@kehto/nip 0.3.0 → 0.4.1

package/README.md

@@ -11,7 +11,7 @@ any NIP that isn't referenced.
 | Subpath | NIP | What it provides |
 |---------|-----|------------------|
 | [`@kehto/nip/5a`](./src/5a/README.md) | NIP-5A | aggregate hash compute/verify over `path` tags (`computeAggregateHash`, `verifyAggregate`) |
-| [`@kehto/nip/5d`](./src/5d/README.md) | NIP-5D | content-addressed napplet manifest resolution — parse, verify sig + aggregate + Blossom blobs (`resolveNapplet`) |
+| [`@kehto/nip/5d`](./src/5d/README.md) | NIP-5D | content-addressed napplet manifest resolution — parse, verify sig + aggregate + Blossom blobs (`resolveNapplet`) with optional Cache Storage artifact caching |
 | [`@kehto/nip/51`](./src/51/README.md) | NIP-51 | lists & sets parser — mute/bookmarks/relay-sets/emoji-sets/… (`parseList`) |
 | [`@kehto/nip/65`](./src/65/README.md) | NIP-65 | relay-list (kind 10002) parsing + outbox/inbox resolution (`createNip65Registry`) |
 | [`@kehto/nip/66`](./src/66/README.md) | NIP-66 | kind-30166 relay-discovery aggregator (`createNip66Aggregator`) |
@@ -20,6 +20,10 @@ any NIP that isn't referenced.
 Each subpath has its own README with full API docs and examples (linked above).
 More unique NIPs are added as their own subpath (`@kehto/nip/<n>`) over time.
 
+For browser hosts that want repeated NIP-5D loads to reuse verified artifact
+bytes, see the repo guide:
+[Implement a napplet artifact cache](https://kehto.github.io/web/docs/how-tos/implement-napplet-artifact-cache).
+
 ## Selection criteria
 
 A NIP earns a place here only if it is:

package/dist/5d/index.d.ts

@@ -1,6 +1,150 @@
 import { NostrEvent } from 'nostr-tools';
 import { PathEntry } from '../5a/index.js';
 
+/** Versioned Cache Storage namespace for verified napplet artifacts. */
+declare const NAPPLET_ARTIFACT_CACHE_NAME = "kehto:napplet-artifacts:v1";
+interface NappletCacheDiagnostic {
+    type: 'cache-open-failed' | 'cache-read-failed' | 'cache-write-failed' | 'cache-delete-failed' | 'cache-prune-failed' | 'storage-estimate-unavailable';
+    message: string;
+    cause?: unknown;
+}
+interface NappletBlobIndexEntry {
+    size: number;
+    lastAccessed: number;
+    refCount: number;
+}
+interface NappletAggregateIndexEntry {
+    dTag: string;
+    aggregateHash: string;
+    key: string;
+    blobHashes: string[];
+    size: number;
+    lastAccessed: number;
+    coordinateKey?: string;
+    pinned?: boolean;
+}
+interface CachedCoordinate {
+    key: string;
+    kind: number;
+    pubkey: string;
+    dTag: string;
+    aggregateHash: string;
+    lastResolvedAt: number;
+    foregroundTtlMs: number;
+    backgroundTtlMs: number;
+}
+interface NappletArtifactCacheIndex {
+    schemaVersion: number;
+    updatedAt: number;
+    blobs: Record<string, NappletBlobIndexEntry>;
+    aggregates: Record<string, NappletAggregateIndexEntry>;
+    coordinates: Record<string, CachedCoordinate>;
+}
+interface WriteVerifiedResolutionInput {
+    event: NostrEvent;
+    manifest: NappletManifest;
+    files: ReadonlyMap<string, Uint8Array>;
+    indexHtml: string;
+    now?: number;
+}
+interface CoordinateFreshnessOptions {
+    now?: number;
+    background?: boolean;
+}
+interface NappletArtifactCache {
+    readBlob(sha256Hex: string): Promise<Uint8Array | undefined>;
+    deleteBlob(sha256Hex: string): Promise<void>;
+    writeVerifiedResolution(input: WriteVerifiedResolutionInput): Promise<void>;
+    writeCoordinate(input: {
+        kind: number;
+        pubkey: string;
+        dTag: string;
+        aggregateHash: string;
+        lastResolvedAt?: number;
+        foregroundTtlMs?: number;
+        backgroundTtlMs?: number;
+    }): Promise<void>;
+    getCoordinate(input: {
+        kind: number;
+        pubkey: string;
+        dTag: string;
+    }, options?: CoordinateFreshnessOptions): Promise<(CachedCoordinate & {
+        fresh: boolean;
+    }) | undefined>;
+    touchAggregate(dTag: string, aggregateHash: string, now?: number): Promise<void>;
+    markAggregateActive(dTag: string, aggregateHash: string): void;
+    releaseAggregateActive(dTag: string, aggregateHash: string): void;
+    prune(now?: number): Promise<void>;
+}
+interface CacheStorageNappletArtifactCacheOptions {
+    cacheStorage?: CacheStorage;
+    storage?: StorageManager;
+    cacheName?: string;
+    baseUrl?: string;
+    now?: () => number;
+    onDiagnostic?: (diagnostic: NappletCacheDiagnostic) => void;
+    unknownBudgetBytes?: number;
+    softCeilingBytes?: number;
+    hardCeilingBytes?: number;
+}
+interface OpenNappletArtifactCacheOptions extends CacheStorageNappletArtifactCacheOptions {
+    requireStorageEstimate?: boolean;
+}
+declare function coordinateKey(kind: number, pubkey: string, dTag: string): string;
+declare function isCoordinateFresh(coordinate: CachedCoordinate, options?: CoordinateFreshnessOptions): boolean;
+declare class CacheStorageNappletArtifactCache implements NappletArtifactCache {
+    private readonly cacheStorage;
+    private readonly storage?;
+    private readonly cacheName;
+    private readonly baseUrl;
+    private readonly now;
+    private readonly activeAggregates;
+    private readonly onDiagnostic?;
+    private readonly unknownBudgetBytes;
+    private readonly softCeilingBytes;
+    private readonly hardCeilingBytes;
+    private cachePromise?;
+    constructor(options?: CacheStorageNappletArtifactCacheOptions);
+    readBlob(sha256Hex: string): Promise<Uint8Array | undefined>;
+    deleteBlob(sha256Hex: string): Promise<void>;
+    writeVerifiedResolution(input: WriteVerifiedResolutionInput): Promise<void>;
+    writeCoordinate(input: {
+        kind: number;
+        pubkey: string;
+        dTag: string;
+        aggregateHash: string;
+        lastResolvedAt?: number;
+        foregroundTtlMs?: number;
+        backgroundTtlMs?: number;
+    }): Promise<void>;
+    getCoordinate(input: {
+        kind: number;
+        pubkey: string;
+        dTag: string;
+    }, options?: CoordinateFreshnessOptions): Promise<(CachedCoordinate & {
+        fresh: boolean;
+    }) | undefined>;
+    touchAggregate(dTag: string, aggregateHash: string, now?: number): Promise<void>;
+    markAggregateActive(dTag: string, aggregateHash: string): void;
+    releaseAggregateActive(dTag: string, aggregateHash: string): void;
+    prune(now?: number): Promise<void>;
+    snapshotIndex(): Promise<NappletArtifactCacheIndex>;
+    private writeVerifiedResolutionOnce;
+    private open;
+    private indexUrl;
+    private blobUrl;
+    private aggregateUrl;
+    private readIndex;
+    private writeIndex;
+    private rewriteRefCounts;
+    private budgetBytes;
+    private hardBudgetBytes;
+    private originPressureHigh;
+    private estimateStorage;
+    private diagnostic;
+}
+declare function openNappletArtifactCache(options?: OpenNappletArtifactCacheOptions): Promise<CacheStorageNappletArtifactCache | undefined>;
+
 /**
  * `@kehto/nip/5d` — NIP-5D napplet manifest resolution.
  *
@@ -143,6 +287,12 @@ interface ResolveNappletOptions {
     fetchBlob: (sha256Hex: string, servers: readonly string[]) => Promise<Uint8Array>;
     /** Decode blob bytes to text for `indexHtml` (default UTF-8). */
     textDecode?: (bytes: Uint8Array) => string;
+    /**
+     * Optional verified artifact cache. Cache hits are still re-verified against
+     * the manifest hash before use; cache writes happen only after the signature,
+     * aggregate, and every blob hash have been verified.
+     */
+    cache?: NappletArtifactCache;
 }
 /**
  * Resolve a napplet end-to-end from a candidate manifest event: verify the
@@ -167,4 +317,4 @@ interface ResolveNappletOptions {
  */
 declare function resolveNapplet(options: ResolveNappletOptions): Promise<ResolvedNapplet>;
 
-export { NAPPLET_KINDS, NAPPLET_KIND_NAMED, NAPPLET_KIND_ROOT, NAPPLET_KIND_SNAPSHOT, type NappletManifest, NappletResolutionError, type NappletResolutionErrorCode, type ResolveNappletOptions, type ResolvedNapplet, fetchBlob, isNappletManifestKind, parseNappletManifest, resolveNapplet, verifyBlobHash, verifyManifestSignature };
+export { CacheStorageNappletArtifactCache, type CacheStorageNappletArtifactCacheOptions, type CachedCoordinate, type CoordinateFreshnessOptions, NAPPLET_ARTIFACT_CACHE_NAME, NAPPLET_KINDS, NAPPLET_KIND_NAMED, NAPPLET_KIND_ROOT, NAPPLET_KIND_SNAPSHOT, type NappletAggregateIndexEntry, type NappletArtifactCache, type NappletArtifactCacheIndex, type NappletBlobIndexEntry, type NappletCacheDiagnostic, type NappletManifest, NappletResolutionError, type NappletResolutionErrorCode, type OpenNappletArtifactCacheOptions, type ResolveNappletOptions, type ResolvedNapplet, type WriteVerifiedResolutionInput, coordinateKey, fetchBlob, isCoordinateFresh, isNappletManifestKind, openNappletArtifactCache, parseNappletManifest, resolveNapplet, verifyBlobHash, verifyManifestSignature };

package/dist/5d/index.js

@@ -1,25 +1,35 @@
 import {
+  CacheStorageNappletArtifactCache,
+  NAPPLET_ARTIFACT_CACHE_NAME,
   NAPPLET_KINDS,
   NAPPLET_KIND_NAMED,
   NAPPLET_KIND_ROOT,
   NAPPLET_KIND_SNAPSHOT,
   NappletResolutionError,
+  coordinateKey,
   fetchBlob,
+  isCoordinateFresh,
   isNappletManifestKind,
+  openNappletArtifactCache,
   parseNappletManifest,
   resolveNapplet,
   verifyBlobHash,
   verifyManifestSignature
-} from "../chunk-JRSVIT22.js";
+} from "../chunk-CDBUCFLP.js";
 import "../chunk-2J3CSGKL.js";
 export {
+  CacheStorageNappletArtifactCache,
+  NAPPLET_ARTIFACT_CACHE_NAME,
   NAPPLET_KINDS,
   NAPPLET_KIND_NAMED,
   NAPPLET_KIND_ROOT,
   NAPPLET_KIND_SNAPSHOT,
   NappletResolutionError,
+  coordinateKey,
   fetchBlob,
+  isCoordinateFresh,
   isNappletManifestKind,
+  openNappletArtifactCache,
   parseNappletManifest,
   resolveNapplet,
   verifyBlobHash,

