@farm.js/core 0.1.61 → 0.1.62

package/dist/chunk-B4CWYGCG.mjs

@@ -0,0 +1,541 @@
+import {
+  farmSecretsMatch
+} from "./chunk-YP7YO3S3.mjs";
+import {
+  getStorage
+} from "./chunk-TJVUTGED.mjs";
+
+// src/mobile/session.ts
+var FARM_MOBILE_SESSION_PLUGIN = "farm:mobile-session";
+var FARM_MOBILE_SESSION_PATH = "/__farm/mobile/session";
+var FARM_MOBILE_APP_HEADER = "x-farm-mobile";
+var FARM_MOBILE_NONCE_HEADER = "x-farm-mobile-nonce";
+var FARM_MOBILE_DEVICE_COOKIE = "farm_mobile";
+var ACCESS_PREFIX = "fma1";
+var REFRESH_PREFIX = "fmr1";
+var STORAGE_NAMESPACE = "farm-mobile";
+var STATE_KEY = "farm:mobile-session";
+var USED_REFRESH_LIMIT = 8;
+var BROWSER_HEADERS = [
+  "origin",
+  "sec-fetch-site",
+  "sec-fetch-mode",
+  "sec-fetch-dest",
+  "sec-fetch-user"
+];
+var APP_ID = /^[A-Za-z][A-Za-z0-9_]*(?:\.[A-Za-z][A-Za-z0-9_]*)+$/;
+var BASE64URL = /^[A-Za-z0-9_-]+$/;
+var encoder = new TextEncoder();
+var decoder = new TextDecoder();
+function toBase64Url(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function fromBase64Url(value) {
+  const base64 = value.replace(/-/g, "+").replace(/_/g, "/");
+  const binary = atob(base64 + "=".repeat((4 - base64.length % 4) % 4));
+  const bytes = new Uint8Array(binary.length);
+  for (let index = 0; index < binary.length; index++) bytes[index] = binary.charCodeAt(index);
+  return bytes;
+}
+function randomToken(bytes) {
+  return toBase64Url(globalThis.crypto.getRandomValues(new Uint8Array(bytes)));
+}
+async function sha256(value) {
+  const digest = await globalThis.crypto.subtle.digest("SHA-256", encoder.encode(value));
+  return toBase64Url(new Uint8Array(digest));
+}
+async function aesKey(key) {
+  return globalThis.crypto.subtle.importKey("raw", fromBase64Url(key), "AES-GCM", false, [
+    "encrypt",
+    "decrypt"
+  ]);
+}
+async function sealJar(jar, key, deviceId) {
+  const iv = globalThis.crypto.getRandomValues(new Uint8Array(12));
+  const data = await globalThis.crypto.subtle.encrypt(
+    { name: "AES-GCM", iv, additionalData: encoder.encode(deviceId) },
+    await aesKey(key),
+    encoder.encode(JSON.stringify(jar))
+  );
+  return { iv: toBase64Url(iv), data: toBase64Url(new Uint8Array(data)) };
+}
+async function openJar(sealed, key, deviceId) {
+  try {
+    const data = await globalThis.crypto.subtle.decrypt(
+      { name: "AES-GCM", iv: fromBase64Url(sealed.iv), additionalData: encoder.encode(deviceId) },
+      await aesKey(key),
+      fromBase64Url(sealed.data)
+    );
+    const jar = JSON.parse(decoder.decode(data));
+    if (!jar || typeof jar !== "object" || Array.isArray(jar)) return null;
+    return Object.fromEntries(
+      Object.entries(jar).filter(
+        (entry) => typeof entry[1] === "string"
+      )
+    );
+  } catch {
+    return null;
+  }
+}
+function formatToken(prefix, token) {
+  return `${prefix}.${token.deviceId}.${token.secret}.${token.key}`;
+}
+function parseFarmMobileToken(value, kind) {
+  if (typeof value !== "string" || value.length > 256) return null;
+  const parts = value.split(".");
+  if (parts.length !== 4 || parts[0] !== (kind === "access" ? ACCESS_PREFIX : REFRESH_PREFIX)) {
+    return null;
+  }
+  const [, deviceId, secret, key] = parts;
+  if (deviceId.length !== 22 || secret.length !== 43 || key.length !== 43) return null;
+  if (!BASE64URL.test(deviceId) || !BASE64URL.test(secret) || !BASE64URL.test(key)) return null;
+  return { deviceId, secret, key };
+}
+function readCookies(header) {
+  const cookies = {};
+  for (const part of (header ?? "").split(";")) {
+    const separator = part.indexOf("=");
+    if (separator <= 0) continue;
+    const name = part.slice(0, separator).trim();
+    if (!name || name === "__proto__" || name in cookies) continue;
+    cookies[name] = part.slice(separator + 1).trim();
+  }
+  return cookies;
+}
+function cookieHeader(jar) {
