@haverstack/core 0.8.0 → 0.10.0

package/dist/auth.js

@@ -0,0 +1,145 @@
+/**
+ * Stack — Authentication handshake primitives
+ * -------------------------------------------------------
+ * The challenge–response handshake proves a client holds the key behind a
+ * DID, so a server can issue it a bearer token without an out-of-band
+ * secret handoff. See docs/spec/wire-format.md § Authentication.
+ *
+ * What lives here is the half both sides must agree on byte for byte: the
+ * payload that gets signed. A client builds it to sign; a server builds it
+ * to verify. Two implementations of "the same string" would diverge on the
+ * first ambiguity, and the failure mode is a signature that verifies
+ * against a payload nobody meant — so there is one constructor, exported,
+ * the same way the attachment content-type policy is shared rather than
+ * re-derived.
+ *
+ * Core verifies signatures; it does not run a server. Nonce storage,
+ * single-use enforcement and token issuance are the server's.
+ */
+import { isValidDid, signWithDid, verifyDidSignature } from './did.js';
+// -------------------------------------------------------
+// Errors
+// -------------------------------------------------------
+/**
+ * Malformed input to a handshake primitive — a bad origin, DID, or nonce,
+ * caught locally before anything is signed or verified. Outside the
+ * StackError hierarchy, like InvalidDidError: no Stack operation has begun,
+ * so there is no wire code or status to carry (docs/spec/wire-format.md
+ * § The taxonomy root).
+ */
+export class InvalidAuthChallengeError extends Error {
+    constructor(message = '') {
+        super(message || 'Invalid authentication challenge.');
+        this.name = 'InvalidAuthChallengeError';
+    }
+}
+// -------------------------------------------------------
+// The signed payload
+// -------------------------------------------------------
+/**
+ * Domain-separation tag. Version it rather than the payload's shape: a
+ * future signing primitive picks its own tag, so no signature made for one
+ * purpose can ever verify as another.
+ */
+export const AUTH_PAYLOAD_LABEL = 'haverstack-auth-v1';
+/**
+ * A server-issued nonce is opaque, but not arbitrary — it lands in a
+ * newline-delimited payload, so the charset is what keeps a nonce from
+ * spanning fields. base64url, hex and UUID all satisfy it.
+ */
+const NONCE_FORMAT = /^[A-Za-z0-9_-]+$/;
+/**
+ * Reduce a URL to the origin form the payload uses: scheme, host and a
+ * non-default port. A client derives it from the URL it dialed; a server
+ * MUST derive it from its own configured public origin rather than from a
+ * request header, which a client controls.
+ */
+export const authOriginFromUrl = (url) => {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        throw new InvalidAuthChallengeError(`Not a valid URL: "${url}"`);
+    }
+    // Opaque origins ("null") come from schemes with no host to bind to —
+    // there is nothing for a signature to be scoped by.
+    if (parsed.origin === 'null') {
+        throw new InvalidAuthChallengeError(`URL has no origin to bind a signature to: "${url}"`);
+    }
+    return parsed.origin;
+};
+/**
+ * Build the exact bytes a client signs and a server verifies.
+ *
+ * The origin is in the payload because the nonce alone doesn't scope a
+ * signature to a server: one that a client connects to can fetch a
+ * challenge from the client's real stack, pass that nonce along, and
+ * redeem the returned signature as a token. Signing the origin the client
+ * believes it is talking to makes such a signature verify nowhere else.
+ */
+export const buildAuthChallengePayload = (challenge) => {
+    const origin = authOriginFromUrl(challenge.origin);
+    if (!isValidDid(challenge.did)) {
+        throw new InvalidAuthChallengeError(`Not a valid DID: "${challenge.did}"`);
+    }
+    if (!NONCE_FORMAT.test(challenge.nonce)) {
+        throw new InvalidAuthChallengeError('Nonce must be a non-empty string of unreserved base64url characters.');
+    }
+    return new TextEncoder().encode(`${AUTH_PAYLOAD_LABEL}\n${origin}\n${challenge.did}\n${challenge.nonce}`);
+};
+// -------------------------------------------------------
+// Sign / verify
+// -------------------------------------------------------
+/** Sign a challenge with the private key behind its DID. */
+export const signAuthChallenge = async (privateKey, challenge) => signWithDid(privateKey, buildAuthChallengePayload(challenge));
+/**
+ * Verify a challenge signature. Answers only "this signature was made by
+ * the key behind this DID, for this origin and nonce" — whether the nonce
+ * was ever issued, is unexpired, and has not already been spent is the
+ * server's to track, and all three matter.
+ */
+export const verifyAuthChallenge = async (challenge, signature) => {
+    const payload = buildAuthChallengePayload(challenge);
+    try {
+        return await verifyDidSignature(challenge.did, signature, payload);
+    }
+    catch {
+        // A DID whose key can't be decoded verifies nothing — a false answer,
+        // not an exceptional one, since the caller asked whether it verifies.
+        return false;
+    }
+};
+/**
+ * Build a credential from a keypair, for callers holding key material in
+ * process and wanting no ceremony. Anything else implements DidCredential
+ * directly.
+ */
+export const didCredentialFromKeypair = (keypair) => ({
+    did: keypair.did,
+    sign: (payload) => signWithDid(keypair.privateKey, payload),
+});
+// -------------------------------------------------------
+// base64url — how a signature travels in JSON
+// -------------------------------------------------------
+export const base64urlEncode = (bytes) => {
+    let binary = '';
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+};
+export const base64urlDecode = (encoded) => {
+    if (!NONCE_FORMAT.test(encoded)) {
+        throw new InvalidAuthChallengeError('Not valid base64url.');
+    }
+    const padded = encoded.replace(/-/g, '+').replace(/_/g, '/');
+    let binary;
+    try {
+        binary = atob(padded);
+    }
+    catch {
+        throw new InvalidAuthChallengeError('Not valid base64url.');
+    }
+    return Uint8Array.from(binary, (char) => char.charCodeAt(0));
+};
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,kBAAkB,EAAmB,MAAM,UAAU,CAAC;AAExF,0DAA0D;AAC1D,SAAS;AACT,0DAA0D;AAE1D;;;;;;GAMG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD,YAAY,OAAO,GAAG,EAAE;QACtB,KAAK,CAAC,OAAO,IAAI,mCAAmC,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED,0DAA0D;AAC1D,qBAAqB;AACrB,0DAA0D;AAE1D;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAEvD;;;;GAIG;AACH,MAAM,YAAY,GAAG,kBAAkB,CAAC;AAWxC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAW,EAAU,EAAE;IACvD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,yBAAyB,CAAC,qBAAqB,GAAG,GAAG,CAAC,CAAC;IACnE,CAAC;IACD,sEAAsE;IACtE,oDAAoD;IACpD,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC7B,MAAM,IAAI,yBAAyB,CAAC,8CAA8C,GAAG,GAAG,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,SAAwB,EAAc,EAAE;IAChF,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,yBAAyB,CAAC,qBAAqB,SAAS,CAAC,GAAG,GAAG,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,yBAAyB,CACjC,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAC7B,GAAG,kBAAkB,KAAK,MAAM,KAAK,SAAS,CAAC,GAAG,KAAK,SAAS,CAAC,KAAK,EAAE,CACzE,CAAC;AACJ,CAAC,CAAC;AAEF,0DAA0D;AAC1D,gBAAgB;AAChB,0DAA0D;AAE1D,4DAA4D;AAC5D,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EACpC,UAAqB,EACrB,SAAwB,EACH,EAAE,CAAC,WAAW,CAAC,UAAU,EAAE,yBAAyB,CAAC,SAAS,CAAC,CAAC,CAAC;AAExF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EACtC,SAAwB,EACxB,SAAqB,EACH,EAAE;IACpB,MAAM,OAAO,GAAG,yBAAyB,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,CAAC;QACH,OAAO,MAAM,kBAAkB,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,sEAAsE;QACtE,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAiBF;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,OAAmB,EAAiB,EAAE,CAAC,CAAC;IAC/E,GAAG,EAAE,OAAO,CAAC,GAAG;IAChB,IAAI,EAAE,CAAC,OAAmB,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC;CACxE,CAAC,CAAC;AAEH,0DAA0D;AAC1D,8CAA8C;AAC9C,0DAA0D;AAE1D,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAiB,EAAU,EAAE;IAC3D,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACjF,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAe,EAAc,EAAE;IAC7D,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,yBAAyB,CAAC,sBAAsB,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7D,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,yBAAyB,CAAC,sBAAsB,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC,CAAC"}