package/dist/chunk-CDBUCFLP.js

@@ -0,0 +1,572 @@
+import {
+  aggregateTagValue,
+  computeAggregateHash,
+  pathEntriesFromTags
+} from "./chunk-2J3CSGKL.js";
+
+// src/5d/index.ts
+import { verifyEvent } from "nostr-tools/pure";
+import { sha256 } from "@noble/hashes/sha2.js";
+import { bytesToHex } from "@noble/hashes/utils.js";
+
+// src/5d/artifact-cache.ts
+var MIB = 1024 * 1024;
+var NAPPLET_ARTIFACT_CACHE_NAME = "kehto:napplet-artifacts:v1";
+var SCHEMA_VERSION = 1;
+var DEFAULT_BASE_URL = "https://kehto.invalid";
+var DEFAULT_UNKNOWN_BUDGET_BYTES = 32 * MIB;
+var DEFAULT_SOFT_CEILING_BYTES = 128 * MIB;
+var DEFAULT_HARD_CEILING_BYTES = 256 * MIB;
+var DEFAULT_FOREGROUND_TTL_MS = 15 * 60 * 1e3;
+var DEFAULT_BACKGROUND_TTL_MS = 60 * 60 * 1e3;
+function emptyIndex(now) {
+  return {
+    schemaVersion: SCHEMA_VERSION,
+    updatedAt: now,
+    blobs: {},
+    aggregates: {},
+    coordinates: {}
+  };
+}
+function aggregateKey(dTag, aggregateHash) {
+  return `${encodeURIComponent(dTag)}:${aggregateHash}`;
+}
+function coordinateKey(kind, pubkey, dTag) {
+  return `${kind}:${pubkey}:${encodeURIComponent(dTag)}`;
+}
+function isCoordinateFresh(coordinate, options = {}) {
+  const now = options.now ?? Date.now();
+  const ttl = options.background ? coordinate.backgroundTtlMs : coordinate.foregroundTtlMs;
+  return ttl === Number.POSITIVE_INFINITY || now - coordinate.lastResolvedAt <= ttl;
+}
+function byteLength(bytes) {
+  return bytes.byteLength;
+}
+function encodeKeyPart(value) {
+  return encodeURIComponent(value).replaceAll("%2F", "%252F");
+}
+function cloneBytes(bytes) {
+  return new Uint8Array(bytes);
+}
+function responseBody(bytes) {
+  return cloneBytes(bytes).buffer;
+}
+function normalizeBaseUrl(baseUrl) {
+  return baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`;
+}
+function resolveBaseUrl(baseUrl) {
+  if (baseUrl) return normalizeBaseUrl(baseUrl);
+  const maybeLocation = globalThis;
+  if (maybeLocation.location?.origin) return normalizeBaseUrl(maybeLocation.location.origin);
+  return normalizeBaseUrl(DEFAULT_BASE_URL);
+}
+async function responseBytes(response) {
+  return new Uint8Array(await response.arrayBuffer());
+}
+async function responseJson(response) {
+  return response.json();
+}
+function refCounts(index) {
+  const counts = {};
+  for (const aggregate of Object.values(index.aggregates)) {
+    for (const hash of aggregate.blobHashes) counts[hash] = (counts[hash] ?? 0) + 1;
+  }
+  return counts;
+}
+function cachedSize(index) {
+  const blobBytes = Object.values(index.blobs).reduce((sum, entry) => sum + entry.size, 0);
+  const aggregateBytes = Object.values(index.aggregates).reduce((sum, entry) => sum + entry.size, 0);
+  return blobBytes + aggregateBytes;
+}
+var CacheStorageNappletArtifactCache = class {
+  cacheStorage;
+  storage;
+  cacheName;
+  baseUrl;
+  now;
+  activeAggregates = /* @__PURE__ */ new Set();
+  onDiagnostic;
+  unknownBudgetBytes;
+  softCeilingBytes;
+  hardCeilingBytes;
+  cachePromise;
+  constructor(options = {}) {
+    const maybeCacheStorage = options.cacheStorage ?? globalThis.caches;
+    if (!maybeCacheStorage) {
+      throw new Error("Cache Storage is unavailable");
+    }
+    this.cacheStorage = maybeCacheStorage;
+    this.storage = options.storage ?? globalThis.navigator?.storage;
+    this.cacheName = options.cacheName ?? NAPPLET_ARTIFACT_CACHE_NAME;
+    this.baseUrl = resolveBaseUrl(options.baseUrl);
+    this.now = options.now ?? Date.now;
+    this.onDiagnostic = options.onDiagnostic;
+    this.unknownBudgetBytes = options.unknownBudgetBytes ?? DEFAULT_UNKNOWN_BUDGET_BYTES;
+    this.softCeilingBytes = options.softCeilingBytes ?? DEFAULT_SOFT_CEILING_BYTES;
+    this.hardCeilingBytes = options.hardCeilingBytes ?? DEFAULT_HARD_CEILING_BYTES;
+  }
+  async readBlob(sha256Hex) {
+    try {
+      const cache = await this.open();
+      const response = await cache.match(this.blobUrl(sha256Hex));
+      if (!response) return void 0;
+      const bytes = await responseBytes(response);
+      const index = await this.readIndex(cache);
+      const entry = index.blobs[sha256Hex];
+      if (entry) {
+        entry.lastAccessed = this.now();
+        index.updatedAt = entry.lastAccessed;
+        await this.writeIndex(cache, index);
+      }
+      return bytes;
+    } catch (cause) {
+      this.diagnostic({ type: "cache-read-failed", message: `failed to read blob ${sha256Hex}`, cause });
+      return void 0;
+    }
+  }
+  async deleteBlob(sha256Hex) {
+    try {
+      const cache = await this.open();
+      await cache.delete(this.blobUrl(sha256Hex));
+      const index = await this.readIndex(cache);
+      delete index.blobs[sha256Hex];
+      index.updatedAt = this.now();
+      await this.writeIndex(cache, index);
+    } catch (cause) {
+      this.diagnostic({ type: "cache-delete-failed", message: `failed to delete blob ${sha256Hex}`, cause });
+    }
+  }
+  async writeVerifiedResolution(input) {
+    try {
+      await this.writeVerifiedResolutionOnce(input);
+    } catch (firstCause) {
+      try {
+        await this.prune(input.now ?? this.now());
+        await this.writeVerifiedResolutionOnce(input);
+      } catch (cause) {
+        this.diagnostic({
+          type: "cache-write-failed",
+          message: "failed to write verified napplet artifacts after prune retry",
+          cause: cause ?? firstCause
+        });
+      }
+    }
+  }
+  async writeCoordinate(input) {
+    const cache = await this.open();
+    const now = this.now();
+    const index = await this.readIndex(cache);
+    const key = coordinateKey(input.kind, input.pubkey, input.dTag);
+    index.coordinates[key] = {
+      key,
+      kind: input.kind,
+      pubkey: input.pubkey,
+      dTag: input.dTag,
+      aggregateHash: input.aggregateHash,
+      lastResolvedAt: input.lastResolvedAt ?? now,
+      foregroundTtlMs: input.foregroundTtlMs ?? DEFAULT_FOREGROUND_TTL_MS,
+      backgroundTtlMs: input.backgroundTtlMs ?? DEFAULT_BACKGROUND_TTL_MS
+    };
+    index.updatedAt = now;
+    await this.writeIndex(cache, index);
+  }
+  async getCoordinate(input, options = {}) {
+    const cache = await this.open();
+    const index = await this.readIndex(cache);
+    const coordinate = index.coordinates[coordinateKey(input.kind, input.pubkey, input.dTag)];
+    if (!coordinate) return void 0;
+    return { ...coordinate, fresh: isCoordinateFresh(coordinate, options) };
+  }
+  async touchAggregate(dTag, aggregateHash, now = this.now()) {
+    const cache = await this.open();
+    const index = await this.readIndex(cache);
+    const key = aggregateKey(dTag, aggregateHash);
+    const aggregate = index.aggregates[key];
+    if (!aggregate) return;
+    aggregate.lastAccessed = now;
+    for (const hash of aggregate.blobHashes) {
+      if (index.blobs[hash]) index.blobs[hash].lastAccessed = now;
+    }
+    index.updatedAt = now;
+    await this.writeIndex(cache, index);
+  }
+  markAggregateActive(dTag, aggregateHash) {
+    this.activeAggregates.add(aggregateKey(dTag, aggregateHash));
+  }
+  releaseAggregateActive(dTag, aggregateHash) {
+    this.activeAggregates.delete(aggregateKey(dTag, aggregateHash));
+  }
+  async prune(now = this.now()) {
+    try {
+      const cache = await this.open();
+      const index = await this.readIndex(cache);
+      let size = cachedSize(index);
+      const budget = await this.budgetBytes();
+      const hardBudget = await this.hardBudgetBytes();
+      const shouldPrune = size > budget || await this.originPressureHigh();
+      if (!shouldPrune) return;
+      this.rewriteRefCounts(index);
+      for (const [hash, blob] of Object.entries(index.blobs)) {
+        if (size <= budget) break;
+        if (blob.refCount > 0) continue;
+        await cache.delete(this.blobUrl(hash));
+        delete index.blobs[hash];
+        size -= blob.size;
+      }
+      const currentAggregateHashes = new Set(
+        Object.values(index.coordinates).map((coordinate) => coordinate.aggregateHash)
+      );
+      const aggregates = Object.values(index.aggregates).filter((entry) => !this.activeAggregates.has(entry.key)).sort((a, b) => {
+        const currentA = currentAggregateHashes.has(a.aggregateHash) ? 1 : 0;
+        const currentB = currentAggregateHashes.has(b.aggregateHash) ? 1 : 0;
+        if (currentA !== currentB) return currentA - currentB;
+        return a.lastAccessed - b.lastAccessed;
+      });
+      for (const aggregate of aggregates) {
+        if (size <= budget) break;
+        await cache.delete(this.aggregateUrl(aggregate.key));
+        delete index.aggregates[aggregate.key];
+        size -= aggregate.size;
+        this.rewriteRefCounts(index);
+      }
+      if (size > hardBudget) {
+        const active = Object.values(index.aggregates).filter((entry) => this.activeAggregates.has(entry.key)).sort((a, b) => a.lastAccessed - b.lastAccessed);
+        for (const aggregate of active) {
+          if (size <= hardBudget) break;
+          await cache.delete(this.aggregateUrl(aggregate.key));
+          delete index.aggregates[aggregate.key];
+          size -= aggregate.size;
+        }
+      }
+      this.rewriteRefCounts(index);
+      for (const [hash, blob] of Object.entries(index.blobs)) {
+        if (blob.refCount === 0) {
+          await cache.delete(this.blobUrl(hash));
+          delete index.blobs[hash];
+        }
+      }
+      index.updatedAt = now;
+      await this.writeIndex(cache, index);
+    } catch (cause) {
+      this.diagnostic({ type: "cache-prune-failed", message: "failed to prune napplet artifact cache", cause });
+    }
+  }
+  async snapshotIndex() {
+    return this.readIndex(await this.open());
+  }
+  async writeVerifiedResolutionOnce(input) {
+    const cache = await this.open();
+    const now = input.now ?? this.now();
+    const index = await this.readIndex(cache);
+    const blobHashes = [];
+    for (const pathEntry of input.manifest.paths) {
+      const bytes = input.files.get(pathEntry.path);
+      if (!bytes) continue;
+      blobHashes.push(pathEntry.sha256);
+      await cache.put(this.blobUrl(pathEntry.sha256), new Response(responseBody(bytes)));
+      index.blobs[pathEntry.sha256] = {
+        size: byteLength(bytes),
+        lastAccessed: now,
+        refCount: index.blobs[pathEntry.sha256]?.refCount ?? 0
+      };
+    }
+    const key = aggregateKey(input.manifest.dTag, input.manifest.aggregateHash);
+    const record = {
+      schemaVersion: SCHEMA_VERSION,
+      dTag: input.manifest.dTag,
+      aggregateHash: input.manifest.aggregateHash,
+      manifest: {
+        kind: input.manifest.kind,
+        pubkey: input.manifest.pubkey,
+        dTag: input.manifest.dTag,
+        paths: input.manifest.paths.map((entry) => ({ path: entry.path, sha256: entry.sha256 })),
+        requires: [...input.manifest.requires],
+        ...input.manifest.title === void 0 ? {} : { title: input.manifest.title },
+        ...input.manifest.description === void 0 ? {} : { description: input.manifest.description }
+      },
+      indexHtml: input.indexHtml,
+      blobHashes,
+      writtenAt: now
+    };
+    const aggregateBytes = new TextEncoder().encode(JSON.stringify(record));
+    await cache.put(this.aggregateUrl(key), new Response(responseBody(aggregateBytes), {
+      headers: { "content-type": "application/json" }
+    }));
+    const coordKey = coordinateKey(input.manifest.kind, input.manifest.pubkey, input.manifest.dTag);
+    index.aggregates[key] = {
+      dTag: input.manifest.dTag,
+      aggregateHash: input.manifest.aggregateHash,
+      key,
+      blobHashes,
+      size: byteLength(aggregateBytes),
+      lastAccessed: now,
+      coordinateKey: coordKey
+    };
+    index.coordinates[coordKey] = {
+      key: coordKey,
+      kind: input.manifest.kind,
+      pubkey: input.manifest.pubkey,
+      dTag: input.manifest.dTag,
+      aggregateHash: input.manifest.aggregateHash,
+      lastResolvedAt: now,
+      foregroundTtlMs: DEFAULT_FOREGROUND_TTL_MS,
+      backgroundTtlMs: DEFAULT_BACKGROUND_TTL_MS
+    };
+    this.rewriteRefCounts(index);
+    index.updatedAt = now;
+    await this.writeIndex(cache, index);
+    await this.prune(now);
+  }
+  async open() {
+    this.cachePromise ??= this.cacheStorage.open(this.cacheName);
+    return this.cachePromise;
+  }
+  indexUrl() {
+    return new URL("__kehto_napplet_cache/index.json", this.baseUrl).toString();
+  }
+  blobUrl(hash) {
+    return new URL(`__kehto_napplet_cache/blob/${encodeKeyPart(hash)}`, this.baseUrl).toString();
+  }
+  aggregateUrl(key) {
+    return new URL(`__kehto_napplet_cache/aggregate/${encodeKeyPart(key)}.json`, this.baseUrl).toString();
+  }
+  async readIndex(cache) {
+    const response = await cache.match(this.indexUrl());
+    if (!response) return emptyIndex(this.now());
+    try {
+      const index = await responseJson(response);
+      if (index.schemaVersion !== SCHEMA_VERSION) return emptyIndex(this.now());
+      return index;
+    } catch {
+      return emptyIndex(this.now());
+    }
+  }
+  async writeIndex(cache, index) {
+    await cache.put(this.indexUrl(), new Response(JSON.stringify(index), {
+      headers: { "content-type": "application/json" }
+    }));
+  }
+  rewriteRefCounts(index) {
+    const counts = refCounts(index);
+    for (const [hash, blob] of Object.entries(index.blobs)) {
+      blob.refCount = counts[hash] ?? 0;
+    }
+  }
+  async budgetBytes() {
+    const estimate = await this.estimateStorage();
+    if (!estimate?.quota) return this.unknownBudgetBytes;
+    return Math.min(this.softCeilingBytes, Math.floor(estimate.quota * 0.1));
+  }
+  async hardBudgetBytes() {
+    const estimate = await this.estimateStorage();
+    if (!estimate?.quota) return this.unknownBudgetBytes;
+    return Math.min(this.hardCeilingBytes, Math.floor(estimate.quota * 0.2));
+  }
+  async originPressureHigh() {
+    const estimate = await this.estimateStorage();
+    if (!estimate?.quota || estimate.usage === void 0) return false;
+    return estimate.usage / estimate.quota >= 0.8;
+  }
+  async estimateStorage() {
+    if (!this.storage?.estimate) return void 0;
+    try {
+      return this.storage.estimate();
+    } catch (cause) {
+      this.diagnostic({
+        type: "storage-estimate-unavailable",
+        message: "storage estimate failed; using unknown quota cache budget",
+        cause
+      });
+      return void 0;
+    }
+  }
+  diagnostic(diagnostic) {
+    this.onDiagnostic?.(diagnostic);
+  }
+};
+async function openNappletArtifactCache(options = {}) {
+  const cacheStorage = options.cacheStorage ?? globalThis.caches;
+  if (!cacheStorage) return void 0;
+  const storage = options.storage ?? globalThis.navigator?.storage;
+  if (options.requireStorageEstimate && !storage?.estimate) {
+    options.onDiagnostic?.({
+      type: "storage-estimate-unavailable",
+      message: "storage estimates are unavailable; using network-only loading"
+    });
+    return void 0;
+  }
+  try {
+    const cache = new CacheStorageNappletArtifactCache({ ...options, cacheStorage, storage });
+    await cache.snapshotIndex();
+    return cache;
+  } catch (cause) {
+    options.onDiagnostic?.({
+      type: "cache-open-failed",
+      message: "Cache Storage napplet artifact cache could not be opened",
+      cause
+    });
+    return void 0;
+  }
+}
+
+// src/5d/index.ts
+var NAPPLET_KIND_SNAPSHOT = 5129;
+var NAPPLET_KIND_ROOT = 15129;
+var NAPPLET_KIND_NAMED = 35129;
+var NAPPLET_KINDS = [
+  NAPPLET_KIND_SNAPSHOT,
+  NAPPLET_KIND_ROOT,
+  NAPPLET_KIND_NAMED
+];
+function isNappletManifestKind(kind) {
+  return NAPPLET_KINDS.includes(kind);
+}
+var NappletResolutionError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "NappletResolutionError";
+    this.code = code;
+  }
+};
+function firstTagValue(tags, name) {
+  for (const tag of tags) {
+    if (tag[0] === name && typeof tag[1] === "string" && tag[1].length > 0) return tag[1];
+  }
+  return void 0;
+}
+function allTagValues(tags, name) {
+  const out = [];
+  for (const tag of tags) {
+    if (tag[0] === name && typeof tag[1] === "string" && tag[1].length > 0) out.push(tag[1]);
+  }
+  return out;
+}
+function archetypesFromTags(tags) {
+  const out = [];
+  for (const tag of tags) {
+    if (tag[0] !== "archetype") continue;
+    if (typeof tag[1] !== "string" || tag[1].length === 0) continue;
+    out.push(
+      typeof tag[2] === "string" && tag[2].length > 0 ? { slug: tag[1], nap: tag[2] } : { slug: tag[1] }
+    );
+  }
+  return out;
+}
+function parseNappletManifest(event) {
+  if (!isNappletManifestKind(event.kind)) {
+    throw new NappletResolutionError("invalid-manifest", `not a NIP-5D napplet kind: ${event.kind}`);
+  }
+  const paths = pathEntriesFromTags(event.tags);
+  if (paths.length === 0) {
+    throw new NappletResolutionError("invalid-manifest", "manifest has no path tags");
+  }
+  const aggregateHash = aggregateTagValue(event.tags);
+  if (!aggregateHash) {
+    throw new NappletResolutionError("invalid-manifest", "manifest has no aggregate x tag");
+  }
+  return {
+    kind: event.kind,
+    pubkey: event.pubkey,
+    dTag: firstTagValue(event.tags, "d") ?? "",
+    paths,
+    aggregateHash,
+    servers: allTagValues(event.tags, "server"),
+    requires: allTagValues(event.tags, "requires"),
+    archetypes: archetypesFromTags(event.tags),
+    title: firstTagValue(event.tags, "title"),
+    description: firstTagValue(event.tags, "description"),
+    source: firstTagValue(event.tags, "source")
+  };
+}
+function verifyManifestSignature(event) {
+  try {
+    return verifyEvent(event);
+  } catch {
+    return false;
+  }
+}
+function verifyBlobHash(bytes, sha256Hex) {
+  return bytesToHex(sha256(bytes)) === sha256Hex;
+}
+function stripTrailingSlash(url) {
+  return url.endsWith("/") ? url.slice(0, -1) : url;
+}
+async function fetchBlob(servers, sha256Hex, fetchBytes) {
+  for (const server of servers) {
+    const url = `${stripTrailingSlash(server)}/${sha256Hex}`;
+    try {
+      const bytes = await fetchBytes(url);
+      if (verifyBlobHash(bytes, sha256Hex)) return bytes;
+    } catch {
+    }
+  }
+  throw new NappletResolutionError("blob-unavailable", `no server served blob ${sha256Hex}`);
+}
+var INDEX_PATHS = ["/index.html", "index.html", "/"];
+function defaultDecode(bytes) {
+  return new TextDecoder().decode(bytes);
+}
+async function resolveNapplet(options) {
+  const { event, fetchBlob: fetchBlobBytes, textDecode = defaultDecode, cache } = options;
+  if (!verifyManifestSignature(event)) {
+    throw new NappletResolutionError("invalid-signature", "manifest signature is invalid");
+  }
+  const manifest = parseNappletManifest(event);
+  const recomputed = computeAggregateHash(manifest.paths);
+  if (recomputed !== manifest.aggregateHash) {
+    throw new NappletResolutionError(
+      "aggregate-mismatch",
+      `recomputed aggregate ${recomputed} != manifest ${manifest.aggregateHash}`
+    );
+  }
+  const files = /* @__PURE__ */ new Map();
+  for (const entry of manifest.paths) {
+    let bytes = await cache?.readBlob(entry.sha256);
+    if (bytes && !verifyBlobHash(bytes, entry.sha256)) {
+      await cache?.deleteBlob(entry.sha256);
+      bytes = void 0;
+    }
+    bytes ??= await fetchBlobBytes(entry.sha256, manifest.servers);
+    if (!verifyBlobHash(bytes, entry.sha256)) {
+      throw new NappletResolutionError(
+        "blob-hash-mismatch",
+        `blob for ${entry.path} does not match hash ${entry.sha256}`
+      );
+    }
+    files.set(entry.path, bytes);
+  }
+  const indexEntry = manifest.paths.find((e) => INDEX_PATHS.includes(e.path));
+  if (!indexEntry) {
+    throw new NappletResolutionError("missing-index", "manifest has no /index.html entry");
+  }
+  const indexHtml = textDecode(files.get(indexEntry.path));
+  await cache?.writeVerifiedResolution({ event, manifest, files, indexHtml });
+  return {
+    dTag: manifest.dTag,
+    aggregateHash: manifest.aggregateHash,
+    files,
+    indexHtml,
+    manifest
+  };
+}
+
+export {
+  NAPPLET_ARTIFACT_CACHE_NAME,
+  coordinateKey,
+  isCoordinateFresh,
+  CacheStorageNappletArtifactCache,
+  openNappletArtifactCache,
+  NAPPLET_KIND_SNAPSHOT,
+  NAPPLET_KIND_ROOT,
+  NAPPLET_KIND_NAMED,
+  NAPPLET_KINDS,
+  isNappletManifestKind,
+  NappletResolutionError,
+  parseNappletManifest,
+  verifyManifestSignature,
+  verifyBlobHash,
+  fetchBlob,
+  resolveNapplet
+};
+//# sourceMappingURL=chunk-CDBUCFLP.js.map

