@hexpro/qr-code-studio 0.0.0-stage → 0.1.0

package/dist/payload/types.d.ts

@@ -0,0 +1,138 @@
+/**
+ * The public shape of a content type, as docs/CONTRACTS.md (`payload`) gives it.
+ *
+ * Three additions to the contract, all listed in the branch report, and two
+ * fields made optional:
+ *
+ * - `FieldSchema.multiple` and `maxItems`. A contact card has several phone
+ *   numbers and an email has several recipients, and `FieldValue` already
+ *   allows `readonly string[]`, but nothing in the schema said which fields
+ *   hold one. A field with `multiple: true` holds a `readonly string[]` whose
+ *   every item is checked as `kind`.
+ * - `PayloadType.generate`. A Saudi e-invoice code can be read and explained
+ *   but not made honestly here: phase 2 codes carry a signature over the
+ *   invoice made with the seller's own certificate. `generate: false` tells a
+ *   view to offer the type in the inspector only. Absent means true.
+ * - The safety code 'payload/service-code', for a tel: link that dials a
+ *   star or hash code (call forwarding, settings), which the contract's
+ *   union had no code for.
+ * - `PayloadType.vectors` and `CompatibilityNote.source` are optional. Both
+ *   are evidence for the people maintaining a type rather than anything a
+ *   view needs, and carried on the runtime objects they put tens of
+ *   kilobytes of test data and dozens of document addresses into every
+ *   bundle that offers a content type. The built-in types carry neither:
+ *   their vectors are `BUILT_IN_VECTORS` in `./payload/vectors`, and each
+ *   note cites its source in a comment beside it.
+ */
+import type { Issue, MessageKey } from '../core/issue.js';
+/**
+ * Error correction levels.
+ *
+ * The same union as `segment`'s `EcLevel`, repeated because this layer may
+ * import only from core. Content types name the levels a specification
+ * requires; the encoder owns what they mean.
+ */
+export type EcLevel = 'L' | 'M' | 'Q' | 'H';
+export type FieldValue = string | number | boolean | null | readonly string[];
+export type FieldKind = 'text' | 'multiline' | 'url' | 'email' | 'tel' | 'number' | 'integer' | 'select' | 'boolean' | 'date' | 'datetime' | 'iban' | 'bic' | 'amount' | 'currency' | 'country' | 'latitude' | 'longitude' | 'secret';
+export interface FieldOption {
+    readonly value: string;
+    readonly labelKey: MessageKey;
+}
+export interface FieldSchema {
+    readonly key: string;
+    readonly kind: FieldKind;
+    readonly labelKey: MessageKey;
+    readonly hintKey?: MessageKey;
+    readonly required?: boolean;
+    /** In characters (code points), for each item when the field is `multiple`. */
+    readonly maxLength?: number;
+    readonly min?: number;
+    readonly max?: number;
+    readonly options?: readonly FieldOption[];
+    readonly default?: FieldValue;
+    /** Fields shown together, such as 'address'. */
+    readonly group?: string;
+    /** Behind a disclosure. */
+    readonly advanced?: boolean;
+    /** Holds a `readonly string[]`, each item checked as `kind`. A contract addition. */
+    readonly multiple?: boolean;
+    /** The most items a `multiple` field may hold. */
+    readonly maxItems?: number;
+}
+export type PayloadCategory = 'link' | 'contact' | 'message' | 'network' | 'event' | 'place' | 'payment' | 'commerce' | 'text';
+export interface PayloadConstraints {
+    readonly ecLevels?: readonly EcLevel[];
+    readonly maxVersion?: string;
+    readonly symbologies?: readonly string[];
+    readonly sizeMm?: number;
+    readonly colours?: 'black-on-white';
+    readonly designLocked?: boolean;
+    readonly overlay?: 'swiss-cross';
+}
+export interface CompatibilityNote {
+    readonly reader: string;
+    readonly noteKey: MessageKey;
+    /** Where the behaviour is documented. The built-in notes cite theirs in a comment instead. */
+    readonly source?: string;
+}
+export type PayloadValue = Readonly<Record<string, FieldValue>>;
+export interface PayloadVector<V extends PayloadValue = PayloadValue> {
+    readonly text: string;
+    readonly value: V;
+    readonly source: string;
+}
+export interface PayloadType<V extends PayloadValue = PayloadValue> {
+    readonly id: string;
+    readonly labelKey: MessageKey;
+    readonly descriptionKey: MessageKey;
+    readonly category: PayloadCategory;
+    readonly fields: readonly FieldSchema[];
+    readonly constraints?: PayloadConstraints;
+    /**
+     * What a phone does with it, in plain words and without any content:
+     * "Joins a Wi-Fi network", never "Joins the network {ssid}".
+     */
+    readonly actionKey: MessageKey;
+    readonly compatibility?: readonly CompatibilityNote[];
+    /** False when this type can be read and explained but not made. A contract addition; absent means true. */
+    readonly generate?: boolean;
+    validate(value: V): readonly Issue[];
