@orangecheck/me-client 0.27.2 → 0.27.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/README.md +1 -1
  2. package/dist/server.js +3 -3
  3. package/dist/server.js.map +1 -1
  4. package/dist/server.mjs +3 -3
  5. package/dist/server.mjs.map +1 -1
  6. package/package.json +1 -1
package/README.md CHANGED
@@ -59,7 +59,7 @@ export default withOcAuth(
59
59
 
60
60
  An account can pledge one coin it holds as backing (oc-attest-protocol `BOND.md`). The coin never moves and you never see it: the token carries only floors (`sats_floor`, `days_floor`) and a `nullifier` that is the same for that coin at your site and different everywhere else. Ban the nullifier and you've banned the coin until it moves, which restarts its age.
61
61
 
62
- Nobody needs a bond to sign in. To let in only backed accounts, set the floor in your project's settings ("who can sign in") and pass your project key:
62
+ Nobody needs a bond to sign in. To let in only backed accounts, set the floor in your project's settings ("who can sign in") and pass your project key. A change there is enforced within a minute:
63
63
 
64
64
  ```ts
65
65
  export default withOcAuth(handler, {
package/dist/server.js CHANGED
@@ -468,7 +468,7 @@ function base64UrlToString(s) {
468
468
  if (typeof atob === "function") return atob(b64 + "=".repeat((4 - b64.length % 4) % 4));
469
469
  return Buffer.from(s, "base64url").toString("utf8");
470
470
  }
471
- var POLICY_TTL_MS = 5 * 6e4;
471
+ var POLICY_TTL_MS = 6e4;
472
472
  var policies = /* @__PURE__ */ new Map();
473
473
  async function projectRequirement(options) {
474
474
  const key = options.projectKey;
@@ -476,12 +476,12 @@ async function projectRequirement(options) {
476
476
  if (hit && Date.now() - hit.at < POLICY_TTL_MS) return hit.need;
477
477
  try {
478
478
  const base = options.meOrigin ?? "https://me.ochk.io";
479
- const r = await fetch(`${base}/api/integrator/config?project_key=${encodeURIComponent(key)}`, {
479
+ const r = await fetch(`${base}/api/integrator/${encodeURIComponent(key)}/sign-in`, {
480
480
  signal: AbortSignal.timeout(4e3)
481
481
  });
482
482
  if (!r.ok) throw new Error(`HTTP ${r.status}`);
483
483
  const j = await r.json();
484
- const req = j.config?.require_bond ?? null;
484
+ const req = j.require_bond ?? null;
485
485
  const need = req ? { minSats: req.min_sats, minDays: req.min_days } : null;
486
486
  policies.set(key, { at: Date.now(), need });
487
487
  return need;
package/dist/server.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"sources":["../node_modules/jose/dist/webapi/lib/buffer_utils.js","../node_modules/jose/dist/webapi/lib/base64.js","../node_modules/jose/dist/webapi/util/base64url.js","../node_modules/jose/dist/webapi/util/errors.js","../node_modules/jose/dist/webapi/lib/type_checks.js","../node_modules/jose/dist/webapi/lib/jwk_to_key.js","../node_modules/jose/dist/webapi/key/import.js","../src/identity.ts","../src/server.ts"],"names":["getOcSessionCore","bondMeets","readBondClaim"],"mappings":";;;;;;;;;AAAuB,IAAI,WAAA;AACpB,IAAM,OAAA,GAAU,IAAI,WAAA,EAAY;;;ACUhC,SAAS,aAAa,OAAA,EAAS;AAClC,EAAA,IAAI,WAAW,UAAA,EAAY;AACvB,IAAA,OAAO,UAAA,CAAW,WAAW,OAAO,CAAA;AAAA,EACxC;AACA,EAAA,MAAM,MAAA,GAAS,KAAK,OAAO,CAAA;AAC3B,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,MAAA,CAAO,MAAM,CAAA;AAC1C,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,QAAQ,CAAA,EAAA,EAAK;AACpC,IAAA,KAAA,CAAM,CAAC,CAAA,GAAI,MAAA,CAAO,UAAA,CAAW,CAAC,CAAA;AAAA,EAClC;AACA,EAAA,OAAO,KAAA;AACX;;;ACnBO,SAAS,OAAO,KAAA,EAAO;AAC1B,EAAA,IAAI,WAAW,UAAA,EAAY;AACvB,IAAA,OAAO,UAAA,CAAW,WAAW,OAAO,KAAA,KAAU,WAAW,KAAA,GAAQ,OAAA,CAAQ,MAAA,CAAO,KAAK,CAAA,EAAG;AAAA,MACpF,QAAA,EAAU;AAAA,KACb,CAAA;AAAA,EACL;AACA,EAAA,IAAI,OAAA,GAAU,KAAA;AACd,EAAA,IAAI,mBAAmB,UAAA,EAAY;AAC/B,IAAA,OAAA,GAAU,OAAA,CAAQ,OAAO,OAAO,CAAA;AAAA,EACpC;AACA,EAAA,OAAA,GAAU,QAAQ,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AACtD,EAAA,IAAI;AACA,IAAA,OAAO,aAAa,OAAO,CAAA;AAAA,EAC/B,CAAA,CAAA,MACM;AACF,IAAA,MAAM,IAAI,UAAU,mDAAmD,CAAA;AAAA,EAC3E;AACJ;;;ACnBO,IAAM,SAAA,GAAN,cAAwB,KAAA,CAAM;AAAA,EAGjC,WAAA,CAAY,SAAS,OAAA,EAAS;AAC1B,IAAA,KAAA,CAAM,SAAS,OAAO,CAAA;AAF1B,IAAA,aAAA,CAAA,IAAA,EAAA,MAAA,EAAO,kBAAA,CAAA;AAGH,IAAA,IAAA,CAAK,IAAA,GAAO,KAAK,WAAA,CAAY,IAAA;AAC7B,IAAA,KAAA,CAAM,iBAAA,GAAoB,IAAA,EAAM,IAAA,CAAK,WAAW,CAAA;AAAA,EACpD;AACJ,CAAA;AAPI,aAAA,CADS,WACF,MAAA,EAAO,kBAAA,CAAA;AAsCX,IAAM,gBAAA,GAAN,cAA+B,SAAA,CAAU;AAAA,EAAzC,WAAA,GAAA;AAAA,IAAA,KAAA,CAAA,GAAA,SAAA,CAAA;AAEH,IAAA,aAAA,CAAA,IAAA,EAAA,MAAA,EAAO,wBAAA,CAAA;AAAA,EAAA;AACX,CAAA;AAFI,aAAA,CADS,kBACF,MAAA,EAAO,wBAAA,CAAA;AAxClB,IAAA,EAAA,EAAA,EAAA;AA6EO,IAAM,wBAAA,GAAN,eAAuC,EAAA,GAAA,SAAA,EACzC,EAAA,GAAA,MAAA,CAAO,eADkC,EAAA,EAAU;AAAA,EAIpD,WAAA,CAAY,OAAA,GAAU,sDAAA,EAAwD,OAAA,EAAS;AACnF,IAAA,KAAA,CAAM,SAAS,OAAO,CAAA;AAJ1B,IAAA,aAAA,CAAA,IAAA,EAAC,EAAA,CAAA;AAED,IAAA,aAAA,CAAA,IAAA,EAAA,MAAA,EAAO,iCAAA,CAAA;AAAA,EAGP;AACJ,CAAA;AALI,aAAA,CAFS,0BAEF,MAAA,EAAO,iCAAA,CAAA;;;AC/ElB,IAAM,eAAe,CAAC,KAAA,KAAU,OAAO,KAAA,KAAU,YAAY,KAAA,KAAU,IAAA;AAChE,SAAS,SAAS,KAAA,EAAO;AAC5B,EAAA,IAAI,CAAC,YAAA,CAAa,KAAK,CAAA,IAAK,MAAA,CAAO,UAAU,QAAA,CAAS,IAAA,CAAK,KAAK,CAAA,KAAM,iBAAA,EAAmB;AACrF,IAAA,OAAO,KAAA;AAAA,EACX;AACA,EAAA,IAAI,MAAA,CAAO,cAAA,CAAe,KAAK,CAAA,KAAM,IAAA,EAAM;AACvC,IAAA,OAAO,IAAA;AAAA,EACX;AACA,EAAA,IAAI,KAAA,GAAQ,KAAA;AACZ,EAAA,OAAO,MAAA,CAAO,cAAA,CAAe,KAAK,CAAA,KAAM,IAAA,EAAM;AAC1C,IAAA,KAAA,GAAQ,MAAA,CAAO,eAAe,KAAK,CAAA;AAAA,EACvC;AACA,EAAA,OAAO,MAAA,CAAO,cAAA,CAAe,KAAK,CAAA,KAAM,KAAA;AAC5C;;;ACZA,IAAM,cAAA,GAAiB,8DAAA;AACvB,SAAS,cAAc,GAAA,EAAK;AACxB,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI,SAAA;AACJ,EAAA,QAAQ,IAAI,GAAA;AAAK,IACb,KAAK,KAAA,EAAO;AACR,MAAA,QAAQ,IAAI,GAAA;AAAK,QACb,KAAK,WAAA;AAAA,QACL,KAAK,WAAA;AAAA,QACL,KAAK,WAAA;AACD,UAAA,SAAA,GAAY,EAAE,IAAA,EAAM,GAAA,CAAI,GAAA,EAAI;AAC5B,UAAA,SAAA,GAAY,IAAI,IAAA,GAAO,CAAC,MAAM,CAAA,GAAI,CAAC,QAAQ,CAAA;AAC3C,UAAA;AAAA,QACJ;AACI,UAAA,MAAM,IAAI,iBAAiB,cAAc,CAAA;AAAA;AAEjD,MAAA;AAAA,IACJ;AAAA,IACA,KAAK,KAAA,EAAO;AACR,MAAA,QAAQ,IAAI,GAAA;AAAK,QACb,KAAK,OAAA;AAAA,QACL,KAAK,OAAA;AAAA,QACL,KAAK,OAAA;AACD,UAAA,SAAA,GAAY,EAAE,IAAA,EAAM,SAAA,EAAW,IAAA,EAAM,CAAA,IAAA,EAAO,IAAI,GAAA,CAAI,KAAA,CAAM,EAAE,CAAC,CAAA,CAAA,EAAG;AAChE,UAAA,SAAA,GAAY,IAAI,CAAA,GAAI,CAAC,MAAM,CAAA,GAAI,CAAC,QAAQ,CAAA;AACxC,UAAA;AAAA,QACJ,KAAK,OAAA;AAAA,QACL,KAAK,OAAA;AAAA,QACL,KAAK,OAAA;AACD,UAAA,SAAA,GAAY,EAAE,IAAA,EAAM,mBAAA,EAAqB,IAAA,EAAM,CAAA,IAAA,EAAO,IAAI,GAAA,CAAI,KAAA,CAAM,EAAE,CAAC,CAAA,CAAA,EAAG;AAC1E,UAAA,SAAA,GAAY,IAAI,CAAA,GAAI,CAAC,MAAM,CAAA,GAAI,CAAC,QAAQ,CAAA;AACxC,UAAA;AAAA,QACJ,KAAK,UAAA;AAAA,QACL,KAAK,cAAA;AAAA,QACL,KAAK,cAAA;AAAA,QACL,KAAK,cAAA;AACD,UAAA,SAAA,GAAY;AAAA,YACR,IAAA,EAAM,UAAA;AAAA,YACN,IAAA,EAAM,CAAA,IAAA,EAAO,QAAA,CAAS,GAAA,CAAI,GAAA,CAAI,MAAM,EAAE,CAAA,EAAG,EAAE,CAAA,IAAK,CAAC,CAAA;AAAA,WACrD;AACA,UAAA,SAAA,GAAY,GAAA,CAAI,IAAI,CAAC,SAAA,EAAW,WAAW,CAAA,GAAI,CAAC,WAAW,SAAS,CAAA;AACpE,UAAA;AAAA,QACJ;AACI,UAAA,MAAM,IAAI,iBAAiB,cAAc,CAAA;AAAA;AAEjD,MAAA;AAAA,IACJ;AAAA,IACA,KAAK,IAAA,EAAM;AACP,MAAA,QAAQ,IAAI,GAAA;AAAK,QACb,KAAK,OAAA;AAAA,QACL,KAAK,OAAA;AAAA,QACL,KAAK,OAAA;AACD,UAAA,SAAA,GAAY;AAAA,YACR,IAAA,EAAM,OAAA;AAAA,YACN,UAAA,EAAY,EAAE,KAAA,EAAO,OAAA,EAAS,KAAA,EAAO,SAAS,KAAA,EAAO,OAAA,EAAQ,CAAE,GAAA,CAAI,GAAG;AAAA,WAC1E;AACA,UAAA,SAAA,GAAY,IAAI,CAAA,GAAI,CAAC,MAAM,CAAA,GAAI,CAAC,QAAQ,CAAA;AACxC,UAAA;AAAA,QACJ,KAAK,SAAA;AAAA,QACL,KAAK,gBAAA;AAAA,QACL,KAAK,gBAAA;AAAA,QACL,KAAK,gBAAA;AACD,UAAA,SAAA,GAAY,EAAE,IAAA,EAAM,MAAA,EAAQ,UAAA,EAAY,IAAI,GAAA,EAAI;AAChD,UAAA,SAAA,GAAY,GAAA,CAAI,CAAA,GAAI,CAAC,YAAY,IAAI,EAAC;AACtC,UAAA;AAAA,QACJ;AACI,UAAA,MAAM,IAAI,iBAAiB,cAAc,CAAA;AAAA;AAEjD,MAAA;AAAA,IACJ;AAAA,IACA,KAAK,KAAA,EAAO;AACR,MAAA,QAAQ,IAAI,GAAA;AAAK,QACb,KAAK,SAAA;AAAA,QACL,KAAK,OAAA;AACD,UAAA,SAAA,GAAY,EAAE,MAAM,SAAA,EAAU;AAC9B,UAAA,SAAA,GAAY,IAAI,CAAA,GAAI,CAAC,MAAM,CAAA,GAAI,CAAC,QAAQ,CAAA;AACxC,UAAA;AAAA,QACJ,KAAK,SAAA;AAAA,QACL,KAAK,gBAAA;AAAA,QACL,KAAK,gBAAA;AAAA,QACL,KAAK,gBAAA;AACD,UAAA,SAAA,GAAY,EAAE,IAAA,EAAM,GAAA,CAAI,GAAA,EAAI;AAC5B,UAAA,SAAA,GAAY,GAAA,CAAI,CAAA,GAAI,CAAC,YAAY,IAAI,EAAC;AACtC,UAAA;AAAA,QACJ;AACI,UAAA,MAAM,IAAI,iBAAiB,cAAc,CAAA;AAAA;AAEjD,MAAA;AAAA,IACJ;AAAA,IACA;AACI,MAAA,MAAM,IAAI,iBAAiB,6DAA6D,CAAA;AAAA;AAEhG,EAAA,OAAO,EAAE,WAAW,SAAA,EAAU;AAClC;AACA,eAAsB,SAAS,GAAA,EAAK;AAChC,EAAA,IAAI,CAAC,IAAI,GAAA,EAAK;AACV,IAAA,MAAM,IAAI,UAAU,0DAA0D,CAAA;AAAA,EAClF;AACA,EAAA,MAAM,EAAE,SAAA,EAAW,SAAA,EAAU,GAAI,cAAc,GAAG,CAAA;AAClD,EAAA,MAAM,OAAA,GAAU,EAAE,GAAG,GAAA,EAAI;AACzB,EAAA,IAAI,OAAA,CAAQ,QAAQ,KAAA,EAAO;AACvB,IAAA,OAAO,OAAA,CAAQ,GAAA;AAAA,EACnB;AACA,EAAA,OAAO,OAAA,CAAQ,GAAA;AACf,EAAA,OAAO,OAAO,MAAA,CAAO,SAAA,CAAU,KAAA,EAAO,OAAA,EAAS,WAAW,GAAA,CAAI,GAAA,KAAQ,GAAA,CAAI,CAAA,IAAK,IAAI,IAAA,GAAO,KAAA,GAAQ,IAAA,CAAA,EAAO,GAAA,CAAI,WAAW,SAAS,CAAA;AACrI;;;ACnFA,eAAsB,SAAA,CAAU,GAAA,EAAK,GAAA,EAAK,OAAA,EAAS;AAC/C,EAAA,IAAI,CAAC,QAAA,CAAS,GAAG,CAAA,EAAG;AAChB,IAAA,MAAM,IAAI,UAAU,uBAAuB,CAAA;AAAA,EAC/C;AACA,EAAA,IAAI,GAAA;AAEJ,EAAA,GAAA,KAAA,GAAA,GAAgC,GAAA,CAAI,GAAA,CAAA;AACpC,EAAA,QAAQ,IAAI,GAAA;AAAK,IACb,KAAK,KAAA;AACD,MAAA,IAAI,OAAO,GAAA,CAAI,CAAA,KAAM,QAAA,IAAY,CAAC,IAAI,CAAA,EAAG;AACrC,QAAA,MAAM,IAAI,UAAU,yCAAyC,CAAA;AAAA,MACjE;AACA,MAAA,OAAO,MAAA,CAAgB,IAAI,CAAC,CAAA;AAAA,IAChC,KAAK,KAAA;AACD,MAAA,IAAI,KAAA,IAAS,GAAA,IAAO,GAAA,CAAI,GAAA,KAAQ,MAAA,EAAW;AACvC,QAAA,MAAM,IAAI,iBAAiB,oEAAoE,CAAA;AAAA,MACnG;AACA,MAAA,OAAO,SAAS,EAAE,GAAG,GAAA,EAAK,GAAA,EAAK,KAAK,CAAA;AAAA,IACxC,KAAK,KAAA,EAAO;AACR,MAAA,IAAI,OAAO,GAAA,CAAI,GAAA,KAAQ,QAAA,IAAY,CAAC,IAAI,GAAA,EAAK;AACzC,QAAA,MAAM,IAAI,UAAU,2CAA2C,CAAA;AAAA,MACnE;AACA,MAAA,IAAyB,GAAA,KAAQ,GAAA,CAAI,GAAA,EAAK;AACtC,QAAA,MAAM,IAAI,UAAU,uCAAuC,CAAA;AAAA,MAC/D;AACA,MAAA,OAAO,QAAA,CAAS,EAAE,GAAG,GAAA,EAAK,KAAK,CAAA;AAAA,IACnC;AAAA,IACA,KAAK,IAAA;AAAA,IACL,KAAK,KAAA;AACD,MAAA,OAAO,SAAS,EAAE,GAAG,GAAA,EAAK,GAAA,EAAK,KAAK,CAAA;AAAA,IACxC;AACI,MAAA,MAAM,IAAI,iBAAiB,8CAA8C,CAAA;AAAA;AAErF;;;AClCA,IAAM,cAAA,GAAiB,oBAAA;AACvB,IAAM,cAAA,GAAiB,KAAK,EAAA,GAAK,GAAA;AACjC,IAAM,kBAAA,GAAqB,oCAAA;AAoE3B,IAAM,SAAA,uBAAgB,GAAA,EAA4B;AAClD,IAAM,QAAA,uBAAe,GAAA,EAAqC;AAE1D,eAAe,iBAAA,CAAkB,QAAgB,KAAA,EAAwC;AACrF,EAAA,MAAM,MAAA,GAAS,SAAA,CAAU,GAAA,CAAI,MAAM,CAAA;AACnC,EAAA,IAAI,UAAU,IAAA,CAAK,GAAA,KAAQ,MAAA,CAAO,SAAA,GAAY,OAAO,OAAO,MAAA;AAC5D,EAAA,MAAM,QAAA,GAAW,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA;AACpC,EAAA,IAAI,UAAU,OAAO,QAAA;AACrB,EAAA,MAAM,KAAK,YAAqC;AAC5C,IAAA,IAAI;AACA,MAAA,MAAM,GAAA,GAAM,GAAG,MAAA,CAAO,OAAA,CAAQ,OAAO,EAAE,CAAC,GAAG,kBAAkB,CAAA,CAAA;AAC7D,MAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,SAAS,EAAE,MAAA,EAAQ,kBAAA,EAAmB,EAAG,CAAA;AACxE,MAAA,IAAI,CAAC,GAAA,CAAI,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,GAAG,CAAA,UAAA,EAAa,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAChF,MAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAC7B,MAAA,IAAI,CAAC,IAAA,IAAQ,CAAC,MAAM,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAA,EAAG;AACpC,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,iBAAA,EAAoB,GAAG,CAAA,+BAAA,CAA4B,CAAA;AAAA,MACvE;AACA,MAAA,MAAM,OAAgC,EAAC;AACvC,MAAA,KAAA,MAAW,CAAA,IAAK,KAAK,IAAA,EAAM;AACvB,QAAA,IAAI,OAAO,CAAA,CAAE,GAAA,KAAQ,QAAA,EAAU;AAC/B,QAAA,IAAI;AACA,UAAA,IAAA,CAAK,EAAE,GAAG,CAAA,GAAK,MAAM,SAAA,CAAU,GAAG,OAAO,CAAA;AAAA,QAC7C,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACJ;AACA,MAAA,MAAM,QAAwB,EAAE,IAAA,EAAM,SAAA,EAAW,IAAA,CAAK,KAAI,EAAE;AAC5D,MAAA,SAAA,CAAU,GAAA,CAAI,QAAQ,KAAK,CAAA;AAC3B,MAAA,OAAO,KAAA;AAAA,IACX,SAAS,GAAA,EAAK;AACV,MAAA,MAAM,KAAA,GAAQ,SAAA,CAAU,GAAA,CAAI,MAAM,CAAA;AAClC,MAAA,IAAI,OAAO,OAAO,KAAA;AAClB,MAAA,MAAM,GAAA;AAAA,IACV;AAAA,EACJ,CAAA,GAAG,CAAE,OAAA,CAAQ,MAAM;AACf,IAAA,QAAA,CAAS,OAAO,MAAM,CAAA;AAAA,EAC1B,CAAC,CAAA;AACD,EAAA,QAAA,CAAS,GAAA,CAAI,QAAQ,CAAC,CAAA;AACtB,EAAA,OAAO,CAAA;AACX;AAEA,SAAS,WAAW,GAAA,EAAgC;AAChD,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,OAAO,IAAA;AACpC,EAAA,MAAM,CAAA,GAAI,IAAI,IAAA,EAAK;AACnB,EAAA,IAAI,EAAE,MAAA,KAAW,CAAA,IAAK,EAAE,MAAA,GAAS,CAAA,KAAM,GAAG,OAAO,IAAA;AACjD,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,CAAA,CAAE,SAAS,CAAC,CAAA;AACvC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,GAAA,CAAI,QAAQ,CAAA,EAAA,EAAK;AACjC,IAAA,MAAM,CAAA,GAAI,QAAA,CAAS,CAAA,CAAE,KAAA,CAAM,CAAA,GAAI,GAAG,CAAA,GAAI,CAAA,GAAI,CAAC,CAAA,EAAG,EAAE,CAAA;AAChD,IAAA,IAAI,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA,EAAG,OAAO,IAAA;AAC5B,IAAA,GAAA,CAAI,CAAC,CAAA,GAAI,CAAA;AAAA,EACb;AACA,EAAA,OAAO,GAAA;AACX;AAEA,SAAS,cAAc,GAAA,EAAgC;AACnD,EAAA,IAAI;AACA,IAAA,MAAM,GAAA,GACF,OAAO,IAAA,KAAS,UAAA,GACV,IAAA,CAAK,GAAG,CAAA,GACR,MAAA,CAAO,IAAA,CAAK,GAAA,EAAK,QAAQ,CAAA,CAAE,SAAS,QAAQ,CAAA;AACtD,IAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA;AACrC,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,GAAA,CAAI,MAAA,EAAQ,CAAA,EAAA,EAAK,GAAA,CAAI,CAAC,CAAA,GAAI,GAAA,CAAI,UAAA,CAAW,CAAC,CAAA;AAC9D,IAAA,OAAO,GAAA;AAAA,EACX,CAAA,CAAA,MAAQ;AACJ,IAAA,OAAO,IAAA;AAAA,EACX;AACJ;AAEA,SAAS,WAAW,KAAA,EAA2B;AAC3C,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,MAAW,CAAA,IAAK,OAAO,GAAA,IAAO,CAAA,CAAE,SAAS,EAAE,CAAA,CAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAA;AAC5D,EAAA,OAAO,GAAA;AACX;AAEA,eAAe,OAAO,KAAA,EAAwC;AAC1D,EAAA,MAAM,MAAA,GACF,OAAO,UAAA,CAAW,MAAA,KAAW,WAAA,IAAe,WAAW,MAAA,CAAO,MAAA,GACxD,UAAA,CAAW,MAAA,CAAO,MAAA,GAClB,IAAA;AACV,EAAA,IAAI,CAAC,MAAA,EAAQ;AACT,IAAA,MAAM,IAAI,MAAM,8EAA2E,CAAA;AAAA,EAC/F;AACA,EAAA,MAAM,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,WAAW,KAA+B,CAAA;AAC1E,EAAA,OAAO,IAAI,WAAW,GAAG,CAAA;AAC7B;AAEA,SAAS,cAAc,IAAA,EAA+B;AAClD,EAAA,MAAM,GAAA,GAAM,IAAI,WAAA,CAAY,IAAA,CAAK,UAAU,CAAA;AAC3C,EAAA,IAAI,UAAA,CAAW,GAAG,CAAA,CAAE,GAAA,CAAI,IAAI,CAAA;AAC5B,EAAA,OAAO,GAAA;AACX;AAEA,eAAe,aAAA,CACX,GAAA,EACA,GAAA,EACA,GAAA,EACgB;AAChB,EAAA,MAAM,MAAA,GACF,OAAO,UAAA,CAAW,MAAA,KAAW,WAAA,IAAe,WAAW,MAAA,CAAO,MAAA,GACxD,UAAA,CAAW,MAAA,CAAO,MAAA,GAClB,IAAA;AACV,EAAA,IAAI,CAAC,QAAQ,OAAO,KAAA;AACpB,EAAA,IAAI;AACA,IAAA,OAAO,MAAM,MAAA,CAAO,MAAA;AAAA,MAChB,SAAA;AAAA,MACA,GAAA;AAAA,MACA,cAAc,GAAG,CAAA;AAAA,MACjB,cAAc,GAAG;AAAA,KACrB;AAAA,EACJ,CAAA,CAAA,MAAQ;AACJ,IAAA,OAAO,KAAA;AAAA,EACX;AACJ;AAWA,eAAsB,yBAAA,CAClB,MAAA,EACA,OAAA,GAAiC,EAAC,EACL;AAC7B,EAAA,MAAM,SAAgC,EAAC;AAGvC,EAAA,MAAM,OAAA,GACF,CAAC,CAAC,MAAA,IACF,OAAO,MAAA,KAAW,QAAA,IAClB,OAAO,MAAA,CAAO,GAAA,KAAQ,QAAA,IACtB,OAAO,OAAO,GAAA,KAAQ,QAAA,IACtB,OAAO,MAAA,CAAO,aAAA,KAAkB,QAAA,IAChC,CAAC,CAAC,OAAO,WAAA,IACT,OAAO,MAAA,CAAO,WAAA,CAAY,EAAA,KAAO,QAAA,IACjC,OAAO,MAAA,CAAO,YAAY,UAAA,KAAe,QAAA;AAC7C,EAAA,MAAA,CAAO,IAAA,CAAK;AAAA,IACR,EAAA,EAAI,OAAA;AAAA,IACJ,KAAA,EAAO;AAAA,GACV,CAAA;AACD,EAAA,IAAI,CAAC,OAAA,EAAS;AACV,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,wBAAwB,MAAA,EAAO;AAAA,EAC/D;AAEA,EAAA,MAAM,IAAI,MAAA,CAAO,WAAA;AAGjB,EAAA,MAAM,SAAA,GAAY,aAAA,CAAc,MAAA,CAAO,aAAa,CAAA;AACpD,EAAA,MAAA,CAAO,IAAA,CAAK;AAAA,IACR,IAAI,SAAA,KAAc,IAAA;AAAA,IAClB,KAAA,EAAO,uBAAA;AAAA,IACP,MAAA,EAAQ,SAAA,GAAY,CAAA,EAAG,SAAA,CAAU,MAAM,CAAA,MAAA,CAAA,GAAW;AAAA,GACrD,CAAA;AACD,EAAA,IAAI,CAAC,SAAA,EAAW,OAAO,EAAE,EAAA,EAAI,OAAO,MAAA,EAAQ,8BAAA,EAAgC,MAAA,EAAQ,WAAA,EAAa,CAAA,EAAE;AAGnG,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,SAAS,CAAA;AACrC,EAAA,MAAM,UAAA,GAAa,WAAW,MAAM,CAAA;AACpC,EAAA,MAAM,IAAA,GAAO,eAAe,CAAA,CAAE,EAAA;AAC9B,EAAA,MAAA,CAAO,IAAA,CAAK;AAAA,IACR,EAAA,EAAI,IAAA;AAAA,IACJ,KAAA,EAAO,gCAAA;AAAA,IACP,MAAA,EAAQ,OAAO,CAAA,CAAE,EAAA,GAAK,YAAY,CAAA,CAAE,EAAE,SAAS,UAAU,CAAA;AAAA,GAC5D,CAAA;AACD,EAAA,IAAI,CAAC,IAAA,EAAM,OAAO,EAAE,EAAA,EAAI,OAAO,MAAA,EAAQ,wCAAA,EAA0C,MAAA,EAAQ,WAAA,EAAa,CAAA,EAAE;AAGxG,EAAA,IAAI,GAAA,GAAsB,IAAA;AAC1B,EAAA,IAAI,QAAQ,GAAA,EAAK;AACb,IAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,GAAA,KAAQ,MAAA,CAAO,GAAA,EAAK;AAChC,MAAA,MAAA,CAAO,IAAA,CAAK;AAAA,QACR,EAAA,EAAI,KAAA;AAAA,QACJ,KAAA,EAAO,+BAAA;AAAA,QACP,QAAQ,CAAA,iBAAA,EAAoB,OAAA,CAAQ,IAAI,GAAG,CAAA,gBAAA,EAAmB,OAAO,GAAG,CAAA;AAAA,OAC3E,CAAA;AACD,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,gCAAA,EAAkC,MAAA,EAAQ,aAAa,CAAA,EAAE;AAAA,IACzF;AACA,IAAA,IAAI;AACA,MAAA,GAAA,GAAO,MAAM,SAAA,CAAU,OAAA,CAAQ,GAAA,EAAK,OAAO,CAAA;AAC3C,MAAA,MAAA,CAAO,IAAA,CAAK,EAAE,EAAA,EAAI,IAAA,EAAM,KAAA,EAAO,+BAAA,EAAiC,MAAA,EAAQ,CAAA,IAAA,EAAO,MAAA,CAAO,GAAG,CAAA,WAAA,CAAA,EAAe,CAAA;AAAA,IAC5G,SAAS,GAAA,EAAK;AACV,MAAA,MAAA,CAAO,IAAA,CAAK;AAAA,QACR,EAAA,EAAI,KAAA;AAAA,QACJ,KAAA,EAAO,+BAAA;AAAA,QACP,MAAA,EAAQ,CAAA,4BAAA,EAAgC,GAAA,CAAc,OAAO,CAAA;AAAA,OAChE,CAAA;AACD,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,4BAAA,EAA8B,MAAA,EAAQ,aAAa,CAAA,EAAE;AAAA,IACrF;AAAA,EACJ,CAAA,MAAO;AACH,IAAA,MAAM,MAAA,GAAS,QAAQ,MAAA,IAAU,cAAA;AACjC,IAAA,MAAM,GAAA,GAAM,QAAQ,cAAA,IAAkB,cAAA;AACtC,IAAA,IAAI;AACA,MAAA,IAAI,KAAA,GAAQ,MAAM,iBAAA,CAAkB,MAAA,EAAQ,GAAG,CAAA;AAC/C,MAAA,GAAA,GAAM,KAAA,CAAM,IAAA,CAAK,MAAA,CAAO,GAAG,CAAA,IAAK,IAAA;AAChC,MAAA,IAAI,CAAC,GAAA,EAAK;AAEN,QAAA,SAAA,CAAU,OAAO,MAAM,CAAA;AACvB,QAAA,KAAA,GAAQ,MAAM,iBAAA,CAAkB,MAAA,EAAQ,GAAG,CAAA;AAC3C,QAAA,GAAA,GAAM,KAAA,CAAM,IAAA,CAAK,MAAA,CAAO,GAAG,CAAA,IAAK,IAAA;AAAA,MACpC;AACA,MAAA,MAAA,CAAO,IAAA,CAAK;AAAA,QACR,EAAA,EAAI,CAAC,CAAC,GAAA;AAAA,QACN,KAAA,EAAO,+BAAA;AAAA,QACP,MAAA,EAAQ,GAAA,GAAM,CAAA,IAAA,EAAO,MAAA,CAAO,GAAG,CAAA,CAAA,GAAK,CAAA,gBAAA,EAAmB,MAAA,CAAO,GAAG,CAAA,IAAA,EAAO,MAAM,CAAA,EAAG,kBAAkB,CAAA;AAAA,OACtG,CAAA;AACD,MAAA,IAAI,CAAC,GAAA,EAAK;AACN,QAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,CAAA,IAAA,EAAO,OAAO,GAAG,CAAA,qBAAA,CAAA,EAAyB,MAAA,EAAQ,WAAA,EAAa,CAAA,EAAE;AAAA,MACjG;AAAA,IACJ,SAAS,GAAA,EAAK;AACV,MAAA,MAAA,CAAO,IAAA,CAAK;AAAA,QACR,EAAA,EAAI,KAAA;AAAA,QACJ,KAAA,EAAO,+BAAA;AAAA,QACP,MAAA,EAAQ,CAAA,2BAAA,EAA+B,GAAA,CAAc,OAAO,CAAA;AAAA,OAC/D,CAAA;AACD,MAAA,OAAO;AAAA,QACH,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,CAAA,2BAAA,EAA+B,GAAA,CAAc,OAAO,CAAA,CAAA;AAAA,QAC5D,MAAA;AAAA,QACA,WAAA,EAAa;AAAA,OACjB;AAAA,IACJ;AAAA,EACJ;AAEA,EAAA,MAAM,QAAA,GAAW,UAAA,CAAW,MAAA,CAAO,GAAG,CAAA;AACtC,EAAA,IAAI,CAAC,QAAA,EAAU;AACX,IAAA,MAAA,CAAO,IAAA,CAAK;AAAA,MACR,EAAA,EAAI,KAAA;AAAA,MACJ,KAAA,EAAO,kDAAA;AAAA,MACP,MAAA,EAAQ;AAAA,KACX,CAAA;AACD,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,eAAA,EAAiB,MAAA,EAAQ,aAAa,CAAA,EAAE;AAAA,EACxE;AACA,EAAA,MAAM,KAAA,GAAQ,MAAM,aAAA,CAAc,GAAA,EAAK,UAAU,SAAS,CAAA;AAC1D,EAAA,MAAA,CAAO,IAAA,CAAK;AAAA,IACR,EAAA,EAAI,KAAA;AAAA,IACJ,KAAA,EAAO,kDAAA;AAAA,IACP,MAAA,EAAQ,QAAQ,iBAAA,GAAoB;AAAA,GACvC,CAAA;AACD,EAAA,IAAI,CAAC,KAAA,EAAO,OAAO,EAAE,EAAA,EAAI,OAAO,MAAA,EAAQ,0BAAA,EAA4B,MAAA,EAAQ,WAAA,EAAa,CAAA,EAAE;AAG3F,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,oBAAO,IAAI,IAAA,EAAK;AACpC,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,KAAA,CAAM,CAAA,CAAE,UAAU,CAAA;AACzC,EAAA,MAAM,UAAU,MAAA,CAAO,QAAA,CAAS,SAAS,CAAA,IAAK,SAAA,GAAY,IAAI,OAAA,EAAQ;AACtE,EAAA,MAAA,CAAO,IAAA,CAAK;AAAA,IACR,EAAA,EAAI,OAAA;AAAA,IACJ,KAAA,EAAO,8BAAA;AAAA,IACP,MAAA,EAAQ,UACF,CAAA,QAAA,EAAW,IAAI,KAAK,SAAS,CAAA,CAAE,WAAA,EAAa,CAAA,CAAA,GAC5C;AAAA,GACT,CAAA;AACD,EAAA,IAAI,CAAC,OAAA,EAAS,OAAO,EAAE,EAAA,EAAI,OAAO,MAAA,EAAQ,yBAAA,EAA2B,MAAA,EAAQ,WAAA,EAAa,CAAA,EAAE;AAE5F,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,WAAA,EAAa,GAAG,MAAA,EAAO;AAC9C;AAIA,eAAsB,mBAAA,CAAoB,SAAS,cAAA,EAA+B;AAC9E,EAAA,SAAA,CAAU,OAAO,MAAM,CAAA;AACvB,EAAA,MAAM,iBAAA,CAAkB,QAAQ,cAAc,CAAA;AAClD;AAEO,IAAM,QAAA,GAAW;AAAA,EACpB,yBAAA;AAAA,EACA;AACJ;;;ACtRA,eAAsB,YAAA,CAClB,OAAA,EACA,OAAA,GAA2B,EAAC,EACE;AAC9B,EAAA,MAAM,OAAA,GAAU,MAAMA,qBAAA,CAAiB,OAAA,EAAS,OAAO,CAAA;AACvD,EAAA,IAAI,CAAC,OAAA,IAAW,OAAA,CAAQ,QAAA,KAAa,MAAA,wBAAiC,OAAO,CAAA;AAC7E,EAAA,OAAO,OAAA;AACX;AAEA,IAAI,cAAA,GAAiB,KAAA;AAQrB,SAAS,sBAAsB,OAAA,EAAgD;AAC3E,EAAA,IAAI,cAAA,EAAgB;AACpB,EAAA,MAAM,IAAA,GACF,OAAO,OAAA,KAAY,WAAA,IAAe,OAAA,YAAmB,UAC/C,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA,GAC1B,OAAA,CAAkC,aAAA;AAC7C,EAAA,MAAM,IAAI,OAAO,IAAA,KAAS,WAAW,+BAAA,CAAgC,IAAA,CAAK,IAAI,CAAA,GAAI,IAAA;AAClF,EAAA,IAAI,CAAC,CAAA,EAAG;AACR,EAAA,IAAI;AACA,IAAA,MAAM,UAAU,IAAA,CAAK,KAAA,CAAM,kBAAkB,CAAA,CAAE,CAAC,CAAE,CAAC,CAAA;AACnD,IAAA,IAAI,OAAA,CAAQ,QAAQ,KAAA,CAAA,EAAW;AAC/B,IAAA,cAAA,GAAiB,IAAA;AACjB,IAAA,OAAA,CAAQ,IAAA;AAAA,MACJ,CAAA,kDAAA,EAAqD,IAAA,CAAK,SAAA,CAAU,OAAA,CAAQ,GAAG,CAAC,CAAA,+IAAA;AAAA,KAGpF;AAAA,EACJ,CAAA,CAAA,MAAQ;AAAA,EAER;AACJ;AAEA,SAAS,kBAAkB,CAAA,EAAmB;AAC1C,EAAA,MAAM,GAAA,GAAM,EAAE,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AAClD,EAAA,IAAI,OAAO,IAAA,KAAS,UAAA,EAAY,OAAO,IAAA,CAAK,GAAA,GAAM,GAAA,CAAI,MAAA,CAAA,CAAQ,CAAA,GAAK,GAAA,CAAI,MAAA,GAAS,CAAA,IAAM,CAAC,CAAC,CAAA;AACxF,EAAA,OAAO,OAAO,IAAA,CAAK,CAAA,EAAG,WAAW,CAAA,CAAE,SAAS,MAAM,CAAA;AACtD;AAyCA,IAAM,gBAAgB,CAAA,GAAI,GAAA;AAC1B,IAAM,QAAA,uBAAe,GAAA,EAAmD;AAOxE,eAAe,mBAAmB,OAAA,EAAkE;AAChG,EAAA,MAAM,MAAM,OAAA,CAAQ,UAAA;AACpB,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,GAAA,CAAI,GAAG,CAAA;AAC5B,EAAA,IAAI,GAAA,IAAO,KAAK,GAAA,EAAI,GAAI,IAAI,EAAA,GAAK,aAAA,SAAsB,GAAA,CAAI,IAAA;AAC3D,EAAA,IAAI;AACA,IAAA,MAAM,IAAA,GAAO,QAAQ,QAAA,IAAY,oBAAA;AACjC,IAAA,MAAM,CAAA,GAAI,MAAM,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,mCAAA,EAAsC,kBAAA,CAAmB,GAAG,CAAC,CAAA,CAAA,EAAI;AAAA,MAC1F,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,GAAI;AAAA,KACnC,CAAA;AACD,IAAA,IAAI,CAAC,EAAE,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,KAAA,EAAQ,CAAA,CAAE,MAAM,CAAA,CAAE,CAAA;AAC7C,IAAA,MAAM,CAAA,GAAK,MAAM,CAAA,CAAE,IAAA,EAAK;AAGxB,IAAA,MAAM,GAAA,GAAM,CAAA,CAAE,MAAA,EAAQ,YAAA,IAAgB,IAAA;AACtC,IAAA,MAAM,IAAA,GAAO,MAAM,EAAE,OAAA,EAAS,IAAI,QAAA,EAAU,OAAA,EAAS,GAAA,CAAI,QAAA,EAAS,GAAI,IAAA;AACtE,IAAA,QAAA,CAAS,GAAA,CAAI,KAAK,EAAE,EAAA,EAAI,KAAK,GAAA,EAAI,EAAG,MAAM,CAAA;AAC1C,IAAA,OAAO,IAAA;AAAA,EACX,CAAA,CAAA,MAAQ;AACJ,IAAA,OAAO,GAAA,EAAK,IAAA;AAAA,EAChB;AACJ;AAGA,eAAe,SAAS,OAAA,EAAkE;AACtF,EAAA,IAAI,OAAA,CAAQ,WAAA,EAAa,OAAO,OAAA,CAAQ,WAAA;AACxC,EAAA,IAAI,OAAA,CAAQ,UAAA,EAAY,OAAO,kBAAA,CAAmB,OAAO,CAAA;AACzD,EAAA,OAAO,IAAA;AACX;AAGA,eAAe,OAAA,CACX,SACA,OAAA,EACiE;AACjE,EAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,OAAO,CAAA;AACnC,EAAA,IAAI,CAAC,OAAA,EAAS;AACV,IAAA,OAAO,OAAA,CAAQ,QAAA,IAAY,IAAA,KAAS,IAAA,GAC9B,EAAE,MAAA,EAAQ,GAAA,EAAK,IAAA,EAAM,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,iBAAA,IAAoB,GAC9D,IAAA;AAAA,EACV;AACA,EAAA,IAAI,SAAS,MAAA,EAAW;AACpB,IAAA,OAAO,EAAE,QAAQ,GAAA,EAAK,IAAA,EAAM,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,yBAAA,EAA0B,EAAE;AAAA,EACjF;AACA,EAAA,IAAI,IAAA,IAAQ,CAACC,kBAAA,CAAU,OAAA,EAAS,IAAI,CAAA,EAAG;AACnC,IAAA,MAAM,IAAA,GAAOC,uBAAc,OAAO,CAAA;AAClC,IAAA,OAAO;AAAA,MACH,MAAA,EAAQ,GAAA;AAAA,MACR,IAAA,EAAM;AAAA,QACF,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,eAAA;AAAA,QACR,IAAA;AAAA,QACA,IAAA,EAAM,OAAO,EAAE,UAAA,EAAY,KAAK,UAAA,EAAY,UAAA,EAAY,IAAA,CAAK,UAAA,EAAW,GAAI;AAAA;AAChF,KACJ;AAAA,EACJ;AACA,EAAA,OAAO,IAAA;AACX;AAqBO,SAAS,UAAA,CACZ,OAAA,EACA,OAAA,GAA6B,EAAC,EAC7B;AACD,EAAA,MAAM,OAAA,GAAU,OAAO,GAAA,EAAyB,GAAA,KAA6B;AACzE,IAAA,GAAA,CAAI,SAAA,CAAU,iBAAiB,mBAAmB,CAAA;AAClD,IAAA,GAAA,CAAI,SAAA,CAAU,QAAQ,uBAAuB,CAAA;AAC7C,IAAA,MAAM,UAAU,MAAM,YAAA;AAAA,MAClB;AAAA,QACI,MAAA,EAAQ,OAAO,GAAA,CAAI,OAAA,CAAQ,WAAW,QAAA,GAAW,GAAA,CAAI,QAAQ,MAAA,GAAS,IAAA;AAAA,QACtE,aAAA,EACI,OAAO,GAAA,CAAI,OAAA,CAAQ,kBAAkB,QAAA,GAC/B,GAAA,CAAI,QAAQ,aAAA,GACZ;AAAA,OACd;AAAA,MACA;AAAA,KACJ;AACA,IAAA,GAAA,CAAI,SAAA,GAAY,OAAA;AAChB,IAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,OAAA,EAAS,OAAO,CAAA;AAC9C,IAAA,IAAI,OAAA,SAAgB,GAAA,CAAI,MAAA,CAAO,QAAQ,MAAM,CAAA,CAAE,IAAA,CAAK,OAAA,CAAQ,IAAI,CAAA;AAChE,IAAA,OAAO,OAAA,CAAQ,KAAK,GAAG,CAAA;AAAA,EAC3B,CAAA;AACA,EAAA,OAAO,OAAA;AACX;AAkCO,SAAS,aAAA,CAAc,OAAA,GAA6B,EAAC,EAAG;AAC3D,EAAA,OAAO,OAAO,GAAA,EAAyB,GAAA,EAA0B,IAAA,KAA0B;AACvF,IAAA,IAAI;AACA,MAAA,GAAA,CAAI,SAAA,CAAU,iBAAiB,mBAAmB,CAAA;AAClD,MAAA,GAAA,CAAI,SAAA,CAAU,QAAQ,uBAAuB,CAAA;AAC7C,MAAA,MAAM,UAAU,MAAM,YAAA;AAAA,QAClB;AAAA,UACI,MAAA,EAAQ,OAAO,GAAA,CAAI,OAAA,CAAQ,WAAW,QAAA,GAAW,GAAA,CAAI,QAAQ,MAAA,GAAS,IAAA;AAAA,UACtE,aAAA,EACI,OAAO,GAAA,CAAI,OAAA,CAAQ,kBAAkB,QAAA,GAC/B,GAAA,CAAI,QAAQ,aAAA,GACZ;AAAA,SACd;AAAA,QACA;AAAA,OACJ;AACA,MAAA,GAAA,CAAI,SAAA,GAAY,OAAA;AAChB,MAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,OAAA,EAAS,OAAO,CAAA;AAC9C,MAAA,IAAI,OAAA,EAAS;AACT,QAAA,GAAA,CAAI,OAAO,OAAA,CAAQ,MAAM,CAAA,CAAE,IAAA,CAAK,QAAQ,IAAI,CAAA;AAC5C,QAAA;AAAA,MACJ;AACA,MAAA,IAAA,EAAK;AAAA,IACT,SAAS,GAAA,EAAK;AACV,MAAA,IAAA,CAAK,GAAG,CAAA;AAAA,IACZ;AAAA,EACJ,CAAA;AACJ;AA2BO,SAAS,UAAA,CAAW,OAAA,GAA6B,EAAC,EAAG;AACxD,EAAA,OAAO,OAAO,GAAoB,IAAA,KAAuB;AACrD,IAAA,CAAA,CAAE,MAAA,CAAO,iBAAiB,mBAAmB,CAAA;AAC7C,IAAA,CAAA,CAAE,MAAA,CAAO,QAAQ,uBAAuB,CAAA;AACxC,IAAA,MAAM,UAAU,MAAM,YAAA,CAAa,EAAE,GAAA,CAAI,GAAA,CAAI,SAAS,OAAO,CAAA;AAC7D,IAAA,CAAA,CAAE,GAAA,CAAI,aAAa,OAAO,CAAA;AAC1B,IAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,OAAA,EAAS,OAAO,CAAA;AAC9C,IAAA,IAAI,SAAS,OAAO,CAAA,CAAE,KAAK,OAAA,CAAQ,IAAA,EAAM,QAAQ,MAAM,CAAA;AACvD,IAAA,MAAM,IAAA,EAAK;AAAA,EACf,CAAA;AACJ","file":"server.js","sourcesContent":["export const encoder = new TextEncoder();\nexport const decoder = new TextDecoder();\nconst MAX_INT32 = 2 ** 32;\nexport function concat(...buffers) {\n const size = buffers.reduce((acc, { length }) => acc + length, 0);\n const buf = new Uint8Array(size);\n let i = 0;\n for (const buffer of buffers) {\n buf.set(buffer, i);\n i += buffer.length;\n }\n return buf;\n}\nfunction writeUInt32BE(buf, value, offset) {\n if (value < 0 || value >= MAX_INT32) {\n throw new RangeError(`value must be >= 0 and <= ${MAX_INT32 - 1}. Received ${value}`);\n }\n buf.set([value >>> 24, value >>> 16, value >>> 8, value & 0xff], offset);\n}\nexport function uint64be(value) {\n const high = Math.floor(value / MAX_INT32);\n const low = value % MAX_INT32;\n const buf = new Uint8Array(8);\n writeUInt32BE(buf, high, 0);\n writeUInt32BE(buf, low, 4);\n return buf;\n}\nexport function uint32be(value) {\n const buf = new Uint8Array(4);\n writeUInt32BE(buf, value);\n return buf;\n}\nexport function encode(string) {\n const bytes = new Uint8Array(string.length);\n for (let i = 0; i < string.length; i++) {\n const code = string.charCodeAt(i);\n if (code > 127) {\n throw new TypeError('non-ASCII string encountered in encode()');\n }\n bytes[i] = code;\n }\n return bytes;\n}\n","export function encodeBase64(input) {\n if (Uint8Array.prototype.toBase64) {\n return input.toBase64();\n }\n const CHUNK_SIZE = 0x8000;\n const arr = [];\n for (let i = 0; i < input.length; i += CHUNK_SIZE) {\n arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));\n }\n return btoa(arr.join(''));\n}\nexport function decodeBase64(encoded) {\n if (Uint8Array.fromBase64) {\n return Uint8Array.fromBase64(encoded);\n }\n const binary = atob(encoded);\n const bytes = new Uint8Array(binary.length);\n for (let i = 0; i < binary.length; i++) {\n bytes[i] = binary.charCodeAt(i);\n }\n return bytes;\n}\n","import { encoder, decoder } from '../lib/buffer_utils.js';\nimport { encodeBase64, decodeBase64 } from '../lib/base64.js';\nexport function decode(input) {\n if (Uint8Array.fromBase64) {\n return Uint8Array.fromBase64(typeof input === 'string' ? input : decoder.decode(input), {\n alphabet: 'base64url',\n });\n }\n let encoded = input;\n if (encoded instanceof Uint8Array) {\n encoded = decoder.decode(encoded);\n }\n encoded = encoded.replace(/-/g, '+').replace(/_/g, '/');\n try {\n return decodeBase64(encoded);\n }\n catch {\n throw new TypeError('The input to be decoded is not correctly encoded.');\n }\n}\nexport function encode(input) {\n let unencoded = input;\n if (typeof unencoded === 'string') {\n unencoded = encoder.encode(unencoded);\n }\n if (Uint8Array.prototype.toBase64) {\n return unencoded.toBase64({ alphabet: 'base64url', omitPadding: true });\n }\n return encodeBase64(unencoded).replace(/=/g, '').replace(/\\+/g, '-').replace(/\\//g, '_');\n}\n","export class JOSEError extends Error {\n static code = 'ERR_JOSE_GENERIC';\n code = 'ERR_JOSE_GENERIC';\n constructor(message, options) {\n super(message, options);\n this.name = this.constructor.name;\n Error.captureStackTrace?.