package/dist/chunk-CDBUCFLP.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/5d/index.ts","../src/5d/artifact-cache.ts"],"sourcesContent":["import type { NostrEvent } from 'nostr-tools';\nimport { verifyEvent } from 'nostr-tools/pure';\nimport { sha256 } from '@noble/hashes/sha2.js';\nimport { bytesToHex } from '@noble/hashes/utils.js';\nimport {\n  computeAggregateHash,\n  pathEntriesFromTags,\n  aggregateTagValue,\n  type PathEntry,\n} from '../5a/index.js';\nimport type { NappletArtifactCache } from './artifact-cache.js';\nexport {\n  CacheStorageNappletArtifactCache,\n  NAPPLET_ARTIFACT_CACHE_NAME,\n  coordinateKey,\n  isCoordinateFresh,\n  openNappletArtifactCache,\n  type CachedCoordinate,\n  type CacheStorageNappletArtifactCacheOptions,\n  type CoordinateFreshnessOptions,\n  type NappletAggregateIndexEntry,\n  type NappletArtifactCacheIndex,\n  type NappletArtifactCache,\n  type NappletBlobIndexEntry,\n  type NappletCacheDiagnostic,\n  type OpenNappletArtifactCacheOptions,\n  type WriteVerifiedResolutionInput,\n} from './artifact-cache.js';\n\n/**\n * `@kehto/nip/5d` — NIP-5D napplet manifest resolution.\n *\n * NIP-5D (`dskvr/nips` branch `nip/5d`) defines content-addressed \"napplet\"\n * web applets published as Nostr events that reference their files by hash\n * (NIP-5A `path` tags + an aggregate `x` tag). A runtime resolves a napplet by:\n *\n * 1. verifying the manifest event's signature,\n * 2. recomputing the NIP-5A aggregate from its `path` tags and checking the\n *    `[\"x\",\"<hex>\",\"aggregate\"]` tag,\n * 3. fetching each referenced blob (e.g. from Blossom) and verifying its hash,\n * 4. assembling the verified `/index.html`.\n *\n * The napplet's identity is the `(dTag, aggregateHash)` tuple **computed** from\n * these verified bytes — it is never accepted from a host or gateway.\n */\n\n/** Snapshot manifest — regular event, immutable point-in-time release. */\nexport const NAPPLET_KIND_SNAPSHOT = 5129;\n/** Root manifest — replaceable event, an author's latest unnamed napplet. */\nexport const NAPPLET_KIND_ROOT = 15129;\n/** Named manifest — addressable event (carries a `d` tag identifier). */\nexport const NAPPLET_KIND_NAMED = 35129;\n\n/** All three NIP-5D napplet manifest kinds. */\nexport const NAPPLET_KINDS: readonly number[] = [\n  NAPPLET_KIND_SNAPSHOT,\n  NAPPLET_KIND_ROOT,\n  NAPPLET_KIND_NAMED,\n];\n\n/**\n * Whether `kind` is one of the three NIP-5D napplet manifest kinds.\n *\n * @param kind - A Nostr event kind\n * @returns `true` for `5129` / `15129` / `35129`\n */\nexport function isNappletManifestKind(kind: number): boolean {\n  return NAPPLET_KINDS.includes(kind);\n}\n\n/**\n * A parsed NIP-5D napplet manifest. All fields are derived from the manifest\n * event's tags; the aggregate is the declared `x` tag (verify it separately\n * with {@link resolveNapplet} or `@kehto/nip/5a` `verifyAggregate`).\n */\nexport interface NappletManifest {\n  /** Manifest event kind (`5129` / `15129` / `35129`). */\n  kind: number;\n  /** Author hex public key. */\n  pubkey: string;\n  /** Named-napplet `d` identifier, or `''` for root/snapshot manifests. */\n  dTag: string;\n  /** File path entries from `path` tags. */\n  paths: PathEntry[];\n  /** Declared aggregate hash from the `[\"x\",\"<hex>\",\"aggregate\"]` tag. */\n  aggregateHash: string;\n  /** Blossom server URL hints from `server` tags. */\n  servers: string[];\n  /** Short NAP capability names from `requires` tags. */\n  requires: string[];\n  /**\n   * Archetype slugs this napplet fulfills, from `archetype` manifest tags; the\n   * optional `nap` is the recommended default wire protocol (the 3rd tag element).\n   */\n  archetypes: Array<{ slug: string; nap?: string }>;\n  /** Optional human title. */\n  title?: string;\n  /** Optional human description. */\n  description?: string;\n  /** Optional upstream source URL from the `source` tag. */\n  source?: string;\n}\n\n/** Error codes for every napplet resolution failure path. */\nexport type NappletResolutionErrorCode =\n  | 'invalid-signature'\n  | 'invalid-manifest'\n  | 'aggregate-mismatch'\n  | 'blob-hash-mismatch'\n  | 'blob-unavailable'\n  | 'missing-index';\n\n/**\n * Thrown on any napplet resolution/verification failure. The `code` field\n * identifies which guard rejected, so callers can fail closed without parsing\n * the message.\n */\nexport class NappletResolutionError extends Error {\n  readonly code: NappletResolutionErrorCode;\n  constructor(code: NappletResolutionErrorCode, message: string) {\n    super(message);\n    this.name = 'NappletResolutionError';\n    this.code = code;\n  }\n}\n\nfunction firstTagValue(tags: readonly (readonly string[])[], name: string): string | undefined {\n  for (const tag of tags) {\n    if (tag[0] === name && typeof tag[1] === 'string' && tag[1].length > 0) return tag[1];\n  }\n  return undefined;\n}\n\nfunction allTagValues(tags: readonly (readonly string[])[], name: string): string[] {\n  const out: string[] = [];\n  for (const tag of tags) {\n    if (tag[0] === name && typeof tag[1] === 'string' && tag[1].length > 0) out.push(tag[1]);\n  }\n  return out;\n}\n\nfunction archetypesFromTags(\n  tags: readonly (readonly string[])[],\n): Array<{ slug: string; nap?: string }> {\n  const out: Array<{ slug: string; nap?: string }> = [];\n  for (const tag of tags) {\n    if (tag[0] !== 'archetype') continue;\n    if (typeof tag[1] !== 'string' || tag[1].length === 0) continue;\n    out.push(\n      typeof tag[2] === 'string' && tag[2].length > 0\n        ? { slug: tag[1], nap: tag[2] }\n        : { slug: tag[1] },\n    );\n  }\n  return out;\n}\n\n/**\n * Parse a NIP-5D manifest event into a {@link NappletManifest}.\n *\n * Does not verify the signature, aggregate, or blobs — use {@link resolveNapplet}\n * for full verification.\n *\n * @param event - A NIP-5D manifest event (`5129` / `15129` / `35129`)\n * @returns The parsed manifest\n * @throws {@link NappletResolutionError} `invalid-manifest` for a non-napplet\n *   kind, missing `path` tags, or a missing aggregate `x` tag\n */\nexport function parseNappletManifest(event: NostrEvent): NappletManifest {\n  if (!isNappletManifestKind(event.kind)) {\n    throw new NappletResolutionError('invalid-manifest', `not a NIP-5D napplet kind: ${event.kind}`);\n  }\n  const paths = pathEntriesFromTags(event.tags);\n  if (paths.length === 0) {\n    throw new NappletResolutionError('invalid-manifest', 'manifest has no path tags');\n  }\n  const aggregateHash = aggregateTagValue(event.tags);\n  if (!aggregateHash) {\n    throw new NappletResolutionError('invalid-manifest', 'manifest has no aggregate x tag');\n  }\n  return {\n    kind: event.kind,\n    pubkey: event.pubkey,\n    dTag: firstTagValue(event.tags, 'd') ?? '',\n    paths,\n    aggregateHash,\n    servers: allTagValues(event.tags, 'server'),\n    requires: allTagValues(event.tags, 'requires'),\n    archetypes: archetypesFromTags(event.tags),\n    title: firstTagValue(event.tags, 'title'),\n    description: firstTagValue(event.tags, 'description'),\n    source: firstTagValue(event.tags, 'source'),\n  };\n}\n\n/**\n * Verify a manifest event's Nostr signature (id + schnorr sig).\n *\n * @param event - A manifest event\n * @returns `true` if the event is internally consistent and validly signed\n */\nexport function verifyManifestSignature(event: NostrEvent): boolean {\n  try {\n    return verifyEvent(event);\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Whether `bytes` hash to the expected lowercase-hex SHA-256.\n *\n * @param bytes - The blob bytes\n * @param sha256Hex - Expected lowercase-hex SHA-256\n * @returns `true` only on an exact match\n */\nexport function verifyBlobHash(bytes: Uint8Array, sha256Hex: string): boolean {\n  return bytesToHex(sha256(bytes)) === sha256Hex;\n}\n\nfunction stripTrailingSlash(url: string): string {\n  return url.endsWith('/') ? url.slice(0, -1) : url;\n}\n\n/**\n * Fetch a blob by SHA-256 from a list of Blossom servers, returning the first\n * server's bytes whose hash matches. The returned bytes are always re-verified\n * against `sha256Hex` — servers (and gateways) are never trusted.\n *\n * @param servers - Candidate Blossom server base URLs, tried in order\n * @param sha256Hex - The blob's lowercase-hex SHA-256\n * @param fetchBytes - Fetches raw bytes for a URL (`<server>/<sha256>`)\n * @returns The verified blob bytes\n * @throws {@link NappletResolutionError} `blob-unavailable` if no server serves\n *   a hash-matching blob\n */\nexport async function fetchBlob(\n  servers: readonly string[],\n  sha256Hex: string,\n  fetchBytes: (url: string) => Promise<Uint8Array>,\n): Promise<Uint8Array> {\n  for (const server of servers) {\n    const url = `${stripTrailingSlash(server)}/${sha256Hex}`;\n    try {\n      const bytes = await fetchBytes(url);\n      if (verifyBlobHash(bytes, sha256Hex)) return bytes;\n    } catch {\n      // try the next server\n    }\n  }\n  throw new NappletResolutionError('blob-unavailable', `no server served blob ${sha256Hex}`);\n}\n\n/** A fully verified napplet, ready to inject via `iframe.srcdoc`. */\nexport interface ResolvedNapplet {\n  /** Computed `d` identifier (`''` for root/snapshot). */\n  dTag: string;\n  /** Computed (and verified) aggregate hash — the content address. */\n  aggregateHash: string;\n  /** Verified file bytes keyed by manifest path. */\n  files: Map<string, Uint8Array>;\n  /** The verified `/index.html` decoded to text. */\n  indexHtml: string;\n  /** The parsed manifest. */\n  manifest: NappletManifest;\n}\n\n/** Options for {@link resolveNapplet}. */\nexport interface ResolveNappletOptions {\n  /** The candidate manifest event (resolved from relays by the caller). */\n  event: NostrEvent;\n  /**\n   * Fetch raw blob bytes by SHA-256. Backed by Blossom (or a gateway) by the\n   * caller. The bytes are re-verified against the hash here, so the fetcher is\n   * untrusted.\n   */\n  fetchBlob: (sha256Hex: string, servers: readonly string[]) => Promise<Uint8Array>;\n  /** Decode blob bytes to text for `indexHtml` (default UTF-8). */\n  textDecode?: (bytes: Uint8Array) => string;\n  /**\n   * Optional verified artifact cache. Cache hits are still re-verified against\n   * the manifest hash before use; cache writes happen only after the signature,\n   * aggregate, and every blob hash have been verified.\n   */\n  cache?: NappletArtifactCache;\n}\n\nconst INDEX_PATHS = ['/index.html', 'index.html', '/'];\n\nfunction defaultDecode(bytes: Uint8Array): string {\n  return new TextDecoder().decode(bytes);\n}\n\n/**\n * Resolve a napplet end-to-end from a candidate manifest event: verify the\n * signature, parse the manifest, verify the NIP-5A aggregate, fetch and verify\n * every blob, then assemble the verified `/index.html`.\n *\n * The returned `(dTag, aggregateHash)` is computed from the verified bytes and\n * is the napplet's identity. Any failure throws a {@link NappletResolutionError}\n * — the caller must fail closed (never render unverified bytes).\n *\n * @param options - {@link ResolveNappletOptions}\n * @returns The {@link ResolvedNapplet}\n * @throws {@link NappletResolutionError} on signature, manifest, aggregate,\n *   blob-hash, blob-availability, or missing-index failures\n *\n * @example\n * ```ts\n * import { resolveNapplet } from '@kehto/nip/5d';\n * const napplet = await resolveNapplet({ event, fetchBlob });\n * iframe.srcdoc = napplet.indexHtml; // sandbox=\"allow-scripts\", opaque origin\n * ```\n */\nexport async function resolveNapplet(options: ResolveNappletOptions): Promise<ResolvedNapplet> {\n  const { event, fetchBlob: fetchBlobBytes, textDecode = defaultDecode, cache } = options;\n\n  if (!verifyManifestSignature(event)) {\n    throw new NappletResolutionError('invalid-signature', 'manifest signature is invalid');\n  }\n\n  const manifest = parseNappletManifest(event);\n\n  const recomputed = computeAggregateHash(manifest.paths);\n  if (recomputed !== manifest.aggregateHash) {\n    throw new NappletResolutionError(\n      'aggregate-mismatch',\n      `recomputed aggregate ${recomputed} != manifest ${manifest.aggregateHash}`,\n    );\n  }\n\n  const files = new Map<string, Uint8Array>();\n  for (const entry of manifest.paths) {\n    let bytes = await cache?.readBlob(entry.sha256);\n    if (bytes && !verifyBlobHash(bytes, entry.sha256)) {\n      await cache?.deleteBlob(entry.sha256);\n      bytes = undefined;\n    }\n    bytes ??= await fetchBlobBytes(entry.sha256, manifest.servers);\n    if (!verifyBlobHash(bytes, entry.sha256)) {\n      throw new NappletResolutionError(\n        'blob-hash-mismatch',\n        `blob for ${entry.path} does not match hash ${entry.sha256}`,\n      );\n    }\n    files.set(entry.path, bytes);\n  }\n\n  const indexEntry = manifest.paths.find((e) => INDEX_PATHS.includes(e.path));\n  if (!indexEntry) {\n    throw new NappletResolutionError('missing-index', 'manifest has no /index.html entry');\n  }\n\n  const indexHtml = textDecode(files.get(indexEntry.path)!);\n  await cache?.writeVerifiedResolution({ event, manifest, files, indexHtml });\n\n  return {\n    dTag: manifest.dTag,\n    aggregateHash: manifest.aggregateHash,\n    files,\n    indexHtml,\n    manifest,\n  };\n}\n","import type { NostrEvent } from 'nostr-tools';\nimport type { NappletManifest } from './index.js';\n\nconst MIB = 1024 * 1024;\n\n/** Versioned Cache Storage namespace for verified napplet artifacts. */\nexport const NAPPLET_ARTIFACT_CACHE_NAME = 'kehto:napplet-artifacts:v1';\nconst SCHEMA_VERSION = 1;\nconst DEFAULT_BASE_URL = 'https://kehto.invalid';\nconst DEFAULT_UNKNOWN_BUDGET_BYTES = 32 * MIB;\nconst DEFAULT_SOFT_CEILING_BYTES = 128 * MIB;\nconst DEFAULT_HARD_CEILING_BYTES = 256 * MIB;\nconst DEFAULT_FOREGROUND_TTL_MS = 15 * 60 * 1000;\nconst DEFAULT_BACKGROUND_TTL_MS = 60 * 60 * 1000;\n\nexport interface NappletCacheDiagnostic {\n  type:\n    | 'cache-open-failed'\n    | 'cache-read-failed'\n    | 'cache-write-failed'\n    | 'cache-delete-failed'\n    | 'cache-prune-failed'\n    | 'storage-estimate-unavailable';\n  message: string;\n  cause?: unknown;\n}\n\nexport interface NappletBlobIndexEntry {\n  size: number;\n  lastAccessed: number;\n  refCount: number;\n}\n\nexport interface NappletAggregateIndexEntry {\n  dTag: string;\n  aggregateHash: string;\n  key: string;\n  blobHashes: string[];\n  size: number;\n  lastAccessed: number;\n  coordinateKey?: string;\n  pinned?: boolean;\n}\n\nexport interface CachedCoordinate {\n  key: string;\n  kind: number;\n  pubkey: string;\n  dTag: string;\n  aggregateHash: string;\n  lastResolvedAt: number;\n  foregroundTtlMs: number;\n  backgroundTtlMs: number;\n}\n\nexport interface NappletArtifactCacheIndex {\n  schemaVersion: number;\n  updatedAt: number;\n  blobs: Record<string, NappletBlobIndexEntry>;\n  aggregates: Record<string, NappletAggregateIndexEntry>;\n  coordinates: Record<string, CachedCoordinate>;\n}\n\ninterface AggregateRecord {\n  schemaVersion: number;\n  dTag: string;\n  aggregateHash: string;\n  manifest: {\n    kind: number;\n    pubkey: string;\n    dTag: string;\n    paths: Array<{ path: string; sha256: string }>;\n    requires: string[];\n    title?: string;\n    description?: string;\n  };\n  indexHtml: string;\n  blobHashes: string[];\n  writtenAt: number;\n}\n\nexport interface WriteVerifiedResolutionInput {\n  event: NostrEvent;\n  manifest: NappletManifest;\n  files: ReadonlyMap<string, Uint8Array>;\n  indexHtml: string;\n  now?: number;\n}\n\nexport interface CoordinateFreshnessOptions {\n  now?: number;\n  background?: boolean;\n}\n\nexport interface NappletArtifactCache {\n  readBlob(sha256Hex: string): Promise<Uint8Array | undefined>;\n  deleteBlob(sha256Hex: string): Promise<void>;\n  writeVerifiedResolution(input: WriteVerifiedResolutionInput): Promise<void>;\n  writeCoordinate(input: {\n    kind: number;\n    pubkey: string;\n    dTag: string;\n    aggregateHash: string;\n    lastResolvedAt?: number;\n    foregroundTtlMs?: number;\n    backgroundTtlMs?: number;\n  }): Promise<void>;\n  getCoordinate(input: {\n    kind: number;\n    pubkey: string;\n    dTag: string;\n  }, options?: CoordinateFreshnessOptions): Promise<(CachedCoordinate & { fresh: boolean }) | undefined>;\n  touchAggregate(dTag: string, aggregateHash: string, now?: number): Promise<void>;\n  markAggregateActive(dTag: string, aggregateHash: string): void;\n  releaseAggregateActive(dTag: string, aggregateHash: string): void;\n  prune(now?: number): Promise<void>;\n}\n\nexport interface CacheStorageNappletArtifactCacheOptions {\n  cacheStorage?: CacheStorage;\n  storage?: StorageManager;\n  cacheName?: string;\n  baseUrl?: string;\n  now?: () => number;\n  onDiagnostic?: (diagnostic: NappletCacheDiagnostic) => void;\n  unknownBudgetBytes?: number;\n  softCeilingBytes?: number;\n  hardCeilingBytes?: number;\n}\n\nexport interface OpenNappletArtifactCacheOptions extends CacheStorageNappletArtifactCacheOptions {\n  requireStorageEstimate?: boolean;\n}\n\nfunction emptyIndex(now: number): NappletArtifactCacheIndex {\n  return {\n    schemaVersion: SCHEMA_VERSION,\n    updatedAt: now,\n    blobs: {},\n    aggregates: {},\n    coordinates: {},\n  };\n}\n\nfunction aggregateKey(dTag: string, aggregateHash: string): string {\n  return `${encodeURIComponent(dTag)}:${aggregateHash}`;\n}\n\nexport function coordinateKey(kind: number, pubkey: string, dTag: string): string {\n  return `${kind}:${pubkey}:${encodeURIComponent(dTag)}`;\n}\n\nexport function isCoordinateFresh(\n  coordinate: CachedCoordinate,\n  options: CoordinateFreshnessOptions = {},\n): boolean {\n  const now = options.now ?? Date.now();\n  const ttl = options.background ? coordinate.backgroundTtlMs : coordinate.foregroundTtlMs;\n  return ttl === Number.POSITIVE_INFINITY || now - coordinate.lastResolvedAt <= ttl;\n}\n\nfunction byteLength(bytes: Uint8Array): number {\n  return bytes.byteLength;\n}\n\nfunction encodeKeyPart(value: string): string {\n  return encodeURIComponent(value).replaceAll('%2F', '%252F');\n}\n\nfunction cloneBytes(bytes: Uint8Array): Uint8Array {\n  return new Uint8Array(bytes);\n}\n\nfunction responseBody(bytes: Uint8Array): ArrayBuffer {\n  return cloneBytes(bytes).buffer as ArrayBuffer;\n}\n\nfunction normalizeBaseUrl(baseUrl: string): string {\n  return baseUrl.endsWith('/') ? baseUrl : `${baseUrl}/`;\n}\n\nfunction resolveBaseUrl(baseUrl?: string): string {\n  if (baseUrl) return normalizeBaseUrl(baseUrl);\n  const maybeLocation = globalThis as typeof globalThis & { location?: { origin?: string } };\n  if (maybeLocation.location?.origin) return normalizeBaseUrl(maybeLocation.location.origin);\n  return normalizeBaseUrl(DEFAULT_BASE_URL);\n}\n\nasync function responseBytes(response: Response): Promise<Uint8Array> {\n  return new Uint8Array(await response.arrayBuffer());\n}\n\nasync function responseJson<T>(response: Response): Promise<T> {\n  return response.json() as Promise<T>;\n}\n\nfunction refCounts(index: NappletArtifactCacheIndex): Record<string, number> {\n  const counts: Record<string, number> = {};\n  for (const aggregate of Object.values(index.aggregates)) {\n    for (const hash of aggregate.blobHashes) counts[hash] = (counts[hash] ?? 0) + 1;\n  }\n  return counts;\n}\n\nfunction cachedSize(index: NappletArtifactCacheIndex): number {\n  const blobBytes = Object.values(index.blobs).reduce((sum, entry) => sum + entry.size, 0);\n  const aggregateBytes = Object.values(index.aggregates).reduce((sum, entry) => sum + entry.size, 0);\n  return blobBytes + aggregateBytes;\n}\n\nexport class CacheStorageNappletArtifactCache implements NappletArtifactCache {\n  private readonly cacheStorage: CacheStorage;\n  private readonly storage?: StorageManager;\n  private readonly cacheName: string;\n  private readonly baseUrl: string;\n  private readonly now: () => number;\n  private readonly activeAggregates = new Set<string>();\n  private readonly onDiagnostic?: (diagnostic: NappletCacheDiagnostic) => void;\n  private readonly unknownBudgetBytes: number;\n  private readonly softCeilingBytes: number;\n  private readonly hardCeilingBytes: number;\n  private cachePromise?: Promise<Cache>;\n\n  constructor(options: CacheStorageNappletArtifactCacheOptions = {}) {\n    const maybeCacheStorage = options.cacheStorage ?? (globalThis as typeof globalThis & { caches?: CacheStorage }).caches;\n    if (!maybeCacheStorage) {\n      throw new Error('Cache Storage is unavailable');\n    }\n    this.cacheStorage = maybeCacheStorage;\n    this.storage = options.storage ?? (globalThis.navigator as Navigator | undefined)?.storage;\n    this.cacheName = options.cacheName ?? NAPPLET_ARTIFACT_CACHE_NAME;\n    this.baseUrl = resolveBaseUrl(options.baseUrl);\n    this.now = options.now ?? Date.now;\n    this.onDiagnostic = options.onDiagnostic;\n    this.unknownBudgetBytes = options.unknownBudgetBytes ?? DEFAULT_UNKNOWN_BUDGET_BYTES;\n    this.softCeilingBytes = options.softCeilingBytes ?? DEFAULT_SOFT_CEILING_BYTES;\n    this.hardCeilingBytes = options.hardCeilingBytes ?? DEFAULT_HARD_CEILING_BYTES;\n  }\n\n  async readBlob(sha256Hex: string): Promise<Uint8Array | undefined> {\n    try {\n      const cache = await this.open();\n      const response = await cache.match(this.blobUrl(sha256Hex));\n      if (!response) return undefined;\n      const bytes = await responseBytes(response);\n      const index = await this.readIndex(cache);\n      const entry = index.blobs[sha256Hex];\n      if (entry) {\n        entry.lastAccessed = this.now();\n        index.updatedAt = entry.lastAccessed;\n        await this.writeIndex(cache, index);\n      }\n      return bytes;\n    } catch (cause) {\n      this.diagnostic({ type: 'cache-read-failed', message: `failed to read blob ${sha256Hex}`, cause });\n      return undefined;\n    }\n  }\n\n  async deleteBlob(sha256Hex: string): Promise<void> {\n    try {\n      const cache = await this.open();\n      await cache.delete(this.blobUrl(sha256Hex));\n      const index = await this.readIndex(cache);\n      delete index.blobs[sha256Hex];\n      index.updatedAt = this.now();\n      await this.writeIndex(cache, index);\n    } catch (cause) {\n      this.diagnostic({ type: 'cache-delete-failed', message: `failed to delete blob ${sha256Hex}`, cause });\n    }\n  }\n\n  async writeVerifiedResolution(input: WriteVerifiedResolutionInput): Promise<void> {\n    try {\n      await this.writeVerifiedResolutionOnce(input);\n    } catch (firstCause) {\n      try {\n        await this.prune(input.now ?? this.now());\n        await this.writeVerifiedResolutionOnce(input);\n      } catch (cause) {\n        this.diagnostic({\n          type: 'cache-write-failed',\n          message: 'failed to write verified napplet artifacts after prune retry',\n          cause: cause ?? firstCause,\n        });\n      }\n    }\n  }\n\n  async writeCoordinate(input: {\n    kind: number;\n    pubkey: string;\n    dTag: string;\n    aggregateHash: string;\n    lastResolvedAt?: number;\n    foregroundTtlMs?: number;\n    backgroundTtlMs?: number;\n  }): Promise<void> {\n    const cache = await this.open();\n    const now = this.now();\n    const index = await this.readIndex(cache);\n    const key = coordinateKey(input.kind, input.pubkey, input.dTag);\n    index.coordinates[key] = {\n      key,\n      kind: input.kind,\n      pubkey: input.pubkey,\n      dTag: input.dTag,\n      aggregateHash: input.aggregateHash,\n      lastResolvedAt: input.lastResolvedAt ?? now,\n      foregroundTtlMs: input.foregroundTtlMs ?? DEFAULT_FOREGROUND_TTL_MS,\n      backgroundTtlMs: input.backgroundTtlMs ?? DEFAULT_BACKGROUND_TTL_MS,\n    };\n    index.updatedAt = now;\n    await this.writeIndex(cache, index);\n  }\n\n  async getCoordinate(\n    input: { kind: number; pubkey: string; dTag: string },\n    options: CoordinateFreshnessOptions = {},\n  ): Promise<(CachedCoordinate & { fresh: boolean }) | undefined> {\n    const cache = await this.open();\n    const index = await this.readIndex(cache);\n    const coordinate = index.coordinates[coordinateKey(input.kind, input.pubkey, input.dTag)];\n    if (!coordinate) return undefined;\n    return { ...coordinate, fresh: isCoordinateFresh(coordinate, options) };\n  }\n\n  async touchAggregate(dTag: string, aggregateHash: string, now = this.now()): Promise<void> {\n    const cache = await this.open();\n    const index = await this.readIndex(cache);\n    const key = aggregateKey(dTag, aggregateHash);\n    const aggregate = index.aggregates[key];\n    if (!aggregate) return;\n    aggregate.lastAccessed = now;\n    for (const hash of aggregate.blobHashes) {\n      if (index.blobs[hash]) index.blobs[hash].lastAccessed = now;\n    }\n    index.updatedAt = now;\n    await this.writeIndex(cache, index);\n  }\n\n  markAggregateActive(dTag: string, aggregateHash: string): void {\n    this.activeAggregates.add(aggregateKey(dTag, aggregateHash));\n  }\n\n  releaseAggregateActive(dTag: string, aggregateHash: string): void {\n    this.activeAggregates.delete(aggregateKey(dTag, aggregateHash));\n  }\n\n  async prune(now = this.now()): Promise<void> {\n    try {\n      const cache = await this.open();\n      const index = await this.readIndex(cache);\n      let size = cachedSize(index);\n      const budget = await this.budgetBytes();\n      const hardBudget = await this.hardBudgetBytes();\n      const shouldPrune = size > budget || await this.originPressureHigh();\n      if (!shouldPrune) return;\n\n      this.rewriteRefCounts(index);\n\n      for (const [hash, blob] of Object.entries(index.blobs)) {\n        if (size <= budget) break;\n        if (blob.refCount > 0) continue;\n        await cache.delete(this.blobUrl(hash));\n        delete index.blobs[hash];\n        size -= blob.size;\n      }\n\n      const currentAggregateHashes = new Set(\n        Object.values(index.coordinates).map((coordinate) => coordinate.aggregateHash),\n      );\n      const aggregates = Object.values(index.aggregates)\n        .filter((entry) => !this.activeAggregates.has(entry.key))\n        .sort((a, b) => {\n          const currentA = currentAggregateHashes.has(a.aggregateHash) ? 1 : 0;\n          const currentB = currentAggregateHashes.has(b.aggregateHash) ? 1 : 0;\n          if (currentA !== currentB) return currentA - currentB;\n          return a.lastAccessed - b.lastAccessed;\n        });\n\n      for (const aggregate of aggregates) {\n        if (size <= budget) break;\n        await cache.delete(this.aggregateUrl(aggregate.key));\n        delete index.aggregates[aggregate.key];\n        size -= aggregate.size;\n        this.rewriteRefCounts(index);\n      }\n\n      if (size > hardBudget) {\n        const active = Object.values(index.aggregates)\n          .filter((entry) => this.activeAggregates.has(entry.key))\n          .sort((a, b) => a.lastAccessed - b.lastAccessed);\n        for (const aggregate of active) {\n          if (size <= hardBudget) break;\n          await cache.delete(this.aggregateUrl(aggregate.key));\n          delete index.aggregates[aggregate.key];\n          size -= aggregate.size;\n        }\n      }\n\n      this.rewriteRefCounts(index);\n      for (const [hash, blob] of Object.entries(index.blobs)) {\n        if (blob.refCount === 0) {\n          await cache.delete(this.blobUrl(hash));\n          delete index.blobs[hash];\n        }\n      }\n      index.updatedAt = now;\n      await this.writeIndex(cache, index);\n    } catch (cause) {\n      this.diagnostic({ type: 'cache-prune-failed', message: 'failed to prune napplet artifact cache', cause });\n    }\n  }\n\n  async snapshotIndex(): Promise<NappletArtifactCacheIndex> {\n    return this.readIndex(await this.open());\n  }\n\n  private async writeVerifiedResolutionOnce(input: WriteVerifiedResolutionInput): Promise<void> {\n    const cache = await this.open();\n    const now = input.now ?? this.now();\n    const index = await this.readIndex(cache);\n    const blobHashes: string[] = [];\n\n    for (const pathEntry of input.manifest.paths) {\n      const bytes = input.files.get(pathEntry.path);\n      if (!bytes) continue;\n      blobHashes.push(pathEntry.sha256);\n      await cache.put(this.blobUrl(pathEntry.sha256), new Response(responseBody(bytes)));\n      index.blobs[pathEntry.sha256] = {\n        size: byteLength(bytes),\n        lastAccessed: now,\n        refCount: index.blobs[pathEntry.sha256]?.refCount ?? 0,\n      };\n    }\n\n    const key = aggregateKey(input.manifest.dTag, input.manifest.aggregateHash);\n    const record: AggregateRecord = {\n      schemaVersion: SCHEMA_VERSION,\n      dTag: input.manifest.dTag,\n      aggregateHash: input.manifest.aggregateHash,\n      manifest: {\n        kind: input.manifest.kind,\n        pubkey: input.manifest.pubkey,\n        dTag: input.manifest.dTag,\n        paths: input.manifest.paths.map((entry) => ({ path: entry.path, sha256: entry.sha256 })),\n        requires: [...input.manifest.requires],\n        ...(input.manifest.title === undefined ? {} : { title: input.manifest.title }),\n        ...(input.manifest.description === undefined ? {} : { description: input.manifest.description }),\n      },\n      indexHtml: input.indexHtml,\n      blobHashes,\n      writtenAt: now,\n    };\n    const aggregateBytes = new TextEncoder().encode(JSON.stringify(record));\n    await cache.put(this.aggregateUrl(key), new Response(responseBody(aggregateBytes), {\n      headers: { 'content-type': 'application/json' },\n    }));\n\n    const coordKey = coordinateKey(input.manifest.kind, input.manifest.pubkey, input.manifest.dTag);\n    index.aggregates[key] = {\n      dTag: input.manifest.dTag,\n      aggregateHash: input.manifest.aggregateHash,\n      key,\n      blobHashes,\n      size: byteLength(aggregateBytes),\n      lastAccessed: now,\n      coordinateKey: coordKey,\n    };\n    index.coordinates[coordKey] = {\n      key: coordKey,\n      kind: input.manifest.kind,\n      pubkey: input.manifest.pubkey,\n      dTag: input.manifest.dTag,\n      aggregateHash: input.manifest.aggregateHash,\n      lastResolvedAt: now,\n      foregroundTtlMs: DEFAULT_FOREGROUND_TTL_MS,\n      backgroundTtlMs: DEFAULT_BACKGROUND_TTL_MS,\n    };\n\n    this.rewriteRefCounts(index);\n    index.updatedAt = now;\n    await this.writeIndex(cache, index);\n    await this.prune(now);\n  }\n\n  private async open(): Promise<Cache> {\n    this.cachePromise ??= this.cacheStorage.open(this.cacheName);\n    return this.cachePromise;\n  }\n\n  private indexUrl(): string {\n    return new URL('__kehto_napplet_cache/index.json', this.baseUrl).toString();\n  }\n\n  private blobUrl(hash: string): string {\n    return new URL(`__kehto_napplet_cache/blob/${encodeKeyPart(hash)}`, this.baseUrl).toString();\n  }\n\n  private aggregateUrl(key: string): string {\n    return new URL(`__kehto_napplet_cache/aggregate/${encodeKeyPart(key)}.json`, this.baseUrl).toString();\n  }\n\n  private async readIndex(cache: Cache): Promise<NappletArtifactCacheIndex> {\n    const response = await cache.match(this.indexUrl());\n    if (!response) return emptyIndex(this.now());\n    try {\n      const index = await responseJson<NappletArtifactCacheIndex>(response);\n      if (index.schemaVersion !== SCHEMA_VERSION) return emptyIndex(this.now());\n      return index;\n    } catch {\n      return emptyIndex(this.now());\n    }\n  }\n\n  private async writeIndex(cache: Cache, index: NappletArtifactCacheIndex): Promise<void> {\n    await cache.put(this.indexUrl(), new Response(JSON.stringify(index), {\n      headers: { 'content-type': 'application/json' },\n    }));\n  }\n\n  private rewriteRefCounts(index: NappletArtifactCacheIndex): void {\n    const counts = refCounts(index);\n    for (const [hash, blob] of Object.entries(index.blobs)) {\n      blob.refCount = counts[hash] ?? 