     * Optional only because `estivaIdSigner` always supplies it and a caller with
+     * genuinely no expectation should be able to say so out loud. Supply it.
+     */
+    expectedPubkey?: string;
+    fetch?: SignFetchLike;
+}
+/**
+ * One `POST /sign`.
+ *
+ * **`/sign` refuses `kind:0` for every app, always.** Profiles belong to the
+ * identity service (PEEK-31); a refusal here is the policy working rather than
+ * something to route around.
+ *
+ * A `401` is thrown as {@link SignerTokenExpired} rather than a generic failure,
+ * because "obtain a new token" and "this event was refused" call for completely
+ * different responses from the caller and the status code is the only thing that
+ * distinguishes them.
+ */
+export declare function signViaEstivaId(unsigned: UnsignedEvent, options: SignViaEstivaIdOptions): Promise<SignedEvent>;
+export interface EstivaIdSignerOptions {
+    /** Origin of the identity service, e.g. `https://id.estiva.app`. */
+    base: string;
+    /** The pubkey the token was issued for — `sub` in the JWT. */
+    pubkey: string;
+    /** A bearer token from `POST /token`, audience-bound to this app. */
+    token: string;
+    /**
+     * Renew the token, once, when `/sign` says it has expired (PEEK-108).
+     *
+     * Optional: without it a `401` surfaces as {@link SignerTokenExpired} for the
+     * caller to deal with, exactly as before. With it, an expiry is invisible —
+     * which matters more than it used to, because access tokens live ten minutes
+     * rather than an hour, so a session of any length crosses one.
+     *
+     * Returning `null` means renewal failed and the expiry is real.
+     *
+     * Pass `client.refreshAccessToken` and nothing else: it coalesces concurrent
+     * callers, and a refresh token is single-use with a replay read as theft.
+     */
+    renew?: () => Promise<string | null>;
+    fetch?: SignFetchLike;
+}
+/**
+ * A {@link Signer} that signs by asking Estiva ID.
+ *
+ * Holds the live bearer, so a renewal replaces it for every later signature
+ * rather than being rediscovered on each one.
+ */
+export declare function estivaIdSigner({ base, pubkey, token, renew, fetch: send }: EstivaIdSignerOptions): Signer;
+export {};
+//# sourceMappingURL=signer.d.ts.map

package/dist/signer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signer.d.ts","sourceRoot":"","sources":["../src/signer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAE9E;;;;;;;;GAQG;AACH,OAAO,CAAC,MAAM,KAAK,EAAE,CACnB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,KACpE,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CAAE,CAAC,CAAA;AAEtE,kFAAkF;AAClF,MAAM,MAAM,aAAa,GAAG,OAAO,KAAK,CAAA;AAExC,mEAAmE;AACnE,qBAAa,kBAAmB,SAAQ,KAAK;;CAK5C;AAED,MAAM,WAAW,sBAAsB;IACrC,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAA;IACZ,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAA;IACb;;;;;;;;;;;;OAYG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,KAAK,CAAC,EAAE,aAAa,CAAA;CACtB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,aAAa,EACvB,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,WAAW,CAAC,CAkDtB;AAED,MAAM,WAAW,qBAAqB;IACpC,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAA;IACZ,8DAA8D;IAC9D,MAAM,EAAE,MAAM,CAAA;IACd,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAA;IACb;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IACpC,KAAK,CAAC,EAAE,aAAa,CAAA;CACtB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,qBAAqB,GAAG,MAAM,CAwCzG"}