(this, this.constructor);\n }\n}\nexport class JWTClaimValidationFailed extends JOSEError {\n static code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';\n code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';\n claim;\n reason;\n payload;\n constructor(message, payload, claim = 'unspecified', reason = 'unspecified') {\n super(message, { cause: { claim, reason, payload } });\n this.claim = claim;\n this.reason = reason;\n this.payload = payload;\n }\n}\nexport class JWTExpired extends JOSEError {\n static code = 'ERR_JWT_EXPIRED';\n code = 'ERR_JWT_EXPIRED';\n claim;\n reason;\n payload;\n constructor(message, payload, claim = 'unspecified', reason = 'unspecified') {\n super(message, { cause: { claim, reason, payload } });\n this.claim = claim;\n this.reason = reason;\n this.payload = payload;\n }\n}\nexport class JOSEAlgNotAllowed extends JOSEError {\n static code = 'ERR_JOSE_ALG_NOT_ALLOWED';\n code = 'ERR_JOSE_ALG_NOT_ALLOWED';\n}\nexport class JOSENotSupported extends JOSEError {\n static code = 'ERR_JOSE_NOT_SUPPORTED';\n code = 'ERR_JOSE_NOT_SUPPORTED';\n}\nexport class JWEDecryptionFailed extends JOSEError {\n static code = 'ERR_JWE_DECRYPTION_FAILED';\n code = 'ERR_JWE_DECRYPTION_FAILED';\n constructor(message = 'decryption operation failed', options) {\n super(message, options);\n }\n}\nexport class JWEInvalid extends JOSEError {\n static code = 'ERR_JWE_INVALID';\n code = 'ERR_JWE_INVALID';\n}\nexport class JWSInvalid extends JOSEError {\n static code = 'ERR_JWS_INVALID';\n code = 'ERR_JWS_INVALID';\n}\nexport class JWTInvalid extends JOSEError {\n static code = 'ERR_JWT_INVALID';\n code = 'ERR_JWT_INVALID';\n}\nexport class JWKInvalid extends JOSEError {\n static code = 'ERR_JWK_INVALID';\n code = 'ERR_JWK_INVALID';\n}\nexport class JWKSInvalid extends JOSEError {\n static code = 'ERR_JWKS_INVALID';\n code = 'ERR_JWKS_INVALID';\n}\nexport class JWKSNoMatchingKey extends JOSEError {\n static code = 'ERR_JWKS_NO_MATCHING_KEY';\n code = 'ERR_JWKS_NO_MATCHING_KEY';\n constructor(message = 'no applicable key found in the JSON Web Key Set', options) {\n super(message, options);\n }\n}\nexport class JWKSMultipleMatchingKeys extends JOSEError {\n [Symbol.asyncIterator];\n static code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';\n code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';\n constructor(message = 'multiple matching keys found in the JSON Web Key Set', options) {\n super(message, options);\n }\n}\nexport class JWKSTimeout extends JOSEError {\n static code = 'ERR_JWKS_TIMEOUT';\n code = 'ERR_JWKS_TIMEOUT';\n constructor(message = 'request timed out', options) {\n super(message, options);\n }\n}\nexport class JWSSignatureVerificationFailed extends JOSEError {\n static code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';\n code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';\n constructor(message = 'signature verification failed', options) {\n super(message, options);\n }\n}\n","const isObjectLike = (value) => typeof value === 'object' && value !== null;\nexport function isObject(input) {\n if (!isObjectLike(input) || Object.prototype.toString.call(input) !== '[object Object]') {\n return false;\n }\n if (Object.getPrototypeOf(input) === null) {\n return true;\n }\n let proto = input;\n while (Object.getPrototypeOf(proto) !== null) {\n proto = Object.getPrototypeOf(proto);\n }\n return Object.getPrototypeOf(input) === proto;\n}\nexport function isDisjoint(...headers) {\n const sources = headers.filter(Boolean);\n if (sources.length === 0 || sources.length === 1) {\n return true;\n }\n let acc;\n for (const header of sources) {\n const parameters = Object.keys(header);\n if (!acc || acc.size === 0) {\n acc = new Set(parameters);\n continue;\n }\n for (const parameter of parameters) {\n if (acc.has(parameter)) {\n return false;\n }\n acc.add(parameter);\n }\n }\n return true;\n}\nexport const isJWK = (key) => isObject(key) && typeof key.kty === 'string';\nexport const isPrivateJWK = (key) => key.kty !== 'oct' &&\n ((key.kty === 'AKP' && typeof key.priv === 'string') || typeof key.d === 'string');\nexport const isPublicJWK = (key) => key.kty !== 'oct' && key.d === undefined && key.priv === undefined;\nexport const isSecretJWK = (key) => key.kty === 'oct' && typeof key.k === 'string';\n","import { JOSENotSupported } from '../util/errors.js';\nconst unsupportedAlg = 'Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value';\nfunction subtleMapping(jwk) {\n let algorithm;\n let keyUsages;\n switch (jwk.kty) {\n case 'AKP': {\n switch (jwk.alg) {\n case 'ML-DSA-44':\n case 'ML-DSA-65':\n case 'ML-DSA-87':\n algorithm = { name: jwk.alg };\n keyUsages = jwk.priv ? ['sign'] : ['verify'];\n break;\n default:\n throw new JOSENotSupported(unsupportedAlg);\n }\n break;\n }\n case 'RSA': {\n switch (jwk.alg) {\n case 'PS256':\n case 'PS384':\n case 'PS512':\n algorithm = { name: 'RSA-PSS', hash: `SHA-${jwk.alg.slice(-3)}` };\n keyUsages = jwk.d ? ['sign'] : ['verify'];\n break;\n case 'RS256':\n case 'RS384':\n case 'RS512':\n algorithm = { name: 'RSASSA-PKCS1-v1_5', hash: `SHA-${jwk.alg.slice(-3)}` };\n keyUsages = jwk.d ? ['sign'] : ['verify'];\n break;\n case 'RSA-OAEP':\n case 'RSA-OAEP-256':\n case 'RSA-OAEP-384':\n case 'RSA-OAEP-512':\n algorithm = {\n name: 'RSA-OAEP',\n hash: `SHA-${parseInt(jwk.alg.slice(-3), 10) || 1}`,\n };\n keyUsages = jwk.d ? ['decrypt', 'unwrapKey'] : ['encrypt', 'wrapKey'];\n break;\n default:\n throw new JOSENotSupported(unsupportedAlg);\n }\n break;\n }\n case 'EC': {\n switch (jwk.alg) {\n case 'ES256':\n case 'ES384':\n case 'ES512':\n algorithm = {\n name: 'ECDSA',\n namedCurve: { ES256: 'P-256', ES384: 'P-384', ES512: 'P-521' }[jwk.alg],\n };\n keyUsages = jwk.d ? ['sign'] : ['verify'];\n break;\n case 'ECDH-ES':\n case 'ECDH-ES+A128KW':\n case 'ECDH-ES+A192KW':\n case 'ECDH-ES+A256KW':\n algorithm = { name: 'ECDH', namedCurve: jwk.crv };\n keyUsages = jwk.d ? ['deriveBits'] : [];\n break;\n default:\n throw new JOSENotSupported(unsupportedAlg);\n }\n break;\n }\n case 'OKP': {\n switch (jwk.alg) {\n case 'Ed25519':\n case 'EdDSA':\n algorithm = { name: 'Ed25519' };\n keyUsages = jwk.d ? ['sign'] : ['verify'];\n break;\n case 'ECDH-ES':\n case 'ECDH-ES+A128KW':\n case 'ECDH-ES+A192KW':\n case 'ECDH-ES+A256KW':\n algorithm = { name: jwk.crv };\n keyUsages = jwk.d ? ['deriveBits'] : [];\n break;\n default:\n throw new JOSENotSupported(unsupportedAlg);\n }\n break;\n }\n default:\n throw new JOSENotSupported('Invalid or unsupported JWK \"kty\" (Key Type) Parameter value');\n }\n return { algorithm, keyUsages };\n}\nexport async function jwkToKey(jwk) {\n if (!jwk.alg) {\n throw new TypeError('\"alg\" argument is required when \"jwk.alg\" is not present');\n }\n const { algorithm, keyUsages } = subtleMapping(jwk);\n const keyData = { ...jwk };\n if (keyData.kty !== 'AKP') {\n delete keyData.alg;\n }\n delete keyData.use;\n return crypto.subtle.importKey('jwk', keyData, algorithm, jwk.ext ?? (jwk.d || jwk.priv ? false : true), jwk.key_ops ?? keyUsages);\n}\n","import { decode as decodeBase64URL } from '../util/base64url.js';\nimport { fromSPKI, fromPKCS8, fromX509 } from '../lib/asn1.js';\nimport { jwkToKey } from '../lib/jwk_to_key.js';\nimport { JOSENotSupported } from '../util/errors.js';\nimport { isObject } from '../lib/type_checks.js';\nexport async function importSPKI(spki, alg, options) {\n if (typeof spki !== 'string' || spki.indexOf('-----BEGIN PUBLIC KEY-----') !== 0) {\n throw new TypeError('\"spki\" must be SPKI formatted string');\n }\n return fromSPKI(spki, alg, options);\n}\nexport async function importX509(x509, alg, options) {\n if (typeof x509 !== 'string' || x509.indexOf('-----BEGIN CERTIFICATE-----') !== 0) {\n throw new TypeError('\"x509\" must be X.509 formatted string');\n }\n return fromX509(x509, alg, options);\n}\nexport async function importPKCS8(pkcs8, alg, options) {\n if (typeof pkcs8 !== 'string' || pkcs8.indexOf('-----BEGIN PRIVATE KEY-----') !== 0) {\n throw new TypeError('\"pkcs8\" must be PKCS#8 formatted string');\n }\n return fromPKCS8(pkcs8, alg, options);\n}\nexport async function importJWK(jwk, alg, options) {\n if (!isObject(jwk)) {\n throw new TypeError('JWK must be an object');\n }\n let ext;\n alg ??= jwk.alg;\n ext ??= options?.extractable ?? jwk.ext;\n switch (jwk.kty) {\n case 'oct':\n if (typeof jwk.k !== 'string' || !jwk.k) {\n throw new TypeError('missing \"k\" (Key Value) Parameter value');\n }\n return decodeBase64URL(jwk.k);\n case 'RSA':\n if ('oth' in jwk && jwk.oth !== undefined) {\n throw new JOSENotSupported('RSA JWK \"oth\" (Other Primes Info) Parameter value is not supported');\n }\n return jwkToKey({ ...jwk, alg, ext });\n case 'AKP': {\n if (typeof jwk.alg !== 'string' || !jwk.alg) {\n throw new TypeError('missing \"alg\" (Algorithm) Parameter value');\n }\n if (alg !== undefined && alg !== jwk.alg) {\n throw new TypeError('JWK alg and alg option value mismatch');\n }\n return jwkToKey({ ...jwk, ext });\n }\n case 'EC':\n case 'OKP':\n return jwkToKey({ ...jwk, alg, ext });\n default:\n throw new JOSENotSupported('Unsupported \"kty\" (Key Type) Parameter value');\n }\n}\n","/**\n * `oc.identity.verifyActivityAttestation` — one-call ed25519 verifier\n * for a /api/me/activity-attestation bundle.\n *\n * Cashes the \"trivially to verify\" strategic claim: an integrator\n * receiving a signed attestation JSON from a user calls one function,\n * gets a typed result with per-check detail, never reaches into\n * @noble/curves or jose themselves.\n *\n * import { oc } from '@orangecheck/me-client';\n *\n * const result = await oc.identity.verifyActivityAttestation(bundle);\n * if (!result.ok) return res.status(401).send(result.reason);\n * // result.attestation is typed · safe to gate on lifetime_sats etc.\n *\n * The JWKS issuer is me.ochk.io (the envelope key), DISTINCT from\n * the auth host's ochk.io JWKS that signs webhooks. Same Ed25519\n * curve, same kid lookup pattern, fetched + cached separately.\n */\n\nimport { importJWK, type CryptoKey, type KeyObject } from 'jose';\n\nconst DEFAULT_ISSUER = 'https://me.ochk.io';\nconst DEFAULT_TTL_MS = 60 * 60 * 1000;\nconst ENVELOPE_JWKS_PATH = '/.well-known/oc-envelope-jwks.json';\n\nexport interface ActivityAttestation {\n id: string;\n v: 1;\n kind: 'oc-me-activity';\n did_oc: string;\n event_count: number;\n human_event_count: number;\n lifetime_sats: number;\n distinct_integrator_count: number;\n oldest_event_at: string | null;\n active_days: number;\n computed_at: string;\n expires_at: string;\n}\n\nexport interface ActivityAttestationBundle {\n attestation: ActivityAttestation;\n sig: string;\n kid: string;\n canonical_b64: string;\n}\n\nexport interface ActivityVerifyCheck {\n ok: boolean;\n label: string;\n detail?: string;\n}\n\nexport interface ActivityVerifyResult {\n ok: boolean;\n reason?: string;\n attestation?: ActivityAttestation;\n checks: ActivityVerifyCheck[];\n}\n\ninterface OcEnvelopePublicJwk {\n kty: 'OKP';\n crv: 'Ed25519';\n x: string;\n kid: string;\n alg?: 'EdDSA';\n use?: 'sig';\n}\n\nexport interface VerifyActivityOptions {\n /** Override the me.ochk.io issuer (defaults to https://me.ochk.io).\n * Useful for staging / self-hosted dev. */\n issuer?: string;\n /** Pass a JWK directly to skip the network fetch · convenient when\n * embedding the public key in your service for air-gapped or\n * edge-runtime deployments. */\n jwk?: OcEnvelopePublicJwk;\n /** JWKS cache TTL in ms. Defaults to 1h. Stale-on-error falls back\n * to the previous cached value. */\n jwksCacheTtlMs?: number;\n /** Optional · override \"now\" for deterministic tests. */\n now?: Date;\n}\n\ntype AuthKey = CryptoKey | KeyObject;\n\ninterface JwksCacheEntry {\n keys: Record<string, AuthKey>;\n fetchedAt: number;\n}\n\nconst jwksCache = new Map<string, JwksCacheEntry>();\nconst inflight = new Map<string, Promise<JwksCacheEntry>>();\n\nasync function fetchEnvelopeJwks(issuer: string, ttlMs: number): Promise<JwksCacheEntry> {\n const cached = jwksCache.get(issuer);\n if (cached && Date.now() - cached.fetchedAt < ttlMs) return cached;\n const existing = inflight.get(issuer);\n if (existing) return existing;\n const p = (async (): Promise<JwksCacheEntry> => {\n try {\n const url = `${issuer.replace(/\\/$/, '')}${ENVELOPE_JWKS_PATH}`;\n const res = await fetch(url, { headers: { Accept: 'application/json' } });\n if (!res.ok) throw new Error(`envelope JWKS fetch ${url} returned ${res.status}`);\n const json = (await res.json()) as { keys: OcEnvelopePublicJwk[] };\n if (!json || !Array.isArray(json.keys)) {\n throw new Error(`envelope JWKS at ${url} did not return {keys:[…]}`);\n }\n const keys: Record<string, AuthKey> = {};\n for (const k of json.keys) {\n if (typeof k.kid !== 'string') continue;\n try {\n keys[k.kid] = (await importJWK(k, 'EdDSA')) as AuthKey;\n } catch {\n /* skip keys that won't import */\n }\n }\n const entry: JwksCacheEntry = { keys, fetchedAt: Date.now() };\n jwksCache.set(issuer, entry);\n return entry;\n } catch (err) {\n const stale = jwksCache.get(issuer);\n if (stale) return stale;\n throw err;\n }\n })().finally(() => {\n inflight.delete(issuer);\n });\n inflight.set(issuer, p);\n return p;\n}\n\nfunction hexToBytes(hex: string): Uint8Array | null {\n if (typeof hex !== 'string') return null;\n const s = hex.trim();\n if (s.length === 0 || s.length % 2 !== 0) return null;\n const out = new Uint8Array(s.length / 2);\n for (let i = 0; i < out.length; i++) {\n const b = parseInt(s.slice(i * 2, i * 2 + 2), 16);\n if (Number.isNaN(b)) return null;\n out[i] = b;\n }\n return out;\n}\n\nfunction base64ToBytes(b64: string): Uint8Array | null {\n try {\n const bin =\n typeof atob === 'function'\n ? atob(b64)\n : Buffer.from(b64, 'base64').toString('binary');\n const out = new Uint8Array(bin.length);\n for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);\n return out;\n } catch {\n return null;\n }\n}\n\nfunction bytesToHex(bytes: Uint8Array): string {\n let out = '';\n for (const b of bytes) out += b.toString(16).padStart(2, '0');\n return out;\n}\n\nasync function sha256(bytes: Uint8Array): Promise<Uint8Array> {\n const subtle =\n typeof globalThis.crypto !== 'undefined' && globalThis.crypto.subtle\n ? globalThis.crypto.subtle\n : null;\n if (!subtle) {\n throw new Error('crypto.subtle unavailable · need Node 20+ / modern browser / Edge runtime');\n }\n const buf = await subtle.digest('SHA-256', bytes as unknown as ArrayBuffer);\n return new Uint8Array(buf);\n}\n\nfunction toArrayBuffer(view: Uint8Array): ArrayBuffer {\n const buf = new ArrayBuffer(view.byteLength);\n new Uint8Array(buf).set(view);\n return buf;\n}\n\nasync function verifyEd25519(\n key: AuthKey,\n sig: Uint8Array,\n msg: Uint8Array\n): Promise<boolean> {\n const subtle =\n typeof globalThis.crypto !== 'undefined' && globalThis.crypto.subtle\n ? globalThis.crypto.subtle\n : null;\n if (!subtle) return false;\n try {\n return await subtle.verify(\n 'Ed25519',\n key as CryptoKey,\n toArrayBuffer(sig),\n toArrayBuffer(msg)\n );\n } catch {\n return false;\n }\n}\n\n/**\n * Verify a signed activity attestation bundle. Returns a typed\n * ActivityVerifyResult with per-check detail · never throws (network\n * + parse failures surface as ok=false rows in the checks array, so\n * the caller can log them without try/catch).\n *\n * Five checks, in order: bundle shape, canonical-bytes hash matches\n * id, JWK with matching kid present, ed25519 signature, freshness.\n */\nexport async function verifyActivityAttestation(\n bundle: ActivityAttestationBundle,\n options: VerifyActivityOptions = {}\n): Promise<ActivityVerifyResult> {\n const checks: ActivityVerifyCheck[] = [];\n\n // 1. Bundle shape\n const shapeOk =\n !!bundle &&\n typeof bundle === 'object' &&\n typeof bundle.sig === 'string' &&\n typeof bundle.kid === 'string' &&\n typeof bundle.canonical_b64 === 'string' &&\n !!bundle.attestation &&\n typeof bundle.attestation.id === 'string' &&\n typeof bundle.attestation.expires_at === 'string';\n checks.push({\n ok: shapeOk,\n label: 'bundle shape · sig / kid / canonical_b64 / attestation',\n });\n if (!shapeOk) {\n return { ok: false, reason: 'bundle shape invalid', checks };\n }\n\n const a = bundle.attestation;\n\n // 2. canonical_b64 decodes\n const canonical = base64ToBytes(bundle.canonical_b64);\n checks.push({\n ok: canonical !== null,\n label: 'canonical_b64 decodes',\n detail: canonical ? `${canonical.length} bytes` : 'invalid base64',\n });\n if (!canonical) return { ok: false, reason: 'canonical_b64 invalid base64', checks, attestation: a };\n\n // 3. sha256 === id\n const digest = await sha256(canonical);\n const computedId = bytesToHex(digest);\n const idOk = computedId === a.id;\n checks.push({\n ok: idOk,\n label: 'sha256(canonical_bytes) === id',\n detail: idOk ? a.id : `expected ${a.id}, got ${computedId}`,\n });\n if (!idOk) return { ok: false, reason: 'id does not match canonical-bytes hash', checks, attestation: a };\n\n // 4. JWK lookup + ed25519 verify\n let key: AuthKey | null = null;\n if (options.jwk) {\n if (options.jwk.kid !== bundle.kid) {\n checks.push({\n ok: false,\n label: 'JWK with matching kid present',\n detail: `provided jwk.kid=${options.jwk.kid} but bundle.kid=${bundle.kid}`,\n });\n return { ok: false, reason: 'kid mismatch with provided jwk', checks, attestation: a };\n }\n try {\n key = (await importJWK(options.jwk, 'EdDSA')) as AuthKey;\n checks.push({ ok: true, label: 'JWK with matching kid present', detail: `kid ${bundle.kid} (provided)` });\n } catch (err) {\n checks.push({\n ok: false,\n label: 'JWK with matching kid present',\n detail: `provided jwk failed import: ${(err as Error).message}`,\n });\n return { ok: false, reason: 'provided jwk failed import', checks, attestation: a };\n }\n } else {\n const issuer = options.issuer ?? DEFAULT_ISSUER;\n const ttl = options.jwksCacheTtlMs ?? DEFAULT_TTL_MS;\n try {\n let entry = await fetchEnvelopeJwks(issuer, ttl);\n key = entry.keys[bundle.kid] ?? null;\n if (!key) {\n // Cache miss · likely a rotation. Force-refresh once.\n jwksCache.delete(issuer);\n entry = await fetchEnvelopeJwks(issuer, ttl);\n key = entry.keys[bundle.kid] ?? null;\n }\n checks.push({\n ok: !!key,\n label: 'JWK with matching kid present',\n detail: key ? `kid ${bundle.kid}` : `no JWK with kid ${bundle.kid} at ${issuer}${ENVELOPE_JWKS_PATH}`,\n });\n if (!key) {\n return { ok: false, reason: `kid ${bundle.kid} not in envelope JWKS`, checks, attestation: a };\n }\n } catch (err) {\n checks.push({\n ok: false,\n label: 'JWK with matching kid present',\n detail: `envelope JWKS unavailable: ${(err as Error).message}`,\n });\n return {\n ok: false,\n reason: `envelope JWKS unavailable: ${(err as Error).message}`,\n checks,\n attestation: a,\n };\n }\n }\n\n const sigBytes = hexToBytes(bundle.sig);\n if (!sigBytes) {\n checks.push({\n ok: false,\n label: 'ed25519.verify(sig, canonical_bytes, jwk.public)',\n detail: 'malformed sig (expected hex)',\n });\n return { ok: false, reason: 'malformed sig', checks, attestation: a };\n }\n const sigOk = await verifyEd25519(key, sigBytes, canonical);\n checks.push({\n ok: sigOk,\n label: 'ed25519.verify(sig, canonical_bytes, jwk.public)',\n detail: sigOk ? 'signature valid' : 'signature does not match',\n });\n if (!sigOk) return { ok: false, reason: 'signature does not match', checks, attestation: a };\n\n // 5. Freshness\n const now = options.now ?? new Date();\n const expiresMs = Date.parse(a.expires_at);\n const freshOk = Number.isFinite(expiresMs) && expiresMs > now.getTime();\n checks.push({\n ok: freshOk,\n label: 'now < attestation.expires_at',\n detail: freshOk\n ? `expires ${new Date(expiresMs).toISOString()}`\n : 'attestation has expired',\n });\n if (!freshOk) return { ok: false, reason: 'attestation has expired', checks, attestation: a };\n\n return { ok: true, attestation: a, checks };\n}\n\n/** Force-refresh the envelope-JWKS cache · useful after a key rotation\n * if you don't want to wait for the TTL to expire. */\nexport async function refreshEnvelopeJwks(issuer = DEFAULT_ISSUER): Promise<void> {\n jwksCache.delete(issuer);\n await fetchEnvelopeJwks(issuer, DEFAULT_TTL_MS);\n}\n\nexport const identity = {\n verifyActivityAttestation,\n refreshEnvelopeJwks,\n};\n","/**\n * @orangecheck/me-client/server\n *\n * Server-side verification helpers for OC integrators.\n *\n * import {\n * withOcAuth,\n * getOcSession,\n * verifyOcToken,\n * verifyActivityAttestation,\n * } from '@orangecheck/me-client/server';\n *\n * Zero env vars, zero JWK handling. Internally lazy-fetches the auth\n * host's JWKS at https://ochk.io/.well-known/jwks.json and the\n * envelope JWKS at https://me.ochk.io/.well-known/oc-envelope-jwks.json,\n * caches both in-process. Integrators write code; we handle the crypto.\n *\n * Three layers of session verification, smallest to thickest:\n *\n * verifyOcToken(token) → SessionPayload | null\n * getOcSession(headers) → SessionPayload | null (cookie OR Bearer)\n * withOcAuth(handler) → Next.js Pages adapter that injects\n * req.ocSession on the request object\n * ocAuthExpress(opts?) → Express / Connect middleware\n * ocAuthHono(opts?) → Hono middleware\n *\n * Plus the activity-attestation verifier · for sybil-resistance gating:\n *\n * verifyActivityAttestation(bundle, opts?) → ActivityVerifyResult\n *\n * Same envelope-JWKS verification posture as the public /verify-activity\n * page; same five checks (shape / id / kid / sig / freshness). Use to\n * gate sensitive flows on cross-integrator lifetime_sats + duration +\n * distinct_count + active_days · all values are content-addressed and\n * signed.