@macula-io/ts 0.15.0 → 0.17.0

package/dist/session.js

@@ -50,26 +50,20 @@ export class Session {
     #identity;
     #activeServe = null;
     #activeSubscription = null;
-    // Serializes every operation that reads this Session's shared
-    // control stream: call()/callWithUcan()/the DHT methods, plus
-    // serve()'s advertise + each poll tick + unadvertise, plus
-    // subscribe()'s start + stop. macula-go's connection/frame_stream.go
-    // RecvFrame mutates a shared buffer with no mutex of its own, so two
-    // reads racing it corrupt the stream -- verified live: `Promise.all`
-    // of 4 concurrent call()s on one Session left EVERY later read on
-    // that same Session permanently failing "claimed frame length ...
-    // exceeds the 16777215-byte cap" (a torn buffer), not just that one
-    // batch. The `#activeServe`/`#activeSubscription` checks above only
-    // ever protected call()-family operations from an ACTIVE serve()/
-    // subscribe() -- they did nothing to stop two ordinary call()s (or a
-    // call() racing a DHT method) from racing each other, since neither
-    // flag is set in that case. This queue is what actually closes that
-    // gap: every control-stream-reading native call funnels through
-    // #enqueue, so only one is ever in flight at a time, regardless of
-    // which method it came from. publish()/putContent()/getContent() do
-    // NOT go through this -- see their own docs for why (a pure write,
-    // and each own dedicated QUIC stream, respectively -- neither reads
-    // this shared stream at all).
+    // Serializes every native call that uses this Session's control
+    // stream: call()/callWithUcan()/the DHT methods, plus serve()'s
+    // advertise, each poll tick and unadvertise, plus subscribe()'s start
+    // and stop, so only one of them is in flight at a time. It was added
+    // when macula-go read the control stream without a lock, so two reads
+    // racing it corrupted the stream -- verified live: `Promise.all` of 4
+    // concurrent call()s on one Session left EVERY later read on that
+    // Session permanently failing "claimed frame length ... exceeds the
+    // 16777215-byte cap". macula-go v0.10.0, which this release embeds,
+    // reads the control stream on one goroutine and routes each reply,
+    // event and inbound CALL to what is waiting for it, so concurrent calls
+    // no longer race; this release keeps the queue as it was.
+    // publish()/putContent()/getContent() do NOT go through it -- see their
+    // own docs (a pure write, and each own dedicated QUIC stream).
     #queue = Promise.resolve();
     #enqueue(fn) {
         const result = this.#queue.then(fn, fn);
@@ -108,31 +102,27 @@ export class Session {
         }
         return this.#handle;
     }
-    /** call()'s own handle-plus-exclusivity guard, factored out since the
-     * DHT methods below (findRecord/findRecords/findRecordsByType/
-     * putRecord) all end up on this Session's same shared control stream
-     * too -- macula-go's dht.FindRecord et al. are themselves just a
-     * connection.Session.Call under the hood (see cabi/dht.go), so mixing
-     * one of these with an active serve() OR subscribe() on this Session
-     * races exactly the way call() itself would: serve()'s poll loop and
-     * subscribe()'s background reader both read frames off this same
-     * stream on their own schedule, same as call()'s own blocking read
-     * does. publish() is deliberately NOT guarded by this: it only ever
-     * WRITES a fire-and-forget frame (connection.Session.Publish), never
-     * reads, so it does not race a concurrent reader the way call()/
-     * serve()/subscribe()/the DHT methods do -- and the live pubsub round
-     * trip this SDK's own test performs (subscribe(), then publish() on
-     * the SAME Session while that subscription is active) depends on
-     * publish() staying unguarded here. */
+    /** call()'s own handle-plus-one-role check, factored out since the DHT
+     * methods below and the direct-dial methods are CALLs too (macula-go's
+     * dht.FindRecord et al. are a connection.Session.Call under the hood,
+     * see cabi/dht.go). A Session takes one role at a time: calls, one
+     * serve(), or one subscribe(). macula-go v0.10.0 routes each reply,
+     * event and inbound CALL on its own, so a call beside a serve() or
+     * subscribe() no longer races; this release keeps the check as it was.
+     * publish() is deliberately NOT checked: it only ever WRITES a
+     * fire-and-forget frame (connection.Session.Publish), and the live
+     * pubsub round trip this SDK's own test performs (subscribe(), then
+     * publish() on the SAME Session while that subscription is active)
+     * depends on publish() staying unchecked here. */
     #requireHandleNotServing(caller) {
         const handle = this.#requireHandle();
         if (this.#activeServe !== null) {
             throw new Error(`macula-ts: Session.${caller}() while serve("${this.#activeServe.procedure}") is active on the same ` +
-                `Session races on the shared control stream -- open a second Session for the other role.`);
+                `Session is not supported -- open a second Session for the other role.`);
         }
         if (this.#activeSubscription !== null) {
             throw new Error(`macula-ts: Session.${caller}() while subscribe("${this.#activeSubscription.topic}") is active on the ` +
-                `same Session races on the shared control stream -- open a second Session for the other role.`);
+                `same Session is not supported -- open a second Session for the other role.`);
         }
         return handle;
     }
@@ -210,13 +200,10 @@ export class Session {
      *
      * Real network I/O -- a signed frame out and a wait for the reply,
      * up to opts.deadlineMs -- so this runs off the main thread on the
-     * native side, like connect()/close(). Do not call this
-     * concurrently with an active serve() on the SAME Session: both read
-     * frames off the one shared control stream, and macula-go's own
-     * ServeOneCall/Call docs both warn that mixing roles on one
-     * connection races (an unrelated frame arriving first is discarded,
-     * not queued) -- open a second Session for the other role instead,
-     * exactly what this SDK's own live test does. */
+     * native side, like connect()/close(). Rejects while a serve() or
+     * subscribe() is active on the SAME Session (#requireHandleNotServing):
+     * a Session takes one role at a time, so open a second Session for the
+     * other role, exactly what this SDK's own live test does. */
     async call(procedure, payload, opts = {}) {
         const handle = this.#requireHandleNotServing("call");
         const timeoutMs = opts.deadlineMs ?? DEFAULT_CALL_TIMEOUT_MS;
@@ -254,9 +241,8 @@ export class Session {
      * security property that isn't actually enforced.
      *
      * Real network I/O, off the main thread on the native side, and
-     * subject to the identical same-Session exclusivity rule as `call()`
-     * (`#requireHandleNotServing`) -- both end up on the same shared
-     * control stream. */
+     * subject to the same one-role check as `call()`
+     * (`#requireHandleNotServing`). */
     async callWithUcan(procedure, payload, ucanToken, opts = {}) {
         const handle = this.#requireHandleNotServing("callWithUcan");
         const timeoutMs = opts.deadlineMs ?? DEFAULT_CALL_TIMEOUT_MS;
@@ -282,11 +268,15 @@ export class Session {
      * between this and the JS handler) would map to
      * TemporaryRelayFailure, per that same file.
      *
-     * Only one serve() registration is allowed per Session at a time --
-     * see call()'s own doc on why mixing roles (or two server loops) on
-     * one connection is unsafe, not just inadvisable; open a second
-     * Session for a second procedure instead of trying to serve two
-     * procedures off one.
+     * Only one serve() registration is allowed per Session at a time: each
+     * poll tick takes the next inbound CALL from the session's one queue
+     * (macula-go's ServeOneCall) and answers a CALL for a procedure it
+     * doesn't serve with unknown_next_peer, so a second serve() would answer
+     * CALLs meant for the first. Open a second Session for a second
+     * procedure instead of trying to serve two procedures off one. serve()
+     * also refuses while a subscribe() is active on the same Session, and
+     * call()/the DHT methods refuse while a serve() is (the one-role rule,
+     * #requireHandleNotServing).