package/dist/signer.js

@@ -0,0 +1,114 @@
+/** Distinguishes "sign in again" from "this event was refused". */
+export class SignerTokenExpired extends Error {
+    constructor() {
+        super('The signing token has expired');
+        this.name = 'SignerTokenExpired';
+    }
+}
+/**
+ * One `POST /sign`.
+ *
+ * **`/sign` refuses `kind:0` for every app, always.** Profiles belong to the
+ * identity service (PEEK-31); a refusal here is the policy working rather than
+ * something to route around.
+ *
+ * A `401` is thrown as {@link SignerTokenExpired} rather than a generic failure,
+ * because "obtain a new token" and "this event was refused" call for completely
+ * different responses from the caller and the status code is the only thing that
+ * distinguishes them.
+ */
+export async function signViaEstivaId(unsigned, options) {
+    const send = options.fetch ?? fetch;
+    const origin = options.base.replace(/\/+$/, '');
+    const response = await send(`${origin}/sign`, {
+        method: 'POST',
+        headers: {
+            'content-type': 'application/json',
+            authorization: `Bearer ${options.token}`,
+        },
+        /*
+          Only the four fields that go into the signature input. The unsigned event
+          may carry a `pubkey` — Peek's NIP-98 path passes an empty one on purpose —
+          and sending it would imply `/sign` honours it, which it does not.
+        */
+        body: JSON.stringify({
+            event: {
+                kind: unsigned.kind,
+                created_at: unsigned.created_at,
+                tags: unsigned.tags,
+                content: unsigned.content,
+            },
+        }),
+    });
+    const text = await response.text();
+    if (response.status === 401)
+        throw new SignerTokenExpired();
+    if (!response.ok) {
+        let reason = text.slice(0, 200);
+        try {
+            const body = JSON.parse(text);
+            reason = body.error?.message ?? reason;
+        }
+        catch {
+            // Keep the raw text. `/sign`'s error bodies are not reliably JSON, and the
+            // raw text is more use to a person than "unparseable response".
+        }
+        throw new Error(`Estiva ID refused to sign kind:${unsigned.kind} — ${reason}`);
+    }
+    const event = JSON.parse(text).event;
+    if (!event)
+        throw new Error('POST /sign returned no event');
+    if (options.expectedPubkey && event.pubkey !== options.expectedPubkey) {
+        throw new Error(`POST /sign returned an event authored by ${event.pubkey}, expected ${options.expectedPubkey}. ` +
+            'That token belongs to a different identity — refusing to publish under the wrong author.');
+    }
+    return event;
+}
+/**
+ * A {@link Signer} that signs by asking Estiva ID.
+ *
+ * Holds the live bearer, so a renewal replaces it for every later signature
+ * rather than being rediscovered on each one.
+ */
+export function estivaIdSigner({ base, pubkey, token, renew, fetch: send }) {
+    let bearer = token;
+    return {
+        pubkey,
+        kind: 'estiva-id',
+        async sign(unsigned) {
+            const once = (auth) => signViaEstivaId(unsigned, {
+                base,
+                token: auth,
+                // The guard, unconditionally. Ship's copy of this signer never had it
+                // and Peek's `signViaEstivaId` did, which is exactly the drift three
+                // copies produce: the app that publishes every issue, comment and
+                // status change was the one that could not tell it had signed as
+                // somebody else. SHA-4's Traps section says both must keep it.
+                expectedPubkey: pubkey,
+                ...(send ? { fetch: send } : {}),
+            });
+            try {
+                return await once(bearer);
+            }
+            catch (error) {
+                /*
+                  Renew once and retry, never twice.
+        
+                  A second 401 after a successful renewal is not an expiry — it is a
+                  token the service will not accept, and retrying that in a loop is how
+                  one refused signature becomes a hot loop against the identity service.
+                  Anything that is not an expiry is rethrown untouched, so a wrong-author
+                  refusal is never mistaken for something a new token would fix.
+                */
+                if (!(error instanceof SignerTokenExpired) || !renew)
+                    throw error;
+                const renewed = await renew();
+                if (!renewed)
+                    throw error;
+                bearer = renewed;
+                return await once(bearer);
+            }
+        },
+    };
+}
+//# sourceMappingURL=signer.js.map

