@oaath/server 0.3.1 → 0.3.3

package/dist/{interface-DHpwP0wr.d.ts → interface-BVKJY6sm.d.ts}

@@ -98,7 +98,7 @@ declare class OaathRelayError extends Error {
   readonly bundlerRejection: Readonly<BundlerRejection> | null;
   readonly code: RelayErrorCode;
   readonly diagnostic: Readonly<ValidationGasDiagnostic> | null;
-  constructor(code: RelayErrorCode, message: string, diagnostic?: Readonly<ValidationGasDiagnostic> | null, bundlerRejection?: Readonly<BundlerRejection> | null);
+  constructor(code: RelayErrorCode, message: string, diagnostic?: Readonly<ValidationGasDiagnostic> | null, bundlerRejection?: Readonly<BundlerRejection> | null, options?: ErrorOptions);
 }
 //#endregion
 //#region src/store/records.d.ts
@@ -242,4 +242,4 @@ interface RelayStore {
 }
 //#endregion
 export { OAATH_REVOCATION_REQUEST_RECORD_VERSION as _, AuthorizationDecisionRecord as a, RelayClock as b, EncryptedArtifactRecord as c, OAATH_AUTHORIZATION_REQUEST_RECORD_VERSION as d, OAATH_ENCRYPTED_ARTIFACT_RECORD_VERSION as f, OAATH_REVOCATION_DECISION_RECORD_VERSION as g, RelayErrorCode as h, AuthorizationDecisionOutcome as i, OAATH_AUTHORIZATION_CODE_RECORD_VERSION as l, RELAY_ERROR_STATUS as m, RelayTransaction as n, AuthorizationOwnerRoute as o, OaathRelayError as p, AuthorizationCodeRecord as r, AuthorizationRequestRecord as s, RelayStore as t, OAATH_AUTHORIZATION_DECISION_RECORD_VERSION as u, RevocationDecisionRecord as v, RevocationRequestRecord as y };
-//# sourceMappingURL=interface-DHpwP0wr.d.ts.map
+//# sourceMappingURL=interface-BVKJY6sm.d.ts.map

package/dist/interface-BVKJY6sm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interface-BVKJY6sm.d.ts","names":[],"sources":["../src/clock.ts","../src/revocation/records.ts","../src/relay/errors.ts","../src/store/records.ts","../src/store/interface.ts"],"mappings":";;;;;;;;UAUiB;;EAEf;;;;cCHW;cAEA;UAKI;WACN,gBAAgB;WAChB;WACA;WACA;WACA;WACA;WACA,gBAAgB,SAAS;;UAEnB;WACN,gBAAgB;WAChB;WACA;WACA;;WAEA;;;;KCdC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA6DC,oBAAoB,SAAS,OAAO;cAyBpC,wBAAwB;WAC1B,kBAAkB,SAAS;WAC3B,MAAM;WACN,YAAY,SAAS;EAE9B,YACE,MAAM,gBACN,iBACA,aAAY,SAAS,iCACrB,mBAAkB,SAAS,0BAC3B,UAAU;;;;cC7FD;cAEA;cAEA;cAEA;cAEA;;UAiBI;WACN;WACA;;UAGM,mCAAmC;WACzC,gBAAgB;WAChB;;WAEA;;WAEA;;;;;;WAMA;WACA;;WAEA;;WAEA;WACA;WACA;;KAGC;;;;;UAMK;WACN,gBAAgB;WAChB;WACA,SAAS;WACT;;;;;;;WAOA;WACA;;UAGM;WACN,gBAAgB;;WAEhB;WACA;;WAEA;WACA;WACA;WACA;WACA;WACA;;WAEA;;UAGM;WACN,gBAAgB;WAChB;WACA;WACA;;WAEA;WACA;;WAEA;;;;;;;;;;UAWM;WACN,gBAAgB;WAChB;;WAEA;WACA;WACA;;;;;UC7FM;WACN;WACA;WACA;;UAGM;;EAEf,yBACE,sBACA,aACA,gBACC,iBAAiB;;EAEpB,4BACE,iBACA,kBACC,QAAQ;;EAEX,sBAAsB,sBAAsB,QAAQ;EACpD,wBAAwB,QAAQ,0BAA0B;EAC1D,uBAAuB,sBAAsB,QAAQ;EACrD,yBAAyB,QAAQ,2BAA2B;EAE5D,yBAAyB,oBAAoB,QAAQ;;EAErD,2BAA2B,QAAQ,6BAA6B;EAEhE,0BAA0B,oBAAoB,QAAQ;;EAEtD,4BAA4B,QAAQ,8BAA8B;EAElE,sBAAsB,mBAAmB,QAAQ;EACjD,wBAAwB,QAAQ,0BAA0B;;EAE1D,yBAAyB,kBAAkB,qBAAqB;EAEhE,2BAA2B,kBAAkB,QAAQ;;EAErD,6BAA6B,QAAQ,+BAA+B;EAEpE,sBAAsB,qBAAqB,QAAQ;;EAEnD,iCAAiC,oBAAoB,QAAQ;EAC7D,wBAAwB,QAAQ,0BAA0B;;EAE1D,uBAAuB,oBAAoB,oBAAoB;;EAG/D,UAAU;;EAEV,YAAY;;UAGG;EACf,SAAS,QAAQ;EACjB,SAAS"}

package/dist/kernel.d.ts

@@ -1,4 +1,4 @@
-import { b as RelayClock, t as RelayStore } from "./interface-DHpwP0wr.js";
+import { b as RelayClock, t as RelayStore } from "./interface-BVKJY6sm.js";
 import { t as RelayKms } from "./kms-BWkywdJM.js";
 import { OperationObserveResult, OperationObserverCapabilities, OperationStartResult, OperationStoreAdapter } from "@oaath/sdk/advanced";
 import { PreparedUserOperation } from "@oaath/sdk/kernel";

package/dist/kernel.js

@@ -1,6 +1,6 @@
-import { b as relayFailure } from "./records-BQNDxbPg.js";
-import { a as relayNow } from "./challenge-DmpGSogj.js";
-import { S as withRelayTransaction, b as openArtifact, r as readRevocationState } from "./service-Cf4f-9KP.js";
+import { b as relayFailure } from "./records-Bh8rOpBa.js";
+import { a as relayNow } from "./challenge-WmeNbyox.js";
+import { S as withRelayTransaction, b as openArtifact, r as readRevocationState } from "./service-DT0vkKop.js";
 import { parseOwnerSigningArtifact } from "@oaath/protocol";
 import { OperationStore, createOperationObserver, createOperationRunner } from "@oaath/sdk/advanced";
 import { restoreKernelPermissionRevocation } from "@oaath/sdk/kernel";

package/dist/native.d.ts

@@ -1,3 +1,3 @@
-import { a as ProjectOwnerPhoneRequestInput, c as OwnerPhoneRevocationDecision, d as OwnerPhonePermissionApprovals, f as PreparedOwnerPhonePermissionApproval, i as OwnerPhoneScopeProjection, l as OwnerPhoneRevocationScopeProjection, n as OwnerPhonePushProjection, o as projectOwnerPhonePermissionSigning, r as OwnerPhoneRequestProjection, s as projectOwnerPhoneRequest, t as OAATH_NATIVE_PROJECTION_VERSION, u as projectOwnerPhoneRevocation } from "./projection-B7IB9irs.js";
-import { A as listOwnerPhoneRequests, B as createMemoryOwnerDeviceCredentialStore, C as RequestOwnerPhoneRevocationInput, D as submitOwnerPhoneRevocationDecision, E as requestOwnerPhoneRevocation, F as OAATH_OWNER_DEVICE_CREDENTIAL_VERSION, I as OwnerDeviceAuthentication, L as OwnerDeviceCredentialRecord, M as OwnerPhoneDecision, N as SubmitOwnerPhoneDecisionInput, O as OAATH_NATIVE_INBOX_VERSION, P as submitOwnerPhoneDecision, R as OwnerDeviceCredentialStore, S as OwnerPhoneRevocationStatus, T as fetchOwnerPhoneRevocation, V as createOwnerDeviceAuthentication, j as NATIVE_DISPLAY_PAYLOAD_LENGTH, k as OwnerPhoneInbox, w as fetchClientPhoneRevocation, z as OwnerDeviceReference } from "./service-J51bOVe6.js";
+import { a as ProjectOwnerPhoneRequestInput, c as OwnerPhoneRevocationDecision, d as OwnerPhonePermissionApprovals, f as PreparedOwnerPhonePermissionApproval, i as OwnerPhoneScopeProjection, l as OwnerPhoneRevocationScopeProjection, n as OwnerPhonePushProjection, o as projectOwnerPhonePermissionSigning, r as OwnerPhoneRequestProjection, s as projectOwnerPhoneRequest, t as OAATH_NATIVE_PROJECTION_VERSION, u as projectOwnerPhoneRevocation } from "./projection-CrtZYvxz.js";
+import { A as listOwnerPhoneRequests, B as createMemoryOwnerDeviceCredentialStore, C as RequestOwnerPhoneRevocationInput, D as submitOwnerPhoneRevocationDecision, E as requestOwnerPhoneRevocation, F as OAATH_OWNER_DEVICE_CREDENTIAL_VERSION, I as OwnerDeviceAuthentication, L as OwnerDeviceCredentialRecord, M as OwnerPhoneDecision, N as SubmitOwnerPhoneDecisionInput, O as OAATH_NATIVE_INBOX_VERSION, P as submitOwnerPhoneDecision, R as OwnerDeviceCredentialStore, S as OwnerPhoneRevocationStatus, T as fetchOwnerPhoneRevocation, V as createOwnerDeviceAuthentication, j as NATIVE_DISPLAY_PAYLOAD_LENGTH, k as OwnerPhoneInbox, w as fetchClientPhoneRevocation, z as OwnerDeviceReference } from "./service-Dv3zIiNr.js";
 export { NATIVE_DISPLAY_PAYLOAD_LENGTH, OAATH_NATIVE_INBOX_VERSION, OAATH_NATIVE_PROJECTION_VERSION, OAATH_OWNER_DEVICE_CREDENTIAL_VERSION, type OwnerDeviceAuthentication, type OwnerDeviceCredentialRecord, type OwnerDeviceCredentialStore, type OwnerDeviceReference, type OwnerPhoneDecision, type OwnerPhoneInbox, type OwnerPhonePermissionApprovals, type OwnerPhonePushProjection, type OwnerPhoneRequestProjection, type OwnerPhoneRevocationDecision, type OwnerPhoneRevocationScopeProjection, type OwnerPhoneRevocationStatus, type OwnerPhoneScopeProjection, type PreparedOwnerPhonePermissionApproval, type ProjectOwnerPhoneRequestInput, type RequestOwnerPhoneRevocationInput, type SubmitOwnerPhoneDecisionInput, createMemoryOwnerDeviceCredentialStore, createOwnerDeviceAuthentication, fetchClientPhoneRevocation, fetchOwnerPhoneRevocation, listOwnerPhoneRequests, projectOwnerPhonePermissionSigning, projectOwnerPhoneRequest, projectOwnerPhoneRevocation, requestOwnerPhoneRevocation, submitOwnerPhoneDecision, submitOwnerPhoneRevocationDecision };