package/dist/combine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"combine.d.ts","sourceRoot":"","sources":["../src/combine.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAErF;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE;IACrC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,IAAI,EAAE,gBAAgB,CAAC;CACxB,GAAG,YAAY,CA0Cf"}
+{"version":3,"file":"combine.d.ts","sourceRoot":"","sources":["../src/combine.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAErF;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE;IACrC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,IAAI,EAAE,gBAAgB,CAAC;CACxB,GAAG,YAAY,CA8Df"}

package/dist/combine.js

@@ -18,20 +18,37 @@ export function combineAdapters(parts) {
         },
         createRecord: (r) => parts.record.createRecord(r),
         getRecord: (id) => parts.record.getRecord(id),
-        updateRecord: (id, changes) => parts.record.updateRecord(id, changes),
+        patchContent: (id, patch, opts) => parts.record.patchContent(id, patch, opts),
         deleteRecord: (id, opts) => parts.record.deleteRecord(id, opts),
+        undeleteRecord: (id, opts) => parts.record.undeleteRecord(id, opts),
         queryRecords: (q) => parts.record.queryRecords(q),
-        associate: (id, assoc) => parts.record.associate(id, assoc),
-        dissociate: (id, assoc) => parts.record.dissociate(id, assoc),
+        associate: (id, assoc, opts) => parts.record.associate(id, assoc, opts),
+        dissociate: (id, assoc, opts) => parts.record.dissociate(id, assoc, opts),
+        setPermissions: (id, permissions, opts) => parts.record.setPermissions(id, permissions, opts),
         getVersions: (id) => parts.record.getVersions(id),
         getVersion: (id, v) => parts.record.getVersion(id, v),
         saveVersion: (id, v) => parts.record.saveVersion(id, v),
+        restoreVersion: (id, v, opts) => parts.record.restoreVersion(id, v, opts),
+        commitMigration: (id, toTypeId, content, opts) => parts.record.commitMigration(id, toTypeId, content, opts),
         saveType: (t) => parts.record.saveType(t),
         getType: (id) => parts.record.getType(id),
         listTypes: () => parts.record.listTypes(),
+        // Conditionally spread so an unimplemented optional capability stays
+        // absent on the combined adapter, rather than silently becoming
+        // "supported" via a wrapper that forwards to a missing method.
+        ...(parts.record.deleteUnreferencedAttachmentRecords && {
+            deleteUnreferencedAttachmentRecords: (fileId, metadataTypeId) => parts.record.deleteUnreferencedAttachmentRecords(fileId, metadataTypeId),
+        }),
+        // StackAdapter.putAttachmentWithMetadata is deliberately never
+        // synthesized here: glued backends have no shared transaction to honor
+        // its atomicity promise (docs/spec/adapters.md § Interface split).
+        // Stack.putAttachment() falls back to bytes-then-create().
         putAttachment: (data) => parts.blob.putAttachment(data),
         getAttachment: (id) => parts.blob.getAttachment(id),
         deleteAttachment: (id) => parts.blob.deleteAttachment(id),
+        ...(parts.blob.listFiles && {
+            listFiles: () => parts.blob.listFiles(),
+        }),
         async flush() {
             await parts.record.flush?.();
             await parts.blob.flush?.();

