@oaath/server 0.1.0

package/dist/apns.js

@@ -0,0 +1,488 @@
+import { b as relayFailure, c as canonicalIdentifier, m as timestamp, s as boundedText } from "./records-Bgr-9PUh.js";
+import { a as relayNow, n as randomIdentifier } from "./challenge-AGTmUfj2.js";
+import { exactRecord } from "@oaath/protocol";
+import { createPrivateKey, sign } from "node:crypto";
+//#region src/apns/sender.ts
+/**
+* EXPERIMENTAL PREVIEW — Apple provider-token signing and APNs payload
+* construction.
+*
+* Preview means: no stability guarantee and no production qualification. Apple
+* provisioning, KMS key rotation, and production operations are later work.
+*
+* Credentials are an injected capability. This package reads no environment
+* variable anywhere in `src/`: a deployment hands over the key material it
+* already owns, and the repository's normal gates scrub `APNS_*`/`APPLE_*` out
+* of the test environment so nothing can drift into an implicit default.
+*
+* The injected capability is a trust boundary, so it is exact-captured once
+* here: unknown fields, a non-P-256 key, or a non-Apple key/team id fail closed
+* with `relay_apns_credentials_invalid`. The provider error is never surfaced,
+* because it can quote key material.
+*
+* Payloads stay opaque. Human text is a phone-side localization key, and the
+* only variable rendered is the projection's bounded match code. No permission,
+* scope, client, chain, or account detail is ever serialized: the payload
+* transits Apple.
+*
+* @author taek <leekt216@gmail.com>
+*/
+/** Apple's hard limit for an alert notification payload. */
+const APNS_PAYLOAD_MAX_BYTES = 4096;
+const OAATH_APNS_PAYLOAD_VERSION = "oaath.apns-payload/v1";
+/** Localization keys: the phone owns every word the owner reads. */
+const APNS_TITLE_LOC_KEY = "oaath_approval_title";
+const APNS_BODY_LOC_KEY = "oaath_approval_body";
+/** Apple rejects a token older than one hour and re-signing more often than 20 minutes. */
+const APNS_TOKEN_MIN_REUSE_MS = 12e5;
+const APNS_TOKEN_MAX_REUSE_MS = 36e5;
+const DEFAULT_REUSE_MS = 27e5;
+const MAX_PEM_LENGTH = 8192;
+/** `apns-collapse-id` is limited to 64 bytes. */
+const MAX_COLLAPSE_ID = 64;
+const APPLE_TEN_CHARACTER_ID = /^[A-Z0-9]{10}$/u;
+const DEVICE_TOKEN = /^[0-9a-fA-F]{64,200}$/u;
+const CREDENTIALS_INVALID = "relay_apns_credentials_invalid";
+const INVALID = "relay_request_invalid";
+function boundedPem(value) {
+	if (typeof value !== "string" || value.length < 1 || value.length > MAX_PEM_LENGTH) return relayFailure(CREDENTIALS_INVALID, "privateKeyPem must be a bounded non-empty PEM");
+	return value;
+}
+/**
+* Bounded, but wide enough that an oversized display payload is a reachable
+* failure instead of an unprovable one: the 4096-byte payload check owns it.
+*/
+function boundedDisplayPayload(value) {
+	if (typeof value !== "string" || value.length < 1 || value.length > 4096) return relayFailure(INVALID, "displayPayload must be a bounded non-empty string");
+	return value;
+}
+function captureCredentials(value) {
+	const context = /* @__PURE__ */ new WeakSet();
+	const fail = (message) => relayFailure(CREDENTIALS_INVALID, message);
+	const record = exactRecord(value, [
+		"privateKeyPem",
+		"keyId",
+		"teamId",
+		"topic"
+	], "apns credentials", context, fail);
+	const keyId = canonicalIdentifier(record.keyId, "keyId", CREDENTIALS_INVALID);
+	const teamId = canonicalIdentifier(record.teamId, "teamId", CREDENTIALS_INVALID);
+	if (!APPLE_TEN_CHARACTER_ID.test(keyId) || !APPLE_TEN_CHARACTER_ID.test(teamId)) fail("keyId and teamId must be Apple ten-character identifiers");
+	return Object.freeze({
+		privateKeyPem: boundedPem(record.privateKeyPem),
+		keyId,
+		teamId,
+		topic: canonicalIdentifier(record.topic, "topic", CREDENTIALS_INVALID)
+	});
+}
+function signingKey(privateKeyPem) {
+	let key;
+	try {
+		key = createPrivateKey({
+			key: privateKeyPem,
+			format: "pem"
+		});
+	} catch {
+		return relayFailure(CREDENTIALS_INVALID, "privateKeyPem is not a readable PEM private key");
+	}
+	if (key.asymmetricKeyType !== "ec" || key.asymmetricKeyDetails?.namedCurve !== "prime256v1") return relayFailure(CREDENTIALS_INVALID, "privateKeyPem must be a P-256 signing key");
+	return key;
+}
+function reuseWindow(value) {
+	if (value === void 0) return DEFAULT_REUSE_MS;
+	const milliseconds = timestamp(value, "reuseWindowMs", CREDENTIALS_INVALID);
+	if (milliseconds < 12e5 || milliseconds > 36e5) return relayFailure(CREDENTIALS_INVALID, "reuseWindowMs must be 20-60 minutes");
+	return milliseconds;
+}
+function base64UrlJson(value) {
+	return Buffer.from(JSON.stringify(value), "utf8").toString("base64url");
+}
+function captureProjection(value) {
+	const context = /* @__PURE__ */ new WeakSet();
+	const fail = (message) => relayFailure(INVALID, message);
+	const record = exactRecord(value, [
+		"operationId",
+		"displayPayload",
+		"expiresAt"
+	], "owner phone projection", context, fail);
+	const operationId = canonicalIdentifier(record.operationId, "operationId", INVALID);
+	if (operationId.length > MAX_COLLAPSE_ID) fail("operationId must fit an apns-collapse-id");
+	return Object.freeze({
+		operationId,
+		displayPayload: boundedDisplayPayload(record.displayPayload),
+		expiresAt: timestamp(record.expiresAt, "expiresAt", INVALID)
+	});
+}
+function createApnsSender(input) {
+	const credentials = captureCredentials(input.credentials);
+	const key = signingKey(credentials.privateKeyPem);
+	const windowMs = reuseWindow(input.reuseWindowMs);
+	let cached = null;
+	const providerToken = () => {
+		const now = relayNow(input.clock);
+		if (cached !== null && now >= cached.issuedAt && now - cached.issuedAt < windowMs) return cached.token;
+		const signingInput = `${base64UrlJson({
+			alg: "ES256",
+			kid: credentials.keyId,
+			typ: "JWT"
+		})}.${base64UrlJson({
+			iss: credentials.teamId,
+			iat: Math.floor(now / 1e3)
+		})}`;
+		let signature;
+		try {
+			signature = sign("sha256", Buffer.from(signingInput, "utf8"), {
+				key,
+				dsaEncoding: "ieee-p1363"
+			});
+		} catch {
+			return relayFailure(CREDENTIALS_INVALID, "provider token could not be signed");
+		}
+		const token = `${signingInput}.${signature.toString("base64url")}`;
+		cached = Object.freeze({
+			token,
+			issuedAt: now
+		});
+		return token;
+	};
+	return Object.freeze({
+		providerToken,
+		notification(details) {
+			const projection = captureProjection(details.projection);
+			if (typeof details.deviceToken !== "string" || !DEVICE_TOKEN.test(details.deviceToken)) relayFailure(INVALID, "deviceToken must be a hex APNs device token");
+			const payload = JSON.stringify({
+				aps: {
+					alert: {
+						"title-loc-key": APNS_TITLE_LOC_KEY,
+						"loc-key": APNS_BODY_LOC_KEY,
+						"loc-args": [projection.displayPayload]
+					},
+					sound: "default"
+				},
+				oaath: {
+					version: OAATH_APNS_PAYLOAD_VERSION,
+					operationId: projection.operationId,
+					expiresAt: projection.expiresAt
+				}
+			});
+			if (Buffer.byteLength(payload, "utf8") > 4096) relayFailure("relay_apns_payload_too_large", "apns payload exceeds Apple's limit");
+			return Object.freeze({
+				operationId: projection.operationId,
+				payload,
+				headers: Object.freeze({
+					":method": "POST",
+					":scheme": "https",
+					":path": `/3/device/${details.deviceToken}`,
+					authorization: `bearer ${providerToken()}`,
+					"apns-topic": credentials.topic,
+					"apns-push-type": "alert",
+					"apns-priority": "10",
+					"apns-expiration": String(Math.floor(projection.expiresAt / 1e3)),
+					"apns-collapse-id": projection.operationId
+				})
+			});
+		}
+	});
+}
+//#endregion
+//#region src/apns/outbox.ts
+/**
+* EXPERIMENTAL PREVIEW — at-least-once APNs delivery outbox: retry schedule and
+* dead-lettering.
+*
+* ```text
+* state and owner        one delivery record per operation id owns "was this
+*                        push settled?"; the transport owns one attempt only
+* persisted evidence     the record: state, attempts, availableAt, lease, and
+*                        the last classified outcome kind
+* resource occupied?     yes: a lease occupies the record until it expires or
+*                        settles, so two workers never attempt it concurrently
+* retry positively safe? yes, and only here: a push is at-least-once, so a
+*                        duplicate is collapsed by `apns-collapse-id`, never
+*                        suppressed by pretending an unproven send succeeded
+* transitions            pending -> pending(retrying) | delivered |
+*                        dead-lettered. Both terminal states are final.