package/dist/signer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signer.js","sourceRoot":"","sources":["../src/signer.ts"],"names":[],"mappings":"AA+DA,mEAAmE;AACnE,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C;QACE,KAAK,CAAC,+BAA+B,CAAC,CAAA;QACtC,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAA;IAClC,CAAC;CACF;AAwBD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAuB,EACvB,OAA+B;IAE/B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAA;IACnC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IAE/C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,MAAM,OAAO,EAAE;QAC5C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE;SACzC;QACD;;;;UAIE;QACF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,KAAK,EAAE;gBACL,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;aAC1B;SACF,CAAC;KACH,CAAC,CAAA;IAEF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,kBAAkB,EAAE,CAAA;IAC3D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAC/B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqC,CAAA;YACjE,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,OAAO,IAAI,MAAM,CAAA;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;YAC3E,gEAAgE;QAClE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,CAAC,IAAI,MAAM,MAAM,EAAE,CAAC,CAAA;IAChF,CAAC;IAED,MAAM,KAAK,GAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAA6B,CAAC,KAAK,CAAA;IACjE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;IAE3D,IAAI,OAAO,CAAC,cAAc,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,4CAA4C,KAAK,CAAC,MAAM,cAAc,OAAO,CAAC,cAAc,IAAI;YAC9F,0FAA0F,CAC7F,CAAA;IACH,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AA0BD;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAyB;IAC/F,IAAI,MAAM,GAAG,KAAK,CAAA;IAElB,OAAO;QACL,MAAM;QACN,IAAI,EAAE,WAAW;QACjB,KAAK,CAAC,IAAI,CAAC,QAAQ;YACjB,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAC5B,eAAe,CAAC,QAAQ,EAAE;gBACxB,IAAI;gBACJ,KAAK,EAAE,IAAI;gBACX,sEAAsE;gBACtE,qEAAqE;gBACrE,kEAAkE;gBAClE,iEAAiE;gBACjE,+DAA+D;gBAC/D,cAAc,EAAE,MAAM;gBACtB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjC,CAAC,CAAA;YAEJ,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,CAAA;YAC3B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf;;;;;;;;kBAQE;gBACF,IAAI,CAAC,CAAC,KAAK,YAAY,kBAAkB,CAAC,IAAI,CAAC,KAAK;oBAAE,MAAM,KAAK,CAAA;gBACjE,MAAM,OAAO,GAAG,MAAM,KAAK,EAAE,CAAA;gBAC7B,IAAI,CAAC,OAAO;oBAAE,MAAM,KAAK,CAAA;gBACzB,MAAM,GAAG,OAAO,CAAA;gBAChB,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,CAAA;YAC3B,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@estiva-app/identity",
-  "version": "0.1.2",
-  "description": "Estiva ID sign-in: authorization code + PKCE, token storage, silent renewal, sign-out, and the auth-shell state machine. Knows nothing about any app's data layer.",
+  "version": "0.2.0",
+  "description": "Estiva ID sign-in: authorization code + PKCE, token storage, silent renewal, sign-out, signing via POST /sign, and the auth-shell state machine. Knows nothing about any app's data layer.",
   "license": "MIT",
   "type": "module",
   "exports": {
@@ -35,11 +35,13 @@
   "keywords": [
     "estiva",
     "estiva-id",
+    "nostr",
     "oauth",
     "pkce",
-    "nostr"
+    "signer"
   ],
   "scripts": {
+    "prebuild": "npm run build --workspace @estiva-app/protocol",
     "build": "tsc -p tsconfig.json",
     "test": "npm run build && node --test test/*.test.mjs test/*.test.ts",
     "typecheck": "npm run build && tsc -p tsconfig.test.json",
@@ -47,7 +49,11 @@
   },
   "dependencies": {},
   "devDependencies": {
+    "@estiva-app/protocol": ">=0.14.0",
     "@types/node": "^24.13.3",
     "typescript": "~5.9.3"
+  },
+  "peerDependencies": {
+    "@estiva-app/protocol": ">=0.14.0"
   }
 }

package/src/client.ts

@@ -67,6 +67,8 @@ declare const crypto: {
   subtle: { digest(algorithm: string, data: Uint8Array): Promise<ArrayBuffer> }
 }
 declare const btoa: (binary: string) => string
+/** Reading the `exp` claim out of a token the app already holds. */
+declare const atob: (base64: string) => string
 declare const TextEncoder: { new (): { encode(input: string): Uint8Array } }
 declare const URL: {
   new (url: string, base?: string): { searchParams: { set(k: string, v: string): void }; toString(): string }
@@ -251,18 +253,67 @@ export function createEstivaId(config: EstivaIdConfig): EstivaIdClient {
     return base64Url(new Uint8Array(digest))
   }
 