\n *\n * All thin wrappers around the same crypto primitives. Bring your own\n * framework.\n */\n\nimport {\n bondMeets,\n getOcSession as getOcSessionCore,\n readBondClaim,\n verifyOcToken,\n type BondClaim,\n type SessionPayload,\n type VerifyOcOptions,\n type SessionRequestHeaders,\n} from '@orangecheck/auth-core';\n\nexport { bondMeets, readBondClaim, verifyOcToken };\nexport type { BondClaim, SessionPayload, VerifyOcOptions };\n\n// Activity-attestation verifier · re-export from the identity module so\n// server-side integrators get the gating helper alongside session\n// verification without a second import path.\nexport {\n identity,\n verifyActivityAttestation,\n refreshEnvelopeJwks,\n} from './identity';\nexport type {\n ActivityAttestation,\n ActivityAttestationBundle,\n ActivityVerifyCheck,\n ActivityVerifyResult,\n VerifyActivityOptions,\n} from './identity';\n\n/**\n * Verify the OC session for a request. Accepts either:\n *\n * - A Web Headers object (Hono / edge / Fetch API): `c.req.raw.headers`\n * - A plain `{ cookie, authorization }` object (Express / Next.js Pages /\n * Fastify / etc.): `{ cookie: req.headers.cookie, authorization: req.headers.authorization }`\n *\n * Reads the `oc_session` cookie first; falls back to\n * `Authorization: Bearer <token>` so cross-domain integrators (no\n * .ochk.io cookie reach) verify the same way.\n *\n * Returns `null` for unauthenticated requests. Never throws.\n */\nexport async function getOcSession(\n headers: SessionRequestHeaders | Headers,\n options: VerifyOcOptions = {}\n): Promise<SessionPayload | null> {\n const session = await getOcSessionCore(headers, options);\n if (!session && options.audience === undefined) warnIfAudienceMissing(headers);\n return session;\n}\n\nlet warnedAudience = false;\n\n/**\n * The popup issues a token bound to your site's origin. Verified with no\n * `audience`, it is refused — correctly, since a verifier with no audience\n * accepts only family sessions — and every popup sign-in would 401 with no\n * clue why. Say so, once, the first time it happens.\n */\nfunction warnIfAudienceMissing(headers: SessionRequestHeaders | Headers): void {\n if (warnedAudience) return;\n const auth =\n typeof Headers !== 'undefined' && headers instanceof Headers\n ? headers.get('authorization')\n : (headers as SessionRequestHeaders).authorization;\n const m = typeof auth === 'string' ? /^Bearer\\s+([^.]+)\\.([^.]+)\\./i.exec(auth) : null;\n if (!m) return;\n try {\n const payload = JSON.parse(base64UrlToString(m[2]!)) as { aud?: unknown };\n if (payload.aud === undefined) return;\n warnedAudience = true;\n console.warn(\n `[@orangecheck/me-client] a sign-in token bound to ${JSON.stringify(payload.aud)} was refused ` +\n 'because no `audience` is configured. Pass your site origin, e.g. ' +\n \"withOcAuth(handler, { audience: 'https://your-site.example' }).\"\n );\n } catch {\n // Not a JWT we can read · nothing useful to say.\n }\n}\n\nfunction base64UrlToString(s: string): string {\n const b64 = s.replace(/-/g, '+').replace(/_/g, '/');\n if (typeof atob === 'function') return atob(b64 + '='.repeat((4 - (b64.length % 4)) % 4));\n return Buffer.from(s, 'base64url').toString('utf8');\n}\n\n// ─── Next.js Pages Router adapter ────────────────────────────────────────\n\ninterface NextApiRequestLike {\n headers: { cookie?: string; authorization?: string; [k: string]: unknown };\n ocSession?: SessionPayload | null;\n}\ninterface NextApiResponseLike {\n status(code: number): NextApiResponseLike;\n json(body: unknown): unknown;\n setHeader(name: string, value: string | number | readonly string[]): unknown;\n}\ntype NextApiHandlerLike = (req: NextApiRequestLike, res: NextApiResponseLike) => unknown | Promise<unknown>;\n\nexport interface WithOcAuthOptions extends VerifyOcOptions {\n /** When true, unauthenticated requests get a 401 + `{ok:false}` response\n * before the wrapped handler runs. Default: false — handler runs and\n * receives `req.ocSession === null`, useful when the route serves both\n * signed-in and anonymous users. */\n required?: boolean;\n /**\n * Refuse a signed-in account (403, `reason: 'bond_required'`) unless a\n * bond backs it: one unspent coin of at least `minSats`, unspent at least\n * `minDays` days, checked within `maxAgeSecs`. The app never learns the\n * coin; `req.ocSession.oc_bond.nullifier` is the same for the same coin at\n * your site, so ban that to ban the coin. Implies `required`.\n */\n requireBond?: { minSats?: number; minDays?: number; maxAgeSecs?: number };\n /**\n * Your project key. The requirement you set in the project's settings\n * (\"who can sign in\") is read from its public config and enforced like\n * `requireBond`, so you change it there, not in code. An explicit\n * `requireBond` wins over it.\n */\n projectKey?: string;\n /** Where the project config is read. Default https://me.ochk.io. */\n meOrigin?: string;\n}\n\ntype BondNeed = NonNullable<WithOcAuthOptions['requireBond']>;\nconst POLICY_TTL_MS = 5 * 60_000;\nconst policies = new Map<string, { at: number; need: BondNeed | null }>();\n\n/**\n * The project's published requirement, cached five minutes. When the config\n * can't be read, the last one read stands; with none read yet it is\n * `undefined`, and the request is refused rather than let through unchecked.\n */\nasync function projectRequirement(options: WithOcAuthOptions): Promise<BondNeed | null | undefined> {\n const key = options.projectKey!;\n const hit = policies.get(key);\n if (hit && Date.now() - hit.at < POLICY_TTL_MS) return hit.need;\n try {\n const base = options.meOrigin ?? 'https://me.ochk.io';\n const r = await fetch(`${base}/api/integrator/config?project_key=${encodeURIComponent(key)}`, {\n signal: AbortSignal.timeout(4000),\n });\n if (!r.ok) throw new Error(`HTTP ${r.status}`);\n const j = (await r.json()) as {\n config?: { require_bond?: { min_sats: number; min_days: number } | null };\n };\n const req = j.config?.require_bond ?? null;\n const need = req ? { minSats: req.min_sats, minDays: req.min_days } : null;\n policies.set(key, { at: Date.now(), need });\n return need;\n } catch {\n return hit?.need;\n }\n}\n\n/** The requirement in force: explicit, else the project's, else none. */\nasync function bondNeed(options: WithOcAuthOptions): Promise<BondNeed | null | undefined> {\n if (options.requireBond) return options.requireBond;\n if (options.projectKey) return projectRequirement(options);\n return null;\n}\n\n/** Why a session can't pass, as a status and body, or null when it can. */\nasync function refusal(\n session: SessionPayload | null,\n options: WithOcAuthOptions\n): Promise<{ status: number; body: Record<string, unknown> } | null> {\n const need = await bondNeed(options);\n if (!session) {\n return options.required || need !== null\n ? { status: 401, body: { ok: false, reason: 'unauthenticated' } }\n : null;\n }\n if (need === undefined) {\n return { status: 503, body: { ok: false, reason: 'bond_policy_unavailable' } };\n }\n if (need && !bondMeets(session, need)) {\n const have = readBondClaim(session);\n return {\n status: 403,\n body: {\n ok: false,\n reason: 'bond_required',\n need,\n have: have ? { sats_floor: have.sats_floor, days_floor: have.days_floor } : null,\n },\n };\n }\n return null;\n}\n\n/**\n * Wrap a Next.js Pages-Router API route handler. Adds `req.ocSession` —\n * the verified SessionPayload, or null when unauthenticated.\n *\n * // pages/api/me/profile.ts\n * import { withOcAuth } from '@orangecheck/me-client/server';\n *\n * export default withOcAuth(async (req, res) => {\n * if (!req.ocSession) return res.status(401).json({ ok: false });\n * res.status(200).json({ account: { address: req.ocSession.did_oc } });\n * }, { required: true, audience: 'https://your-site.example' });\n *\n * `audience` is your own origin. The sign-in popup issues each site a token\n * bound to it; a site on *.ochk.io that reads the family cookie omits it.\n *\n * `Cache-Control: no-store, private` and `Vary: Cookie, Authorization`\n * are set on every authenticated response — without them a cached 401\n * leaks anonymous to authenticated callers.\n */\nexport function withOcAuth<T extends NextApiHandlerLike>(\n handler: T,\n options: WithOcAuthOptions = {}\n): T {\n const wrapped = async (req: NextApiRequestLike, res: NextApiResponseLike) => {\n res.setHeader('Cache-Control', 'no-store, private');\n res.setHeader('Vary', 'Cookie, Authorization');\n const session = await getOcSession(\n {\n cookie: typeof req.headers.cookie === 'string' ? req.headers.cookie : null,\n authorization:\n typeof req.headers.authorization === 'string'\n ? req.headers.authorization\n : null,\n },\n options\n );\n req.ocSession = session;\n const refused = await refusal(session, options);\n if (refused) return res.status(refused.status).json(refused.body);\n return handler(req, res);\n };\n return wrapped as unknown as T;\n}\n\n// ─── Express / Connect middleware ────────────────────────────────────────\n\ninterface ExpressRequestLike {\n headers: { cookie?: string; authorization?: string; [k: string]: unknown };\n ocSession?: SessionPayload | null;\n}\ninterface ExpressResponseLike {\n status(code: number): ExpressResponseLike;\n json(body: unknown): unknown;\n setHeader(name: string, value: string | number | readonly string[]): unknown;\n}\ntype ExpressNextLike = (err?: unknown) => void;\n\n/**\n * Express / Connect middleware. Attaches `req.ocSession` (verified\n * SessionPayload | null) and calls next(). Use it as a global middleware\n * or per-route.\n *\n * import express from 'express';\n * import { ocAuthExpress } from '@orangecheck/me-client/server';\n *\n * const app = express();\n * app.use(ocAuthExpress());\n *\n * app.get('/api/profile', (req, res) => {\n * if (!req.ocSession) return res.status(401).json({ error: 'sign in' });\n * res.json({ address: req.ocSession.did_oc });\n * });\n *\n * Pass `{ required: true }` to short-circuit unauthenticated requests\n * with a 401 before they reach your handler.\n */\nexport function ocAuthExpress(options: WithOcAuthOptions = {}) {\n return async (req: ExpressRequestLike, res: ExpressResponseLike, next: ExpressNextLike) => {\n try {\n res.setHeader('Cache-Control', 'no-store, private');\n res.setHeader('Vary', 'Cookie, Authorization');\n const session = await getOcSession(\n {\n cookie: typeof req.headers.cookie === 'string' ? req.headers.cookie : null,\n authorization:\n typeof req.headers.authorization === 'string'\n ? req.headers.authorization\n : null,\n },\n options\n );\n req.ocSession = session;\n const refused = await refusal(session, options);\n if (refused) {\n res.status(refused.status).json(refused.body);\n return;\n }\n next();\n } catch (err) {\n next(err);\n }\n };\n}\n\n// ─── Hono middleware ─────────────────────────────────────────────────────\n\ninterface HonoContextLike {\n req: { raw: { headers: Headers } };\n set(key: string, value: unknown): void;\n json(body: unknown, status?: number): unknown;\n header(name: string, value: string): void;\n}\ntype HonoNextLike = () => Promise<void>;\n\n/**\n * Hono middleware. Attaches the verified session at `c.get('ocSession')`.\n *\n * import { Hono } from 'hono';\n * import { ocAuthHono } from '@orangecheck/me-client/server';\n *\n * const app = new Hono();\n * app.use('*', ocAuthHono());\n *\n * app.get('/api/profile', (c) => {\n * const session = c.get('ocSession');\n * if (!session) return c.json({ error: 'sign in' }, 401);\n * return c.json({ address: session.did_oc });\n * });\n */\nexport function ocAuthHono(options: WithOcAuthOptions = {}) {\n return async (c: HonoContextLike, next: HonoNextLike) => {\n c.header('Cache-Control', 'no-store, private');\n c.header('Vary', 'Cookie, Authorization');\n const session = await getOcSession(c.req.raw.headers, options);\n c.set('ocSession', session);\n const refused = await refusal(session, options);\n if (refused) return c.json(refused.body, refused.status);\n await next();\n };\n}\n"]}
1
+ {"version":3,"sources":["../node_modules/jose/dist/webapi/lib/buffer_utils.js","../node_modules/jose/dist/webapi/lib/base64.js","../node_modules/jose/dist/webapi/util/base64url.js","../node_modules/jose/dist/webapi/util/errors.js","../node_modules/jose/dist/webapi/lib/type_checks.js","../node_modules/jose/dist/webapi/lib/jwk_to_key.js","../node_modules/jose/dist/webapi/key/import.js","../src/identity.ts","../src/server.ts"],"names":["getOcSessionCore","bondMeets","readBondClaim"],"mappings":";;;;;;;;;AAAuB,IAAI,WAAA;AACpB,IAAM,OAAA,GAAU,IAAI,WAAA,EAAY;;;ACUhC,SAAS,aAAa,OAAA,EAAS;AAClC,EAAA,IAAI,WAAW,UAAA,EAAY;AACvB,IAAA,OAAO,UAAA,CAAW,WAAW,OAAO,CAAA;AAAA,EACxC;AACA,EAAA,MAAM,MAAA,GAAS,KAAK,OAAO,CAAA;AAC3B,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,MAAA,CAAO,MAAM,CAAA;AAC1C,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,QAAQ,CAAA,EAAA,EAAK;AACpC,IAAA,KAAA,CAAM,CAAC,CAAA,GAAI,MAAA,CAAO,UAAA,CAAW,CAAC,CAAA;AAAA,EAClC;AACA,EAAA,OAAO,KAAA;AACX;;;ACnBO,SAAS,OAAO,KAAA,EAAO;AAC1B,EAAA,IAAI,WAAW,UAAA,EAAY;AACvB,IAAA,OAAO,UAAA,CAAW,WAAW,OAAO,KAAA,KAAU,WAAW,KAAA,GAAQ,OAAA,CAAQ,MAAA,CAAO,KAAK,CAAA,EAAG;AAAA,MACpF,QAAA,EAAU;AAAA,KACb,CAAA;AAAA,EACL;AACA,EAAA,IAAI,OAAA,GAAU,KAAA;AACd,EAAA,IAAI,mBAAmB,UAAA,EAAY;AAC/B,IAAA,OAAA,GAAU,OAAA,CAAQ,OAAO,OAAO,CAAA;AAAA,EACpC;AACA,EAAA,OAAA,GAAU,QAAQ,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AACtD,EAAA,IAAI;AACA,IAAA,OAAO,aAAa,OAAO,CAAA;AAAA,EAC/B,CAAA,CAAA,MACM;AACF,IAAA,MAAM,IAAI,UAAU,mDAAmD,CAAA;AAAA,EAC3E;AACJ;;;ACnBO,IAAM,SAAA,GAAN,cAAwB,KAAA,CAAM;AAAA,EAGjC,WAAA,CAAY,SAAS,OAAA,EAAS;AAC1B,IAAA,KAAA,CAAM,SAAS,OAAO,CAAA;AAF1B,IAAA,aAAA,CAAA,IAAA,EAAA,MAAA,EAAO,kBAAA,CAAA;AAGH,IAAA,IAAA,CAAK,IAAA,GAAO,KAAK,WAAA,CAAY,IAAA;AAC7B,IAAA,KAAA,CAAM,iBAAA,GAAoB,IAAA,EAAM,IAAA,CAAK,WAAW,CAAA;AAAA,EACpD;AACJ,CAAA;AAPI,aAAA,CADS,WACF,MAAA,EAAO,kBAAA,CAAA;AAsCX,IAAM,gBAAA,GAAN,cAA+B,SAAA,CAAU;AAAA,EAAzC,WAAA,GAAA;AAAA,IAAA,KAAA,CAAA,GAAA,SAAA,CAAA;AAEH,IAAA,aAAA,CAAA,IAAA,EAAA,MAAA,EAAO,wBAAA,CAAA;AAAA,EAAA;AACX,CAAA;AAFI,aAAA,CADS,kBACF,MAAA,EAAO,wBAAA,CAAA;AAxClB,IAAA,EAAA,EAAA,EAAA;AA6EO,IAAM,wBAAA,GAAN,eAAuC,EAAA,GAAA,SAAA,EACzC,EAAA,GAAA,MAAA,CAAO,eADkC,EAAA,EAAU;AAAA,EAIpD,WAAA,CAAY,OAAA,GAAU,sDAAA,EAAwD,OAAA,EAAS;AACnF,IAAA,KAAA,CAAM,SAAS,OAAO,CAAA;AAJ1B,IAAA,aAAA,CAAA,IAAA,EAAC,EAAA,CAAA;AAED,IAAA,aAAA,CAAA,IAAA,EAAA,MAAA,EAAO,iCAAA,CAAA;AAAA,EAGP;AACJ,CAAA;AALI,aAAA,CAFS,0BAEF,MAAA,EAAO,iCAAA,CAAA;;;AC/ElB,IAAM,eAAe,CAAC,KAAA,KAAU,OAAO,KAAA,KAAU,YAAY,KAAA,KAAU,IAAA;AAChE,SAAS,SAAS,KAAA,EAAO;AAC5B,EAAA,IAAI,CAAC,YAAA,CAAa,KAAK,CAAA,IAAK,MAAA,CAAO,UAAU,QAAA,CAAS,IAAA,CAAK,KAAK,CAAA,KAAM,iBAAA,EAAmB;AACrF,IAAA,OAAO,KAAA;AAAA,EACX;AACA,EAAA,IAAI,MAAA,CAAO,cAAA,CAAe,KAAK,CAAA,KAAM,IAAA,EAAM;AACvC,IAAA,OAAO,IAAA;AAAA,EACX;AACA,EAAA,IAAI,KAAA,GAAQ,KAAA;AACZ,EAAA,OAAO,MAAA,CAAO,cAAA,CAAe,KAAK,CAAA,KAAM,IAAA,EAAM;AAC1C,IAAA,KAAA,GAAQ,MAAA,CAAO,eAAe,KAAK,CAAA;AAAA,EACvC;AACA,EAAA,OAAO,MAAA,CAAO,cAAA,CAAe,KAAK,CAAA,KAAM,KAAA;AAC5C;;;ACZA,IAAM,cAAA,GAAiB,8DAAA;AACvB,SAAS,cAAc,GAAA,EAAK;AACxB,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI,SAAA;AACJ,EAAA,QAAQ,IAAI,GAAA;AAAK,IACb,KAAK,KAAA,EAAO;AACR,MAAA,QAAQ,IAAI,GAAA;AAAK,QACb,KAAK,WAAA;AAAA,QACL,KAAK,WAAA;AAAA,QACL,KAAK,WAAA;AACD,UAAA,SAAA,GAAY,EAAE,IAAA,EAAM,GAAA,CAAI,GAAA,EAAI;AAC5B,UAAA,SAAA,GAAY,IAAI,IAAA,GAAO,CAAC,MAAM,CAAA,GAAI,CAAC,QAAQ,CAAA;AAC3C,UAAA;AAAA,QACJ;AACI,UAAA,MAAM,IAAI,iBAAiB,cAAc,CAAA;AAAA;AAEjD,MAAA;AAAA,IACJ;AAAA,IACA,KAAK,KAAA,EAAO;AACR,MAAA,QAAQ,IAAI,GAAA;AAAK,QACb,KAAK,OAAA;AAAA,QACL,KAAK,OAAA;AAAA,QACL,KAAK,OAAA;AACD,UAAA,SAAA,GAAY,EAAE,IAAA,EAAM,SAAA,EAAW,IAAA,EAAM,CAAA,IAAA,EAAO,IAAI,GAAA,CAAI,KAAA,CAAM,EAAE,CAAC,CAAA,CAAA,EAAG;AAChE,UAAA,SAAA,GAAY,IAAI,CAAA,GAAI,CAAC,MAAM,CAAA,GAAI,CAAC,QAAQ,CAAA;AACxC,UAAA;AAAA,QACJ,KAAK,OAAA;AAAA,QACL,KAAK,OAAA;AAAA,QACL,KAAK,OAAA;AACD,UAAA,SAAA,GAAY,EAAE,IAAA,EAAM,mBAAA,EAAqB,IAAA,EAAM,CAAA,IAAA,EAAO,IAAI,GAAA,CAAI,KAAA,CAAM,EAAE,CAAC,CAAA,CAAA,EAAG;AAC1E,UAAA,SAAA,GAAY,IAAI,CAAA,GAAI,CAAC,MAAM,CAAA,GAAI,CAAC,QAAQ,CAAA;AACxC,UAAA;AAAA,QACJ,KAAK,UAAA;AAAA,QACL,KAAK,cAAA;AAAA,QACL,KAAK,cAAA;AAAA,QACL,KAAK,cAAA;AACD,UAAA,SAAA,GAAY;AAAA,YACR,IAAA,EAAM,UAAA;AAAA,YACN,IAAA,EAAM,CAAA,IAAA,EAAO,QAAA,CAAS,GAAA,CAAI,GAAA,CAAI,MAAM,EAAE,CAAA,EAAG,EAAE,CAAA,IAAK,CAAC,CAAA;AAAA,WACrD;AACA,UAAA,SAAA,GAAY,GAAA,CAAI,IAAI,CAAC,SAAA,EAAW,WAAW,CAAA,GAAI,CAAC,WAAW,SAAS,CAAA;AACpE,UAAA;AAAA,QACJ;AACI,UAAA,MAAM,IAAI,iBAAiB,cAAc,CAAA;AAAA;AAEjD,MAAA;AAAA,IACJ;AAAA,IACA,KAAK,IAAA,EAAM;AACP,MAAA,QAAQ,IAAI,GAAA;AAAK,QACb,KAAK,OAAA;AAAA,QACL,KAAK,OAAA;AAAA,QACL,KAAK,OAAA;AACD,UAAA,SAAA,GAAY;AAAA,YACR,IAAA,EAAM,OAAA;AAAA,YACN,UAAA,EAAY,EAAE,KAAA,EAAO,OAAA,EAAS,KAAA,EAAO,SAAS,KAAA,EAAO,OAAA,EAAQ,CAAE,GAAA,CAAI,GAAG;AAAA,WAC1E;AACA,UAAA,SAAA,GAAY,IAAI,CAAA,GAAI,CAAC,MAAM,CAAA,GAAI,CAAC,QAAQ,CAAA;AACxC,UAAA;AAAA,QACJ,KAAK,SAAA;AAAA,QACL,KAAK,gBAAA;AAAA,QACL,KAAK,gBAAA;AAAA,QACL,KAAK,gBAAA;AACD,UAAA,SAAA,GAAY,EAAE,IAAA,EAAM,MAAA,EAAQ,UAAA,EAAY,IAAI,GAAA,EAAI;AAChD,UAAA,SAAA,GAAY,GAAA,CAAI,CAAA,GAAI,CAAC,YAAY,IAAI,EAAC;AACtC,UAAA;AAAA,QACJ;AACI,UAAA,MAAM,IAAI,iBAAiB,cAAc,CAAA;AAAA;AAEjD,MAAA;AAAA,IACJ;AAAA,IACA,KAAK,KAAA,EAAO;AACR,MAAA,QAAQ,IAAI,GAAA;AAAK,QACb,KAAK,SAAA;AAAA,QACL,KAAK,OAAA;AACD,UAAA,SAAA,GAAY,EAAE,MAAM,SAAA,EAAU;AAC9B,UAAA,SAAA,GAAY,IAAI,CAAA,GAAI,CAAC,MAAM,CAAA,GAAI,CAAC,QAAQ,CAAA;AACxC,UAAA;AAAA,QACJ,KAAK,SAAA;AAAA,QACL,KAAK,gBAAA;AAAA,QACL,KAAK,gBAAA;AAAA,QACL,KAAK,gBAAA;AACD,UAAA,SAAA,GAAY,EAAE,IAAA,EAAM,GAAA,CAAI,GAAA,EAAI;AAC5B,UAAA,SAAA,GAAY,GAAA,CAAI,CAAA,GAAI,CAAC,YAAY,IAAI,EAAC;AACtC,UAAA;AAAA,QACJ;AACI,UAAA,MAAM,IAAI,iBAAiB,cAAc,CAAA;AAAA;AAEjD,MAAA;AAAA,IACJ;AAAA,IACA;AACI,MAAA,MAAM,IAAI,iBAAiB,6DAA6D,CAAA;AAAA;AAEhG,EAAA,OAAO,EAAE,WAAW,SAAA,EAAU;AAClC;AACA,eAAsB,SAAS,GAAA,EAAK;AAChC,EAAA,IAAI,CAAC,IAAI,GAAA,EAAK;AACV,IAAA,MAAM,IAAI,UAAU,0DAA0D,CAAA;AAAA,EAClF;AACA,EAAA,MAAM,EAAE,SAAA,EAAW,SAAA,EAAU,GAAI,cAAc,GAAG,CAAA;AAClD,EAAA,MAAM,OAAA,GAAU,EAAE,GAAG,GAAA,EAAI;AACzB,EAAA,IAAI,OAAA,CAAQ,QAAQ,KAAA,EAAO;AACvB,IAAA,OAAO,OAAA,CAAQ,GAAA;AAAA,EACnB;AACA,EAAA,OAAO,OAAA,CAAQ,GAAA;AACf,EAAA,OAAO,OAAO,MAAA,CAAO,SAAA,CAAU,KAAA,EAAO,OAAA,EAAS,WAAW,GAAA,CAAI,GAAA,KAAQ,GAAA,CAAI,CAAA,IAAK,IAAI,IAAA,GAAO,KAAA,GAAQ,IAAA,CAAA,EAAO,GAAA,CAAI,WAAW,SAAS,CAAA;AACrI;;;ACnFA,eAAsB,SAAA,CAAU,GAAA,EAAK,GAAA,EAAK,OAAA,EAAS;AAC/C,EAAA,IAAI,CAAC,QAAA,CAAS,GAAG,CAAA,EAAG;AAChB,IAAA,MAAM,IAAI,UAAU,uBAAuB,CAAA;AAAA,EAC/C;AACA,EAAA,IAAI,GAAA;AAEJ,EAAA,GAAA,KAAA,GAAA,GAAgC,GAAA,CAAI,GAAA,CAAA;AACpC,EAAA,QAAQ,IAAI,GAAA;AAAK,IACb,KAAK,KAAA;AACD,MAAA,IAAI,OAAO,GAAA,CAAI,CAAA,KAAM,QAAA,IAAY,CAAC,IAAI,CAAA,EAAG;AACrC,QAAA,MAAM,IAAI,UAAU,yCAAyC,CAAA;AAAA,MACjE;AACA,MAAA,OAAO,MAAA,CAAgB,IAAI,CAAC,CAAA;AAAA,IAChC,KAAK,KAAA;AACD,MAAA,IAAI,KAAA,IAAS,GAAA,IAAO,GAAA,CAAI,GAAA,KAAQ,MAAA,EAAW;AACvC,QAAA,MAAM,IAAI,iBAAiB,oEAAoE,CAAA;AAAA,MACnG;AACA,MAAA,OAAO,SAAS,EAAE,GAAG,GAAA,EAAK,GAAA,EAAK,KAAK,CAAA;AAAA,IACxC,KAAK,KAAA,EAAO;AACR,MAAA,IAAI,OAAO,GAAA,CAAI,GAAA,KAAQ,QAAA,IAAY,CAAC,IAAI,GAAA,EAAK;AACzC,QAAA,MAAM,IAAI,UAAU,2CAA2C,CAAA;AAAA,MACnE;AACA,MAAA,IAAyB,GAAA,KAAQ,GAAA,CAAI,GAAA,EAAK;AACtC,QAAA,MAAM,IAAI,UAAU,uCAAuC,CAAA;AAAA,MAC/D;AACA,MAAA,OAAO,QAAA,CAAS,EAAE,GAAG,GAAA,EAAK,KAAK,CAAA;AAAA,IACnC;AAAA,IACA,KAAK,IAAA;AAAA,IACL,KAAK,KAAA;AACD,MAAA,OAAO,SAAS,EAAE,GAAG,GAAA,EAAK,GAAA,EAAK,KAAK,CAAA;AAAA,IACxC;AACI,MAAA,MAAM,IAAI,iBAAiB,8CAA8C,CAAA;AAAA;AAErF;;;AClCA,IAAM,cAAA,GAAiB,oBAAA;AACvB,IAAM,cAAA,GAAiB,KAAK,EAAA,GAAK,GAAA;AACjC,IAAM,kBAAA,GAAqB,oCAAA;AAoE3B,IAAM,SAAA,uBAAgB,GAAA,EAA4B;AAClD,IAAM,QAAA,uBAAe,GAAA,EAAqC;AAE1D,eAAe,iBAAA,CAAkB,QAAgB,KAAA,EAAwC;AACrF,EAAA,MAAM,MAAA,GAAS,SAAA,CAAU,GAAA,CAAI,MAAM,CAAA;AACnC,EAAA,IAAI,UAAU,IAAA,CAAK,GAAA,KAAQ,MAAA,CAAO,SAAA,GAAY,OAAO,OAAO,MAAA;AAC5D,EAAA,MAAM,QAAA,GAAW,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA;AACpC,EAAA,IAAI,UAAU,OAAO,QAAA;AACrB,EAAA,MAAM,KAAK,YAAqC;AAC5C,IAAA,IAAI;AACA,MAAA,MAAM,GAAA,GAAM,GAAG,MAAA,CAAO,OAAA,CAAQ,OAAO,EAAE,CAAC,GAAG,kBAAkB,CAAA,CAAA;AAC7D,MAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,SAAS,EAAE,MAAA,EAAQ,kBAAA,EAAmB,EAAG,CAAA;AACxE,MAAA,IAAI,CAAC,GAAA,CAAI,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,GAAG,CAAA,UAAA,EAAa,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAChF,MAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAC7B,MAAA,IAAI,CAAC,IAAA,IAAQ,CAAC,MAAM,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAA,EAAG;AACpC,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,iBAAA,EAAoB,GAAG,CAAA,+BAAA,CAA4B,CAAA;AAAA,MACvE;AACA,MAAA,MAAM,OAAgC,EAAC;AACvC,MAAA,KAAA,MAAW,CAAA,IAAK,KAAK,IAAA,EAAM;AACvB,QAAA,IAAI,OAAO,CAAA,CAAE,GAAA,KAAQ,QAAA,EAAU;AAC/B,QAAA,IAAI;AACA,UAAA,IAAA,CAAK,EAAE,GAAG,CAAA,GAAK,MAAM,SAAA,CAAU,GAAG,OAAO,CAAA;AAAA,QAC7C,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACJ;AACA,MAAA,MAAM,QAAwB,EAAE,IAAA,EAAM,SAAA,EAAW,IAAA,CAAK,KAAI,EAAE;AAC5D,MAAA,SAAA,CAAU,GAAA,CAAI,QAAQ,KAAK,CAAA;AAC3B,MAAA,OAAO,KAAA;AAAA,IACX,SAAS,GAAA,EAAK;AACV,MAAA,MAAM,KAAA,GAAQ,SAAA,CAAU,GAAA,CAAI,MAAM,CAAA;AAClC,MAAA,IAAI,OAAO,OAAO,KAAA;AAClB,MAAA,MAAM,GAAA;AAAA,IACV;AAAA,EACJ,CAAA,GAAG,CAAE,OAAA,CAAQ,MAAM;AACf,IAAA,QAAA,CAAS,OAAO,MAAM,CAAA;AAAA,EAC1B,CAAC,CAAA;AACD,EAAA,QAAA,CAAS,GAAA,CAAI,QAAQ,CAAC,CAAA;AACtB,EAAA,OAAO,CAAA;AACX;AAEA,SAAS,WAAW,GAAA,EAAgC;AAChD,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,OAAO,IAAA;AACpC,EAAA,MAAM,CAAA,GAAI,IAAI,IAAA,EAAK;AACnB,EAAA,IAAI,EAAE,MAAA,KAAW,CAAA,IAAK,EAAE,MAAA,GAAS,CAAA,KAAM,GAAG,OAAO,IAAA;AACjD,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,CAAA,CAAE,SAAS,CAAC,CAAA;AACvC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,GAAA,CAAI,QAAQ,CAAA,EAAA,EAAK;AACjC,IAAA,MAAM,CAAA,GAAI,QAAA,CAAS,CAAA,CAAE,KAAA,CAAM,CAAA,GAAI,GAAG,CAAA,GAAI,CAAA,GAAI,CAAC,CAAA,EAAG,EAAE,CAAA;AAChD,IAAA,IAAI,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA,EAAG,OAAO,IAAA;AAC5B,IAAA,GAAA,CAAI,CAAC,CAAA,GAAI,CAAA;AAAA,EACb;AACA,EAAA,OAAO,GAAA;AACX;AAEA,SAAS,cAAc,GAAA,EAAgC;AACnD,EAAA,IAAI;AACA,IAAA,MAAM,GAAA,GACF,OAAO,IAAA,KAAS,UAAA,GACV,IAAA,CAAK,GAAG,CAAA,GACR,MAAA,CAAO,IAAA,CAAK,GAAA,EAAK,QAAQ,CAAA,CAAE,SAAS,QAAQ,CAAA;AACtD,IAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA;AACrC,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,GAAA,CAAI,MAAA,EAAQ,CAAA,EAAA,EAAK,GAAA,CAAI,CAAC,CAAA,GAAI,GAAA,CAAI,UAAA,CAAW,CAAC,CAAA;AAC9D,IAAA,OAAO,GAAA;AAAA,EACX,CAAA,CAAA,MAAQ;AACJ,IAAA,OAAO,IAAA;AAAA,EACX;AACJ;AAEA,SAAS,WAAW,KAAA,EAA2B;AAC3C,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,MAAW,CAAA,IAAK,OAAO,GAAA,IAAO,CAAA,CAAE,SAAS,EAAE,CAAA,CAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAA;AAC5D,EAAA,OAAO,GAAA;AACX;AAEA,eAAe,OAAO,KAAA,EAAwC;AAC1D,EAAA,MAAM,MAAA,GACF,OAAO,UAAA,CAAW,MAAA,KAAW,WAAA,IAAe,WAAW,MAAA,CAAO,MAAA,GACxD,UAAA,CAAW,MAAA,CAAO,MAAA,GAClB,IAAA;AACV,EAAA,IAAI,CAAC,MAAA,EAAQ;AACT,IAAA,MAAM,IAAI,MAAM,8EAA2E,CAAA;AAAA,EAC/F;AACA,EAAA,MAAM,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,WAAW,KAA+B,CAAA;AAC1E,EAAA,OAAO,IAAI,WAAW,GAAG,CAAA;AAC7B;AAEA,SAAS,cAAc,IAAA,EAA+B;AAClD,EAAA,MAAM,GAAA,GAAM,IAAI,WAAA,CAAY,IAAA,CAAK,UAAU,CAAA;AAC3C,EAAA,IAAI,UAAA,CAAW,GAAG,CAAA,CAAE,GAAA,CAAI,IAAI,CAAA;AAC5B,EAAA,OAAO,GAAA;AACX;AAEA,eAAe,aAAA,CACX,GAAA,EACA,GAAA,EACA,GAAA,EACgB;AAChB,EAAA,MAAM,MAAA,GACF,OAAO,UAAA,CAAW,MAAA,KAAW,WAAA,IAAe,WAAW,MAAA,CAAO,MAAA,GACxD,UAAA,CAAW,MAAA,CAAO,MAAA,GAClB,IAAA;AACV,EAAA,IAAI,CAAC,QAAQ,OAAO,KAAA;AACpB,EAAA,IAAI;AACA,IAAA,OAAO,MAAM,MAAA,CAAO,MAAA;AAAA,MAChB,SAAA;AAAA,MACA,GAAA;AAAA,MACA,cAAc,GAAG,CAAA;AAAA,MACjB,cAAc,GAAG;AAAA,KACrB;AAAA,EACJ,CAAA,CAAA,MAAQ;AACJ,IAAA,OAAO,KAAA;AAAA,EACX;AACJ;AAWA,eAAsB,yBAAA,CAClB,MAAA,EACA,OAAA,GAAiC,EAAC,EACL;AAC7B,EAAA,MAAM,SAAgC,EAAC;AAGvC,EAAA,MAAM,OAAA,GACF,CAAC,CAAC,MAAA,IACF,OAAO,MAAA,KAAW,QAAA,IAClB,OAAO,MAAA,CAAO,GAAA,KAAQ,QAAA,IACtB,OAAO,OAAO,GAAA,KAAQ,QAAA,IACtB,OAAO,MAAA,CAAO,aAAA,KAAkB,QAAA,IAChC,CAAC,CAAC,OAAO,WAAA,IACT,OAAO,MAAA,CAAO,WAAA,CAAY,EAAA,KAAO,QAAA,IACjC,OAAO,MAAA,CAAO,YAAY,UAAA,KAAe,QAAA;AAC7C,EAAA,MAAA,CAAO,IAAA,CAAK;AAAA,IACR,EAAA,EAAI,OAAA;AAAA,IACJ,KAAA,EAAO;AAAA,GACV,CAAA;AACD,EAAA,IAAI,CAAC,OAAA,EAAS;AACV,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,wBAAwB,MAAA,EAAO;AAAA,EAC/D;AAEA,EAAA,MAAM,IAAI,MAAA,CAAO,WAAA;AAGjB,EAAA,MAAM,SAAA,GAAY,aAAA,CAAc,MAAA,CAAO,aAAa,CAAA;AACpD,EAAA,MAAA,CAAO,IAAA,CAAK;AAAA,IACR,IAAI,SAAA,KAAc,IAAA;AAAA,IAClB,KAAA,EAAO,uBAAA;AAAA,IACP,MAAA,EAAQ,SAAA,GAAY,CAAA,EAAG,SAAA,CAAU,MAAM,CAAA,MAAA,CAAA,GAAW;AAAA,GACrD,CAAA;AACD,EAAA,IAAI,CAAC,SAAA,EAAW,OAAO,EAAE,EAAA,EAAI,OAAO,MAAA,EAAQ,8BAAA,EAAgC,MAAA,EAAQ,WAAA,EAAa,CAAA,EAAE;AAGnG,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,SAAS,CAAA;