      *
      * `opts.bytes` picks how bytes in each inbound CALL's payload reach
      * `handler`: "hex" (the default) or "tagged" (rpc.ts's BytesOutput).
@@ -302,13 +292,13 @@ export class Session {
     async serve(procedure, handler, opts = {}) {
         const bytesMode = bytesModeFor(opts.bytes);
         if (this.#activeServe !== null) {
-            throw new Error(`macula-ts: Session is already serving "${this.#activeServe.procedure}" -- macula-go's ServeOneCall reads ` +
-                `one frame at a time off the shared control stream, so a second concurrent serve() (or a serve() ` +
-                `alongside call()) on the same Session races; open a second Session instead.`);
+            throw new Error(`macula-ts: Session is already serving "${this.#activeServe.procedure}" -- a second serve() on the ` +
+                `same Session would answer CALLs meant for the first, since each serve() takes the next inbound CALL ` +
+                `from the session's one queue; open a second Session instead.`);
         }
         if (this.#activeSubscription !== null) {
             throw new Error(`macula-ts: Session.serve() while subscribe("${this.#activeSubscription.topic}") is active on the same ` +
-                `Session races on the shared control stream -- open a second Session for the other role.`);
+                `Session is not supported -- open a second Session for the other role.`);
         }
         const handle = this.#requireHandle();
         const identityHandle = this.#identity.handleForFfi();
@@ -386,9 +376,9 @@ export class Session {
      * signature or checks its expiry -- see DhtRecord's own doc (dht.ts).
      *
      * Real network I/O, off the main thread on the native side, exactly
-     * like call() -- and subject to the same same-Session exclusivity
-     * rule as call() (see #requireHandleNotServing's own doc): do not
-     * call this while serve() is active on the same Session. */
+     * like call() -- and subject to the same one-role rule as call() (see
+     * #requireHandleNotServing's own doc): it refuses while a serve() or
+     * subscribe() is active on the same Session. */
     async findRecordsByType(recordType) {
         const handle = this.#requireHandleNotServing("findRecordsByType");
         const json = await this.#enqueue(() => native.dhtFindRecordsByType(handle, this.#identity.handleForFfi(), recordType));
@@ -400,7 +390,7 @@ export class Session {
      * procedure, not just the first one found. `key` must be exactly 32
      * bytes -- see dht/record.go's ProcedureKey/StationEndpointKey/
      * ContentKey (macula-go) for how those are derived from the thing
-     * being looked up. Same I/O and exclusivity notes as
+     * being looked up. Same I/O and one-role notes as
      * findRecordsByType(). */
     async findRecords(key) {
         const handle = this.#requireHandleNotServing("findRecords");
@@ -412,7 +402,7 @@ export class Session {
      * dht.FindRecord). Resolves `null` when none exists -- mirrors
      * macula-go's own dht.ErrNotFound, translated to a value instead of a
      * thrown error since "not found" is an expected, routine outcome
-     * here, not exceptional. Same I/O and exclusivity notes as
+     * here, not exceptional. Same I/O and one-role notes as
      * findRecordsByType(). */
     async findRecord(key) {
         const handle = this.#requireHandleNotServing("findRecord");
@@ -454,7 +444,7 @@ export class Session {
      * silently becomes CBOR text. Typed arguments rule that mistake out
      * (see DhtRecord's own doc). `ttlMs` defaults to DHT_DEFAULT_TTL_MS
      * (48h). Resolves with the signed record actually stored. Same I/O
-     * and exclusivity notes as findRecordsByType(). */
+     * and one-role notes as findRecordsByType(). */
     async putProcedureAdvertisement(procedure, servingStation, opts = {}) {
         const handle = this.#requireHandleNotServing("putProcedureAdvertisement");
         requireKey32(servingStation);
@@ -471,7 +461,7 @@ export class Session {
      * own doc for wrapping macula-go's real constructor instead of a
      * generic JSON-payload builder (announcer_node/mcid are the same kind
      * of raw-byte field). `ttlMs` defaults to DHT_DEFAULT_TTL_MS (48h).
-     * Same I/O and exclusivity notes as findRecordsByType(). */
+     * Same I/O and one-role notes as findRecordsByType(). */
     async putContentAnnouncement(mcid, endpoint, ttlMs = DHT_DEFAULT_TTL_MS) {
         const handle = this.#requireHandleNotServing("putContentAnnouncement");
         if (mcid.length !== 34) {
@@ -484,11 +474,12 @@ export class Session {
      * serving station and its dialable host/port (macula-go's
      * `directdial.Resolve`), via this Session used only to query the DHT
      * -- it does not need to be connected to the station that ends up
-     * serving `procedure`. Retries past DHT propagation lag internally (up
-     * to ~5s, macula-go's own fixed schedule, not configurable here); a
-     * `procedure` nobody ever called `advertiseDirect()` for rejects
-     * cleanly after that window (a plain `Error` wrapping macula-go's
-     * `ErrProcedureNotAdvertised`), never a hang.
+     * serving `procedure`. Every advertisement that verifies is a
+     * candidate, and the DHT is asked again until one's station endpoint
+     * resolves or `opts.deadlineMs` passes (10 s when unset, macula-go's
+     * `directdial.DefaultResolveTimeout`); a `procedure` nobody ever called
+     * `advertiseDirect()` for rejects once that time is up (a plain `Error`
+     * wrapping macula-go's `ErrProcedureNotAdvertised`), never a hang.
      *
      * `opts.realm` must match whatever realm `procedure` was
      * `advertiseDirect()`d under, or the discovery URI the two sides
@@ -500,12 +491,16 @@ export class Session {
      * diagnostics).
      *
      * Real network I/O, off the main thread on the native side, subject to
-     * the same same-Session exclusivity rule as `call()`/the DHT methods
+     * the same one-role rule as `call()`/the DHT methods
      * (`#requireHandleNotServing`). */
     async resolveDirect(procedure, opts = {}) {
+        if (opts.deadlineMs !== undefined && !(opts.deadlineMs > 0)) {
+            throw new RangeError(`macula-ts: resolveDirect deadlineMs must be a positive number of milliseconds, got ${opts.deadlineMs}`);
+        }
         const handle = this.#requireHandleNotServing("resolveDirect");
         const realm = realmBytesFromHex(opts.realm);
-        const json = await this.#enqueue(() => native.directdialResolve(handle, this.#identity.handleForFfi(), realm, procedure));
+        const deadlineMs = opts.deadlineMs ?? 0;
+        const json = await this.#enqueue(() => native.directdialResolve(handle, this.#identity.handleForFfi(), realm, procedure, deadlineMs));
         return JSON.parse(json);
     }
     /** Direct-dial (caller side): resolves `procedure`'s provider (via
@@ -527,9 +522,9 @@ export class Session {
      *
      * Real network I/O (DHT lookups, a fresh QUIC dial, then the CALL
      * itself) -- off the main thread on the native side, subject to the
-     * same same-Session exclusivity rule as `call()` for THIS Session's own
-     * DHT-querying use (the separate dialed connection this opens
-     * internally is not this Session and is never exposed as one). */
+     * same one-role rule as `call()` for THIS Session's own DHT-querying use
+     * (the separate dialed connection this opens internally is not this
+     * Session and is never exposed as one). */
     async callDirect(procedure, payload, opts = {}) {
         const handle = this.#requireHandleNotServing("callDirect");
         const timeoutMs = opts.deadlineMs ?? DEFAULT_CALL_TIMEOUT_MS;
@@ -553,7 +548,7 @@ export class Session {
      * method's and ucan.ts's own doc for why: macula's UCAN gate is a
      * bearer-token check, not an audience match).