+* crash/reload           a crashed worker's lease expires and the record is
+*                        leasable again; attempts already counted stay counted
+* cleanup owner          the lease holder settles; an abandoned lease is
+*                        reclaimed by expiry, never by another worker's write
+* ```
+*
+* `rejected` dead-letters immediately: Apple refused this device token, and
+* retrying a refusal is how an outbox spins forever. `unreadable` and
+* `unavailable` are retried on the schedule, which is data (`APNS_RETRY_BACKOFF_MS`)
+* so nothing here sleeps or owns a timer.
+*
+* The contract is deliberately its own, not new methods on `RelayTransaction`:
+* a preview surface may not widen the relay's core durable contract, and every
+* store implementation would then owe it. The memory implementation matches the
+* relay store's row-lock semantics; a PostgreSQL table is deferred until the
+* preview is qualified, which is why the schema module is untouched.
+*
+* @author taek <leekt216@gmail.com>
+*/
+const OAATH_APNS_DELIVERY_RECORD_VERSION = "oaath.apns-delivery-record/v1";
+/**
+* Retry delays in milliseconds. One more attempt than there are delays, then the
+* record is dead-lettered.
+*/
+const APNS_RETRY_BACKOFF_MS = Object.freeze([
+	1e3,
+	5e3,
+	3e4
+]);
+const MAX_DEVICE_TOKEN = 200;
+const UNREADABLE = "relay_record_unreadable";
+function deliveryState(value) {
+	if (value === "pending" || value === "delivered" || value === "dead-lettered") return value;
+	return relayFailure(UNREADABLE, "apns delivery state is unsupported");
+}
+function outcomeKind(value) {
+	if (value === null) return null;
+	if (value === "delivered" || value === "rejected" || value === "unreadable" || value === "unavailable") return value;
+	return relayFailure(UNREADABLE, "apns delivery outcome is unsupported");
+}
+function attempts(value) {
+	const count = timestamp(value, "attempts", UNREADABLE);
+	if (count > APNS_RETRY_BACKOFF_MS.length + 1) return relayFailure(UNREADABLE, "apns delivery attempts exceed the schedule");
+	return count;
+}
+function nullableIdentifier(value, label) {
+	return value === null ? null : canonicalIdentifier(value, label, UNREADABLE);
+}
+function nullableTimestamp(value, label) {
+	return value === null ? null : timestamp(value, label, UNREADABLE);
+}
+/** Durable storage is a trust boundary, including in memory. */
+function parseApnsDeliveryRecord(value) {
+	const record = exactRecord(value, [
+		"version",
+		"operationId",
+		"deviceToken",
+		"payload",
+		"state",
+		"attempts",
+		"createdAt",
+		"availableAt",
+		"leaseId",
+		"leaseExpiresAt",
+		"settledAt",
+		"lastOutcome"
+	], "apns delivery record", /* @__PURE__ */ new WeakSet(), (message) => relayFailure(UNREADABLE, message));
+	if (record.version !== "oaath.apns-delivery-record/v1") return relayFailure(UNREADABLE, "apns delivery record version is unsupported");
+	return Object.freeze({
+		version: OAATH_APNS_DELIVERY_RECORD_VERSION,
+		operationId: canonicalIdentifier(record.operationId, "operationId", UNREADABLE),
+		deviceToken: boundedText(record.deviceToken, MAX_DEVICE_TOKEN, "deviceToken", UNREADABLE),
+		payload: boundedText(record.payload, APNS_PAYLOAD_MAX_BYTES, "payload", UNREADABLE),
+		state: deliveryState(record.state),
+		attempts: attempts(record.attempts),
+		createdAt: timestamp(record.createdAt, "createdAt", UNREADABLE),
+		availableAt: timestamp(record.availableAt, "availableAt", UNREADABLE),
+		leaseId: nullableIdentifier(record.leaseId, "leaseId"),
+		leaseExpiresAt: nullableTimestamp(record.leaseExpiresAt, "leaseExpiresAt"),
+		settledAt: nullableTimestamp(record.settledAt, "settledAt"),
+		lastOutcome: outcomeKind(record.lastOutcome)
+	});
+}
+function settled(record, nextState, kind, now) {
+	return Object.freeze({
+		...record,
+		state: nextState,
+		attempts: record.attempts + 1,
+		leaseId: null,
+		leaseExpiresAt: null,
+		settledAt: now,
+		lastOutcome: kind
+	});
+}
+/**
+* Process-local outbox with the durable contract's semantics. It survives no
+* restart: use it for local development and tests only.
+*
+* ponytail: a linear scan picks the next due record and one map holds the queue.
+* Both are fine for a preview push queue; index by `availableAt` only if a
+* deployment ever runs enough of them to notice.
+*/
+function createMemoryApnsOutbox(backoffMs = APNS_RETRY_BACKOFF_MS) {
+	const rows = /* @__PURE__ */ new Map();
+	const load = (operationId) => {
+		const stored = rows.get(operationId);
+		return stored === void 0 ? void 0 : parseApnsDeliveryRecord(stored);
+	};
+	return Object.freeze({
+		async enqueue(input) {
+			const operationId = canonicalIdentifier(input.operationId, "operationId", UNREADABLE);
+			if (rows.has(operationId)) return false;
+			rows.set(operationId, Object.freeze({
+				version: OAATH_APNS_DELIVERY_RECORD_VERSION,
+				operationId,
+				deviceToken: boundedText(input.deviceToken, MAX_DEVICE_TOKEN, "deviceToken", UNREADABLE),
+				payload: boundedText(input.payload, APNS_PAYLOAD_MAX_BYTES, "payload", UNREADABLE),
+				state: "pending",
+				attempts: 0,
+				createdAt: timestamp(input.now, "now", UNREADABLE),
+				availableAt: input.now,
+				leaseId: null,
+				leaseExpiresAt: null,
+				settledAt: null,
+				lastOutcome: null
+			}));
+			return true;
+		},
+		async leaseNext(input) {
+			const now = timestamp(input.now, "now", UNREADABLE);
+			const leaseMs = timestamp(input.leaseMs, "leaseMs", UNREADABLE);
+			for (const key of rows.keys()) {
+				const record = load(key);
+				if (!record || record.state !== "pending" || record.availableAt > now) continue;
+				if (record.leaseExpiresAt !== null && record.leaseExpiresAt > now) continue;
+				const leased = Object.freeze({
+					...record,
+					leaseId: randomIdentifier(),
+					leaseExpiresAt: now + leaseMs
+				});
+				rows.set(key, leased);
+				return leased;
+			}
+		},
+		async settle(input) {
+			const now = timestamp(input.now, "now", UNREADABLE);
+			const record = load(input.operationId);
+			if (!record || record.state !== "pending" || record.leaseId !== input.leaseId) return Object.freeze({ settlement: "stale" });
+			if (input.outcome.kind === "delivered") {
+				const next = settled(record, "delivered", "delivered", now);
+				rows.set(record.operationId, next);
+				return Object.freeze({
+					settlement: "delivered",
+					record: next
+				});
+			}
+			if (input.outcome.kind === "rejected") {
+				const next = settled(record, "dead-lettered", "rejected", now);
+				rows.set(record.operationId, next);
+				return Object.freeze({
+					settlement: "dead-lettered",
+					record: next
+				});
+			}
+			const attempt = record.attempts + 1;
+			const delay = backoffMs[attempt - 1];
+			if (delay === void 0) {
+				const next = settled(record, "dead-lettered", input.outcome.kind, now);
+				rows.set(record.operationId, next);
+				return Object.freeze({
+					settlement: "dead-lettered",
+					record: next
+				});
+			}
+			const next = Object.freeze({
+				...record,
+				attempts: attempt,
+				availableAt: now + delay,
+				leaseId: null,
+				leaseExpiresAt: null,
+				lastOutcome: input.outcome.kind
+			});
+			rows.set(record.operationId, next);
+			return Object.freeze({
+				settlement: "retrying",
+				record: next
+			});
+		},
+		async read(operationId) {
+			return load(operationId);
+		}
+	});
+}
+//#endregion
+//#region src/apns/transport.ts
+/** Bounded refusal body. Apple's is tiny; anything larger is not read. */
+const MAX_BODY_BYTES = 4096;
+/** Apple's documented reasons are short ASCII words. */
+const REASON = /^[A-Za-z]{1,64}$/u;
+function reasonOf(body) {
+	let parsed;
+	try {
+		parsed = JSON.parse(body);
+	} catch {
+		return null;
+	}
+	if (parsed === null || typeof parsed !== "object") return null;
+	const reason = parsed.reason;
+	return typeof reason === "string" && REASON.test(reason) ? reason : null;
+}
+function classify(status, apnsId, body) {
+	if (status === 200) return Object.freeze({
+		kind: "delivered",
+		apnsId
+	});
+	if (status === null || status === 429 || status === 500 || status === 503) return Object.freeze({ kind: status === null ? "unreadable" : "unavailable" });
+	const reason = reasonOf(body);
+	return reason === null ? Object.freeze({ kind: "unreadable" }) : Object.freeze({
+		kind: "rejected",
+		status,
+		reason
+	});
+}
+function headerText(value) {
+	return typeof value === "string" ? value : null;
+}
+/** Response headers are provider output: read them as data, never as a shape. */
+function headerMap(headers) {
+	if (headers === null || typeof headers !== "object") return /* @__PURE__ */ new Map();
+	return new Map(Object.entries(headers));
+}
+/**
+* Sends one notification and settles exactly once. It never retries, and it
+* never throws: every outcome, including an unopenable stream, is a classified
+* value the outbox decides on.