+  return Object.entries(jar).map(([name, value]) => `${name}=${value}`).join("; ");
+}
+function readSetCookies(headers, now) {
+  const changes = [];
+  for (const line of headers.getSetCookie()) {
+    const [pair = "", ...attributes] = line.split(";");
+    const separator = pair.indexOf("=");
+    if (separator <= 0) continue;
+    const name = pair.slice(0, separator).trim();
+    if (!name || name === "__proto__") continue;
+    let expired = false;
+    for (const attribute of attributes) {
+      const [rawKey = "", ...rest] = attribute.split("=");
+      const key = rawKey.trim().toLowerCase();
+      const value = rest.join("=").trim();
+      if (key === "max-age" && /^-?\d+$/.test(value)) expired = Number(value) <= 0;
+      if (key === "expires" && !attributes.some((item) => /^\s*max-age=/i.test(item))) {
+        const time = Date.parse(value);
+        if (!Number.isNaN(time) && time <= now) expired = true;
+      }
+    }
+    changes.push([name, expired ? null : pair.slice(separator + 1).trim()]);
+  }
+  return changes;
+}
+function applySetCookies(jar, changes) {
+  const next = { ...jar };
+  for (const [name, value] of changes) {
+    if (name === FARM_MOBILE_DEVICE_COOKIE) continue;
+    if (value === null) delete next[name];
+    else next[name] = value;
+  }
+  return next;
+}
+function json(body, status = 200, headers) {
+  const response = Response.json(body, { status, headers });
+  response.headers.set("cache-control", "no-store");
+  return response;
+}
+function failure(status, error, message) {
+  const response = json({ error, message }, status);
+  if (status === 401) {
+    response.headers.set("www-authenticate", `Bearer error="invalid_token"`);
+  }
+  return response;
+}
+function isFarmMobileNativeRequest(request) {
+  return !BROWSER_HEADERS.some((name) => request.headers.has(name));
+}
+function readAppId(request) {
+  const value = request.headers.get(FARM_MOBILE_APP_HEADER)?.trim();
+  return value && value.length <= 255 && APP_ID.test(value) ? value : null;
+}
+function bearer(request) {
+  const header = request.headers.get("authorization");
+  if (!header) return null;
+  const match = /^bearer\s+(\S+)$/i.exec(header.trim());
+  return match ? match[1] : null;
+}
+var SessionReadError = class extends Error {
+  constructor(message, reason) {
+    super(message);
+    this.reason = reason;
+  }
+};
+function createFarmMobileSessionPlugin(options) {
+  const basePath = options.basePath && options.basePath !== "/" ? options.basePath : "";
+  const accessTtl = (options.accessTokenTtl ?? 15 * 60) * 1e3;
+  const refreshTtl = (options.refreshTokenTtl ?? 30 * 24 * 60 * 60) * 1e3;
+  const nonceTtl = (options.nonceTtl ?? 60) * 1e3;
+  const now = options.now ?? Date.now;
+  const store = () => options.storage?.() ?? getStorage(STORAGE_NAMESPACE);
+  let warnedNoReader = false;
+  function sessionReader() {
+    for (const integration of Object.values(options.integrations() ?? {})) {
+      const session = integration?.session;
+      if (typeof session === "function") {
+        return (request) => session.call(integration, request);
+      }
+    }
+    return null;
+  }
+  async function readSession(reader, url, cookies) {
+    const header = cookieHeader(cookies);
+    if (!header) return null;
+    let session;
+    try {
+      session = await reader(new Request(url, { headers: { cookie: header } }));
+    } catch (error) {
+      throw new SessionReadError("The auth integration's session() failed", error);
+    }
+    const id = session?.id;
+    return typeof id === "string" && id ? session : null;
+  }
+  function noReader() {
+    if (!warnedNoReader) {
+      warnedNoReader = true;
+      console.warn(
+        "[Farm] Mobile session tokens need an auth integration that reads sessions (`session()`): @farm.js/auth (`auth: true`) or @farm.js/better-auth. No configured integration has one, so native screens stay signed out."