+    /** Call only on a value with no error issues; throws TypeError otherwise. */
+    build(value: V): {
+        readonly text: string;
+    };
+    /** 0 when the text is certainly not this type, 1 when it certainly is. */
+    detect(text: string): number;
+    /** Throws QrStudioError 'payload/unparseable', or 'payload/invalid' when an integrity check over the whole text fails. */
+    parse(text: string): V;
+    safety?(value: V): readonly SafetyFinding[];
+    /**
+     * Spec vectors, which `checkPayloadType` in `./conformance` runs when they
+     * are present. `source` cites where each came from. The built-in types
+     * carry none, so their test data stays out of every bundle: theirs are
+     * `BUILT_IN_VECTORS` in `./payload/vectors`.
+     */
+    readonly vectors?: readonly PayloadVector<V>[];
+}
+export type SafetyCode = 'scheme/dangerous' | 'scheme/unusual' | 'host/ip-literal' | 'host/mixed-script' | 'host/punycode' | 'host/lookalike' | 'url/userinfo' | 'host/shortener' | 'host/dynamic-qr' | 'url/tracking-params' | 'url/insecure' | 'url/very-long' | 'payload/open-wifi' | 'payload/payment' | 'payload/sends-message' | 'payload/service-code';
+export type SafetySeverity = 'danger' | 'caution' | 'note';
+export interface SafetyFinding {
+    readonly code: SafetyCode;
+    readonly severity: SafetySeverity;
+    /** Host names may appear here: they are what the person needs to see. Never in an error message. */
+    readonly params?: Readonly<Record<string, number | string>>;
+}
+export interface UrlAnalysis {
+    readonly findings: readonly SafetyFinding[];
+    /** The host a browser will connect to, after WHATWG normalisation, in its ASCII form. */
+    readonly displayHost: string | null;
+    /** The same host with any punycode labels decoded, when that differs from `displayHost`. */
+    readonly unicodeHost: string | null;
+}
+/** What `detectPayload` returns: the best type for some text and how sure it is. */
+export interface PayloadDetection {
+    readonly type: PayloadType;
+    readonly confidence: number;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/payload/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/payload/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE1D;;;;;;GAMG;AACH,MAAM,MAAM,OAAO,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;AAE5C,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,MAAM,EAAE,CAAC;AAE9E,MAAM,MAAM,SAAS,GAClB,MAAM,GACN,WAAW,GACX,KAAK,GACL,OAAO,GACP,KAAK,GACL,QAAQ,GACR,SAAS,GACT,QAAQ,GACR,SAAS,GACT,MAAM,GACN,UAAU,GACV,MAAM,GACN,KAAK,GACL,QAAQ,GACR,UAAU,GACV,SAAS,GACT,UAAU,GACV,WAAW,GACX,QAAQ,CAAC;AAEZ,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;CAC9B;AAED,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,+EAA+E;IAC/E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC;IAC9B,gDAAgD;IAChD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,2BAA2B;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,qFAAqF;IACrF,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,kDAAkD;IAClD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,MAAM,eAAe,GAC1B,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,MAAM,CAAC;AAElG,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;CACjC;AAED,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,8FAA8F;IAC9F,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AAEhE,MAAM,WAAW,aAAa,CAAC,CAAC,SAAS,YAAY,GAAG,YAAY;IACnE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;IAClB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,WAAW,CAAC,CAAC,SAAS,YAAY,GAAG,YAAY;IACjE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,UAAU,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC;IACxC,QAAQ,CAAC,WAAW,CAAC,EAAE,kBAAkB,CAAC;IAC1C;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACtD,2GAA2G;IAC3G,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,CAAC,GAAG,SAAS,KAAK,EAAE,CAAC;IACrC,6EAA6E;IAC7E,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,0EAA0E;IAC1E,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,0HAA0H;IAC1H,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,CAAC,CAAC;IACvB,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,SAAS,aAAa,EAAE,CAAC;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;CAC/C;AAED,MAAM,MAAM,UAAU,GACnB,kBAAkB,GAClB,gBAAgB,GAChB,iBAAiB,GACjB,mBAAmB,GACnB,eAAe,GACf,gBAAgB,GAChB,cAAc,GACd,gBAAgB,GAChB,iBAAiB,GACjB,qBAAqB,GACrB,cAAc,GACd,eAAe,GACf,mBAAmB,GACnB,iBAAiB,GACjB,uBAAuB,GAEvB,sBAAsB,CAAC;AAE1B,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAC;AAE3D,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,oGAAoG;IACpG,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC;CAC5D;AAED,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;IAC5C,yFAAyF;IACzF,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,4FAA4F;IAC5F,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,oFAAoF;AACpF,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC5B"}