+*/
+function sendApnsNotification(input) {
+	return new Promise((resolve) => {
+		let stream;
+		try {
+			stream = input.session.request(input.notification.headers);
+		} catch {
+			resolve(Object.freeze({ kind: "unavailable" }));
+			return;
+		}
+		let settled = false;
+		let status = null;
+		let apnsId = null;
+		let body = "";
+		const settle = (outcome) => {
+			if (settled) return;
+			settled = true;
+			try {
+				stream.destroy();
+			} catch {}
+			resolve(outcome);
+		};
+		stream.on("response", (headers) => {
+			const map = headerMap(headers);
+			const raw = map.get(":status");
+			status = typeof raw === "number" ? raw : Number.parseInt(headerText(raw) ?? "", 10);
+			if (!Number.isInteger(status)) status = null;
+			apnsId = headerText(map.get("apns-id"));
+		});
+		stream.on("data", (chunk) => {
+			if (body.length >= MAX_BODY_BYTES) return;
+			body += typeof chunk === "string" ? chunk : String(chunk);
+		});
+		stream.on("end", () => {
+			settle(classify(status, apnsId, body.slice(0, MAX_BODY_BYTES)));
+		});
+		stream.on("error", () => {
+			settle(Object.freeze({ kind: status === null ? "unavailable" : "unreadable" }));
+		});
+		stream.setTimeout(input.timeoutMs, () => {
+			settle(Object.freeze({ kind: "unreadable" }));
+		});
+		stream.end(input.notification.payload);
+	});
+}
+//#endregion
+export { APNS_BODY_LOC_KEY, APNS_PAYLOAD_MAX_BYTES, APNS_RETRY_BACKOFF_MS, APNS_TITLE_LOC_KEY, APNS_TOKEN_MAX_REUSE_MS, APNS_TOKEN_MIN_REUSE_MS, OAATH_APNS_DELIVERY_RECORD_VERSION, OAATH_APNS_PAYLOAD_VERSION, createApnsSender, createMemoryApnsOutbox, parseApnsDeliveryRecord, sendApnsNotification };
+
+//# sourceMappingURL=apns.js.map

package/dist/apns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apns.js","names":[],"sources":["../src/apns/sender.ts","../src/apns/outbox.ts","../src/apns/transport.ts"],"sourcesContent":["/**\n * EXPERIMENTAL PREVIEW — Apple provider-token signing and APNs payload\n * construction.\n *\n * Preview means: no stability guarantee and no production qualification. Apple\n * provisioning, KMS key rotation, and production operations are later work.\n *\n * Credentials are an injected capability. This package reads no environment\n * variable anywhere in `src/`: a deployment hands over the key material it\n * already owns, and the repository's normal gates scrub `APNS_*`/`APPLE_*` out\n * of the test environment so nothing can drift into an implicit default.\n *\n * The injected capability is a trust boundary, so it is exact-captured once\n * here: unknown fields, a non-P-256 key, or a non-Apple key/team id fail closed\n * with `relay_apns_credentials_invalid`. The provider error is never surfaced,\n * because it can quote key material.\n *\n * Payloads stay opaque. Human text is a phone-side localization key, and the\n * only variable rendered is the projection's bounded match code. No permission,\n * scope, client, chain, or account detail is ever serialized: the payload\n * transits Apple.\n *\n * @author taek <leekt216@gmail.com>\n */\n\nimport { createPrivateKey, type KeyObject, sign } from \"node:crypto\";\nimport { type CaptureContext, exactRecord } from \"@oaath/protocol\";\nimport { type RelayClock, relayNow } from \"../clock.js\";\nimport type { OwnerPhonePushProjection } from \"../native/projection.js\";\nimport { relayFailure } from \"../relay/errors.js\";\nimport { canonicalIdentifier, timestamp } from \"../store/records.js\";\n\n/** Apple's hard limit for an alert notification payload. */\nexport const APNS_PAYLOAD_MAX_BYTES = 4096;\n\nexport const OAATH_APNS_PAYLOAD_VERSION = \"oaath.apns-payload/v1\" as const;\n\n/** Localization keys: the phone owns every word the owner reads. */\nexport const APNS_TITLE_LOC_KEY = \"oaath_approval_title\" as const;\nexport const APNS_BODY_LOC_KEY = \"oaath_approval_body\" as const;\n\n/** Apple rejects a token older than one hour and re-signing more often than 20 minutes. */\nexport const APNS_TOKEN_MIN_REUSE_MS = 1_200_000;\nexport const APNS_TOKEN_MAX_REUSE_MS = 3_600_000;\nconst DEFAULT_REUSE_MS = 2_700_000;\n\nconst MAX_PEM_LENGTH = 8192;\n/** `apns-collapse-id` is limited to 64 bytes. */\nconst MAX_COLLAPSE_ID = 64;\nconst APPLE_TEN_CHARACTER_ID = /^[A-Z0-9]{10}$/u;\nconst DEVICE_TOKEN = /^[0-9a-fA-F]{64,200}$/u;\n\nconst CREDENTIALS_INVALID = \"relay_apns_credentials_invalid\" as const;\nconst INVALID = \"relay_request_invalid\" as const;\n\nexport interface ApnsCredentials {\n  /** PEM-encoded P-256 (`prime256v1`) private key from Apple. */\n  readonly privateKeyPem: string;\n  /** Apple key id (`kid`). */\n  readonly keyId: string;\n  /** Apple team id (`iss`). */\n  readonly teamId: string;\n  /** Bundle identifier used as `apns-topic`. */\n  readonly topic: string;\n}\n\nexport interface CreateApnsSenderInput {\n  /** Injected capability object. Never sourced from `process.env`. */\n  readonly credentials: ApnsCredentials;\n  readonly clock: RelayClock;\n  /** 20-60 minutes. Defaults to 45. */\n  readonly reuseWindowMs?: number;\n}\n\nexport interface ApnsNotificationInput {\n  /** Lowercase or uppercase hex device token. */\n  readonly deviceToken: string;\n  /**\n   * Only the opaque push subset is accepted: the payload transits Apple, so\n   * the consent projection's client and scope detail must never reach here.\n   */\n  readonly projection: OwnerPhonePushProjection;\n}\n\nexport interface ApnsNotification {\n  readonly operationId: string;\n  /** HTTP/2 request headers, including the `:method`/`:scheme`/`:path` pseudo-headers. */\n  readonly headers: Readonly<Record<string, string>>;\n  /** JSON body, already proven to be within `APNS_PAYLOAD_MAX_BYTES`. */\n  readonly payload: string;\n}\n\nexport interface ApnsSender {\n  /** Signs lazily and reuses one token for the whole reuse window. */\n  providerToken(): string;\n  notification(input: ApnsNotificationInput): ApnsNotification;\n}\n\nfunction boundedPem(value: unknown): string {\n  if (typeof value !== \"string\" || value.length < 1 || value.length > MAX_PEM_LENGTH) {\n    return relayFailure(CREDENTIALS_INVALID, \"privateKeyPem must be a bounded non-empty PEM\");\n  }\n  return value;\n}\n\n/**\n * Bounded, but wide enough that an oversized display payload is a reachable\n * failure instead of an unprovable one: the 4096-byte payload check owns it.\n */\nfunction boundedDisplayPayload(value: unknown): string {\n  if (typeof value !== \"string\" || value.length < 1 || value.length > APNS_PAYLOAD_MAX_BYTES) {\n    return relayFailure(INVALID, \"displayPayload must be a bounded non-empty string\");\n  }\n  return value;\n}\n\nfunction captureCredentials(value: unknown): ApnsCredentials {\n  const context: CaptureContext = new WeakSet();\n  const fail = (message: string): never => relayFailure(CREDENTIALS_INVALID, message);\n  const record = exactRecord(\n    value,\n    [\"privateKeyPem\", \"keyId\", \"teamId\", \"topic\"],\n    \"apns credentials\",\n    context,\n    fail,\n  );\n  const keyId = canonicalIdentifier(record.keyId, \"keyId\", CREDENTIALS_INVALID);\n  const teamId = canonicalIdentifier(record.teamId, \"teamId\", CREDENTIALS_INVALID);\n  if (!APPLE_TEN_CHARACTER_ID.test(keyId) || !APPLE_TEN_CHARACTER_ID.test(teamId)) {\n    fail(\"keyId and teamId must be Apple ten-character identifiers\");\n  }\n  return Object.freeze({\n    // PEM carries newlines, so it is bounded by length only and validated by the\n    // key parser rather than by the control-character text rules.