AACrC,EAAA,MAAM,UAAA,GAAa,WAAW,MAAM,CAAA;AACpC,EAAA,MAAM,IAAA,GAAO,eAAe,CAAA,CAAE,EAAA;AAC9B,EAAA,MAAA,CAAO,IAAA,CAAK;AAAA,IACR,EAAA,EAAI,IAAA;AAAA,IACJ,KAAA,EAAO,gCAAA;AAAA,IACP,MAAA,EAAQ,OAAO,CAAA,CAAE,EAAA,GAAK,YAAY,CAAA,CAAE,EAAE,SAAS,UAAU,CAAA;AAAA,GAC5D,CAAA;AACD,EAAA,IAAI,CAAC,IAAA,EAAM,OAAO,EAAE,EAAA,EAAI,OAAO,MAAA,EAAQ,wCAAA,EAA0C,MAAA,EAAQ,WAAA,EAAa,CAAA,EAAE;AAGxG,EAAA,IAAI,GAAA,GAAsB,IAAA;AAC1B,EAAA,IAAI,QAAQ,GAAA,EAAK;AACb,IAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,GAAA,KAAQ,MAAA,CAAO,GAAA,EAAK;AAChC,MAAA,MAAA,CAAO,IAAA,CAAK;AAAA,QACR,EAAA,EAAI,KAAA;AAAA,QACJ,KAAA,EAAO,+BAAA;AAAA,QACP,QAAQ,CAAA,iBAAA,EAAoB,OAAA,CAAQ,IAAI,GAAG,CAAA,gBAAA,EAAmB,OAAO,GAAG,CAAA;AAAA,OAC3E,CAAA;AACD,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,gCAAA,EAAkC,MAAA,EAAQ,aAAa,CAAA,EAAE;AAAA,IACzF;AACA,IAAA,IAAI;AACA,MAAA,GAAA,GAAO,MAAM,SAAA,CAAU,OAAA,CAAQ,GAAA,EAAK,OAAO,CAAA;AAC3C,MAAA,MAAA,CAAO,IAAA,CAAK,EAAE,EAAA,EAAI,IAAA,EAAM,KAAA,EAAO,+BAAA,EAAiC,MAAA,EAAQ,CAAA,IAAA,EAAO,MAAA,CAAO,GAAG,CAAA,WAAA,CAAA,EAAe,CAAA;AAAA,IAC5G,SAAS,GAAA,EAAK;AACV,MAAA,MAAA,CAAO,IAAA,CAAK;AAAA,QACR,EAAA,EAAI,KAAA;AAAA,QACJ,KAAA,EAAO,+BAAA;AAAA,QACP,MAAA,EAAQ,CAAA,4BAAA,EAAgC,GAAA,CAAc,OAAO,CAAA;AAAA,OAChE,CAAA;AACD,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,4BAAA,EAA8B,MAAA,EAAQ,aAAa,CAAA,EAAE;AAAA,IACrF;AAAA,EACJ,CAAA,MAAO;AACH,IAAA,MAAM,MAAA,GAAS,QAAQ,MAAA,IAAU,cAAA;AACjC,IAAA,MAAM,GAAA,GAAM,QAAQ,cAAA,IAAkB,cAAA;AACtC,IAAA,IAAI;AACA,MAAA,IAAI,KAAA,GAAQ,MAAM,iBAAA,CAAkB,MAAA,EAAQ,GAAG,CAAA;AAC/C,MAAA,GAAA,GAAM,KAAA,CAAM,IAAA,CAAK,MAAA,CAAO,GAAG,CAAA,IAAK,IAAA;AAChC,MAAA,IAAI,CAAC,GAAA,EAAK;AAEN,QAAA,SAAA,CAAU,OAAO,MAAM,CAAA;AACvB,QAAA,KAAA,GAAQ,MAAM,iBAAA,CAAkB,MAAA,EAAQ,GAAG,CAAA;AAC3C,QAAA,GAAA,GAAM,KAAA,CAAM,IAAA,CAAK,MAAA,CAAO,GAAG,CAAA,IAAK,IAAA;AAAA,MACpC;AACA,MAAA,MAAA,CAAO,IAAA,CAAK;AAAA,QACR,EAAA,EAAI,CAAC,CAAC,GAAA;AAAA,QACN,KAAA,EAAO,+BAAA;AAAA,QACP,MAAA,EAAQ,GAAA,GAAM,CAAA,IAAA,EAAO,MAAA,CAAO,GAAG,CAAA,CAAA,GAAK,CAAA,gBAAA,EAAmB,MAAA,CAAO,GAAG,CAAA,IAAA,EAAO,MAAM,CAAA,EAAG,kBAAkB,CAAA;AAAA,OACtG,CAAA;AACD,MAAA,IAAI,CAAC,GAAA,EAAK;AACN,QAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,CAAA,IAAA,EAAO,OAAO,GAAG,CAAA,qBAAA,CAAA,EAAyB,MAAA,EAAQ,WAAA,EAAa,CAAA,EAAE;AAAA,MACjG;AAAA,IACJ,SAAS,GAAA,EAAK;AACV,MAAA,MAAA,CAAO,IAAA,CAAK;AAAA,QACR,EAAA,EAAI,KAAA;AAAA,QACJ,KAAA,EAAO,+BAAA;AAAA,QACP,MAAA,EAAQ,CAAA,2BAAA,EAA+B,GAAA,CAAc,OAAO,CAAA;AAAA,OAC/D,CAAA;AACD,MAAA,OAAO;AAAA,QACH,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,CAAA,2BAAA,EAA+B,GAAA,CAAc,OAAO,CAAA,CAAA;AAAA,QAC5D,MAAA;AAAA,QACA,WAAA,EAAa;AAAA,OACjB;AAAA,IACJ;AAAA,EACJ;AAEA,EAAA,MAAM,QAAA,GAAW,UAAA,CAAW,MAAA,CAAO,GAAG,CAAA;AACtC,EAAA,IAAI,CAAC,QAAA,EAAU;AACX,IAAA,MAAA,CAAO,IAAA,CAAK;AAAA,MACR,EAAA,EAAI,KAAA;AAAA,MACJ,KAAA,EAAO,kDAAA;AAAA,MACP,MAAA,EAAQ;AAAA,KACX,CAAA;AACD,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,eAAA,EAAiB,MAAA,EAAQ,aAAa,CAAA,EAAE;AAAA,EACxE;AACA,EAAA,MAAM,KAAA,GAAQ,MAAM,aAAA,CAAc,GAAA,EAAK,UAAU,SAAS,CAAA;AAC1D,EAAA,MAAA,CAAO,IAAA,CAAK;AAAA,IACR,EAAA,EAAI,KAAA;AAAA,IACJ,KAAA,EAAO,kDAAA;AAAA,IACP,MAAA,EAAQ,QAAQ,iBAAA,GAAoB;AAAA,GACvC,CAAA;AACD,EAAA,IAAI,CAAC,KAAA,EAAO,OAAO,EAAE,EAAA,EAAI,OAAO,MAAA,EAAQ,0BAAA,EAA4B,MAAA,EAAQ,WAAA,EAAa,CAAA,EAAE;AAG3F,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,oBAAO,IAAI,IAAA,EAAK;AACpC,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,KAAA,CAAM,CAAA,CAAE,UAAU,CAAA;AACzC,EAAA,MAAM,UAAU,MAAA,CAAO,QAAA,CAAS,SAAS,CAAA,IAAK,SAAA,GAAY,IAAI,OAAA,EAAQ;AACtE,EAAA,MAAA,CAAO,IAAA,CAAK;AAAA,IACR,EAAA,EAAI,OAAA;AAAA,IACJ,KAAA,EAAO,8BAAA;AAAA,IACP,MAAA,EAAQ,UACF,CAAA,QAAA,EAAW,IAAI,KAAK,SAAS,CAAA,CAAE,WAAA,EAAa,CAAA,CAAA,GAC5C;AAAA,GACT,CAAA;AACD,EAAA,IAAI,CAAC,OAAA,EAAS,OAAO,EAAE,EAAA,EAAI,OAAO,MAAA,EAAQ,yBAAA,EAA2B,MAAA,EAAQ,WAAA,EAAa,CAAA,EAAE;AAE5F,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,WAAA,EAAa,GAAG,MAAA,EAAO;AAC9C;AAIA,eAAsB,mBAAA,CAAoB,SAAS,cAAA,EAA+B;AAC9E,EAAA,SAAA,CAAU,OAAO,MAAM,CAAA;AACvB,EAAA,MAAM,iBAAA,CAAkB,QAAQ,cAAc,CAAA;AAClD;AAEO,IAAM,QAAA,GAAW;AAAA,EACpB,yBAAA;AAAA,EACA;AACJ;;;ACtRA,eAAsB,YAAA,CAClB,OAAA,EACA,OAAA,GAA2B,EAAC,EACE;AAC9B,EAAA,MAAM,OAAA,GAAU,MAAMA,qBAAA,CAAiB,OAAA,EAAS,OAAO,CAAA;AACvD,EAAA,IAAI,CAAC,OAAA,IAAW,OAAA,CAAQ,QAAA,KAAa,MAAA,wBAAiC,OAAO,CAAA;AAC7E,EAAA,OAAO,OAAA;AACX;AAEA,IAAI,cAAA,GAAiB,KAAA;AAQrB,SAAS,sBAAsB,OAAA,EAAgD;AAC3E,EAAA,IAAI,cAAA,EAAgB;AACpB,EAAA,MAAM,IAAA,GACF,OAAO,OAAA,KAAY,WAAA,IAAe,OAAA,YAAmB,UAC/C,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA,GAC1B,OAAA,CAAkC,aAAA;AAC7C,EAAA,MAAM,IAAI,OAAO,IAAA,KAAS,WAAW,+BAAA,CAAgC,IAAA,CAAK,IAAI,CAAA,GAAI,IAAA;AAClF,EAAA,IAAI,CAAC,CAAA,EAAG;AACR,EAAA,IAAI;AACA,IAAA,MAAM,UAAU,IAAA,CAAK,KAAA,CAAM,kBAAkB,CAAA,CAAE,CAAC,CAAE,CAAC,CAAA;AACnD,IAAA,IAAI,OAAA,CAAQ,QAAQ,KAAA,CAAA,EAAW;AAC/B,IAAA,cAAA,GAAiB,IAAA;AACjB,IAAA,OAAA,CAAQ,IAAA;AAAA,MACJ,CAAA,kDAAA,EAAqD,IAAA,CAAK,SAAA,CAAU,OAAA,CAAQ,GAAG,CAAC,CAAA,+IAAA;AAAA,KAGpF;AAAA,EACJ,CAAA,CAAA,MAAQ;AAAA,EAER;AACJ;AAEA,SAAS,kBAAkB,CAAA,EAAmB;AAC1C,EAAA,MAAM,GAAA,GAAM,EAAE,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AAClD,EAAA,IAAI,OAAO,IAAA,KAAS,UAAA,EAAY,OAAO,IAAA,CAAK,GAAA,GAAM,GAAA,CAAI,MAAA,CAAA,CAAQ,CAAA,GAAK,GAAA,CAAI,MAAA,GAAS,CAAA,IAAM,CAAC,CAAC,CAAA;AACxF,EAAA,OAAO,OAAO,IAAA,CAAK,CAAA,EAAG,WAAW,CAAA,CAAE,SAAS,MAAM,CAAA;AACtD;AAyCA,IAAM,aAAA,GAAgB,GAAA;AACtB,IAAM,QAAA,uBAAe,GAAA,EAAmD;AASxE,eAAe,mBAAmB,OAAA,EAAkE;AAChG,EAAA,MAAM,MAAM,OAAA,CAAQ,UAAA;AACpB,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,GAAA,CAAI,GAAG,CAAA;AAC5B,EAAA,IAAI,GAAA,IAAO,KAAK,GAAA,EAAI,GAAI,IAAI,EAAA,GAAK,aAAA,SAAsB,GAAA,CAAI,IAAA;AAC3D,EAAA,IAAI;AACA,IAAA,MAAM,IAAA,GAAO,QAAQ,QAAA,IAAY,oBAAA;AACjC,IAAA,MAAM,CAAA,GAAI,MAAM,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,gBAAA,EAAmB,kBAAA,CAAmB,GAAG,CAAC,CAAA,QAAA,CAAA,EAAY;AAAA,MAC/E,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,GAAI;AAAA,KACnC,CAAA;AACD,IAAA,IAAI,CAAC,EAAE,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,KAAA,EAAQ,CAAA,CAAE,MAAM,CAAA,CAAE,CAAA;AAC7C,IAAA,MAAM,CAAA,GAAK,MAAM,CAAA,CAAE,IAAA,EAAK;AAGxB,IAAA,MAAM,GAAA,GAAM,EAAE,YAAA,IAAgB,IAAA;AAC9B,IAAA,MAAM,IAAA,GAAO,MAAM,EAAE,OAAA,EAAS,IAAI,QAAA,EAAU,OAAA,EAAS,GAAA,CAAI,QAAA,EAAS,GAAI,IAAA;AACtE,IAAA,QAAA,CAAS,GAAA,CAAI,KAAK,EAAE,EAAA,EAAI,KAAK,GAAA,EAAI,EAAG,MAAM,CAAA;AAC1C,IAAA,OAAO,IAAA;AAAA,EACX,CAAA,CAAA,MAAQ;AACJ,IAAA,OAAO,GAAA,EAAK,IAAA;AAAA,EAChB;AACJ;AAGA,eAAe,SAAS,OAAA,EAAkE;AACtF,EAAA,IAAI,OAAA,CAAQ,WAAA,EAAa,OAAO,OAAA,CAAQ,WAAA;AACxC,EAAA,IAAI,OAAA,CAAQ,UAAA,EAAY,OAAO,kBAAA,CAAmB,OAAO,CAAA;AACzD,EAAA,OAAO,IAAA;AACX;AAGA,eAAe,OAAA,CACX,SACA,OAAA,EACiE;AACjE,EAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,OAAO,CAAA;AACnC,EAAA,IAAI,CAAC,OAAA,EAAS;AACV,IAAA,OAAO,OAAA,CAAQ,QAAA,IAAY,IAAA,KAAS,IAAA,GAC9B,EAAE,MAAA,EAAQ,GAAA,EAAK,IAAA,EAAM,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,iBAAA,IAAoB,GAC9D,IAAA;AAAA,EACV;AACA,EAAA,IAAI,SAAS,MAAA,EAAW;AACpB,IAAA,OAAO,EAAE,QAAQ,GAAA,EAAK,IAAA,EAAM,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,yBAAA,EAA0B,EAAE;AAAA,EACjF;AACA,EAAA,IAAI,IAAA,IAAQ,CAACC,kBAAA,CAAU,OAAA,EAAS,IAAI,CAAA,EAAG;AACnC,IAAA,MAAM,IAAA,GAAOC,uBAAc,OAAO,CAAA;AAClC,IAAA,OAAO;AAAA,MACH,MAAA,EAAQ,GAAA;AAAA,MACR,IAAA,EAAM;AAAA,QACF,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,eAAA;AAAA,QACR,IAAA;AAAA,QACA,IAAA,EAAM,OAAO,EAAE,UAAA,EAAY,KAAK,UAAA,EAAY,UAAA,EAAY,IAAA,CAAK,UAAA,EAAW,GAAI;AAAA;AAChF,KACJ;AAAA,EACJ;AACA,EAAA,OAAO,IAAA;AACX;AAqBO,SAAS,UAAA,CACZ,OAAA,EACA,OAAA,GAA6B,EAAC,EAC7B;AACD,EAAA,MAAM,OAAA,GAAU,OAAO,GAAA,EAAyB,GAAA,KAA6B;AACzE,IAAA,GAAA,CAAI,SAAA,CAAU,iBAAiB,mBAAmB,CAAA;AAClD,IAAA,GAAA,CAAI,SAAA,CAAU,QAAQ,uBAAuB,CAAA;AAC7C,IAAA,MAAM,UAAU,MAAM,YAAA;AAAA,MAClB;AAAA,QACI,MAAA,EAAQ,OAAO,GAAA,CAAI,OAAA,CAAQ,WAAW,QAAA,GAAW,GAAA,CAAI,QAAQ,MAAA,GAAS,IAAA;AAAA,QACtE,aAAA,EACI,OAAO,GAAA,CAAI,OAAA,CAAQ,kBAAkB,QAAA,GAC/B,GAAA,CAAI,QAAQ,aAAA,GACZ;AAAA,OACd;AAAA,MACA;AAAA,KACJ;AACA,IAAA,GAAA,CAAI,SAAA,GAAY,OAAA;AAChB,IAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,OAAA,EAAS,OAAO,CAAA;AAC9C,IAAA,IAAI,OAAA,SAAgB,GAAA,CAAI,MAAA,CAAO,QAAQ,MAAM,CAAA,CAAE,IAAA,CAAK,OAAA,CAAQ,IAAI,CAAA;AAChE,IAAA,OAAO,OAAA,CAAQ,KAAK,GAAG,CAAA;AAAA,EAC3B,CAAA;AACA,EAAA,OAAO,OAAA;AACX;AAkCO,SAAS,aAAA,CAAc,OAAA,GAA6B,EAAC,EAAG;AAC3D,EAAA,OAAO,OAAO,GAAA,EAAyB,GAAA,EAA0B,IAAA,KAA0B;AACvF,IAAA,IAAI;AACA,MAAA,GAAA,CAAI,SAAA,CAAU,iBAAiB,mBAAmB,CAAA;AAClD,MAAA,GAAA,CAAI,SAAA,CAAU,QAAQ,uBAAuB,CAAA;AAC7C,MAAA,MAAM,UAAU,MAAM,YAAA;AAAA,QAClB;AAAA,UACI,MAAA,EAAQ,OAAO,GAAA,CAAI,OAAA,CAAQ,WAAW,QAAA,GAAW,GAAA,CAAI,QAAQ,MAAA,GAAS,IAAA;AAAA,UACtE,aAAA,EACI,OAAO,GAAA,CAAI,OAAA,CAAQ,kBAAkB,QAAA,GAC/B,GAAA,CAAI,QAAQ,aAAA,GACZ;AAAA,SACd;AAAA,QACA;AAAA,OACJ;AACA,MAAA,GAAA,CAAI,SAAA,GAAY,OAAA;AAChB,MAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,OAAA,EAAS,OAAO,CAAA;AAC9C,MAAA,IAAI,OAAA,EAAS;AACT,QAAA,GAAA,CAAI,OAAO,OAAA,CAAQ,MAAM,CAAA,CAAE,IAAA,CAAK,QAAQ,IAAI,CAAA;AAC5C,QAAA;AAAA,MACJ;AACA,MAAA,IAAA,EAAK;AAAA,IACT,SAAS,GAAA,EAAK;AACV,MAAA,IAAA,CAAK,GAAG,CAAA;AAAA,IACZ;AAAA,EACJ,CAAA;AACJ;AA2BO,SAAS,UAAA,CAAW,OAAA,GAA6B,EAAC,EAAG;AACxD,EAAA,OAAO,OAAO,GAAoB,IAAA,KAAuB;AACrD,IAAA,CAAA,CAAE,MAAA,CAAO,iBAAiB,mBAAmB,CAAA;AAC7C,IAAA,CAAA,CAAE,MAAA,CAAO,QAAQ,uBAAuB,CAAA;AACxC,IAAA,MAAM,UAAU,MAAM,YAAA,CAAa,EAAE,GAAA,CAAI,GAAA,CAAI,SAAS,OAAO,CAAA;AAC7D,IAAA,CAAA,CAAE,GAAA,CAAI,aAAa,OAAO,CAAA;AAC1B,IAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,OAAA,EAAS,OAAO,CAAA;AAC9C,IAAA,IAAI,SAAS,OAAO,CAAA,CAAE,KAAK,OAAA,CAAQ,IAAA,EAAM,QAAQ,MAAM,CAAA;AACvD,IAAA,MAAM,IAAA,EAAK;AAAA,EACf,CAAA;AACJ","file":"server.js","sourcesContent":["export const encoder = new TextEncoder();\nexport const decoder = new TextDecoder();\nconst MAX_INT32 = 2 ** 32;\nexport function concat(...buffers) {\n const size = buffers.reduce((acc, { length }) => acc + length, 0);\n const buf = new Uint8Array(size);\n let i = 0;\n for (const buffer of buffers) {\n buf.set(buffer, i);\n i += buffer.length;\n }\n return buf;\n}\nfunction writeUInt32BE(buf, value, offset) {\n if (value < 0 || value >= MAX_INT32) {\n throw new RangeError(`value must be >= 0 and <= ${MAX_INT32 - 1}. Received ${value}`);\n }\n buf.set([value >>> 24, value >>> 16, value >>> 8, value & 0xff], offset);\n}\nexport function uint64be(value) {\n const high = Math.floor(value / MAX_INT32);\n const low = value % MAX_INT32;\n const buf = new Uint8Array(8);\n writeUInt32BE(buf, high, 0);\n writeUInt32BE(buf, low, 4);\n return buf;\n}\nexport function uint32be(value) {\n const buf = new Uint8Array(4);\n writeUInt32BE(buf, value);\n return buf;\n}\nexport function encode(string) {\n const bytes = new Uint8Array(string.length);\n for (let i = 0; i < string.length; i++) {\n const code = string.charCodeAt(i);\n if (code > 127) {\n throw new TypeError('non-ASCII string encountered in encode()');\n }\n bytes[i] = code;\n }\n return bytes;\n}\n","export function encodeBase64(input) {\n if (Uint8Array.prototype.toBase64) {\n return input.toBase64();\n }\n const CHUNK_SIZE = 0x8000;\n const arr = [];\n for (let i = 0; i < input.length; i += CHUNK_SIZE) {\n arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));\n }\n return btoa(arr.join(''));\n}\nexport function decodeBase64(encoded) {\n if (Uint8Array.fromBase64) {\n return Uint8Array.fromBase64(encoded);\n }\n const binary = atob(encoded);\n const bytes = new Uint8Array(binary.length);\n for (let i = 0; i < binary.length; i++) {\n bytes[i] = binary.charCodeAt(i);\n }\n return bytes;\n}\n","import { encoder, decoder } from '../lib/buffer_utils.js';\nimport { encodeBase64, decodeBase64 } from '../lib/base64.js';\nexport function decode(input) {\n if (Uint8Array.fromBase64) {\n return Uint8Array.fromBase64(typeof input === 'string' ? input : decoder.decode(input), {\n alphabet: 'base64url',\n });\n }\n let encoded = input;\n if (encoded instanceof Uint8Array) {\n encoded = decoder.decode(encoded);\n }\n encoded = encoded.replace(/-/g, '+').replace(/_/g, '/');\n try {\n return decodeBase64(encoded);\n }\n catch {\n throw new TypeError('The input to be decoded is not correctly encoded.');\n }\n}\nexport function encode(input) {\n let unencoded = input;\n if (typeof unencoded === 'string') {\n unencoded = encoder.encode(unencoded);\n }\n if (Uint8Array.prototype.toBase64) {\n return unencoded.toBase64({ alphabet: 'base64url', omitPadding: true });\n }\n return encodeBase64(unencoded).replace(/=/g, '').replace(/\\+/g, '-').replace(/\\//g, '_');\n}\n","export class JOSEError extends Error {\n static code = 'ERR_JOSE_GENERIC';\n code = 'ERR_JOSE_GENERIC';\n constructor(message, options) {\n super(message, options);\n this.name = this.constructor.name;\n Error.captureStackTrace?.(this, this.constructor);\n }\n}\nexport class JWTClaimValidationFailed extends JOSEError {\n static code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';\n code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';\n claim;\n reason;\n payload;\n constructor(message, payload, claim = 'unspecified', reason = 'unspecified') {\n super(message, { cause: { claim, reason, payload } });\n this.claim = claim;\n this.reason = reason;\n this.payload = payload;\n }\n}\nexport class JWTExpired extends JOSEError {\n static code = 'ERR_JWT_EXPIRED';\n code = 'ERR_JWT_EXPIRED';\n claim;\n reason;\n payload;\n constructor(message, payload, claim = 'unspecified', reason = 'unspecified') {\n super(message, { cause: { claim, reason, payload } });\n this.claim = claim;\n this.reason = reason;\n this.payload = payload;\n }\n}\nexport class JOSEAlgNotAllowed extends JOSEError {\n static code = 'ERR_JOSE_ALG_NOT_ALLOWED';\n code = 'ERR_JOSE_ALG_NOT_ALLOWED';\n}\nexport class JOSENotSupported extends JOSEError {\n static code = 'ERR_JOSE_NOT_SUPPORTED';\n code = 'ERR_JOSE_NOT_SUPPORTED';\n}\nexport class JWEDecryptionFailed extends JOSEError {\n static code = 'ERR_JWE_DECRYPTION_FAILED';\n code = 'ERR_JWE_DECRYPTION_FAILED';\n constructor(message = 'decryption operation failed', options) {\n super(message, options);\n }\n}\nexport class JWEInvalid extends JOSEError {\n static code = 'ERR_JWE_INVALID';\n code = 'ERR_JWE_INVALID';\n}\nexport class JWSInvalid extends JOSEError {\n static code = 'ERR_JWS_INVALID';\n code = 'ERR_JWS_INVALID';\n}\nexport class JWTInvalid extends JOSEError {\n static code = 'ERR_JWT_INVALID';\n code = 'ERR_JWT_INVALID';\n}\nexport class JWKInvalid extends JOSEError {\n static code = 'ERR_JWK_INVALID';\n code = 'ERR_JWK_INVALID';\n}\nexport class JWKSInvalid extends JOSEError {\n static code = 'ERR_JWKS_INVALID';\n code = 'ERR_JWKS_INVALID';\n}\nexport class JWKSNoMatchingKey extends JOSEError {\n static code = 'ERR_JWKS_NO_MATCHING_KEY';\n code = 'ERR_JWKS_NO_MATCHING_KEY';\n constructor(message = 'no applicable key found in the JSON Web Key Set', options) {\n super(message, options);\n }\n}\nexport class JWKSMultipleMatchingKeys extends JOSEError {\n [Symbol.asyncIterator];\n static code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';\n code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';\n constructor(message = 'multiple matching keys found in the JSON Web Key Set', options) {\n super(message, options);\n }\n}\nexport class JWKSTimeout extends JOSEError {\n static code = 'ERR_JWKS_TIMEOUT';\n code = 'ERR_JWKS_TIMEOUT';\n constructor(message = 'request timed out', options) {\n super(message, options);\n }\n}\nexport class JWSSignatureVerificationFailed extends JOSEError {\n static code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';\n code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';\n constructor(message = 'signature verification failed', options) {\n super(message, options);\n }\n}\n","const isObjectLike = (value) => typeof value === 'object' && value !== null;\nexport function isObject(input) {\n if (!isObjectLike(input) || Object.prototype.toString.call(input) !== '[object Object]') {\n return false;\n }\n if (Object.getPrototypeOf(input) === null) {\n return true;\n }\n let proto = input;\n while (Object.getPrototypeOf(proto) !== null) {\n proto = Object.getPrototypeOf(proto);\n }\n return Object.getPrototypeOf(input) === proto;\n}\nexport function isDisjoint(...headers) {\n const sources = headers.filter(Boolean);\n if (sources.length === 0 || sources.length === 1) {\n return true;\n }\n let acc;\n for (const header of sources) {\n const parameters = Object.keys(header);\n if (!acc || acc.size === 0) {\n acc = new Set(parameters);\n continue;\n }\n for (const parameter of parameters) {\n if (acc.has(parameter)) {\n return false;\n }\n acc.add(parameter);\n }\n }\n return true;\n}\nexport const isJWK = (key) => isObject(key) && typeof key.kty === 'string';\nexport const isPrivateJWK = (key) => key.kty !== 'oct' &&\n ((key.kty === 'AKP' && typeof key.priv === 'string') || typeof key.d === 'string');\nexport const isPublicJWK = (key) => key.kty !== 'oct' && key.d === undefined && key.priv === undefined;\nexport const isSecretJWK = (key) => key.kty === 'oct' && typeof key.k === 'string';\n","import { JOSENotSupported } from '../util/errors.js';\nconst unsupportedAlg = 'Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value';\nfunction subtleMapping(jwk) {\n let algorithm;\n let keyUsages;\n switch (jwk.kty) {\n case 'AKP': {\n switch (jwk.alg) {\n case 'ML-DSA-44':\n case 'ML-DSA-65':\n case 'ML-DSA-87':\n algorithm = { name: jwk.alg };\n keyUsages = jwk.priv ? ['sign'] : ['verify'];\n break;\n default:\n throw new JOSENotSupported(unsupportedAlg);\n }\n break;\n }\n case 'RSA': {\n switch (jwk.alg) {\n case 'PS256':\n case 'PS384':\n case 'PS512':\n algorithm = { name: 'RSA-PSS', hash: `SHA-${jwk.alg.slice(-3)}` };\n keyUsages = jwk.d ? ['sign'] : ['verify'];\n break;\n case 'RS256':\n case 'RS384':\n case 'RS512':\n algorithm = { name: 'RSASSA-PKCS1-v1_5', hash: `SHA-${jwk.alg.slice(-3)}` };\n keyUsages = jwk.d ? ['sign'] : ['verify'];\n break;\n case 'RSA-OAEP':\n case 'RSA-OAEP-256':\n case 'RSA-OAEP-384':\n case 'RSA-OAEP-512':\n algorithm = {\n name: 'RSA-OAEP',\n hash: `SHA-${parseInt(jwk.alg.slice(-3), 10) || 1}`,\n };\n keyUsages = jwk.d ? ['decrypt', 'unwrapKey'] : ['encrypt', 'wrapKey'];\n break;\n default:\n throw new JOSENotSupported(unsupportedAlg);\n }\n break;\n }\n case 'EC': {\n switch (jwk.alg) {\n case 'ES256':\n case 'ES384':\n case 'ES512':\n algorithm = {\n name: 'ECDSA',\n namedCurve: { ES256: 'P-256', ES384: 'P-384', ES512: 'P-521' }[jwk.alg],\n };\n keyUsages = jwk.d ? ['sign'] : ['verify'];\n break;\n case 'ECDH-ES':\n case 'ECDH-ES+A128KW':\n case 'ECDH-ES+A192KW':\n case 'ECDH-ES+A256KW':\n algorithm = { name: 'ECDH', namedCurve: jwk.crv };\n keyUsages = jwk.d ? ['deriveBits'] : [];\n break;\n default:\n throw new JOSENotSupported(unsupportedAlg);\n }\n break;\n }\n case 'OKP': {\n switch (jwk.alg) {\n case 'Ed25519':\n case 'EdDSA':\n algorithm = { name: 'Ed25519' };\n keyUsages = jwk.d ? ['sign'] : ['verify'];\n break;\n case 'ECDH-ES':\n case 'ECDH-ES+A128KW':\n case 'ECDH-ES+A192KW':\n case 'ECDH-ES+A256KW':\n algorithm = { name: jwk.crv };\n keyUsages = jwk.d ? ['deriveBits'] : [];\n break;\n default:\n throw new JOSENotSupported(unsupportedAlg);\n }\n break;\n }\n default:\n throw new JOSENotSupported('Invalid or unsupported JWK \"kty\" (Key Type) Parameter value');\n }\n return { algorithm, keyUsages };\n}\nexport async function jwkToKey(jwk) {\n if (!jwk.alg) {\n throw new TypeError('\"alg\" argument is required when \"jwk.alg\" is not present');\n }\n const { algorithm, keyUsages } = subtleMapping(jwk);\n const keyData = { ...jwk };\n if (keyData.kty !== 'AKP') {\n delete keyData.alg;\n }\n delete keyData.use;\n return crypto.subtle.importKey('jwk', keyData, algorithm, jwk.ext ?? (jwk.d || jwk.priv ? false : true), jwk.key_ops ?? keyUsages);\n}\n","import { decode as decodeBase64URL } from '../util/base64url.js';\nimport { fromSPKI, fromPKCS8, fromX509 } from '../lib/asn1.js';\nimport { jwkToKey } from '../lib/jwk_to_key.js';\nimport { JOSENotSupported } from '../util/errors.js';\nimport { isObject } from '../lib/type_checks.js';\nexport async function importSPKI(spki, alg, options) {\n if (typeof spki !== 'string' || spki.indexOf('-----BEGIN PUBLIC KEY-----') !== 0) {\n throw new TypeError('\"spki\" must be SPKI formatted string');\n }\n return fromSPKI(spki, alg, options);\n}\nexport async function importX509(x509, alg, options) {\n if (typeof x509 !== 'string' || x509.indexOf('-----BEGIN CERTIFICATE-----') !== 0) {\n throw new TypeError('\"x509\" must be X.509 formatted string');\n }\n return fromX509(x509, alg, options);\n}\nexport async function importPKCS8(pkcs8, alg, options) {\n if (typeof pkcs8 !== 'string' || pkcs8.indexOf('-----BEGIN PRIVATE KEY-----') !== 0) {\n throw new TypeError('\"pkcs8\" must be PKCS#8 formatted string');\n }\n return fromPKCS8(pkcs8, alg, options);\n}\nexport async function importJWK(jwk, alg, options) {\n if (!isObject(jwk)) {\n throw new TypeError('JWK must be an object');\n }\n let ext;\n alg ??= jwk.alg;\n ext ??= options?.extractable ?? jwk.ext;\n switch (jwk.kty) {\n case 'oct':\n if (typeof jwk.k !== 'string' || !jwk.k) {\n throw new TypeError('missing \"k\" (Key Value) Parameter value');\n }\n return decodeBase64URL(jwk.k);\n case 'RSA':\n if ('oth' in jwk && jwk.oth !== undefined) {\n throw new JOSENotSupported('RSA JWK \"oth\" (Other Primes Info) Parameter value is not supported');\n }\n return jwkToKey({ ...jwk, alg, ext });\n case 'AKP': {\n if (typeof jwk.alg !== 'string' || !jwk.alg) {\n throw new TypeError('missing \"alg\" (Algorithm) Parameter value');\n }\n if (alg !== undefined && alg !== jwk.alg) {\n throw new TypeError('JWK alg and alg option value mismatch');\n }\n return jwkToKey({ ...jwk, ext });\n }\n case 'EC':\n case 'OKP':\n return jwkToKey({ ...jwk, alg, ext });\n default:\n throw new JOSENotSupported('Unsupported \"kty\" (Key Type) Parameter value');\n }\n}\n","/**\n * `oc.identity.verifyActivityAttestation` — one-call ed25519 verifier\n * for a /api/me/activity-attestation bundle.\n *\n * Cashes the \"trivially to verify\" strategic claim: an integrator\n * receiving a signed attestation JSON from a user calls one function,\n * gets a typed result with per-check detail, never reaches into\n * @noble/curves or jose themselves.\n *\n * import { oc } from '@orangecheck/me-client';\n *\n * const result = await oc.identity.verifyActivityAttestation(bundle);\n * if (!result.ok) return res.status(401).send(result.reason);\n * // result.attestation is typed · safe to gate on lifetime_sats etc.\n *\n * The JWKS issuer is me.ochk.io (the envelope key), DISTINCT from\n * the auth host's ochk.io JWKS that signs webhooks. Same Ed25519\n * curve, same kid lookup pattern, fetched + cached separately.\n */\n\nimport { importJWK, type CryptoKey, type KeyObject } from 'jose';\n\nconst DEFAULT_ISSUER = 'https://me.ochk.io';\nconst DEFAULT_TTL_MS = 60 * 60 * 1000;\nconst ENVELOPE_JWKS_PATH = '/.well-known/oc-envelope-jwks.json';\n\nexport interface ActivityAttestation {\n id: string;\n v: 1;\n kind: 'oc-me-activity';\n did_oc: string;\n event_count: number;\n human_event_count: number;\n lifetime_sats: number;\n distinct_integrator_count: number;\n oldest_event_at: string | null;\n active_days: number;\n computed_at: string;\n expires_at: string;\n}\n\nexport interface ActivityAttestationBundle {\n attestation: ActivityAttestation;\n sig: string;\n kid: string;\n canonical_b64: string;\n}\n\nexport interface ActivityVerifyCheck {\n ok: boolean;\n label: string;\n detail?: string;\n}\n\nexport interface ActivityVerifyResult {\n ok: boolean;\n reason?: string;\n attestation?: ActivityAttestation;\n checks: ActivityVerifyCheck[];\n}\n\ninterface OcEnvelopePublicJwk {\n kty: 'OKP';\n crv: 'Ed25519';\n x: string;\n kid: string;\n alg?: 'EdDSA';\n use?: 'sig';\n}\n\nexport interface VerifyActivityOptions {\n /** Override the me.ochk.io issuer (defaults to https://me.ochk.io).