+      );
+    }
+    return failure(
+      501,
+      "mobile_session_unavailable",
+      "No auth integration in this app reads sessions for mobile tokens."
+    );
+  }
+  function markerCookie(request, value, maxAge) {
+    const secure = new URL(request.url).protocol === "https:" ? "; Secure" : "";
+    return `${FARM_MOBILE_DEVICE_COOKIE}=${value}; Path=${basePath || "/"}; Max-Age=${maxAge}; HttpOnly; SameSite=Lax${secure}`;
+  }
+  async function loadDevice(deviceId) {
+    const record = await store().getItem(`device:${deviceId}`);
+    return record && record.v === 1 ? record : null;
+  }
+  async function saveDevice(deviceId, record) {
+    await store().setItem(`device:${deviceId}`, record);
+  }
+  async function revokeDevice(deviceId) {
+    await store().removeItem(`device:${deviceId}`);
+  }
+  async function challengeKey(sessionId, appId) {
+    return `challenge:${await sha256(`${sessionId}
+${appId}`)}`;
+  }
+  async function issueTokens(deviceId, key, base, jar) {
+    const access = { deviceId, secret: randomToken(32), key };
+    const refresh2 = { deviceId, secret: randomToken(32), key };
+    const issuedAt = now();
+    const record = {
+      ...base,
+      accessHash: await sha256(access.secret),
+      accessExpiresAt: issuedAt + accessTtl,
+      refreshHash: await sha256(refresh2.secret),
+      refreshExpiresAt: issuedAt + refreshTtl,
+      jar: await sealJar(jar, key, deviceId)
+    };
+    await saveDevice(deviceId, record);
+    return {
+      record,
+      body: {
+        tokenType: "Bearer",
+        accessToken: formatToken(ACCESS_PREFIX, access),
+        refreshToken: formatToken(REFRESH_PREFIX, refresh2),
+        expiresIn: Math.floor(accessTtl / 1e3),
+        refreshExpiresIn: Math.floor(refreshTtl / 1e3)
+      }
+    };
+  }
+  function guardEndpoint(request) {
+    if (request.method !== "POST") {
+      return new Response("Method Not Allowed", {
+        status: 405,
+        headers: { allow: "POST", "cache-control": "no-store" }
+      });
+    }
+    if (!isFarmMobileNativeRequest(request)) {
+      return failure(403, "not_native", "Mobile session endpoints answer the app's shell only.");
+    }
+    const appId = readAppId(request);
+    if (!appId) {
+      return failure(400, "invalid_app", `Send the app's mobile.id in ${FARM_MOBILE_APP_HEADER}.`);
+    }
+    return { appId };
+  }
+  async function challenge(request) {
+    const guard = guardEndpoint(request);
+    if (guard instanceof Response) return guard;
+    const reader = sessionReader();
+    if (!reader) return noReader();
+    const cookies = readCookies(request.headers.get("cookie"));
+    delete cookies[FARM_MOBILE_DEVICE_COOKIE];
+    const session = await readSession(reader, request.url, cookies);
+    if (!session) return failure(401, "signed_out", "Sign in on a web screen first.");
+    const nonce = randomToken(32);
+    await store().setItem(await challengeKey(session.id, guard.appId), {
+      hash: await sha256(nonce),
+      expiresAt: now() + nonceTtl
+    });
+    return json({ nonce, expiresIn: Math.floor(nonceTtl / 1e3) });
+  }
+  async function issue(request) {
+    const guard = guardEndpoint(request);
+    if (guard instanceof Response) return guard;
+    const reader = sessionReader();
+    if (!reader) return noReader();
+    const nonce = request.headers.get(FARM_MOBILE_NONCE_HEADER)?.trim() ?? "";
+    const cookies = readCookies(request.headers.get("cookie"));
+    delete cookies[FARM_MOBILE_DEVICE_COOKIE];
+    const session = await readSession(reader, request.url, cookies);
+    if (!session) return failure(401, "signed_out", "Sign in on a web screen first.");
+    const key = await challengeKey(session.id, guard.appId);
+    const pending = await store().getItem(key);
+    if (pending) await store().removeItem(key);
+    if (!pending || pending.expiresAt <= now() || !nonce || !farmSecretsMatch(await sha256(nonce), pending.hash)) {
+      return failure(401, "invalid_nonce", "Request a new challenge and try again.");
+    }
+    const deviceId = randomToken(16);
+    const { body: tokens } = await issueTokens(