\n    privateKeyPem: boundedPem(record.privateKeyPem),\n    keyId,\n    teamId,\n    // A topic reaches an HTTP/2 header, so it stays URL-safe by construction.\n    topic: canonicalIdentifier(record.topic, \"topic\", CREDENTIALS_INVALID),\n  });\n}\n\nfunction signingKey(privateKeyPem: string): KeyObject {\n  let key: KeyObject;\n  try {\n    key = createPrivateKey({ key: privateKeyPem, format: \"pem\" });\n  } catch {\n    // The parser error can quote key material; only the code leaves.\n    return relayFailure(CREDENTIALS_INVALID, \"privateKeyPem is not a readable PEM private key\");\n  }\n  if (key.asymmetricKeyType !== \"ec\" || key.asymmetricKeyDetails?.namedCurve !== \"prime256v1\") {\n    return relayFailure(CREDENTIALS_INVALID, \"privateKeyPem must be a P-256 signing key\");\n  }\n  return key;\n}\n\nfunction reuseWindow(value: number | undefined): number {\n  if (value === undefined) return DEFAULT_REUSE_MS;\n  const milliseconds = timestamp(value, \"reuseWindowMs\", CREDENTIALS_INVALID);\n  if (milliseconds < APNS_TOKEN_MIN_REUSE_MS || milliseconds > APNS_TOKEN_MAX_REUSE_MS) {\n    return relayFailure(CREDENTIALS_INVALID, \"reuseWindowMs must be 20-60 minutes\");\n  }\n  return milliseconds;\n}\n\nfunction base64UrlJson(value: unknown): string {\n  return Buffer.from(JSON.stringify(value), \"utf8\").toString(\"base64url\");\n}\n\nfunction captureProjection(value: unknown): OwnerPhonePushProjection {\n  const context: CaptureContext = new WeakSet();\n  const fail = (message: string): never => relayFailure(INVALID, message);\n  const record = exactRecord(\n    value,\n    [\"operationId\", \"displayPayload\", \"expiresAt\"],\n    \"owner phone projection\",\n    context,\n    fail,\n  );\n  const operationId = canonicalIdentifier(record.operationId, \"operationId\", INVALID);\n  if (operationId.length > MAX_COLLAPSE_ID) {\n    fail(\"operationId must fit an apns-collapse-id\");\n  }\n  return Object.freeze({\n    operationId,\n    displayPayload: boundedDisplayPayload(record.displayPayload),\n    expiresAt: timestamp(record.expiresAt, \"expiresAt\", INVALID),\n  });\n}\n\nexport function createApnsSender(input: CreateApnsSenderInput): ApnsSender {\n  const credentials = captureCredentials(input.credentials);\n  const key = signingKey(credentials.privateKeyPem);\n  const windowMs = reuseWindow(input.reuseWindowMs);\n  let cached: Readonly<{ token: string; issuedAt: number }> | null = null;\n\n  const providerToken = (): string => {\n    const now = relayNow(input.clock);\n    // A clock that moved backwards invalidates the cache rather than extending it.\n    if (cached !== null && now >= cached.issuedAt && now - cached.issuedAt < windowMs) {\n      return cached.token;\n    }\n    const signingInput = `${base64UrlJson({\n      alg: \"ES256\",\n      kid: credentials.keyId,\n      typ: \"JWT\",\n    })}.${base64UrlJson({ iss: credentials.teamId, iat: Math.floor(now / 1000) })}`;\n    let signature: Buffer;\n    try {\n      // JOSE needs the raw r||s form, not the DER sequence node signs by default.\n      signature = sign(\"sha256\", Buffer.from(signingInput, \"utf8\"), {\n        key,\n        dsaEncoding: \"ieee-p1363\",\n      });\n    } catch {\n      return relayFailure(CREDENTIALS_INVALID, \"provider token could not be signed\");\n    }\n    const token = `${signingInput}.${signature.toString(\"base64url\")}`;\n    cached = Object.freeze({ token, issuedAt: now });\n    return token;\n  };\n\n  return Object.freeze({\n    providerToken,\n    notification(details: ApnsNotificationInput): ApnsNotification {\n      const projection = captureProjection(details.projection);\n      if (typeof details.deviceToken !== \"string\" || !DEVICE_TOKEN.test(details.deviceToken)) {\n        // The token reaches the `:path` pseudo-header; only hex may get there.\n        relayFailure(INVALID, \"deviceToken must be a hex APNs device token\");\n      }\n      const payload = JSON.stringify({\n        aps: {\n          alert: {\n            \"title-loc-key\": APNS_TITLE_LOC_KEY,\n            \"loc-key\": APNS_BODY_LOC_KEY,\n            \"loc-args\": [projection.displayPayload],\n          },\n          sound: \"default\",\n        },\n        oaath: {\n          version: OAATH_APNS_PAYLOAD_VERSION,\n          operationId: projection.operationId,\n          expiresAt: projection.expiresAt,\n        },\n      });\n      if (Buffer.byteLength(payload, \"utf8\") > APNS_PAYLOAD_MAX_BYTES) {\n        relayFailure(\"relay_apns_payload_too_large\", \"apns payload exceeds Apple's limit\");\n      }\n      return Object.freeze({\n        operationId: projection.operationId,\n        payload,\n        headers: Object.freeze({\n          \":method\": \"POST\",\n          \":scheme\": \"https\",\n          \":path\": `/3/device/${details.deviceToken}`,\n          authorization: `bearer ${providerToken()}`,\n          \"apns-topic\": credentials.topic,\n          \"apns-push-type\": \"alert\",\n          \"apns-priority\": \"10\",\n          \"apns-expiration\": String(Math.floor(projection.expiresAt / 1000)),\n          // One notification per operation, so a duplicate push collapses.\n          \"apns-collapse-id\": projection.operationId,\n        }),\n      });\n    },\n  });\n}\n","/**\n * EXPERIMENTAL PREVIEW — at-least-once APNs delivery outbox: retry schedule and\n * dead-lettering.\n *\n * ```text\n * state and owner        one delivery record per operation id owns \"was this\n *                        push settled?\"; the transport owns one attempt only\n * persisted evidence     the record: state, attempts, availableAt, lease, and\n *                        the last classified outcome kind\n * resource occupied?     yes: a lease occupies the record until it expires or\n *                        settles, so two workers never attempt it concurrently\n * retry positively safe? yes, and only here: a push is at-least-once, so a\n *                        duplicate is collapsed by `apns-collapse-id`, never\n *                        suppressed by pretending an unproven send succeeded\n * transitions            pending -> pending(retrying) | delivered |\n *                        dead-lettered. Both terminal states are final.\n * crash/reload           a crashed worker's lease expires and the record is\n *                        leasable again; attempts already counted stay counted\n * cleanup owner          the lease holder settles; an abandoned lease is\n *                        reclaimed by expiry, never by another worker's write\n * ```\n *\n * `rejected` dead-letters immediately: Apple refused this device token, and\n * retrying a refusal is how an outbox spins forever. `unreadable` and\n * `unavailable` are retried on the schedule, which is data (`APNS_RETRY_BACKOFF_MS`)\n * so nothing here sleeps or owns a timer.