      *
-     * Same I/O and exclusivity notes as `callDirect()`. */
+     * Same I/O and one-role notes as `callDirect()`. */
     async callDirectWithUcan(procedure, payload, ucanToken, opts = {}) {
         const handle = this.#requireHandleNotServing("callDirectWithUcan");
         const timeoutMs = opts.deadlineMs ?? DEFAULT_CALL_TIMEOUT_MS;
@@ -592,10 +587,8 @@ export class Session {
      *
      * **Must NOT be called on a Session that is also actively
      * `serve()`-ing** -- enforced by the same `#requireHandleNotServing`
-     * guard `call()`/the DHT methods use, for the identical reason: this
-     * method's own `PutRecord` CALL reads a RESULT off the same shared
-     * control stream `serve()`'s poll loop is also reading, and the two
-     * would race (matches `directdial.AdvertiseDirect`'s own doc). A
+     * one-role check `call()`/the DHT methods use, since this method's own
+     * `PutRecord` is a CALL. A
      * provider that also serves `procedure` needs a SEPARATE Session (and
      * identity -- this fleet enforces one connection per identity, kicking
      * whichever connects second) to call this on.
@@ -620,13 +613,11 @@ export class Session {
      * observes a subscriber's own publish arriving back at it rather than
      * asserting it as a hard guarantee, for the same reason).
      *
-     * Deliberately NOT guarded by the same-Session exclusivity rule
-     * call()/serve()/subscribe()/the DHT methods share (see
-     * #requireHandleNotServing's own doc) -- publish() only ever writes,
-     * never reads off the shared control stream, so it does not race a
-     * concurrent serve()/subscribe() the way those do, and can run safely
-     * on the SAME Session a subscribe() of its own is active on -- exactly
-     * what a subscriber publishing to (and receiving) its own topic needs.
+     * Deliberately NOT subject to the one-role rule call()/serve()/
+     * subscribe()/the DHT methods share (see #requireHandleNotServing's own
+     * doc) -- publish() only ever writes, so it runs on the SAME Session a
+     * subscribe() of its own is active on -- exactly what a subscriber
+     * publishing to (and receiving) its own topic needs.
      *
      * `opts.realm` (see CallOptions.realm's own doc for the hex-string
      * format and exact-match semantics) scopes which realm this EVENT is
@@ -644,21 +635,18 @@ export class Session {
         await native.sessionPublish(handle, this.#identity.handleForFfi(), realm, topic, payloadJson, opts.ttlMs ?? 0);
     }
     /** Pubsub: sends a signed SUBSCRIBE for `topic`, then delivers every
-     * inbound EVENT for it to `handler` -- macula-go's own
-     * connection.Session.RunSubscriber (connection/subscriber.go) drives
-     * the actual read loop on the Go side, in a background goroutine, NOT
-     * reimplemented on top of a hand-rolled poll here (see cabi/pubsub.go's
-     * own doc for why RunSubscriber specifically, over the lower-level
-     * RecvEvent). Delivery is Go-driven, not JS-driven: unlike serve()'s
+     * inbound EVENT for it to `handler` -- a background goroutine on the Go
+     * side reads the macula-go connection.Subscription that SUBSCRIBE
+     * opened (see cabi/pubsub.go's own doc for why the SUBSCRIBE goes out
+     * before that goroutine starts). Delivery is Go-driven, not JS-driven:
+     * unlike serve()'s
      * poll loop, nothing on this side calls into the native layer
      * repeatedly to ask "did anything arrive yet" -- the addon calls INTO
      * this handler asynchronously, via a Napi::ThreadSafeFunction wired to
      * that background goroutine, whenever an EVENT actually shows up.
      *
      * Only one subscribe() (and no active serve()) is allowed per Session
-     * at a time -- same reasoning as serve()'s own one-at-a-time rule
-     * (#requireHandleNotServing's own doc): the background reader and any
-     * other read off this Session's shared control stream would race.
+     * at a time -- the one-role rule (#requireHandleNotServing's own doc).
      * Open a second Session for a second topic (or to serve/call
      * concurrently) instead.
      *
@@ -693,12 +681,11 @@ export class Session {
     async subscribe(topic, handler, opts = {}) {
         if (this.#activeServe !== null) {
             throw new Error(`macula-ts: Session.subscribe() while serve("${this.#activeServe.procedure}") is active on the same ` +
-                `Session races on the shared control stream -- open a second Session for the other role.`);
+                `Session is not supported -- open a second Session for the other role.`);
         }
         if (this.#activeSubscription !== null) {
-            throw new Error(`macula-ts: Session is already subscribed to "${this.#activeSubscription.topic}" -- macula-go's ` +
-                `RunSubscriber reads one frame at a time off the shared control stream, so a second concurrent ` +
-                `subscribe() on the same Session races; open a second Session instead.`);
+            throw new Error(`macula-ts: Session is already subscribed to "${this.#activeSubscription.topic}" -- one ` +
+                `subscribe() per Session is supported; open a second Session instead.`);
         }
         const handle = this.#requireHandle();
         const identityHandle = this.#identity.handleForFfi();
@@ -764,8 +751,8 @@ export class Session {
     }
     /** Content transfer: stores `data` (macula-go's content.Put, on this
      * Session's own fresh dedicated QUIC stream -- Session.
-     * OpenDedicatedStream on the Go side, NOT the shared control stream
-     * call()/serve()/the DHT methods/subscribe() all read from), chunking
+     * OpenDedicatedStream on the Go side, NOT the control stream
+     * call()/serve()/the DHT methods/subscribe() all use), chunking
      * automatically above manifest.DefaultChunkSize (256 KiB) and
      * returning the hex-encoded mcid it's now addressable by. `name` is
      * used ONLY on the chunked path (attached to the resulting manifest)
@@ -776,12 +763,11 @@ export class Session {
      * station may forget this content later, and there is no list/delete
      * operation. Treat this as "hand these bytes to a peer once."
      *
-     * Because Put opens its own dedicated stream instead of reading the
-     * shared control stream, this is, unlike call()/serve()/the DHT
-     * methods/subscribe(), never subject to Session's same-Session
-     * exclusivity guard (#requireHandleNotServing) -- it can run
-     * concurrently with an active serve()/subscribe() (or another
-     * putContent()/getContent()) on the same Session without racing.
+     * Because Put opens its own dedicated stream, this is, unlike call()/
+     * serve()/the DHT methods/subscribe(), never subject to Session's
+     * one-role rule (#requireHandleNotServing) -- it can run concurrently
+     * with an active serve()/subscribe() (or another putContent()/
+     * getContent()) on the same Session.
      *
      * Real network I/O (one or more signed CALLs on the new stream) --
      * runs off the main thread on the native side, like every other
@@ -805,9 +791,9 @@ export class Session {
      * (a bad session, a malformed mcid, a real transport error) rejects
      * with a plain Error instead.