\n * Useful for staging / self-hosted dev. */\n issuer?: string;\n /** Pass a JWK directly to skip the network fetch · convenient when\n * embedding the public key in your service for air-gapped or\n * edge-runtime deployments. */\n jwk?: OcEnvelopePublicJwk;\n /** JWKS cache TTL in ms. Defaults to 1h. Stale-on-error falls back\n * to the previous cached value. */\n jwksCacheTtlMs?: number;\n /** Optional · override \"now\" for deterministic tests. */\n now?: Date;\n}\n\ntype AuthKey = CryptoKey | KeyObject;\n\ninterface JwksCacheEntry {\n keys: Record<string, AuthKey>;\n fetchedAt: number;\n}\n\nconst jwksCache = new Map<string, JwksCacheEntry>();\nconst inflight = new Map<string, Promise<JwksCacheEntry>>();\n\nasync function fetchEnvelopeJwks(issuer: string, ttlMs: number): Promise<JwksCacheEntry> {\n const cached = jwksCache.get(issuer);\n if (cached && Date.now() - cached.fetchedAt < ttlMs) return cached;\n const existing = inflight.get(issuer);\n if (existing) return existing;\n const p = (async (): Promise<JwksCacheEntry> => {\n try {\n const url = `${issuer.replace(/\\/$/, '')}${ENVELOPE_JWKS_PATH}`;\n const res = await fetch(url, { headers: { Accept: 'application/json' } });\n if (!res.ok) throw new Error(`envelope JWKS fetch ${url} returned ${res.status}`);\n const json = (await res.json()) as { keys: OcEnvelopePublicJwk[] };\n if (!json || !Array.isArray(json.keys)) {\n throw new Error(`envelope JWKS at ${url} did not return {keys:[…]}`);\n }\n const keys: Record<string, AuthKey> = {};\n for (const k of json.keys) {\n if (typeof k.kid !== 'string') continue;\n try {\n keys[k.kid] = (await importJWK(k, 'EdDSA')) as AuthKey;\n } catch {\n /* skip keys that won't import */\n }\n }\n const entry: JwksCacheEntry = { keys, fetchedAt: Date.now() };\n jwksCache.set(issuer, entry);\n return entry;\n } catch (err) {\n const stale = jwksCache.get(issuer);\n if (stale) return stale;\n throw err;\n }\n })().finally(() => {\n inflight.delete(issuer);\n });\n inflight.set(issuer, p);\n return p;\n}\n\nfunction hexToBytes(hex: string): Uint8Array | null {\n if (typeof hex !== 'string') return null;\n const s = hex.trim();\n if (s.length === 0 || s.length % 2 !== 0) return null;\n const out = new Uint8Array(s.length / 2);\n for (let i = 0; i < out.length; i++) {\n const b = parseInt(s.slice(i * 2, i * 2 + 2), 16);\n if (Number.isNaN(b)) return null;\n out[i] = b;\n }\n return out;\n}\n\nfunction base64ToBytes(b64: string): Uint8Array | null {\n try {\n const bin =\n typeof atob === 'function'\n ? atob(b64)\n : Buffer.from(b64, 'base64').toString('binary');\n const out = new Uint8Array(bin.length);\n for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);\n return out;\n } catch {\n return null;\n }\n}\n\nfunction bytesToHex(bytes: Uint8Array): string {\n let out = '';\n for (const b of bytes) out += b.toString(16).padStart(2, '0');\n return out;\n}\n\nasync function sha256(bytes: Uint8Array): Promise<Uint8Array> {\n const subtle =\n typeof globalThis.crypto !== 'undefined' && globalThis.crypto.subtle\n ? globalThis.crypto.subtle\n : null;\n if (!subtle) {\n throw new Error('crypto.subtle unavailable · need Node 20+ / modern browser / Edge runtime');\n }\n const buf = await subtle.digest('SHA-256', bytes as unknown as ArrayBuffer);\n return new Uint8Array(buf);\n}\n\nfunction toArrayBuffer(view: Uint8Array): ArrayBuffer {\n const buf = new ArrayBuffer(view.byteLength);\n new Uint8Array(buf).set(view);\n return buf;\n}\n\nasync function verifyEd25519(\n key: AuthKey,\n sig: Uint8Array,\n msg: Uint8Array\n): Promise<boolean> {\n const subtle =\n typeof globalThis.crypto !== 'undefined' && globalThis.crypto.subtle\n ? globalThis.crypto.subtle\n : null;\n if (!subtle) return false;\n try {\n return await subtle.verify(\n 'Ed25519',\n key as CryptoKey,\n toArrayBuffer(sig),\n toArrayBuffer(msg)\n );\n } catch {\n return false;\n }\n}\n\n/**\n * Verify a signed activity attestation bundle. Returns a typed\n * ActivityVerifyResult with per-check detail · never throws (network\n * + parse failures surface as ok=false rows in the checks array, so\n * the caller can log them without try/catch).\n *\n * Five checks, in order: bundle shape, canonical-bytes hash matches\n * id, JWK with matching kid present, ed25519 signature, freshness.\n */\nexport async function verifyActivityAttestation(\n bundle: ActivityAttestationBundle,\n options: VerifyActivityOptions = {}\n): Promise<ActivityVerifyResult> {\n const checks: ActivityVerifyCheck[] = [];\n\n // 1. Bundle shape\n const shapeOk =\n !!bundle &&\n typeof bundle === 'object' &&\n typeof bundle.sig === 'string' &&\n typeof bundle.kid === 'string' &&\n typeof bundle.canonical_b64 === 'string' &&\n !!bundle.attestation &&\n typeof bundle.attestation.id === 'string' &&\n typeof bundle.attestation.expires_at === 'string';\n checks.push({\n ok: shapeOk,\n label: 'bundle shape · sig / kid / canonical_b64 / attestation',\n });\n if (!shapeOk) {\n return { ok: false, reason: 'bundle shape invalid', checks };\n }\n\n const a = bundle.attestation;\n\n // 2. canonical_b64 decodes\n const canonical = base64ToBytes(bundle.canonical_b64);\n checks.push({\n ok: canonical !== null,\n label: 'canonical_b64 decodes',\n detail: canonical ? `${canonical.length} bytes` : 'invalid base64',\n });\n if (!canonical) return { ok: false, reason: 'canonical_b64 invalid base64', checks, attestation: a };\n\n // 3. sha256 === id\n const digest = await sha256(canonical);\n const computedId = bytesToHex(digest);\n const idOk = computedId === a.id;\n checks.push({\n ok: idOk,\n label: 'sha256(canonical_bytes) === id',\n detail: idOk ? a.id : `expected ${a.id}, got ${computedId}`,\n });\n if (!idOk) return { ok: false, reason: 'id does not match canonical-bytes hash', checks, attestation: a };\n\n // 4. JWK lookup + ed25519 verify\n let key: AuthKey | null = null;\n if (options.jwk) {\n if (options.jwk.kid !== bundle.kid) {\n checks.push({\n ok: false,\n label: 'JWK with matching kid present',\n detail: `provided jwk.kid=${options.jwk.kid} but bundle.kid=${bundle.kid}`,\n });\n return { ok: false, reason: 'kid mismatch with provided jwk', checks, attestation: a };\n }\n try {\n key = (await importJWK(options.jwk, 'EdDSA')) as AuthKey;\n checks.push({ ok: true, label: 'JWK with matching kid present', detail: `kid ${bundle.kid} (provided)` });\n } catch (err) {\n checks.push({\n ok: false,\n label: 'JWK with matching kid present',\n detail: `provided jwk failed import: ${(err as Error).message}`,\n });\n return { ok: false, reason: 'provided jwk failed import', checks, attestation: a };\n }\n } else {\n const issuer = options.issuer ?? DEFAULT_ISSUER;\n const ttl = options.jwksCacheTtlMs ?? DEFAULT_TTL_MS;\n try {\n let entry = await fetchEnvelopeJwks(issuer, ttl);\n key = entry.keys[bundle.kid] ?? null;\n if (!key) {\n // Cache miss · likely a rotation. Force-refresh once.\n jwksCache.delete(issuer);\n entry = await fetchEnvelopeJwks(issuer, ttl);\n key = entry.keys[bundle.kid] ?? null;\n }\n checks.push({\n ok: !!key,\n label: 'JWK with matching kid present',\n detail: key ? `kid ${bundle.kid}` : `no JWK with kid ${bundle.kid} at ${issuer}${ENVELOPE_JWKS_PATH}`,\n });\n if (!key) {\n return { ok: false, reason: `kid ${bundle.kid} not in envelope JWKS`, checks, attestation: a };\n }\n } catch (err) {\n checks.push({\n ok: false,\n label: 'JWK with matching kid present',\n detail: `envelope JWKS unavailable: ${(err as Error).message}`,\n });\n return {\n ok: false,\n reason: `envelope JWKS unavailable: ${(err as Error).message}`,\n checks,\n attestation: a,\n };\n }\n }\n\n const sigBytes = hexToBytes(bundle.sig);\n if (!sigBytes) {\n checks.push({\n ok: false,\n label: 'ed25519.verify(sig, canonical_bytes, jwk.public)',\n detail: 'malformed sig (expected hex)',\n });\n return { ok: false, reason: 'malformed sig', checks, attestation: a };\n }\n const sigOk = await verifyEd25519(key, sigBytes, canonical);\n checks.push({\n ok: sigOk,\n label: 'ed25519.verify(sig, canonical_bytes, jwk.public)',\n detail: sigOk ? 'signature valid' : 'signature does not match',\n });\n if (!sigOk) return { ok: false, reason: 'signature does not match', checks, attestation: a };\n\n // 5. Freshness\n const now = options.now ?? new Date();\n const expiresMs = Date.parse(a.expires_at);\n const freshOk = Number.isFinite(expiresMs) && expiresMs > now.getTime();\n checks.push({\n ok: freshOk,\n label: 'now < attestation.expires_at',\n detail: freshOk\n ? `expires ${new Date(expiresMs).toISOString()}`\n : 'attestation has expired',\n });\n if (!freshOk) return { ok: false, reason: 'attestation has expired', checks, attestation: a };\n\n return { ok: true, attestation: a, checks };\n}\n\n/** Force-refresh the envelope-JWKS cache · useful after a key rotation\n * if you don't want to wait for the TTL to expire. */\nexport async function refreshEnvelopeJwks(issuer = DEFAULT_ISSUER): Promise<void> {\n jwksCache.delete(issuer);\n await fetchEnvelopeJwks(issuer, DEFAULT_TTL_MS);\n}\n\nexport const identity = {\n verifyActivityAttestation,\n refreshEnvelopeJwks,\n};\n","/**\n * @orangecheck/me-client/server\n *\n * Server-side verification helpers for OC integrators.\n *\n * import {\n * withOcAuth,\n * getOcSession,\n * verifyOcToken,\n * verifyActivityAttestation,\n * } from '@orangecheck/me-client/server';\n *\n * Zero env vars, zero JWK handling. Internally lazy-fetches the auth\n * host's JWKS at https://ochk.io/.well-known/jwks.json and the\n * envelope JWKS at https://me.ochk.io/.well-known/oc-envelope-jwks.json,\n * caches both in-process. Integrators write code; we handle the crypto.\n *\n * Three layers of session verification, smallest to thickest:\n *\n * verifyOcToken(token) → SessionPayload | null\n * getOcSession(headers) → SessionPayload | null (cookie OR Bearer)\n * withOcAuth(handler) → Next.js Pages adapter that injects\n * req.ocSession on the request object\n * ocAuthExpress(opts?) → Express / Connect middleware\n * ocAuthHono(opts?) → Hono middleware\n *\n * Plus the activity-attestation verifier · for sybil-resistance gating:\n *\n * verifyActivityAttestation(bundle, opts?) → ActivityVerifyResult\n *\n * Same envelope-JWKS verification posture as the public /verify-activity\n * page; same five checks (shape / id / kid / sig / freshness). Use to\n * gate sensitive flows on cross-integrator lifetime_sats + duration +\n * distinct_count + active_days · all values are content-addressed and\n * signed.\n *\n * All thin wrappers around the same crypto primitives. Bring your own\n * framework.\n */\n\nimport {\n bondMeets,\n getOcSession as getOcSessionCore,\n readBondClaim,\n verifyOcToken,\n type BondClaim,\n type SessionPayload,\n type VerifyOcOptions,\n type SessionRequestHeaders,\n} from '@orangecheck/auth-core';\n\nexport { bondMeets, readBondClaim, verifyOcToken };\nexport type { BondClaim, SessionPayload, VerifyOcOptions };\n\n// Activity-attestation verifier · re-export from the identity module so\n// server-side integrators get the gating helper alongside session\n// verification without a second import path.\nexport {\n identity,\n verifyActivityAttestation,\n refreshEnvelopeJwks,\n} from './identity';\nexport type {\n ActivityAttestation,\n ActivityAttestationBundle,\n ActivityVerifyCheck,\n ActivityVerifyResult,\n VerifyActivityOptions,\n} from './identity';\n\n/**\n * Verify the OC session for a request. Accepts either:\n *\n * - A Web Headers object (Hono / edge / Fetch API): `c.req.raw.headers`\n * - A plain `{ cookie, authorization }` object (Express / Next.js Pages /\n * Fastify / etc.): `{ cookie: req.headers.cookie, authorization: req.headers.authorization }`\n *\n * Reads the `oc_session` cookie first; falls back to\n * `Authorization: Bearer <token>` so cross-domain integrators (no\n * .ochk.io cookie reach) verify the same way.\n *\n * Returns `null` for unauthenticated requests. Never throws.\n */\nexport async function getOcSession(\n headers: SessionRequestHeaders | Headers,\n options: VerifyOcOptions = {}\n): Promise<SessionPayload | null> {\n const session = await getOcSessionCore(headers, options);\n if (!session && options.audience === undefined) warnIfAudienceMissing(headers);\n return session;\n}\n\nlet warnedAudience = false;\n\n/**\n * The popup issues a token bound to your site's origin. Verified with no\n * `audience`, it is refused — correctly, since a verifier with no audience\n * accepts only family sessions — and every popup sign-in would 401 with no\n * clue why. Say so, once, the first time it happens.\n */\nfunction warnIfAudienceMissing(headers: SessionRequestHeaders | Headers): void {\n if (warnedAudience) return;\n const auth =\n typeof Headers !== 'undefined' && headers instanceof Headers\n ? headers.get('authorization')\n : (headers as SessionRequestHeaders).authorization;\n const m = typeof auth === 'string' ? /^Bearer\\s+([^.]+)\\.([^.]+)\\./i.exec(auth) : null;\n if (!m) return;\n try {\n const payload = JSON.parse(base64UrlToString(m[2]!)) as { aud?: unknown };\n if (payload.aud === undefined) return;\n warnedAudience = true;\n console.warn(\n `[@orangecheck/me-client] a sign-in token bound to ${JSON.stringify(payload.aud)} was refused ` +\n 'because no `audience` is configured. Pass your site origin, e.g. ' +\n \"withOcAuth(handler, { audience: 'https://your-site.example' }).\"\n );\n } catch {\n // Not a JWT we can read · nothing useful to say.\n }\n}\n\nfunction base64UrlToString(s: string): string {\n const b64 = s.replace(/-/g, '+').replace(/_/g, '/');\n if (typeof atob === 'function') return atob(b64 + '='.repeat((4 - (b64.length % 4)) % 4));\n return Buffer.from(s, 'base64url').toString('utf8');\n}\n\n// ─── Next.js Pages Router adapter ────────────────────────────────────────\n\ninterface NextApiRequestLike {\n headers: { cookie?: string; authorization?: string; [k: string]: unknown };\n ocSession?: SessionPayload | null;\n}\ninterface NextApiResponseLike {\n status(code: number): NextApiResponseLike;\n json(body: unknown): unknown;\n setHeader(name: string, value: string | number | readonly string[]): unknown;\n}\ntype NextApiHandlerLike = (req: NextApiRequestLike, res: NextApiResponseLike) => unknown | Promise<unknown>;\n\nexport interface WithOcAuthOptions extends VerifyOcOptions {\n /** When true, unauthenticated requests get a 401 + `{ok:false}` response\n * before the wrapped handler runs. Default: false — handler runs and\n * receives `req.ocSession === null`, useful when the route serves both\n * signed-in and anonymous users. */\n required?: boolean;\n /**\n * Refuse a signed-in account (403, `reason: 'bond_required'`) unless a\n * bond backs it: one unspent coin of at least `minSats`, unspent at least\n * `minDays` days, checked within `maxAgeSecs`. The app never learns the\n * coin; `req.ocSession.oc_bond.nullifier` is the same for the same coin at\n * your site, so ban that to ban the coin. Implies `required`.\n */\n requireBond?: { minSats?: number; minDays?: number; maxAgeSecs?: number };\n /**\n * Your project key. The requirement you set in the project's settings\n * (\"who can sign in\") is read from me.ochk.io within a minute of a change\n * and enforced like `requireBond`, so you change it there, not in code.\n * An explicit `requireBond` wins over it.\n */\n projectKey?: string;\n /** Where the project config is read. Default https://me.ochk.io. */\n meOrigin?: string;\n}\n\ntype BondNeed = NonNullable<WithOcAuthOptions['requireBond']>;\nconst POLICY_TTL_MS = 60_000;\nconst policies = new Map<string, { at: number; need: BondNeed | null }>();\n\n/**\n * The project's requirement, from its uncached sign-in endpoint, held a\n * minute here. (The price config is edge-cached for ten minutes: reading the\n * requirement there let a just-tightened app keep admitting unbacked accounts.)\n * When it can't be read, the last one read stands; with none read yet it is\n * `undefined`, and the request is refused rather than let through unchecked.\n */\nasync function projectRequirement(options: WithOcAuthOptions): Promise<BondNeed | null | undefined> {\n const key = options.projectKey!;\n const hit = policies.get(key);\n if (hit && Date.now() - hit.at < POLICY_TTL_MS) return hit.need;\n try {\n const base = options.meOrigin ?? 'https://me.ochk.io';\n const r = await fetch(`${base}/api/integrator/${encodeURIComponent(key)}/sign-in`, {\n signal: AbortSignal.timeout(4000),\n });\n if (!r.ok) throw new Error(`HTTP ${r.status}`);\n const j = (await r.json()) as {\n require_bond?: { min_sats: number; min_days: number } | null;\n };\n const req = j.require_bond ?? null;\n const need = req ? { minSats: req.min_sats, minDays: req.min_days } : null;\n policies.set(key, { at: Date.now(), need });\n return need;\n } catch {\n return hit?.need;\n }\n}\n\n/** The requirement in force: explicit, else the project's, else none. */\nasync function bondNeed(options: WithOcAuthOptions): Promise<BondNeed | null | undefined> {\n if (options.requireBond) return options.requireBond;\n if (options.projectKey) return projectRequirement(options);\n return null;\n}\n\n/** Why a session can't pass, as a status and body, or null when it can. */\nasync function refusal(\n session: SessionPayload | null,\n options: WithOcAuthOptions\n): Promise<{ status: number; body: Record<string, unknown> } | null> {\n const need = await bondNeed(options);\n if (!session) {\n return options.required || need !== null\n ? { status: 401, body: { ok: false, reason: 'unauthenticated' } }\n : null;\n }\n if (need === undefined) {\n return { status: 503, body: { ok: false, reason: 'bond_policy_unavailable' } };\n }\n if (need && !bondMeets(session, need)) {\n const have = readBondClaim(session);\n return {\n status: 403,\n body: {\n ok: false,\n reason: 'bond_required',\n need,\n have: have ? { sats_floor: have.sats_floor, days_floor: have.days_floor } : null,\n },\n };\n }\n return null;\n}\n\n/**\n * Wrap a Next.js Pages-Router API route handler. Adds `req.ocSession` —\n * the verified SessionPayload, or null when unauthenticated.\n *\n * // pages/api/me/profile.ts\n * import { withOcAuth } from '@orangecheck/me-client/server';\n *\n * export default withOcAuth(async (req, res) => {\n * if (!req.ocSession) return res.status(401).json({ ok: false });\n * res.status(200).json({ account: { address: req.ocSession.did_oc } });\n * }, { required: true, audience: 'https://your-site.example' });\n *\n * `audience` is your own origin. The sign-in popup issues each site a token\n * bound to it; a site on *.ochk.io that reads the family cookie omits it.\n *\n * `Cache-Control: no-store, private` and `Vary: Cookie, Authorization`\n * are set on every authenticated response — without them a cached 401\n * leaks anonymous to authenticated callers.\n */\nexport function withOcAuth<T extends NextApiHandlerLike>(\n handler: T,\n options: WithOcAuthOptions = {}\n): T {\n const wrapped = async (req: NextApiRequestLike, res: NextApiResponseLike) => {\n res.setHeader('Cache-Control', 'no-store, private');\n res.setHeader('Vary', 'Cookie, Authorization');\n const session = await getOcSession(\n {\n cookie: typeof req.headers.cookie === 'string' ? req.headers.cookie : null,\n authorization:\n typeof req.headers.authorization === 'string'\n ? req.headers.authorization\n : null,\n },\n options\n );\n req.ocSession = session;\n const refused = await refusal(session, options);\n if (refused) return res.status(refused.status).json(refused.body);\n return handler(req, res);\n };\n return wrapped as unknown as T;\n}\n\n// ─── Express / Connect middleware ────────────────────────────────────────\n\ninterface ExpressRequestLike {\n headers: { cookie?: string; authorization?: string; [k: string]: unknown };\n ocSession?: SessionPayload | null;\n}\ninterface ExpressResponseLike {\n status(code: number): ExpressResponseLike;\n json(body: unknown): unknown;\n setHeader(name: string, value: string | number | readonly string[]): unknown;\n}\ntype ExpressNextLike = (err?: unknown) => void;\n\n/**\n * Express / Connect middleware. Attaches `req.ocSession` (verified\n * SessionPayload | null) and calls next(). Use it as a global middleware\n * or per-route.\n *\n * import express from 'express';\n * import { ocAuthExpress } from '@orangecheck/me-client/server';\n *\n * const app = express();\n * app.use(ocAuthExpress());\n *\n * app.get('/api/profile', (req, res) => {\n * if (!req.ocSession) return res.status(401).json({ error: 'sign in' });\n * res.json({ address: req.ocSession.did_oc });\n * });\n *\n * Pass `{ required: true }` to short-circuit unauthenticated requests\n * with a 401 before they reach your handler.\n */\nexport function ocAuthExpress(options: WithOcAuthOptions = {}) {\n return async (req: ExpressRequestLike, res: ExpressResponseLike, next: ExpressNextLike) => {\n try {\n res.setHeader('Cache-Control', 'no-store, private');\n res.setHeader('Vary', 'Cookie, Authorization');\n const session = await getOcSession(\n {\n cookie: typeof req.headers.cookie === 'string' ? req.headers.cookie : null,\n authorization:\n typeof req.headers.authorization === 'string'\n ? req.headers.authorization\n : null,\n },\n options\n );\n req.ocSession = session;\n const refused = await refusal(session, options);\n if (refused) {\n res.status(refused.status).json(refused.body);\n return;\n }\n next();\n } catch (err) {\n next(err);\n }\n };\n}\n\n// ─── Hono middleware ─────────────────────────────────────────────────────\n\ninterface HonoContextLike {\n req: { raw: { headers: Headers } };\n set(key: string, value: unknown): void;\n json(body: unknown, status?: number): unknown;\n header(name: string, value: string): void;\n}\ntype HonoNextLike = () => Promise<void>;\n\n/**\n * Hono middleware. Attaches the verified session at `c.get('ocSession')`.\n *\n * import { Hono } from 'hono';\n * import { ocAuthHono } from '@orangecheck/me-client/server';\n *\n * const app = new Hono();\n * app.use('*', ocAuthHono());\n *\n * app.get('/api/profile', (c) => {\n * const session = c.get('ocSession');\n * if (!session) return c.json({ error: 'sign in' }, 401);\n * return c.json({ address: session.did_oc });\n * });\n */\nexport function ocAuthHono(options: WithOcAuthOptions = {}) {\n return async (c: HonoContextLike, next: HonoNextLike) => {\n c.header('Cache-Control', 'no-store, private');\n c.header('Vary', 'Cookie, Authorization');\n const session = await getOcSession(c.req.raw.headers, options);\n c.set('ocSession', session);\n const refused = await refusal(session, options);\n if (refused) return c.json(refused.body, refused.status);\n await next();\n };\n}\n"]}
package/dist/server.mjs CHANGED
@@ -467,7 +467,7 @@ function base64UrlToString(s) {
467
467
  if (typeof atob === "function") return atob(b64 + "=".repeat((4 - b64.length % 4) % 4));
468
468
  return Buffer.from(s, "base64url").toString("utf8");
469
469
  }
470
- var POLICY_TTL_MS = 5 * 6e4;
470
+ var POLICY_TTL_MS = 6e4;
471
471
  var policies = /* @__PURE__ */ new Map();
472
472
  async function projectRequirement(options) {
473
473
  const key = options.projectKey;
@@ -475,12 +475,12 @@ async function projectRequirement(options) {
475
475
  if (hit && Date.now() - hit.at < POLICY_TTL_MS) return hit.need;
476
476
  try {
477
477
  const base = options.meOrigin ?? "https://me.ochk.io";
478
- const r = await fetch(`${base}/api/integrator/config?project_key=${encodeURIComponent(key)}`, {
478
+ const r = await fetch(`${base}/api/integrator/${encodeURIComponent(key)}/sign-in`, {
479
479
  signal: AbortSignal.timeout(4e3)
480
480
  });
481
481
  if (!r.ok) throw new Error(`HTTP ${r.status}`);
482
482
  const j = await r.json();
483
- const req = j.config?.require_bond ?? null;
483
+ const req = j.require_bond ?? null;
484
484
  const need = req ? { minSats: req.min_sats, minDays: req.min_days } : null;
485
485
  policies.set(key, { at: Date.now(), need });
486
486
  return need;