package/dist/payload/types.js

@@ -0,0 +1,28 @@
+/**
+ * The public shape of a content type, as docs/CONTRACTS.md (`payload`) gives it.
+ *
+ * Three additions to the contract, all listed in the branch report, and two
+ * fields made optional:
+ *
+ * - `FieldSchema.multiple` and `maxItems`. A contact card has several phone
+ *   numbers and an email has several recipients, and `FieldValue` already
+ *   allows `readonly string[]`, but nothing in the schema said which fields
+ *   hold one. A field with `multiple: true` holds a `readonly string[]` whose
+ *   every item is checked as `kind`.
+ * - `PayloadType.generate`. A Saudi e-invoice code can be read and explained
+ *   but not made honestly here: phase 2 codes carry a signature over the
+ *   invoice made with the seller's own certificate. `generate: false` tells a
+ *   view to offer the type in the inspector only. Absent means true.
+ * - The safety code 'payload/service-code', for a tel: link that dials a
+ *   star or hash code (call forwarding, settings), which the contract's
+ *   union had no code for.
+ * - `PayloadType.vectors` and `CompatibilityNote.source` are optional. Both
+ *   are evidence for the people maintaining a type rather than anything a
+ *   view needs, and carried on the runtime objects they put tens of
+ *   kilobytes of test data and dozens of document addresses into every
+ *   bundle that offers a content type. The built-in types carry neither:
+ *   their vectors are `BUILT_IN_VECTORS` in `./payload/vectors`, and each
+ *   note cites its source in a comment beside it.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/payload/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/payload/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG"}

package/dist/payload/uri.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Editing a URL's query as text.
+ *
+ * `URL.searchParams` would do this, but writing it back re-serialises the
+ * whole URL: the host comes out in punycode, a trailing slash appears, and
+ * percent-encoding changes case. A person who pasted a link and added a
+ * campaign tag expects their link back with the tag on the end, so these work
+ * on the text and touch only the parameters named.
+ */
+/**
+ * Set query parameters, replacing any already there with the same names and
+ * appending the rest in the order given. Values are percent-encoded; a space
+ * becomes %20, which every server reads, where + is only a space in forms.
+ */
+export declare function withQueryParams(url: string, params: readonly (readonly [string, string])[]): string;
+/**
+ * Take the named parameters out of a URL: the URL without them, and the
+ * first value of each one found. The rest of the URL is left as written.
+ */
+export declare function takeQueryParams(url: string, names: readonly string[]): {
+    readonly url: string;
+    readonly taken: ReadonlyMap<string, string>;
+};
+//# sourceMappingURL=uri.d.ts.map