      *
-     * Same dedicated-stream, no-exclusivity-guard reasoning as
-     * putContent() -- safe alongside an active serve()/subscribe() on the
-     * same Session. Real network I/O, runs off the main thread. */
+     * Not subject to the one-role rule, for the same dedicated-stream
+     * reason as putContent() -- safe alongside an active serve()/subscribe()
+     * on the same Session. Real network I/O, runs off the main thread. */
     async getContent(mcid) {
         const handle = this.#requireHandle();
         const data = await native.contentGet(handle, this.#identity.handleForFfi(), mcid);

package/dist/session.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.js","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,kEAAkE;AAClE,uEAAuE;AACvE,oEAAoE;AACpE,sEAAsE;AACtE,uBAAuB;AACvB,EAAE;AACF,sEAAsE;AACtE,qEAAqE;AACrE,uEAAuE;AACvE,sEAAsE;AACtE,QAAQ;AACR,OAAO,EAAE,MAAM,EAAe,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAiC,MAAM,UAAU,CAAC;AAI7E,OAAO,EACL,YAAY,EACZ,uBAAuB,EACvB,eAAe,EACf,aAAa,GAId,MAAM,UAAU,CAAC;AAyClB,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAE9C;;;;;;;;;;;;oEAYoE;AACpE,MAAM,UAAU,iBAAiB,CAAC,KAAyB;IACzD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,sEAAsE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjH,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AACnD,CAAC;AAyBD,MAAM,OAAO,OAAO;IAClB,OAAO,CAAgB;IACvB,gEAAgE;IAChE,oEAAoE;IACpE,oEAAoE;IACpE,2DAA2D;IAC3D,gEAAgE;IAChE,+DAA+D;IAC/D,kEAAkE;IAClE,iEAAiE;IACjE,+DAA+D;IAC/D,SAAS,CAAW;IACpB,YAAY,GAAuB,IAAI,CAAC;IACxC,mBAAmB,GAA8B,IAAI,CAAC;IAEtD,8DAA8D;IAC9D,8DAA8D;IAC9D,2DAA2D;IAC3D,qEAAqE;IACrE,qEAAqE;IACrE,qEAAqE;IACrE,kEAAkE;IAClE,kEAAkE;IAClE,oEAAoE;IACpE,oEAAoE;IACpE,kEAAkE;IAClE,qEAAqE;IACrE,oEAAoE;IACpE,oEAAoE;IACpE,gEAAgE;IAChE,mEAAmE;IACnE,oEAAoE;IACpE,mEAAmE;IACnE,oEAAoE;IACpE,8BAA8B;IAC9B,MAAM,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAE1C,QAAQ,CAAI,EAAoB;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACxC,gEAAgE;QAChE,8DAA8D;QAC9D,iEAAiE;QACjE,iEAAiE;QACjE,wBAAwB;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CACvB,GAAG,EAAE,CAAC,SAAS,EACf,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,YAAoB,MAAc,EAAE,QAAkB;QACpD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;IAC5B,CAAC;IAED;;;;;;;;;;;;4DAYwD;IACxD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,IAAY,EAAE,QAAkB;QACjE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC;QAChF,OAAO,IAAI,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACvC,CAAC;IAED,cAAc;QACZ,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;;;;;;;;;;;;;;2CAeuC;IACvC,wBAAwB,CAAC,MAAc;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,sBAAsB,MAAM,mBAAmB,IAAI,CAAC,YAAY,CAAC,SAAS,2BAA2B;gBACnG,yFAAyF,CAC5F,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,sBAAsB,MAAM,uBAAuB,IAAI,CAAC,mBAAmB,CAAC,KAAK,sBAAsB;gBACrG,8FAA8F,CACjG,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,qEAAqE;IACrE,IAAI,UAAU;QACZ,OAAO,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;IACzD,CAAC;IAED;;;;uEAImE;IACnE,IAAI,aAAa;QACf,OAAO,MAAM,CAAC,oBAAoB,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED;;;;;;;;;;;;;;;;;;;0DAmBsD;IACtD,KAAK,CAAC,KAAK,CAAC,QAAkB,EAAE,MAAM,GAAG,EAAE;QACzC,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI;YAAE,OAAO;QAClC,IAAI,IAAI,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;YACtC,8DAA8D;YAC9D,iEAAiE;YACjE,+DAA+D;YAC/D,0DAA0D;YAC1D,8DAA8D;YAC9D,+DAA+D;YAC/D,2DAA2D;YAC3D,+DAA+D;YAC/D,2DAA2D;YAC3D,sCAAsC;YACtC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC;YACxC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,iGAAiG,EAAE,GAAG,CAAC,CAAC;YACxH,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,MAAM,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,YAAY,EAAE,EAAE,MAAM,CAAC,CAAC;IACrE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;qDAuBiD;IACjD,KAAK,CAAC,IAAI,CAAC,SAAiB,EAAE,OAAkB,EAAE,IAAI,GAAgB,EAAE;QACtE,MAAM,MAAM,GAAG,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,IAAI,uBAAuB,CAAC;QAC7D,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAC5C,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,CAC/G,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAiB,CAAC;QAC1D,IAAI,QAAQ,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC,OAAO,CAAC;QACzC,MAAM,IAAI,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;yBA2BqB;IACrB,KAAK,CAAC,YAAY,CAAC,SAAiB,EAAE,OAAkB,EAAE,SAAwB,EAAE,IAAI,GAAgB,EAAE;QACxG,MAAM,MAAM,GAAG,IAAI,CAAC,wBAAwB,CAAC,cAAc,CAAC,CAAC;QAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,IAAI,uBAAuB,CAAC;QAC7D,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC;QAC1E,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAC5C,MAAM,CAAC,mBAAmB,CACxB,MAAM,EACN,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,EAC7B,SAAS,EACT,KAAK,EACL,WAAW,EACX,SAAS,EACT,KAAK,EACL,SAAS,CACV,CACF,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAiB,CAAC;QAC1D,IAAI,QAAQ,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC,OAAO,CAAC;QACzC,MAAM,IAAI,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBA4BiB;IACjB,KAAK,CAAC,KAAK,CACT,SAAiB,EACjB,OAA+D,EAC/D,IAAI,GAAiB,EAAE;QAEvB,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,0CAA0C,IAAI,CAAC,YAAY,CAAC,SAAS,sCAAsC;gBACzG,kGAAkG;gBAClG,6EAA6E,CAChF,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,+CAA+C,IAAI,CAAC,mBAAmB,CAAC,KAAK,2BAA2B;gBACtG,yFAAyF,CAC5F,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;QAErD,oEAAoE;QACpE,0DAA0D;QAC1D,4DAA4D;QAC5D,iEAAiE;QACjE,iEAAiE;QACjE,4DAA4D;QAC5D,4DAA4D;QAC5D,6DAA6D;QAC7D,kEAAkE;QAClE,+DAA+D;QAC/D,mDAAmD;QACnD,MAAM,eAAe,GAAG,KAAK,IAAmB,EAAE;YAChD,MAAM,IAAI,KAAK,CAAC,6BAA6B,SAAS,kCAAkC,CAAC,CAAC;QAC5F,CAAC,CAAC;QACF,IAAI,CAAC,YAAY,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;QAEzD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QACnG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;YACzB,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,QAAQ,GAAG,CAAC,KAAK,IAAI,EAAE;YAC3B,OAAO,CAAC,OAAO,EAAE,CAAC;gBAChB,IAAI,aAA4B,CAAC;gBACjC,IAAI,CAAC;oBACH,aAAa,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CACvC,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,CAAC,CACrF,CAAC;gBACJ,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,CAAC,OAAO,EAAE,CAAC;wBACb,OAAO,CAAC,KAAK,CAAC,6BAA6B,SAAS,4CAA4C,EAAE,GAAG,CAAC,CAAC;oBACzG,CAAC;oBACD,OAAO;gBACT,CAAC;gBACD,IAAI,aAAa,KAAK,IAAI;oBAAE,SAAS,CAAC,0CAA0C;gBAEhF,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,sBAAsB,CAAC,aAAa,EAAE,SAAS,CAAC,CAAc,CAAC;gBACjG,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;oBACrC,MAAM,MAAM,CAAC,sBAAsB,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC;gBACpF,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAChE,IAAI,CAAC;wBACH,MAAM,MAAM,CAAC,qBAAqB,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;oBAC5D,CAAC;oBAAC,OAAO,QAAQ,EAAE,CAAC;wBAClB,OAAO,CAAC,KAAK,CAAC,6BAA6B,SAAS,4BAA4B,EAAE,QAAQ,CAAC,CAAC;oBAC9F,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QAEL,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;YACrC,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,QAAQ,CAAC;YACf,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