package/dist/server.mjs.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"sources":["../node_modules/jose/dist/webapi/lib/buffer_utils.js","../node_modules/jose/dist/webapi/lib/base64.js","../node_modules/jose/dist/webapi/util/base64url.js","../node_modules/jose/dist/webapi/util/errors.js","../node_modules/jose/dist/webapi/lib/type_checks.js","../node_modules/jose/dist/webapi/lib/jwk_to_key.js","../node_modules/jose/dist/webapi/key/import.js","../src/identity.ts","../src/server.ts"],"names":["getOcSessionCore"],"mappings":";;;;;;;;AAAuB,IAAI,WAAA;AACpB,IAAM,OAAA,GAAU,IAAI,WAAA,EAAY;;;ACUhC,SAAS,aAAa,OAAA,EAAS;AAClC,EAAA,IAAI,WAAW,UAAA,EAAY;AACvB,IAAA,OAAO,UAAA,CAAW,WAAW,OAAO,CAAA;AAAA,EACxC;AACA,EAAA,MAAM,MAAA,GAAS,KAAK,OAAO,CAAA;AAC3B,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,MAAA,CAAO,MAAM,CAAA;AAC1C,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,QAAQ,CAAA,EAAA,EAAK;AACpC,IAAA,KAAA,CAAM,CAAC,CAAA,GAAI,MAAA,CAAO,UAAA,CAAW,CAAC,CAAA;AAAA,EAClC;AACA,EAAA,OAAO,KAAA;AACX;;;ACnBO,SAAS,OAAO,KAAA,EAAO;AAC1B,EAAA,IAAI,WAAW,UAAA,EAAY;AACvB,IAAA,OAAO,UAAA,CAAW,WAAW,OAAO,KAAA,KAAU,WAAW,KAAA,GAAQ,OAAA,CAAQ,MAAA,CAAO,KAAK,CAAA,EAAG;AAAA,MACpF,QAAA,EAAU;AAAA,KACb,CAAA;AAAA,EACL;AACA,EAAA,IAAI,OAAA,GAAU,KAAA;AACd,EAAA,IAAI,mBAAmB,UAAA,EAAY;AAC/B,IAAA,OAAA,GAAU,OAAA,CAAQ,OAAO,OAAO,CAAA;AAAA,EACpC;AACA,EAAA,OAAA,GAAU,QAAQ,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AACtD,EAAA,IAAI;AACA,IAAA,OAAO,aAAa,OAAO,CAAA;AAAA,EAC/B,CAAA,CAAA,MACM;AACF,IAAA,MAAM,IAAI,UAAU,mDAAmD,CAAA;AAAA,EAC3E;AACJ;;;ACnBO,IAAM,SAAA,GAAN,cAAwB,KAAA,CAAM;AAAA,EAGjC,WAAA,CAAY,SAAS,OAAA,EAAS;AAC1B,IAAA,KAAA,CAAM,SAAS,OAAO,CAAA;AAF1B,IAAA,aAAA,CAAA,IAAA,EAAA,MAAA,EAAO,kBAAA,CAAA;AAGH,IAAA,IAAA,CAAK,IAAA,GAAO,KAAK,WAAA,CAAY,IAAA;AAC7B,IAAA,KAAA,CAAM,iBAAA,GAAoB,IAAA,EAAM,IAAA,CAAK,WAAW,CAAA;AAAA,EACpD;AACJ,CAAA;AAPI,aAAA,CADS,WACF,MAAA,EAAO,kBAAA,CAAA;AAsCX,IAAM,gBAAA,GAAN,cAA+B,SAAA,CAAU;AAAA,EAAzC,WAAA,GAAA;AAAA,IAAA,KAAA,CAAA,GAAA,SAAA,CAAA;AAEH,IAAA,aAAA,CAAA,IAAA,EAAA,MAAA,EAAO,wBAAA,CAAA;AAAA,EAAA;AACX,CAAA;AAFI,aAAA,CADS,kBACF,MAAA,EAAO,wBAAA,CAAA;AAxClB,IAAA,EAAA,EAAA,EAAA;AA6EO,IAAM,wBAAA,GAAN,eAAuC,EAAA,GAAA,SAAA,EACzC,EAAA,GAAA,MAAA,CAAO,eADkC,EAAA,EAAU;AAAA,EAIpD,WAAA,CAAY,OAAA,GAAU,sDAAA,EAAwD,OAAA,EAAS;AACnF,IAAA,KAAA,CAAM,SAAS,OAAO,CAAA;AAJ1B,IAAA,aAAA,CAAA,IAAA,EAAC,EAAA,CAAA;AAED,IAAA,aAAA,CAAA,IAAA,EAAA,MAAA,EAAO,iCAAA,CAAA;AAAA,EAGP;AACJ,CAAA;AALI,aAAA,CAFS,0BAEF,MAAA,EAAO,iCAAA,CAAA;;;AC/ElB,IAAM,eAAe,CAAC,KAAA,KAAU,OAAO,KAAA,KAAU,YAAY,KAAA,KAAU,IAAA;AAChE,SAAS,SAAS,KAAA,EAAO;AAC5B,EAAA,IAAI,CAAC,YAAA,CAAa,KAAK,CAAA,IAAK,MAAA,CAAO,UAAU,QAAA,CAAS,IAAA,CAAK,KAAK,CAAA,KAAM,iBAAA,EAAmB;AACrF,IAAA,OAAO,KAAA;AAAA,EACX;AACA,EAAA,IAAI,MAAA,CAAO,cAAA,CAAe,KAAK,CAAA,KAAM,IAAA,EAAM;AACvC,IAAA,OAAO,IAAA;AAAA,EACX;AACA,EAAA,IAAI,KAAA,GAAQ,KAAA;AACZ,EAAA,OAAO,MAAA,CAAO,cAAA,CAAe,KAAK,CAAA,KAAM,IAAA,EAAM;AAC1C,IAAA,KAAA,GAAQ,MAAA,CAAO,eAAe,KAAK,CAAA;AAAA,EACvC;AACA,EAAA,OAAO,MAAA,CAAO,cAAA,CAAe,KAAK,CAAA,KAAM,KAAA;AAC5C;;;ACZA,IAAM,cAAA,GAAiB,8DAAA;AACvB,SAAS,cAAc,GAAA,EAAK;AACxB,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI,SAAA;AACJ,EAAA,QAAQ,IAAI,GAAA;AAAK,IACb,KAAK,KAAA,EAAO;AACR,MAAA,QAAQ,IAAI,GAAA;AAAK,QACb,KAAK,WAAA;AAAA,QACL,KAAK,WAAA;AAAA,QACL,KAAK,WAAA;AACD,UAAA,SAAA,GAAY,EAAE,IAAA,EAAM,GAAA,CAAI,GAAA,EAAI;AAC5B,UAAA,SAAA,GAAY,IAAI,IAAA,GAAO,CAAC,MAAM,CAAA,GAAI,CAAC,QAAQ,CAAA;AAC3C,UAAA;AAAA,QACJ;AACI,UAAA,MAAM,IAAI,iBAAiB,cAAc,CAAA;AAAA;AAEjD,MAAA;AAAA,IACJ;AAAA,IACA,KAAK,KAAA,EAAO;AACR,MAAA,QAAQ,IAAI,GAAA;AAAK,QACb,KAAK,OAAA;AAAA,QACL,KAAK,OAAA;AAAA,QACL,KAAK,OAAA;AACD,UAAA,SAAA,GAAY,EAAE,IAAA,EAAM,SAAA,EAAW,IAAA,EAAM,CAAA,IAAA,EAAO,IAAI,GAAA,CAAI,KAAA,CAAM,EAAE,CAAC,CAAA,CAAA,EAAG;AAChE,UAAA,SAAA,GAAY,IAAI,CAAA,GAAI,CAAC,MAAM,CAAA,GAAI,CAAC,QAAQ,CAAA;AACxC,UAAA;AAAA,QACJ,KAAK,OAAA;AAAA,QACL,KAAK,OAAA;AAAA,QACL,KAAK,OAAA;AACD,UAAA,SAAA,GAAY,EAAE,IAAA,EAAM,mBAAA,EAAqB,IAAA,EAAM,CAAA,IAAA,EAAO,IAAI,GAAA,CAAI,KAAA,CAAM,EAAE,CAAC,CAAA,CAAA,EAAG;AAC1E,UAAA,SAAA,GAAY,IAAI,CAAA,GAAI,CAAC,MAAM,CAAA,GAAI,CAAC,QAAQ,CAAA;AACxC,UAAA;AAAA,QACJ,KAAK,UAAA;AAAA,QACL,KAAK,cAAA;AAAA,QACL,KAAK,cAAA;AAAA,QACL,KAAK,cAAA;AACD,UAAA,SAAA,GAAY;AAAA,YACR,IAAA,EAAM,UAAA;AAAA,YACN,IAAA,EAAM,CAAA,IAAA,EAAO,QAAA,CAAS,GAAA,CAAI,GAAA,CAAI,MAAM,EAAE,CAAA,EAAG,EAAE,CAAA,IAAK,CAAC,CAAA;AAAA,WACrD;AACA,UAAA,SAAA,GAAY,GAAA,CAAI,IAAI,CAAC,SAAA,EAAW,WAAW,CAAA,GAAI,CAAC,WAAW,SAAS,CAAA;AACpE,UAAA;AAAA,QACJ;AACI,UAAA,MAAM,IAAI,iBAAiB,cAAc,CAAA;AAAA;AAEjD,MAAA;AAAA,IACJ;AAAA,IACA,KAAK,IAAA,EAAM;AACP,MAAA,QAAQ,IAAI,GAAA;AAAK,QACb,KAAK,OAAA;AAAA,QACL,KAAK,OAAA;AAAA,QACL,KAAK,OAAA;AACD,UAAA,SAAA,GAAY;AAAA,YACR,IAAA,EAAM,OAAA;AAAA,YACN,UAAA,EAAY,EAAE,KAAA,EAAO,OAAA,EAAS,KAAA,EAAO,SAAS,KAAA,EAAO,OAAA,EAAQ,CAAE,GAAA,CAAI,GAAG;AAAA,WAC1E;AACA,UAAA,SAAA,GAAY,IAAI,CAAA,GAAI,CAAC,MAAM,CAAA,GAAI,CAAC,QAAQ,CAAA;AACxC,UAAA;AAAA,QACJ,KAAK,SAAA;AAAA,QACL,KAAK,gBAAA;AAAA,QACL,KAAK,gBAAA;AAAA,QACL,KAAK,gBAAA;AACD,UAAA,SAAA,GAAY,EAAE,IAAA,EAAM,MAAA,EAAQ,UAAA,EAAY,IAAI,GAAA,EAAI;AAChD,UAAA,SAAA,GAAY,GAAA,CAAI,CAAA,GAAI,CAAC,YAAY,IAAI,EAAC;AACtC,UAAA;AAAA,QACJ;AACI,UAAA,MAAM,IAAI,iBAAiB,cAAc,CAAA;AAAA;AAEjD,MAAA;AAAA,IACJ;AAAA,IACA,KAAK,KAAA,EAAO;AACR,MAAA,QAAQ,IAAI,GAAA;AAAK,QACb,KAAK,SAAA;AAAA,QACL,KAAK,OAAA;AACD,UAAA,SAAA,GAAY,EAAE,MAAM,SAAA,EAAU;AAC9B,UAAA,SAAA,GAAY,IAAI,CAAA,GAAI,CAAC,MAAM,CAAA,GAAI,CAAC,QAAQ,CAAA;AACxC,UAAA;AAAA,QACJ,KAAK,SAAA;AAAA,QACL,KAAK,gBAAA;AAAA,QACL,KAAK,gBAAA;AAAA,QACL,KAAK,gBAAA;AACD,UAAA,SAAA,GAAY,EAAE,IAAA,EAAM,GAAA,CAAI,GAAA,EAAI;AAC5B,UAAA,SAAA,GAAY,GAAA,CAAI,CAAA,GAAI,CAAC,YAAY,IAAI,EAAC;AACtC,UAAA;AAAA,QACJ;AACI,UAAA,MAAM,IAAI,iBAAiB,cAAc,CAAA;AAAA;AAEjD,MAAA;AAAA,IACJ;AAAA,IACA;AACI,MAAA,MAAM,IAAI,iBAAiB,6DAA6D,CAAA;AAAA;AAEhG,EAAA,OAAO,EAAE,WAAW,SAAA,EAAU;AAClC;AACA,eAAsB,SAAS,GAAA,EAAK;AAChC,EAAA,IAAI,CAAC,IAAI,GAAA,EAAK;AACV,IAAA,MAAM,IAAI,UAAU,0DAA0D,CAAA;AAAA,EAClF;AACA,EAAA,MAAM,EAAE,SAAA,EAAW,SAAA,EAAU,GAAI,cAAc,GAAG,CAAA;AAClD,EAAA,MAAM,OAAA,GAAU,EAAE,GAAG,GAAA,EAAI;AACzB,EAAA,IAAI,OAAA,CAAQ,QAAQ,KAAA,EAAO;AACvB,IAAA,OAAO,OAAA,CAAQ,GAAA;AAAA,EACnB;AACA,EAAA,OAAO,OAAA,CAAQ,GAAA;AACf,EAAA,OAAO,OAAO,MAAA,CAAO,SAAA,CAAU,KAAA,EAAO,OAAA,EAAS,WAAW,GAAA,CAAI,GAAA,KAAQ,GAAA,CAAI,CAAA,IAAK,IAAI,IAAA,GAAO,KAAA,GAAQ,IAAA,CAAA,EAAO,GAAA,CAAI,WAAW,SAAS,CAAA;AACrI;;;ACnFA,eAAsB,SAAA,CAAU,GAAA,EAAK,GAAA,EAAK,OAAA,EAAS;AAC/C,EAAA,IAAI,CAAC,QAAA,CAAS,GAAG,CAAA,EAAG;AAChB,IAAA,MAAM,IAAI,UAAU,uBAAuB,CAAA;AAAA,EAC/C;AACA,EAAA,IAAI,GAAA;AAEJ,EAAA,GAAA,KAAA,GAAA,GAAgC,GAAA,CAAI,GAAA,CAAA;AACpC,EAAA,QAAQ,IAAI,GAAA;AAAK,IACb,KAAK,KAAA;AACD,MAAA,IAAI,OAAO,GAAA,CAAI,CAAA,KAAM,QAAA,IAAY,CAAC,IAAI,CAAA,EAAG;AACrC,QAAA,MAAM,IAAI,UAAU,yCAAyC,CAAA;AAAA,MACjE;AACA,MAAA,OAAO,MAAA,CAAgB,IAAI,CAAC,CAAA;AAAA,IAChC,KAAK,KAAA;AACD,MAAA,IAAI,KAAA,IAAS,GAAA,IAAO,GAAA,CAAI,GAAA,KAAQ,MAAA,EAAW;AACvC,QAAA,MAAM,IAAI,iBAAiB,oEAAoE,CAAA;AAAA,MACnG;AACA,MAAA,OAAO,SAAS,EAAE,GAAG,GAAA,EAAK,GAAA,EAAK,KAAK,CAAA;AAAA,IACxC,KAAK,KAAA,EAAO;AACR,MAAA,IAAI,OAAO,GAAA,CAAI,GAAA,KAAQ,QAAA,IAAY,CAAC,IAAI,GAAA,EAAK;AACzC,QAAA,MAAM,IAAI,UAAU,2CAA2C,CAAA;AAAA,MACnE;AACA,MAAA,IAAyB,GAAA,KAAQ,GAAA,CAAI,GAAA,EAAK;AACtC,QAAA,MAAM,IAAI,UAAU,uCAAuC,CAAA;AAAA,MAC/D;AACA,MAAA,OAAO,QAAA,CAAS,EAAE,GAAG,GAAA,EAAK,KAAK,CAAA;AAAA,IACnC;AAAA,IACA,KAAK,IAAA;AAAA,IACL,KAAK,KAAA;AACD,MAAA,OAAO,SAAS,EAAE,GAAG,GAAA,EAAK,GAAA,EAAK,KAAK,CAAA;AAAA,IACxC;AACI,MAAA,MAAM,IAAI,iBAAiB,8CAA8C,CAAA;AAAA;AAErF;;;AClCA,IAAM,cAAA,GAAiB,oBAAA;AACvB,IAAM,cAAA,GAAiB,KAAK,EAAA,GAAK,GAAA;AACjC,IAAM,kBAAA,GAAqB,oCAAA;AAoE3B,IAAM,SAAA,uBAAgB,GAAA,EAA4B;AAClD,IAAM,QAAA,uBAAe,GAAA,EAAqC;AAE1D,eAAe,iBAAA,CAAkB,QAAgB,KAAA,EAAwC;AACrF,EAAA,MAAM,MAAA,GAAS,SAAA,CAAU,GAAA,CAAI,MAAM,CAAA;AACnC,EAAA,IAAI,UAAU,IAAA,CAAK,GAAA,KAAQ,MAAA,CAAO,SAAA,GAAY,OAAO,OAAO,MAAA;AAC5D,EAAA,MAAM,QAAA,GAAW,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA;AACpC,EAAA,IAAI,UAAU,OAAO,QAAA;AACrB,EAAA,MAAM,KAAK,YAAqC;AAC5C,IAAA,IAAI;AACA,MAAA,MAAM,GAAA,GAAM,GAAG,MAAA,CAAO,OAAA,CAAQ,OAAO,EAAE,CAAC,GAAG,kBAAkB,CAAA,CAAA;AAC7D,MAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,SAAS,EAAE,MAAA,EAAQ,kBAAA,EAAmB,EAAG,CAAA;AACxE,MAAA,IAAI,CAAC,GAAA,CAAI,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,GAAG,CAAA,UAAA,EAAa,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAChF,MAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAC7B,MAAA,IAAI,CAAC,IAAA,IAAQ,CAAC,MAAM,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAA,EAAG;AACpC,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,iBAAA,EAAoB,GAAG,CAAA,+BAAA,CAA4B,CAAA;AAAA,MACvE;AACA,MAAA,MAAM,OAAgC,EAAC;AACvC,MAAA,KAAA,MAAW,CAAA,IAAK,KAAK,IAAA,EAAM;AACvB,QAAA,IAAI,OAAO,CAAA,CAAE,GAAA,KAAQ,QAAA,EAAU;AAC/B,QAAA,IAAI;AACA,UAAA,IAAA,CAAK,EAAE,GAAG,CAAA,GAAK,MAAM,SAAA,CAAU,GAAG,OAAO,CAAA;AAAA,QAC7C,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACJ;AACA,MAAA,MAAM,QAAwB,EAAE,IAAA,EAAM,SAAA,EAAW,IAAA,CAAK,KAAI,EAAE;AAC5D,MAAA,SAAA,CAAU,GAAA,CAAI,QAAQ,KAAK,CAAA;AAC3B,MAAA,OAAO,KAAA;AAAA,IACX,SAAS,GAAA,EAAK;AACV,MAAA,MAAM,KAAA,GAAQ,SAAA,CAAU,GAAA,CAAI,MAAM,CAAA;AAClC,MAAA,IAAI,OAAO,OAAO,KAAA;AAClB,MAAA,MAAM,GAAA;AAAA,IACV;AAAA,EACJ,CAAA,GAAG,CAAE,OAAA,CAAQ,MAAM;AACf,IAAA,QAAA,CAAS,OAAO,MAAM,CAAA;AAAA,EAC1B,CAAC,CAAA;AACD,EAAA,QAAA,CAAS,GAAA,CAAI,QAAQ,CAAC,CAAA;AACtB,EAAA,OAAO,CAAA;AACX;AAEA,SAAS,WAAW,GAAA,EAAgC;AAChD,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,OAAO,IAAA;AACpC,EAAA,MAAM,CAAA,GAAI,IAAI,IAAA,EAAK;AACnB,EAAA,IAAI,EAAE,MAAA,KAAW,CAAA,IAAK,EAAE,MAAA,GAAS,CAAA,KAAM,GAAG,OAAO,IAAA;AACjD,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,CAAA,CAAE,SAAS,CAAC,CAAA;AACvC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,GAAA,CAAI,QAAQ,CAAA,EAAA,EAAK;AACjC,IAAA,MAAM,CAAA,GAAI,QAAA,CAAS,CAAA,CAAE,KAAA,CAAM,CAAA,GAAI,GAAG,CAAA,GAAI,CAAA,GAAI,CAAC,CAAA,EAAG,EAAE,CAAA;AAChD,IAAA,IAAI,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA,EAAG,OAAO,IAAA;AAC5B,IAAA,GAAA,CAAI,CAAC,CAAA,GAAI,CAAA;AAAA,EACb;AACA,EAAA,OAAO,GAAA;AACX;AAEA,SAAS,cAAc,GAAA,EAAgC;AACnD,EAAA,IAAI;AACA,IAAA,MAAM,GAAA,GACF,OAAO,IAAA,KAAS,UAAA,GACV,IAAA,CAAK,GAAG,CAAA,GACR,MAAA,CAAO,IAAA,CAAK,GAAA,EAAK,QAAQ,CAAA,CAAE,SAAS,QAAQ,CAAA;AACtD,IAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA;AACrC,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,GAAA,CAAI,MAAA,EAAQ,CAAA,EAAA,EAAK,GAAA,CAAI,CAAC,CAAA,GAAI,GAAA,CAAI,UAAA,CAAW,CAAC,CAAA;AAC9D,IAAA,OAAO,GAAA;AAAA,EACX,CAAA,CAAA,MAAQ;AACJ,IAAA,OAAO,IAAA;AAAA,EACX;AACJ;AAEA,SAAS,WAAW,KAAA,EAA2B;AAC3C,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,MAAW,CAAA,IAAK,OAAO,GAAA,IAAO,CAAA,CAAE,SAAS,EAAE,CAAA,CAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAA;AAC5D,EAAA,OAAO,GAAA;AACX;AAEA,eAAe,OAAO,KAAA,EAAwC;AAC1D,EAAA,MAAM,MAAA,GACF,OAAO,UAAA,CAAW,MAAA,KAAW,WAAA,IAAe,WAAW,MAAA,CAAO,MAAA,GACxD,UAAA,CAAW,MAAA,CAAO,MAAA,GAClB,IAAA;AACV,EAAA,IAAI,CAAC,MAAA,EAAQ;AACT,IAAA,MAAM,IAAI,MAAM,8EAA2E,CAAA;AAAA,EAC/F;AACA,EAAA,MAAM,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,WAAW,KAA+B,CAAA;AAC1E,EAAA,OAAO,IAAI,WAAW,GAAG,CAAA;AAC7B;AAEA,SAAS,cAAc,IAAA,EAA+B;AAClD,EAAA,MAAM,GAAA,GAAM,IAAI,WAAA,CAAY,IAAA,CAAK,UAAU,CAAA;AAC3C,EAAA,IAAI,UAAA,CAAW,GAAG,CAAA,CAAE,GAAA,CAAI,IAAI,CAAA;AAC5B,EAAA,OAAO,GAAA;AACX;AAEA,eAAe,aAAA,CACX,GAAA,EACA,GAAA,EACA,GAAA,EACgB;AAChB,EAAA,MAAM,MAAA,GACF,OAAO,UAAA,CAAW,MAAA,KAAW,WAAA,IAAe,WAAW,MAAA,CAAO,MAAA,GACxD,UAAA,CAAW,MAAA,CAAO,MAAA,GAClB,IAAA;AACV,EAAA,IAAI,CAAC,QAAQ,OAAO,KAAA;AACpB,EAAA,IAAI;AACA,IAAA,OAAO,MAAM,MAAA,CAAO,MAAA;AAAA,MAChB,SAAA;AAAA,MACA,GAAA;AAAA,MACA,cAAc,GAAG,CAAA;AAAA,MACjB,cAAc,GAAG;AAAA,KACrB;AAAA,EACJ,CAAA,CAAA,MAAQ;AACJ,IAAA,OAAO,KAAA;AAAA,EACX;AACJ;AAWA,eAAsB,yBAAA,CAClB,MAAA,EACA,OAAA,GAAiC,EAAC,EACL;AAC7B,EAAA,MAAM,SAAgC,EAAC;AAGvC,EAAA,MAAM,OAAA,GACF,CAAC,CAAC,MAAA,IACF,OAAO,MAAA,KAAW,QAAA,IAClB,OAAO,MAAA,CAAO,GAAA,KAAQ,QAAA,IACtB,OAAO,OAAO,GAAA,KAAQ,QAAA,IACtB,OAAO,MAAA,CAAO,aAAA,KAAkB,QAAA,IAChC,CAAC,CAAC,OAAO,WAAA,IACT,OAAO,MAAA,CAAO,WAAA,CAAY,EAAA,KAAO,QAAA,IACjC,OAAO,MAAA,CAAO,YAAY,UAAA,KAAe,QAAA;AAC7C,EAAA,MAAA,CAAO,IAAA,CAAK;AAAA,IACR,EAAA,EAAI,OAAA;AAAA,IACJ,KAAA,EAAO;AAAA,GACV,CAAA;AACD,EAAA,IAAI,CAAC,OAAA,EAAS;AACV,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,wBAAwB,MAAA,EAAO;AAAA,EAC/D;AAEA,EAAA,MAAM,IAAI,MAAA,CAAO,WAAA;AAGjB,EAAA,MAAM,SAAA,GAAY,aAAA,CAAc,MAAA,CAAO,aAAa,CAAA;AACpD,EAAA,MAAA,CAAO,IAAA,CAAK;AAAA,IACR,IAAI,SAAA,KAAc,IAAA;AAAA,IAClB,KAAA,EAAO,uBAAA;AAAA,IACP,MAAA,EAAQ,SAAA,GAAY,CAAA,EAAG,SAAA,CAAU,MAAM,CAAA,MAAA,CAAA,GAAW;AAAA,GACrD,CAAA;AACD,EAAA,IAAI,CAAC,SAAA,EAAW,OAAO,EAAE,EAAA,EAAI,OAAO,MAAA,EAAQ,8BAAA,EAAgC,MAAA,EAAQ,WAAA,EAAa,CAAA,EAAE;AAGnG,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,SAAS,CAAA;AACrC,EAAA,MAAM,UAAA,GAAa,WAAW,MAAM,CAAA;AACpC,EAAA,MAAM,IAAA,GAAO,eAAe,CAAA,CAAE,EAAA;AAC9B,EAAA,MAAA,CAAO,IAAA,CAAK;AAAA,IACR,EAAA,EAAI,IAAA;AAAA,IACJ,KAAA,EAAO,gCAAA;AAAA,IACP,MAAA,EAAQ,OAAO,CAAA,CAAE,EAAA,GAAK,YAAY,CAAA,CAAE,EAAE,SAAS,UAAU,CAAA;AAAA,GAC5D,CAAA;AACD,EAAA,IAAI,CAAC,IAAA,EAAM,OAAO,EAAE,EAAA,EAAI,OAAO,MAAA,EAAQ,wCAAA,EAA0C,MAAA,EAAQ,WAAA,EAAa,CAAA,EAAE;AAGxG,EAAA,IAAI,GAAA,GAAsB,IAAA;AAC1B,EAAA,IAAI,QAAQ,GAAA,EAAK;AACb,IAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,GAAA,KAAQ,MAAA,CAAO,GAAA,EAAK;AAChC,MAAA,MAAA,CAAO,IAAA,CAAK;AAAA,QACR,EAAA,EAAI,KAAA;AAAA,QACJ,KAAA,EAAO,+BAAA;AAAA,QACP,QAAQ,CAAA,iBAAA,EAAoB,OAAA,CAAQ,IAAI,GAAG,CAAA,gBAAA,EAAmB,OAAO,GAAG,CAAA;AAAA,OAC3E,CAAA;AACD,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,gCAAA,EAAkC,MAAA,EAAQ,aAAa,CAAA,EAAE;AAAA,IACzF;AACA,IAAA,IAAI;AACA,MAAA,GAAA,GAAO,MAAM,SAAA,CAAU,OAAA,CAAQ,GAAA,EAAK,OAAO,CAAA;AAC3C,MAAA,MAAA,CAAO,IAAA,CAAK,EAAE,EAAA,EAAI,IAAA,EAAM,KAAA,EAAO,+BAAA,EAAiC,MAAA,EAAQ,CAAA,IAAA,EAAO,MAAA,CAAO,GAAG,CAAA,WAAA,CAAA,EAAe,CAAA;AAAA,IAC5G,SAAS,GAAA,EAAK;AACV,MAAA,MAAA,CAAO,IAAA,CAAK;AAAA,QACR,EAAA,EAAI,KAAA;AAAA,QACJ,KAAA,EAAO,+BAAA;AAAA,QACP,MAAA,EAAQ,CAAA,4BAAA,EAAgC,GAAA,CAAc,OAAO,CAAA;AAAA,OAChE,CAAA;AACD,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,4BAAA,EAA8B,MAAA,EAAQ,aAAa,CAAA,EAAE;AAAA,IACrF;AAAA,EACJ,CAAA,MAAO;AACH,IAAA,MAAM,MAAA,GAAS,QAAQ,MAAA,IAAU,cAAA;AACjC,IAAA,MAAM,GAAA,GAAM,QAAQ,cAAA,IAAkB,cAAA;AACtC,IAAA,IAAI;AACA,MAAA,IAAI,KAAA,GAAQ,MAAM,iBAAA,CAAkB,MAAA,EAAQ,GAAG,CAAA;AAC/C,MAAA,GAAA,GAAM,KAAA,CAAM,IAAA,CAAK,MAAA,CAAO,GAAG,CAAA,IAAK,IAAA;AAChC,MAAA,IAAI,CAAC,GAAA,EAAK;AAEN,QAAA,SAAA,CAAU,OAAO,MAAM,CAAA;AACvB,QAAA,KAAA,GAAQ,MAAM,iBAAA,CAAkB,MAAA,EAAQ,GAAG,CAAA;AAC3C,QAAA,GAAA,GAAM,KAAA,CAAM,IAAA,CAAK,MAAA,CAAO,GAAG,CAAA,IAAK,IAAA;AAAA,MACpC;AACA,MAAA,MAAA,CAAO,IAAA,CAAK;AAAA,QACR,EAAA,EAAI,CAAC,CAAC,GAAA;AAAA,QACN,KAAA,EAAO,+BAAA;AAAA,QACP,MAAA,EAAQ,GAAA,GAAM,CAAA,IAAA,EAAO,MAAA,CAAO,GAAG,CAAA,CAAA,GAAK,CAAA,gBAAA,EAAmB,MAAA,CAAO,GAAG,CAAA,IAAA,EAAO,MAAM,CAAA,EAAG,kBAAkB,CAAA;AAAA,OACtG,CAAA;AACD,MAAA,IAAI,CAAC,GAAA,EAAK;AACN,QAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,CAAA,IAAA,EAAO,OAAO,GAAG,CAAA,qBAAA,CAAA,EAAyB,MAAA,EAAQ,WAAA,EAAa,CAAA,EAAE;AAAA,MACjG;AAAA,IACJ,SAAS,GAAA,EAAK;AACV,MAAA,MAAA,CAAO,IAAA,CAAK;AAAA,QACR,EAAA,EAAI,KAAA;AAAA,QACJ,KAAA,EAAO,+BAAA;AAAA,QACP,MAAA,EAAQ,CAAA,2BAAA,EAA+B,GAAA,CAAc,OAAO,CAAA;AAAA,OAC/D,CAAA;AACD,MAAA,OAAO;AAAA,QACH,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,CAAA,2BAAA,EAA+B,GAAA,CAAc,OAAO,CAAA,CAAA;AAAA,QAC5D,MAAA;AAAA,QACA,WAAA,EAAa;AAAA,OACjB;AAAA,IACJ;AAAA,EACJ;AAEA,EAAA,MAAM,QAAA,GAAW,UAAA,CAAW,MAAA,CAAO,GAAG,CAAA;AACtC,EAAA,IAAI,CAAC,QAAA,EAAU;AACX,IAAA,MAAA,CAAO,IAAA,CAAK;AAAA,MACR,EAAA,EAAI,KAAA;AAAA,MACJ,KAAA,EAAO,kDAAA;AAAA,MACP,MAAA,EAAQ;AAAA,KACX,CAAA;AACD,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,eAAA,EAAiB,MAAA,EAAQ,aAAa,CAAA,EAAE;AAAA,EACxE;AACA,EAAA,MAAM,KAAA,GAAQ,MAAM,aAAA,CAAc,GAAA,EAAK,UAAU,SAAS,CAAA;AAC1D,EAAA,MAAA,CAAO,IAAA,CAAK;AAAA,IACR,EAAA,EAAI,KAAA;AAAA,IACJ,KAAA,EAAO,kDAAA;AAAA,IACP,MAAA,EAAQ,QAAQ,iBAAA,GAAoB;AAAA,GACvC,CAAA;AACD,EAAA,IAAI,CAAC,KAAA,EAAO,OAAO,EAAE,EAAA,EAAI,OAAO,MAAA,EAAQ,0BAAA,EAA4B,MAAA,EAAQ,WAAA,EAAa,CAAA,EAAE;AAG3F,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,oBAAO,IAAI,IAAA,EAAK;AACpC,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,KAAA,CAAM,CAAA,CAAE,UAAU,CAAA;AACzC,EAAA,MAAM,UAAU,MAAA,CAAO,QAAA,CAAS,SAAS,CAAA,IAAK,SAAA,GAAY,IAAI,OAAA,EAAQ;AACtE,EAAA,MAAA,CAAO,IAAA,CAAK;AAAA,IACR,EAAA,EAAI,OAAA;AAAA,IACJ,KAAA,EAAO,8BAAA;AAAA,IACP,MAAA,EAAQ,UACF,CAAA,QAAA,EAAW,IAAI,KAAK,SAAS,CAAA,CAAE,WAAA,EAAa,CAAA,CAAA,GAC5C;AAAA,GACT,CAAA;AACD,EAAA,IAAI,CAAC,OAAA,EAAS,OAAO,EAAE,EAAA,EAAI,OAAO,MAAA,EAAQ,yBAAA,EAA2B,MAAA,EAAQ,WAAA,EAAa,CAAA,EAAE;AAE5F,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,WAAA,EAAa,GAAG,MAAA,EAAO;AAC9C;AAIA,eAAsB,mBAAA,CAAoB,SAAS,cAAA,EAA+B;AAC9E,EAAA,SAAA,CAAU,OAAO,MAAM,CAAA;AACvB,EAAA,MAAM,iBAAA,CAAkB,QAAQ,cAAc,CAAA;AAClD;AAEO,IAAM,QAAA,GAAW;AAAA,EACpB,yBAAA;AAAA,EACA;AACJ;;;ACtRA,eAAsB,YAAA,CAClB,OAAA,EACA,OAAA,GAA2B,EAAC,EACE;AAC9B,EAAA,MAAM,OAAA,GAAU,MAAMA,cAAA,CAAiB,OAAA,EAAS,OAAO,CAAA;AACvD,EAAA,IAAI,CAAC,OAAA,IAAW,OAAA,CAAQ,QAAA,KAAa,MAAA,wBAAiC,OAAO,CAAA;AAC7E,EAAA,OAAO,OAAA;AACX;AAEA,IAAI,cAAA,GAAiB,KAAA;AAQrB,SAAS,sBAAsB,OAAA,EAAgD;AAC3E,EAAA,IAAI,cAAA,EAAgB;AACpB,EAAA,MAAM,IAAA,GACF,OAAO,OAAA,KAAY,WAAA,IAAe,OAAA,YAAmB,UAC/C,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA,GAC1B,OAAA,CAAkC,aAAA;AAC7C,EAAA,MAAM,IAAI,OAAO,IAAA,KAAS,WAAW,+BAAA,CAAgC,IAAA,CAAK,IAAI,CAAA,GAAI,IAAA;AAClF,EAAA,IAAI,CAAC,CAAA,EAAG;AACR,EAAA,IAAI;AACA,IAAA,MAAM,UAAU,IAAA,CAAK,KAAA,CAAM,kBAAkB,CAAA,CAAE,CAAC,CAAE,CAAC,CAAA;AACnD,IAAA,IAAI,OAAA,CAAQ,QAAQ,KAAA,CAAA,EAAW;AAC/B,IAAA,cAAA,GAAiB,IAAA;AACjB,IAAA,OAAA,CAAQ,IAAA;AAAA,MACJ,CAAA,kDAAA,EAAqD,IAAA,CAAK,SAAA,CAAU,OAAA,CAAQ,GAAG,CAAC,CAAA,+IAAA;AAAA,KAGpF;AAAA,EACJ,CAAA,CAAA,MAAQ;AAAA,EAER;AACJ;AAEA,SAAS,kBAAkB,CAAA,EAAmB;AAC1C,EAAA,MAAM,GAAA,GAAM,EAAE,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AAClD,EAAA,IAAI,OAAO,IAAA,KAAS,UAAA,EAAY,OAAO,IAAA,CAAK,GAAA,GAAM,GAAA,CAAI,MAAA,CAAA,CAAQ,CAAA,GAAK,GAAA,CAAI,MAAA,GAAS,CAAA,IAAM,CAAC,CAAC,CAAA;AACxF,EAAA,OAAO,OAAO,IAAA,CAAK,CAAA,EAAG,WAAW,CAAA,CAAE,SAAS,MAAM,CAAA;AACtD;AAyCA,IAAM,gBAAgB,CAAA,GAAI,GAAA;AAC1B,IAAM,QAAA,uBAAe,GAAA,EAAmD;AAOxE,eAAe,mBAAmB,OAAA,EAAkE;AAChG,EAAA,MAAM,MAAM,OAAA,CAAQ,UAAA;AACpB,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,GAAA,CAAI,GAAG,CAAA;AAC5B,EAAA,IAAI,GAAA,IAAO,KAAK,GAAA,EAAI,GAAI,IAAI,EAAA,GAAK,aAAA,SAAsB,GAAA,CAAI,IAAA;AAC3D,EAAA,IAAI;AACA,IAAA,MAAM,IAAA,GAAO,QAAQ,QAAA,IAAY,oBAAA;AACjC,IAAA,MAAM,CAAA,GAAI,MAAM,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,mCAAA,EAAsC,kBAAA,CAAmB,GAAG,CAAC,CAAA,CAAA,EAAI;AAAA,MAC1F,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,GAAI;AAAA,KACnC,CAAA;AACD,IAAA,IAAI,CAAC,EAAE,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,KAAA,EAAQ,CAAA,CAAE,MAAM,CAAA,CAAE,CAAA;AAC7C,IAAA,MAAM,CAAA,GAAK,MAAM,CAAA,CAAE,IAAA,EAAK;AAGxB,IAAA,MAAM,GAAA,GAAM,CAAA,CAAE,MAAA,EAAQ,YAAA,IAAgB,IAAA;AACtC,IAAA,MAAM,IAAA,GAAO,MAAM,EAAE,OAAA,EAAS,IAAI,QAAA,EAAU,OAAA,EAAS,GAAA,CAAI,QAAA,EAAS,GAAI,IAAA;AACtE,IAAA,QAAA,CAAS,GAAA,CAAI,KAAK,EAAE,EAAA,EAAI,KAAK,GAAA,EAAI,EAAG,MAAM,CAAA;AAC1C,IAAA,OAAO,IAAA;AAAA,EACX,CAAA,CAAA,MAAQ;AACJ,IAAA,OAAO,GAAA,EAAK,IAAA;AAAA,EAChB;AACJ;AAGA,eAAe,SAAS,OAAA,EAAkE;AACtF,EAAA,IAAI,OAAA,CAAQ,WAAA,EAAa,OAAO,OAAA,CAAQ,WAAA;AACxC,EAAA,IAAI,OAAA,CAAQ,UAAA,EAAY,OAAO,kBAAA,CAAmB,OAAO,CAAA;AACzD,EAAA,OAAO,IAAA;AACX;AAGA,eAAe,OAAA,CACX,SACA,OAAA,EACiE;AACjE,EAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,OAAO,CAAA;AACnC,EAAA,IAAI,CAAC,OAAA,EAAS;AACV,IAAA,OAAO,OAAA,CAAQ,QAAA,IAAY,IAAA,KAAS,IAAA,GAC9B,EAAE,MAAA,EAAQ,GAAA,EAAK,IAAA,EAAM,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,iBAAA,IAAoB,GAC9D,IAAA;AAAA,EACV;AACA,EAAA,IAAI,SAAS,MAAA,EAAW;AACpB,IAAA,OAAO,EAAE,QAAQ,GAAA,EAAK,IAAA,EAAM,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,yBAAA,EAA0B,EAAE;AAAA,EACjF;AACA,EAAA,IAAI,IAAA,IAAQ,CAAC,SAAA,CAAU,OAAA,EAAS,IAAI,CAAA,EAAG;AACnC,IAAA,MAAM,IAAA,GAAO,cAAc,OAAO,CAAA;AAClC,IAAA,OAAO;AAAA,MACH,MAAA,EAAQ,GAAA;AAAA,MACR,IAAA,EAAM;AAAA,QACF,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,eAAA;AAAA,QACR,IAAA;AAAA,QACA,IAAA,EAAM,OAAO,EAAE,UAAA,EAAY,KAAK,UAAA,EAAY,UAAA,EAAY,IAAA,CAAK,UAAA,EAAW,GAAI;AAAA;AAChF,KACJ;AAAA,EACJ;AACA,EAAA,OAAO,IAAA;AACX;AAqBO,SAAS,UAAA,CACZ,OAAA,EACA,OAAA,GAA6B,EAAC,EAC7B;AACD,EAAA,MAAM,OAAA,GAAU,OAAO,GAAA,EAAyB,GAAA,KAA6B;AACzE,IAAA,GAAA,CAAI,SAAA,CAAU,iBAAiB,mBAAmB,CAAA;AAClD,IAAA,GAAA,CAAI,SAAA,CAAU,QAAQ,uBAAuB,CAAA;AAC7C,IAAA,MAAM,UAAU,MAAM,YAAA;AAAA,MAClB;AAAA,QACI,MAAA,EAAQ,OAAO,GAAA,CAAI,OAAA,CAAQ,WAAW,QAAA,GAAW,GAAA,CAAI,QAAQ,MAAA,GAAS,IAAA;AAAA,QACtE,aAAA,EACI,OAAO,GAAA,CAAI,OAAA,CAAQ,kBAAkB,QAAA,GAC/B,GAAA,CAAI,QAAQ,aAAA,GACZ;AAAA,OACd;AAAA,MACA;AAAA,KACJ;AACA,IAAA,GAAA,CAAI,SAAA,GAAY,OAAA;AAChB,IAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,OAAA,EAAS,OAAO,CAAA;AAC9C,IAAA,IAAI,OAAA,SAAgB,GAAA,CAAI,MAAA,CAAO,QAAQ,MAAM,CAAA,CAAE,IAAA,CAAK,OAAA,CAAQ,IAAI,CAAA;AAChE,IAAA,OAAO,OAAA,CAAQ,KAAK,GAAG,CAAA;AAAA,EAC3B,CAAA;AACA,EAAA,OAAO,OAAA;AACX;AAkCO,SAAS,aAAA,CAAc,OAAA,GAA6B,EAAC,EAAG;AAC3D,EAAA,OAAO,OAAO,GAAA,EAAyB,GAAA,EAA0B,IAAA,KAA0B;AACvF,IAAA,IAAI;AACA,MAAA,GAAA,CAAI,SAAA,CAAU,iBAAiB,mBAAmB,CAAA;AAClD,MAAA,GAAA,CAAI,SAAA,CAAU,QAAQ,uBAAuB,CAAA;AAC7C,MAAA,MAAM,UAAU,MAAM,YAAA;AAAA,QAClB;AAAA,UACI,MAAA,EAAQ,OAAO,GAAA,CAAI,OAAA,CAAQ,WAAW,QAAA,GAAW,GAAA,CAAI,QAAQ,MAAA,GAAS,IAAA;AAAA,UACtE,aAAA,EACI,OAAO,GAAA,CAAI,OAAA,CAAQ,kBAAkB,QAAA,GAC/B,GAAA,CAAI,QAAQ,aAAA,GACZ;AAAA,SACd;AAAA,QACA;AAAA,OACJ;AACA,MAAA,GAAA,CAAI,SAAA,GAAY,OAAA;AAChB,MAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,OAAA,EAAS,OAAO,CAAA;AAC9C,MAAA,IAAI,OAAA,EAAS;AACT,QAAA,GAAA,CAAI,OAAO,OAAA,CAAQ,MAAM,CAAA,CAAE,IAAA,CAAK,QAAQ,IAAI,CAAA;AAC5C,QAAA;AAAA,MACJ;AACA,MAAA,IAAA,EAAK;AAAA,IACT,SAAS,GAAA,EAAK;AACV,MAAA,IAAA,CAAK,GAAG,CAAA;AAAA,IACZ;AAAA,EACJ,CAAA;AACJ;AA2BO,SAAS,UAAA,CAAW,OAAA,GAA6B,EAAC,EAAG;AACxD,EAAA,OAAO,OAAO,GAAoB,IAAA,KAAuB;AACrD,IAAA,CAAA,CAAE,MAAA,CAAO,iBAAiB,mBAAmB,CAAA;AAC7C,IAAA,CAAA,CAAE,MAAA,CAAO,QAAQ,uBAAuB,CAAA;AACxC,IAAA,MAAM,UAAU,MAAM,YAAA,CAAa,EAAE,GAAA,CAAI,GAAA,CAAI,SAAS,OAAO,CAAA;AAC7D,IAAA,CAAA,CAAE,GAAA,CAAI,aAAa,OAAO,CAAA;AAC1B,IAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,OAAA,EAAS,OAAO,CAAA;AAC9C,IAAA,IAAI,SAAS,OAAO,CAAA,CAAE,KAAK,OAAA,CAAQ,IAAA,EAAM,QAAQ,MAAM,CAAA;AACvD,IAAA,MAAM,IAAA,EAAK;AAAA,EACf,CAAA;AACJ","file":"server.mjs","sourcesContent":["export const encoder = new TextEncoder();\nexport const decoder = new TextDecoder();\nconst MAX_INT32 = 2 ** 32;\nexport function concat(...buffers) {\n const size = buffers.reduce((acc, { length }) => acc + length, 0);\n const buf = new Uint8Array(size);\n let i = 0;\n for (const buffer of buffers) {\n buf.set(buffer, i);\n i += buffer.length;\n }\n return buf;\n}\nfunction writeUInt32BE(buf, value, offset) {\n if (value < 0 || value >= MAX_INT32) {\n throw new RangeError(`value must be >= 0 and <= ${MAX_INT32 - 1}. Received ${value}`);\n }\n buf.set([value >>> 24, value >>> 16, value >>> 8, value & 0xff], offset);\n}\nexport function uint64be(value) {\n const high = Math.floor(value / MAX_INT32);\n const low = value % MAX_INT32;\n const buf = new Uint8Array(8);\n writeUInt32BE(buf, high, 0);\n writeUInt32BE(buf, low, 4);\n return buf;\n}\nexport function uint32be(value) {\n const buf = new Uint8Array(4);\n writeUInt32BE(buf, value);\n return buf;\n}\nexport function encode(string) {\n const bytes = new Uint8Array(string.length);\n for (let i = 0; i < string.length; i++) {\n const code = string.charCodeAt(i);\n if (code > 127) {\n throw new TypeError('non-ASCII string encountered in encode()');\n }\n bytes[i] = code;\n }\n return bytes;\n}\n","export function encodeBase64(input) {\n if (Uint8Array.prototype.toBase64) {\n return input.toBase64();\n }\n const CHUNK_SIZE = 0x8000;\n const arr = [];\n for (let i = 0; i < input.length; i += CHUNK_SIZE) {\n arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));\n }\n return btoa(arr.join(''));\n}\nexport function decodeBase64(encoded) {\n if (Uint8Array.fromBase64) {\n return Uint8Array.fromBase64(encoded);\n }\n const binary = atob(encoded);\n const bytes = new Uint8Array(binary.length);\n for (let i = 0; i < binary.length; i++) {\n bytes[i] = binary.charCodeAt(i);\n }\n return bytes;\n}\n","import { encoder, decoder } from '../lib/buffer_utils.js';\nimport { encodeBase64, decodeBase64 } from '../lib/base64.js';\nexport function decode(input) {\n if (Uint8Array.fromBase64) {\n return Uint8Array.fromBase64(typeof input === 'string' ? input : decoder.decode(input), {\n alphabet: 'base64url',\n });\n }\n let encoded = input;\n if (encoded instanceof Uint8Array) {\n encoded = decoder.decode(encoded);\n }\n encoded = encoded.replace(/-/g, '+').replace(/_/g, '/');\n try {\n return decodeBase64(encoded);\n }\n catch {\n throw new TypeError('The input to be decoded is not correctly encoded.');\n }\n}\nexport function encode(input) {\n let unencoded = input;\n if (typeof unencoded === 'string') {\n unencoded = encoder.encode(unencoded);\n }\n if (Uint8Array.prototype.toBase64) {\n return unencoded.toBase64({ alphabet: 'base64url', omitPadding: true });\n }\n return encodeBase64(unencoded).replace(/=/g, '').replace(/\\+/g, '-').replace(/\\//g, '_');\n}\n","export class JOSEError extends Error {\n static code = 'ERR_JOSE_GENERIC';\n code = 'ERR_JOSE_GENERIC';\n constructor(message, options) {\n super(message, options);\n this.name = this.constructor.name;\n Error.captureStackTrace?.