package/dist/combine.js.map

@@ -1 +1 @@
-{"version":3,"file":"combine.js","sourceRoot":"","sources":["../src/combine.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,KAG/B;IACC,OAAO;QACL,IAAI,YAAY;YACd,OAAO,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC;QACnC,CAAC;QACD,IAAI,aAAa;YACf,OAAO,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC;QACpC,CAAC;QACD,IAAI,QAAQ;YACV,OAAO,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC/B,CAAC;QAED,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;QACjD,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7C,YAAY,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC;QACrE,YAAY,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC;QAC/D,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;QAEjD,SAAS,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC;QAC3D,UAAU,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC;QAE7D,WAAW,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QACjD,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QACrD,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC;QAEvD,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QACzC,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE;QAEzC,aAAa,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;QACvD,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QACnD,gBAAgB,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAEzD,KAAK,CAAC,KAAK;YACT,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;YAC7B,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;QAC7B,CAAC;QACD,KAAK,CAAC,KAAK;YACT,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;YAC7B,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;QAC7B,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"combine.js","sourceRoot":"","sources":["../src/combine.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,KAG/B;IACC,OAAO;QACL,IAAI,YAAY;YACd,OAAO,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC;QACnC,CAAC;QACD,IAAI,aAAa;YACf,OAAO,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC;QACpC,CAAC;QACD,IAAI,QAAQ;YACV,OAAO,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC/B,CAAC;QAED,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;QACjD,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7C,YAAY,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC;QAC7E,YAAY,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC;QAC/D,cAAc,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,EAAE,IAAI,CAAC;QACnE,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;QAEjD,SAAS,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC;QACvE,UAAU,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC;QACzE,cAAc,EAAE,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC;QAE7F,WAAW,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QACjD,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QACrD,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC;QACvD,cAAc,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC;QACzE,eAAe,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAC/C,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC;QAE3D,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QACzC,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE;QAEzC,qEAAqE;QACrE,gEAAgE;QAChE,+DAA+D;QAC/D,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,mCAAmC,IAAI;YACtD,mCAAmC,EAAE,CAAC,MAAc,EAAE,cAAsB,EAAE,EAAE,CAC9E,KAAK,CAAC,MAAM,CAAC,mCAAoC,CAAC,MAAM,EAAE,cAAc,CAAC;SAC5E,CAAC;QAEF,+DAA+D;QAC/D,uEAAuE;QACvE,mEAAmE;QACnE,2DAA2D;QAC3D,aAAa,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;QACvD,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QACnD,gBAAgB,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI;YAC1B,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAU,EAAE;SACzC,CAAC;QAEF,KAAK,CAAC,KAAK;YACT,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;YAC7B,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;QAC7B,CAAC;QACD,KAAK,CAAC,KAAK;YACT,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;YAC7B,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;QAC7B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/did-entry.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @haverstack/core/did
+ * -------------------------------------------------------
+ * Key generation, custody and signing for did:key — the mandatory-floor
+ * DID method (see docs/spec/identity.md). Audience: apps at first-run
+ * keygen and key custody, and protocol implementers verifying signatures.
+ */
+export { InvalidDidError, generateDidKeypair, verifyDidSignature } from './did.js';
+export type { DidKeypair } from './did.js';
+export { isValidDid } from './did.js';
+export { signWithDid, exportDidPrivateKeyJwk, importDidPrivateKeyJwk } from './did.js';
+//# sourceMappingURL=did-entry.d.ts.map

package/dist/did-entry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"did-entry.d.ts","sourceRoot":"","sources":["../src/did-entry.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AACnF,YAAY,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAI3C,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAKtC,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC"}

package/dist/did-entry.js

@@ -0,0 +1,16 @@
+/**
+ * @haverstack/core/did
+ * -------------------------------------------------------
+ * Key generation, custody and signing for did:key — the mandatory-floor
+ * DID method (see docs/spec/identity.md). Audience: apps at first-run
+ * keygen and key custody, and protocol implementers verifying signatures.
+ */
+export { InvalidDidError, generateDidKeypair, verifyDidSignature } from './did.js';
+// No in-repo caller: haverstack/server#54 validates ENTITY_ID as a DID at
+// server startup.
+export { isValidDid } from './did.js';
+// No in-repo caller: root README.md § Key custody documents
+// exportDidPrivateKeyJwk() -> store -> importDidPrivateKeyJwk() ->
+// signWithDid() as the key-custody journey an app follows.
+export { signWithDid, exportDidPrivateKeyJwk, importDidPrivateKeyJwk } from './did.js';
+//# sourceMappingURL=did-entry.js.map

package/dist/did-entry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"did-entry.js","sourceRoot":"","sources":["../src/did-entry.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAGnF,0EAA0E;AAC1E,kBAAkB;AAClB,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAEtC,4DAA4D;AAC5D,mEAAmE;AACnE,2DAA2D;AAC3D,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC"}

package/dist/did.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Stack — Decentralized Identifiers
+ * -------------------------------------------------------
+ * entityId values are DID strings (see docs/spec/identity.md). did:key —
+ * an Ed25519 public key, multicodec + multibase(base58btc) encoded — is the
+ * mandatory floor: zero infrastructure, zero resolution, verifiable by
+ * anyone from the string alone. Other methods (did:web, did:plc, ...) are
+ * valid entityId values too, but this module only knows how to mint and
+ * verify did:key.
+ *
+ * Uses Web Crypto (crypto.subtle) exclusively — no dependency, works in
+ * Node (>=22.5, matching the rest of core's floor), browsers, and Deno.
+ */
+export declare class InvalidDidError extends Error {
+    constructor(message?: string);
+}
+export type DidKeypair = {
+    /** e.g. "did:key:z6Mk..." */
+    did: string;
+    publicKey: CryptoKey;
+    privateKey: CryptoKey;
+};
+/** Generate a fresh Ed25519 keypair and derive its did:key. */
+export declare const generateDidKeypair: () => Promise<DidKeypair>;
+/** Derive a did:key string from an Ed25519 CryptoKey. */
+export declare const didFromPublicKey: (publicKey: CryptoKey) => Promise<string>;
+/**
+ * Parse a did:key string and return its raw Ed25519 public key bytes, or
+ * null if it isn't a well-formed Ed25519 did:key (wrong prefix, bad base58,
+ * wrong multicodec, wrong length).
+ */
+export declare const parseDidKey: (did: string) => Uint8Array | null;
+/** Whether a string is a well-formed Ed25519 did:key. */
+export declare const isValidDidKey: (value: string) => boolean;
+/** Import the Ed25519 public key encoded in a did:key, for verification. */
+export declare const publicKeyFromDidKey: (did: string) => Promise<CryptoKey>;
+/**
+ * Whether a string has the generic W3C DID Core syntax (did:<method>:<id>)
+ * — any method, not just did:key. Use isValidDidKey() to additionally
+ * require the did:key method and a well-formed Ed25519 key.
+ */
+export declare const isValidDid: (value: string) => boolean;
+export declare const signWithDid: (privateKey: CryptoKey, data: Uint8Array) => Promise<Uint8Array>;
+/**
+ * Verify a signature was produced by the private key behind a did:key.
+ * Requires no lookup — the public key is decoded from the DID itself.
+ */
+export declare const verifyDidSignature: (did: string, signature: Uint8Array, data: Uint8Array) => Promise<boolean>;
+export declare const exportDidPrivateKeyJwk: (privateKey: CryptoKey) => Promise<JsonWebKey>;
+export declare const importDidPrivateKeyJwk: (jwk: JsonWebKey) => Promise<CryptoKey>;
+//# sourceMappingURL=did.d.ts.map