package/dist/payload/uri.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"uri.d.ts","sourceRoot":"","sources":["../../src/payload/uri.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA8BH;;;;GAIG;AACH,wBAAgB,eAAe,CAC9B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,GAC5C,MAAM,CASR;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC9B,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,MAAM,EAAE,GACtB;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAiBvE"}

package/dist/payload/uri.js

@@ -0,0 +1,69 @@
+/**
+ * Editing a URL's query as text.
+ *
+ * `URL.searchParams` would do this, but writing it back re-serialises the
+ * whole URL: the host comes out in punycode, a trailing slash appears, and
+ * percent-encoding changes case. A person who pasted a link and added a
+ * campaign tag expects their link back with the tag on the end, so these work
+ * on the text and touch only the parameters named.
+ */
+import { percentDecode } from './escape.js';
+function split(url) {
+    const hash = url.indexOf('#');
+    const fragment = hash === -1 ? '' : url.slice(hash);
+    const rest = hash === -1 ? url : url.slice(0, hash);
+    const mark = rest.indexOf('?');
+    if (mark === -1)
+        return { base: rest, parts: [], fragment };
+    return { base: rest.slice(0, mark), parts: rest.slice(mark + 1).split('&'), fragment };
+}
+function nameOf(part) {
+    const equals = part.indexOf('=');
+    const raw = equals === -1 ? part : part.slice(0, equals);
+    return percentDecode(raw, true) ?? raw;
+}
+function join({ base, parts, fragment }) {
+    const kept = parts.filter((part) => part !== '');
+    return `${base}${kept.length === 0 ? '' : `?${kept.join('&')}`}${fragment}`;
+}
+/**
+ * Set query parameters, replacing any already there with the same names and
+ * appending the rest in the order given. Values are percent-encoded; a space
+ * becomes %20, which every server reads, where + is only a space in forms.
+ */
+export function withQueryParams(url, params) {
+    if (params.length === 0)
+        return url;
+    const parsed = split(url);
+    const names = new Set(params.map(([name]) => name));
+    const parts = [
+        ...parsed.parts.filter((part) => part !== '' && !names.has(nameOf(part))),
+        ...params.map(([name, value]) => `${encodeURIComponent(name)}=${encodeURIComponent(value)}`),
+    ];
+    return join({ ...parsed, parts });
+}
+/**
+ * Take the named parameters out of a URL: the URL without them, and the
+ * first value of each one found. The rest of the URL is left as written.
+ */
+export function takeQueryParams(url, names) {
+    const parsed = split(url);
+    const wanted = new Set(names);
+    const taken = new Map();
+    const parts = [];
+    for (const part of parsed.parts) {
+        const name = nameOf(part);
+        if (!wanted.has(name)) {
+            parts.push(part);
+            continue;
+        }
+        const equals = part.indexOf('=');
+        const raw = equals === -1 ? '' : part.slice(equals + 1);
+        if (!taken.has(name))
+            taken.set(name, percentDecode(raw, true) ?? raw);
+    }
+    if (taken.size === 0)
+        return { url, taken };
+    return { url: join({ ...parsed, parts }), taken };
+}
+//# sourceMappingURL=uri.js.map