package/dist/native.js

@@ -1,7 +1,7 @@
-import { b as relayFailure, c as canonicalIdentifier } from "./records-BQNDxbPg.js";
-import { n as randomIdentifier, r as sha256Base64Url } from "./challenge-DmpGSogj.js";
-import { a as submitOwnerPhoneRevocationDecision, c as projectOwnerPhonePermissionSigning, h as NATIVE_DISPLAY_PAYLOAD_LENGTH, i as requestOwnerPhoneRevocation, l as projectOwnerPhoneRequest, n as fetchOwnerPhoneRevocation, o as projectOwnerPhoneRevocation, s as OAATH_NATIVE_PROJECTION_VERSION, t as fetchClientPhoneRevocation } from "./service-Cf4f-9KP.js";
-import { n as listOwnerPhoneRequests, r as submitOwnerPhoneDecision, t as OAATH_NATIVE_INBOX_VERSION } from "./inbox-B80EUVht.js";
+import { b as relayFailure, c as canonicalIdentifier } from "./records-Bh8rOpBa.js";
+import { n as randomIdentifier, r as sha256Base64Url } from "./challenge-WmeNbyox.js";
+import { a as submitOwnerPhoneRevocationDecision, c as projectOwnerPhonePermissionSigning, h as NATIVE_DISPLAY_PAYLOAD_LENGTH, i as requestOwnerPhoneRevocation, l as projectOwnerPhoneRequest, n as fetchOwnerPhoneRevocation, o as projectOwnerPhoneRevocation, s as OAATH_NATIVE_PROJECTION_VERSION, t as fetchClientPhoneRevocation } from "./service-DT0vkKop.js";
+import { n as listOwnerPhoneRequests, r as submitOwnerPhoneDecision, t as OAATH_NATIVE_INBOX_VERSION } from "./inbox-BKXNtsX3.js";
 import { captureRecord, exactCapturedRecord } from "@oaath/protocol";
 //#region src/native/authentication.ts
 const OAATH_OWNER_DEVICE_CREDENTIAL_VERSION = "oaath.owner-device-credential/v1";

package/dist/postgres.d.ts

@@ -1,5 +1,5 @@
-import { t as RelayStore } from "./interface-DHpwP0wr.js";
-import { R as OwnerDeviceCredentialStore, i as ServiceDirectoryStore } from "./service-J51bOVe6.js";
+import { t as RelayStore } from "./interface-BVKJY6sm.js";
+import { R as OwnerDeviceCredentialStore, i as ServiceDirectoryStore } from "./service-Dv3zIiNr.js";
 import { Pool } from "pg";
 import { OperationStoreAdapter } from "@oaath/sdk/advanced";
 //#region src/directory/postgres.d.ts

package/dist/postgres.js

@@ -1,5 +1,5 @@
-import { b as relayFailure, d as parseAuthorizationRequestRecord, f as parseCapabilityInvalidationRecord, l as parseAuthorizationCodeRecord, p as parseEncryptedArtifactRecord, u as parseAuthorizationDecisionRecord } from "./records-BQNDxbPg.js";
-import { a as parseRevocationRequestRecord, i as parseRevocationDecisionRecord } from "./records-BUvqmp0D.js";
+import { b as relayFailure, d as parseAuthorizationRequestRecord, f as parseCapabilityInvalidationRecord, l as parseAuthorizationCodeRecord, p as parseEncryptedArtifactRecord, u as parseAuthorizationDecisionRecord } from "./records-Bh8rOpBa.js";
+import { a as parseRevocationRequestRecord, i as parseRevocationDecisionRecord } from "./records-lPGo4RxO.js";
 import pg from "pg";
 //#region src/directory/postgres.ts
 /** Creates the current directory schema; existing/older tables are never migrated. */

package/dist/{projection-B7IB9irs.d.ts → projection-CrtZYvxz.d.ts}

@@ -1,4 +1,4 @@
-import { b as RelayClock, t as RelayStore } from "./interface-DHpwP0wr.js";
+import { b as RelayClock, t as RelayStore } from "./interface-BVKJY6sm.js";
 import { KernelReplayableInstallOwnerSigningRequest, KernelRevocationSigningRequest, OwnerSigningArtifact, OwnerSigningRequest, PermissionRequest, WorkspaceAccountContext } from "@oaath/protocol";
 //#region src/security/authentication.d.ts
 /**
@@ -225,4 +225,4 @@ declare function projectOwnerPhonePermissionSigning(input: ProjectOwnerPhoneRequ
 }): Promise<OwnerPhoneRequestProjection>;
 //#endregion
 export { ProjectOwnerPhoneRequestInput as a, OwnerPhoneRevocationDecision as c, OwnerPhonePermissionApprovals as d, PreparedOwnerPhonePermissionApproval as f, RelayCallerRole as h, OwnerPhoneScopeProjection as i, OwnerPhoneRevocationScopeProjection as l, RelayCaller as m, OwnerPhonePushProjection as n, projectOwnerPhonePermissionSigning as o, RelayAuthentication as p, OwnerPhoneRequestProjection as r, projectOwnerPhoneRequest as s, OAATH_NATIVE_PROJECTION_VERSION as t, projectOwnerPhoneRevocation as u };
-//# sourceMappingURL=projection-B7IB9irs.d.ts.map
+//# sourceMappingURL=projection-CrtZYvxz.d.ts.map

package/dist/{projection-B7IB9irs.d.ts.map → projection-CrtZYvxz.d.ts.map}

@@ -1 +1 @@
-{"version":3,"file":"projection-B7IB9irs.d.ts","names":[],"sources":["../src/security/authentication.ts","../src/native/permission-approval.ts","../src/native/revocation.ts","../src/native/projection.ts"],"mappings":";;;;;;;;;;;;;KAoBY;UAIK;WACN,MAAM;WACN;;WAEA;;;;;;WAMA;;;;;;;;;WASA;;UAGM;;;;;EAKf,aAAa,SAAS,UAAU;;;;UCtCjB;WACN,gBAAgB,SAAS;;EAElC,SAAS,UAAU,SAAS,uBAAuB,oBAAoB;;UAGxD;;EAEf,QACE,SAAS,SAAS,qBACjB,QAAQ,SAAS;;;;UCPL;WACN;WACA;;WAEA;WACA,YAAY;WACZ,SAAS;IAChB;IACA;IACA;IACA,SAAS;;WAEF,QAAQ;WACR;WACA;WACA,WAAW;WACX;;;UAIM;WACN;WACA;WACA;WACA;WACA;;;;;;;iBAQW,4BAA4B;WACvC;WACA;WACA;WACA;IACP,QAAQ;;;;cCIC;;KAUD,iCACR;EAAW;EAAe;KAC1B;EAAW;EAAc;KACzB;EAAW;EAAkB;EAAmB;;;;;;;;;;KAUxC,sCAAsC;EAChD;EACA;;EAEA,SAAS,SAAS;;EAElB,aAAa;IACX;IACA;IACA;;IAEA;;;EAGF,SAAS;IACP;IACA;IACA;IACA;IACA,iBAAiB;;;EAGnB,oBAAoB;;;;;;;EAOpB,eAAe;IACb;IACA;;EAEF;EACA,gBAAgB;IACd;IACA;IACA;IACA,yBAAyB;MAAW;MAAe;;;EAErD;;EAEA;;EAEA;EACA;EACA;;EAEA;;KAGU,4BACR,sCACA,sCACA;EACE;EACA;;EAEA;;EAEA,SAAS,SAAS;KAEpB;EACE;EACA;;EAEA;;EAEA,SAAS,SAAS;KAEpB;EAAW;EAAa;EAAyB;;UAEpC;WACN,gBAAgB;;;;;;WAMhB;;WAEA;;WAEA;;WAEA,QAAQ;IAAW;IAAkB;;WACrC,OAAO;;;;;;;KAQN,2BAA2B,KACrC;UAIe;WACN,OAAO;WACP,OAAO;;WAEP,QAAQ;WACR;;iBA+JW,yBACpB,OAAO,gCACN,QAAQ;;iBAUW,mCACpB,OAAO;WACI,sBAAsB;IAEhC,QAAQ"}
+{"version":3,"file":"projection-CrtZYvxz.d.ts","names":[],"sources":["../src/security/authentication.ts","../src/native/permission-approval.ts","../src/native/revocation.ts","../src/native/projection.ts"],"mappings":";;;;;;;;;;;;;KAoBY;UAIK;WACN,MAAM;WACN;;WAEA;;;;;;WAMA;;;;;;;;;WASA;;UAGM;;;;;EAKf,aAAa,SAAS,UAAU;;;;UCtCjB;WACN,gBAAgB,SAAS;;EAElC,SAAS,UAAU,SAAS,uBAAuB,oBAAoB;;UAGxD;;EAEf,QACE,SAAS,SAAS,qBACjB,QAAQ,SAAS;;;;UCPL;WACN;WACA;;WAEA;WACA,YAAY;WACZ,SAAS;IAChB;IACA;IACA;IACA,SAAS;;WAEF,QAAQ;WACR;WACA;WACA,WAAW;WACX;;;UAIM;WACN;WACA;WACA;WACA;WACA;;;;;;;iBAQW,4BAA4B;WACvC;WACA;WACA;WACA;IACP,QAAQ;;;;cCIC;;KAUD,iCACR;EAAW;EAAe;KAC1B;EAAW;EAAc;KACzB;EAAW;EAAkB;EAAmB;;;;;;;;;;KAUxC,sCAAsC;EAChD;EACA;;EAEA,SAAS,SAAS;;EAElB,aAAa;IACX;IACA;IACA;;IAEA;;;EAGF,SAAS;IACP;IACA;IACA;IACA;IACA,iBAAiB;;;EAGnB,oBAAoB;;;;;;;EAOpB,eAAe;IACb;IACA;;EAEF;EACA,gBAAgB;IACd;IACA;IACA;IACA,yBAAyB;MAAW;MAAe;;;EAErD;;EAEA;;EAEA;EACA;EACA;;EAEA;;KAGU,4BACR,sCACA,sCACA;EACE;EACA;;EAEA;;EAEA,SAAS,SAAS;KAEpB;EACE;EACA;;EAEA;;EAEA,SAAS,SAAS;KAEpB;EAAW;EAAa;EAAyB;;UAEpC;WACN,gBAAgB;;;;;;WAMhB;;WAEA;;WAEA;;WAEA,QAAQ;IAAW;IAAkB;;WACrC,OAAO;;;;;;;KAQN,2BAA2B,KACrC;UAIe;WACN,OAAO;WACP,OAAO;;WAEP,QAAQ;WACR;;iBA+JW,yBACpB,OAAO,gCACN,QAAQ;;iBAUW,mCACpB,OAAO;WACI,sBAAsB;IAEhC,QAAQ"}