+      deviceId,
+      randomToken(32),
+      {
+        v: 1,
+        appId: guard.appId,
+        sessionHash: await sha256(session.id),
+        createdAt: now(),
+        usedRefreshHashes: []
+      },
+      cookies
+    );
+    const response = json(tokens);
+    response.headers.append(
+      "set-cookie",
+      markerCookie(request, deviceId, Math.floor(refreshTtl / 1e3))
+    );
+    return response;
+  }
+  async function refresh(request) {
+    const guard = guardEndpoint(request);
+    if (guard instanceof Response) return guard;
+    const reader = sessionReader();
+    if (!reader) return noReader();
+    const token = parseFarmMobileToken(bearer(request), "refresh");
+    if (!token) return failure(401, "invalid_token", "Unknown refresh token.");
+    const record = await loadDevice(token.deviceId);
+    if (!record) return failure(401, "invalid_token", "Unknown refresh token.");
+    if (record.appId !== guard.appId) {
+      return failure(401, "invalid_token", "The token belongs to another app.");
+    }
+    const hash = await sha256(token.secret);
+    if (!farmSecretsMatch(hash, record.refreshHash)) {
+      if (record.usedRefreshHashes.some((used) => farmSecretsMatch(hash, used))) {
+        await revokeDevice(token.deviceId);
+        return failure(401, "refresh_reused", "The refresh token was already used.");
+      }
+      return failure(401, "invalid_token", "Unknown refresh token.");
+    }
+    if (record.refreshExpiresAt <= now()) {
+      await revokeDevice(token.deviceId);
+      return failure(401, "invalid_token", "The refresh token expired.");
+    }
+    const jar = await openJar(record.jar, token.key, token.deviceId);
+    if (!jar) return failure(401, "invalid_token", "Unknown refresh token.");
+    let session;
+    try {
+      session = await readSession(reader, request.url, jar);
+    } catch (error) {
+      console.error("[Farm] Mobile session refresh could not read the session:", error);
+      return failure(503, "session_unavailable", "Try again later.");
+    }
+    if (!session || await sha256(session.id) !== record.sessionHash) {
+      await revokeDevice(token.deviceId);
+      return failure(401, "signed_out", "The web session behind this device ended.");
+    }
+    const { body: tokens } = await issueTokens(
+      token.deviceId,
+      randomToken(32),
+      {
+        v: 1,
+        appId: record.appId,
+        sessionHash: record.sessionHash,
+        createdAt: record.createdAt,
+        usedRefreshHashes: [record.refreshHash, ...record.usedRefreshHashes].slice(
+          0,
+          USED_REFRESH_LIMIT
+        )
+      },
+      jar
+    );
+    const response = json(tokens);
+    response.headers.append(
+      "set-cookie",
+      markerCookie(request, token.deviceId, Math.floor(refreshTtl / 1e3))
+    );
+    return response;
+  }
+  async function revoke(request) {
+    const guard = guardEndpoint(request);
+    if (guard instanceof Response) return guard;
+    const access = parseFarmMobileToken(bearer(request), "access");
+    const token = access ?? parseFarmMobileToken(bearer(request), "refresh");
+    if (token) {
+      const record = await loadDevice(token.deviceId);
+      const hash = await sha256(token.secret);
+      if (record && record.appId === guard.appId && farmSecretsMatch(hash, access ? record.accessHash : record.refreshHash)) {
+        await revokeDevice(token.deviceId);
+      }
+    }
+    const response = new Response(null, { status: 204, headers: { "cache-control": "no-store" } });
+    response.headers.append("set-cookie", markerCookie(request, "", 0));
+    return response;
+  }
+  async function before(event) {
+    const { request } = event;
+    const value = bearer(request);
+    if (!value?.startsWith(`${ACCESS_PREFIX}.`)) return void 0;
+    if (!isFarmMobileNativeRequest(request)) return void 0;
+    const token = parseFarmMobileToken(value, "access");
+    if (!token) return failure(401, "invalid_token", "Unknown access token.");
+    const appId = readAppId(request);
+    const record = await loadDevice(token.deviceId);
+    const hash = await sha256(token.secret);