+  /**
+   * The `exp` claim, in epoch ms, or null if the token does not carry a readable one.
+   *
+   * Not verification — that is the resource server's job and it holds the key.
+   * This reads one number out of a payload the app already holds, for one
+   * purpose: so that "is this token still good" is answered by the same fact the
+   * service will answer it with.
+   *
+   * Parse failures return null rather than throwing. A token this cannot read is
+   * still a token, and refusing to hold one because its middle segment is not
+   * base64url would be a worse failure than the one this prevents.
+   */
+  const expFromJwt = (accessToken: string): number | null => {
+    const payload = accessToken.split('.')[1]
+    if (!payload) return null
+    try {
+      const json = atob(payload.replace(/-/g, '+').replace(/_/g, '/'))
+      const exp = (JSON.parse(json) as { exp?: unknown }).exp
+      return typeof exp === 'number' && Number.isFinite(exp) ? exp * 1000 : null
+    } catch {
+      return null
+    }
+  }
+
   /**
    * Shape a token response into what is kept.
    *
    * The expiry is deliberately pessimistic by 30s, so a token is never presented
    * in the window where it is technically alive and about to not be.
+   *
+   * ## Why `exp` and not just `expires_in`
+   *
+   * `expires_in` describes a *duration*, so acting on it means adding it to the
+   * local clock — and the service decides using the token's own `exp` against
+   * *its* clock. Those two answers agree only while the clocks do.
+   *
+   * When they diverge in the unsafe direction the app believes a dead token is
+   * live, and the failure is genuinely nasty: `POST /sign` answers
+   * `401 Invalid token: "exp" claim timestamp check failed`, while `validToken`
+   * keeps returning that same token to every caller that asks — including the
+   * one Convex asks — so nothing ever renews and nothing ever recovers. Peek got
+   * into exactly this state overnight on a machine that had slept, and the only
+   * way out was clearing site data and signing in again.
+   *
+   * So both bounds are computed and **the earlier wins**. `exp` is what the
+   * service will actually check; `expires_in` still covers a token with no
+   * readable `exp`, and a clock that is *behind* the service's, where `exp`
+   * alone would be the more generous of the two.
    */
-  const tokenFrom = (body: TokenResponse, pubkey: string): StoredToken => ({
-    accessToken: body.access_token as string,
-    expiresAt: now() + Math.max(0, (body.expires_in ?? 600) - 30) * 1000,
-    pubkey,
-    ...(body.refresh_token ? { refreshToken: body.refresh_token } : {}),
-  })
+  const tokenFrom = (body: TokenResponse, pubkey: string): StoredToken => {
+    const accessToken = body.access_token as string
+    const fromDuration = now() + Math.max(0, (body.expires_in ?? 600) - 30) * 1000
+    const exp = expFromJwt(accessToken)
+    const fromClaim = exp === null ? null : exp - 30_000
+    return {
+      accessToken,
+      expiresAt: fromClaim === null ? fromDuration : Math.min(fromDuration, fromClaim),
+      pubkey,
+      ...(body.refresh_token ? { refreshToken: body.refresh_token } : {}),
+    }
+  }
 
   const storedToken = (): StoredToken | null => {
     const raw = config.storage()?.getItem(TOKEN_KEY)

package/src/index.ts

@@ -46,7 +46,7 @@
  * The thing that made it possible was not cleverness — it was that a browser API
  * an app must inject is also a browser API a test can observe.
  */
-export const IDENTITY_VERSION = '0.1.2'
+export const IDENTITY_VERSION = '0.2.0'
 
 export {
   type KeyValueStore,
@@ -81,3 +81,12 @@ export {
   SignInError,
   createEstivaId,
 } from './client.js'
+
+export {
+  type SignViaEstivaIdOptions,
+  type EstivaIdSignerOptions,
+  type SignFetchLike,
+  SignerTokenExpired,
+  signViaEstivaId,
+  estivaIdSigner,
+} from './signer.js'