package/dist/{records-BQNDxbPg.js → records-Bh8rOpBa.js}

@@ -1,4 +1,4 @@
-import { captureBundlerRejection, captureValidationGasDiagnostic, exactRecord } from "@oaath/protocol";
+import { captureBundlerRejection, captureValidationGasDiagnostic, exactRecord, serializeUserOperationFailure } from "@oaath/protocol";
 //#region src/relay/errors.ts
 /**
 * Closed relay failure codes and their stable HTTP projection.
@@ -38,16 +38,16 @@ var OaathRelayError = class extends Error {
 	bundlerRejection;
 	code;
 	diagnostic;
-	constructor(code, message, diagnostic = null, bundlerRejection = null) {
-		super(message);
+	constructor(code, message, diagnostic = null, bundlerRejection = null, options) {
+		super(message, options);
 		this.name = "OaathRelayError";
 		this.code = code;
 		this.diagnostic = captureValidationGasDiagnostic(diagnostic);
 		this.bundlerRejection = code === "relay_chain_unavailable" ? captureBundlerRejection(bundlerRejection) : null;
 	}
 };
-function relayFailure(code, message, diagnostic = null, bundlerRejection = null) {
-	throw new OaathRelayError(code, message, diagnostic, bundlerRejection);
+function relayFailure(code, message, diagnostic = null, bundlerRejection = null, options) {
+	throw new OaathRelayError(code, message, diagnostic, bundlerRejection, options);
 }
 /** Any non-relay throw is an unreadable internal failure, never caller-visible detail. */
 function relayErrorCode(error) {
@@ -57,13 +57,15 @@ const RESPONSE_HEADERS = Object.freeze({
 	"content-type": "application/json; charset=utf-8",
 	"cache-control": "no-store"
 });
-function relayErrorResponse(code, diagnostic = null, bundlerRejection = null) {
+function relayErrorResponse(code, diagnostic = null, bundlerRejection = null, cause) {
+	const failure = code === "relay_chain_unavailable" ? serializeUserOperationFailure(cause) : null;
 	const captured = code === "relay_chain_unavailable" ? captureValidationGasDiagnostic(diagnostic) : null;
 	const rejection = code === "relay_chain_unavailable" ? captureBundlerRejection(bundlerRejection) : null;
 	return jsonResponse(RELAY_ERROR_STATUS[code], { error: {
 		code,
 		...captured === null ? {} : { diagnostic: captured },
-		...rejection === null ? {} : { bundlerRejection: rejection }
+		...rejection === null ? {} : { bundlerRejection: rejection },
+		...failure === null ? {} : { failure }
 	} });
 }
 function jsonResponse(status, body) {
@@ -252,4 +254,4 @@ function parseEncryptedArtifactRecord(value) {
 //#endregion
 export { jsonResponse as _, OAATH_ENCRYPTED_ARTIFACT_RECORD_VERSION as a, relayFailure as b, canonicalIdentifier as c, parseAuthorizationRequestRecord as d, parseCapabilityInvalidationRecord as f, RELAY_ERROR_STATUS as g, OaathRelayError as h, OAATH_CAPABILITY_INVALIDATION_RECORD_VERSION as i, parseAuthorizationCodeRecord as l, timestamp as m, OAATH_AUTHORIZATION_DECISION_RECORD_VERSION as n, RELAY_LIMITS as o, parseEncryptedArtifactRecord as p, OAATH_AUTHORIZATION_REQUEST_RECORD_VERSION as r, boundedText as s, OAATH_AUTHORIZATION_CODE_RECORD_VERSION as t, parseAuthorizationDecisionRecord as u, relayErrorCode as v, relayErrorResponse as y };
 
-//# sourceMappingURL=records-BQNDxbPg.js.map
+//# sourceMappingURL=records-Bh8rOpBa.js.map