0;\n    }\n  }\n\n  private async budgetBytes(): Promise<number> {\n    const estimate = await this.estimateStorage();\n    if (!estimate?.quota) return this.unknownBudgetBytes;\n    return Math.min(this.softCeilingBytes, Math.floor(estimate.quota * 0.1));\n  }\n\n  private async hardBudgetBytes(): Promise<number> {\n    const estimate = await this.estimateStorage();\n    if (!estimate?.quota) return this.unknownBudgetBytes;\n    return Math.min(this.hardCeilingBytes, Math.floor(estimate.quota * 0.2));\n  }\n\n  private async originPressureHigh(): Promise<boolean> {\n    const estimate = await this.estimateStorage();\n    if (!estimate?.quota || estimate.usage === undefined) return false;\n    return estimate.usage / estimate.quota >= 0.8;\n  }\n\n  private async estimateStorage(): Promise<StorageEstimate | undefined> {\n    if (!this.storage?.estimate) return undefined;\n    try {\n      return this.storage.estimate();\n    } catch (cause) {\n      this.diagnostic({\n        type: 'storage-estimate-unavailable',\n        message: 'storage estimate failed; using unknown quota cache budget',\n        cause,\n      });\n      return undefined;\n    }\n  }\n\n  private diagnostic(diagnostic: NappletCacheDiagnostic): void {\n    this.onDiagnostic?.(diagnostic);\n  }\n}\n\nexport async function openNappletArtifactCache(\n  options: OpenNappletArtifactCacheOptions = {},\n): Promise<CacheStorageNappletArtifactCache | undefined> {\n  const cacheStorage = options.cacheStorage ?? (globalThis as typeof globalThis & { caches?: CacheStorage }).caches;\n  if (!cacheStorage) return undefined;\n  const storage = options.storage ?? (globalThis.navigator as Navigator | undefined)?.storage;\n  if (options.requireStorageEstimate && !storage?.estimate) {\n    options.onDiagnostic?.({\n      type: 'storage-estimate-unavailable',\n      message: 'storage estimates are unavailable; using network-only loading',\n    });\n    return undefined;\n  }\n  try {\n    const cache = new CacheStorageNappletArtifactCache({ ...options, cacheStorage, storage });\n    await cache.snapshotIndex();\n    return cache;\n  } catch (cause) {\n    options.onDiagnostic?.({\n      type: 'cache-open-failed',\n      message: 'Cache Storage napplet artifact cache could not be opened',\n      cause,\n    });\n    return undefined;\n  }\n}\n"],"mappings":";;;;;;;AACA,SAAS,mBAAmB;AAC5B,SAAS,cAAc;AACvB,SAAS,kBAAkB;;;ACA3B,IAAM,MAAM,OAAO;AAGZ,IAAM,8BAA8B;AAC3C,IAAM,iBAAiB;AACvB,IAAM,mBAAmB;AACzB,IAAM,+BAA+B,KAAK;AAC1C,IAAM,6BAA6B,MAAM;AACzC,IAAM,6BAA6B,MAAM;AACzC,IAAM,4BAA4B,KAAK,KAAK;AAC5C,IAAM,4BAA4B,KAAK,KAAK;AAyH5C,SAAS,WAAW,KAAwC;AAC1D,SAAO;AAAA,IACL,eAAe;AAAA,IACf,WAAW;AAAA,IACX,OAAO,CAAC;AAAA,IACR,YAAY,CAAC;AAAA,IACb,aAAa,CAAC;AAAA,EAChB;AACF;AAEA,SAAS,aAAa,MAAc,eAA+B;AACjE,SAAO,GAAG,mBAAmB,IAAI,CAAC,IAAI,aAAa;AACrD;AAEO,SAAS,cAAc,MAAc,QAAgB,MAAsB;AAChF,SAAO,GAAG,IAAI,IAAI,MAAM,IAAI,mBAAmB,IAAI,CAAC;AACtD;AAEO,SAAS,kBACd,YACA,UAAsC,CAAC,GAC9B;AACT,QAAM,MAAM,QAAQ,OAAO,KAAK,IAAI;AACpC,QAAM,MAAM,QAAQ,aAAa,WAAW,kBAAkB,WAAW;AACzE,SAAO,QAAQ,OAAO,qBAAqB,MAAM,WAAW,kBAAkB;AAChF;AAEA,SAAS,WAAW,OAA2B;AAC7C,SAAO,MAAM;AACf;AAEA,SAAS,cAAc,OAAuB;AAC5C,SAAO,mBAAmB,KAAK,EAAE,WAAW,OAAO,OAAO;AAC5D;AAEA,SAAS,WAAW,OAA+B;AACjD,SAAO,IAAI,WAAW,KAAK;AAC7B;AAEA,SAAS,aAAa,OAAgC;AACpD,SAAO,WAAW,KAAK,EAAE;AAC3B;AAEA,SAAS,iBAAiB,SAAyB;AACjD,SAAO,QAAQ,SAAS,GAAG,IAAI,UAAU,GAAG,OAAO;AACrD;AAEA,SAAS,eAAe,SAA0B;AAChD,MAAI,QAAS,QAAO,iBAAiB,OAAO;AAC5C,QAAM,gBAAgB;AACtB,MAAI,cAAc,UAAU,OAAQ,QAAO,iBAAiB,cAAc,SAAS,MAAM;AACzF,SAAO,iBAAiB,gBAAgB;AAC1C;AAEA,eAAe,cAAc,UAAyC;AACpE,SAAO,IAAI,WAAW,MAAM,SAAS,YAAY,CAAC;AACpD;AAEA,eAAe,aAAgB,UAAgC;AAC7D,SAAO,SAAS,KAAK;AACvB;AAEA,SAAS,UAAU,OAA0D;AAC3E,QAAM,SAAiC,CAAC;AACxC,aAAW,aAAa,OAAO,OAAO,MAAM,UAAU,GAAG;AACvD,eAAW,QAAQ,UAAU,WAAY,QAAO,IAAI,KAAK,OAAO,IAAI,KAAK,KAAK;AAAA,EAChF;AACA,SAAO;AACT;AAEA,SAAS,WAAW,OAA0C;AAC5D,QAAM,YAAY,OAAO,OAAO,MAAM,KAAK,EAAE,OAAO,CAAC,KAAK,UAAU,MAAM,MAAM,MAAM,CAAC;AACvF,QAAM,iBAAiB,OAAO,OAAO,MAAM,UAAU,EAAE,OAAO,CAAC,KAAK,UAAU,MAAM,MAAM,MAAM,CAAC;AACjG,SAAO,YAAY;AACrB;AAEO,IAAM,mCAAN,MAAuE;AAAA,EAC3D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,mBAAmB,oBAAI,IAAY;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACT;AAAA,EAER,YAAY,UAAmD,CAAC,GAAG;AACjE,UAAM,oBAAoB,QAAQ,gBAAiB,WAA6D;AAChH,QAAI,CAAC,mBAAmB;AACtB,YAAM,IAAI,MAAM,8BAA8B;AAAA,IAChD;AACA,SAAK,eAAe;AACpB,SAAK,UAAU,QAAQ,WAAY,WAAW,WAAqC;AACnF,SAAK,YAAY,QAAQ,aAAa;AACtC,SAAK,UAAU,eAAe,QAAQ,OAAO;AAC7C,SAAK,MAAM,QAAQ,OAAO,KAAK;AAC/B,SAAK,eAAe,QAAQ;AAC5B,SAAK,qBAAqB,QAAQ,sBAAsB;AACxD,SAAK,mBAAmB,QAAQ,oBAAoB;AACpD,SAAK,mBAAmB,QAAQ,oBAAoB;AAAA,EACtD;AAAA,EAEA,MAAM,SAAS,WAAoD;AACjE,QAAI;AACF,YAAM,QAAQ,MAAM,KAAK,KAAK;AAC9B,YAAM,WAAW,MAAM,MAAM,MAAM,KAAK,QAAQ,SAAS,CAAC;AAC1D,UAAI,CAAC,SAAU,QAAO;AACtB,YAAM,QAAQ,MAAM,cAAc,QAAQ;AAC1C,YAAM,QAAQ,MAAM,KAAK,UAAU,KAAK;AACxC,YAAM,QAAQ,MAAM,MAAM,SAAS;AACnC,UAAI,OAAO;AACT,cAAM,eAAe,KAAK,IAAI;AAC9B,cAAM,YAAY,MAAM;AACxB,cAAM,KAAK,WAAW,OAAO,KAAK;AAAA,MACpC;AACA,aAAO;AAAA,IACT,SAAS,OAAO;AACd,WAAK,WAAW,EAAE,MAAM,qBAAqB,SAAS,uBAAuB,SAAS,IAAI,MAAM,CAAC;AACjG,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAM,WAAW,WAAkC;AACjD,QAAI;AACF,YAAM,QAAQ,MAAM,KAAK,KAAK;AAC9B,YAAM,MAAM,OAAO,KAAK,QAAQ,SAAS,CAAC;AAC1C,YAAM,QAAQ,MAAM,KAAK,UAAU,KAAK;AACxC,aAAO,MAAM,MAAM,SAAS;AAC5B,YAAM,YAAY,KAAK,IAAI;AAC3B,YAAM,KAAK,WAAW,OAAO,KAAK;AAAA,IACpC,SAAS,OAAO;AACd,WAAK,WAAW,EAAE,MAAM,uBAAuB,SAAS,yBAAyB,SAAS,IAAI,MAAM,CAAC;AAAA,IACvG;AAAA,EACF;AAAA,EAEA,MAAM,wBAAwB,OAAoD;AAChF,QAAI;AACF,YAAM,KAAK,4BAA4B,KAAK;AAAA,IAC9C,SAAS,YAAY;AACnB,UAAI;AACF,cAAM,KAAK,MAAM,MAAM,OAAO,KAAK,IAAI,CAAC;AACxC,cAAM,KAAK,4BAA4B,KAAK;AAAA,MAC9C,SAAS,OAAO;AACd,aAAK,WAAW;AAAA,UACd,MAAM;AAAA,UACN,SAAS;AAAA,UACT,OAAO,SAAS;AAAA,QAClB,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,gBAAgB,OAQJ;AAChB,UAAM,QAAQ,MAAM,KAAK,KAAK;AAC9B,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,QAAQ,MAAM,KAAK,UAAU,KAAK;AACxC,UAAM,MAAM,cAAc,MAAM,MAAM,MAAM,QAAQ,MAAM,IAAI;AAC9D,UAAM,YAAY,GAAG,IAAI;AAAA,MACvB;AAAA,MACA,MAAM,MAAM;AAAA,MACZ,QAAQ,MAAM;AAAA,MACd,MAAM,MAAM;AAAA,MACZ,eAAe,MAAM;AAAA,MACrB,gBAAgB,MAAM,kBAAkB;AAAA,MACxC,iBAAiB,MAAM,mBAAmB;AAAA,MAC1C,iBAAiB,MAAM,mBAAmB;AAAA,IAC5C;AACA,UAAM,YAAY;AAClB,UAAM,KAAK,WAAW,OAAO,KAAK;AAAA,EACpC;AAAA,EAEA,MAAM,cACJ,OACA,UAAsC,CAAC,GACuB;AAC9D,UAAM,QAAQ,MAAM,KAAK,KAAK;AAC9B,UAAM,QAAQ,MAAM,KAAK,UAAU,KAAK;AACxC,UAAM,aAAa,MAAM,YAAY,cAAc,MAAM,MAAM,MAAM,QAAQ,MAAM,IAAI,CAAC;AACxF,QAAI,CAAC,WAAY,QAAO;AACxB,WAAO,EAAE,GAAG,YAAY,OAAO,kBAAkB,YAAY,OAAO,EAAE;AAAA,EACxE;AAAA,EAEA,MAAM,eAAe,MAAc,eAAuB,MAAM,KAAK,IAAI,GAAkB;AACzF,UAAM,QAAQ,MAAM,KAAK,KAAK;AAC9B,UAAM,QAAQ,MAAM,KAAK,UAAU,KAAK;AACxC,UAAM,MAAM,aAAa,MAAM,aAAa;AAC5C,UAAM,YAAY,MAAM,WAAW,GAAG;AACtC,QAAI,CAAC,UAAW;AAChB,cAAU,eAAe;AACzB,eAAW,QAAQ,UAAU,YAAY;AACvC,UAAI,MAAM,MAAM,IAAI,EAAG,OAAM,MAAM,IAAI,EAAE,eAAe;AAAA,IAC1D;AACA,UAAM,YAAY;AAClB,UAAM,KAAK,WAAW,OAAO,KAAK;AAAA,EACpC;AAAA,EAEA,oBAAoB,MAAc,eAA6B;AAC7D,SAAK,iBAAiB,IAAI,aAAa,MAAM,aAAa,CAAC;AAAA,EAC7D;AAAA,EAEA,uBAAuB,MAAc,eAA6B;AAChE,SAAK,iBAAiB,OAAO,aAAa,MAAM,aAAa,CAAC;AAAA,EAChE;AAAA,EAEA,MAAM,MAAM,MAAM,KAAK,IAAI,GAAkB;AAC3C,QAAI;AACF,YAAM,QAAQ,MAAM,KAAK,KAAK;AAC9B,YAAM,QAAQ,MAAM,KAAK,UAAU,KAAK;AACxC,UAAI,OAAO,WAAW,KAAK;AAC3B,YAAM,SAAS,MAAM,KAAK,YAAY;AACtC,YAAM,aAAa,MAAM,KAAK,gBAAgB;AAC9C,YAAM,cAAc,OAAO,UAAU,MAAM,KAAK,mBAAmB;AACnE,UAAI,CAAC,YAAa;AAElB,WAAK,iBAAiB,KAAK;AAE3B,iBAAW,CAAC,MAAM,IAAI,KAAK,OAAO,QAAQ,MAAM,KAAK,GAAG;AACtD,YAAI,QAAQ,OAAQ;AACpB,YAAI,KAAK,WAAW,EAAG;AACvB,cAAM,MAAM,OAAO,KAAK,QAAQ,IAAI,CAAC;AACrC,eAAO,MAAM,MAAM,IAAI;AACvB,gBAAQ,KAAK;AAAA,MACf;AAEA,YAAM,yBAAyB,IAAI;AAAA,QACjC,OAAO,OAAO,MAAM,WAAW,EAAE,IAAI,CAAC,eAAe,WAAW,aAAa;AAAA,MAC/E;AACA,YAAM,aAAa,OAAO,OAAO,MAAM,UAAU,EAC9C,OAAO,CAAC,UAAU,CAAC,KAAK,iBAAiB,IAAI,MAAM,GAAG,CAAC,EACvD,KAAK,CAAC,GAAG,MAAM;AACd,cAAM,WAAW,uBAAuB,IAAI,EAAE,aAAa,IAAI,IAAI;AACnE,cAAM,WAAW,uBAAuB,IAAI,EAAE,aAAa,IAAI,IAAI;AACnE,YAAI,aAAa,SAAU,QAAO,WAAW;AAC7C,eAAO,EAAE,eAAe,EAAE;AAAA,MAC5B,CAAC;AAEH,iBAAW,aAAa,YAAY;AAClC,YAAI,QAAQ,OAAQ;AACpB,cAAM,MAAM,OAAO,KAAK,aAAa,UAAU,GAAG,CAAC;AACnD,eAAO,MAAM,WAAW,UAAU,GAAG;AACrC,gBAAQ,UAAU;AAClB,aAAK,iBAAiB,KAAK;AAAA,MAC7B;AAEA,UAAI,OAAO,YAAY;AACrB,cAAM,SAAS,OAAO,OAAO,MAAM,UAAU,EAC1C,OAAO,CAAC,UAAU,KAAK,iBAAiB,IAAI,MAAM,GAAG,CAAC,EACtD,KAAK,CAAC,GAAG,MAAM,EAAE,eAAe,EAAE,YAAY;AACjD,mBAAW,aAAa,QAAQ;AAC9B,cAAI,QAAQ,WAAY;AACxB,gBAAM,MAAM,OAAO,KAAK,aAAa,UAAU,GAAG,CAAC;AACnD,iBAAO,MAAM,WAAW,UAAU,GAAG;AACrC,kBAAQ,UAAU;AAAA,QACpB;AAAA,MACF;AAEA,WAAK,iBAAiB,KAAK;AAC3B,iBAAW,CAAC,MAAM,IAAI,KAAK,OAAO,QAAQ,MAAM,KAAK,GAAG;AACtD,YAAI,KAAK,aAAa,GAAG;AACvB,gBAAM,MAAM,OAAO,KAAK,QAAQ,IAAI,CAAC;AACrC,iBAAO,MAAM,MAAM,IAAI;AAAA,QACzB;AAAA,MACF;AACA,YAAM,YAAY;AAClB,YAAM,KAAK,WAAW,OAAO,KAAK;AAAA,IACpC,SAAS,OAAO;AACd,WAAK,WAAW,EAAE,MAAM,sBAAsB,SAAS,0CAA0C,MAAM,CAAC;AAAA,IAC1G;AAAA,EACF;AAAA,EAEA,MAAM,gBAAoD;AACxD,WAAO,KAAK,UAAU,MAAM,KAAK,KAAK,CAAC;AAAA,EACzC;AAAA,EAEA,MAAc,4BAA4B,OAAoD;AAC5F,UAAM,QAAQ,MAAM,KAAK,KAAK;AAC9B,UAAM,MAAM,MAAM,OAAO,KAAK,IAAI;AAClC,UAAM,QAAQ,MAAM,KAAK,UAAU,KAAK;AACxC,UAAM,aAAuB,CAAC;AAE9B,eAAW,aAAa,MAAM,SAAS,OAAO;AAC5C,YAAM,QAAQ,MAAM,MAAM,IAAI,UAAU,IAAI;AAC5C,UAAI,CAAC,MAAO;AACZ,iBAAW,KAAK,UAAU,MAAM;AAChC,YAAM,MAAM,IAAI,KAAK,QAAQ,UAAU,MAAM,GAAG,IAAI,SAAS,aAAa,KAAK,CAAC,CAAC;AACjF,YAAM,MAAM,UAAU,MAAM,IAAI;AAAA,QAC9B,MAAM,WAAW,KAAK;AAAA,QACtB,cAAc;AAAA,QACd,UAAU,MAAM,MAAM,UAAU,MAAM,GAAG,YAAY;AAAA,MACvD;AAAA,IACF;AAEA,UAAM,MAAM,aAAa,MAAM,SAAS,MAAM,MAAM,SAAS,aAAa;AAC1E,UAAM,SAA0B;AAAA,MAC9B,eAAe;AAAA,MACf,MAAM,MAAM,SAAS;AAAA,MACrB,eAAe,MAAM,SAAS;AAAA,MAC9B,UAAU;AAAA,QACR,MAAM,MAAM,SAAS;AAAA,QACrB,QAAQ,MAAM,SAAS;AAAA,QACvB,MAAM,MAAM,SAAS;AAAA,QACrB,OAAO,MAAM,SAAS,MAAM,IAAI,CAAC,WAAW,EAAE,MAAM,MAAM,MAAM,QAAQ,MAAM,OAAO,EAAE;AAAA,QACvF,UAAU,CAAC,GAAG,MAAM,SAAS,QAAQ;AAAA,QACrC,GAAI,MAAM,SAAS,UAAU,SAAY,CAAC,IAAI,EAAE,OAAO,MAAM,SAAS,MAAM;AAAA,QAC5E,GAAI,MAAM,SAAS,gBAAgB,SAAY,CAAC,IAAI,EAAE,aAAa,MAAM,SAAS,YAAY;AAAA,MAChG;AAAA,MACA,WAAW,MAAM;AAAA,MACjB;AAAA,MACA,WAAW;AAAA,IACb;AACA,UAAM,iBAAiB,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,MAAM,CAAC;AACtE,UAAM,MAAM,IAAI,KAAK,aAAa,GAAG,GAAG,IAAI,SAAS,aAAa,cAAc,GAAG;AAAA,MACjF,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAChD,CAAC,CAAC;AAEF,UAAM,WAAW,cAAc,MAAM,SAAS,MAAM,MAAM,SAAS,QAAQ,MAAM,SAAS,IAAI;AAC9F,UAAM,WAAW,GAAG,IAAI;AAAA,MACtB,MAAM,MAAM,SAAS;AAAA,MACrB,eAAe,MAAM,SAAS;AAAA,MAC9B;AAAA,MACA;AAAA,MACA,MAAM,WAAW,cAAc;AAAA,MAC/B,cAAc;AAAA,MACd,eAAe;AAAA,IACjB;AACA,UAAM,YAAY,QAAQ,IAAI;AAAA,MAC5B,KAAK;AAAA,MACL,MAAM,MAAM,SAAS;AAAA,MACrB,QAAQ,MAAM,SAAS;AAAA,MACvB,MAAM,MAAM,SAAS;AAAA,MACrB,eAAe,MAAM,SAAS;AAAA,MAC9B,gBAAgB;AAAA,MAChB,iBAAiB;AAAA,MACjB,iBAAiB;AAAA,IACnB;AAEA,SAAK,iBAAiB,KAAK;AAC3B,UAAM,YAAY;AAClB,UAAM,KAAK,WAAW,OAAO,KAAK;AAClC,UAAM,KAAK,MAAM,GAAG;AAAA,EACtB;AAAA,EAEA,MAAc,OAAuB;AACnC,SAAK,iBAAiB,KAAK,aAAa,KAAK,KAAK,SAAS;AAC3D,WAAO,KAAK;AAAA,EACd;AAAA,EAEQ,WAAmB;AACzB,WAAO,IAAI,IAAI,oCAAoC,KAAK,OAAO,EAAE,SAAS;AAAA,EAC5E;AAAA,EAEQ,QAAQ,MAAsB;AACpC,WAAO,IAAI,IAAI,8BAA8B,cAAc,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS;AAAA,EAC7F;AAAA,EAEQ,aAAa,KAAqB;AACxC,WAAO,IAAI,IAAI,mCAAmC,cAAc,GAAG,CAAC,SAAS,KAAK,OAAO,EAAE,SAAS;AAAA,EACtG;AAAA,EAEA,MAAc,UAAU,OAAkD;AACxE,UAAM,WAAW,MAAM,MAAM,MAAM,KAAK,SAAS,CAAC;AAClD,QAAI,CAAC,SAAU,QAAO,WAAW,KAAK,IAAI,CAAC;AAC3C,QAAI;AACF,YAAM,QAAQ,MAAM,aAAwC,QAAQ;AACpE,UAAI,MAAM,kBAAkB,eAAgB,QAAO,WAAW,KAAK,IAAI,CAAC;AACxE,aAAO;AAAA,IACT,QAAQ;AACN,aAAO,WAAW,KAAK,IAAI,CAAC;AAAA,IAC9B;AAAA,EACF;AAAA,EAEA,MAAc,WAAW,OAAc,OAAiD;AACtF,UAAM,MAAM,IAAI,KAAK,SAAS,GAAG,IAAI,SAAS,KAAK,UAAU,KAAK,GAAG;AAAA,MACnE,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAChD,CAAC,CAAC;AAAA,EACJ;AAAA,EAEQ,iBAAiB,OAAwC;AAC/D,UAAM,SAAS,UAAU,KAAK;AAC9B,eAAW,CAAC,MAAM,IAAI,KAAK,OAAO,QAAQ,MAAM,KAAK,GAAG;AACtD,WAAK,WAAW,OAAO,IAAI,KAAK;AAAA,IAClC;AAAA,EACF;AAAA,EAEA,MAAc,cAA+B;AAC3C,UAAM,WAAW,MAAM,KAAK,gBAAgB;AAC5C,QAAI,CAAC,UAAU,MAAO,QAAO,KAAK;AAClC,WAAO,KAAK,IAAI,KAAK,kBAAkB,KAAK,MAAM,SAAS,QAAQ,GAAG,CAAC;AAAA,EACzE;AAAA,EAEA,MAAc,kBAAmC;AAC/C,UAAM,WAAW,MAAM,KAAK,gBAAgB;AAC5C,QAAI,CAAC,UAAU,MAAO,QAAO,KAAK;AAClC,WAAO,KAAK,IAAI,KAAK,kBAAkB,KAAK,MAAM,SAAS,QAAQ,GAAG,CAAC;AAAA,EACzE;AAAA,EAEA,MAAc,qBAAuC;AACnD,UAAM,WAAW,MAAM,KAAK,gBAAgB;AAC5C,QAAI,CAAC,UAAU,SAAS,SAAS,UAAU,OAAW,QAAO;AAC7D,WAAO,SAAS,QAAQ,SAAS,SAAS;AAAA,EAC5C;AAAA,EAEA,MAAc,kBAAwD;AACpE,QAAI,CAAC,KAAK,SAAS,SAAU,QAAO;AACpC,QAAI;AACF,aAAO,KAAK,QAAQ,SAAS;AAAA,IAC/B,SAAS,OAAO;AACd,WAAK,WAAW;AAAA,QACd,MAAM;AAAA,QACN,SAAS;AAAA,QACT;AAAA,MACF,CAAC;AACD,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEQ,WAAW,YAA0C;AAC3D,SAAK,eAAe,UAAU;AAAA,EAChC;AACF;AAEA,eAAsB,yBACpB,UAA2C,CAAC,GACW;AACvD,QAAM,eAAe,QAAQ,gBAAiB,WAA6D;AAC3G,MAAI,CAAC,aAAc,QAAO;AAC1B,QAAM,UAAU,QAAQ,WAAY,WAAW,WAAqC;AACpF,MAAI,QAAQ,0BAA0B,CAAC,SAAS,UAAU;AACxD,YAAQ,eAAe;AAAA,MACrB,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AACD,WAAO;AAAA,EACT;AACA,MAAI;AACF,UAAM,QAAQ,IAAI,iCAAiC,EAAE,GAAG,SAAS,cAAc,QAAQ,CAAC;AACxF,UAAM,MAAM,cAAc;AAC1B,WAAO;AAAA,EACT,SAAS,OAAO;AACd,YAAQ,eAAe;AAAA,MACrB,MAAM;AAAA,MACN,SAAS;AAAA,MACT;AAAA,IACF,CAAC;AACD,WAAO;AAAA,EACT;AACF;;;ADhiBO,IAAM,wBAAwB;AAE9B,IAAM,oBAAoB;AAE1B,IAAM,qBAAqB;AAG3B,IAAM,gBAAmC;AAAA,EAC9C;AAAA,EACA;AAAA,EACA;AACF;AAQO,SAAS,sBAAsB,MAAuB;AAC3D,SAAO,cAAc,SAAS,IAAI;AACpC;AAiDO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EACvC;AAAA,EACT,YAAY,MAAkC,SAAiB;AAC7D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AAAA,EACd;AACF;AAEA,SAAS,cAAc,MAAsC,MAAkC;AAC7F,aAAW,OAAO,MAAM;AACtB,QAAI,IAAI,CAAC,MAAM,QAAQ,OAAO,IAAI,CAAC,MAAM,YAAY,IAAI,CAAC,EAAE,SAAS,EAAG,QAAO,IAAI,CAAC;AAAA,EACtF;AACA,SAAO;AACT;AAEA,SAAS,aAAa,MAAsC,MAAwB;AAClF,QAAM,MAAgB,CAAC;AACvB,aAAW,OAAO,MAAM;AACtB,QAAI,IAAI,CAAC,MAAM,QAAQ,OAAO,IAAI,CAAC,MAAM,YAAY,IAAI,CAAC,EAAE,SAAS,EAAG,KAAI,KAAK,IAAI,CAAC,CAAC;AAAA,EACzF;AACA,SAAO;AACT;AAEA,SAAS,mBACP,MACuC;AACvC,QAAM,MAA6C,CAAC;AACpD,aAAW,OAAO,MAAM;AACtB,QAAI,IAAI,CAAC,MAAM,YAAa;AAC5B,QAAI,OAAO,IAAI,CAAC,MAAM,YAAY,IAAI,CAAC,EAAE,WAAW,EAAG;AACvD,QAAI;AAAA,MACF,OAAO,IAAI,CAAC,MAAM,YAAY,IAAI,CAAC,EAAE,SAAS,IAC1C,EAAE,MAAM,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,EAAE,IAC5B,EAAE,MAAM,IAAI,CAAC,EAAE;AAAA,IACrB;AAAA,EACF;AACA,SAAO;AACT;AAaO,SAAS,qBAAqB,OAAoC;AACvE,MAAI,CAAC,sBAAsB,MAAM,IAAI,GAAG;AACtC,UAAM,IAAI,uBAAuB,oBAAoB,8BAA8B,MAAM,IAAI,EAAE;AAAA,EACjG;AACA,QAAM,QAAQ,oBAAoB,MAAM,IAAI;AAC5C,MAAI,MAAM,WAAW,GAAG;AACtB,UAAM,IAAI,uBAAuB,oBAAoB,2BAA2B;AAAA,EAClF;AACA,QAAM,gBAAgB,kBAAkB,MAAM,IAAI;AAClD,MAAI,CAAC,eAAe;AAClB,UAAM,IAAI,uBAAuB,oBAAoB,iCAAiC;AAAA,EACxF;AACA,SAAO;AAAA,IACL,MAAM,MAAM;AAAA,IACZ,QAAQ,MAAM;AAAA,IACd,MAAM,cAAc,MAAM,MAAM,GAAG,KAAK;AAAA,IACxC;AAAA,IACA;AAAA,IACA,SAAS,aAAa,MAAM,MAAM,QAAQ;AAAA,IAC1C,UAAU,aAAa,MAAM,MAAM,UAAU;AAAA,IAC7C,YAAY,mBAAmB,MAAM,IAAI;AAAA,IACzC,OAAO,cAAc,MAAM,MAAM,OAAO;AAAA,IACxC,aAAa,cAAc,MAAM,MAAM,aAAa;AAAA,IACpD,QAAQ,cAAc,MAAM,MAAM,QAAQ;AAAA,EAC5C;AACF;AAQO,SAAS,wBAAwB,OAA4B;AAClE,MAAI;AACF,WAAO,YAAY,KAAK;AAAA,EAC1B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AASO,SAAS,eAAe,OAAmB,WAA4B;AAC5E,SAAO,WAAW,OAAO,KAAK,CAAC,MAAM;AACvC;AAEA,SAAS,mBAAmB,KAAqB;AAC/C,SAAO,IAAI,SAAS,GAAG,IAAI,IAAI,MAAM,GAAG,EAAE,IAAI;AAChD;AAcA,eAAsB,UACpB,SACA,WACA,YACqB;AACrB,aAAW,UAAU,SAAS;AAC5B,UAAM,MAAM,GAAG,mBAAmB,MAAM,CAAC,IAAI,SAAS;AACtD,QAAI;AACF,YAAM,QAAQ,MAAM,WAAW,GAAG;AAClC,UAAI,eAAe,OAAO,SAAS,EAAG,QAAO;AAAA,IAC/C,QAAQ;AAAA,IAER;AAAA,EACF;AACA,QAAM,IAAI,uBAAuB,oBAAoB,yBAAyB,SAAS,EAAE;AAC3F;AAoCA,IAAM,cAAc,CAAC,eAAe,cAAc,GAAG;AAErD,SAAS,cAAc,OAA2B;AAChD,SAAO,IAAI,YAAY,EAAE,OAAO,KAAK;AACvC;AAuBA,eAAsB,eAAe,SAA0D;AAC7F,QAAM,EAAE,OAAO,WAAW,gBAAgB,aAAa,eAAe,MAAM,IAAI;AAEhF,MAAI,CAAC,wBAAwB,KAAK,GAAG;AACnC,UAAM,IAAI,uBAAuB,qBAAqB,+BAA+B;AAAA,EACvF;AAEA,QAAM,WAAW,qBAAqB,KAAK;AAE3C,QAAM,aAAa,qBAAqB,SAAS,KAAK;AACtD,MAAI,eAAe,SAAS,eAAe;AACzC,UAAM,IAAI;AAAA,MACR;AAAA,MACA,wBAAwB,UAAU,gBAAgB,SAAS,aAAa;AAAA,IAC1E;AAAA,EACF;AAEA,QAAM,QAAQ,oBAAI,IAAwB;AAC1C,aAAW,SAAS,SAAS,OAAO;AAClC,QAAI,QAAQ,MAAM,OAAO,SAAS,MAAM,MAAM;AAC9C,QAAI,SAAS,CAAC,eAAe,OAAO,MAAM,MAAM,GAAG;AACjD,YAAM,OAAO,WAAW,MAAM,MAAM;AACpC,cAAQ;AAAA,IACV;AACA,cAAU,MAAM,eAAe,MAAM,QAAQ,SAAS,OAAO;AAC7D,QAAI,CAAC,eAAe,OAAO,MAAM,MAAM,GAAG;AACxC,YAAM,IAAI;AAAA,QACR;AAAA,QACA,YAAY,MAAM,IAAI,wBAAwB,MAAM,MAAM;AAAA,MAC5D;AAAA,IACF;AACA,UAAM,IAAI,MAAM,MAAM,KAAK;AAAA,EAC7B;AAEA,QAAM,aAAa,SAAS,MAAM,KAAK,CAAC,MAAM,YAAY,SAAS,EAAE,IAAI,CAAC;AAC1E,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,uBAAuB,iBAAiB,mCAAmC;AAAA,EACvF;AAEA,QAAM,YAAY,WAAW,MAAM,IAAI,WAAW,IAAI,CAAE;AACxD,QAAM,OAAO,wBAAwB,EAAE,OAAO,UAAU,OAAO,UAAU,CAAC;AAE1E,SAAO;AAAA,IACL,MAAM,SAAS;AAAA,IACf,eAAe,SAAS;AAAA,IACxB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":[]}