(this, this.constructor);\n }\n}\nexport class JWTClaimValidationFailed extends JOSEError {\n static code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';\n code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';\n claim;\n reason;\n payload;\n constructor(message, payload, claim = 'unspecified', reason = 'unspecified') {\n super(message, { cause: { claim, reason, payload } });\n this.claim = claim;\n this.reason = reason;\n this.payload = payload;\n }\n}\nexport class JWTExpired extends JOSEError {\n static code = 'ERR_JWT_EXPIRED';\n code = 'ERR_JWT_EXPIRED';\n claim;\n reason;\n payload;\n constructor(message, payload, claim = 'unspecified', reason = 'unspecified') {\n super(message, { cause: { claim, reason, payload } });\n this.claim = claim;\n this.reason = reason;\n this.payload = payload;\n }\n}\nexport class JOSEAlgNotAllowed extends JOSEError {\n static code = 'ERR_JOSE_ALG_NOT_ALLOWED';\n code = 'ERR_JOSE_ALG_NOT_ALLOWED';\n}\nexport class JOSENotSupported extends JOSEError {\n static code = 'ERR_JOSE_NOT_SUPPORTED';\n code = 'ERR_JOSE_NOT_SUPPORTED';\n}\nexport class JWEDecryptionFailed extends JOSEError {\n static code = 'ERR_JWE_DECRYPTION_FAILED';\n code = 'ERR_JWE_DECRYPTION_FAILED';\n constructor(message = 'decryption operation failed', options) {\n super(message, options);\n }\n}\nexport class JWEInvalid extends JOSEError {\n static code = 'ERR_JWE_INVALID';\n code = 'ERR_JWE_INVALID';\n}\nexport class JWSInvalid extends JOSEError {\n static code = 'ERR_JWS_INVALID';\n code = 'ERR_JWS_INVALID';\n}\nexport class JWTInvalid extends JOSEError {\n static code = 'ERR_JWT_INVALID';\n code = 'ERR_JWT_INVALID';\n}\nexport class JWKInvalid extends JOSEError {\n static code = 'ERR_JWK_INVALID';\n code = 'ERR_JWK_INVALID';\n}\nexport class JWKSInvalid extends JOSEError {\n static code = 'ERR_JWKS_INVALID';\n code = 'ERR_JWKS_INVALID';\n}\nexport class JWKSNoMatchingKey extends JOSEError {\n static code = 'ERR_JWKS_NO_MATCHING_KEY';\n code = 'ERR_JWKS_NO_MATCHING_KEY';\n constructor(message = 'no applicable key found in the JSON Web Key Set', options) {\n super(message, options);\n }\n}\nexport class JWKSMultipleMatchingKeys extends JOSEError {\n [Symbol.asyncIterator];\n static code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';\n code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';\n constructor(message = 'multiple matching keys found in the JSON Web Key Set', options) {\n super(message, options);\n }\n}\nexport class JWKSTimeout extends JOSEError {\n static code = 'ERR_JWKS_TIMEOUT';\n code = 'ERR_JWKS_TIMEOUT';\n constructor(message = 'request timed out', options) {\n super(message, options);\n }\n}\nexport class JWSSignatureVerificationFailed extends JOSEError {\n static code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';\n code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';\n constructor(message = 'signature verification failed', options) {\n super(message, options);\n }\n}\n","const isObjectLike = (value) => typeof value === 'object' && value !== null;\nexport function isObject(input) {\n if (!isObjectLike(input) || Object.prototype.toString.call(input) !== '[object Object]') {\n return false;\n }\n if (Object.getPrototypeOf(input) === null) {\n return true;\n }\n let proto = input;\n while (Object.getPrototypeOf(proto) !== null) {\n proto = Object.getPrototypeOf(proto);\n }\n return Object.getPrototypeOf(input) === proto;\n}\nexport function isDisjoint(...headers) {\n const sources = headers.filter(Boolean);\n if (sources.length === 0 || sources.length === 1) {\n return true;\n }\n let acc;\n for (const header of sources) {\n const parameters = Object.keys(header);\n if (!acc || acc.size === 0) {\n acc = new Set(parameters);\n continue;\n }\n for (const parameter of parameters) {\n if (acc.has(parameter)) {\n return false;\n }\n acc.add(parameter);\n }\n }\n return true;\n}\nexport const isJWK = (key) => isObject(key) && typeof key.kty === 'string';\nexport const isPrivateJWK = (key) => key.kty !== 'oct' &&\n ((key.kty === 'AKP' && typeof key.priv === 'string') || typeof key.d === 'string');\nexport const isPublicJWK = (key) => key.kty !== 'oct' && key.d === undefined && key.priv === undefined;\nexport const isSecretJWK = (key) => key.kty === 'oct' && typeof key.k === 'string';\n","import { JOSENotSupported } from '../util/errors.js';\nconst unsupportedAlg = 'Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value';\nfunction subtleMapping(jwk) {\n let algorithm;\n let keyUsages;\n switch (jwk.kty) {\n case 'AKP': {\n switch (jwk.alg) {\n case 'ML-DSA-44':\n case 'ML-DSA-65':\n case 'ML-DSA-87':\n algorithm = { name: jwk.alg };\n keyUsages = jwk.priv ? ['sign'] : ['verify'];\n break;\n default:\n throw new JOSENotSupported(unsupportedAlg);\n }\n break;\n }\n case 'RSA': {\n switch (jwk.alg) {\n case 'PS256':\n case 'PS384':\n case 'PS512':\n algorithm = { name: 'RSA-PSS', hash: `SHA-${jwk.alg.slice(-3)}` };\n keyUsages = jwk.d ? ['sign'] : ['verify'];\n break;\n case 'RS256':\n case 'RS384':\n case 'RS512':\n algorithm = { name: 'RSASSA-PKCS1-v1_5', hash: `SHA-${jwk.alg.slice(-3)}` };\n keyUsages = jwk.d ? ['sign'] : ['verify'];\n break;\n case 'RSA-OAEP':\n case 'RSA-OAEP-256':\n case 'RSA-OAEP-384':\n case 'RSA-OAEP-512':\n algorithm = {\n name: 'RSA-OAEP',\n hash: `SHA-${parseInt(jwk.alg.slice(-3), 10) || 1}`,\n };\n keyUsages = jwk.d ? ['decrypt', 'unwrapKey'] : ['encrypt', 'wrapKey'];\n break;\n default:\n throw new JOSENotSupported(unsupportedAlg);\n }\n break;\n }\n case 'EC': {\n switch (jwk.alg) {\n case 'ES256':\n case 'ES384':\n case 'ES512':\n algorithm = {\n name: 'ECDSA',\n namedCurve: { ES256: 'P-256', ES384: 'P-384', ES512: 'P-521' }[jwk.alg],\n };\n keyUsages = jwk.d ? ['sign'] : ['verify'];\n break;\n case 'ECDH-ES':\n case 'ECDH-ES+A128KW':\n case 'ECDH-ES+A192KW':\n case 'ECDH-ES+A256KW':\n algorithm = { name: 'ECDH', namedCurve: jwk.crv };\n keyUsages = jwk.d ? ['deriveBits'] : [];\n break;\n default:\n throw new JOSENotSupported(unsupportedAlg);\n }\n break;\n }\n case 'OKP': {\n switch (jwk.alg) {\n case 'Ed25519':\n case 'EdDSA':\n algorithm = { name: 'Ed25519' };\n keyUsages = jwk.d ? ['sign'] : ['verify'];\n break;\n case 'ECDH-ES':\n case 'ECDH-ES+A128KW':\n case 'ECDH-ES+A192KW':\n case 'ECDH-ES+A256KW':\n algorithm = { name: jwk.crv };\n keyUsages = jwk.d ? ['deriveBits'] : [];\n break;\n default:\n throw new JOSENotSupported(unsupportedAlg);\n }\n break;\n }\n default:\n throw new JOSENotSupported('Invalid or unsupported JWK \"kty\" (Key Type) Parameter value');\n }\n return { algorithm, keyUsages };\n}\nexport async function jwkToKey(jwk) {\n if (!jwk.alg) {\n throw new TypeError('\"alg\" argument is required when \"jwk.alg\" is not present');\n }\n const { algorithm, keyUsages } = subtleMapping(jwk);\n const keyData = { ...jwk };\n if (keyData.kty !== 'AKP') {\n delete keyData.alg;\n }\n delete keyData.use;\n return crypto.subtle.importKey('jwk', keyData, algorithm, jwk.ext ?? (jwk.d || jwk.priv ? false : true), jwk.key_ops ?? keyUsages);\n}\n","import { decode as decodeBase64URL } from '../util/base64url.js';\nimport { fromSPKI, fromPKCS8, fromX509 } from '../lib/asn1.js';\nimport { jwkToKey } from '../lib/jwk_to_key.js';\nimport { JOSENotSupported } from '../util/errors.js';\nimport { isObject } from '../lib/type_checks.js';\nexport async function importSPKI(spki, alg, options) {\n if (typeof spki !== 'string' || spki.indexOf('-----BEGIN PUBLIC KEY-----') !== 0) {\n throw new TypeError('\"spki\" must be SPKI formatted string');\n }\n return fromSPKI(spki, alg, options);\n}\nexport async function importX509(x509, alg, options) {\n if (typeof x509 !== 'string' || x509.indexOf('-----BEGIN CERTIFICATE-----') !== 0) {\n throw new TypeError('\"x509\" must be X.509 formatted string');\n }\n return fromX509(x509, alg, options);\n}\nexport async function importPKCS8(pkcs8, alg, options) {\n if (typeof pkcs8 !== 'string' || pkcs8.indexOf('-----BEGIN PRIVATE KEY-----') !== 0) {\n throw new TypeError('\"pkcs8\" must be PKCS#8 formatted string');\n }\n return fromPKCS8(pkcs8, alg, options);\n}\nexport async function importJWK(jwk, alg, options) {\n if (!isObject(jwk)) {\n throw new TypeError('JWK must be an object');\n }\n let ext;\n alg ??= jwk.alg;\n ext ??= options?.extractable ?? jwk.ext;\n switch (jwk.kty) {\n case 'oct':\n if (typeof jwk.k !== 'string' || !jwk.k) {\n throw new TypeError('missing \"k\" (Key Value) Parameter value');\n }\n return decodeBase64URL(jwk.k);\n case 'RSA':\n if ('oth' in jwk && jwk.oth !== undefined) {\n throw new JOSENotSupported('RSA JWK \"oth\" (Other Primes Info) Parameter value is not supported');\n }\n return jwkToKey({ ...jwk, alg, ext });\n case 'AKP': {\n if (typeof jwk.alg !== 'string' || !jwk.alg) {\n throw new TypeError('missing \"alg\" (Algorithm) Parameter value');\n }\n if (alg !== undefined && alg !== jwk.alg) {\n throw new TypeError('JWK alg and alg option value mismatch');\n }\n return jwkToKey({ ...jwk, ext });\n }\n case 'EC':\n case 'OKP':\n return jwkToKey({ ...jwk, alg, ext });\n default:\n throw new JOSENotSupported('Unsupported \"kty\" (Key Type) Parameter value');\n }\n}\n","/**\n * `oc.identity.verifyActivityAttestation` — one-call ed25519 verifier\n * for a /api/me/activity-attestation bundle.\n *\n * Cashes the \"trivially to verify\" strategic claim: an integrator\n * receiving a signed attestation JSON from a user calls one function,\n * gets a typed result with per-check detail, never reaches into\n * @noble/curves or jose themselves.\n *\n * import { oc } from '@orangecheck/me-client';\n *\n * const result = await oc.identity.verifyActivityAttestation(bundle);\n * if (!result.ok) return res.status(401).send(result.reason);\n * // result.attestation is typed · safe to gate on lifetime_sats etc.\n *\n * The JWKS issuer is me.ochk.io (the envelope key), DISTINCT from\n * the auth host's ochk.io JWKS that signs webhooks. Same Ed25519\n * curve, same kid lookup pattern, fetched + cached separately.\n */\n\nimport { importJWK, type CryptoKey, type KeyObject } from 'jose';\n\nconst DEFAULT_ISSUER = 'https://me.ochk.io';\nconst DEFAULT_TTL_MS = 60 * 60 * 1000;\nconst ENVELOPE_JWKS_PATH = '/.well-known/oc-envelope-jwks.json';\n\nexport interface ActivityAttestation {\n id: string;\n v: 1;\n kind: 'oc-me-activity';\n did_oc: string;\n event_count: number;\n human_event_count: number;\n lifetime_sats: number;\n distinct_integrator_count: number;\n oldest_event_at: string | null;\n active_days: number;\n computed_at: string;\n expires_at: string;\n}\n\nexport interface ActivityAttestationBundle {\n attestation: ActivityAttestation;\n sig: string;\n kid: string;\n canonical_b64: string;\n}\n\nexport interface ActivityVerifyCheck {\n ok: boolean;\n label: string;\n detail?: string;\n}\n\nexport interface ActivityVerifyResult {\n ok: boolean;\n reason?: string;\n attestation?: ActivityAttestation;\n checks: ActivityVerifyCheck[];\n}\n\ninterface OcEnvelopePublicJwk {\n kty: 'OKP';\n crv: 'Ed25519';\n x: string;\n kid: string;\n alg?: 'EdDSA';\n use?: 'sig';\n}\n\nexport interface VerifyActivityOptions {\n /** Override the me.ochk.io issuer (defaults to https://me.ochk.io).\n * Useful for staging / self-hosted dev. */\n issuer?: string;\n /** Pass a JWK directly to skip the network fetch · convenient when\n * embedding the public key in your service for air-gapped or\n * edge-runtime deployments. */\n jwk?: OcEnvelopePublicJwk;\n /** JWKS cache TTL in ms. Defaults to 1h. Stale-on-error falls back\n * to the previous cached value. */\n jwksCacheTtlMs?: number;\n /** Optional · override \"now\" for deterministic tests. */\n now?: Date;\n}\n\ntype AuthKey = CryptoKey | KeyObject;\n\ninterface JwksCacheEntry {\n keys: Record<string, AuthKey>;\n fetchedAt: number;\n}\n\nconst jwksCache = new Map<string, JwksCacheEntry>();\nconst inflight = new Map<string, Promise<JwksCacheEntry>>();\n\nasync function fetchEnvelopeJwks(issuer: string, ttlMs: number): Promise<JwksCacheEntry> {\n const cached = jwksCache.get(issuer);\n if (cached && Date.now() - cached.fetchedAt < ttlMs) return cached;\n const existing = inflight.get(issuer);\n if (existing) return existing;\n const p = (async (): Promise<JwksCacheEntry> => {\n try {\n const url = `${issuer.replace(/\\/$/, '')}${ENVELOPE_JWKS_PATH}`;\n const res = await fetch(url, { headers: { Accept: 'application/json' } });\n if (!res.ok) throw new Error(`envelope JWKS fetch ${url} returned ${res.status}`);\n const json = (await res.json()) as { keys: OcEnvelopePublicJwk[] };\n if (!json || !Array.isArray(json.keys)) {\n throw new Error(`envelope JWKS at ${url} did not return {keys:[…]}`);\n }\n const keys: Record<string, AuthKey> = {};\n for (const k of json.keys) {\n if (typeof k.kid !== 'string') continue;\n try {\n keys[k.kid] = (await importJWK(k, 'EdDSA')) as AuthKey;\n } catch {\n /* skip keys that won't import */\n }\n }\n const entry: JwksCacheEntry = { keys, fetchedAt: Date.now() };\n jwksCache.set(issuer, entry);\n return entry;\n } catch (err) {\n const stale = jwksCache.get(issuer);\n if (stale) return stale;\n throw err;\n }\n })().finally(() => {\n inflight.delete(issuer);\n });\n inflight.set(issuer, p);\n return p;\n}\n\nfunction hexToBytes(hex: string): Uint8Array | null {\n if (typeof hex !== 'string') return null;\n const s = hex.trim();\n if (s.length === 0 || s.length % 2 !== 0) return null;\n const out = new Uint8Array(s.length / 2);\n for (let i = 0; i < out.length; i++) {\n const b = parseInt(s.slice(i * 2, i * 2 + 2), 16);\n if (Number.isNaN(b)) return null;\n out[i] = b;\n }\n return out;\n}\n\nfunction base64ToBytes(b64: string): Uint8Array | null {\n try {\n const bin =\n typeof atob === 'function'\n ? atob(b64)\n : Buffer.from(b64, 'base64').toString('binary');\n const out = new Uint8Array(bin.length);\n for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);\n return out;\n } catch {\n return null;\n }\n}\n\nfunction bytesToHex(bytes: Uint8Array): string {\n let out = '';\n for (const b of bytes) out += b.toString(16).padStart(2, '0');\n return out;\n}\n\nasync function sha256(bytes: Uint8Array): Promise<Uint8Array> {\n const subtle =\n typeof globalThis.crypto !== 'undefined' && globalThis.crypto.subtle\n ? globalThis.crypto.subtle\n : null;\n if (!subtle) {\n throw new Error('crypto.subtle unavailable · need Node 20+ / modern browser / Edge runtime');\n }\n const buf = await subtle.digest('SHA-256', bytes as unknown as ArrayBuffer);\n return new Uint8Array(buf);\n}\n\nfunction toArrayBuffer(view: Uint8Array): ArrayBuffer {\n const buf = new ArrayBuffer(view.byteLength);\n new Uint8Array(buf).set(view);\n return buf;\n}\n\nasync function verifyEd25519(\n key: AuthKey,\n sig: Uint8Array,\n msg: Uint8Array\n): Promise<boolean> {\n const subtle =\n typeof globalThis.crypto !== 'undefined' && globalThis.crypto.subtle\n ? globalThis.crypto.subtle\n : null;\n if (!subtle) return false;\n try {\n return await subtle.verify(\n 'Ed25519',\n key as CryptoKey,\n toArrayBuffer(sig),\n toArrayBuffer(msg)\n );\n } catch {\n return false;\n }\n}\n\n/**\n * Verify a signed activity attestation bundle. Returns a typed\n * ActivityVerifyResult with per-check detail · never throws (network\n * + parse failures surface as ok=false rows in the checks array, so\n * the caller can log them without try/catch).\n *\n * Five checks, in order: bundle shape, canonical-bytes hash matches\n * id, JWK with matching kid present, ed25519 signature, freshness.\n */\nexport async function verifyActivityAttestation(\n bundle: ActivityAttestationBundle,\n options: VerifyActivityOptions = {}\n): Promise<ActivityVerifyResult> {\n const checks: ActivityVerifyCheck[] = [];\n\n // 1. Bundle shape\n const shapeOk =\n !!bundle &&\n typeof bundle === 'object' &&\n typeof bundle.sig === 'string' &&\n typeof bundle.kid === 'string' &&\n typeof bundle.canonical_b64 === 'string' &&\n !!bundle.attestation &&\n typeof bundle.attestation.id === 'string' &&\n typeof bundle.attestation.expires_at === 'string';\n checks.push({\n ok: shapeOk,\n label: 'bundle shape · sig / kid / canonical_b64 / attestation',\n });\n if (!shapeOk) {\n return { ok: false, reason: 'bundle shape invalid', checks };\n }\n\n const a = bundle.attestation;\n\n // 2. canonical_b64 decodes\n const canonical = base64ToBytes(bundle.canonical_b64);\n checks.push({\n ok: canonical !== null,\n label: 'canonical_b64 decodes',\n detail: canonical ? `${canonical.length} bytes` : 'invalid base64',\n });\n if (!canonical) return { ok: false, reason: 'canonical_b64 invalid base64', checks, attestation: a };\n\n // 3. sha256 === id\n const digest = await sha256(canonical);\n const computedId = bytesToHex(digest);\n const idOk = computedId === a.id;\n checks.push({\n ok: idOk,\n label: 'sha256(canonical_bytes) === id',\n detail: idOk ? a.id : `expected ${a.id}, got ${computedId}`,\n });\n if (!idOk) return { ok: false, reason: 'id does not match canonical-bytes hash', checks, attestation: a };\n\n // 4. JWK lookup + ed25519 verify\n let key: AuthKey | null = null;\n if (options.jwk) {\n if (options.jwk.kid !== bundle.kid) {\n checks.push({\n ok: false,\n label: 'JWK with matching kid present',\n detail: `provided jwk.kid=${options.jwk.kid} but bundle.kid=${bundle.kid}`,\n });\n return { ok: false, reason: 'kid mismatch with provided jwk', checks, attestation: a };\n }\n try {\n key = (await importJWK(options.jwk, 'EdDSA')) as AuthKey;\n checks.push({ ok: true, label: 'JWK with matching kid present', detail: `kid ${bundle.kid} (provided)` });\n } catch (err) {\n checks.push({\n ok: false,\n label: 'JWK with matching kid present',\n detail: `provided jwk failed import: ${(err as Error).message}`,\n });\n return { ok: false, reason: 'provided jwk failed import', checks, attestation: a };\n }\n } else {\n const issuer = options.issuer ?? DEFAULT_ISSUER;\n const ttl = options.jwksCacheTtlMs ?? DEFAULT_TTL_MS;\n try {\n let entry = await fetchEnvelopeJwks(issuer, ttl);\n key = entry.keys[bundle.kid] ?? null;\n if (!key) {\n // Cache miss · likely a rotation. Force-refresh once.\n jwksCache.delete(issuer);\n entry = await fetchEnvelopeJwks(issuer, ttl);\n key = entry.keys[bundle.kid] ?? null;\n }\n checks.push({\n ok: !!key,\n label: 'JWK with matching kid present',\n detail: key ? `kid ${bundle.kid}` : `no JWK with kid ${bundle.kid} at ${issuer}${ENVELOPE_JWKS_PATH}`,\n });\n if (!key) {\n return { ok: false, reason: `kid ${bundle.kid} not in envelope JWKS`, checks, attestation: a };\n }\n } catch (err) {\n checks.push({\n ok: false,\n label: 'JWK with matching kid present',\n detail: `envelope JWKS unavailable: ${(err as Error).message}`,\n });\n return {\n ok: false,\n reason: `envelope JWKS unavailable: ${(err as Error).message}`,\n checks,\n attestation: a,\n };\n }\n }\n\n const sigBytes = hexToBytes(bundle.sig);\n if (!sigBytes) {\n checks.push({\n ok: false,\n label: 'ed25519.verify(sig, canonical_bytes, jwk.public)',\n detail: 'malformed sig (expected hex)',\n });\n return { ok: false, reason: 'malformed sig', checks, attestation: a };\n }\n const sigOk = await verifyEd25519(key, sigBytes, canonical);\n checks.push({\n ok: sigOk,\n label: 'ed25519.verify(sig, canonical_bytes, jwk.public)',\n detail: sigOk ? 'signature valid' : 'signature does not match',\n });\n if (!sigOk) return { ok: false, reason: 'signature does not match', checks, attestation: a };\n\n // 5. Freshness\n const now = options.now ?? new Date();\n const expiresMs = Date.parse(a.expires_at);\n const freshOk = Number.isFinite(expiresMs) && expiresMs > now.getTime();\n checks.push({\n ok: freshOk,\n label: 'now < attestation.expires_at',\n detail: freshOk\n ? `expires ${new Date(expiresMs).toISOString()}`\n : 'attestation has expired',\n });\n if (!freshOk) return { ok: false, reason: 'attestation has expired', checks, attestation: a };\n\n return { ok: true, attestation: a, checks };\n}\n\n/** Force-refresh the envelope-JWKS cache · useful after a key rotation\n * if you don't want to wait for the TTL to expire. */\nexport async function refreshEnvelopeJwks(issuer = DEFAULT_ISSUER): Promise<void> {\n jwksCache.delete(issuer);\n await fetchEnvelopeJwks(issuer, DEFAULT_TTL_MS);\n}\n\nexport const identity = {\n verifyActivityAttestation,\n refreshEnvelopeJwks,\n};\n","/**\n * @orangecheck/me-client/server\n *\n * Server-side verification helpers for OC integrators.\n *\n * import {\n * withOcAuth,\n * getOcSession,\n * verifyOcToken,\n * verifyActivityAttestation,\n * } from '@orangecheck/me-client/server';\n *\n * Zero env vars, zero JWK handling. Internally lazy-fetches the auth\n * host's JWKS at https://ochk.io/.well-known/jwks.json and the\n * envelope JWKS at https://me.ochk.io/.well-known/oc-envelope-jwks.json,\n * caches both in-process. Integrators write code; we handle the crypto.\n *\n * Three layers of session verification, smallest to thickest:\n *\n * verifyOcToken(token) → SessionPayload | null\n * getOcSession(headers) → SessionPayload | null (cookie OR Bearer)\n * withOcAuth(handler) → Next.js Pages adapter that injects\n * req.ocSession on the request object\n * ocAuthExpress(opts?) → Express / Connect middleware\n * ocAuthHono(opts?) → Hono middleware\n *\n * Plus the activity-attestation verifier · for sybil-resistance gating:\n *\n * verifyActivityAttestation(bundle, opts?) → ActivityVerifyResult\n *\n * Same envelope-JWKS verification posture as the public /verify-activity\n * page; same five checks (shape / id / kid / sig / freshness). Use to\n * gate sensitive flows on cross-integrator lifetime_sats + duration +\n * distinct_count + active_days · all values are content-addressed and\n * signed.\n *\n * All thin wrappers around the same crypto primitives. Bring your own\n * framework.\n */\n\nimport {\n bondMeets,\n getOcSession as getOcSessionCore,\n readBondClaim,\n verifyOcToken,\n type BondClaim,\n type SessionPayload,\n type VerifyOcOptions,\n type SessionRequestHeaders,\n} from '@orangecheck/auth-core';\n\nexport { bondMeets, readBondClaim, verifyOcToken };\nexport type { BondClaim, SessionPayload, VerifyOcOptions };\n\n// Activity-attestation verifier · re-export from the identity module so\n// server-side integrators get the gating helper alongside session\n// verification without a second import path.\nexport {\n identity,\n verifyActivityAttestation,\n refreshEnvelopeJwks,\n} from './identity';\nexport type {\n ActivityAttestation,\n ActivityAttestationBundle,\n ActivityVerifyCheck,\n ActivityVerifyResult,\n VerifyActivityOptions,\n} from './identity';\n\n/**\n * Verify the OC session for a request. Accepts either:\n *\n * - A Web Headers object (Hono / edge / Fetch API): `c.req.raw.headers`\n * - A plain `{ cookie, authorization }` object (Express / Next.js Pages /\n * Fastify / etc.): `{ cookie: req.headers.cookie, authorization: req.headers.authorization }`\n *\n * Reads the `oc_session` cookie first; falls back to\n * `Authorization: Bearer <token>` so cross-domain integrators (no\n * .ochk.io cookie reach) verify the same way.\n *\n * Returns `null` for unauthenticated requests. Never throws.\n */\nexport async function getOcSession(\n headers: SessionRequestHeaders | Headers,\n options: VerifyOcOptions = {}\n): Promise<SessionPayload | null> {\n const session = await getOcSessionCore(headers, options);\n if (!session && options.audience === undefined) warnIfAudienceMissing(headers);\n return session;\n}\n\nlet warnedAudience = false;\n\n/**\n * The popup issues a token bound to your site's origin. Verified with no\n * `audience`, it is refused — correctly, since a verifier with no audience\n * accepts only family sessions — and every popup sign-in would 401 with no\n * clue why. Say so, once, the first time it happens.\n */\nfunction warnIfAudienceMissing(headers: SessionRequestHeaders | Headers): void {\n if (warnedAudience) return;\n const auth =\n typeof Headers !== 'undefined' && headers instanceof Headers\n ? headers.get('authorization')\n : (headers as SessionRequestHeaders).authorization;\n const m = typeof auth === 'string' ? /^Bearer\\s+([^.]+)\\.([^.]+)\\./i.exec(auth) : null;\n if (!m) return;\n try {\n const payload = JSON.parse(base64UrlToString(m[2]!)) as { aud?: unknown };\n if (payload.aud === undefined) return;\n warnedAudience = true;\n console.warn(\n `[@orangecheck/me-client] a sign-in token bound to ${JSON.stringify(payload.aud)} was refused ` +\n 'because no `audience` is configured. Pass your site origin, e.g. ' +\n \"withOcAuth(handler, { audience: 'https://your-site.example' }).\"\n );\n } catch {\n // Not a JWT we can read · nothing useful to say.