package/dist/payload/uri.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"uri.js","sourceRoot":"","sources":["../../src/payload/uri.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAQ5C,SAAS,KAAK,CAAC,GAAW;IACzB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,IAAI,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;IAC5D,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC;AACxF,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACzD,OAAO,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC;AACxC,CAAC;AAED,SAAS,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAY;IAChD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;IACjD,OAAO,GAAG,IAAI,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC;AAC7E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC9B,GAAW,EACX,MAA8C;IAE9C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IACpC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG;QACb,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACzE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;KAC5F,CAAC;IACF,OAAO,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC9B,GAAW,EACX,KAAwB;IAExB,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,SAAS;QACV,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IAC5C,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;AACnD,CAAC"}

package/dist/payload/url-safety.d.ts

@@ -0,0 +1,31 @@
+/**
+ * What a browser will do with a link, explained before anybody opens it.
+ *
+ * Everything here works from what `new URL()` makes of the text, because that
+ * is the WHATWG parser every browser uses, and the place an attack lives is
+ * the gap between what a link looks like and what it parses to. A tab typed
+ * into the middle of "javascript:" disappears; "3232235777" is the address 192.168.1.1; an
+ * address with an "@" in it goes to whatever comes after the "@". Reading the
+ * text with a regular expression would miss all three.
+ *
+ * Findings carry the host in `params`, because showing the person where a
+ * code goes is the whole job. Nothing here ever goes into an error message.
+ */
+import type { UrlAnalysis } from './types.js';
+/** True for a scheme (without its colon) that runs code or reaches the device. */
+export declare function isDangerousScheme(scheme: string): boolean;
+/**
+ * Past this a link is longer than any phone's address bar shows, so the part
+ * a person can see may not be the part that matters. Not from a standard:
+ * chosen to be well above the length of an ordinary link with a campaign tag.
+ */
+export declare const VERY_LONG_URL = 512;
+export declare function isTrackingParam(name: string): boolean;
+/** Every finding about a link, the host it goes to, and that host in Unicode when it differs. */
+export declare function analyseUrl(text: string): UrlAnalysis;
+/**
+ * The link without its tracking parameters, otherwise exactly as written. The
+ * text comes back unchanged when it is not a URL or has nothing to remove.
+ */
+export declare function cleanUrl(text: string): string;
+//# sourceMappingURL=url-safety.d.ts.map

package/dist/payload/url-safety.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-safety.d.ts","sourceRoot":"","sources":["../../src/payload/url-safety.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,OAAO,KAAK,EAAiB,WAAW,EAAE,MAAM,YAAY,CAAC;AAqB7D,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEzD;AAoED;;;;GAIG;AACH,eAAO,MAAM,aAAa,MAAM,CAAC;AAuBjC,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAErD;AA8BD,iGAAiG;AACjG,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CA0BpD;AAYD;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAY7C"}