\n *\n * The contract is deliberately its own, not new methods on `RelayTransaction`:\n * a preview surface may not widen the relay's core durable contract, and every\n * store implementation would then owe it. The memory implementation matches the\n * relay store's row-lock semantics; a PostgreSQL table is deferred until the\n * preview is qualified, which is why the schema module is untouched.\n *\n * @author taek <leekt216@gmail.com>\n */\n\nimport { type CaptureContext, exactRecord } from \"@oaath/protocol\";\nimport { randomIdentifier } from \"../authorization/challenge.js\";\nimport { relayFailure } from \"../relay/errors.js\";\nimport { boundedText, canonicalIdentifier, timestamp } from \"../store/records.js\";\nimport { APNS_PAYLOAD_MAX_BYTES } from \"./sender.js\";\nimport type { ApnsDeliveryOutcome } from \"./transport.js\";\n\nexport const OAATH_APNS_DELIVERY_RECORD_VERSION = \"oaath.apns-delivery-record/v1\" as const;\n\n/**\n * Retry delays in milliseconds. One more attempt than there are delays, then the\n * record is dead-lettered.\n */\nexport const APNS_RETRY_BACKOFF_MS: readonly number[] = Object.freeze([1_000, 5_000, 30_000]);\n\nconst MAX_DEVICE_TOKEN = 200;\nconst UNREADABLE = \"relay_record_unreadable\" as const;\n\nexport type ApnsDeliveryState = \"pending\" | \"delivered\" | \"dead-lettered\";\n\nexport interface ApnsDeliveryRecord {\n  readonly version: typeof OAATH_APNS_DELIVERY_RECORD_VERSION;\n  /** Stable operation id from the phone projection. One delivery per operation. */\n  readonly operationId: string;\n  readonly deviceToken: string;\n  /** The exact bytes to send. Opaque here; the sender built and bounded it. */\n  readonly payload: string;\n  readonly state: ApnsDeliveryState;\n  /** Settled attempts, including the one that reached a terminal state. */\n  readonly attempts: number;\n  readonly createdAt: number;\n  /** Earliest next attempt. Backoff is data; nothing in this module waits. */\n  readonly availableAt: number;\n  /** Non-null only while leased, and held by exactly one worker. */\n  readonly leaseId: string | null;\n  readonly leaseExpiresAt: number | null;\n  /** Non-null exactly for the two terminal states. */\n  readonly settledAt: number | null;\n  /** Last classified transport outcome. Never Apple's prose. */\n  readonly lastOutcome: ApnsDeliveryOutcome[\"kind\"] | null;\n}\n\nexport type ApnsSettleResult =\n  | Readonly<{ settlement: \"delivered\" | \"retrying\" | \"dead-lettered\"; record: ApnsDeliveryRecord }>\n  /** The lease is not the current one: a slower worker lost the record. */\n  | Readonly<{ settlement: \"stale\" }>;\n\nexport interface ApnsEnqueueInput {\n  readonly operationId: string;\n  readonly deviceToken: string;\n  readonly payload: string;\n  readonly now: number;\n}\n\nexport interface ApnsLeaseInput {\n  readonly now: number;\n  readonly leaseMs: number;\n}\n\nexport interface ApnsSettleInput {\n  readonly operationId: string;\n  readonly leaseId: string;\n  readonly outcome: ApnsDeliveryOutcome;\n  readonly now: number;\n}\n\nexport interface ApnsOutbox {\n  /** False when the operation is already enqueued. One push per operation. */\n  enqueue(input: ApnsEnqueueInput): Promise<boolean>;\n  /**\n   * Leases the next due pending record exclusively, under the same row-lock\n   * semantics as the relay store, or `undefined` when nothing is due.\n   */\n  leaseNext(input: ApnsLeaseInput): Promise<ApnsDeliveryRecord | undefined>;\n  settle(input: ApnsSettleInput): Promise<ApnsSettleResult>;\n  read(operationId: string): Promise<ApnsDeliveryRecord | undefined>;\n}\n\nfunction deliveryState(value: unknown): ApnsDeliveryState {\n  if (value === \"pending\" || value === \"delivered\" || value === \"dead-lettered\") return value;\n  return relayFailure(UNREADABLE, \"apns delivery state is unsupported\");\n}\n\nfunction outcomeKind(value: unknown): ApnsDeliveryOutcome[\"kind\"] | null {\n  if (value === null) return null;\n  if (\n    value === \"delivered\" ||\n    value === \"rejected\" ||\n    value === \"unreadable\" ||\n    value === \"unavailable\"\n  ) {\n    return value;\n  }\n  return relayFailure(UNREADABLE, \"apns delivery outcome is unsupported\");\n}\n\nfunction attempts(value: unknown): number {\n  const count = timestamp(value, \"attempts\", UNREADABLE);\n  if (count > APNS_RETRY_BACKOFF_MS.length + 1) {\n    return relayFailure(UNREADABLE, \"apns delivery attempts exceed the schedule\");\n  }\n  return count;\n}\n\nfunction nullableIdentifier(value: unknown, label: string): string | null {\n  return value === null ? null : canonicalIdentifier(value, label, UNREADABLE);\n}\n\nfunction nullableTimestamp(value: unknown, label: string): number | null {\n  return value === null ? null : timestamp(value, label, UNREADABLE);\n}\n\n/** Durable storage is a trust boundary, including in memory. */\nexport function parseApnsDeliveryRecord(value: unknown): ApnsDeliveryRecord {\n  const context: CaptureContext = new WeakSet();\n  const record = exactRecord(\n    value,\n    [\n      \"version\",\n      \"operationId\",\n      \"deviceToken\",\n      \"payload\",\n      \"state\",\n      \"attempts\",\n      \"createdAt\",\n      \"availableAt\",\n      \"leaseId\",\n      \"leaseExpiresAt\",\n      \"settledAt\",\n      \"lastOutcome\",\n    ],\n    \"apns delivery record\",\n    context,\n    (message) => relayFailure(UNREADABLE, message),\n  );\n  if (record.version !== OAATH_APNS_DELIVERY_RECORD_VERSION) {\n    return relayFailure(UNREADABLE, \"apns delivery record version is unsupported\");\n  }\n  return Object.freeze({\n    version: OAATH_APNS_DELIVERY_RECORD_VERSION,\n    operationId: canonicalIdentifier(record.operationId, \"operationId\", UNREADABLE),\n    deviceToken: boundedText(record.deviceToken, MAX_DEVICE_TOKEN, \"deviceToken\", UNREADABLE),\n    payload: boundedText(record.payload, APNS_PAYLOAD_MAX_BYTES, \"payload\", UNREADABLE),\n    state: deliveryState(record.state),\n    attempts: attempts(record.attempts),\n    createdAt: timestamp(record.createdAt, \"createdAt\", UNREADABLE),\n    availableAt: timestamp(record.availableAt, \"availableAt\", UNREADABLE),\n    leaseId: nullableIdentifier(record.leaseId, \"leaseId\"),\n    leaseExpiresAt: nullableTimestamp(record.leaseExpiresAt, \"leaseExpiresAt\"),\n    settledAt: nullableTimestamp(record.settledAt, \"settledAt\"),\n    lastOutcome: outcomeKind(record.lastOutcome),\n  });\n}\n\nfunction settled(\n  record: ApnsDeliveryRecord,\n  nextState: Exclude<ApnsDeliveryState, \"pending\">,\n  kind: ApnsDeliveryOutcome[\"kind\"],\n  now: number,\n): ApnsDeliveryRecord {\n  return Object.freeze({\n    ...record,\n    state: nextState,\n    attempts: record.attempts + 1,\n    leaseId: null,\n    leaseExpiresAt: null,\n    settledAt: now,\n    lastOutcome: kind,\n  });\n}\n\n/**\n * Process-local outbox with the durable contract's semantics. It survives no\n * restart: use it for local development and tests only.