package/dist/records-Bh8rOpBa.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"records-Bh8rOpBa.js","names":[],"sources":["../src/relay/errors.ts","../src/store/records.ts"],"sourcesContent":["/**\n * Closed relay failure codes and their stable HTTP projection.\n *\n * Machine decisions and wire responses use these codes only. `Error.message`\n * exists for local diagnostics and never reaches a response body.\n *\n * @author taek <leekt216@gmail.com>\n */\n\nimport {\n  type BundlerRejection,\n  captureBundlerRejection,\n  captureValidationGasDiagnostic,\n  serializeUserOperationFailure,\n  type ValidationGasDiagnostic,\n} from \"@oaath/protocol\";\n\nexport type RelayErrorCode =\n  /** Wire input is missing, malformed, oversized, or contains unknown fields. */\n  | \"relay_request_invalid\"\n  /** The deployment authentication port did not authenticate the caller. */\n  | \"relay_unauthenticated\"\n  /** Authenticated caller may not act in the required role. */\n  | \"relay_forbidden\"\n  /** Route, or a record the caller is entitled to see, does not exist. */\n  | \"relay_not_found\"\n  /** Route exists with a different method. */\n  | \"relay_method_not_allowed\"\n  /** The authorization request or code is past its injected-clock expiry. */\n  | \"relay_expired\"\n  /** The authorization request already reached a terminal decision. */\n  | \"relay_already_decided\"\n  /** The one-time authorization code was already consumed. */\n  | \"relay_code_already_consumed\"\n  /** The one-time encrypted artifact was already claimed. */\n  | \"relay_artifact_already_claimed\"\n  /**\n   * Authorization code redemption failed. One code for every reason it can\n   * fail — unknown code, another client's code, wrong redirect URI, wrong PKCE\n   * verifier — so the endpoint never confirms that a guessed code was correct.\n   * A code that existed is burned.\n   */\n  | \"relay_code_invalid\"\n  /** The optional deployment limiter rejected the call. */\n  | \"relay_rate_limited\"\n  /** A durable record could not be read as the current schema version. */\n  | \"relay_record_unreadable\"\n  /** The KMS port was unavailable or returned an unusable result. */\n  | \"relay_kms_unavailable\"\n  /** The store failed before any state change could have been committed. */\n  | \"relay_store_unavailable\"\n  /**\n   * The store could not prove whether a transition committed. The caller must\n   * treat the transition as neither applied nor retryable: an ambiguous commit\n   * never authorizes resubmission.\n   */\n  | \"relay_state_ambiguous\"\n  /**\n   * EXPERIMENTAL PREVIEW (`@oaath/server/apns`): the constructed APNs payload\n   * exceeded Apple's 4096-byte limit, so nothing was sent.\n   */\n  | \"relay_apns_payload_too_large\"\n  /**\n   * EXPERIMENTAL PREVIEW (`@oaath/server/apns`): the injected Apple credential\n   * capability is not a usable P-256 signing key, key id, team id, or topic.\n   */\n  | \"relay_apns_credentials_invalid\"\n  /** A deployment-injected chain execution port failed or answered unusably. */\n  | \"relay_chain_unavailable\"\n  /** The Grant's capability is durably invalidated; nothing more executes here. */\n  | \"relay_capability_invalidated\"\n  /** An invariant the relay owns was violated. */\n  | \"relay_internal\";\n\n/**\n * Status projection. `relay_state_ambiguous` is deliberately 500 and not 503,\n * because 503 invites the retry that an ambiguous commit forbids.\n */\nexport const RELAY_ERROR_STATUS: Readonly<Record<RelayErrorCode, number>> = Object.freeze({\n  relay_request_invalid: 400,\n  relay_unauthenticated: 401,\n  relay_forbidden: 403,\n  relay_not_found: 404,\n  relay_method_not_allowed: 405,\n  relay_expired: 410,\n  relay_already_decided: 409,\n  relay_code_already_consumed: 409,\n  relay_artifact_already_claimed: 409,\n  relay_code_invalid: 400,\n  relay_rate_limited: 429,\n  relay_record_unreadable: 500,\n  relay_kms_unavailable: 503,\n  relay_store_unavailable: 503,\n  relay_state_ambiguous: 500,\n  // The preview codes have no route. They are projected only so the union stays\n  // closed and one owner keeps every code's status.\n  relay_apns_payload_too_large: 500,\n  relay_apns_credentials_invalid: 500,\n  relay_chain_unavailable: 503,\n  relay_capability_invalidated: 409,\n  relay_internal: 500,\n});\n\nexport class OaathRelayError extends Error {\n  readonly bundlerRejection: Readonly<BundlerRejection> | null;\n  readonly code: RelayErrorCode;\n  readonly diagnostic: Readonly<ValidationGasDiagnostic> | null;\n\n  constructor(\n    code: RelayErrorCode,\n    message: string,\n    diagnostic: Readonly<ValidationGasDiagnostic> | null = null,\n    bundlerRejection: Readonly<BundlerRejection> | null = null,\n    options?: ErrorOptions,\n  ) {\n    super(message, options);\n    this.name = \"OaathRelayError\";\n    this.code = code;\n    this.diagnostic = captureValidationGasDiagnostic(diagnostic);\n    this.bundlerRejection =\n      code === \"relay_chain_unavailable\" ? captureBundlerRejection(bundlerRejection) : null;\n  }\n}\n\nexport function relayFailure(\n  code: RelayErrorCode,\n  message: string,\n  diagnostic: Readonly<ValidationGasDiagnostic> | null = null,\n  bundlerRejection: Readonly<BundlerRejection> | null = null,\n  options?: ErrorOptions,\n): never {\n  throw new OaathRelayError(code, message, diagnostic, bundlerRejection, options);\n}\n\n/** Any non-relay throw is an unreadable internal failure, never caller-visible detail. */\nexport function relayErrorCode(error: unknown): RelayErrorCode {\n  return error instanceof OaathRelayError ? error.code : \"relay_internal\";\n}\n\nconst RESPONSE_HEADERS: Readonly<Record<string, string>> = Object.freeze({\n  \"content-type\": \"application/json; charset=utf-8\",\n  \"cache-control\": \"no-store\",\n});\n\nexport function relayErrorResponse(\n  code: RelayErrorCode,\n  diagnostic: Readonly<ValidationGasDiagnostic> | null = null,\n  bundlerRejection: Readonly<BundlerRejection> | null = null,\n  cause?: unknown,\n): Response {\n  const failure = code === \"relay_chain_unavailable\" ? serializeUserOperationFailure(cause) : null;\n  const captured =\n    code === \"relay_chain_unavailable\" ? captureValidationGasDiagnostic(diagnostic) : null;\n  const rejection =\n    code === \"relay_chain_unavailable\" ? captureBundlerRejection(bundlerRejection) : null;\n  return jsonResponse(RELAY_ERROR_STATUS[code], {\n    error: {\n      code,\n      ...(captured === null ? {} : { diagnostic: captured }),\n      ...(rejection === null ? {} : { bundlerRejection: rejection }),\n      ...(failure === null ? {} : { failure }),\n    },\n  });\n}\n\nexport function jsonResponse(status: number, body: unknown): Response {\n  return new Response(JSON.stringify(body), { status, headers: RESPONSE_HEADERS });\n}\n","/**\n * Exact current-version durable relay records.\n *\n * Durable storage is a trust boundary: every read is captured into an exact,\n * owned, immutable record before typed code consumes it. There is exactly one\n * current version per record and no reader for any older version.\n *\n * These shapes are relay-owned for now. `@oaath/protocol` owns the wire\n * `AuthorizationRequest`, `AuthorizationDecision`, and `AuthorizationCode`\n * contracts; adopting them here is a follow-up because the units differ (this\n * store keeps epoch milliseconds, the protocol speaks whole seconds) and the\n * code digest differs (base64url WebCrypto here, `0x` hex there). Once adopted,\n * this file should keep only the store envelope around those records.\n *\n * @author taek <leekt216@gmail.com>\n */\n\nimport { type CaptureContext, exactRecord } from \"@oaath/protocol\";\nimport { type RelayErrorCode, relayFailure } from \"../relay/errors.js\";\n\nexport const OAATH_AUTHORIZATION_REQUEST_RECORD_VERSION =\n  \"oaath.authorization-request-record/v2\" as const;\nexport const OAATH_AUTHORIZATION_DECISION_RECORD_VERSION =\n  \"oaath.authorization-decision-record/v1\" as const;\nexport const OAATH_AUTHORIZATION_CODE_RECORD_VERSION =\n  \"oaath.authorization-code-record/v1\" as const;\nexport const OAATH_ENCRYPTED_ARTIFACT_RECORD_VERSION =\n  \"oaath.encrypted-artifact-record/v1\" as const;\nexport const OAATH_CAPABILITY_INVALIDATION_RECORD_VERSION =\n  \"oaath.capability-invalidation-record/v1\" as const;\n\n/** Bounded field limits owned here and shared with wire capture. */\nexport const RELAY_LIMITS = Object.freeze({\n  identifier: 256,\n  redirectUri: 2048,\n  codeChallenge: 128,\n  codeVerifier: 128,\n  requestedScope: 8192,\n  artifactPlaintext: 32_768,\n  ciphertextRef: 65_536,\n});\n\nconst MAX_TIMESTAMP = Number.MAX_SAFE_INTEGER;\n\n/** Deployment-selected device reference and its authenticated approving subject. */\nexport interface AuthorizationOwnerRoute {\n  readonly ownerDeviceId: string;\n  readonly ownerSubject: string;\n}\n\nexport interface AuthorizationRequestRecord extends AuthorizationOwnerRoute {\n  readonly version: typeof OAATH_AUTHORIZATION_REQUEST_RECORD_VERSION;\n  readonly requestId: string;\n  /** Client bound by the deployment authentication port, never by wire input. */\n  readonly clientId: string;\n  /** Requesting member's subject, independent of the approving device. */\n  readonly subject: string;\n  /**\n   * Organization/audience bound by the authentication port at creation time,\n   * or null when the deployment declares none. Grant reference verification\n   * compares assertions against this captured value.