+    if (!record || !farmSecretsMatch(hash, record.accessHash)) {
+      return failure(401, "invalid_token", "Unknown access token.");
+    }
+    if (!appId || appId !== record.appId) {
+      return failure(401, "invalid_token", "The token belongs to another app.");
+    }
+    if (record.accessExpiresAt <= now()) {
+      return failure(401, "invalid_token", "The access token expired.");
+    }
+    const jar = await openJar(record.jar, token.key, token.deviceId);
+    if (!jar) return failure(401, "invalid_token", "Unknown access token.");
+    const headers = new Headers(request.headers);
+    headers.delete("authorization");
+    headers.delete("cookie");
+    const cookies = cookieHeader(jar);
+    if (cookies) headers.set("cookie", cookies);
+    headers.set("origin", new URL(request.url).origin);
+    event.req.set(STATE_KEY, {
+      deviceId: token.deviceId,
+      key: token.key,
+      accessHash: record.accessHash
+    });
+    return new Request(request, { headers });
+  }
+  async function after(event) {
+    const state = event.req.get(STATE_KEY);
+    if (state) return afterBearer(event.request, event.response, state);
+    const cookie = event.request.headers.get("cookie");
+    if (!cookie?.includes(`${FARM_MOBILE_DEVICE_COOKIE}=`)) return void 0;
+    return afterWebScreen(event.request, event.response);
+  }
+  async function afterBearer(request, response, state) {
+    const changes = readSetCookies(response.headers, now());
+    const headers = new Headers(response.headers);
+    headers.delete("set-cookie");
+    headers.set("cache-control", "private, no-store");
+    if (changes.length > 0) {
+      const record = await loadDevice(state.deviceId);
+      if (record && farmSecretsMatch(state.accessHash, record.accessHash)) {
+        const jar = await openJar(record.jar, state.key, state.deviceId);
+        if (jar) {
+          const next = applySetCookies(jar, changes);
+          const reader = sessionReader();
+          let signedOut = false;
+          if (reader && changes.some(([, value]) => value === null)) {
+            signedOut = await readSession(reader, request.url, next).then(
+              async (session) => !session || await sha256(session.id) !== record.sessionHash,
+              () => false
+            );
+          }
+          if (signedOut) await revokeDevice(state.deviceId);
+          else
+            await saveDevice(state.deviceId, {
+              ...record,
+              jar: await sealJar(next, state.key, state.deviceId)
+            });
+        }
+      }
+    }
+    return new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers
+    });
+  }
+  async function afterWebScreen(request, response) {
+    const changes = readSetCookies(response.headers, now());
+    if (!changes.some(([, value]) => value === null)) return void 0;
+    const cookies = readCookies(request.headers.get("cookie"));
+    const deviceId = cookies[FARM_MOBILE_DEVICE_COOKIE];
+    if (!deviceId || deviceId.length !== 22 || !BASE64URL.test(deviceId)) return void 0;
+    const reader = sessionReader();
+    if (!reader) return void 0;
+    delete cookies[FARM_MOBILE_DEVICE_COOKIE];
+    const signedOut = await readSession(
+      reader,
+      request.url,
+      applySetCookies(cookies, changes)
+    ).then(
+      (session) => !session,
+      () => false
+    );
+    if (!signedOut) return void 0;
+    await revokeDevice(deviceId);
+    const headers = new Headers(response.headers);
+    headers.append("set-cookie", markerCookie(request, "", 0));
+    return new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers
+    });
+  }
+  const endpoint = (path, handler) => ({
+    path,
+    handler: (event) => handler(event.request).catch((error) => {
+      if (error instanceof SessionReadError) {
+        console.error("[Farm] Mobile session endpoint could not read the session:", error.reason);
+        return failure(503, "session_unavailable", "Try again later.");
+      }
+      throw error;
+    })
+  });
+  return {
+    name: FARM_MOBILE_SESSION_PLUGIN,
+    // Before app plugins, so their hooks see the signed-in request.