;YACzB,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;YACrG,CAAC;QACH,CAAC,CAAC;QACF,IAAI,CAAC,YAAY,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;gEAY4D;IAC5D,KAAK,CAAC,iBAAiB,CAAC,UAAkC;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,CAAC;QAClE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;QACvH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAgB,CAAC;IACzC,CAAC;IAED;;;;;;;8BAO0B;IAC1B,KAAK,CAAC,WAAW,CAAC,GAAe;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,wBAAwB,CAAC,aAAa,CAAC,CAAC;QAC5D,YAAY,CAAC,GAAG,CAAC,CAAC;QAClB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;QAC1G,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAgB,CAAC;IACzC,CAAC;IAED;;;;;8BAK0B;IAC1B,KAAK,CAAC,UAAU,CAAC,GAAe;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;QAC3D,YAAY,CAAC,GAAG,CAAC,CAAC;QAClB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;QACzG,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC;IAChE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uDAkCmD;IACnD,KAAK,CAAC,yBAAyB,CAC7B,SAAiB,EACjB,cAA0B,EAC1B,IAAI,GAA2C,EAAE;QAEjD,MAAM,MAAM,GAAG,IAAI,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,CAAC;QAC1E,YAAY,CAAC,cAAc,CAAC,CAAC;QAC7B,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CACpC,MAAM,CAAC,4BAA4B,CACjC,MAAM,EACN,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,EAC7B,IAAI,CAAC,KAAK,EACV,SAAS,EACT,cAAc,EACd,IAAI,CAAC,KAAK,IAAI,kBAAkB,CACjC,CACF,CAAC;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAc,CAAC;IACvC,CAAC;IAED;;;;;;;;gEAQ4D;IAC5D,KAAK,CAAC,sBAAsB,CAAC,IAAgB,EAAE,QAAgB,EAAE,KAAK,GAAG,kBAAkB;QACzF,MAAM,MAAM,GAAG,IAAI,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,CAAC;QACvE,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,sEAAsE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CACpC,MAAM,CAAC,yBAAyB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAC/F,CAAC;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAc,CAAC;IACvC,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;uCAqBmC;IACnC,KAAK,CAAC,aAAa,CAAC,SAAiB,EAAE,IAAI,GAAuB,EAAE;QAClE,MAAM,MAAM,GAAG,IAAI,CAAC,wBAAwB,CAAC,eAAe,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;QAC1H,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqB,CAAC;IAC9C,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;sEAqBkE;IAClE,KAAK,CAAC,UAAU,CAAC,SAAiB,EAAE,OAAkB,EAAE,IAAI,GAAgB,EAAE;QAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,IAAI,uBAAuB,CAAC;QAC7D,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAC5C,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,CAClH,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAiB,CAAC;QAC1D,IAAI,QAAQ,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC,OAAO,CAAC;QACzC,MAAM,IAAI,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;;;;;;2DAWuD;IACvD,KAAK,CAAC,kBAAkB,CAAC,SAAiB,EAAE,OAAkB,EAAE,SAAwB,EAAE,IAAI,GAAgB,EAAE;QAC9G,MAAM,MAAM,GAAG,IAAI,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,CAAC;QACnE,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,IAAI,uBAAuB,CAAC;QAC7D,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC;QAC1E,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAC5C,MAAM,CAAC,sBAAsB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,CACjI,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAiB,CAAC;QAC1D,IAAI,QAAQ,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC,OAAO,CAAC;QACzC,MAAM,IAAI,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oEAkCgE;IAChE,KAAK,CAAC,eAAe,CAAC,SAAiB,EAAE,IAAI,GAA2B,EAAE;QACxE,MAAM,MAAM,GAAG,IAAI,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,CAAC;QAChE,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CACvB,MAAM,CAAC,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,IAAI,kBAAkB,CAAC,CACtH,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eA6BW;IACX,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,OAAkB,EAAE,IAAI,GAAmB,EAAE;QACxE,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;IACjH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8CA8C0C;IAC1C,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,OAAmC,EAAE,IAAI,GAAqB,EAAE;QAC7F,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,+CAA+C,IAAI,CAAC,YAAY,CAAC,SAAS,2BAA2B;gBACnG,yFAAyF,CAC5F,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,gDAAgD,IAAI,CAAC,mBAAmB,CAAC,KAAK,mBAAmB;gBAC/F,gGAAgG;gBAChG,uEAAuE,CAC1E,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAE3C,mEAAmE;QACnE,kEAAkE;QAClE,gEAAgE;QAChE,8DAA8D;QAC9D,6BAA6B;QAC7B,MAAM,eAAe,GAAG,KAAK,IAAmB,EAAE;YAChD,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,kCAAkC,CAAC,CAAC;QAC5F,CAAC,CAAC;QACF,IAAI,CAAC,mBAAmB,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;QAE5D,yEAAyE;QACzE,+DAA+D;QAC/D,mEAAmE;QACnE,qEAAqE;QACrE,IAAI,kBAA2B,CAAC;QAChC,IAAI,WAAW,GAAyB,IAAI,CAAC;QAE7C,MAAM,QAAQ,GAAG,KAAK,IAAmB,EAAE;YACzC,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;YAChC,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC7E,CAAC,CAAC;QACF,oEAAoE;QACpE,gEAAgE;QAChE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,iEAAiE;QACjE,MAAM,IAAI,GAAG,GAAkB,EAAE;YAC/B,IAAI,WAAW,KAAK,IAAI;gBAAE,WAAW,GAAG,QAAQ,EAAE,CAAC;YACnD,OAAO,WAAW,CAAC;QACrB,CAAC,CAAC;QAEF,MAAM,QAAQ,GAAG,CAAC,KAAY,EAAQ,EAAE;YACtC,OAAO,CAAC,KAAK,CAAC,iCAAiC,KAAK,yCAAyC,EAAE,KAAK,CAAC,CAAC;YACtG,+DAA+D;YAC/D,gEAAgE;YAChE,gEAAgE;YAChE,8DAA8D;YAC9D,gEAAgE;YAChE,mEAAmE;YACnE,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACvB,IAAI,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC,CAAC;QAEF,IAAI,CAAC;YACH,kBAAkB,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAC5C,MAAM,CAAC,qBAAqB,CAAC,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;gBACzE,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC1B,QAAQ,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,qBAAqB,CAAC,CAAC,CAAC;oBACxD,OAAO;gBACT,CAAC;gBACD,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAc,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;YACzG,CAAC,EAAE,SAAS,CAAC,CACd,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;YAChC,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,mBAAmB,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;uCAuBmC;IACnC,KAAK,CAAC,UAAU,CAAC,IAAgB,EAAE,IAAI,GAAG,EAAE;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACxF,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;;;;;;mEAgB+D;IAC/D,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,IAAI,CAAC,CAAC;QAClF,IAAI,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,SAAS,YAAY,CAAC,GAAe;IACnC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,oDAAoD,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACpF,CAAC;AACH,CAAC"}