\n   */\n  readonly organizationAudience: string | null;\n  readonly redirectUri: string;\n  /** PKCE S256 challenge; the verifier never reaches the store. */\n  readonly codeChallenge: string;\n  /** Opaque owner-reviewed scope payload. Migrates to @oaath/protocol. */\n  readonly requestedScope: string;\n  readonly createdAt: number;\n  readonly expiresAt: number;\n}\n\nexport type AuthorizationDecisionOutcome = \"approved\" | \"rejected\";\n\n/**\n * Terminal decision. Its existence is the single authoritative fact that an\n * authorization request was decided; the request record never mutates.\n */\nexport interface AuthorizationDecisionRecord {\n  readonly version: typeof OAATH_AUTHORIZATION_DECISION_RECORD_VERSION;\n  readonly requestId: string;\n  readonly outcome: AuthorizationDecisionOutcome;\n  readonly decidedAt: number;\n  /**\n   * KMS-sealed copy of the released code for authenticated client pickup, and\n   * its expiry. The relay mints the code itself, so holding a sealed copy adds\n   * no new trust; PKCE still guards consumption. Both are null exactly when\n   * the outcome is a rejection.\n   */\n  readonly codeRef: string | null;\n  readonly codeExpiresAt: number | null;\n}\n\nexport interface AuthorizationCodeRecord {\n  readonly version: typeof OAATH_AUTHORIZATION_CODE_RECORD_VERSION;\n  /** SHA-256 (base64url) of the released code. The code itself is never stored. */\n  readonly codeHash: string;\n  readonly requestId: string;\n  /** Binding snapshot taken at issue time so consume needs exactly one row lock. */\n  readonly clientId: string;\n  readonly redirectUri: string;\n  readonly codeChallenge: string;\n  readonly artifactId: string;\n  readonly createdAt: number;\n  readonly expiresAt: number;\n  /** Set exactly once. A non-null value is terminal. */\n  readonly consumedAt: number | null;\n}\n\nexport interface EncryptedArtifactRecord {\n  readonly version: typeof OAATH_ENCRYPTED_ARTIFACT_RECORD_VERSION;\n  readonly artifactId: string;\n  readonly requestId: string;\n  readonly clientId: string;\n  /** Opaque KMS reference. Plaintext never reaches the store. */\n  readonly ciphertextRef: string;\n  readonly createdAt: number;\n  /** Set exactly once. A non-null value is terminal. */\n  readonly claimedAt: number | null;\n}\n\n/**\n * One durable capability invalidation: from the moment this record commits,\n * the relay's chain execution routes refuse every submission and usage read\n * for the Grant, so the recorded evidence states an enforced fact — \"this\n * service will no longer act for this capability\" — not a bare digest.\n * Consuming the on-chain install nonce is the chain-local revocation\n * operation's job and stays separate evidence.\n */\nexport interface CapabilityInvalidationRecord {\n  readonly version: typeof OAATH_CAPABILITY_INVALIDATION_RECORD_VERSION;\n  readonly grantId: string;\n  /** The authenticated client that recorded the invalidation. */\n  readonly clientId: string;\n  readonly capabilityHash: string;\n  readonly invalidatedAt: number;\n}\n\nexport function boundedText(\n  value: unknown,\n  maximum: number,\n  label: string,\n  code: RelayErrorCode,\n): string {\n  if (typeof value !== \"string\" || value.length < 1 || value.length > maximum) {\n    return relayFailure(code, `${label} must be a bounded non-empty string`);\n  }\n  // Control characters would corrupt logs and downstream headers.\n  for (let index = 0; index < value.length; index += 1) {\n    const unit = value.charCodeAt(index);\n    if (unit < 0x20 || unit === 0x7f) {\n      return relayFailure(code, `${label} must not contain control characters`);\n    }\n  }\n  return value;\n}\n\nexport function canonicalIdentifier(value: unknown, label: string, code: RelayErrorCode): string {\n  const text = boundedText(value, RELAY_LIMITS.identifier, label, code);\n  if (!/^[A-Za-z0-9._~-]+$/u.test(text)) {\n    return relayFailure(code, `${label} must be URL-safe`);\n  }\n  return text;\n}\n\nexport function timestamp(value: unknown, label: string, code: RelayErrorCode): number {\n  if (\n    typeof value !== \"number\" ||\n    !Number.isSafeInteger(value) ||\n    Object.is(value, -0) ||\n    value < 0 ||\n    value > MAX_TIMESTAMP\n  ) {\n    return relayFailure(code, `${label} must be a non-negative safe integer`);\n  }\n  return value;\n}\n\nfunction nullableTimestamp(value: unknown, label: string, code: RelayErrorCode): number | null {\n  return value === null ? null : timestamp(value, label, code);\n}\n\nconst UNREADABLE: RelayErrorCode = \"relay_record_unreadable\";\n\nfunction captured(value: unknown, keys: readonly string[], label: string): Record<string, unknown> {\n  const context: CaptureContext = new WeakSet();\n  return exactRecord(value, keys, label, context, (message) => relayFailure(UNREADABLE, message));\n}\n\nfunction version<Value extends string>(value: unknown, expected: Value, label: string): Value {\n  if (value !== expected) {\n    return relayFailure(UNREADABLE, `${label} version is unsupported`);\n  }\n  return expected;\n}\n\nexport function parseCapabilityInvalidationRecord(value: unknown): CapabilityInvalidationRecord {\n  const record = captured(\n    value,\n    [\"version\", \"grantId\", \"clientId\", \"capabilityHash\", \"invalidatedAt\"],\n    \"capability invalidation record\",\n  );\n  const capabilityHash = boundedText(record.capabilityHash, 66, \"capabilityHash\", UNREADABLE);\n  if (!/^0x[0-9a-f]{64}$/u.test(capabilityHash)) {\n    return relayFailure(UNREADABLE, \"capabilityHash must be a lowercase 32-byte hash\");\n  }\n  return Object.freeze({\n    version: version(\n      record.version,\n      OAATH_CAPABILITY_INVALIDATION_RECORD_VERSION,\n      \"capability invalidation record\",\n    ),\n    grantId: canonicalIdentifier(record.grantId, \"grantId\", UNREADABLE),\n    clientId: canonicalIdentifier(record.clientId, \"clientId\", UNREADABLE),\n    capabilityHash,\n    invalidatedAt: timestamp(record.invalidatedAt, \"invalidatedAt\", UNREADABLE),\n  });\n}\n\nexport function parseAuthorizationRequestRecord(value: unknown): AuthorizationRequestRecord {\n  const record = captured(\n    value,\n    [\n      \"version\",\n      \"requestId\",\n      \"clientId\",\n      \"subject\",\n      \"ownerDeviceId\",\n      \"ownerSubject\",\n      \"organizationAudience\",\n      \"redirectUri\",\n      \"codeChallenge\",\n      \"requestedScope\",\n      \"createdAt\",\n      \"expiresAt\",\n    ],\n    \"authorization request record\",\n  );\n  return Object.freeze({\n    version: version(\n      record.version,\n      OAATH_AUTHORIZATION_REQUEST_RECORD_VERSION,\n      \"authorization request record\",\n    ),\n    requestId: canonicalIdentifier(record.requestId, \"requestId\", UNREADABLE),\n    clientId: canonicalIdentifier(record.clientId, \"clientId\", UNREADABLE),\n    subject: canonicalIdentifier(record.subject, \"subject\", UNREADABLE),\n    ownerDeviceId: canonicalIdentifier(record.ownerDeviceId, \"ownerDeviceId\", UNREADABLE),\n    ownerSubject: canonicalIdentifier(record.ownerSubject, \"ownerSubject\", UNREADABLE),\n    organizationAudience:\n      record.organizationAudience === null\n        ? null\n        : canonicalIdentifier(record.organizationAudience, \"organizationAudience\", UNREADABLE),\n    redirectUri: boundedText(\n      record.redirectUri,\n      RELAY_LIMITS.redirectUri,\n      \"redirectUri\",\n      UNREADABLE,\n    ),\n    codeChallenge: canonicalIdentifier(record.codeChallenge, \"codeChallenge\", UNREADABLE),\n    requestedScope: boundedText(\n      record.requestedScope,\n      RELAY_LIMITS.requestedScope,\n      \"requestedScope\",\n      UNREADABLE,\n    ),\n    createdAt: timestamp(record.createdAt, \"createdAt\", UNREADABLE),\n    expiresAt: timestamp(record.expiresAt, \"expiresAt\", UNREADABLE),\n  });\n}\n\nexport function parseAuthorizationDecisionRecord(value: unknown): AuthorizationDecisionRecord {\n  const record = captured(\n    value,\n    [\"version\", \"requestId\", \"outcome\", \"decidedAt\", \"codeRef\", \"codeExpiresAt\"],\n    \"authorization decision record\",\n  );\n  if (record.outcome !