package/dist/payload/url-safety.js

@@ -0,0 +1,221 @@
+/**
+ * What a browser will do with a link, explained before anybody opens it.
+ *
+ * Everything here works from what `new URL()` makes of the text, because that
+ * is the WHATWG parser every browser uses, and the place an attack lives is
+ * the gap between what a link looks like and what it parses to. A tab typed
+ * into the middle of "javascript:" disappears; "3232235777" is the address 192.168.1.1; an
+ * address with an "@" in it goes to whatever comes after the "@". Reading the
+ * text with a regular expression would miss all three.
+ *
+ * Findings carry the host in `params`, because showing the person where a
+ * code goes is the whole job. Nothing here ever goes into an error message.
+ */
+import { DYNAMIC_QR_HOSTS, SHORTENER_HOSTS } from './data/hosts.js';
+import { hostToUnicode } from './punycode.js';
+import { isMixedScript, isWholeScriptLookalike } from './scripts.js';
+/**
+ * Schemes that run code or reach the local machine rather than going to a
+ * site: script, inline documents, local files and in-memory objects, and
+ * itms-services, which installs an app on an iPhone from a manifest anybody
+ * can host. No QR code has a good reason to carry one.
+ *
+ * Android's intent: is not here. It opens an app, which is "unusual" and
+ * worth a caution, and plenty of ordinary codes use it to open a map or a
+ * store page.
+ */
+const DANGEROUS_SCHEMES = new Set([
+    'javascript',
+    'data',
+    'vbscript',
+    'file',
+    'blob',
+    'itms-services',
+]);
+/** True for a scheme (without its colon) that runs code or reaches the device. */
+export function isDangerousScheme(scheme) {
+    return DANGEROUS_SCHEMES.has(scheme.toLowerCase());
+}
+/**
+ * Schemes the content types in this layer read and explain themselves. They
+ * are not web navigation, so the host checks below do not apply to them.
+ */
+const CONTENT_SCHEMES = new Set([
+    'mailto',
+    'tel',
+    'sms',
+    'smsto',
+    'mms',
+    'mmsto',
+    'geo',
+    'facetime',
+    'facetime-audio',
+    'bitcoin',
+    'lightning',
+    'upi',
+    'wifi',
+    'matmsg',
+    'mecard',
+    'tg',
+    'whatsapp',
+    'sgnl',
+]);
+/**
+ * Query parameters that exist to say where a visitor came from, rather than
+ * what they asked for. Removing them leaves the same page. Sources: Google
+ * Analytics campaign parameters (support.google.com/analytics/answer/10917952),
+ * Google Ads auto-tagging gclid, gbraid and wbraid
+ * (support.google.com/google-ads/answer/9744275), Campaign Manager dclid,
+ * Meta's fbclid (developers.facebook.com/docs/marketing-api/conversions-api/parameters/fbp-and-fbc),
+ * Microsoft Advertising msclkid (help.ads.microsoft.com, "What is Microsoft
+ * Click ID"), Mailchimp mc_cid and mc_eid, HubSpot _hsenc and _hsmi, Marketo
+ * mkt_tok, Instagram igshid, Yandex yclid, TikTok ttclid, X twclid, LinkedIn
+ * li_fat_id and Google's cross-domain _gl.
+ */
+const TRACKING_PARAMS = new Set([
+    'utm_source',
+    'utm_medium',
+    'utm_campaign',
+    'utm_term',
+    'utm_content',
+    'utm_id',
+    'utm_source_platform',
+    'utm_creative_format',
+    'utm_marketing_tactic',
+    'gclid',
+    'gbraid',
+    'wbraid',
+    'dclid',
+    'fbclid',
+    'msclkid',
+    'mc_cid',
+    'mc_eid',
+    '_hsenc',
+    '_hsmi',
+    'mkt_tok',
+    'igshid',
+    'yclid',
+    'ttclid',
+    'twclid',
+    'li_fat_id',
+    '_gl',
+]);
+/**
+ * Past this a link is longer than any phone's address bar shows, so the part
+ * a person can see may not be the part that matters. Not from a standard:
+ * chosen to be well above the length of an ordinary link with a campaign tag.
+ */
+export const VERY_LONG_URL = 512;
+const EMPTY = Object.freeze({
+    findings: Object.freeze([]),
+    displayHost: null,
+    unicodeHost: null,
+});
+function parseUrl(text) {
+    try {
+        return new URL(text);
+    }
+    catch {
+        return undefined;
+    }
+}
+function matches(fqdn, list) {
+    // "bit.ly." is the same host as "bit.ly", written as a fully qualified
+    // name, and WHATWG keeps the dot.
+    const host = fqdn.endsWith('.') ? fqdn.slice(0, -1) : fqdn;