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,kEAAkE;AAClE,uEAAuE;AACvE,oEAAoE;AACpE,sEAAsE;AACtE,uBAAuB;AACvB,EAAE;AACF,sEAAsE;AACtE,qEAAqE;AACrE,uEAAuE;AACvE,sEAAsE;AACtE,QAAQ;AACR,OAAO,EAAE,MAAM,EAAe,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAiC,MAAM,UAAU,CAAC;AAI7E,OAAO,EACL,YAAY,EACZ,uBAAuB,EACvB,eAAe,EACf,aAAa,GAId,MAAM,UAAU,CAAC;AAyClB,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAE9C;;;;;;;;;;;;oEAYoE;AACpE,MAAM,UAAU,iBAAiB,CAAC,KAAyB;IACzD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,sEAAsE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjH,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AACnD,CAAC;AAkBD,MAAM,OAAO,OAAO;IAClB,OAAO,CAAgB;IACvB,gEAAgE;IAChE,oEAAoE;IACpE,oEAAoE;IACpE,2DAA2D;IAC3D,gEAAgE;IAChE,+DAA+D;IAC/D,kEAAkE;IAClE,iEAAiE;IACjE,+DAA+D;IAC/D,SAAS,CAAW;IACpB,YAAY,GAAuB,IAAI,CAAC;IACxC,mBAAmB,GAA8B,IAAI,CAAC;IAEtD,gEAAgE;IAChE,gEAAgE;IAChE,sEAAsE;IACtE,qEAAqE;IACrE,sEAAsE;IACtE,sEAAsE;IACtE,kEAAkE;IAClE,oEAAoE;IACpE,oEAAoE;IACpE,mEAAmE;IACnE,wEAAwE;IACxE,0DAA0D;IAC1D,wEAAwE;IACxE,+DAA+D;IAC/D,MAAM,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAE1C,QAAQ,CAAI,EAAoB;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACxC,gEAAgE;QAChE,8DAA8D;QAC9D,iEAAiE;QACjE,iEAAiE;QACjE,wBAAwB;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CACvB,GAAG,EAAE,CAAC,SAAS,EACf,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,YAAoB,MAAc,EAAE,QAAkB;QACpD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;IAC5B,CAAC;IAED;;;;;;;;;;;;4DAYwD;IACxD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,IAAY,EAAE,QAAkB;QACjE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC;QAChF,OAAO,IAAI,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACvC,CAAC;IAED,cAAc;QACZ,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;;;;;;;;;;sDAWkD;IAClD,wBAAwB,CAAC,MAAc;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,sBAAsB,MAAM,mBAAmB,IAAI,CAAC,YAAY,CAAC,SAAS,2BAA2B;gBACnG,uEAAuE,CAC1E,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,sBAAsB,MAAM,uBAAuB,IAAI,CAAC,mBAAmB,CAAC,KAAK,sBAAsB;gBACrG,4EAA4E,CAC/E,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,qEAAqE;IACrE,IAAI,UAAU;QACZ,OAAO,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;IACzD,CAAC;IAED;;;;uEAImE;IACnE,IAAI,aAAa;QACf,OAAO,MAAM,CAAC,oBAAoB,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED;;;;;;;;;;;;;;;;;;;0DAmBsD;IACtD,KAAK,CAAC,KAAK,CAAC,QAAkB,EAAE,MAAM,GAAG,EAAE;QACzC,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI;YAAE,OAAO;QAClC,IAAI,IAAI,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;YACtC,8DAA8D;YAC9D,iEAAiE;YACjE,+DAA+D;YAC/D,0DAA0D;YAC1D,8DAA8D;YAC9D,+DAA+D;YAC/D,2DAA2D;YAC3D,+DAA+D;YAC/D,2DAA2D;YAC3D,sCAAsC;YACtC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC;YACxC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,iGAAiG,EAAE,GAAG,CAAC,CAAC;YACxH,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,MAAM,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,YAAY,EAAE,EAAE,MAAM,CAAC,CAAC;IACrE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;iEAoB6D;IAC7D,KAAK,CAAC,IAAI,CAAC,SAAiB,EAAE,OAAkB,EAAE,IAAI,GAAgB,EAAE;QACtE,MAAM,MAAM,GAAG,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,IAAI,uBAAuB,CAAC;QAC7D,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAC5C,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,CAC/G,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAiB,CAAC;QAC1D,IAAI,QAAQ,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC,OAAO,CAAC;QACzC,MAAM,IAAI,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;uCA0BmC;IACnC,KAAK,CAAC,YAAY,CAAC,SAAiB,EAAE,OAAkB,EAAE,SAAwB,EAAE,IAAI,GAAgB,EAAE;QACxG,MAAM,MAAM,GAAG,IAAI,CAAC,wBAAwB,CAAC,cAAc,CAAC,CAAC;QAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,IAAI,uBAAuB,CAAC;QAC7D,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC;QAC1E,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAC5C,MAAM,CAAC,mBAAmB,CACxB,MAAM,EACN,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,EAC7B,SAAS,EACT,KAAK,EACL,WAAW,EACX,SAAS,EACT,KAAK,EACL,SAAS,CACV,CACF,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAiB,CAAC;QAC1D,IAAI,QAAQ,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC,OAAO,CAAC;QACzC,MAAM,IAAI,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBAgCiB;IACjB,KAAK,CAAC,KAAK,CACT,SAAiB,EACjB,OAA+D,EAC/D,IAAI,GAAiB,EAAE;QAEvB,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,0CAA0C,IAAI,CAAC,YAAY,CAAC,SAAS,+BAA+B;gBAClG,sGAAsG;gBACtG,8DAA8D,CACjE,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,+CAA+C,IAAI,CAAC,mBAAmB,CAAC,KAAK,2BAA2B;gBACtG,uEAAuE,CAC1E,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;QAErD,oEAAoE;QACpE,0DAA0D;QAC1D,4DAA4D;QAC5D,iEAAiE;QACjE,iEAAiE;QACjE,4DAA4D;QAC5D,4DAA4D;QAC5D,6DAA6D;QAC7D,kEAAkE;QAClE,+DAA+D;QAC/D,mDAAmD;QACnD,MAAM,eAAe,GAAG,KAAK,IAAmB,EAAE;YAChD,MAAM,IAAI,KAAK,CAAC,6BAA6B,SAAS,kCAAkC,CAAC,CAAC;QAC5F,CAAC,CAAC;QACF,IAAI,CAAC,YAAY,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;QAEzD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QACnG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;YACzB,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,QAAQ,GAAG,CAAC,KAAK,IAAI,EAAE;YAC3B,OAAO,CAAC,OAAO,EAAE,CAAC;gBAChB,IAAI,aAA4B,CAAC;gBACjC,IAAI,CAAC;oBACH,aAAa,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CACvC,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,CAAC,CACrF,CAAC;gBACJ,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,CAAC,OAAO,EAAE,CAAC;wBACb,OAAO,CAAC,KAAK,CAAC,6BAA6B,SAAS,4CAA4C,EAAE,GAAG,CAAC,CAAC;oBACzG,CAAC;oBACD,OAAO;gBACT,CAAC;gBACD,IAAI,aAAa,KAAK,IAAI;oBAAE,SAAS,CAAC,0CAA0C;gBAEhF,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,sBAAsB,CAAC,aAAa,EAAE,SAAS,CAAC,CAAc,CAAC;gBACjG,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;oBACrC,MAAM,MAAM,CAAC,sBAAsB,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC;gBACpF,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAChE,IAAI,CAAC;wBACH,MAAM,MAAM,CAAC,qBAAqB,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;oBAC5D,CAAC;oBAAC,OAAO,QAAQ,EAAE,CAAC;wBAClB,OAAO,CAAC,KAAK,CAAC,6BAA6B,SAAS,4BAA4B,EAAE,QAAQ,CAAC,CAAC;oBAC9F,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QAEL,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;YACrC,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,QAAQ,CAAC;YACf,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;YACzB,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;YACrG,CAAC;QACH,CAAC,CAAC;QACF,IAAI,CAAC,YAAY,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;oDAYgD;IAChD,KAAK,CAAC,iBAAiB,CAAC,UAAkC;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,CAAC;QAClE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;QACvH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAgB,CAAC;IACzC,CAAC;IAED;;;;;;;8BAO0B;IAC1B,KAAK,CAAC,WAAW,CAAC,GAAe;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,wBAAwB,CAAC,aAAa,CAAC,CAAC;QAC5D,YAAY,CAAC,GAAG,CAAC,CAAC;QAClB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;QAC1G,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAgB,CAAC;IACzC,CAAC;IAED;;;;;8BAK0B;IAC1B,KAAK,CAAC,UAAU,CAAC,GAAe;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;QAC3D,YAAY,CAAC,GAAG,CAAC,CAAC;QAClB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;QACzG,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC;IAChE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oDAkCgD;IAChD,KAAK,CAAC,yBAAyB,CAC7B,SAAiB,EACjB,cAA0B,EAC1B,IAAI,GAA2C,EAAE;QAEjD,MAAM,MAAM,GAAG,IAAI,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,CAAC;QAC1E,YAAY,CAAC,cAAc,CAAC,CAAC;QAC7B,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CACpC,MAAM