package/dist/did.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"did.d.ts","sourceRoot":"","sources":["../src/did.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,OAAO,SAAK;CAIzB;AA4DD,MAAM,MAAM,UAAU,GAAG;IACvB,6BAA6B;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,SAAS,CAAC;IACrB,UAAU,EAAE,SAAS,CAAC;CACvB,CAAC;AAEF,+DAA+D;AAC/D,eAAO,MAAM,kBAAkB,QAAa,OAAO,CAAC,UAAU,CAM7D,CAAC;AAEF,yDAAyD;AACzD,eAAO,MAAM,gBAAgB,GAAU,WAAW,SAAS,KAAG,OAAO,CAAC,MAAM,CAM3E,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,WAAW,GAAI,KAAK,MAAM,KAAG,UAAU,GAAG,IAoBtD,CAAC;AAEF,yDAAyD;AACzD,eAAO,MAAM,aAAa,GAAI,OAAO,MAAM,KAAG,OAAsC,CAAC;AAErF,4EAA4E;AAC5E,eAAO,MAAM,mBAAmB,GAAU,KAAK,MAAM,KAAG,OAAO,CAAC,SAAS,CAIxE,CAAC;AASF;;;;GAIG;AACH,eAAO,MAAM,UAAU,GAAI,OAAO,MAAM,KAAG,OAAyC,CAAC;AAMrF,eAAO,MAAM,WAAW,GAAU,YAAY,SAAS,EAAE,MAAM,UAAU,KAAG,OAAO,CAAC,UAAU,CACP,CAAC;AAExF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,GAC7B,KAAK,MAAM,EACX,WAAW,UAAU,EACrB,MAAM,UAAU,KACf,OAAO,CAAC,OAAO,CAQjB,CAAC;AAWF,eAAO,MAAM,sBAAsB,GAAU,YAAY,SAAS,KAAG,OAAO,CAAC,UAAU,CAC3C,CAAC;AAE7C,eAAO,MAAM,sBAAsB,GAAU,KAAK,UAAU,KAAG,OAAO,CAAC,SAAS,CAChB,CAAC"}

package/dist/did.js

@@ -0,0 +1,153 @@
+/**
+ * Stack — Decentralized Identifiers
+ * -------------------------------------------------------
+ * entityId values are DID strings (see docs/spec/identity.md). did:key —
+ * an Ed25519 public key, multicodec + multibase(base58btc) encoded — is the
+ * mandatory floor: zero infrastructure, zero resolution, verifiable by
+ * anyone from the string alone. Other methods (did:web, did:plc, ...) are
+ * valid entityId values too, but this module only knows how to mint and
+ * verify did:key.
+ *
+ * Uses Web Crypto (crypto.subtle) exclusively — no dependency, works in
+ * Node (>=22.5, matching the rest of core's floor), browsers, and Deno.
+ */
+// -------------------------------------------------------
+// Errors
+// -------------------------------------------------------
+export class InvalidDidError extends Error {
+    constructor(message = '') {
+        super(message || 'Invalid DID.');
+        this.name = 'InvalidDidError';
+    }
+}
+// -------------------------------------------------------
+// base58btc (Bitcoin alphabet) — no leading-zero-safe library dependency
+// -------------------------------------------------------
+const BASE58_ALPHABET = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
+const base58btcEncode = (bytes) => {
+    let value = 0n;
+    for (const byte of bytes)
+        value = (value << 8n) | BigInt(byte);
+    let out = '';
+    while (value > 0n) {
+        const remainder = value % 58n;
+        value /= 58n;
+        out = BASE58_ALPHABET[Number(remainder)] + out;
+    }
+    for (const byte of bytes) {
+        if (byte !== 0)
+            break;
+        out = '1' + out;
+    }
+    return out;
+};
+const base58btcDecode = (encoded) => {
+    let value = 0n;
+    for (const char of encoded) {
+        const digit = BASE58_ALPHABET.indexOf(char);
+        if (digit === -1) {
+            throw new InvalidDidError(`Invalid base58 character: "${char}"`);
+        }
+        value = value * 58n + BigInt(digit);
+    }
+    const bytes = [];
+    while (value > 0n) {
+        bytes.unshift(Number(value & 0xffn));
+        value >>= 8n;
+    }
+    for (const char of encoded) {
+        if (char !== '1')
+            break;
+        bytes.unshift(0);
+    }
+    return new Uint8Array(bytes);
+};
+// -------------------------------------------------------
+// did:key (Ed25519)
+// -------------------------------------------------------
+/** Multicodec varint prefix for "ed25519-pub" (code 0xed). */
+const ED25519_MULTICODEC_PREFIX = new Uint8Array([0xed, 0x01]);
+const ED25519_RAW_KEY_LENGTH = 32;
+const DID_KEY_PREFIX = 'did:key:z';
+/** Generate a fresh Ed25519 keypair and derive its did:key. */
+export const generateDidKeypair = async () => {
+    const { publicKey, privateKey } = (await crypto.subtle.generateKey('Ed25519', true, [
+        'sign',
+        'verify',
+    ]));
+    return { did: await didFromPublicKey(publicKey), publicKey, privateKey };
+};
+/** Derive a did:key string from an Ed25519 CryptoKey. */
+export const didFromPublicKey = async (publicKey) => {
+    const raw = new Uint8Array(await crypto.subtle.exportKey('raw', publicKey));
+    const prefixed = new Uint8Array(ED25519_MULTICODEC_PREFIX.length + raw.length);
+    prefixed.set(ED25519_MULTICODEC_PREFIX, 0);
+    prefixed.set(raw, ED25519_MULTICODEC_PREFIX.length);
+    return DID_KEY_PREFIX + base58btcEncode(prefixed);
+};
+/**
+ * Parse a did:key string and return its raw Ed25519 public key bytes, or
+ * null if it isn't a well-formed Ed25519 did:key (wrong prefix, bad base58,
+ * wrong multicodec, wrong length).
+ */
+export const parseDidKey = (did) => {
+    if (!did.startsWith(DID_KEY_PREFIX))
+        return null;
+    let decoded;
+    try {
+        decoded = base58btcDecode(did.slice(DID_KEY_PREFIX.length));
+    }
+    catch {
+        return null;
+    }
+    const expectedLength = ED25519_MULTICODEC_PREFIX.length + ED25519_RAW_KEY_LENGTH;
+    if (decoded.length !== expectedLength ||
+        decoded[0] !== ED25519_MULTICODEC_PREFIX[0] ||
+        decoded[1] !== ED25519_MULTICODEC_PREFIX[1]) {
+        return null;
+    }
+    return decoded.slice(ED25519_MULTICODEC_PREFIX.length);
+};
+/** Whether a string is a well-formed Ed25519 did:key. */
+export const isValidDidKey = (value) => parseDidKey(value) !== null;
+/** Import the Ed25519 public key encoded in a did:key, for verification. */
+export const publicKeyFromDidKey = async (did) => {
+    const raw = parseDidKey(did);
+    if (!raw)
+        throw new InvalidDidError(`Not a valid did:key: "${did}"`);
+    return crypto.subtle.importKey('raw', new Uint8Array(raw), 'Ed25519', true, ['verify']);
+};
+// -------------------------------------------------------
+// Generic DID syntax (any method)
+// -------------------------------------------------------
+// did-core ABNF, simplified: "did:" method-name ":" method-specific-id
+const GENERIC_DID_FORMAT = /^did:[a-z0-9]+:[A-Za-z0-9._:%-]+$/;
+/**
+ * Whether a string has the generic W3C DID Core syntax (did:<method>:<id>)
+ * — any method, not just did:key. Use isValidDidKey() to additionally
+ * require the did:key method and a well-formed Ed25519 key.
+ */
+export const isValidDid = (value) => GENERIC_DID_FORMAT.test(value);
+// -------------------------------------------------------
+// Sign / verify
+// -------------------------------------------------------
+export const signWithDid = async (privateKey, data) => new Uint8Array(await crypto.subtle.sign('Ed25519', privateKey, new Uint8Array(data)));
+/**
+ * Verify a signature was produced by the private key behind a did:key.
+ * Requires no lookup — the public key is decoded from the DID itself.
+ */
+export const verifyDidSignature = async (did, signature, data) => {
+    const publicKey = await publicKeyFromDidKey(did);
+    return crypto.subtle.verify('Ed25519', publicKey, new Uint8Array(signature), new Uint8Array(data));
+};
+// -------------------------------------------------------
+// Private-key export/import
+// -------------------------------------------------------
+//
+// Core never stores a private key itself — these exist so callers can
+// persist the key material returned by generateDidKeypair() (encrypted key
+// backup, OS keychain, etc.) and reconstruct it on a later run. Where that
+// key lives is an app/UX concern, not this library's.
+export const exportDidPrivateKeyJwk = async (privateKey) => crypto.subtle.exportKey('jwk', privateKey);
+export const importDidPrivateKeyJwk = async (jwk) => crypto.subtle.importKey('jwk', jwk, 'Ed25519', true, ['sign']);
+//# sourceMappingURL=did.js.map