+    return list.some((entry) => host === entry.host || host.endsWith(`.${entry.host}`));
+}
+export function isTrackingParam(name) {
+    return TRACKING_PARAMS.has(name.toLowerCase());
+}
+function hostFindings(url, host, findings) {
+    if (url.username !== '' || url.password !== '') {
+        // "https://bank.example@other.example/" goes to other.example. The part
+        // before the "@" is a user name, and it is there to be read as a host.
+        findings.push({ code: 'url/userinfo', severity: 'danger', params: { host } });
+    }
+    if (/^\d+\.\d+\.\d+\.\d+$/.test(host) || host.startsWith('[')) {
+        findings.push({ code: 'host/ip-literal', severity: 'caution', params: { host } });
+    }
+    const unicode = hostToUnicode(host);
+    const unicodeHost = unicode === host ? null : unicode;
+    if (unicodeHost !== null) {
+        findings.push({ code: 'host/punycode', severity: 'caution', params: { host, unicodeHost } });
+    }
+    const labels = unicode.split('.');
+    if (labels.some(isMixedScript)) {
+        findings.push({ code: 'host/mixed-script', severity: 'danger', params: { host: unicode } });
+    }
+    else if (labels.some(isWholeScriptLookalike)) {
+        findings.push({ code: 'host/lookalike', severity: 'danger', params: { host: unicode } });
+    }
+    if (matches(host, SHORTENER_HOSTS)) {
+        findings.push({ code: 'host/shortener', severity: 'caution', params: { host } });
+    }
+    else if (matches(host, DYNAMIC_QR_HOSTS)) {
+        findings.push({ code: 'host/dynamic-qr', severity: 'caution', params: { host } });
+    }
+    return unicodeHost;
+}
+/** Every finding about a link, the host it goes to, and that host in Unicode when it differs. */
+export function analyseUrl(text) {
+    const url = parseUrl(text);
+    if (url === undefined)
+        return EMPTY;
+    const scheme = url.protocol.slice(0, -1);
+    const findings = [];
+    if (DANGEROUS_SCHEMES.has(scheme)) {
+        findings.push({ code: 'scheme/dangerous', severity: 'danger', params: { scheme } });
+        return { findings, displayHost: null, unicodeHost: null };
+    }
+    if (CONTENT_SCHEMES.has(scheme))
+        return EMPTY;
+    if (scheme === 'http')
+        findings.push({ code: 'url/insecure', severity: 'caution' });
+    else if (scheme !== 'https')
+        findings.push({ code: 'scheme/unusual', severity: 'caution', params: { scheme } });
+    const host = url.hostname;
+    const unicodeHost = host === '' ? null : hostFindings(url, host, findings);
+    let tracking = 0;
+    for (const name of url.searchParams.keys())
+        if (isTrackingParam(name))
+            tracking += 1;
+    if (tracking > 0) {
+        findings.push({ code: 'url/tracking-params', severity: 'note', params: { count: tracking } });
+    }
+    if (text.length > VERY_LONG_URL) {
+        findings.push({ code: 'url/very-long', severity: 'note', params: { length: text.length } });
+    }
+    return { findings, displayHost: host === '' ? null : host, unicodeHost };
+}
+function decodedName(part) {
+    const equals = part.indexOf('=');
+    const raw = (equals === -1 ? part : part.slice(0, equals)).replace(/\+/g, ' ');
+    try {
+        return decodeURIComponent(raw);
+    }
+    catch {
+        return raw;
+    }
+}
+/**
+ * The link without its tracking parameters, otherwise exactly as written. The
+ * text comes back unchanged when it is not a URL or has nothing to remove.
+ */
+export function cleanUrl(text) {
+    if (parseUrl(text) === undefined)
+        return text;
+    const hash = text.indexOf('#');
+    const fragment = hash === -1 ? '' : text.slice(hash);
+    const beforeFragment = hash === -1 ? text : text.slice(0, hash);
+    const mark = beforeFragment.indexOf('?');
+    if (mark === -1)
+        return text;
+    const parts = beforeFragment.slice(mark + 1).split('&');
+    const kept = parts.filter((part) => !isTrackingParam(decodedName(part)));
+    if (kept.length === parts.length)
+        return text;
+    const query = kept.filter((part) => part !== '').join('&');
+    return `${beforeFragment.slice(0, mark)}${query === '' ? '' : `?${query}`}${fragment}`;
+}
+//# sourceMappingURL=url-safety.js.map