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 export { PathEntry, aggregateTagValue, computeAggregateHash, pathEntriesFromTags, verifyAggregate } from './5a/index.js';
-export { NAPPLET_KINDS, NAPPLET_KIND_NAMED, NAPPLET_KIND_ROOT, NAPPLET_KIND_SNAPSHOT, NappletManifest, NappletResolutionError, NappletResolutionErrorCode, ResolveNappletOptions, ResolvedNapplet, fetchBlob, isNappletManifestKind, parseNappletManifest, resolveNapplet, verifyBlobHash, verifyManifestSignature } from './5d/index.js';
+export { CacheStorageNappletArtifactCache, CacheStorageNappletArtifactCacheOptions, CachedCoordinate, CoordinateFreshnessOptions, NAPPLET_ARTIFACT_CACHE_NAME, NAPPLET_KINDS, NAPPLET_KIND_NAMED, NAPPLET_KIND_ROOT, NAPPLET_KIND_SNAPSHOT, NappletAggregateIndexEntry, NappletArtifactCache, NappletArtifactCacheIndex, NappletBlobIndexEntry, NappletCacheDiagnostic, NappletManifest, NappletResolutionError, NappletResolutionErrorCode, OpenNappletArtifactCacheOptions, ResolveNappletOptions, ResolvedNapplet, WriteVerifiedResolutionInput, coordinateKey, fetchBlob, isCoordinateFresh, isNappletManifestKind, openNappletArtifactCache, parseNappletManifest, resolveNapplet, verifyBlobHash, verifyManifestSignature } from './5d/index.js';
 export { ITEM_TAGS, LIST_KINDS, Nip44Decryptor, Nip51List, SET_KINDS, decryptPrivateItems, getTagValues, isListKind, isSetKind, listKindName, parseList } from './51/index.js';
 export { Nip65Registry, RelayEntry, createNip65Registry, parseNip65RelayList, selectReadRelays, selectWriteRelays } from './65/index.js';
 export { DEFAULT_RELAY_ATTRIBUTE_GROUPS, Nip66Aggregator, Nip66AggregatorOptions, Nip66Filter, Nip66RelayAttributes, Nip66RelayPool, RelayAttributeGroups, RelayAttributeMatcher, createNip66Aggregator } from './66/index.js';