== \"approved\" && record.outcome !== \"rejected\") {\n    return relayFailure(UNREADABLE, \"decision outcome is unsupported\");\n  }\n  // The sealed code exists exactly when a code was released: an approval with\n  // no pickup copy or a rejection carrying one is an unreadable record.\n  if ((record.outcome === \"approved\") !== (record.codeRef !== null)) {\n    return relayFailure(UNREADABLE, \"decision code reference does not match the outcome\");\n  }\n  if ((record.codeRef === null) !== (record.codeExpiresAt === null)) {\n    return relayFailure(UNREADABLE, \"decision code expiry does not match its reference\");\n  }\n  return Object.freeze({\n    version: version(\n      record.version,\n      OAATH_AUTHORIZATION_DECISION_RECORD_VERSION,\n      \"authorization decision record\",\n    ),\n    requestId: canonicalIdentifier(record.requestId, \"requestId\", UNREADABLE),\n    outcome: record.outcome,\n    decidedAt: timestamp(record.decidedAt, \"decidedAt\", UNREADABLE),\n    codeRef:\n      record.codeRef === null\n        ? null\n        : boundedText(record.codeRef, RELAY_LIMITS.ciphertextRef, \"codeRef\", UNREADABLE),\n    codeExpiresAt:\n      record.codeExpiresAt === null\n        ? null\n        : timestamp(record.codeExpiresAt, \"codeExpiresAt\", UNREADABLE),\n  });\n}\n\nexport function parseAuthorizationCodeRecord(value: unknown): AuthorizationCodeRecord {\n  const record = captured(\n    value,\n    [\n      \"version\",\n      \"codeHash\",\n      \"requestId\",\n      \"clientId\",\n      \"redirectUri\",\n      \"codeChallenge\",\n      \"artifactId\",\n      \"createdAt\",\n      \"expiresAt\",\n      \"consumedAt\",\n    ],\n    \"authorization code record\",\n  );\n  return Object.freeze({\n    version: version(\n      record.version,\n      OAATH_AUTHORIZATION_CODE_RECORD_VERSION,\n      \"authorization code record\",\n    ),\n    codeHash: canonicalIdentifier(record.codeHash, \"codeHash\", UNREADABLE),\n    requestId: canonicalIdentifier(record.requestId, \"requestId\", UNREADABLE),\n    clientId: canonicalIdentifier(record.clientId, \"clientId\", UNREADABLE),\n    redirectUri: boundedText(\n      record.redirectUri,\n      RELAY_LIMITS.redirectUri,\n      \"redirectUri\",\n      UNREADABLE,\n    ),\n    codeChallenge: canonicalIdentifier(record.codeChallenge, \"codeChallenge\", UNREADABLE),\n    artifactId: canonicalIdentifier(record.artifactId, \"artifactId\", UNREADABLE),\n    createdAt: timestamp(record.createdAt, \"createdAt\", UNREADABLE),\n    expiresAt: timestamp(record.expiresAt, \"expiresAt\", UNREADABLE),\n    consumedAt: nullableTimestamp(record.consumedAt, \"consumedAt\", UNREADABLE),\n  });\n}\n\nexport function parseEncryptedArtifactRecord(value: unknown): EncryptedArtifactRecord {\n  const record = captured(\n    value,\n    [\"version\", \"artifactId\", \"requestId\", \"clientId\", \"ciphertextRef\", \"createdAt\", \"claimedAt\"],\n    \"encrypted artifact record\",\n  );\n  return Object.freeze({\n    version: version(\n      record.version,\n      OAATH_ENCRYPTED_ARTIFACT_RECORD_VERSION,\n      \"encrypted artifact record\",\n    ),\n    artifactId: canonicalIdentifier(record.artifactId, \"artifactId\", UNREADABLE),\n    requestId: canonicalIdentifier(record.requestId, \"requestId\", UNREADABLE),\n    clientId: canonicalIdentifier(record.clientId, \"clientId\", UNREADABLE),\n    ciphertextRef: boundedText(\n      record.ciphertextRef,\n      RELAY_LIMITS.ciphertextRef,\n      \"ciphertextRef\",\n      UNREADABLE,\n    ),\n    createdAt: timestamp(record.createdAt, \"createdAt\", UNREADABLE),\n    claimedAt: nullableTimestamp(record.claimedAt, \"claimedAt\", UNREADABLE),\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;AA8EA,MAAa,qBAA+D,OAAO,OAAO;CACxF,uBAAuB;CACvB,uBAAuB;CACvB,iBAAiB;CACjB,iBAAiB;CACjB,0BAA0B;CAC1B,eAAe;CACf,uBAAuB;CACvB,6BAA6B;CAC7B,gCAAgC;CAChC,oBAAoB;CACpB,oBAAoB;CACpB,yBAAyB;CACzB,uBAAuB;CACvB,yBAAyB;CACzB,uBAAuB;CAGvB,8BAA8B;CAC9B,gCAAgC;CAChC,yBAAyB;CACzB,8BAA8B;CAC9B,gBAAgB;AAClB,CAAC;AAED,IAAa,kBAAb,cAAqC,MAAM;CACzC;CACA;CACA;CAEA,YACE,MACA,SACA,aAAuD,MACvD,mBAAsD,MACtD,SACA;EACA,MAAM,SAAS,OAAO;EACtB,KAAK,OAAO;EACZ,KAAK,OAAO;EACZ,KAAK,aAAa,+BAA+B,UAAU;EAC3D,KAAK,mBACH,SAAS,4BAA4B,wBAAwB,gBAAgB,IAAI;CACrF;AACF;AAEA,SAAgB,aACd,MACA,SACA,aAAuD,MACvD,mBAAsD,MACtD,SACO;CACP,MAAM,IAAI,gBAAgB,MAAM,SAAS,YAAY,kBAAkB,OAAO;AAChF;;AAGA,SAAgB,eAAe,OAAgC;CAC7D,OAAO,iBAAiB,kBAAkB,MAAM,OAAO;AACzD;AAEA,MAAM,mBAAqD,OAAO,OAAO;CACvE,gBAAgB;CAChB,iBAAiB;AACnB,CAAC;AAED,SAAgB,mBACd,MACA,aAAuD,MACvD,mBAAsD,MACtD,OACU;CACV,MAAM,UAAU,SAAS,4BAA4B,8BAA8B,KAAK,IAAI;CAC5F,MAAM,WACJ,SAAS,4BAA4B,+BAA+B,UAAU,IAAI;CACpF,MAAM,YACJ,SAAS,4BAA4B,wBAAwB,gBAAgB,IAAI;CACnF,OAAO,aAAa,mBAAmB,OAAO,EAC5C,OAAO;EACL;EACA,GAAI,aAAa,OAAO,CAAC,IAAI,EAAE,YAAY,SAAS;EACpD,GAAI,cAAc,OAAO,CAAC,IAAI,EAAE,kBAAkB,UAAU;EAC5D,GAAI,YAAY,OAAO,CAAC,IAAI,EAAE,QAAQ;CACxC,EACF,CAAC;AACH;AAEA,SAAgB,aAAa,QAAgB,MAAyB;CACpE,OAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;EAAE;EAAQ,SAAS;CAAiB,CAAC;AACjF;;;;;;;;;;;;;;;;;;;ACnJA,MAAa,6CACX;AACF,MAAa,8CACX;AACF,MAAa,0CACX;AACF,MAAa,0CACX;AACF,MAAa,+CACX;;AAGF,MAAa,eAAe,OAAO,OAAO;CACxC,YAAY;CACZ,aAAa;CACb,eAAe;CACf,cAAc;CACd,gBAAgB;CAChB,mBAAmB;CACnB,eAAe;AACjB,CAAC;AAED,MAAM,gBAAgB,OAAO;AAgG7B,SAAgB,YACd,OACA,SACA,OACA,MACQ;CACR,IAAI,OAAO,UAAU,YAAY,MAAM,SAAS,KAAK,MAAM,SAAS,SAClE,OAAO,aAAa,MAAM,GAAG,MAAM,oCAAoC;CAGzE,KAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;EACpD,MAAM,OAAO,MAAM,WAAW,KAAK;EACnC,IAAI,OAAO,MAAQ,SAAS,KAC1B,OAAO,aAAa,MAAM,GAAG,MAAM,qCAAqC;CAE5E;CACA,OAAO;AACT;AAEA,SAAgB,oBAAoB,OAAgB,OAAe,MAA8B;CAC/F,MAAM,OAAO,YAAY,OAAO,aAAa,YAAY,OAAO,IAAI;CACpE,IAAI,CAAC,sBAAsB,KAAK,IAAI,GAClC,OAAO,aAAa,MAAM,GAAG,MAAM,kBAAkB;CAEvD,OAAO;AACT;AAEA,SAAgB,UAAU,OAAgB,OAAe,MAA8B;CACrF,IACE,OAAO,UAAU,YACjB,CAAC,OAAO,cAAc,KAAK,KAC3B,OAAO,GAAG,OAAO,EAAE,KACnB,QAAQ,KACR,QAAQ,eAER,OAAO,aAAa,MAAM,GAAG,MAAM,qCAAqC;CAE1E,OAAO;AACT;AAEA,SAAS,kBAAkB,OAAgB,OAAe,MAAqC;CAC7F,OAAO,UAAU,OAAO,OAAO,UAAU,OAAO,OAAO,IAAI;AAC7D;AAEA,MAAM,aAA6B;AAEnC,SAAS,SAAS,OAAgB,MAAyB,OAAwC;CAEjG,OAAO,YAAY,OAAO,MAAM,uBAAO,IADH,QACS,IAAI,YAAY,aAAa,YAAY,OAAO,CAAC;AAChG;AAEA,SAAS,QAA8B,OAAgB,UAAiB,OAAsB;CAC5F,IAAI,UAAU,UACZ,OAAO,aAAa,YAAY,GAAG,MAAM,wBAAwB;CAEnE,OAAO;AACT;AAEA,SAAgB,kCAAkC,OAA8C;CAC9F,MAAM,SAAS,SACb,OACA;EAAC;EAAW;EAAW;EAAY;EAAkB;CAAe,GACpE,gCACF;CACA,MAAM,iBAAiB,YAAY,OAAO,gBAAgB,IAAI,kBAAkB,UAAU;CAC1F,IAAI,CAAC,oBAAoB,KAAK,cAAc,GAC1C,OAAO,aAAa,YAAY,iDAAiD;CAEnF,OAAO,OAAO,OAAO;EACnB,SAAS,QACP,OAAO,SACP,8CACA,gCACF;EACA,SAAS,oBAAoB,OAAO,SAAS,WAAW,UAAU;EAClE,UAAU,oBAAoB,OAAO,UAAU,YAAY,UAAU;EACrE;EACA,eAAe,UAAU,OAAO,eAAe,iBAAiB,UAAU;CAC5E,CAAC;AACH;AAEA,SAAgB,gCAAgC,OAA4C;CAC1F,MAAM,SAAS,SACb,OACA;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,GACA,8BACF;CACA,OAAO,OAAO,OAAO;EACnB,SAAS,QACP,OAAO,SACP,4CACA,8BACF;EACA,WAAW,oBAAoB,OAAO,WAAW,aAAa,UAAU;EACxE,UAAU,oBAAoB,OAAO,UAAU,YAAY,UAAU;EACrE,SAAS,oBAAoB,OAAO,SAAS,WAAW,UAAU;EAClE,eAAe,oBAAoB,OAAO,eAAe,iBAAiB,UAAU;EACpF,cAAc,oBAAoB,OAAO,cAAc,gBAAgB,UAAU;EACjF,sBACE,OAAO,yBAAyB,OAC5B,OACA,oBAAoB,OAAO,sBAAsB,wBAAwB,UAAU;EACzF,aAAa,YACX,OAAO,aACP,aAAa,aACb,eACA,UACF;EACA,eAAe,oBAAoB,OAAO,eAAe,iBAAiB,UAAU;EACpF,gBAAgB,YACd,OAAO,gBACP,aAAa,gBACb,kBACA,UACF;EACA,WAAW,UAAU,OAAO,WAAW,aAAa,UAAU;EAC9D,WAAW,UAAU,OAAO,WAAW,aAAa,UAAU;CAChE,CAAC;AACH;AAEA,SAAgB,iCAAiC,OAA6C;CAC5F,MAAM,SAAS,SACb,OACA;EAAC;EAAW;EAAa;EAAW;EAAa;EAAW;CAAe,GAC3E,+BACF;CACA,IAAI,OAAO,YAAY,cAAc,OAAO,YAAY,YACtD,OAAO,aAAa,YAAY,iCAAiC;CAInE,IAAK,OAAO,YAAY,gBAAiB,OAAO,YAAY,OAC1D,OAAO,aAAa,YAAY,oDAAoD;CAEtF,IAAK,OAAO,YAAY,UAAW,OAAO,kBAAkB,OAC1D,OAAO,aAAa,YAAY,mDAAmD;CAErF,OAAO,OAAO,OAAO;EACnB,SAAS,QACP,OAAO,SACP,6CACA,+BACF;EACA,WAAW,oBAAoB,OAAO,WAAW,aAAa,UAAU;EACxE,SAAS,OAAO;EAChB,WAAW,UAAU,OAAO,WAAW,aAAa,UAAU;EAC9D,SACE,OAAO,YAAY,OACf,OACA,YAAY,OAAO,SAAS,aAAa,eAAe,WAAW,UAAU;EACnF,eACE,OAAO,kBAAkB,OACrB,OACA,UAAU,OAAO,eAAe,iBAAiB,UAAU;CACnE,CAAC;AACH;AAEA,SAAgB,6BAA6B,OAAyC;CACpF,MAAM,SAAS,SACb,OACA;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,GACA,2BACF;CACA,OAAO,OAAO,OAAO;EACnB,SAAS,QACP,OAAO,SACP,yCACA,2BACF;EACA,UAAU,oBAAoB,OAAO,UAAU,YAAY,UAAU;EACrE,WAAW,oBAAoB,OAAO,WAAW,aAAa,UAAU;EACxE,UAAU,oBAAoB,OAAO,UAAU,YAAY,UAAU;EACrE,aAAa,YACX,OAAO,aACP,aAAa,aACb,eACA,UACF;EACA,eAAe,oBAAoB,OAAO,eAAe,iBAAiB,UAAU;EACpF,YAAY,oBAAoB,OAAO,YAAY,cAAc,UAAU;EAC3E,WAAW,UAAU,OAAO,WAAW,aAAa,UAAU;EAC9D,WAAW,UAAU,OAAO,WAAW,aAAa,UAAU;EAC9D,YAAY,kBAAkB,OAAO,YAAY,cAAc,UAAU;CAC3E,CAAC;AACH;AAEA,SAAgB,6BAA6B,OAAyC;CACpF,MAAM,SAAS,SACb,OACA;EAAC;EAAW;EAAc;EAAa;EAAY;EAAiB;EAAa;CAAW,GAC5F,2BACF;CACA,OAAO,OAAO,OAAO;EACnB,SAAS,QACP,OAAO,SACP,yCACA,2BACF;EACA,YAAY,oBAAoB,OAAO,YAAY,cAAc,UAAU;EAC3E,WAAW,oBAAoB,OAAO,WAAW,aAAa,UAAU;EACxE,UAAU,oBAAoB,OAAO,UAAU,YAAY,UAAU;EACrE,eAAe,YACb,OAAO,eACP,aAAa,eACb,iBACA,UACF;EACA,WAAW,UAAU,OAAO,WAAW,aAAa,UAAU;EAC9D,WAAW,kBAAkB,OAAO,WAAW,aAAa,UAAU;CACxE,CAAC;AACH"}