,CAAC,4BAA4B,CACjC,MAAM,EACN,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,EAC7B,IAAI,CAAC,KAAK,EACV,SAAS,EACT,cAAc,EACd,IAAI,CAAC,KAAK,IAAI,kBAAkB,CACjC,CACF,CAAC;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAc,CAAC;IACvC,CAAC;IAED;;;;;;;;6DAQyD;IACzD,KAAK,CAAC,sBAAsB,CAAC,IAAgB,EAAE,QAAgB,EAAE,KAAK,GAAG,kBAAkB;QACzF,MAAM,MAAM,GAAG,IAAI,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,CAAC;QACvE,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,sEAAsE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CACpC,MAAM,CAAC,yBAAyB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAC/F,CAAC;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAc,CAAC;IACvC,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;uCAsBmC;IACnC,KAAK,CAAC,aAAa,CAAC,SAAiB,EAAE,IAAI,GAA4C,EAAE;QACvF,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,UAAU,CAAC,sFAAsF,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QAChI,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,wBAAwB,CAAC,eAAe,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CACpC,MAAM,CAAC,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,CAAC,CAC9F,CAAC;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqB,CAAC;IAC9C,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;+CAqB2C;IAC3C,KAAK,CAAC,UAAU,CAAC,SAAiB,EAAE,OAAkB,EAAE,IAAI,GAAgB,EAAE;QAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,IAAI,uBAAuB,CAAC;QAC7D,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAC5C,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,CAClH,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAiB,CAAC;QAC1D,IAAI,QAAQ,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC,OAAO,CAAC;QACzC,MAAM,IAAI,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;;;;;;wDAWoD;IACpD,KAAK,CAAC,kBAAkB,CAAC,SAAiB,EAAE,OAAkB,EAAE,SAAwB,EAAE,IAAI,GAAgB,EAAE;QAC9G,MAAM,MAAM,GAAG,IAAI,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,CAAC;QACnE,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,IAAI,uBAAuB,CAAC;QAC7D,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC;QAC1E,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAC5C,MAAM,CAAC,sBAAsB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,CACjI,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAiB,CAAC;QAC1D,IAAI,QAAQ,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC,OAAO,CAAC;QACzC,MAAM,IAAI,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oEAgCgE;IAChE,KAAK,CAAC,eAAe,CAAC,SAAiB,EAAE,IAAI,GAA2B,EAAE;QACxE,MAAM,MAAM,GAAG,IAAI,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,CAAC;QAChE,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CACvB,MAAM,CAAC,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,IAAI,kBAAkB,CAAC,CACtH,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;eA2BW;IACX,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,OAAkB,EAAE,IAAI,GAAmB,EAAE;QACxE,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;IACjH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8CA2C0C;IAC1C,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,OAAmC,EAAE,IAAI,GAAqB,EAAE;QAC7F,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,+CAA+C,IAAI,CAAC,YAAY,CAAC,SAAS,2BAA2B;gBACnG,uEAAuE,CAC1E,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,gDAAgD,IAAI,CAAC,mBAAmB,CAAC,KAAK,WAAW;gBACvF,sEAAsE,CACzE,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAE3C,mEAAmE;QACnE,kEAAkE;QAClE,gEAAgE;QAChE,8DAA8D;QAC9D,6BAA6B;QAC7B,MAAM,eAAe,GAAG,KAAK,IAAmB,EAAE;YAChD,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,kCAAkC,CAAC,CAAC;QAC5F,CAAC,CAAC;QACF,IAAI,CAAC,mBAAmB,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;QAE5D,yEAAyE;QACzE,+DAA+D;QAC/D,mEAAmE;QACnE,qEAAqE;QACrE,IAAI,kBAA2B,CAAC;QAChC,IAAI,WAAW,GAAyB,IAAI,CAAC;QAE7C,MAAM,QAAQ,GAAG,KAAK,IAAmB,EAAE;YACzC,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;YAChC,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC7E,CAAC,CAAC;QACF,oEAAoE;QACpE,gEAAgE;QAChE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,iEAAiE;QACjE,MAAM,IAAI,GAAG,GAAkB,EAAE;YAC/B,IAAI,WAAW,KAAK,IAAI;gBAAE,WAAW,GAAG,QAAQ,EAAE,CAAC;YACnD,OAAO,WAAW,CAAC;QACrB,CAAC,CAAC;QAEF,MAAM,QAAQ,GAAG,CAAC,KAAY,EAAQ,EAAE;YACtC,OAAO,CAAC,KAAK,CAAC,iCAAiC,KAAK,yCAAyC,EAAE,KAAK,CAAC,CAAC;YACtG,+DAA+D;YAC/D,gEAAgE;YAChE,gEAAgE;YAChE,8DAA8D;YAC9D,gEAAgE;YAChE,mEAAmE;YACnE,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACvB,IAAI,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC,CAAC;QAEF,IAAI,CAAC;YACH,kBAAkB,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAC5C,MAAM,CAAC,qBAAqB,CAAC,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;gBACzE,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC1B,QAAQ,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,qBAAqB,CAAC,CAAC,CAAC;oBACxD,OAAO;gBACT,CAAC;gBACD,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAc,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;YACzG,CAAC,EAAE,SAAS,CAAC,CACd,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;YAChC,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,mBAAmB,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;uCAsBmC;IACnC,KAAK,CAAC,UAAU,CAAC,IAAgB,EAAE,IAAI,GAAG,EAAE;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACxF,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;;;;;;0EAgBsE;IACtE,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,IAAI,CAAC,CAAC;QAClF,IAAI,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,SAAS,YAAY,CAAC,GAAe;IACnC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,oDAAoD,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACpF,CAAC;AACH,CAAC"}

package/dist/ucan.d.ts

@@ -54,9 +54,11 @@ export declare class Ucan {
     /** The `iss` claim -- an opaque DID string (see didFromNodeId's own
      * doc: not parsed or resolved by this module, carried through as-is). */
     readonly issuer: string;
-    /** The `aud` claim. NOT checked against any local identity by this
-     * module or by Session.callWithUcan -- see this module's own doc on
-     * why: the real gate is bearer-token, not audience-matched. */
+    /** The `aud` claim: for a token Ucan.mint() wrote, the NodeID, as
+     * lowercase hex, of the caller it is for. A gated provider accepts the
+     * token only from that caller; this module and Session.callWithUcan
+     * don't compare it with any local identity (see this module's own
+     * doc). */
     readonly audience: string;
     readonly capabilities: readonly UcanCapability[];
     /** The `exp` claim, unix seconds, or `null` if this token has none
@@ -87,12 +89,12 @@ export declare class Ucan {
     /** Mints a fresh UCAN token, self-issued and signed by `issuer`'s own
      * private key (macula-go's `ucan.Create`) -- the resulting token
      * verifies against `issuer`'s own public key (NodeID), matching
-     * `ucan.Create`'s documented convention. `issuer`'s and `audience`'s
-     * DID strings are both built automatically as
-     * `did:macula:<hex NodeID>` (see `didFromNodeId`'s own doc for why:
-     * this ecosystem's own established convention, not invented here) --
-     * there is no way to mint with a custom DID string through this
-     * method.