package/dist/did.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"did.js","sourceRoot":"","sources":["../src/did.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,0DAA0D;AAC1D,SAAS;AACT,0DAA0D;AAE1D,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAO,GAAG,EAAE;QACtB,KAAK,CAAC,OAAO,IAAI,cAAc,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,0DAA0D;AAC1D,yEAAyE;AACzE,0DAA0D;AAE1D,MAAM,eAAe,GAAG,4DAA4D,CAAC;AAErF,MAAM,eAAe,GAAG,CAAC,KAAiB,EAAU,EAAE;IACpD,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAE/D,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,OAAO,KAAK,GAAG,EAAE,EAAE,CAAC;QAClB,MAAM,SAAS,GAAG,KAAK,GAAG,GAAG,CAAC;QAC9B,KAAK,IAAI,GAAG,CAAC;QACb,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,GAAG,CAAC;IACjD,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,KAAK,CAAC;YAAE,MAAM;QACtB,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IAClB,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,OAAe,EAAc,EAAE;IACtD,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,eAAe,CAAC,8BAA8B,IAAI,GAAG,CAAC,CAAC;QACnE,CAAC;QACD,KAAK,GAAG,KAAK,GAAG,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,OAAO,KAAK,GAAG,EAAE,EAAE,CAAC;QAClB,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC;QACrC,KAAK,KAAK,EAAE,CAAC;IACf,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,IAAI,KAAK,GAAG;YAAE,MAAM;QACxB,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IAED,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC,CAAC;AAEF,0DAA0D;AAC1D,oBAAoB;AACpB,0DAA0D;AAE1D,8DAA8D;AAC9D,MAAM,yBAAyB,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAC/D,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC,MAAM,cAAc,GAAG,WAAW,CAAC;AASnC,+DAA+D;AAC/D,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,IAAyB,EAAE;IAChE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,IAAI,EAAE;QAClF,MAAM;QACN,QAAQ;KACT,CAAC,CAAkB,CAAC;IACrB,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AAC3E,CAAC,CAAC;AAEF,yDAAyD;AACzD,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EAAE,SAAoB,EAAmB,EAAE;IAC9E,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,yBAAyB,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/E,QAAQ,CAAC,GAAG,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC;IAC3C,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,yBAAyB,CAAC,MAAM,CAAC,CAAC;IACpD,OAAO,cAAc,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;AACpD,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,GAAW,EAAqB,EAAE;IAC5D,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC;QAAE,OAAO,IAAI,CAAC;IAEjD,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,cAAc,GAAG,yBAAyB,CAAC,MAAM,GAAG,sBAAsB,CAAC;IACjF,IACE,OAAO,CAAC,MAAM,KAAK,cAAc;QACjC,OAAO,CAAC,CAAC,CAAC,KAAK,yBAAyB,CAAC,CAAC,CAAC;QAC3C,OAAO,CAAC,CAAC,CAAC,KAAK,yBAAyB,CAAC,CAAC,CAAC,EAC3C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC;AACzD,CAAC,CAAC;AAEF,yDAAyD;AACzD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;AAErF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EAAE,GAAW,EAAsB,EAAE;IAC3E,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,eAAe,CAAC,yBAAyB,GAAG,GAAG,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC1F,CAAC,CAAC;AAEF,0DAA0D;AAC1D,kCAAkC;AAClC,0DAA0D;AAE1D,uEAAuE;AACvE,MAAM,kBAAkB,GAAG,mCAAmC,CAAC;AAE/D;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAErF,0DAA0D;AAC1D,gBAAgB;AAChB,0DAA0D;AAE1D,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAE,UAAqB,EAAE,IAAgB,EAAuB,EAAE,CAChG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAExF;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,GAAW,EACX,SAAqB,EACrB,IAAgB,EACE,EAAE;IACpB,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACjD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CACzB,SAAS,EACT,SAAS,EACT,IAAI,UAAU,CAAC,SAAS,CAAC,EACzB,IAAI,UAAU,CAAC,IAAI,CAAC,CACrB,CAAC;AACJ,CAAC,CAAC;AAEF,0DAA0D;AAC1D,4BAA4B;AAC5B,0DAA0D;AAC1D,EAAE;AACF,sEAAsE;AACtE,2EAA2E;AAC3E,2EAA2E;AAC3E,sDAAsD;AAEtD,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,EAAE,UAAqB,EAAuB,EAAE,CACzF,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;AAE7C,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,EAAE,GAAe,EAAsB,EAAE,CAClF,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC"}