package/src/signer.ts

@@ -0,0 +1,231 @@
+/**
+ * Signing by asking Estiva ID, holding no key at all.
+ *
+ * The point of the whole seam: an app publishes as a person without ever seeing
+ * their secret. `POST /sign` takes a bearer token and an unsigned event and
+ * returns a signed one.
+ *
+ * ## Why this is identity's and not protocol's
+ *
+ * `@estiva-app/protocol` owns how an event gets its signature — the id
+ * computation, the serialization, the bytes. It owns the {@link Signer} seam and
+ * the raw-secret-key implementation of it. What it deliberately does not own is
+ * *who is allowed to ask*: the token, its renewal, and the round trip to an
+ * identity service. That is this package, and `ship/lib/nostr/signer.ts` has
+ * said so in a header comment since SHA-3 — "it is `@estiva-app/identity`'s
+ * remit — SHA-4. Until then this file is the app's copy."
+ *
+ * There were three copies until this file existed:
+ *
+ * | where | what |
+ * | --- | --- |
+ * | `ship/lib/nostr/signer.ts` | `estivaIdSigner` |
+ * | `estiva-agent/lib/nostr/signer.ts` | byte-identical to it |
+ * | `peek/src/nostr/bridge.ts` | `signViaEstivaId`, a third |
+ *
+ * Three implementations of the one call that decides who authored an event, and
+ * they had already drifted on the thing that matters most — see the guard below.
+ *
+ * ## Two exports over one round trip
+ *
+ * The consumers genuinely want different shapes, and this is not the same kind
+ * of difference as `storage` or `clientId`. Peek signs *per request* with a token
+ * it reads fresh each time (`signViaEstivaId`); Ship builds a `Signer` **once**,
+ * at module scope, which then holds a live bearer for the life of the page and
+ * renews it on a `401`. Neither can be expressed as the other without one of
+ * them getting worse, so both are here, over one implementation of the round
+ * trip and one copy of the guard.
+ *
+ * `@estiva-app/protocol` is a **peer** dependency, following `@estiva-app/interop`.
+ * Nothing here calls a protocol function — only its types are used — so the
+ * emitted `.js` imports nothing, and `dist/` keeps the property SHA-4's seam was
+ * verified by: the complete list of imports in the shipped JavaScript is
+ * `./client.js` and `./shell.js`.
+ */
+import type { SignedEvent, Signer, UnsignedEvent } from '@estiva-app/protocol'
+
+/**
+ * `fetch`, again, and for the same reason as in `client.ts` — `lib.es2022` has
+ * no such global, and this package compiles with `types: []` and no `lib: dom`
+ * so one published `.d.ts` works in every consumer (ADR 0002 §4a).
+ *
+ * Note this module needs a *slightly* wider `fetch` than `client.ts` does: it
+ * reads `text()` rather than `json()`, because `/sign`'s error bodies are not
+ * reliably JSON and the raw text is the only thing worth showing a person.
+ */
+declare const fetch: (
+  url: string,
+  init: { method: string; headers: Record<string, string>; body: string },
+) => Promise<{ ok: boolean; status: number; text(): Promise<string> }>
+
+/** Just the part of `fetch` this module uses. A parameter as well as a global. */
+export type SignFetchLike = typeof fetch
+
+/** Distinguishes "sign in again" from "this event was refused". */
+export class SignerTokenExpired extends Error {
+  constructor() {
+    super('The signing token has expired')
+    this.name = 'SignerTokenExpired'
+  }
+}
+
+export interface SignViaEstivaIdOptions {
+  /** Origin of the identity service, e.g. `https://id.estiva.app`. */
+  base: string
+  /** A bearer token from `POST /token`, audience-bound to this app. */
+  token: string
+  /**
+   * The pubkey the returned event **must** be authored by.
+   *
+   * Not a request. `/sign` ignores any pubkey it is handed and signs as the
+   * token's subject, always — so this is a *check*, and the reason one is needed
+   * at all is that a mismatch comes back as **HTTP 200 with a perfectly valid
+   * event authored by somebody else**. Without it the failure is invisible at
+   * the call site and surfaces later as a message attributed to the wrong
+   * person, which is not a bug anybody can debug from the symptom.
+   *
+   * Optional only because `estivaIdSigner` always supplies it and a caller with
+   * genuinely no expectation should be able to say so out loud. Supply it.
+   */
+  expectedPubkey?: string
+  fetch?: SignFetchLike
+}
+
+/**
+ * One `POST /sign`.
+ *
+ * **`/sign` refuses `kind:0` for every app, always.** Profiles belong to the
+ * identity service (PEEK-31); a refusal here is the policy working rather than
+ * something to route around.
+ *
+ * A `401` is thrown as {@link SignerTokenExpired} rather than a generic failure,
+ * because "obtain a new token" and "this event was refused" call for completely