package/dist/payload/url-safety.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-safety.js","sourceRoot":"","sources":["../../src/payload/url-safety.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEpE,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAGrE;;;;;;;;;GASG;AACH,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC;IACtD,YAAY;IACZ,MAAM;IACN,UAAU;IACV,MAAM;IACN,MAAM;IACN,eAAe;CACf,CAAC,CAAC;AAEH,kFAAkF;AAClF,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC/C,OAAO,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC;IACpD,QAAQ;IACR,KAAK;IACL,KAAK;IACL,OAAO;IACP,KAAK;IACL,OAAO;IACP,KAAK;IACL,UAAU;IACV,gBAAgB;IAChB,SAAS;IACT,WAAW;IACX,KAAK;IACL,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,IAAI;IACJ,UAAU;IACV,MAAM;CACN,CAAC,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC;IACpD,YAAY;IACZ,YAAY;IACZ,cAAc;IACd,UAAU;IACV,aAAa;IACb,QAAQ;IACR,qBAAqB;IACrB,qBAAqB;IACrB,sBAAsB;IACtB,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,SAAS;IACT,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,WAAW;IACX,KAAK;CACL,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,CAAC;AAEjC,MAAM,KAAK,GAAgB,MAAM,CAAC,MAAM,CAAC;IACxC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;IAC3B,WAAW,EAAE,IAAI;IACjB,WAAW,EAAE,IAAI;CACjB,CAAC,CAAC;AAEH,SAAS,QAAQ,CAAC,IAAY;IAC7B,IAAI,CAAC;QACJ,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,IAA6B;IAC3D,uEAAuE;IACvE,kCAAkC;IAClC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3D,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AACrF,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY;IAC3C,OAAO,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,YAAY,CAAC,GAAQ,EAAE,IAAY,EAAE,QAAyB;IACtE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAChD,wEAAwE;QACxE,uEAAuE;QACvE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/D,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,WAAW,GAAG,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;IACtD,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IAC7F,CAAC;SAAM,IAAI,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAChD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,CAAC;QACpC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAClF,CAAC;SAAM,IAAI,OAAO,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,CAAC;QAC5C,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,WAAW,CAAC;AACpB,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,UAAU,CAAC,IAAY;IACtC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACpF,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,IAAI,MAAM,KAAK,MAAM;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;SAC/E,IAAI,MAAM,KAAK,OAAO;QAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IAEpF,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC1B,MAAM,WAAW,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAE3E,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE;QAAE,IAAI,eAAe,CAAC,IAAI,CAAC;YAAE,QAAQ,IAAI,CAAC,CAAC;IACrF,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QAClB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC;AAC1E,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAChC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC/E,IAAI,CAAC;QACJ,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,GAAG,CAAC;IACZ,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY;IACpC,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,cAAc,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,IAAI,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzE,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3D,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,GAAG,QAAQ,EAAE,CAAC;AACxF,CAAC"}

package/dist/payload/vectors/bitcoin.d.ts

@@ -0,0 +1,13 @@
+/**
+ * The specification vectors for the Bitcoin payment request content type,
+ * ../content/bitcoin.ts. Test data: see ./built-in.ts for why it lives here
+ * rather than on the type.
+ *
+ * BIP 21's example address and BIP 321's examples fail their own checksums,
+ * so those vectors are held to reading only, and the conformance suite
+ * expects validation to report the checksum (see ../content/bitcoin.ts).
+ */
+import type { BitcoinValue } from '../content/bitcoin.js';
+import type { PayloadVector } from '../types.js';
+export declare const bitcoinVectors: readonly PayloadVector<BitcoinValue>[];
+//# sourceMappingURL=bitcoin.d.ts.map

package/dist/payload/vectors/bitcoin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bitcoin.d.ts","sourceRoot":"","sources":["../../../src/payload/vectors/bitcoin.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAIjD,eAAO,MAAM,cAAc,EAAE,SAAS,aAAa,CAAC,YAAY,CAAC,EAyEhE,CAAC"}