\n *\n * ponytail: a linear scan picks the next due record and one map holds the queue.\n * Both are fine for a preview push queue; index by `availableAt` only if a\n * deployment ever runs enough of them to notice.\n */\nexport function createMemoryApnsOutbox(\n  backoffMs: readonly number[] = APNS_RETRY_BACKOFF_MS,\n): ApnsOutbox {\n  const rows = new Map<string, unknown>();\n  const load = (operationId: string): ApnsDeliveryRecord | undefined => {\n    const stored = rows.get(operationId);\n    return stored === undefined ? undefined : parseApnsDeliveryRecord(stored);\n  };\n\n  return Object.freeze({\n    async enqueue(input: ApnsEnqueueInput): Promise<boolean> {\n      const operationId = canonicalIdentifier(input.operationId, \"operationId\", UNREADABLE);\n      if (rows.has(operationId)) return false;\n      rows.set(\n        operationId,\n        Object.freeze({\n          version: OAATH_APNS_DELIVERY_RECORD_VERSION,\n          operationId,\n          deviceToken: boundedText(input.deviceToken, MAX_DEVICE_TOKEN, \"deviceToken\", UNREADABLE),\n          payload: boundedText(input.payload, APNS_PAYLOAD_MAX_BYTES, \"payload\", UNREADABLE),\n          state: \"pending\",\n          attempts: 0,\n          createdAt: timestamp(input.now, \"now\", UNREADABLE),\n          availableAt: input.now,\n          leaseId: null,\n          leaseExpiresAt: null,\n          settledAt: null,\n          lastOutcome: null,\n        }),\n      );\n      return true;\n    },\n\n    async leaseNext(input: ApnsLeaseInput): Promise<ApnsDeliveryRecord | undefined> {\n      const now = timestamp(input.now, \"now\", UNREADABLE);\n      const leaseMs = timestamp(input.leaseMs, \"leaseMs\", UNREADABLE);\n      for (const key of rows.keys()) {\n        const record = load(key);\n        if (!record || record.state !== \"pending\" || record.availableAt > now) continue;\n        // A live lease is exclusive; an expired one is reclaimable, because its\n        // holder may have crashed mid-attempt.\n        if (record.leaseExpiresAt !== null && record.leaseExpiresAt > now) continue;\n        const leased = Object.freeze({\n          ...record,\n          leaseId: randomIdentifier(),\n          leaseExpiresAt: now + leaseMs,\n        });\n        rows.set(key, leased);\n        return leased;\n      }\n      return undefined;\n    },\n\n    async settle(input: ApnsSettleInput): Promise<ApnsSettleResult> {\n      const now = timestamp(input.now, \"now\", UNREADABLE);\n      const record = load(input.operationId);\n      // Terminal, unleased, or a lost lease: this worker's settlement is void.\n      if (!record || record.state !== \"pending\" || record.leaseId !== input.leaseId) {\n        return Object.freeze({ settlement: \"stale\" });\n      }\n      if (input.outcome.kind === \"delivered\") {\n        const next = settled(record, \"delivered\", \"delivered\", now);\n        rows.set(record.operationId, next);\n        return Object.freeze({ settlement: \"delivered\", record: next });\n      }\n      if (input.outcome.kind === \"rejected\") {\n        const next = settled(record, \"dead-lettered\", \"rejected\", now);\n        rows.set(record.operationId, next);\n        return Object.freeze({ settlement: \"dead-lettered\", record: next });\n      }\n      const attempt = record.attempts + 1;\n      const delay = backoffMs[attempt - 1];\n      if (delay === undefined) {\n        const next = settled(record, \"dead-lettered\", input.outcome.kind, now);\n        rows.set(record.operationId, next);\n        return Object.freeze({ settlement: \"dead-lettered\", record: next });\n      }\n      const next: ApnsDeliveryRecord = Object.freeze({\n        ...record,\n        attempts: attempt,\n        availableAt: now + delay,\n        leaseId: null,\n        leaseExpiresAt: null,\n        lastOutcome: input.outcome.kind,\n      });\n      rows.set(record.operationId, next);\n      return Object.freeze({ settlement: \"retrying\", record: next });\n    },\n\n    async read(operationId: string): Promise<ApnsDeliveryRecord | undefined> {\n      return load(operationId);\n    },\n  });\n}\n","/**\n * EXPERIMENTAL PREVIEW — settle-once HTTP/2 request lifecycle for APNs.\n *\n * ```text\n * state and owner        one request stream; this function owns its single\n *                        settlement and nothing else\n * persisted evidence     none. The outbox owns durable delivery state.\n * resource occupied?     the stream, released on settlement\n * retry positively safe? not decided here: this transport never retries\n * transitions            open -> settled(delivered|rejected|unreadable|\n *                        unavailable), exactly once\n * crash/reload           nothing to recover: no state outlives the call\n * cleanup owner          the settlement path destroys the stream\n * ```\n *\n * One request, one settlement. Response, stream error, and timeout all race, and\n * the first to arrive wins; every later event is dropped. A timeout is\n * `unreadable`, not `unavailable`: the notification may well have been accepted,\n * so the send is unproven, and nothing here may treat it as retryable.\n *\n * Classification is closed and never derived from prose:\n *\n * ```text\n * delivered    HTTP 200\n * rejected     a definite Apple refusal with a readable `reason`\n * unavailable  429, 500, 503, or a stream that failed before any status\n * unreadable   timeout, missing/unparseable status, unreadable refusal body,\n *              or a stream that failed after the status arrived\n * ```\n *\n * The session is a port so tests drive a fake stream: no network is contacted.\n * `node:http2`'s `ClientHttp2Session` satisfies it structurally, which\n * `test/apns.test.ts` proves at compile time.\n *\n * @author taek <leekt216@gmail.com>\n */\n\nimport type { ApnsNotification } from \"./sender.js\";\n\n/** Bounded refusal body. Apple's is tiny; anything larger is not read. */\nconst MAX_BODY_BYTES = 4096;\n/** Apple's documented reasons are short ASCII words. */\nconst REASON = /^[A-Za-z]{1,64}$/u;\n\nexport type ApnsDeliveryOutcome =\n  | Readonly<{ kind: \"delivered\"; apnsId: string | null }>\n  | Readonly<{ kind: \"rejected\"; status: number; reason: string }>\n  | Readonly<{ kind: \"unreadable\" }>\n  | Readonly<{ kind: \"unavailable\" }>;\n\n/**\n * The subset of an HTTP/2 client stream this transport uses. Every listener\n * payload is `unknown`, because a provider's response is hostile input until it\n * has been read defensively.\n */\nexport interface ApnsStream {\n  on(event: \"response\", listener: (headers: unknown) => void): unknown;\n  on(event: \"data\", listener: (chunk: unknown) => void): unknown;\n  on(event: \"end\", listener: () => void): unknown;\n  on(event: \"error\", listener: (error: unknown) => void): unknown;\n  setTimeout(milliseconds: number, callback: () => void): unknown;\n  end(data?: string): unknown;\n  destroy(): unknown;\n}\n\nexport interface ApnsSession {\n  request(headers: Readonly<Record<string, string>>): ApnsStream;\n}\n\nexport interface SendApnsNotificationInput {\n  readonly session: ApnsSession;\n  readonly notification: ApnsNotification;\n  readonly timeoutMs: number;\n}\n\nfunction reasonOf(body: string): string | null {\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(body) as unknown;\n  } catch {\n    return null;\n  }\n  if (parsed === null || typeof parsed !