package/dist/index.js

@@ -10,30 +10,35 @@ import {
   parseList
 } from "./chunk-2XYRP2S6.js";
 import {
-  createNip65Registry,
-  parseNip65RelayList,
-  selectReadRelays,
-  selectWriteRelays
-} from "./chunk-UUMBCHTA.js";
-import {
+  CacheStorageNappletArtifactCache,
+  NAPPLET_ARTIFACT_CACHE_NAME,
   NAPPLET_KINDS,
   NAPPLET_KIND_NAMED,
   NAPPLET_KIND_ROOT,
   NAPPLET_KIND_SNAPSHOT,
   NappletResolutionError,
+  coordinateKey,
   fetchBlob,
+  isCoordinateFresh,
   isNappletManifestKind,
+  openNappletArtifactCache,
   parseNappletManifest,
   resolveNapplet,
   verifyBlobHash,
   verifyManifestSignature
-} from "./chunk-JRSVIT22.js";
+} from "./chunk-CDBUCFLP.js";
 import {
   aggregateTagValue,
   computeAggregateHash,
   pathEntriesFromTags,
   verifyAggregate
 } from "./chunk-2J3CSGKL.js";
+import {
+  createNip65Registry,
+  parseNip65RelayList,
+  selectReadRelays,
+  selectWriteRelays
+} from "./chunk-UUMBCHTA.js";
 import {
   DEFAULT_RELAY_ATTRIBUTE_GROUPS,
   createNip66Aggregator
@@ -48,12 +53,14 @@ import {
   parseHandlerRecommendation
 } from "./chunk-BCTIL523.js";
 export {
+  CacheStorageNappletArtifactCache,
   DEFAULT_RELAY_ATTRIBUTE_GROUPS,
   HANDLER_INFORMATION_KIND,
   HANDLER_PLATFORMS,
   HANDLER_RECOMMENDATION_KIND,
   ITEM_TAGS,
   LIST_KINDS,
+  NAPPLET_ARTIFACT_CACHE_NAME,
   NAPPLET_KINDS,
   NAPPLET_KIND_NAMED,
   NAPPLET_KIND_ROOT,
@@ -63,16 +70,19 @@ export {
   aggregateTagValue,
   buildHandlerUrl,
   computeAggregateHash,
+  coordinateKey,
   createNip65Registry,
   createNip66Aggregator,
   decryptPrivateItems,
   fetchBlob,
   getTagValues,
   handlesKind,
+  isCoordinateFresh,
   isListKind,
   isNappletManifestKind,
   isSetKind,
   listKindName,
+  openNappletArtifactCache,
   parseHandlerInformation,
   parseHandlerRecommendation,
   parseList,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kehto/nip",
-  "version": "0.3.0",
+  "version": "0.4.1",
   "description": "Tree-shakable bundle of unique Nostr NIP utilities for napplet runtimes — each NIP at its own subpath (e.g. @kehto/nip/66)",
   "type": "module",
   "main": "./dist/index.js",
@@ -44,7 +44,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "nostr-tools": ">=2.23.3 <3.0.0"
+    "nostr-tools": ">=2.23.3 <=2.x"
   },
   "dependencies": {
     "@noble/hashes": "^2.0.0"
@@ -55,12 +55,6 @@
     "typescript": "^5.9.3",
     "vitest": "^4.1.2"
   },
-  "scripts": {
-    "build": "tsup",
-    "type-check": "tsc --noEmit",
-    "test:unit": "cd ../.. && vitest run --config vitest.config.ts packages/nip",
-    "test": "pnpm test:unit"
-  },
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -85,5 +79,11 @@
     "app-handlers",
     "kehto",
     "napplet"
-  ]
-}
+  ],
+  "scripts": {
+    "build": "tsup",
+    "type-check": "tsc --noEmit",
+    "test:unit": "cd ../.. && vitest run --config vitest.config.ts packages/nip",
+    "test": "pnpm test:unit"
+  }
+}

package/dist/chunk-JRSVIT22.js

@@ -1,158 +0,0 @@
-import {
-  aggregateTagValue,
-  computeAggregateHash,
-  pathEntriesFromTags
-} from "./chunk-2J3CSGKL.js";
-
-// src/5d/index.ts
-import { verifyEvent } from "nostr-tools/pure";
-import { sha256 } from "@noble/hashes/sha2.js";
-import { bytesToHex } from "@noble/hashes/utils.js";
-var NAPPLET_KIND_SNAPSHOT = 5129;
-var NAPPLET_KIND_ROOT = 15129;
-var NAPPLET_KIND_NAMED = 35129;
-var NAPPLET_KINDS = [
-  NAPPLET_KIND_SNAPSHOT,
-  NAPPLET_KIND_ROOT,
-  NAPPLET_KIND_NAMED
-];
-function isNappletManifestKind(kind) {
-  return NAPPLET_KINDS.includes(kind);
-}
-var NappletResolutionError = class extends Error {
-  code;
-  constructor(code, message) {
-    super(message);
-    this.name = "NappletResolutionError";
-    this.code = code;
-  }
-};
-function firstTagValue(tags, name) {
-  for (const tag of tags) {
-    if (tag[0] === name && typeof tag[1] === "string" && tag[1].length > 0) return tag[1];
-  }
-  return void 0;
-}
-function allTagValues(tags, name) {
-  const out = [];
-  for (const tag of tags) {
-    if (tag[0] === name && typeof tag[1] === "string" && tag[1].length > 0) out.push(tag[1]);
-  }
-  return out;
-}
-function archetypesFromTags(tags) {
-  const out = [];
-  for (const tag of tags) {
-    if (tag[0] !== "archetype") continue;
-    if (typeof tag[1] !== "string" || tag[1].length === 0) continue;
-    out.push(
-      typeof tag[2] === "string" && tag[2].length > 0 ? { slug: tag[1], nap: tag[2] } : { slug: tag[1] }
-    );
-  }
-  return out;
-}
-function parseNappletManifest(event) {
-  if (!isNappletManifestKind(event.kind)) {
-    throw new NappletResolutionError("invalid-manifest", `not a NIP-5D napplet kind: ${event.kind}`);
-  }
-  const paths = pathEntriesFromTags(event.tags);
-  if (paths.length === 0) {
-    throw new NappletResolutionError("invalid-manifest", "manifest has no path tags");
-  }
-  const aggregateHash = aggregateTagValue(event.tags);
-  if (!aggregateHash) {
-    throw new NappletResolutionError("invalid-manifest", "manifest has no aggregate x tag");
-  }
-  return {
-    kind: event.kind,
-    pubkey: event.pubkey,
-    dTag: firstTagValue(event.tags, "d") ?? "",
-    paths,
-    aggregateHash,
-    servers: allTagValues(event.tags, "server"),
-    requires: allTagValues(event.tags, "requires"),
-    archetypes: archetypesFromTags(event.tags),
-    title: firstTagValue(event.tags, "title"),
-    description: firstTagValue(event.tags, "description"),
-    source: firstTagValue(event.tags, "source")
-  };
-}
-function verifyManifestSignature(event) {
-  try {
-    return verifyEvent(event);
-  } catch {
-    return false;
-  }
-}
-function verifyBlobHash(bytes, sha256Hex) {
-  return bytesToHex(sha256(bytes)) === sha256Hex;
-}
-function stripTrailingSlash(url) {
-  return url.endsWith("/") ? url.slice(0, -1) : url;
-}
-async function fetchBlob(servers, sha256Hex, fetchBytes) {
-  for (const server of servers) {
-    const url = `${stripTrailingSlash(server)}/${sha256Hex}`;
-    try {
-      const bytes = await fetchBytes(url);
-      if (verifyBlobHash(bytes, sha256Hex)) return bytes;
-    } catch {
-    }
-  }
-  throw new NappletResolutionError("blob-unavailable", `no server served blob ${sha256Hex}`);
-}
-var INDEX_PATHS = ["/index.html", "index.html", "/"];
-function defaultDecode(bytes) {
-  return new TextDecoder().decode(bytes);
-}
-async function resolveNapplet(options) {
-  const { event, fetchBlob: fetchBlobBytes, textDecode = defaultDecode } = options;
-  if (!verifyManifestSignature(event)) {
-    throw new NappletResolutionError("invalid-signature", "manifest signature is invalid");
-  }
-  const manifest = parseNappletManifest(event);
-  const recomputed = computeAggregateHash(manifest.paths);
-  if (recomputed !== manifest.aggregateHash) {
-    throw new NappletResolutionError(
-      "aggregate-mismatch",
-      `recomputed aggregate ${recomputed} != manifest ${manifest.aggregateHash}`
-    );
-  }
-  const files = /* @__PURE__ */ new Map();
-  for (const entry of manifest.paths) {
-    const bytes = await fetchBlobBytes(entry.sha256, manifest.servers);
-    if (!verifyBlobHash(bytes, entry.sha256)) {
-      throw new NappletResolutionError(
-        "blob-hash-mismatch",
-        `blob for ${entry.path} does not match hash ${entry.sha256}`
-      );
-    }
-    files.set(entry.path, bytes);
-  }
-  const indexEntry = manifest.paths.find((e) => INDEX_PATHS.includes(e.path));
-  if (!indexEntry) {
-    throw new NappletResolutionError("missing-index", "manifest has no /index.html entry");
-  }
-  return {
-    dTag: manifest.dTag,
-    aggregateHash: manifest.aggregateHash,
-    files,
-    indexHtml: textDecode(files.get(indexEntry.path)),
-    manifest
-  };
-}
-
-export {
-  NAPPLET_KIND_SNAPSHOT,
-  NAPPLET_KIND_ROOT,
-  NAPPLET_KIND_NAMED,
-  NAPPLET_KINDS,
-  isNappletManifestKind,
-  NappletResolutionError,
-  parseNappletManifest,
-  verifyManifestSignature,
-  verifyBlobHash,
-  fetchBlob,
-  resolveNapplet
-};
-//# sourceMappingURL=chunk-JRSVIT22.js.map