+    enforce: "pre",
+    runtime: {
+      // `before` changes only requests with a mobile bearer, and `after` marks those private.
+      // Every other response stays as cacheable as it was.
+      cache: "public",
+      endpoints: [
+        endpoint(`${FARM_MOBILE_SESSION_PATH}/challenge`, challenge),
+        endpoint(FARM_MOBILE_SESSION_PATH, issue),
+        endpoint(`${FARM_MOBILE_SESSION_PATH}/refresh`, refresh),
+        endpoint(`${FARM_MOBILE_SESSION_PATH}/revoke`, revoke)
+      ],
+      before,
+      after
+    }
+  };
+}
+
+export {
+  FARM_MOBILE_SESSION_PLUGIN,
+  FARM_MOBILE_SESSION_PATH,
+  FARM_MOBILE_APP_HEADER,
+  FARM_MOBILE_NONCE_HEADER,
+  FARM_MOBILE_DEVICE_COOKIE,
+  parseFarmMobileToken,
+  isFarmMobileNativeRequest,
+  createFarmMobileSessionPlugin
+};

package/dist/chunk-BBPDJGCU.cjs

@@ -0,0 +1,157 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+var _chunkLNVGXUL3cjs = require('./chunk-LNVGXUL3.cjs');
+
+// src/i18n/catalog.ts
+var _promises = require('fs/promises');
+var _icumessageformatparser = require('@formatjs/icu-messageformat-parser');
+async function readFarmI18nCatalogs(config) {
+  if (!config.enabled) {
+    return { catalogs: {}, signatures: {} };
+  }
+  const catalogs = {};
+  for (const locale of config.locales) {
+    const filePath = _chunkLNVGXUL3cjs.resolveFarmI18nMessagePath.call(void 0, config, locale);
+    let source;
+    try {
+      source = await _promises.readFile.call(void 0, filePath, "utf8");
+    } catch (error) {
+      throw new Error(
+        `Unable to read Farm i18n catalog for "${locale}" at ${filePath}: ${messageOf(error)}`
+      );
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(source);
+    } catch (error) {
+      throw new Error(`Invalid JSON in Farm i18n catalog ${filePath}: ${messageOf(error)}`);
+    }
+    catalogs[locale] = flattenFarmI18nCatalog(parsed, filePath);
+  }
+  const reference = catalogs[config.defaultLocale] || {};
+  const signatures = {};
+  for (const [key, message] of Object.entries(reference)) {
+    signatures[key] = analyzeFarmI18nMessage(message, `${config.defaultLocale}:${key}`);
+  }
+  validateFarmI18nCatalogs(config, catalogs, signatures);
+  return { catalogs, signatures };
+}
+function flattenFarmI18nCatalog(input, source = "i18n catalog") {
+  if (!isPlainObject(input)) {
+    throw new Error(`${source} must contain a JSON object at its root.`);
+  }
+  const output = {};
+  const visit = (value, segments) => {
+    if (typeof value === "string") {
+      const key = segments.join(".");
+      if (!key) throw new Error(`${source} contains an empty message key.`);
+      if (Object.prototype.hasOwnProperty.call(output, key)) {
+        throw new Error(`${source} contains duplicate message key "${key}".`);
+      }
+      output[key] = value;
+      return;
+    }
+    if (!isPlainObject(value)) {
+      const key = segments.join(".") || "<root>";
+      throw new Error(`${source} message "${key}" must be a string or nested object.`);
+    }
+    for (const [key, nested] of Object.entries(value)) {
+      if (!key.trim()) throw new Error(`${source} contains an empty message key.`);
+      visit(nested, [...segments, key]);
+    }
+  };
+  visit(input, []);
+  return output;
+}
+function analyzeFarmI18nMessage(message, label = "message") {
+  let ast;
+  try {
+    ast = _icumessageformatparser.parse.call(void 0, message, { captureLocation: false });
+  } catch (error) {