== \"object\") return null;\n  const reason: unknown = (parsed as Record<string, unknown>).reason;\n  return typeof reason === \"string\" && REASON.test(reason) ? reason : null;\n}\n\nfunction classify(status: number | null, apnsId: string | null, body: string): ApnsDeliveryOutcome {\n  if (status === 200) return Object.freeze({ kind: \"delivered\", apnsId });\n  // Apple's back-pressure and its own faults are provider unavailability.\n  if (status === null || status === 429 || status === 500 || status === 503) {\n    return Object.freeze({ kind: status === null ? \"unreadable\" : \"unavailable\" });\n  }\n  const reason = reasonOf(body);\n  // A refusal we cannot read is unreadable evidence, never a proven refusal.\n  return reason === null\n    ? Object.freeze({ kind: \"unreadable\" })\n    : Object.freeze({ kind: \"rejected\", status, reason });\n}\n\nfunction headerText(value: unknown): string | null {\n  return typeof value === \"string\" ? value : null;\n}\n\n/** Response headers are provider output: read them as data, never as a shape. */\nfunction headerMap(headers: unknown): ReadonlyMap<string, unknown> {\n  if (headers === null || typeof headers !== \"object\") return new Map();\n  return new Map<string, unknown>(Object.entries(headers));\n}\n\n/**\n * Sends one notification and settles exactly once. It never retries, and it\n * never throws: every outcome, including an unopenable stream, is a classified\n * value the outbox decides on.\n */\nexport function sendApnsNotification(\n  input: SendApnsNotificationInput,\n): Promise<ApnsDeliveryOutcome> {\n  return new Promise<ApnsDeliveryOutcome>((resolve) => {\n    let stream: ApnsStream;\n    try {\n      stream = input.session.request(input.notification.headers);\n    } catch {\n      // Nothing was written, so nothing could have been delivered.\n      resolve(Object.freeze({ kind: \"unavailable\" }));\n      return;\n    }\n\n    let settled = false;\n    let status: number | null = null;\n    let apnsId: string | null = null;\n    let body = \"\";\n\n    const settle = (outcome: ApnsDeliveryOutcome): void => {\n      if (settled) return;\n      settled = true;\n      try {\n        stream.destroy();\n      } catch {\n        // Releasing the stream is cleanup: its failure never changes the outcome.\n      }\n      resolve(outcome);\n    };\n\n    stream.on(\"response\", (headers) => {\n      const map = headerMap(headers);\n      const raw = map.get(\":status\");\n      status = typeof raw === \"number\" ? raw : Number.parseInt(headerText(raw) ?? \"\", 10);\n      if (!Number.isInteger(status)) status = null;\n      apnsId = headerText(map.get(\"apns-id\"));\n    });\n    stream.on(\"data\", (chunk) => {\n      if (body.length >= MAX_BODY_BYTES) return;\n      body += typeof chunk === \"string\" ? chunk : String(chunk);\n    });\n    stream.on(\"end\", () => {\n      settle(classify(status, apnsId, body.slice(0, MAX_BODY_BYTES)));\n    });\n    stream.on(\"error\", () => {\n      // Before a status nothing reached Apple's decision; after one, we had a\n      // decision we could not finish reading.\n      settle(Object.freeze({ kind: status === null ? \"unavailable\" : \"unreadable\" }));\n    });\n    stream.setTimeout(input.timeoutMs, () => {\n      // A timeout is not an absence: the notification may have been accepted.\n      settle(Object.freeze({ kind: \"unreadable\" }));\n    });\n    stream.end(input.notification.payload);\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiCA,MAAa,yBAAyB;AAEtC,MAAa,6BAA6B;;AAG1C,MAAa,qBAAqB;AAClC,MAAa,oBAAoB;;AAGjC,MAAa,0BAA0B;AACvC,MAAa,0BAA0B;AACvC,MAAM,mBAAmB;AAEzB,MAAM,iBAAiB;;AAEvB,MAAM,kBAAkB;AACxB,MAAM,yBAAyB;AAC/B,MAAM,eAAe;AAErB,MAAM,sBAAsB;AAC5B,MAAM,UAAU;AA6ChB,SAAS,WAAW,OAAwB;CAC1C,IAAI,OAAO,UAAU,YAAY,MAAM,SAAS,KAAK,MAAM,SAAS,gBAClE,OAAO,aAAa,qBAAqB,+CAA+C;CAE1F,OAAO;AACT;;;;;AAMA,SAAS,sBAAsB,OAAwB;CACrD,IAAI,OAAO,UAAU,YAAY,MAAM,SAAS,KAAK,MAAM,SAAA,MACzD,OAAO,aAAa,SAAS,mDAAmD;CAElF,OAAO;AACT;AAEA,SAAS,mBAAmB,OAAiC;CAC3D,MAAM,0BAA0B,IAAI,QAAQ;CAC5C,MAAM,QAAQ,YAA2B,aAAa,qBAAqB,OAAO;CAClF,MAAM,SAAS,YACb,OACA;EAAC;EAAiB;EAAS;EAAU;CAAO,GAC5C,oBACA,SACA,IACF;CACA,MAAM,QAAQ,oBAAoB,OAAO,OAAO,SAAS,mBAAmB;CAC5E,MAAM,SAAS,oBAAoB,OAAO,QAAQ,UAAU,mBAAmB;CAC/E,IAAI,CAAC,uBAAuB,KAAK,KAAK,KAAK,CAAC,uBAAuB,KAAK,MAAM,GAC5E,KAAK,0DAA0D;CAEjE,OAAO,OAAO,OAAO;EAGnB,eAAe,WAAW,OAAO,aAAa;EAC9C;EACA;EAEA,OAAO,oBAAoB,OAAO,OAAO,SAAS,mBAAmB;CACvE,CAAC;AACH;AAEA,SAAS,WAAW,eAAkC;CACpD,IAAI;CACJ,IAAI;EACF,MAAM,iBAAiB;GAAE,KAAK;GAAe,QAAQ;EAAM,CAAC;CAC9D,QAAQ;EAEN,OAAO,aAAa,qBAAqB,iDAAiD;CAC5F;CACA,IAAI,IAAI,sBAAsB,QAAQ,IAAI,sBAAsB,eAAe,cAC7E,OAAO,aAAa,qBAAqB,2CAA2C;CAEtF,OAAO;AACT;AAEA,SAAS,YAAY,OAAmC;CACtD,IAAI,UAAU,KAAA,GAAW,OAAO;CAChC,MAAM,eAAe,UAAU,OAAO,iBAAiB,mBAAmB;CAC1E,IAAI,eAAA,QAA0C,eAAA,MAC5C,OAAO,aAAa,qBAAqB,qCAAqC;CAEhF,OAAO;AACT;AAEA,SAAS,cAAc,OAAwB;CAC7C,OAAO,OAAO,KAAK,KAAK,UAAU,KAAK,GAAG,MAAM,CAAC,CAAC,SAAS,WAAW;AACxE;AAEA,SAAS,kBAAkB,OAA0C;CACnE,MAAM,0BAA0B,IAAI,QAAQ;CAC5C,MAAM,QAAQ,YAA2B,aAAa,SAAS,OAAO;CACtE,MAAM,SAAS,YACb,OACA;EAAC;EAAe;EAAkB;CAAW,GAC7C,0BACA,SACA,IACF;CACA,MAAM,cAAc,oBAAoB,OAAO,aAAa,eAAe,OAAO;CAClF,IAAI,YAAY,SAAS,iBACvB,KAAK,0CAA0C;CAEjD,OAAO,OAAO,OAAO;EACnB;EACA,gBAAgB,sBAAsB,OAAO,cAAc;EAC3D,WAAW,UAAU,OAAO,WAAW,aAAa,OAAO;CAC7D,CAAC;AACH;AAEA,SAAgB,iBAAiB,OAA0C;CACzE,MAAM,cAAc,mBAAmB,MAAM,WAAW;CACxD,MAAM,MAAM,WAAW,YAAY,aAAa;CAChD,MAAM,WAAW,YAAY,MAAM,aAAa;CAChD,IAAI,SAA+D;CAEnE,MAAM,sBAA8B;EAClC,MAAM,MAAM,SAAS,MAAM,KAAK;EAEhC,IAAI,WAAW,QAAQ,OAAO,OAAO,YAAY,MAAM,OAAO,WAAW,UACvE,OAAO,OAAO;EAEhB,MAAM,eAAe,GAAG,cAAc;GACpC,KAAK;GACL,KAAK,YAAY;GACjB,KAAK;EACP,CAAC,EAAE,GAAG,cAAc;GAAE,KAAK,YAAY;GAAQ,KAAK,KAAK,MAAM,MAAM,GAAI;EAAE,CAAC;EAC5E,IAAI;EACJ,IAAI;GAEF,YAAY,KAAK,UAAU,OAAO,KAAK,cAAc,MAAM,GAAG;IAC5D;IACA,aAAa;GACf,CAAC;EACH,QAAQ;GACN,OAAO,aAAa,qBAAqB,oCAAoC;EAC/E;EACA,MAAM,QAAQ,GAAG,aAAa,GAAG,UAAU,SAAS,WAAW;EAC/D,SAAS,OAAO,OAAO;GAAE;GAAO,UAAU;EAAI,CAAC;EAC/C,OAAO;CACT;CAEA,OAAO,OAAO,OAAO;EACnB;EACA,aAAa,SAAkD;GAC7D,MAAM,aAAa,kBAAkB,QAAQ,UAAU;GACvD,IAAI,OAAO,QAAQ,gBAAgB,YAAY,CAAC,aAAa,KAAK,QAAQ,WAAW,GAEnF,aAAa,SAAS,6CAA6C;GAErE,MAAM,UAAU,KAAK,UAAU;IAC7B,KAAK;KACH,OAAO;MACL,iBAAiB;MACjB,WAAW;MACX,YAAY,CAAC,WAAW,cAAc;KACxC;KACA,OAAO;IACT;IACA,OAAO;KACL,SAAS;KACT,aAAa,WAAW;KACxB,WAAW,WAAW;IACxB;GACF,CAAC;GACD,IAAI,OAAO,WAAW,SAAS,MAAM,IAAA,MACnC,aAAa,gCAAgC,oCAAoC;GAEnF,OAAO,OAAO,OAAO;IACnB,aAAa,WAAW;IACxB;IACA,SAAS,OAAO,OAAO;KACrB,WAAW;KACX,WAAW;KACX,SAAS,aAAa,QAAQ;KAC9B,eAAe,UAAU,cAAc;KACvC,cAAc,YAAY;KAC1B,kBAAkB;KAClB,iBAAiB;KACjB,mBAAmB,OAAO,KAAK,MAAM,WAAW,YAAY,GAAI,CAAC;KAEjE,oBAAoB,WAAW;IACjC,CAAC;GACH,CAAC;EACH;CACF,CAAC;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC/NA,MAAa,qCAAqC;;;;;AAMlD,MAAa,wBAA2C,OAAO,OAAO;CAAC;CAAO;CAAO;AAAM,CAAC;AAE5F,MAAM,mBAAmB;AACzB,MAAM,aAAa;AA8DnB,SAAS,cAAc,OAAmC;CACxD,IAAI,UAAU,aAAa,UAAU,eAAe,UAAU,iBAAiB,OAAO;CACtF,OAAO,aAAa,YAAY,oCAAoC;AACtE;AAEA,SAAS,YAAY,OAAoD;CACvE,IAAI,UAAU,MAAM,OAAO;CAC3B,IACE,UAAU,eACV,UAAU,cACV,UAAU,gBACV,UAAU,eAEV,OAAO;CAET,OAAO,aAAa,YAAY,sCAAsC;AACxE;AAEA,SAAS,SAAS,OAAwB;CACxC,MAAM,QAAQ,UAAU,OAAO,YAAY,UAAU;CACrD,IAAI,QAAQ,sBAAsB,SAAS,GACzC,OAAO,aAAa,YAAY,4CAA4C;CAE9E,OAAO;AACT;AAEA,SAAS,mBAAmB,OAAgB,OAA8B;CACxE,OAAO,UAAU,OAAO,OAAO,oBAAoB,OAAO,OAAO,UAAU;AAC7E;AAEA,SAAS,kBAAkB,OAAgB,OAA8B;CACvE,OAAO,UAAU,OAAO,OAAO,UAAU,OAAO,OAAO,UAAU;AACnE;;AAGA,SAAgB,wBAAwB,OAAoC;CAE1E,MAAM,SAAS,YACb,OACA;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,GACA,wCACA,IAlBkC,QAkB5B,IACL,YAAY,aAAa,YAAY,OAAO,CAC/C;CACA,IAAI,OAAO,YAAA,iCACT,OAAO,aAAa,YAAY,6CAA6C;CAE/E,OAAO,OAAO,OAAO;EACnB,SAAS;EACT,aAAa,oBAAoB,OAAO,aAAa,eAAe,UAAU;EAC9E,aAAa,YAAY,OAAO,aAAa,kBAAkB,eAAe,UAAU;EACxF,SAAS,YAAY,OAAO,SAAS,wBAAwB,WAAW,UAAU;EAClF,OAAO,cAAc,OAAO,KAAK;EACjC,UAAU,SAAS,OAAO,QAAQ;EAClC,WAAW,UAAU,OAAO,WAAW,aAAa,UAAU;EAC9D,aAAa,UAAU,OAAO,aAAa,eAAe,UAAU;EACpE,SAAS,mBAAmB,OAAO,SAAS,SAAS;EACrD,gBAAgB,kBAAkB,OAAO,gBAAgB,gBAAgB;EACzE,WAAW,kBAAkB,OAAO,WAAW,WAAW;EAC1D,aAAa,YAAY,OAAO,WAAW;CAC7C,CAAC;AACH;AAEA,SAAS,QACP,QACA,WACA,MACA,KACoB;CACpB,OAAO,OAAO,OAAO;EACnB,GAAG;EACH,OAAO;EACP,UAAU,OAAO,WAAW;EAC5B,SAAS;EACT,gBAAgB;EAChB,WAAW;EACX,aAAa;CACf,CAAC;AACH;;;;;;;;;AAUA,SAAgB,uBACd,YAA+B,uBACnB;CACZ,MAAM,uBAAO,IAAI,IAAqB;CACtC,MAAM,QAAQ,gBAAwD;EACpE,MAAM,SAAS,KAAK,IAAI,WAAW;EACnC,OAAO,WAAW,KAAA,IAAY,KAAA,IAAY,wBAAwB,MAAM;CAC1E;CAEA,OAAO,OAAO,OAAO;EACnB,MAAM,QAAQ,OAA2C;GACvD,MAAM,cAAc,oBAAoB,MAAM,aAAa,eAAe,UAAU;GACpF,IAAI,KAAK,IAAI,WAAW,GAAG,OAAO;GAClC,KAAK,IACH,aACA,OAAO,OAAO;IACZ,SAAS;IACT;IACA,aAAa,YAAY,MAAM,aAAa,kBAAkB,eAAe,UAAU;IACvF,SAAS,YAAY,MAAM,SAAS,wBAAwB,WAAW,UAAU;IACjF,OAAO;IACP,UAAU;IACV,WAAW,UAAU,MAAM,KAAK,OAAO,UAAU;IACjD,aAAa,MAAM;IACnB,SAAS;IACT,gBAAgB;IAChB,WAAW;IACX,aAAa;GACf,CAAC,CACH;GACA,OAAO;EACT;EAEA,MAAM,UAAU,OAAgE;GAC9E,MAAM,MAAM,UAAU,MAAM,KAAK,OAAO,UAAU;GAClD,MAAM,UAAU,UAAU,MAAM,SAAS,WAAW,UAAU;GAC9D,KAAK,MAAM,OAAO,KAAK,KAAK,GAAG;IAC7B,MAAM,SAAS,KAAK,GAAG;IACvB,IAAI,CAAC,UAAU,OAAO,UAAU,aAAa,OAAO,cAAc,KAAK;IAGvE,IAAI,OAAO,mBAAmB,QAAQ,OAAO,iBAAiB,KAAK;IACnE,MAAM,SAAS,OAAO,OAAO;KAC3B,GAAG;KACH,SAAS,iBAAiB;KAC1B,gBAAgB,MAAM;IACxB,CAAC;IACD,KAAK,IAAI,KAAK,MAAM;IACpB,OAAO;GACT;EAEF;EAEA,MAAM,OAAO,OAAmD;GAC9D,MAAM,MAAM,UAAU,MAAM,KAAK,OAAO,UAAU;GAClD,MAAM,SAAS,KAAK,MAAM,WAAW;GAErC,IAAI,CAAC,UAAU,OAAO,UAAU,aAAa,OAAO,YAAY,MAAM,SACpE,OAAO,OAAO,OAAO,EAAE,YAAY,QAAQ,CAAC;GAE9C,IAAI,MAAM,QAAQ,SAAS,aAAa;IACtC,MAAM,OAAO,QAAQ,QAAQ,aAAa,aAAa,GAAG;IAC1D,KAAK,IAAI,OAAO,aAAa,IAAI;IACjC,OAAO,OAAO,OAAO;KAAE,YAAY;KAAa,QAAQ;IAAK,CAAC;GAChE;GACA,IAAI,MAAM,QAAQ,SAAS,YAAY;IACrC,MAAM,OAAO,QAAQ,QAAQ,iBAAiB,YAAY,GAAG;IAC7D,KAAK,IAAI,OAAO,aAAa,IAAI;IACjC,OAAO,OAAO,OAAO;KAAE,YAAY;KAAiB,QAAQ;IAAK,CAAC;GACpE;GACA,MAAM,UAAU,OAAO,WAAW;GAClC,MAAM,QAAQ,UAAU,UAAU;GAClC,IAAI,UAAU,KAAA,GAAW;IACvB,MAAM,OAAO,QAAQ,QAAQ,iBAAiB,MAAM,QAAQ,MAAM,GAAG;IACrE,KAAK,IAAI,OAAO,aAAa,IAAI;IACjC,OAAO,OAAO,OAAO;KAAE,YAAY;KAAiB,QAAQ;IAAK,CAAC;GACpE;GACA,MAAM,OAA2B,OAAO,OAAO;IAC7C,GAAG;IACH,UAAU;IACV,aAAa,MAAM;IACnB,SAAS;IACT,gBAAgB;IAChB,aAAa,MAAM,QAAQ;GAC7B,CAAC;GACD,KAAK,IAAI,OAAO,aAAa,IAAI;GACjC,OAAO,OAAO,OAAO;IAAE,YAAY;IAAY,QAAQ;GAAK,CAAC;EAC/D;EAEA,MAAM,KAAK,aAA8D;GACvE,OAAO,KAAK,WAAW;EACzB;CACF,CAAC;AACH;;;;AC5QA,MAAM,iBAAiB;;AAEvB,MAAM,SAAS;AAiCf,SAAS,SAAS,MAA6B;CAC7C,IAAI;CACJ,IAAI;EACF,SAAS,KAAK,MAAM,IAAI;CAC1B,QAAQ;EACN,OAAO;CACT;CACA,IAAI,WAAW,QAAQ,OAAO,WAAW,UAAU,OAAO;CAC1D,MAAM,SAAmB,OAAmC;CAC5D,OAAO,OAAO,WAAW,YAAY,OAAO,KAAK,MAAM,IAAI,SAAS;AACtE;AAEA,SAAS,SAAS,QAAuB,QAAuB,MAAmC;CACjG,IAAI,WAAW,KAAK,OAAO,OAAO,OAAO;EAAE,MAAM;EAAa;CAAO,CAAC;CAEtE,IAAI,WAAW,QAAQ,WAAW,OAAO,WAAW,OAAO,WAAW,KACpE,OAAO,OAAO,OAAO,EAAE,MAAM,WAAW,OAAO,eAAe,cAAc,CAAC;CAE/E,MAAM,SAAS,SAAS,IAAI;CAE5B,OAAO,WAAW,OACd,OAAO,OAAO,EAAE,MAAM,aAAa,CAAC,IACpC,OAAO,OAAO;EAAE,MAAM;EAAY;EAAQ;CAAO,CAAC;AACxD;AAEA,SAAS,WAAW,OAA+B;CACjD,OAAO,OAAO,UAAU,WAAW,QAAQ;AAC7C;;AAGA,SAAS,UAAU,SAAgD;CACjE,IAAI,YAAY,QAAQ,OAAO,YAAY,UAAU,uBAAO,IAAI,IAAI;CACpE,OAAO,IAAI,IAAqB,OAAO,QAAQ,OAAO,CAAC;AACzD;;;;;;AAOA,SAAgB,qBACd,OAC8B;CAC9B,OAAO,IAAI,SAA8B,YAAY;EACnD,IAAI;EACJ,IAAI;GACF,SAAS,MAAM,QAAQ,QAAQ,MAAM,aAAa,OAAO;EAC3D,QAAQ;GAEN,QAAQ,OAAO,OAAO,EAAE,MAAM,cAAc,CAAC,CAAC;GAC9C;EACF;EAEA,IAAI,UAAU;EACd,IAAI,SAAwB;EAC5B,IAAI,SAAwB;EAC5B,IAAI,OAAO;EAEX,MAAM,UAAU,YAAuC;GACrD,IAAI,SAAS;GACb,UAAU;GACV,IAAI;IACF,OAAO,QAAQ;GACjB,QAAQ,CAER;GACA,QAAQ,OAAO;EACjB;EAEA,OAAO,GAAG,aAAa,YAAY;GACjC,MAAM,MAAM,UAAU,OAAO;GAC7B,MAAM,MAAM,IAAI,IAAI,SAAS;GAC7B,SAAS,OAAO,QAAQ,WAAW,MAAM,OAAO,SAAS,WAAW,GAAG,KAAK,IAAI,EAAE;GAClF,IAAI,CAAC,OAAO,UAAU,MAAM,GAAG,SAAS;GACxC,SAAS,WAAW,IAAI,IAAI,SAAS,CAAC;EACxC,CAAC;EACD,OAAO,GAAG,SAAS,UAAU;GAC3B,IAAI,KAAK,UAAU,gBAAgB;GACnC,QAAQ,OAAO,UAAU,WAAW,QAAQ,OAAO,KAAK;EAC1D,CAAC;EACD,OAAO,GAAG,aAAa;GACrB,OAAO,SAAS,QAAQ,QAAQ,KAAK,MAAM,GAAG,cAAc,CAAC,CAAC;EAChE,CAAC;EACD,OAAO,GAAG,eAAe;GAGvB,OAAO,OAAO,OAAO,EAAE,MAAM,WAAW,OAAO,gBAAgB,aAAa,CAAC,CAAC;EAChF,CAAC;EACD,OAAO,WAAW,MAAM,iBAAiB;GAEvC,OAAO,OAAO,OAAO,EAAE,MAAM,aAAa,CAAC,CAAC;EAC9C,CAAC;EACD,OAAO,IAAI,MAAM,aAAa,OAAO;CACvC,CAAC;AACH"}

package/dist/authentication-HUYWk5Y2.d.ts

@@ -0,0 +1,46 @@
+//#region src/clock.d.ts
+/**
+ * Injected clock. Expiry is never read from `Date.now()` directly, so tests and
+ * deployments own time.
+ *
+ * @author taek <leekt216@gmail.com>
+ */
+interface RelayClock {
+  /** Milliseconds since the Unix epoch as a non-negative safe integer. */
+  now(): number;
+}
+//#endregion
+//#region src/security/authentication.d.ts
+/**
+ * Deployment-owned client/device authentication port.
+ *
+ * The relay never parses credentials. It hands the request to the deployment,
+ * which returns the authenticated bindings or nothing. `clientId` and `subject`
+ * come only from here: wire input may never declare either.
+ *
+ * @author taek <leekt216@gmail.com>
+ */
+/** `client` is the requesting application; `owner` is the approving account owner. */
+type RelayCallerRole = "client" | "owner";
+interface RelayCaller {
+  readonly role: RelayCallerRole;
+  readonly clientId: string;
+  /** Pairwise user/device subject. */
+  readonly subject: string;
+  /**
+   * Redirect URIs the deployment registered for this client. An authorization
+   * code may only be requested for one of them. `owner` callers pass an empty
+   * list; they never receive a code at a redirect URI.
+   */
+  readonly redirectUris: readonly string[];
+}
+interface RelayAuthentication {
+  /**
+   * Resolves to a `RelayCaller`-shaped value, or `null`/`undefined` when the
+   * caller is not authenticated. May throw `OaathRelayError` to choose a code.
+   */
+  authenticate(request: Request): Promise<unknown>;
+}
+//#endregion
+export { RelayClock as i, RelayCaller as n, RelayCallerRole as r, RelayAuthentication as t };
+//# sourceMappingURL=authentication-HUYWk5Y2.d.ts.map

package/dist/authentication-HUYWk5Y2.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentication-HUYWk5Y2.d.ts","names":[],"sources":["../src/clock.ts","../src/security/authentication.ts"],"mappings":";;;;;;;UAUiB;;EAEf;;;;;;;;;;;;;;KCGU;UAIK;WACN,MAAM;WACN;;WAEA;;;;;;WAMA;;UAGM;;;;;EAKf,aAAa,SAAS,UAAU"}