package/dist/chunk-JRSVIT22.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/5d/index.ts"],"sourcesContent":["import type { NostrEvent } from 'nostr-tools';\nimport { verifyEvent } from 'nostr-tools/pure';\nimport { sha256 } from '@noble/hashes/sha2.js';\nimport { bytesToHex } from '@noble/hashes/utils.js';\nimport {\n  computeAggregateHash,\n  pathEntriesFromTags,\n  aggregateTagValue,\n  type PathEntry,\n} from '../5a/index.js';\n\n/**\n * `@kehto/nip/5d` — NIP-5D napplet manifest resolution.\n *\n * NIP-5D (`dskvr/nips` branch `nip/5d`) defines content-addressed \"napplet\"\n * web applets published as Nostr events that reference their files by hash\n * (NIP-5A `path` tags + an aggregate `x` tag). A runtime resolves a napplet by:\n *\n * 1. verifying the manifest event's signature,\n * 2. recomputing the NIP-5A aggregate from its `path` tags and checking the\n *    `[\"x\",\"<hex>\",\"aggregate\"]` tag,\n * 3. fetching each referenced blob (e.g. from Blossom) and verifying its hash,\n * 4. assembling the verified `/index.html`.\n *\n * The napplet's identity is the `(dTag, aggregateHash)` tuple **computed** from\n * these verified bytes — it is never accepted from a host or gateway.\n */\n\n/** Snapshot manifest — regular event, immutable point-in-time release. */\nexport const NAPPLET_KIND_SNAPSHOT = 5129;\n/** Root manifest — replaceable event, an author's latest unnamed napplet. */\nexport const NAPPLET_KIND_ROOT = 15129;\n/** Named manifest — addressable event (carries a `d` tag identifier). */\nexport const NAPPLET_KIND_NAMED = 35129;\n\n/** All three NIP-5D napplet manifest kinds. */\nexport const NAPPLET_KINDS: readonly number[] = [\n  NAPPLET_KIND_SNAPSHOT,\n  NAPPLET_KIND_ROOT,\n  NAPPLET_KIND_NAMED,\n];\n\n/**\n * Whether `kind` is one of the three NIP-5D napplet manifest kinds.\n *\n * @param kind - A Nostr event kind\n * @returns `true` for `5129` / `15129` / `35129`\n */\nexport function isNappletManifestKind(kind: number): boolean {\n  return NAPPLET_KINDS.includes(kind);\n}\n\n/**\n * A parsed NIP-5D napplet manifest. All fields are derived from the manifest\n * event's tags; the aggregate is the declared `x` tag (verify it separately\n * with {@link resolveNapplet} or `@kehto/nip/5a` `verifyAggregate`).\n */\nexport interface NappletManifest {\n  /** Manifest event kind (`5129` / `15129` / `35129`). */\n  kind: number;\n  /** Author hex public key. */\n  pubkey: string;\n  /** Named-napplet `d` identifier, or `''` for root/snapshot manifests. */\n  dTag: string;\n  /** File path entries from `path` tags. */\n  paths: PathEntry[];\n  /** Declared aggregate hash from the `[\"x\",\"<hex>\",\"aggregate\"]` tag. */\n  aggregateHash: string;\n  /** Blossom server URL hints from `server` tags. */\n  servers: string[];\n  /** Short NAP capability names from `requires` tags. */\n  requires: string[];\n  /**\n   * Archetype slugs this napplet fulfills, from `archetype` manifest tags; the\n   * optional `nap` is the recommended default wire protocol (the 3rd tag element).\n   */\n  archetypes: Array<{ slug: string; nap?: string }>;\n  /** Optional human title. */\n  title?: string;\n  /** Optional human description. */\n  description?: string;\n  /** Optional upstream source URL from the `source` tag. */\n  source?: string;\n}\n\n/** Error codes for every napplet resolution failure path. */\nexport type NappletResolutionErrorCode =\n  | 'invalid-signature'\n  | 'invalid-manifest'\n  | 'aggregate-mismatch'\n  | 'blob-hash-mismatch'\n  | 'blob-unavailable'\n  | 'missing-index';\n\n/**\n * Thrown on any napplet resolution/verification failure. The `code` field\n * identifies which guard rejected, so callers can fail closed without parsing\n * the message.\n */\nexport class NappletResolutionError extends Error {\n  readonly code: NappletResolutionErrorCode;\n  constructor(code: NappletResolutionErrorCode, message: string) {\n    super(message);\n    this.name = 'NappletResolutionError';\n    this.code = code;\n  }\n}\n\nfunction firstTagValue(tags: readonly (readonly string[])[], name: string): string | undefined {\n  for (const tag of tags) {\n    if (tag[0] === name && typeof tag[1] === 'string' && tag[1].length > 0) return tag[1];\n  }\n  return undefined;\n}\n\nfunction allTagValues(tags: readonly (readonly string[])[], name: string): string[] {\n  const out: string[] = [];\n  for (const tag of tags) {\n    if (tag[0] === name && typeof tag[1] === 'string' && tag[1].length > 0) out.push(tag[1]);\n  }\n  return out;\n}\n\nfunction archetypesFromTags(\n  tags: readonly (readonly string[])[],\n): Array<{ slug: string; nap?: string }> {\n  const out: Array<{ slug: string; nap?: string }> = [];\n  for (const tag of tags) {\n    if (tag[0] !== 'archetype') continue;\n    if (typeof tag[1] !== 'string' || tag[1].length === 0) continue;\n    out.push(\n      typeof tag[2] === 'string' && tag[2].length > 0\n        ? { slug: tag[1], nap: tag[2] }\n        : { slug: tag[1] },\n    );\n  }\n  return out;\n}\n\n/**\n * Parse a NIP-5D manifest event into a {@link NappletManifest}.\n *\n * Does not verify the signature, aggregate, or blobs — use {@link resolveNapplet}\n * for full verification.\n *\n * @param event - A NIP-5D manifest event (`5129` / `15129` / `35129`)\n * @returns The parsed manifest\n * @throws {@link NappletResolutionError} `invalid-manifest` for a non-napplet\n *   kind, missing `path` tags, or a missing aggregate `x` tag\n */\nexport function parseNappletManifest(event: NostrEvent): NappletManifest {\n  if (!isNappletManifestKind(event.kind)) {\n    throw new NappletResolutionError('invalid-manifest', `not a NIP-5D napplet kind: ${event.kind}`);\n  }\n  const paths = pathEntriesFromTags(event.tags);\n  if (paths.length === 0) {\n    throw new NappletResolutionError('invalid-manifest', 'manifest has no path tags');\n  }\n  const aggregateHash = aggregateTagValue(event.tags);\n  if (!aggregateHash) {\n    throw new NappletResolutionError('invalid-manifest', 'manifest has no aggregate x tag');\n  }\n  return {\n    kind: event.kind,\n    pubkey: event.pubkey,\n    dTag: firstTagValue(event.tags, 'd') ?? '',\n    paths,\n    aggregateHash,\n    servers: allTagValues(event.tags, 'server'),\n    requires: allTagValues(event.tags, 'requires'),\n    archetypes: archetypesFromTags(event.tags),\n    title: firstTagValue(event.tags, 'title'),\n    description: firstTagValue(event.tags, 'description'),\n    source: firstTagValue(event.tags, 'source'),\n  };\n}\n\n/**\n * Verify a manifest event's Nostr signature (id + schnorr sig).\n *\n * @param event - A manifest event\n * @returns `true` if the event is internally consistent and validly signed\n */\nexport function verifyManifestSignature(event: NostrEvent): boolean {\n  try {\n    return verifyEvent(event);\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Whether `bytes` hash to the expected lowercase-hex SHA-256.\n *\n * @param bytes - The blob bytes\n * @param sha256Hex - Expected lowercase-hex SHA-256\n * @returns `true` only on an exact match\n */\nexport function verifyBlobHash(bytes: Uint8Array, sha256Hex: string): boolean {\n  return bytesToHex(sha256(bytes)) === sha256Hex;\n}\n\nfunction stripTrailingSlash(url: string): string {\n  return url.endsWith('/') ? url.slice(0, -1) : url;\n}\n\n/**\n * Fetch a blob by SHA-256 from a list of Blossom servers, returning the first\n * server's bytes whose hash matches. The returned bytes are always re-verified\n * against `sha256Hex` — servers (and gateways) are never trusted.\n *\n * @param servers - Candidate Blossom server base URLs, tried in order\n * @param sha256Hex - The blob's lowercase-hex SHA-256\n * @param fetchBytes - Fetches raw bytes for a URL (`<server>/<sha256>`)\n * @returns The verified blob bytes\n * @throws {@link NappletResolutionError} `blob-unavailable` if no server serves\n *   a hash-matching blob\n */\nexport async function fetchBlob(\n  servers: readonly string[],\n  sha256Hex: string,\n  fetchBytes: (url: string) => Promise<Uint8Array>,\n): Promise<Uint8Array> {\n  for (const server of servers) {\n    const url = `${stripTrailingSlash(server)}/${sha256Hex}`;\n    try {\n      const bytes = await fetchBytes(url);\n      if (verifyBlobHash(bytes, sha256Hex)) return bytes;\n    } catch {\n      // try the next server\n    }\n  }\n  throw new NappletResolutionError('blob-unavailable', `no server served blob ${sha256Hex}`);\n}\n\n/** A fully verified napplet, ready to inject via `iframe.srcdoc`. */\nexport interface ResolvedNapplet {\n  /** Computed `d` identifier (`''` for root/snapshot). */\n  dTag: string;\n  /** Computed (and verified) aggregate hash — the content address. */\n  aggregateHash: string;\n  /** Verified file bytes keyed by manifest path. */\n  files: Map<string, Uint8Array>;\n  /** The verified `/index.html` decoded to text. */\n  indexHtml: string;\n  /** The parsed manifest. */\n  manifest: NappletManifest;\n}\n\n/** Options for {@link resolveNapplet}. */\nexport interface ResolveNappletOptions {\n  /** The candidate manifest event (resolved from relays by the caller). */\n  event: NostrEvent;\n  /**\n   * Fetch raw blob bytes by SHA-256. Backed by Blossom (or a gateway) by the\n   * caller. The bytes are re-verified against the hash here, so the fetcher is\n   * untrusted.\n   */\n  fetchBlob: (sha256Hex: string, servers: readonly string[]) => Promise<Uint8Array>;\n  /** Decode blob bytes to text for `indexHtml` (default UTF-8). */\n  textDecode?: (bytes: Uint8Array) => string;\n}\n\nconst INDEX_PATHS = ['/index.html', 'index.html', '/'];\n\nfunction defaultDecode(bytes: Uint8Array): string {\n  return new TextDecoder().decode(bytes);\n}\n\n/**\n * Resolve a napplet end-to-end from a candidate manifest event: verify the\n * signature, parse the manifest, verify the NIP-5A aggregate, fetch and verify\n * every blob, then assemble the verified `/index.html`.\n *\n * The returned `(dTag, aggregateHash)` is computed from the verified bytes and\n * is the napplet's identity. Any failure throws a {@link NappletResolutionError}\n * — the caller must fail closed (never render unverified bytes).\n *\n * @param options - {@link ResolveNappletOptions}\n * @returns The {@link ResolvedNapplet}\n * @throws {@link NappletResolutionError} on signature, manifest, aggregate,\n *   blob-hash, blob-availability, or missing-index failures\n *\n * @example\n * ```ts\n * import { resolveNapplet } from '@kehto/nip/5d';\n * const napplet = await resolveNapplet({ event, fetchBlob });\n * iframe.srcdoc = napplet.indexHtml; // sandbox=\"allow-scripts\", opaque origin\n * ```\n */\nexport async function resolveNapplet(options: ResolveNappletOptions): Promise<ResolvedNapplet> {\n  const { event, fetchBlob: fetchBlobBytes, textDecode = defaultDecode } = options;\n\n  if (!verifyManifestSignature(event)) {\n    throw new NappletResolutionError('invalid-signature', 'manifest signature is invalid');\n  }\n\n  const manifest = parseNappletManifest(event);\n\n  const recomputed = computeAggregateHash(manifest.paths);\n  if (recomputed !== manifest.aggregateHash) {\n    throw new NappletResolutionError(\n      'aggregate-mismatch',\n      `recomputed aggregate ${recomputed} != manifest ${manifest.aggregateHash}`,\n    );\n  }\n\n  const files = new Map<string, Uint8Array>();\n  for (const entry of manifest.paths) {\n    const bytes = await fetchBlobBytes(entry.sha256, manifest.servers);\n    if (!verifyBlobHash(bytes, entry.sha256)) {\n      throw new NappletResolutionError(\n        'blob-hash-mismatch',\n        `blob for ${entry.path} does not match hash ${entry.sha256}`,\n      );\n    }\n    files.set(entry.path, bytes);\n  }\n\n  const indexEntry = manifest.paths.find((e) => INDEX_PATHS.includes(e.path));\n  if (!indexEntry) {\n    throw new NappletResolutionError('missing-index', 'manifest has no /index.html entry');\n  }\n\n  return {\n    dTag: manifest.dTag,\n    aggregateHash: manifest.aggregateHash,\n    files,\n    indexHtml: textDecode(files.get(indexEntry.path)!),\n    manifest,\n  };\n}\n"],"mappings":";;;;;;;AACA,SAAS,mBAAmB;AAC5B,SAAS,cAAc;AACvB,SAAS,kBAAkB;AA0BpB,IAAM,wBAAwB;AAE9B,IAAM,oBAAoB;AAE1B,IAAM,qBAAqB;AAG3B,IAAM,gBAAmC;AAAA,EAC9C;AAAA,EACA;AAAA,EACA;AACF;AAQO,SAAS,sBAAsB,MAAuB;AAC3D,SAAO,cAAc,SAAS,IAAI;AACpC;AAiDO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EACvC;AAAA,EACT,YAAY,MAAkC,SAAiB;AAC7D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AAAA,EACd;AACF;AAEA,SAAS,cAAc,MAAsC,MAAkC;AAC7F,aAAW,OAAO,MAAM;AACtB,QAAI,IAAI,CAAC,MAAM,QAAQ,OAAO,IAAI,CAAC,MAAM,YAAY,IAAI,CAAC,EAAE,SAAS,EAAG,QAAO,IAAI,CAAC;AAAA,EACtF;AACA,SAAO;AACT;AAEA,SAAS,aAAa,MAAsC,MAAwB;AAClF,QAAM,MAAgB,CAAC;AACvB,aAAW,OAAO,MAAM;AACtB,QAAI,IAAI,CAAC,MAAM,QAAQ,OAAO,IAAI,CAAC,MAAM,YAAY,IAAI,CAAC,EAAE,SAAS,EAAG,KAAI,KAAK,IAAI,CAAC,CAAC;AAAA,EACzF;AACA,SAAO;AACT;AAEA,SAAS,mBACP,MACuC;AACvC,QAAM,MAA6C,CAAC;AACpD,aAAW,OAAO,MAAM;AACtB,QAAI,IAAI,CAAC,MAAM,YAAa;AAC5B,QAAI,OAAO,IAAI,CAAC,MAAM,YAAY,IAAI,CAAC,EAAE,WAAW,EAAG;AACvD,QAAI;AAAA,MACF,OAAO,IAAI,CAAC,MAAM,YAAY,IAAI,CAAC,EAAE,SAAS,IAC1C,EAAE,MAAM,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,EAAE,IAC5B,EAAE,MAAM,IAAI,CAAC,EAAE;AAAA,IACrB;AAAA,EACF;AACA,SAAO;AACT;AAaO,SAAS,qBAAqB,OAAoC;AACvE,MAAI,CAAC,sBAAsB,MAAM,IAAI,GAAG;AACtC,UAAM,IAAI,uBAAuB,oBAAoB,8BAA8B,MAAM,IAAI,EAAE;AAAA,EACjG;AACA,QAAM,QAAQ,oBAAoB,MAAM,IAAI;AAC5C,MAAI,MAAM,WAAW,GAAG;AACtB,UAAM,IAAI,uBAAuB,oBAAoB,2BAA2B;AAAA,EAClF;AACA,QAAM,gBAAgB,kBAAkB,MAAM,IAAI;AAClD,MAAI,CAAC,eAAe;AAClB,UAAM,IAAI,uBAAuB,oBAAoB,iCAAiC;AAAA,EACxF;AACA,SAAO;AAAA,IACL,MAAM,MAAM;AAAA,IACZ,QAAQ,MAAM;AAAA,IACd,MAAM,cAAc,MAAM,MAAM,GAAG,KAAK;AAAA,IACxC;AAAA,IACA;AAAA,IACA,SAAS,aAAa,MAAM,MAAM,QAAQ;AAAA,IAC1C,UAAU,aAAa,MAAM,MAAM,UAAU;AAAA,IAC7C,YAAY,mBAAmB,MAAM,IAAI;AAAA,IACzC,OAAO,cAAc,MAAM,MAAM,OAAO;AAAA,IACxC,aAAa,cAAc,MAAM,MAAM,aAAa;AAAA,IACpD,QAAQ,cAAc,MAAM,MAAM,QAAQ;AAAA,EAC5C;AACF;AAQO,SAAS,wBAAwB,OAA4B;AAClE,MAAI;AACF,WAAO,YAAY,KAAK;AAAA,EAC1B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AASO,SAAS,eAAe,OAAmB,WAA4B;AAC5E,SAAO,WAAW,OAAO,KAAK,CAAC,MAAM;AACvC;AAEA,SAAS,mBAAmB,KAAqB;AAC/C,SAAO,IAAI,SAAS,GAAG,IAAI,IAAI,MAAM,GAAG,EAAE,IAAI;AAChD;AAcA,eAAsB,UACpB,SACA,WACA,YACqB;AACrB,aAAW,UAAU,SAAS;AAC5B,UAAM,MAAM,GAAG,mBAAmB,MAAM,CAAC,IAAI,SAAS;AACtD,QAAI;AACF,YAAM,QAAQ,MAAM,WAAW,GAAG;AAClC,UAAI,eAAe,OAAO,SAAS,EAAG,QAAO;AAAA,IAC/C,QAAQ;AAAA,IAER;AAAA,EACF;AACA,QAAM,IAAI,uBAAuB,oBAAoB,yBAAyB,SAAS,EAAE;AAC3F;AA8BA,IAAM,cAAc,CAAC,eAAe,cAAc,GAAG;AAErD,SAAS,cAAc,OAA2B;AAChD,SAAO,IAAI,YAAY,EAAE,OAAO,KAAK;AACvC;AAuBA,eAAsB,eAAe,SAA0D;AAC7F,QAAM,EAAE,OAAO,WAAW,gBAAgB,aAAa,cAAc,IAAI;AAEzE,MAAI,CAAC,wBAAwB,KAAK,GAAG;AACnC,UAAM,IAAI,uBAAuB,qBAAqB,+BAA+B;AAAA,EACvF;AAEA,QAAM,WAAW,qBAAqB,KAAK;AAE3C,QAAM,aAAa,qBAAqB,SAAS,KAAK;AACtD,MAAI,eAAe,SAAS,eAAe;AACzC,UAAM,IAAI;AAAA,MACR;AAAA,MACA,wBAAwB,UAAU,gBAAgB,SAAS,aAAa;AAAA,IAC1E;AAAA,EACF;AAEA,QAAM,QAAQ,oBAAI,IAAwB;AAC1C,aAAW,SAAS,SAAS,OAAO;AAClC,UAAM,QAAQ,MAAM,eAAe,MAAM,QAAQ,SAAS,OAAO;AACjE,QAAI,CAAC,eAAe,OAAO,MAAM,MAAM,GAAG;AACxC,YAAM,IAAI;AAAA,QACR;AAAA,QACA,YAAY,MAAM,IAAI,wBAAwB,MAAM,MAAM;AAAA,MAC5D;AAAA,IACF;AACA,UAAM,IAAI,MAAM,MAAM,KAAK;AAAA,EAC7B;AAEA,QAAM,aAAa,SAAS,MAAM,KAAK,CAAC,MAAM,YAAY,SAAS,EAAE,IAAI,CAAC;AAC1E,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,uBAAuB,iBAAiB,mCAAmC;AAAA,EACvF;AAEA,SAAO;AAAA,IACL,MAAM,SAAS;AAAA,IACf,eAAe,SAAS;AAAA,IACxB;AAAA,IACA,WAAW,WAAW,MAAM,IAAI,WAAW,IAAI,CAAE;AAAA,IACjD;AAAA,EACF;AACF;","names":[]}