package/dist/{records-BUvqmp0D.js → records-lPGo4RxO.js}

@@ -1,4 +1,4 @@
-import { b as relayFailure, c as canonicalIdentifier, m as timestamp, o as RELAY_LIMITS, s as boundedText } from "./records-BQNDxbPg.js";
+import { b as relayFailure, c as canonicalIdentifier, m as timestamp, o as RELAY_LIMITS, s as boundedText } from "./records-Bh8rOpBa.js";
 import { exactRecord, parseKernelRevocationSigningRequest } from "@oaath/protocol";
 //#region src/revocation/records.ts
 /** Current immutable revocation request and terminal phone decision. No submission evidence. */
@@ -67,4 +67,4 @@ function parseRevocationDecisionRecord(value) {
 //#endregion
 export { parseRevocationRequestRecord as a, parseRevocationDecisionRecord as i, OAATH_REVOCATION_REQUEST_RECORD_VERSION as n, REVOCATION_OPERATION_PREFIX as r, OAATH_REVOCATION_DECISION_RECORD_VERSION as t };
 
-//# sourceMappingURL=records-BUvqmp0D.js.map
+//# sourceMappingURL=records-lPGo4RxO.js.map

package/dist/{records-BUvqmp0D.js.map → records-lPGo4RxO.js.map}

@@ -1 +1 @@
-{"version":3,"file":"records-BUvqmp0D.js","names":[],"sources":["../src/revocation/records.ts"],"sourcesContent":["/** Current immutable revocation request and terminal phone decision. No submission evidence. */\nimport {\n  exactRecord,\n  type KernelRevocationSigningRequest,\n  parseKernelRevocationSigningRequest,\n} from \"@oaath/protocol\";\nimport { relayFailure } from \"../relay/errors.js\";\nimport { boundedText, canonicalIdentifier, RELAY_LIMITS, timestamp } from \"../store/records.js\";\n\nexport const OAATH_REVOCATION_REQUEST_RECORD_VERSION =\n  \"oaath.revocation-request-record/v1\" as const;\nexport const OAATH_REVOCATION_DECISION_RECORD_VERSION =\n  \"oaath.revocation-decision-record/v1\" as const;\n/** Separates owner operations from authorization request IDs on the shared phone route. */\nexport const REVOCATION_OPERATION_PREFIX = \"revocation-\";\n\nexport interface RevocationRequestRecord {\n  readonly version: typeof OAATH_REVOCATION_REQUEST_RECORD_VERSION;\n  readonly operationId: string;\n  readonly ownerDeviceId: string;\n  readonly ownerSubject: string;\n  readonly createdAt: number;\n  readonly expiresAt: number;\n  readonly signingRequest: Readonly<KernelRevocationSigningRequest>;\n}\nexport interface RevocationDecisionRecord {\n  readonly version: typeof OAATH_REVOCATION_DECISION_RECORD_VERSION;\n  readonly operationId: string;\n  readonly outcome: \"approved\" | \"rejected\";\n  readonly decidedAt: number;\n  /** Sealed canonical phone artifact; null exactly for rejection. Never an OAuth release. */\n  readonly artifactRef: string | null;\n}\nconst UNREADABLE = \"relay_record_unreadable\" as const;\nconst fail = (message: string): never => relayFailure(UNREADABLE, message);\nfunction capture(value: unknown, keys: readonly string[]): Record<string, unknown> {\n  return exactRecord(value, keys, \"revocation record\", new WeakSet(), fail);\n}\nfunction operationId(value: unknown): string {\n  const id = canonicalIdentifier(value, \"operationId\", UNREADABLE);\n  if (!id.startsWith(REVOCATION_OPERATION_PREFIX) || id.length > 64)\n    return fail(\"revocation operation ID is invalid\");\n  return id;\n}\nexport function parseRevocationRequestRecord(value: unknown): Readonly<RevocationRequestRecord> {\n  const record = capture(value, [\n    \"version\",\n    \"operationId\",\n    \"ownerDeviceId\",\n    \"ownerSubject\",\n    \"createdAt\",\n    \"expiresAt\",\n    \"signingRequest\",\n  ]);\n  if (record.version !== OAATH_REVOCATION_REQUEST_RECORD_VERSION)\n    return fail(\"revocation request version is unsupported\");\n  const createdAt = timestamp(record.createdAt, \"createdAt\", UNREADABLE);\n  const expiresAt = timestamp(record.expiresAt, \"expiresAt\", UNREADABLE);\n  if (expiresAt < createdAt) return fail(\"revocation request expiry precedes creation\");\n  let signingRequest: Readonly<KernelRevocationSigningRequest>;\n  try {\n    signingRequest = parseKernelRevocationSigningRequest(record.signingRequest);\n  } catch {\n    return fail(\"stored revocation signing request is unreadable\");\n  }\n  return Object.freeze({\n    version: record.version,\n    operationId: operationId(record.operationId),\n    ownerDeviceId: canonicalIdentifier(record.ownerDeviceId, \"ownerDeviceId\", UNREADABLE),\n    ownerSubject: canonicalIdentifier(record.ownerSubject, \"ownerSubject\", UNREADABLE),\n    createdAt,\n    expiresAt,\n    signingRequest,\n  });\n}\nexport function parseRevocationDecisionRecord(value: unknown): Readonly<RevocationDecisionRecord> {\n  const record = capture(value, [\"version\", \"operationId\", \"outcome\", \"decidedAt\", \"artifactRef\"]);\n  if (\n    record.version !== OAATH_REVOCATION_DECISION_RECORD_VERSION ||\n    (record.outcome !== \"approved\" && record.outcome !== \"rejected\")\n  )\n    return fail(\"revocation decision is unsupported\");\n  if ((record.outcome === \"rejected\") !== (record.artifactRef === null))\n    return fail(\"revocation decision contradicts artifact custody\");\n  return Object.freeze({\n    version: record.version,\n    operationId: operationId(record.operationId),\n    outcome: record.outcome,\n    decidedAt: timestamp(record.decidedAt, \"decidedAt\", UNREADABLE),\n    artifactRef:\n      record.artifactRef === null\n        ? null\n        : boundedText(record.artifactRef, RELAY_LIMITS.ciphertextRef, \"artifactRef\", UNREADABLE),\n  });\n}\n"],"mappings":";;;;AASA,MAAa,0CACX;AACF,MAAa,2CACX;;AAEF,MAAa,8BAA8B;AAmB3C,MAAM,aAAa;AACnB,MAAM,QAAQ,YAA2B,aAAa,YAAY,OAAO;AACzE,SAAS,QAAQ,OAAgB,MAAkD;CACjF,OAAO,YAAY,OAAO,MAAM,qCAAqB,IAAI,QAAQ,GAAG,IAAI;AAC1E;AACA,SAAS,YAAY,OAAwB;CAC3C,MAAM,KAAK,oBAAoB,OAAO,eAAe,UAAU;CAC/D,IAAI,CAAC,GAAG,WAAA,aAAsC,KAAK,GAAG,SAAS,IAC7D,OAAO,KAAK,oCAAoC;CAClD,OAAO;AACT;AACA,SAAgB,6BAA6B,OAAmD;CAC9F,MAAM,SAAS,QAAQ,OAAO;EAC5B;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC;CACD,IAAI,OAAO,YAAA,sCACT,OAAO,KAAK,2CAA2C;CACzD,MAAM,YAAY,UAAU,OAAO,WAAW,aAAa,UAAU;CACrE,MAAM,YAAY,UAAU,OAAO,WAAW,aAAa,UAAU;CACrE,IAAI,YAAY,WAAW,OAAO,KAAK,6CAA6C;CACpF,IAAI;CACJ,IAAI;EACF,iBAAiB,oCAAoC,OAAO,cAAc;CAC5E,QAAQ;EACN,OAAO,KAAK,iDAAiD;CAC/D;CACA,OAAO,OAAO,OAAO;EACnB,SAAS,OAAO;EAChB,aAAa,YAAY,OAAO,WAAW;EAC3C,eAAe,oBAAoB,OAAO,eAAe,iBAAiB,UAAU;EACpF,cAAc,oBAAoB,OAAO,cAAc,gBAAgB,UAAU;EACjF;EACA;EACA;CACF,CAAC;AACH;AACA,SAAgB,8BAA8B,OAAoD;CAChG,MAAM,SAAS,QAAQ,OAAO;EAAC;EAAW;EAAe;EAAW;EAAa;CAAa,CAAC;CAC/F,IACE,OAAO,YAAA,yCACN,OAAO,YAAY,cAAc,OAAO,YAAY,YAErD,OAAO,KAAK,oCAAoC;CAClD,IAAK,OAAO,YAAY,gBAAiB,OAAO,gBAAgB,OAC9D,OAAO,KAAK,kDAAkD;CAChE,OAAO,OAAO,OAAO;EACnB,SAAS,OAAO;EAChB,aAAa,YAAY,OAAO,WAAW;EAC3C,SAAS,OAAO;EAChB,WAAW,UAAU,OAAO,WAAW,aAAa,UAAU;EAC9D,aACE,OAAO,gBAAgB,OACnB,OACA,YAAY,OAAO,aAAa,aAAa,eAAe,eAAe,UAAU;CAC7F,CAAC;AACH"}
+{"version":3,"file":"records-lPGo4RxO.js","names":[],"sources":["../src/revocation/records.ts"],"sourcesContent":["/** Current immutable revocation request and terminal phone decision. No submission evidence. */\nimport {\n  exactRecord,\n  type KernelRevocationSigningRequest,\n  parseKernelRevocationSigningRequest,\n} from \"@oaath/protocol\";\nimport { relayFailure } from \"../relay/errors.js\";\nimport { boundedText, canonicalIdentifier, RELAY_LIMITS, timestamp } from \"../store/records.js\";\n\nexport const OAATH_REVOCATION_REQUEST_RECORD_VERSION =\n  \"oaath.revocation-request-record/v1\" as const;\nexport const OAATH_REVOCATION_DECISION_RECORD_VERSION =\n  \"oaath.revocation-decision-record/v1\" as const;\n/** Separates owner operations from authorization request IDs on the shared phone route. */\nexport const REVOCATION_OPERATION_PREFIX = \"revocation-\";\n\nexport interface RevocationRequestRecord {\n  readonly version: typeof OAATH_REVOCATION_REQUEST_RECORD_VERSION;\n  readonly operationId: string;\n  readonly ownerDeviceId: string;\n  readonly ownerSubject: string;\n  readonly createdAt: number;\n  readonly expiresAt: number;\n  readonly signingRequest: Readonly<KernelRevocationSigningRequest>;\n}\nexport interface RevocationDecisionRecord {\n  readonly version: typeof OAATH_REVOCATION_DECISION_RECORD_VERSION;\n  readonly operationId: string;\n  readonly outcome: \"approved\" | \"rejected\";\n  readonly decidedAt: number;\n  /** Sealed canonical phone artifact; null exactly for rejection. Never an OAuth release. */\n  readonly artifactRef: string | null;\n}\nconst UNREADABLE = \"relay_record_unreadable\" as const;\nconst fail = (message: string): never => relayFailure(UNREADABLE, message);\nfunction capture(value: unknown, keys: readonly string[]): Record<string, unknown> {\n  return exactRecord(value, keys, \"revocation record\", new WeakSet(), fail);\n}\nfunction operationId(value: unknown): string {\n  const id = canonicalIdentifier(value, \"operationId\", UNREADABLE);\n  if (!id.startsWith(REVOCATION_OPERATION_PREFIX) || id.length > 64)\n    return fail(\"revocation operation ID is invalid\");\n  return id;\n}\nexport function parseRevocationRequestRecord(value: unknown): Readonly<RevocationRequestRecord> {\n  const record = capture(value, [\n    \"version\",\n    \"operationId\",\n    \"ownerDeviceId\",\n    \"ownerSubject\",\n    \"createdAt\",\n    \"expiresAt\",\n    \"signingRequest\",\n  ]);\n  if (record.version !== OAATH_REVOCATION_REQUEST_RECORD_VERSION)\n    return fail(\"revocation request version is unsupported\");\n  const createdAt = timestamp(record.createdAt, \"createdAt\", UNREADABLE);\n  const expiresAt = timestamp(record.expiresAt, \"expiresAt\", UNREADABLE);\n  if (expiresAt < createdAt) return fail(\"revocation request expiry precedes creation\");\n  let signingRequest: Readonly<KernelRevocationSigningRequest>;\n  try {\n    signingRequest = parseKernelRevocationSigningRequest(record.signingRequest);\n  } catch {\n    return fail(\"stored revocation signing request is unreadable\");\n  }\n  return Object.freeze({\n    version: record.version,\n    operationId: operationId(record.operationId),\n    ownerDeviceId: canonicalIdentifier(record.ownerDeviceId, \"ownerDeviceId\", UNREADABLE),\n    ownerSubject: canonicalIdentifier(record.ownerSubject, \"ownerSubject\", UNREADABLE),\n    createdAt,\n    expiresAt,\n    signingRequest,\n  });\n}\nexport function parseRevocationDecisionRecord(value: unknown): Readonly<RevocationDecisionRecord> {\n  const record = capture(value, [\"version\", \"operationId\", \"outcome\", \"decidedAt\", \"artifactRef\"]);\n  if (\n    record.version !== OAATH_REVOCATION_DECISION_RECORD_VERSION ||\n    (record.outcome !== \"approved\" && record.outcome !== \"rejected\")\n  )\n    return fail(\"revocation decision is unsupported\");\n  if ((record.outcome === \"rejected\") !== (record.artifactRef === null))\n    return fail(\"revocation decision contradicts artifact custody\");\n  return Object.freeze({\n    version: record.version,\n    operationId: operationId(record.operationId),\n    outcome: record.outcome,\n    decidedAt: timestamp(record.decidedAt, \"decidedAt\", UNREADABLE),\n    artifactRef:\n      record.artifactRef === null\n        ? null\n        : boundedText(record.artifactRef, RELAY_LIMITS.ciphertextRef, \"artifactRef\", UNREADABLE),\n  });\n}\n"],"mappings":";;;;AASA,MAAa,0CACX;AACF,MAAa,2CACX;;AAEF,MAAa,8BAA8B;AAmB3C,MAAM,aAAa;AACnB,MAAM,QAAQ,YAA2B,aAAa,YAAY,OAAO;AACzE,SAAS,QAAQ,OAAgB,MAAkD;CACjF,OAAO,YAAY,OAAO,MAAM,qCAAqB,IAAI,QAAQ,GAAG,IAAI;AAC1E;AACA,SAAS,YAAY,OAAwB;CAC3C,MAAM,KAAK,oBAAoB,OAAO,eAAe,UAAU;CAC/D,IAAI,CAAC,GAAG,WAAA,aAAsC,KAAK,GAAG,SAAS,IAC7D,OAAO,KAAK,oCAAoC;CAClD,OAAO;AACT;AACA,SAAgB,6BAA6B,OAAmD;CAC9F,MAAM,SAAS,QAAQ,OAAO;EAC5B;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC;CACD,IAAI,OAAO,YAAA,sCACT,OAAO,KAAK,2CAA2C;CACzD,MAAM,YAAY,UAAU,OAAO,WAAW,aAAa,UAAU;CACrE,MAAM,YAAY,UAAU,OAAO,WAAW,aAAa,UAAU;CACrE,IAAI,YAAY,WAAW,OAAO,KAAK,6CAA6C;CACpF,IAAI;CACJ,IAAI;EACF,iBAAiB,oCAAoC,OAAO,cAAc;CAC5E,QAAQ;EACN,OAAO,KAAK,iDAAiD;CAC/D;CACA,OAAO,OAAO,OAAO;EACnB,SAAS,OAAO;EAChB,aAAa,YAAY,OAAO,WAAW;EAC3C,eAAe,oBAAoB,OAAO,eAAe,iBAAiB,UAAU;EACpF,cAAc,oBAAoB,OAAO,cAAc,gBAAgB,UAAU;EACjF;EACA;EACA;CACF,CAAC;AACH;AACA,SAAgB,8BAA8B,OAAoD;CAChG,MAAM,SAAS,QAAQ,OAAO;EAAC;EAAW;EAAe;EAAW;EAAa;CAAa,CAAC;CAC/F,IACE,OAAO,YAAA,yCACN,OAAO,YAAY,cAAc,OAAO,YAAY,YAErD,OAAO,KAAK,oCAAoC;CAClD,IAAK,OAAO,YAAY,gBAAiB,OAAO,gBAAgB,OAC9D,OAAO,KAAK,kDAAkD;CAChE,OAAO,OAAO,OAAO;EACnB,SAAS,OAAO;EAChB,aAAa,YAAY,OAAO,WAAW;EAC3C,SAAS,OAAO;EAChB,WAAW,UAAU,OAAO,WAAW,aAAa,UAAU;EAC9D,aACE,OAAO,gBAAgB,OACnB,OACA,YAAY,OAAO,aAAa,aAAa,eAAe,eAAe,UAAU;CAC7F,CAAC;AACH"}