package/dist/id.d.ts

@@ -22,15 +22,27 @@ export declare const crockford32Encode: (n: number) => string;
 export declare const crockford32Decode: (s: string) => number;
 export declare const _setLastNowId: (chars: string) => void;
 export declare const _setLastRandChars: (chars: string) => void;
+export declare const _setLastTimestamp: (timestamp: number) => void;
+/** Resets all module-level generator state. For test isolation only. */
+export declare const _resetIdState: () => void;
 /**
- * Generate a new Stack record ID.
- *
- * IDs are time-sortable: lexicographic order matches creation order.
- * Same-millisecond IDs are monotonically incremented to preserve order
- * and avoid collisions. Throws IdGenerationOverflowError if more than
- * BASE^RAND_SUFFIX_LENGTH (32^3 = 32,768) IDs are generated in one millisecond.
+ * Generate a new Stack record ID. Time-sortable: lexicographic order
+ * matches creation order, with same-millisecond IDs monotonically
+ * incremented. Throws IdGenerationOverflowError past 32^3 IDs in one
+ * millisecond.
  *
  * @param timestamp - Override the timestamp (ms since epoch). Defaults to Date.now().
  */
 export declare const generateId: (timestamp?: number) => string;
+/**
+ * Check whether a string has the shape of a Stack record ID: exactly
+ * 12 lowercase Crockford base-32 characters. Does not check whether the
+ * ID actually exists — see Stack.create()'s duplicate check for that.
+ */
+export declare const isValidIdFormat: (id: string) => boolean;
+/**
+ * Extract the timestamp (ms since epoch) encoded in an ID's prefix.
+ * Only meaningful for IDs that pass isValidIdFormat().
+ */
+export declare const idTimestamp: (id: string) => number;
 //# sourceMappingURL=id.d.ts.map

package/dist/id.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"id.d.ts","sourceRoot":"","sources":["../src/id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,eAAO,MAAM,IAAI,QAAoB,CAAC;AAGtC,eAAO,MAAM,kBAAkB,IAAI,CAAC;AAUpC,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,OAAO,SAAK;CAIzB;AAED,qBAAa,yBAA0B,SAAQ,iBAAiB;gBAClD,OAAO,SAAK;CAIzB;AAMD,eAAO,MAAM,iBAAiB,GAAI,GAAG,MAAM,KAAG,MAiB7C,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,GAAG,MAAM,KAAG,MAe7C,CAAC;AAoCF,eAAO,MAAM,aAAa,GAAI,OAAO,MAAM,KAAG,IAK7C,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,OAAO,MAAM,KAAG,IAKjD,CAAC;AAMF;;;;;;;;;GASG;AACH,eAAO,MAAM,UAAU,GAAI,YAAW,MAAmB,KAAG,MAQ3D,CAAC"}
+{"version":3,"file":"id.d.ts","sourceRoot":"","sources":["../src/id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,eAAO,MAAM,IAAI,QAAoB,CAAC;AAGtC,eAAO,MAAM,kBAAkB,IAAI,CAAC;AAcpC,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,OAAO,SAAK;CAIzB;AAED,qBAAa,yBAA0B,SAAQ,iBAAiB;gBAClD,OAAO,SAAK;CAIzB;AAMD,eAAO,MAAM,iBAAiB,GAAI,GAAG,MAAM,KAAG,MAiB7C,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,GAAG,MAAM,KAAG,MAe7C,CAAC;AAoCF,eAAO,MAAM,aAAa,GAAI,OAAO,MAAM,KAAG,IAK7C,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,OAAO,MAAM,KAAG,IAKjD,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,WAAW,MAAM,KAAG,IAErD,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,aAAa,QAAO,IAIhC,CAAC;AAMF;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,GAAI,YAAW,MAAmB,KAAG,MAU3D,CAAC;AASF;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAAI,IAAI,MAAM,KAAG,OAA6B,CAAC;AAE3E;;;GAGG;AACH,eAAO,MAAM,WAAW,GAAI,IAAI,MAAM,KAAG,MACa,CAAC"}