+     * `ucan.Create`'s documented convention. `iss` is written as
+     * `did:macula:<hex NodeID>` (`didFromNodeId`) and `aud` as `audience`'s
+     * lowercase hex (`audienceFromNodeId`), the form a gated provider
+     * compares with the calling identity: pass the NodeID of the identity
+     * that will present the token. There is no way to mint with custom
+     * claim strings through this method.
      *
      * No network I/O -- this never touches a Session or a station; a
      * token can be minted entirely offline given only an `Identity`. */

package/dist/ucan.js

@@ -18,35 +18,31 @@
 // out of scope for this slice. See README.md's "What's explicitly not
 // yet implemented" section.
 //
-// CRITICAL, established finding this module's design respects: macula's
-// UCAN gate is a BEARER-token check. The real verify chain (Erlang's
-// authorize_policy + macula_ucan_nif:verify/2, identical across every
-// SDK port including this one's macula-go dependency) checks ONLY the
-// token's signature and expiry against its own issuer -- it never checks
-// the calling identity against the token's `aud` claim. Ucan.mint()
-// therefore places NO restriction relating `issuer`'s identity to
-// `audience` (any 32-byte NodeID is accepted, including one with no
-// relationship to the minting identity at all), and Session.callWithUcan
-// (session.ts) attaches whatever token it is given with no local
-// "does my identity match this token's audience" guard. Adding either
-// would reject configurations the real wire-level gate accepts fine, and
-// would misrepresent a security property the mesh does not actually
-// enforce.
+// A provider gated with ucan.Required accepts a token only when it
+// verifies against the required issuer and its `aud` claim is the calling
+// identity's NodeID as lowercase hex. Ucan.mint() writes `audience` in
+// that form, so mint a token for the identity that will present it; any
+// 32-byte NodeID is accepted as the audience, related to the minting
+// identity or not. Session.callWithUcan (session.ts) attaches whatever
+// token it is given and leaves the check to the provider.
 import { native } from "./binding.js";
-/** Builds this ecosystem's own DID convention for a raw NodeID --
- * "did:macula:<lowercase hex NodeID>" -- matching macula-go's own tests
- * (ucan/ucan_test.go, connection/serve_ucan_test.go) and its
- * examples/ucan/main.go exactly, rather than inventing a different
- * scheme here. This is bookkeeping only: macula-go's ucan package treats
- * `iss`/`aud` as opaque strings it never parses or resolves (that's
- * macula_did_nif's job on the Erlang reference, out of scope for both
- * SDKs) -- the actual cryptographic verification a relying party performs
- * is keyed by a raw public key it already has out of band (ucan.Verify's
- * own `publicKey []byte` parameter, ucan/policy.go's
- * `Required(issuerPublicKey []byte)`), never by parsing this string. */
+/** The `iss` claim this module writes for a NodeID:
+ * "did:macula:<lowercase hex NodeID>". macula-go's ucan package never
+ * parses or resolves it (that's macula_did_nif's job on the Erlang
+ * reference, out of scope for both SDKs) -- the cryptographic check a
+ * relying party performs is keyed by a raw public key it already has out
+ * of band (ucan.Verify's own `publicKey []byte` parameter,
+ * ucan/policy.go's `Required(issuerPublicKey []byte)`), never by parsing
+ * this string. */
 function didFromNodeId(nodeId) {
     return `did:macula:${Buffer.from(nodeId).toString("hex")}`;
 }
+/** The `aud` claim this module writes for a NodeID: its lowercase hex,
+ * the form a gated provider compares with the calling identity
+ * (macula-go's ucan.Policy.Check). */
+function audienceFromNodeId(nodeId) {
+    return Buffer.from(nodeId).toString("hex");
+}
 /** A decoded (never verified -- see this module's own doc) UCAN token:
  * its raw wire text plus every claim cabi/ucan.go's macula_ucan_decode
  * exposes. Both Ucan.mint() and Ucan.decode() return this same shape --
@@ -63,9 +59,11 @@ export class Ucan {
     /** The `iss` claim -- an opaque DID string (see didFromNodeId's own
      * doc: not parsed or resolved by this module, carried through as-is). */
     issuer;
-    /** The `aud` claim. NOT checked against any local identity by this
-     * module or by Session.callWithUcan -- see this module's own doc on
-     * why: the real gate is bearer-token, not audience-matched. */
+    /** The `aud` claim: for a token Ucan.mint() wrote, the NodeID, as
+     * lowercase hex, of the caller it is for. A gated provider accepts the
+     * token only from that caller; this module and Session.callWithUcan
+     * don't compare it with any local identity (see this module's own
+     * doc). */
     audience;
     capabilities;
     /** The `exp` claim, unix seconds, or `null` if this token has none
@@ -110,12 +108,12 @@ export class Ucan {
     /** Mints a fresh UCAN token, self-issued and signed by `issuer`'s own
      * private key (macula-go's `ucan.Create`) -- the resulting token
      * verifies against `issuer`'s own public key (NodeID), matching
-     * `ucan.Create`'s documented convention. `issuer`'s and `audience`'s
-     * DID strings are both built automatically as
-     * `did:macula:<hex NodeID>` (see `didFromNodeId`'s own doc for why:
-     * this ecosystem's own established convention, not invented here) --
-     * there is no way to mint with a custom DID string through this
-     * method.
+     * `ucan.Create`'s documented convention. `iss` is written as
+     * `did:macula:<hex NodeID>` (`didFromNodeId`) and `aud` as `audience`'s
+     * lowercase hex (`audienceFromNodeId`), the form a gated provider
+     * compares with the calling identity: pass the NodeID of the identity
+     * that will present the token. There is no way to mint with custom
+     * claim strings through this method.
      *
      * No network I/O -- this never touches a Session or a station; a
      * token can be minted entirely offline given only an `Identity`. */
@@ -123,7 +121,7 @@ export class Ucan {
         if (audience.length !== 32) {
             throw new Error(`macula-ts: UCAN audience NodeID must be exactly 32 bytes, got ${audience.length}`);
         }
-        const token = native.ucanMint(issuer.handleForFfi(), didFromNodeId(issuer.nodeId), didFromNodeId(audience), JSON.stringify(capabilities ?? []), opts.expiresAt, opts.notBefore, opts.nonce ?? "", opts.facts !== undefined ? JSON.stringify(opts.facts) : undefined, opts.proofs !== undefined ? JSON.stringify(opts.proofs) : undefined);
+        const token = native.ucanMint(issuer.handleForFfi(), didFromNodeId(issuer.nodeId), audienceFromNodeId(audience), JSON.stringify(capabilities ?? []), opts.expiresAt, opts.notBefore, opts.nonce ?? "", opts.facts !== undefined ? JSON.stringify(opts.facts) : undefined, opts.proofs !== undefined ? JSON.stringify(opts.proofs) : undefined);
         return Ucan.decode(token);
     }
     /** Decodes `token`'s claims WITHOUT verifying its signature or