package/dist/{service-Cf4f-9KP.js → service-DT0vkKop.js}

@@ -1,6 +1,6 @@
-import { b as relayFailure, c as canonicalIdentifier, m as timestamp, o as RELAY_LIMITS, r as OAATH_AUTHORIZATION_REQUEST_RECORD_VERSION, s as boundedText } from "./records-BQNDxbPg.js";
-import { a as relayNow, n as randomIdentifier, r as sha256Base64Url, t as isCodeChallengeS256 } from "./challenge-DmpGSogj.js";
-import { n as OAATH_REVOCATION_REQUEST_RECORD_VERSION, r as REVOCATION_OPERATION_PREFIX, t as OAATH_REVOCATION_DECISION_RECORD_VERSION } from "./records-BUvqmp0D.js";
+import { b as relayFailure, c as canonicalIdentifier, m as timestamp, o as RELAY_LIMITS, r as OAATH_AUTHORIZATION_REQUEST_RECORD_VERSION, s as boundedText } from "./records-Bh8rOpBa.js";
+import { a as relayNow, n as randomIdentifier, r as sha256Base64Url, t as isCodeChallengeS256 } from "./challenge-WmeNbyox.js";
+import { n as OAATH_REVOCATION_REQUEST_RECORD_VERSION, r as REVOCATION_OPERATION_PREFIX, t as OAATH_REVOCATION_DECISION_RECORD_VERSION } from "./records-lPGo4RxO.js";
 import { applyPermissionDecision, captureRecord, createGrantFromPermissionRequest, exactRecord, hashKernelRevocationSigningRequest, hashOwnerSigningRequest, hashPermissionRequest, isKernelExistingAccountProfile, parseKernelReplayableInstallOwnerSigningRequest, parseKernelRevocationSigningRequest, parseOwnerSigningArtifact, parseOwnerSigningRequest, parsePermissionDecision, parsePermissionRequest, sameOwnerCredentialProfile, serializeOwnerSigningArtifact } from "@oaath/protocol";
 import { p256 } from "@noble/curves/nist.js";
 import { hexToBytes } from "@noble/hashes/utils.js";
@@ -703,4 +703,4 @@ async function submitOwnerPhoneRevocationDecision(input) {
 //#endregion
 export { withRelayTransaction as S, verifyKernelV4ReplayableInstallOwnerSigningArtifact as _, submitOwnerPhoneRevocationDecision as a, openArtifact as b, projectOwnerPhonePermissionSigning as c, classifyStoredAuthorizationScope as d, createAuthorizationRequest as f, ownerPhoneDisplayPayload as g, NATIVE_DISPLAY_PAYLOAD_LENGTH as h, requestOwnerPhoneRevocation as i, projectOwnerPhoneRequest as l, readAuthorizationState as m, fetchOwnerPhoneRevocation as n, projectOwnerPhoneRevocation as o, fetchAuthorizationRequest as p, readRevocationState as r, OAATH_NATIVE_PROJECTION_VERSION as s, fetchClientPhoneRevocation as t, prepareOwnerPhonePermissionApproval as u, parseApprovedPermission as v, sealArtifact as x, readApprovedPermission as y };
 
-//# sourceMappingURL=service-Cf4f-9KP.js.map
+//# sourceMappingURL=service-DT0vkKop.js.map