+ * different responses from the caller and the status code is the only thing that
+ * distinguishes them.
+ */
+export async function signViaEstivaId(
+  unsigned: UnsignedEvent,
+  options: SignViaEstivaIdOptions,
+): Promise<SignedEvent> {
+  const send = options.fetch ?? fetch
+  const origin = options.base.replace(/\/+$/, '')
+
+  const response = await send(`${origin}/sign`, {
+    method: 'POST',
+    headers: {
+      'content-type': 'application/json',
+      authorization: `Bearer ${options.token}`,
+    },
+    /*
+      Only the four fields that go into the signature input. The unsigned event
+      may carry a `pubkey` — Peek's NIP-98 path passes an empty one on purpose —
+      and sending it would imply `/sign` honours it, which it does not.
+    */
+    body: JSON.stringify({
+      event: {
+        kind: unsigned.kind,
+        created_at: unsigned.created_at,
+        tags: unsigned.tags,
+        content: unsigned.content,
+      },
+    }),
+  })
+
+  const text = await response.text()
+  if (response.status === 401) throw new SignerTokenExpired()
+  if (!response.ok) {
+    let reason = text.slice(0, 200)
+    try {
+      const body = JSON.parse(text) as { error?: { message?: string } }
+      reason = body.error?.message ?? reason
+    } catch {
+      // Keep the raw text. `/sign`'s error bodies are not reliably JSON, and the
+      // raw text is more use to a person than "unparseable response".
+    }
+    throw new Error(`Estiva ID refused to sign kind:${unsigned.kind} — ${reason}`)
+  }
+
+  const event = (JSON.parse(text) as { event?: SignedEvent }).event
+  if (!event) throw new Error('POST /sign returned no event')
+
+  if (options.expectedPubkey && event.pubkey !== options.expectedPubkey) {
+    throw new Error(
+      `POST /sign returned an event authored by ${event.pubkey}, expected ${options.expectedPubkey}. ` +
+        'That token belongs to a different identity — refusing to publish under the wrong author.',
+    )
+  }
+
+  return event
+}
+
+export interface EstivaIdSignerOptions {
+  /** Origin of the identity service, e.g. `https://id.estiva.app`. */
+  base: string
+  /** The pubkey the token was issued for — `sub` in the JWT. */
+  pubkey: string
+  /** A bearer token from `POST /token`, audience-bound to this app. */
+  token: string
+  /**
+   * Renew the token, once, when `/sign` says it has expired (PEEK-108).
+   *
+   * Optional: without it a `401` surfaces as {@link SignerTokenExpired} for the
+   * caller to deal with, exactly as before. With it, an expiry is invisible —
+   * which matters more than it used to, because access tokens live ten minutes
+   * rather than an hour, so a session of any length crosses one.
+   *
+   * Returning `null` means renewal failed and the expiry is real.
+   *
+   * Pass `client.refreshAccessToken` and nothing else: it coalesces concurrent
+   * callers, and a refresh token is single-use with a replay read as theft.
+   */
+  renew?: () => Promise<string | null>
+  fetch?: SignFetchLike
+}
+
+/**
+ * A {@link Signer} that signs by asking Estiva ID.
+ *
+ * Holds the live bearer, so a renewal replaces it for every later signature
+ * rather than being rediscovered on each one.
+ */
+export function estivaIdSigner({ base, pubkey, token, renew, fetch: send }: EstivaIdSignerOptions): Signer {
+  let bearer = token
+
+  return {
+    pubkey,
+    kind: 'estiva-id',
+    async sign(unsigned) {
+      const once = (auth: string) =>
+        signViaEstivaId(unsigned, {
+          base,
+          token: auth,
+          // The guard, unconditionally. Ship's copy of this signer never had it
+          // and Peek's `signViaEstivaId` did, which is exactly the drift three
+          // copies produce: the app that publishes every issue, comment and
+          // status change was the one that could not tell it had signed as
+          // somebody else. SHA-4's Traps section says both must keep it.
+          expectedPubkey: pubkey,
+          ...(send ? { fetch: send } : {}),
+        })
+
+      try {
+        return await once(bearer)
+      } catch (error) {
+        /*
+          Renew once and retry, never twice.
+
+          A second 401 after a successful renewal is not an expiry — it is a
+          token the service will not accept, and retrying that in a loop is how
+          one refused signature becomes a hot loop against the identity service.
+          Anything that is not an expiry is rethrown untouched, so a wrong-author
+          refusal is never mistaken for something a new token would fix.
+        */
+        if (!(error instanceof SignerTokenExpired) || !renew) throw error
+        const renewed = await renew()
+        if (!renewed) throw error
+        bearer = renewed
+        return await once(bearer)
+      }
+    },
+  }
+}