+    throw new Error(`Invalid ICU syntax in ${label}: ${messageOf(error)}`);
+  }
+  const signature = {};
+  collectArguments(ast, signature, label);
+  return signature;
+}
+function validateFarmI18nCatalogs(config, catalogs, signatures) {
+  const referenceKeys = Object.keys(catalogs[config.defaultLocale] || {}).sort();
+  for (const locale of config.locales) {
+    const catalog = catalogs[locale] || {};
+    const localeKeys = Object.keys(catalog).sort();
+    const missing = referenceKeys.filter(
+      (key) => !Object.prototype.hasOwnProperty.call(catalog, key)
+    );
+    const extra = localeKeys.filter(
+      (key) => !Object.prototype.hasOwnProperty.call(signatures, key)
+    );
+    if (config.strict && (missing.length > 0 || extra.length > 0)) {
+      const details = [
+        missing.length ? `missing: ${missing.join(", ")}` : "",
+        extra.length ? `extra: ${extra.join(", ")}` : ""
+      ].filter(Boolean).join("; ");
+      throw new Error(
+        `Farm i18n catalog "${locale}" does not match the default catalog (${details}).`
+      );
+    }
+    for (const [key, message] of Object.entries(catalog)) {
+      const actual = analyzeFarmI18nMessage(message, `${locale}:${key}`);
+      const expected = signatures[key];
+      if (!expected || sameSignature(expected, actual)) continue;
+      throw new Error(
+        `Farm i18n message "${key}" in "${locale}" uses different variables than "${config.defaultLocale}".`
+      );
+    }
+  }
+}
+function collectArguments(elements, signature, label) {
+  for (const element of elements) {
+    switch (element.type) {
+      case _icumessageformatparser.TYPE.argument:
+        addArgument(signature, element.value, "string", label);
+        break;
+      case _icumessageformatparser.TYPE.number:
+      case _icumessageformatparser.TYPE.plural:
+        addArgument(signature, element.value, "number", label);
+        break;
+      case _icumessageformatparser.TYPE.date:
+      case _icumessageformatparser.TYPE.time:
+        addArgument(signature, element.value, "date", label);
+        break;
+      case _icumessageformatparser.TYPE.select:
+        addArgument(signature, element.value, "select", label);
+        break;
+      case _icumessageformatparser.TYPE.tag:
+        addArgument(signature, element.value, "rich", label);
+        collectArguments(element.children, signature, label);
+        break;
+    }
+    if (element.type === _icumessageformatparser.TYPE.plural || element.type === _icumessageformatparser.TYPE.select) {
+      for (const option of Object.values(element.options)) {
+        collectArguments(option.value, signature, label);
+      }
+    }
+  }
+}
+function addArgument(signature, name, kind, label) {
+  const existing = signature[name];
+  if (existing && existing !== kind) {
+    throw new Error(`Farm i18n ${label} uses variable "${name}" as both ${existing} and ${kind}.`);
+  }
+  signature[name] = kind;
+}
+function sameSignature(expected, actual) {
+  const expectedEntries = Object.entries(expected).sort(([a], [b]) => a.localeCompare(b));
+  const actualEntries = Object.entries(actual).sort(([a], [b]) => a.localeCompare(b));
+  return JSON.stringify(expectedEntries) === JSON.stringify(actualEntries);
+}
+function isPlainObject(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function messageOf(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
+
+
+exports.readFarmI18nCatalogs = readFarmI18nCatalogs;