package/dist/id.js

@@ -17,6 +17,10 @@ export const RAND_SUFFIX_LENGTH = 3;
 // Module-level state for monotonicity within the same millisecond
 let lastNowId = '';
 let lastRandChars = '';
+// Tracks the highest timestamp an ID has been minted for, so a backward
+// clock step (NTP correction, suspend/resume) can't produce an ID that
+// sorts before ones already generated in this process.
+let lastTimestamp = 0;
 // -------------------------------------------------------
 // Errors
 // -------------------------------------------------------
@@ -74,15 +78,15 @@ const pad = (chars, length) => chars.padStart(length, CHARACTERS[0]);
  * Works in Node (>=19), browsers, Deno, and Bun.
  */
 const generateRandChars = () => {
-    const max = Math.pow(BASE, RAND_SUFFIX_LENGTH) - 1;
+    const modulus = Math.pow(BASE, RAND_SUFFIX_LENGTH);
     const arr = new Uint32Array(1);
     // Rejection sampling to avoid modulo bias
     let value;
     do {
         crypto.getRandomValues(arr);
         value = arr[0];
-    } while (value > Math.floor(0xffffffff / max) * max);
-    return pad(crockford32Encode(value % max), RAND_SUFFIX_LENGTH);
+    } while (value > Math.floor(0xffffffff / modulus) * modulus);
+    return pad(crockford32Encode(value % modulus), RAND_SUFFIX_LENGTH);
 };
 const incrementRandChars = (randChars) => {
     const next = crockford32Encode(crockford32Decode(randChars) + 1);
@@ -106,24 +110,49 @@ export const _setLastRandChars = (chars) => {
     }
     lastRandChars = chars;
 };
+export const _setLastTimestamp = (timestamp) => {
+    lastTimestamp = timestamp;
+};
+/** Resets all module-level generator state. For test isolation only. */
+export const _resetIdState = () => {
+    lastNowId = '';
+    lastRandChars = '';
+    lastTimestamp = 0;
+};
 // -------------------------------------------------------
 // Public API
 // -------------------------------------------------------
 /**
- * Generate a new Stack record ID.
- *
- * IDs are time-sortable: lexicographic order matches creation order.
- * Same-millisecond IDs are monotonically incremented to preserve order
- * and avoid collisions. Throws IdGenerationOverflowError if more than
- * BASE^RAND_SUFFIX_LENGTH (32^3 = 32,768) IDs are generated in one millisecond.
+ * Generate a new Stack record ID. Time-sortable: lexicographic order
+ * matches creation order, with same-millisecond IDs monotonically
+ * incremented. Throws IdGenerationOverflowError past 32^3 IDs in one
+ * millisecond.
  *
  * @param timestamp - Override the timestamp (ms since epoch). Defaults to Date.now().
  */
 export const generateId = (timestamp = Date.now()) => {
-    const nowId = pad(crockford32Encode(timestamp), MIN_TIMESTAMP_LENGTH);
+    const effectiveTimestamp = Math.max(timestamp, lastTimestamp);
+    const nowId = pad(crockford32Encode(effectiveTimestamp), MIN_TIMESTAMP_LENGTH);
     const randChars = nowId !== lastNowId ? generateRandChars() : incrementRandChars(lastRandChars);
+    lastTimestamp = effectiveTimestamp;
     lastNowId = nowId;
     lastRandChars = randChars;
     return nowId + randChars;
 };
+// -------------------------------------------------------
+// Format validation
+// -------------------------------------------------------
+const ID_LENGTH = MIN_TIMESTAMP_LENGTH + RAND_SUFFIX_LENGTH;
+const ID_FORMAT = new RegExp(`^[${CHARACTERS}]{${ID_LENGTH}}$`);
+/**
+ * Check whether a string has the shape of a Stack record ID: exactly
+ * 12 lowercase Crockford base-32 characters. Does not check whether the
+ * ID actually exists — see Stack.create()'s duplicate check for that.
+ */
+export const isValidIdFormat = (id) => ID_FORMAT.test(id);
+/**
+ * Extract the timestamp (ms since epoch) encoded in an ID's prefix.
+ * Only meaningful for IDs that pass isValidIdFormat().
+ */
+export const idTimestamp = (id) => crockford32Decode(id.slice(0, MIN_TIMESTAMP_LENGTH));
 //# sourceMappingURL=id.js.map

package/dist/id.js.map

@@ -1 +1 @@
-{"version":3,"file":"id.js","sourceRoot":"","sources":["../src/id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,UAAU,GAAG,kCAAkC,CAAC;AAEtD,MAAM,CAAC,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC;AAEtC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAC/B,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAEpC,kEAAkE;AAClE,IAAI,SAAS,GAAG,EAAE,CAAC;AACnB,IAAI,aAAa,GAAG,EAAE,CAAC;AAEvB,0DAA0D;AAC1D,SAAS;AACT,0DAA0D;AAE1D,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,OAAO,GAAG,EAAE;QACtB,KAAK,CAAC,OAAO,IAAI,+BAA+B,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,MAAM,OAAO,yBAA0B,SAAQ,iBAAiB;IAC9D,YAAY,OAAO,GAAG,EAAE;QACtB,KAAK,CAAC,OAAO,IAAI,2DAA2D,CAAC,CAAC;QAC9E,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED,0DAA0D;AAC1D,sBAAsB;AACtB,0DAA0D;AAE1D,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAS,EAAU,EAAE;IACrD,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACV,MAAM,IAAI,UAAU,CAAC,mCAAmC,CAAC,CAAC;IAC5D,CAAC;IAED,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAElB,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACZ,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IAED,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,GAAG,UAAU,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC;QACvC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAS,EAAU,EAAE;IACrD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,UAAU,CAAC,2BAA2B,CAAC,CAAC;IACpD,CAAC;IAED,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IACpB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACpD,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YACZ,MAAM,IAAI,UAAU,CAAC,mCAAmC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;QAClF,CAAC;QACD,CAAC,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AAEF,0DAA0D;AAC1D,mBAAmB;AACnB,0DAA0D;AAE1D,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,MAAc,EAAU,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAE7F;;;GAGG;AACH,MAAM,iBAAiB,GAAG,GAAW,EAAE;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC;IAC/B,0CAA0C;IAC1C,IAAI,KAAa,CAAC;IAClB,GAAG,CAAC;QACF,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAC5B,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC,QAAQ,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC,GAAG,GAAG,EAAE;IACrD,OAAO,GAAG,CAAC,iBAAiB,CAAC,KAAK,GAAG,GAAG,CAAC,EAAE,kBAAkB,CAAC,CAAC;AACjE,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,CAAC,SAAiB,EAAU,EAAE;IACvD,MAAM,IAAI,GAAG,iBAAiB,CAAC,iBAAiB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACjE,IAAI,IAAI,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;QACrC,MAAM,IAAI,yBAAyB,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;AACvC,CAAC,CAAC;AAEF,0DAA0D;AAC1D,+BAA+B;AAC/B,0DAA0D;AAE1D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAa,EAAQ,EAAE;IACnD,IAAI,KAAK,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;QACxC,MAAM,IAAI,UAAU,CAAC,gCAAgC,oBAAoB,cAAc,CAAC,CAAC;IAC3F,CAAC;IACD,SAAS,GAAG,KAAK,CAAC;AACpB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAAa,EAAQ,EAAE;IACvD,IAAI,KAAK,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;QACxC,MAAM,IAAI,UAAU,CAAC,mCAAmC,kBAAkB,cAAc,CAAC,CAAC;IAC5F,CAAC;IACD,aAAa,GAAG,KAAK,CAAC;AACxB,CAAC,CAAC;AAEF,0DAA0D;AAC1D,aAAa;AACb,0DAA0D;AAE1D;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,YAAoB,IAAI,CAAC,GAAG,EAAE,EAAU,EAAE;IACnE,MAAM,KAAK,GAAG,GAAG,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,oBAAoB,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAEhG,SAAS,GAAG,KAAK,CAAC;IAClB,aAAa,GAAG,SAAS,CAAC;IAE1B,OAAO,KAAK,GAAG,SAAS,CAAC;AAC3B,CAAC,CAAC"}
+{"version":3,"file":"id.js","sourceRoot":"","sources":["../src/id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,UAAU,GAAG,kCAAkC,CAAC;AAEtD,MAAM,CAAC,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC;AAEtC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAC/B,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAEpC,kEAAkE;AAClE,IAAI,SAAS,GAAG,EAAE,CAAC;AACnB,IAAI,aAAa,GAAG,EAAE,CAAC;AACvB,wEAAwE;AACxE,uEAAuE;AACvE,uDAAuD;AACvD,IAAI,aAAa,GAAG,CAAC,CAAC;AAEtB,0DAA0D;AAC1D,SAAS;AACT,0DAA0D;AAE1D,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,OAAO,GAAG,EAAE;QACtB,KAAK,CAAC,OAAO,IAAI,+BAA+B,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,MAAM,OAAO,yBAA0B,SAAQ,iBAAiB;IAC9D,YAAY,OAAO,GAAG,EAAE;QACtB,KAAK,CAAC,OAAO,IAAI,2DAA2D,CAAC,CAAC;QAC9E,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED,0DAA0D;AAC1D,sBAAsB;AACtB,0DAA0D;AAE1D,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAS,EAAU,EAAE;IACrD,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACV,MAAM,IAAI,UAAU,CAAC,mCAAmC,CAAC,CAAC;IAC5D,CAAC;IAED,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAElB,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACZ,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IAED,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,GAAG,UAAU,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC;QACvC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAS,EAAU,EAAE;IACrD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,UAAU,CAAC,2BAA2B,CAAC,CAAC;IACpD,CAAC;IAED,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IACpB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACpD,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YACZ,MAAM,IAAI,UAAU,CAAC,mCAAmC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;QAClF,CAAC;QACD,CAAC,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AAEF,0DAA0D;AAC1D,mBAAmB;AACnB,0DAA0D;AAE1D,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,MAAc,EAAU,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAE7F;;;GAGG;AACH,MAAM,iBAAiB,GAAG,GAAW,EAAE;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC;IAC/B,0CAA0C;IAC1C,IAAI,KAAa,CAAC;IAClB,GAAG,CAAC;QACF,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAC5B,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC,QAAQ,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,OAAO,CAAC,GAAG,OAAO,EAAE;IAC7D,OAAO,GAAG,CAAC,iBAAiB,CAAC,KAAK,GAAG,OAAO,CAAC,EAAE,kBAAkB,CAAC,CAAC;AACrE,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,CAAC,SAAiB,EAAU,EAAE;IACvD,MAAM,IAAI,GAAG,iBAAiB,CAAC,iBAAiB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACjE,IAAI,IAAI,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;QACrC,MAAM,IAAI,yBAAyB,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;AACvC,CAAC,CAAC;AAEF,0DAA0D;AAC1D,+BAA+B;AAC/B,0DAA0D;AAE1D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAa,EAAQ,EAAE;IACnD,IAAI,KAAK,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;QACxC,MAAM,IAAI,UAAU,CAAC,gCAAgC,oBAAoB,cAAc,CAAC,CAAC;IAC3F,CAAC;IACD,SAAS,GAAG,KAAK,CAAC;AACpB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAAa,EAAQ,EAAE;IACvD,IAAI,KAAK,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;QACxC,MAAM,IAAI,UAAU,CAAC,mCAAmC,kBAAkB,cAAc,CAAC,CAAC;IAC5F,CAAC;IACD,aAAa,GAAG,KAAK,CAAC;AACxB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,SAAiB,EAAQ,EAAE;IAC3D,aAAa,GAAG,SAAS,CAAC;AAC5B,CAAC,CAAC;AAEF,wEAAwE;AACxE,MAAM,CAAC,MAAM,aAAa,GAAG,GAAS,EAAE;IACtC,SAAS,GAAG,EAAE,CAAC;IACf,aAAa,GAAG,EAAE,CAAC;IACnB,aAAa,GAAG,CAAC,CAAC;AACpB,CAAC,CAAC;AAEF,0DAA0D;AAC1D,aAAa;AACb,0DAA0D;AAE1D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,YAAoB,IAAI,CAAC,GAAG,EAAE,EAAU,EAAE;IACnE,MAAM,kBAAkB,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,GAAG,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAC/E,MAAM,SAAS,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAEhG,aAAa,GAAG,kBAAkB,CAAC;IACnC,SAAS,GAAG,KAAK,CAAC;IAClB,aAAa,GAAG,SAAS,CAAC;IAE1B,OAAO,KAAK,GAAG,SAAS,CAAC;AAC3B,CAAC,CAAC;AAEF,0DAA0D;AAC1D,oBAAoB;AACpB,0DAA0D;AAE1D,MAAM,SAAS,GAAG,oBAAoB,GAAG,kBAAkB,CAAC;AAC5D,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,KAAK,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC;AAEhE;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,EAAU,EAAW,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAE3E;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,EAAU,EAAU,EAAE,CAChD,iBAAiB,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC,CAAC"}