\n }\n}\n\nfunction base64UrlToString(s: string): string {\n const b64 = s.replace(/-/g, '+').replace(/_/g, '/');\n if (typeof atob === 'function') return atob(b64 + '='.repeat((4 - (b64.length % 4)) % 4));\n return Buffer.from(s, 'base64url').toString('utf8');\n}\n\n// ─── Next.js Pages Router adapter ────────────────────────────────────────\n\ninterface NextApiRequestLike {\n headers: { cookie?: string; authorization?: string; [k: string]: unknown };\n ocSession?: SessionPayload | null;\n}\ninterface NextApiResponseLike {\n status(code: number): NextApiResponseLike;\n json(body: unknown): unknown;\n setHeader(name: string, value: string | number | readonly string[]): unknown;\n}\ntype NextApiHandlerLike = (req: NextApiRequestLike, res: NextApiResponseLike) => unknown | Promise<unknown>;\n\nexport interface WithOcAuthOptions extends VerifyOcOptions {\n /** When true, unauthenticated requests get a 401 + `{ok:false}` response\n * before the wrapped handler runs. Default: false — handler runs and\n * receives `req.ocSession === null`, useful when the route serves both\n * signed-in and anonymous users. */\n required?: boolean;\n /**\n * Refuse a signed-in account (403, `reason: 'bond_required'`) unless a\n * bond backs it: one unspent coin of at least `minSats`, unspent at least\n * `minDays` days, checked within `maxAgeSecs`. The app never learns the\n * coin; `req.ocSession.oc_bond.nullifier` is the same for the same coin at\n * your site, so ban that to ban the coin. Implies `required`.\n */\n requireBond?: { minSats?: number; minDays?: number; maxAgeSecs?: number };\n /**\n * Your project key. The requirement you set in the project's settings\n * (\"who can sign in\") is read from its public config and enforced like\n * `requireBond`, so you change it there, not in code. An explicit\n * `requireBond` wins over it.\n */\n projectKey?: string;\n /** Where the project config is read. Default https://me.ochk.io. */\n meOrigin?: string;\n}\n\ntype BondNeed = NonNullable<WithOcAuthOptions['requireBond']>;\nconst POLICY_TTL_MS = 5 * 60_000;\nconst policies = new Map<string, { at: number; need: BondNeed | null }>();\n\n/**\n * The project's published requirement, cached five minutes. When the config\n * can't be read, the last one read stands; with none read yet it is\n * `undefined`, and the request is refused rather than let through unchecked.\n */\nasync function projectRequirement(options: WithOcAuthOptions): Promise<BondNeed | null | undefined> {\n const key = options.projectKey!;\n const hit = policies.get(key);\n if (hit && Date.now() - hit.at < POLICY_TTL_MS) return hit.need;\n try {\n const base = options.meOrigin ?? 'https://me.ochk.io';\n const r = await fetch(`${base}/api/integrator/config?project_key=${encodeURIComponent(key)}`, {\n signal: AbortSignal.timeout(4000),\n });\n if (!r.ok) throw new Error(`HTTP ${r.status}`);\n const j = (await r.json()) as {\n config?: { require_bond?: { min_sats: number; min_days: number } | null };\n };\n const req = j.config?.require_bond ?? null;\n const need = req ? { minSats: req.min_sats, minDays: req.min_days } : null;\n policies.set(key, { at: Date.now(), need });\n return need;\n } catch {\n return hit?.need;\n }\n}\n\n/** The requirement in force: explicit, else the project's, else none. */\nasync function bondNeed(options: WithOcAuthOptions): Promise<BondNeed | null | undefined> {\n if (options.requireBond) return options.requireBond;\n if (options.projectKey) return projectRequirement(options);\n return null;\n}\n\n/** Why a session can't pass, as a status and body, or null when it can. */\nasync function refusal(\n session: SessionPayload | null,\n options: WithOcAuthOptions\n): Promise<{ status: number; body: Record<string, unknown> } | null> {\n const need = await bondNeed(options);\n if (!session) {\n return options.required || need !== null\n ? { status: 401, body: { ok: false, reason: 'unauthenticated' } }\n : null;\n }\n if (need === undefined) {\n return { status: 503, body: { ok: false, reason: 'bond_policy_unavailable' } };\n }\n if (need && !bondMeets(session, need)) {\n const have = readBondClaim(session);\n return {\n status: 403,\n body: {\n ok: false,\n reason: 'bond_required',\n need,\n have: have ? { sats_floor: have.sats_floor, days_floor: have.days_floor } : null,\n },\n };\n }\n return null;\n}\n\n/**\n * Wrap a Next.js Pages-Router API route handler. Adds `req.ocSession` —\n * the verified SessionPayload, or null when unauthenticated.\n *\n * // pages/api/me/profile.ts\n * import { withOcAuth } from '@orangecheck/me-client/server';\n *\n * export default withOcAuth(async (req, res) => {\n * if (!req.ocSession) return res.status(401).json({ ok: false });\n * res.status(200).json({ account: { address: req.ocSession.did_oc } });\n * }, { required: true, audience: 'https://your-site.example' });\n *\n * `audience` is your own origin. The sign-in popup issues each site a token\n * bound to it; a site on *.ochk.io that reads the family cookie omits it.\n *\n * `Cache-Control: no-store, private` and `Vary: Cookie, Authorization`\n * are set on every authenticated response — without them a cached 401\n * leaks anonymous to authenticated callers.\n */\nexport function withOcAuth<T extends NextApiHandlerLike>(\n handler: T,\n options: WithOcAuthOptions = {}\n): T {\n const wrapped = async (req: NextApiRequestLike, res: NextApiResponseLike) => {\n res.setHeader('Cache-Control', 'no-store, private');\n res.setHeader('Vary', 'Cookie, Authorization');\n const session = await getOcSession(\n {\n cookie: typeof req.headers.cookie === 'string' ? req.headers.cookie : null,\n authorization:\n typeof req.headers.authorization === 'string'\n ? req.headers.authorization\n : null,\n },\n options\n );\n req.ocSession = session;\n const refused = await refusal(session, options);\n if (refused) return res.status(refused.status).json(refused.body);\n return handler(req, res);\n };\n return wrapped as unknown as T;\n}\n\n// ─── Express / Connect middleware ────────────────────────────────────────\n\ninterface ExpressRequestLike {\n headers: { cookie?: string; authorization?: string; [k: string]: unknown };\n ocSession?: SessionPayload | null;\n}\ninterface ExpressResponseLike {\n status(code: number): ExpressResponseLike;\n json(body: unknown): unknown;\n setHeader(name: string, value: string | number | readonly string[]): unknown;\n}\ntype ExpressNextLike = (err?: unknown) => void;\n\n/**\n * Express / Connect middleware. Attaches `req.ocSession` (verified\n * SessionPayload | null) and calls next(). Use it as a global middleware\n * or per-route.\n *\n * import express from 'express';\n * import { ocAuthExpress } from '@orangecheck/me-client/server';\n *\n * const app = express();\n * app.use(ocAuthExpress());\n *\n * app.get('/api/profile', (req, res) => {\n * if (!req.ocSession) return res.status(401).json({ error: 'sign in' });\n * res.json({ address: req.ocSession.did_oc });\n * });\n *\n * Pass `{ required: true }` to short-circuit unauthenticated requests\n * with a 401 before they reach your handler.\n */\nexport function ocAuthExpress(options: WithOcAuthOptions = {}) {\n return async (req: ExpressRequestLike, res: ExpressResponseLike, next: ExpressNextLike) => {\n try {\n res.setHeader('Cache-Control', 'no-store, private');\n res.setHeader('Vary', 'Cookie, Authorization');\n const session = await getOcSession(\n {\n cookie: typeof req.headers.cookie === 'string' ? req.headers.cookie : null,\n authorization:\n typeof req.headers.authorization === 'string'\n ? req.headers.authorization\n : null,\n },\n options\n );\n req.ocSession = session;\n const refused = await refusal(session, options);\n if (refused) {\n res.status(refused.status).json(refused.body);\n return;\n }\n next();\n } catch (err) {\n next(err);\n }\n };\n}\n\n// ─── Hono middleware ─────────────────────────────────────────────────────\n\ninterface HonoContextLike {\n req: { raw: { headers: Headers } };\n set(key: string, value: unknown): void;\n json(body: unknown, status?: number): unknown;\n header(name: string, value: string): void;\n}\ntype HonoNextLike = () => Promise<void>;\n\n/**\n * Hono middleware. Attaches the verified session at `c.get('ocSession')`.\n *\n * import { Hono } from 'hono';\n * import { ocAuthHono } from '@orangecheck/me-client/server';\n *\n * const app = new Hono();\n * app.use('*', ocAuthHono());\n *\n * app.get('/api/profile', (c) => {\n * const session = c.get('ocSession');\n * if (!session) return c.json({ error: 'sign in' }, 401);\n * return c.json({ address: session.did_oc });\n * });\n */\nexport function ocAuthHono(options: WithOcAuthOptions = {}) {\n return async (c: HonoContextLike, next: HonoNextLike) => {\n c.header('Cache-Control', 'no-store, private');\n c.header('Vary', 'Cookie, Authorization');\n const session = await getOcSession(c.req.raw.headers, options);\n c.set('ocSession', session);\n const refused = await refusal(session, options);\n if (refused) return c.json(refused.body, refused.status);\n await next();\n };\n}\n"]}
1
+ {"version":3,"sources":["../node_modules/jose/dist/webapi/lib/buffer_utils.js","../node_modules/jose/dist/webapi/lib/base64.js","../node_modules/jose/dist/webapi/util/base64url.js","../node_modules/jose/dist/webapi/util/errors.js","../node_modules/jose/dist/webapi/lib/type_checks.js","../node_modules/jose/dist/webapi/lib/jwk_to_key.js","../node_modules/jose/dist/webapi/key/import.js","../src/identity.ts","../src/server.ts"],"names":["getOcSessionCore"],"mappings":";;;;;;;;AAAuB,IAAI,WAAA;AACpB,IAAM,OAAA,GAAU,IAAI,WAAA,EAAY;;;ACUhC,SAAS,aAAa,OAAA,EAAS;AAClC,EAAA,IAAI,WAAW,UAAA,EAAY;AACvB,IAAA,OAAO,UAAA,CAAW,WAAW,OAAO,CAAA;AAAA,EACxC;AACA,EAAA,MAAM,MAAA,GAAS,KAAK,OAAO,CAAA;AAC3B,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,MAAA,CAAO,MAAM,CAAA;AAC1C,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,QAAQ,CAAA,EAAA,EAAK;AACpC,IAAA,KAAA,CAAM,CAAC,CAAA,GAAI,MAAA,CAAO,UAAA,CAAW,CAAC,CAAA;AAAA,EAClC;AACA,EAAA,OAAO,KAAA;AACX;;;ACnBO,SAAS,OAAO,KAAA,EAAO;AAC1B,EAAA,IAAI,WAAW,UAAA,EAAY;AACvB,IAAA,OAAO,UAAA,CAAW,WAAW,OAAO,KAAA,KAAU,WAAW,KAAA,GAAQ,OAAA,CAAQ,MAAA,CAAO,KAAK,CAAA,EAAG;AAAA,MACpF,QAAA,EAAU;AAAA,KACb,CAAA;AAAA,EACL;AACA,EAAA,IAAI,OAAA,GAAU,KAAA;AACd,EAAA,IAAI,mBAAmB,UAAA,EAAY;AAC/B,IAAA,OAAA,GAAU,OAAA,CAAQ,OAAO,OAAO,CAAA;AAAA,EACpC;AACA,EAAA,OAAA,GAAU,QAAQ,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AACtD,EAAA,IAAI;AACA,IAAA,OAAO,aAAa,OAAO,CAAA;AAAA,EAC/B,CAAA,CAAA,MACM;AACF,IAAA,MAAM,IAAI,UAAU,mDAAmD,CAAA;AAAA,EAC3E;AACJ;;;ACnBO,IAAM,SAAA,GAAN,cAAwB,KAAA,CAAM;AAAA,EAGjC,WAAA,CAAY,SAAS,OAAA,EAAS;AAC1B,IAAA,KAAA,CAAM,SAAS,OAAO,CAAA;AAF1B,IAAA,aAAA,CAAA,IAAA,EAAA,MAAA,EAAO,kBAAA,CAAA;AAGH,IAAA,IAAA,CAAK,IAAA,GAAO,KAAK,WAAA,CAAY,IAAA;AAC7B,IAAA,KAAA,CAAM,iBAAA,GAAoB,IAAA,EAAM,IAAA,CAAK,WAAW,CAAA;AAAA,EACpD;AACJ,CAAA;AAPI,aAAA,CADS,WACF,MAAA,EAAO,kBAAA,CAAA;AAsCX,IAAM,gBAAA,GAAN,cAA+B,SAAA,CAAU;AAAA,EAAzC,WAAA,GAAA;AAAA,IAAA,KAAA,CAAA,GAAA,SAAA,CAAA;AAEH,IAAA,aAAA,CAAA,IAAA,EAAA,MAAA,EAAO,wBAAA,CAAA;AAAA,EAAA;AACX,CAAA;AAFI,aAAA,CADS,kBACF,MAAA,EAAO,wBAAA,CAAA;AAxClB,IAAA,EAAA,EAAA,EAAA;AA6EO,IAAM,wBAAA,GAAN,eAAuC,EAAA,GAAA,SAAA,EACzC,EAAA,GAAA,MAAA,CAAO,eADkC,EAAA,EAAU;AAAA,EAIpD,WAAA,CAAY,OAAA,GAAU,sDAAA,EAAwD,OAAA,EAAS;AACnF,IAAA,KAAA,CAAM,SAAS,OAAO,CAAA;AAJ1B,IAAA,aAAA,CAAA,IAAA,EAAC,EAAA,CAAA;AAED,IAAA,aAAA,CAAA,IAAA,EAAA,MAAA,EAAO,iCAAA,CAAA;AAAA,EAGP;AACJ,CAAA;AALI,aAAA,CAFS,0BAEF,MAAA,EAAO,iCAAA,CAAA;;;AC/ElB,IAAM,eAAe,CAAC,KAAA,KAAU,OAAO,KAAA,KAAU,YAAY,KAAA,KAAU,IAAA;AAChE,SAAS,SAAS,KAAA,EAAO;AAC5B,EAAA,IAAI,CAAC,YAAA,CAAa,KAAK,CAAA,IAAK,MAAA,CAAO,UAAU,QAAA,CAAS,IAAA,CAAK,KAAK,CAAA,KAAM,iBAAA,EAAmB;AACrF,IAAA,OAAO,KAAA;AAAA,EACX;AACA,EAAA,IAAI,MAAA,CAAO,cAAA,CAAe,KAAK,CAAA,KAAM,IAAA,EAAM;AACvC,IAAA,OAAO,IAAA;AAAA,EACX;AACA,EAAA,IAAI,KAAA,GAAQ,KAAA;AACZ,EAAA,OAAO,MAAA,CAAO,cAAA,CAAe,KAAK,CAAA,KAAM,IAAA,EAAM;AAC1C,IAAA,KAAA,GAAQ,MAAA,CAAO,eAAe,KAAK,CAAA;AAAA,EACvC;AACA,EAAA,OAAO,MAAA,CAAO,cAAA,CAAe,KAAK,CAAA,KAAM,KAAA;AAC5C;;;ACZA,IAAM,cAAA,GAAiB,8DAAA;AACvB,SAAS,cAAc,GAAA,EAAK;AACxB,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI,SAAA;AACJ,EAAA,QAAQ,IAAI,GAAA;AAAK,IACb,KAAK,KAAA,EAAO;AACR,MAAA,QAAQ,IAAI,GAAA;AAAK,QACb,KAAK,WAAA;AAAA,QACL,KAAK,WAAA;AAAA,QACL,KAAK,WAAA;AACD,UAAA,SAAA,GAAY,EAAE,IAAA,EAAM,GAAA,CAAI,GAAA,EAAI;AAC5B,UAAA,SAAA,GAAY,IAAI,IAAA,GAAO,CAAC,MAAM,CAAA,GAAI,CAAC,QAAQ,CAAA;AAC3C,UAAA;AAAA,QACJ;AACI,UAAA,MAAM,IAAI,iBAAiB,cAAc,CAAA;AAAA;AAEjD,MAAA;AAAA,IACJ;AAAA,IACA,KAAK,KAAA,EAAO;AACR,MAAA,QAAQ,IAAI,GAAA;AAAK,QACb,KAAK,OAAA;AAAA,QACL,KAAK,OAAA;AAAA,QACL,KAAK,OAAA;AACD,UAAA,SAAA,GAAY,EAAE,IAAA,EAAM,SAAA,EAAW,IAAA,EAAM,CAAA,IAAA,EAAO,IAAI,GAAA,CAAI,KAAA,CAAM,EAAE,CAAC,CAAA,CAAA,EAAG;AAChE,UAAA,SAAA,GAAY,IAAI,CAAA,GAAI,CAAC,MAAM,CAAA,GAAI,CAAC,QAAQ,CAAA;AACxC,UAAA;AAAA,QACJ,KAAK,OAAA;AAAA,QACL,KAAK,OAAA;AAAA,QACL,KAAK,OAAA;AACD,UAAA,SAAA,GAAY,EAAE,IAAA,EAAM,mBAAA,EAAqB,IAAA,EAAM,CAAA,IAAA,EAAO,IAAI,GAAA,CAAI,KAAA,CAAM,EAAE,CAAC,CAAA,CAAA,EAAG;AAC1E,UAAA,SAAA,GAAY,IAAI,CAAA,GAAI,CAAC,MAAM,CAAA,GAAI,CAAC,QAAQ,CAAA;AACxC,UAAA;AAAA,QACJ,KAAK,UAAA;AAAA,QACL,KAAK,cAAA;AAAA,QACL,KAAK,cAAA;AAAA,QACL,KAAK,cAAA;AACD,UAAA,SAAA,GAAY;AAAA,YACR,IAAA,EAAM,UAAA;AAAA,YACN,IAAA,EAAM,CAAA,IAAA,EAAO,QAAA,CAAS,GAAA,CAAI,GAAA,CAAI,MAAM,EAAE,CAAA,EAAG,EAAE,CAAA,IAAK,CAAC,CAAA;AAAA,WACrD;AACA,UAAA,SAAA,GAAY,GAAA,CAAI,IAAI,CAAC,SAAA,EAAW,WAAW,CAAA,GAAI,CAAC,WAAW,SAAS,CAAA;AACpE,UAAA;AAAA,QACJ;AACI,UAAA,MAAM,IAAI,iBAAiB,cAAc,CAAA;AAAA;AAEjD,MAAA;AAAA,IACJ;AAAA,IACA,KAAK,IAAA,EAAM;AACP,MAAA,QAAQ,IAAI,GAAA;AAAK,QACb,KAAK,OAAA;AAAA,QACL,KAAK,OAAA;AAAA,QACL,KAAK,OAAA;AACD,UAAA,SAAA,GAAY;AAAA,YACR,IAAA,EAAM,OAAA;AAAA,YACN,UAAA,EAAY,EAAE,KAAA,EAAO,OAAA,EAAS,KAAA,EAAO,SAAS,KAAA,EAAO,OAAA,EAAQ,CAAE,GAAA,CAAI,GAAG;AAAA,WAC1E;AACA,UAAA,SAAA,GAAY,IAAI,CAAA,GAAI,CAAC,MAAM,CAAA,GAAI,CAAC,QAAQ,CAAA;AACxC,UAAA;AAAA,QACJ,KAAK,SAAA;AAAA,QACL,KAAK,gBAAA;AAAA,QACL,KAAK,gBAAA;AAAA,QACL,KAAK,gBAAA;AACD,UAAA,SAAA,GAAY,EAAE,IAAA,EAAM,MAAA,EAAQ,UAAA,EAAY,IAAI,GAAA,EAAI;AAChD,UAAA,SAAA,GAAY,GAAA,CAAI,CAAA,GAAI,CAAC,YAAY,IAAI,EAAC;AACtC,UAAA;AAAA,QACJ;AACI,UAAA,MAAM,IAAI,iBAAiB,cAAc,CAAA;AAAA;AAEjD,MAAA;AAAA,IACJ;AAAA,IACA,KAAK,KAAA,EAAO;AACR,MAAA,QAAQ,IAAI,GAAA;AAAK,QACb,KAAK,SAAA;AAAA,QACL,KAAK,OAAA;AACD,UAAA,SAAA,GAAY,EAAE,MAAM,SAAA,EAAU;AAC9B,UAAA,SAAA,GAAY,IAAI,CAAA,GAAI,CAAC,MAAM,CAAA,GAAI,CAAC,QAAQ,CAAA;AACxC,UAAA;AAAA,QACJ,KAAK,SAAA;AAAA,QACL,KAAK,gBAAA;AAAA,QACL,KAAK,gBAAA;AAAA,QACL,KAAK,gBAAA;AACD,UAAA,SAAA,GAAY,EAAE,IAAA,EAAM,GAAA,CAAI,GAAA,EAAI;AAC5B,UAAA,SAAA,GAAY,GAAA,CAAI,CAAA,GAAI,CAAC,YAAY,IAAI,EAAC;AACtC,UAAA;AAAA,QACJ;AACI,UAAA,MAAM,IAAI,iBAAiB,cAAc,CAAA;AAAA;AAEjD,MAAA;AAAA,IACJ;AAAA,IACA;AACI,MAAA,MAAM,IAAI,iBAAiB,6DAA6D,CAAA;AAAA;AAEhG,EAAA,OAAO,EAAE,WAAW,SAAA,EAAU;AAClC;AACA,eAAsB,SAAS,GAAA,EAAK;AAChC,EAAA,IAAI,CAAC,IAAI,GAAA,EAAK;AACV,IAAA,MAAM,IAAI,UAAU,0DAA0D,CAAA;AAAA,EAClF;AACA,EAAA,MAAM,EAAE,SAAA,EAAW,SAAA,EAAU,GAAI,cAAc,GAAG,CAAA;AAClD,EAAA,MAAM,OAAA,GAAU,EAAE,GAAG,GAAA,EAAI;AACzB,EAAA,IAAI,OAAA,CAAQ,QAAQ,KAAA,EAAO;AACvB,IAAA,OAAO,OAAA,CAAQ,GAAA;AAAA,EACnB;AACA,EAAA,OAAO,OAAA,CAAQ,GAAA;AACf,EAAA,OAAO,OAAO,MAAA,CAAO,SAAA,CAAU,KAAA,EAAO,OAAA,EAAS,WAAW,GAAA,CAAI,GAAA,KAAQ,GAAA,CAAI,CAAA,IAAK,IAAI,IAAA,GAAO,KAAA,GAAQ,IAAA,CAAA,EAAO,GAAA,CAAI,WAAW,SAAS,CAAA;AACrI;;;ACnFA,eAAsB,SAAA,CAAU,GAAA,EAAK,GAAA,EAAK,OAAA,EAAS;AAC/C,EAAA,IAAI,CAAC,QAAA,CAAS,GAAG,CAAA,EAAG;AAChB,IAAA,MAAM,IAAI,UAAU,uBAAuB,CAAA;AAAA,EAC/C;AACA,EAAA,IAAI,GAAA;AAEJ,EAAA,GAAA,KAAA,GAAA,GAAgC,GAAA,CAAI,GAAA,CAAA;AACpC,EAAA,QAAQ,IAAI,GAAA;AAAK,IACb,KAAK,KAAA;AACD,MAAA,IAAI,OAAO,GAAA,CAAI,CAAA,KAAM,QAAA,IAAY,CAAC,IAAI,CAAA,EAAG;AACrC,QAAA,MAAM,IAAI,UAAU,yCAAyC,CAAA;AAAA,MACjE;AACA,MAAA,OAAO,MAAA,CAAgB,IAAI,CAAC,CAAA;AAAA,IAChC,KAAK,KAAA;AACD,MAAA,IAAI,KAAA,IAAS,GAAA,IAAO,GAAA,CAAI,GAAA,KAAQ,MAAA,EAAW;AACvC,QAAA,MAAM,IAAI,iBAAiB,oEAAoE,CAAA;AAAA,MACnG;AACA,MAAA,OAAO,SAAS,EAAE,GAAG,GAAA,EAAK,GAAA,EAAK,KAAK,CAAA;AAAA,IACxC,KAAK,KAAA,EAAO;AACR,MAAA,IAAI,OAAO,GAAA,CAAI,GAAA,KAAQ,QAAA,IAAY,CAAC,IAAI,GAAA,EAAK;AACzC,QAAA,MAAM,IAAI,UAAU,2CAA2C,CAAA;AAAA,MACnE;AACA,MAAA,IAAyB,GAAA,KAAQ,GAAA,CAAI,GAAA,EAAK;AACtC,QAAA,MAAM,IAAI,UAAU,uCAAuC,CAAA;AAAA,MAC/D;AACA,MAAA,OAAO,QAAA,CAAS,EAAE,GAAG,GAAA,EAAK,KAAK,CAAA;AAAA,IACnC;AAAA,IACA,KAAK,IAAA;AAAA,IACL,KAAK,KAAA;AACD,MAAA,OAAO,SAAS,EAAE,GAAG,GAAA,EAAK,GAAA,EAAK,KAAK,CAAA;AAAA,IACxC;AACI,MAAA,MAAM,IAAI,iBAAiB,8CAA8C,CAAA;AAAA;AAErF;;;AClCA,IAAM,cAAA,GAAiB,oBAAA;AACvB,IAAM,cAAA,GAAiB,KAAK,EAAA,GAAK,GAAA;AACjC,IAAM,kBAAA,GAAqB,oCAAA;AAoE3B,IAAM,SAAA,uBAAgB,GAAA,EAA4B;AAClD,IAAM,QAAA,uBAAe,GAAA,EAAqC;AAE1D,eAAe,iBAAA,CAAkB,QAAgB,KAAA,EAAwC;AACrF,EAAA,MAAM,MAAA,GAAS,SAAA,CAAU,GAAA,CAAI,MAAM,CAAA;AACnC,EAAA,IAAI,UAAU,IAAA,CAAK,GAAA,KAAQ,MAAA,CAAO,SAAA,GAAY,OAAO,OAAO,MAAA;AAC5D,EAAA,MAAM,QAAA,GAAW,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA;AACpC,EAAA,IAAI,UAAU,OAAO,QAAA;AACrB,EAAA,MAAM,KAAK,YAAqC;AAC5C,IAAA,IAAI;AACA,MAAA,MAAM,GAAA,GAAM,GAAG,MAAA,CAAO,OAAA,CAAQ,OAAO,EAAE,CAAC,GAAG,kBAAkB,CAAA,CAAA;AAC7D,MAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,SAAS,EAAE,MAAA,EAAQ,kBAAA,EAAmB,EAAG,CAAA;AACxE,MAAA,IAAI,CAAC,GAAA,CAAI,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,GAAG,CAAA,UAAA,EAAa,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAChF,MAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAC7B,MAAA,IAAI,CAAC,IAAA,IAAQ,CAAC,MAAM,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAA,EAAG;AACpC,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,iBAAA,EAAoB,GAAG,CAAA,+BAAA,CAA4B,CAAA;AAAA,MACvE;AACA,MAAA,MAAM,OAAgC,EAAC;AACvC,MAAA,KAAA,MAAW,CAAA,IAAK,KAAK,IAAA,EAAM;AACvB,QAAA,IAAI,OAAO,CAAA,CAAE,GAAA,KAAQ,QAAA,EAAU;AAC/B,QAAA,IAAI;AACA,UAAA,IAAA,CAAK,EAAE,GAAG,CAAA,GAAK,MAAM,SAAA,CAAU,GAAG,OAAO,CAAA;AAAA,QAC7C,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACJ;AACA,MAAA,MAAM,QAAwB,EAAE,IAAA,EAAM,SAAA,EAAW,IAAA,CAAK,KAAI,EAAE;AAC5D,MAAA,SAAA,CAAU,GAAA,CAAI,QAAQ,KAAK,CAAA;AAC3B,MAAA,OAAO,KAAA;AAAA,IACX,SAAS,GAAA,EAAK;AACV,MAAA,MAAM,KAAA,GAAQ,SAAA,CAAU,GAAA,CAAI,MAAM,CAAA;AAClC,MAAA,IAAI,OAAO,OAAO,KAAA;AAClB,MAAA,MAAM,GAAA;AAAA,IACV;AAAA,EACJ,CAAA,GAAG,CAAE,OAAA,CAAQ,MAAM;AACf,IAAA,QAAA,CAAS,OAAO,MAAM,CAAA;AAAA,EAC1B,CAAC,CAAA;AACD,EAAA,QAAA,CAAS,GAAA,CAAI,QAAQ,CAAC,CAAA;AACtB,EAAA,OAAO,CAAA;AACX;AAEA,SAAS,WAAW,GAAA,EAAgC;AAChD,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,OAAO,IAAA;AACpC,EAAA,MAAM,CAAA,GAAI,IAAI,IAAA,EAAK;AACnB,EAAA,IAAI,EAAE,MAAA,KAAW,CAAA,IAAK,EAAE,MAAA,GAAS,CAAA,KAAM,GAAG,OAAO,IAAA;AACjD,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,CAAA,CAAE,SAAS,CAAC,CAAA;AACvC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,GAAA,CAAI,QAAQ,CAAA,EAAA,EAAK;AACjC,IAAA,MAAM,CAAA,GAAI,QAAA,CAAS,CAAA,CAAE,KAAA,CAAM,CAAA,GAAI,GAAG,CAAA,GAAI,CAAA,GAAI,CAAC,CAAA,EAAG,EAAE,CAAA;AAChD,IAAA,IAAI,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA,EAAG,OAAO,IAAA;AAC5B,IAAA,GAAA,CAAI,CAAC,CAAA,GAAI,CAAA;AAAA,EACb;AACA,EAAA,OAAO,GAAA;AACX;AAEA,SAAS,cAAc,GAAA,EAAgC;AACnD,EAAA,IAAI;AACA,IAAA,MAAM,GAAA,GACF,OAAO,IAAA,KAAS,UAAA,GACV,IAAA,CAAK,GAAG,CAAA,GACR,MAAA,CAAO,IAAA,CAAK,GAAA,EAAK,QAAQ,CAAA,CAAE,SAAS,QAAQ,CAAA;AACtD,IAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA;AACrC,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,GAAA,CAAI,MAAA,EAAQ,CAAA,EAAA,EAAK,GAAA,CAAI,CAAC,CAAA,GAAI,GAAA,CAAI,UAAA,CAAW,CAAC,CAAA;AAC9D,IAAA,OAAO,GAAA;AAAA,EACX,CAAA,CAAA,MAAQ;AACJ,IAAA,OAAO,IAAA;AAAA,EACX;AACJ;AAEA,SAAS,WAAW,KAAA,EAA2B;AAC3C,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,MAAW,CAAA,IAAK,OAAO,GAAA,IAAO,CAAA,CAAE,SAAS,EAAE,CAAA,CAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAA;AAC5D,EAAA,OAAO,GAAA;AACX;AAEA,eAAe,OAAO,KAAA,EAAwC;AAC1D,EAAA,MAAM,MAAA,GACF,OAAO,UAAA,CAAW,MAAA,KAAW,WAAA,IAAe,WAAW,MAAA,CAAO,MAAA,GACxD,UAAA,CAAW,MAAA,CAAO,MAAA,GAClB,IAAA;AACV,EAAA,IAAI,CAAC,MAAA,EAAQ;AACT,IAAA,MAAM,IAAI,MAAM,8EAA2E,CAAA;AAAA,EAC/F;AACA,EAAA,MAAM,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,WAAW,KAA+B,CAAA;AAC1E,EAAA,OAAO,IAAI,WAAW,GAAG,CAAA;AAC7B;AAEA,SAAS,cAAc,IAAA,EAA+B;AAClD,EAAA,MAAM,GAAA,GAAM,IAAI,WAAA,CAAY,IAAA,CAAK,UAAU,CAAA;AAC3C,EAAA,IAAI,UAAA,CAAW,GAAG,CAAA,CAAE,GAAA,CAAI,IAAI,CAAA;AAC5B,EAAA,OAAO,GAAA;AACX;AAEA,eAAe,aAAA,CACX,GAAA,EACA,GAAA,EACA,GAAA,EACgB;AAChB,EAAA,MAAM,MAAA,GACF,OAAO,UAAA,CAAW,MAAA,KAAW,WAAA,IAAe,WAAW,MAAA,CAAO,MAAA,GACxD,UAAA,CAAW,MAAA,CAAO,MAAA,GAClB,IAAA;AACV,EAAA,IAAI,CAAC,QAAQ,OAAO,KAAA;AACpB,EAAA,IAAI;AACA,IAAA,OAAO,MAAM,MAAA,CAAO,MAAA;AAAA,MAChB,SAAA;AAAA,MACA,GAAA;AAAA,MACA,cAAc,GAAG,CAAA;AAAA,MACjB,cAAc,GAAG;AAAA,KACrB;AAAA,EACJ,CAAA,CAAA,MAAQ;AACJ,IAAA,OAAO,KAAA;AAAA,EACX;AACJ;AAWA,eAAsB,yBAAA,CAClB,MAAA,EACA,OAAA,GAAiC,EAAC,EACL;AAC7B,EAAA,MAAM,SAAgC,EAAC;AAGvC,EAAA,MAAM,OAAA,GACF,CAAC,CAAC,MAAA,IACF,OAAO,MAAA,KAAW,QAAA,IAClB,OAAO,MAAA,CAAO,GAAA,KAAQ,QAAA,IACtB,OAAO,OAAO,GAAA,KAAQ,QAAA,IACtB,OAAO,MAAA,CAAO,aAAA,KAAkB,QAAA,IAChC,CAAC,CAAC,OAAO,WAAA,IACT,OAAO,MAAA,CAAO,WAAA,CAAY,EAAA,KAAO,QAAA,IACjC,OAAO,MAAA,CAAO,YAAY,UAAA,KAAe,QAAA;AAC7C,EAAA,MAAA,CAAO,IAAA,CAAK;AAAA,IACR,EAAA,EAAI,OAAA;AAAA,IACJ,KAAA,EAAO;AAAA,GACV,CAAA;AACD,EAAA,IAAI,CAAC,OAAA,EAAS;AACV,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,wBAAwB,MAAA,EAAO;AAAA,EAC/D;AAEA,EAAA,MAAM,IAAI,MAAA,CAAO,WAAA;AAGjB,EAAA,MAAM,SAAA,GAAY,aAAA,CAAc,MAAA,CAAO,aAAa,CAAA;AACpD,EAAA,MAAA,CAAO,IAAA,CAAK;AAAA,IACR,IAAI,SAAA,KAAc,IAAA;AAAA,IAClB,KAAA,EAAO,uBAAA;AAAA,IACP,MAAA,EAAQ,SAAA,GAAY,CAAA,EAAG,SAAA,CAAU,MAAM,CAAA,MAAA,CAAA,GAAW;AAAA,GACrD,CAAA;AACD,EAAA,IAAI,CAAC,SAAA,EAAW,OAAO,EAAE,EAAA,EAAI,OAAO,MAAA,EAAQ,8BAAA,EAAgC,MAAA,EAAQ,WAAA,EAAa,CAAA,EAAE;AAGnG,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,SAAS,CAAA;AACrC,EAAA,MAAM,UAAA,GAAa,WAAW,MAAM,CAAA;AACpC,EAAA,MAAM,IAAA,GAAO,eAAe,CAAA,CAAE,EAAA;AAC9B,EAAA,MAAA,CAAO,IAAA,CAAK;AAAA,IACR,EAAA,EAAI,IAAA;AAAA,IACJ,KAAA,EAAO,gCAAA;AAAA,IACP,MAAA,EAAQ,OAAO,CAAA,CAAE,EAAA,GAAK,YAAY,CAAA,CAAE,EAAE,SAAS,UAAU,CAAA;AAAA,GAC5D,CAAA;AACD,EAAA,IAAI,CAAC,IAAA,EAAM,OAAO,EAAE,EAAA,EAAI,OAAO,MAAA,EAAQ,wCAAA,EAA0C,MAAA,EAAQ,WAAA,EAAa,CAAA,EAAE;AAGxG,EAAA,IAAI,GAAA,GAAsB,IAAA;AAC1B,EAAA,IAAI,QAAQ,GAAA,EAAK;AACb,IAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,GAAA,KAAQ,MAAA,CAAO,GAAA,EAAK;AAChC,MAAA,MAAA,CAAO,IAAA,CAAK;AAAA,QACR,EAAA,EAAI,KAAA;AAAA,QACJ,KAAA,EAAO,+BAAA;AAAA,QACP,QAAQ,CAAA,iBAAA,EAAoB,OAAA,CAAQ,IAAI,GAAG,CAAA,gBAAA,EAAmB,OAAO,GAAG,CAAA;AAAA,OAC3E,CAAA;AACD,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,gCAAA,EAAkC,MAAA,EAAQ,aAAa,CAAA,EAAE;AAAA,IACzF;AACA,IAAA,IAAI;AACA,MAAA,GAAA,GAAO,MAAM,SAAA,CAAU,OAAA,CAAQ,GAAA,EAAK,OAAO,CAAA;AAC3C,MAAA,MAAA,CAAO,IAAA,CAAK,EAAE,EAAA,EAAI,IAAA,EAAM,KAAA,EAAO,+BAAA,EAAiC,MAAA,EAAQ,CAAA,IAAA,EAAO,MAAA,CAAO,GAAG,CAAA,WAAA,CAAA,EAAe,CAAA;AAAA,IAC5G,SAAS,GAAA,EAAK;AACV,MAAA,MAAA,CAAO,IAAA,CAAK;AAAA,QACR,EAAA,EAAI,KAAA;AAAA,QACJ,KAAA,EAAO,+BAAA;AAAA,QACP,MAAA,EAAQ,CAAA,4BAAA,EAAgC,GAAA,CAAc,OAAO,CAAA;AAAA,OAChE,CAAA;AACD,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,4BAAA,EAA8B,MAAA,EAAQ,aAAa,CAAA,EAAE;AAAA,IACrF;AAAA,EACJ,CAAA,MAAO;AACH,IAAA,MAAM,MAAA,GAAS,QAAQ,MAAA,IAAU,cAAA;AACjC,IAAA,MAAM,GAAA,GAAM,QAAQ,cAAA,IAAkB,cAAA;AACtC,IAAA,IAAI;AACA,MAAA,IAAI,KAAA,GAAQ,MAAM,iBAAA,CAAkB,MAAA,EAAQ,GAAG,CAAA;AAC/C,MAAA,GAAA,GAAM,KAAA,CAAM,IAAA,CAAK,MAAA,CAAO,GAAG,CAAA,IAAK,IAAA;AAChC,MAAA,IAAI,CAAC,GAAA,EAAK;AAEN,QAAA,SAAA,CAAU,OAAO,MAAM,CAAA;AACvB,QAAA,KAAA,GAAQ,MAAM,iBAAA,CAAkB,MAAA,EAAQ,GAAG,CAAA;AAC3C,QAAA,GAAA,GAAM,KAAA,CAAM,IAAA,CAAK,MAAA,CAAO,GAAG,CAAA,IAAK,IAAA;AAAA,MACpC;AACA,MAAA,MAAA,CAAO,IAAA,CAAK;AAAA,QACR,EAAA,EAAI,CAAC,CAAC,GAAA;AAAA,QACN,KAAA,EAAO,+BAAA;AAAA,QACP,MAAA,EAAQ,GAAA,GAAM,CAAA,IAAA,EAAO,MAAA,CAAO,GAAG,CAAA,CAAA,GAAK,CAAA,gBAAA,EAAmB,MAAA,CAAO,GAAG,CAAA,IAAA,EAAO,MAAM,CAAA,EAAG,kBAAkB,CAAA;AAAA,OACtG,CAAA;AACD,MAAA,IAAI,CAAC,GAAA,EAAK;AACN,QAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,CAAA,IAAA,EAAO,OAAO,GAAG,CAAA,qBAAA,CAAA,EAAyB,MAAA,EAAQ,WAAA,EAAa,CAAA,EAAE;AAAA,MACjG;AAAA,IACJ,SAAS,GAAA,EAAK;AACV,MAAA,MAAA,CAAO,IAAA,CAAK;AAAA,QACR,EAAA,EAAI,KAAA;AAAA,QACJ,KAAA,EAAO,+BAAA;AAAA,QACP,MAAA,EAAQ,CAAA,2BAAA,EAA+B,GAAA,CAAc,OAAO,CAAA;AAAA,OAC/D,CAAA;AACD,MAAA,OAAO;AAAA,QACH,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,CAAA,2BAAA,EAA+B,GAAA,CAAc,OAAO,CAAA,CAAA;AAAA,QAC5D,MAAA;AAAA,QACA,WAAA,EAAa;AAAA,OACjB;AAAA,IACJ;AAAA,EACJ;AAEA,EAAA,MAAM,QAAA,GAAW,UAAA,CAAW,MAAA,CAAO,GAAG,CAAA;AACtC,EAAA,IAAI,CAAC,QAAA,EAAU;AACX,IAAA,MAAA,CAAO,IAAA,CAAK;AAAA,MACR,EAAA,EAAI,KAAA;AAAA,MACJ,KAAA,EAAO,kDAAA;AAAA,MACP,MAAA,EAAQ;AAAA,KACX,CAAA;AACD,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,QAAQ,eAAA,EAAiB,MAAA,EAAQ,aAAa,CAAA,EAAE;AAAA,EACxE;AACA,EAAA,MAAM,KAAA,GAAQ,MAAM,aAAA,CAAc,GAAA,EAAK,UAAU,SAAS,CAAA;AAC1D,EAAA,MAAA,CAAO,IAAA,CAAK;AAAA,IACR,EAAA,EAAI,KAAA;AAAA,IACJ,KAAA,EAAO,kDAAA;AAAA,IACP,MAAA,EAAQ,QAAQ,iBAAA,GAAoB;AAAA,GACvC,CAAA;AACD,EAAA,IAAI,CAAC,KAAA,EAAO,OAAO,EAAE,EAAA,EAAI,OAAO,MAAA,EAAQ,0BAAA,EAA4B,MAAA,EAAQ,WAAA,EAAa,CAAA,EAAE;AAG3F,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,oBAAO,IAAI,IAAA,EAAK;AACpC,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,KAAA,CAAM,CAAA,CAAE,UAAU,CAAA;AACzC,EAAA,MAAM,UAAU,MAAA,CAAO,QAAA,CAAS,SAAS,CAAA,IAAK,SAAA,GAAY,IAAI,OAAA,EAAQ;AACtE,EAAA,MAAA,CAAO,IAAA,CAAK;AAAA,IACR,EAAA,EAAI,OAAA;AAAA,IACJ,KAAA,EAAO,8BAAA;AAAA,IACP,MAAA,EAAQ,UACF,CAAA,QAAA,EAAW,IAAI,KAAK,SAAS,CAAA,CAAE,WAAA,EAAa,CAAA,CAAA,GAC5C;AAAA,GACT,CAAA;AACD,EAAA,IAAI,CAAC,OAAA,EAAS,OAAO,EAAE,EAAA,EAAI,OAAO,MAAA,EAAQ,yBAAA,EAA2B,MAAA,EAAQ,WAAA,EAAa,CAAA,EAAE;AAE5F,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,WAAA,EAAa,GAAG,MAAA,EAAO;AAC9C;AAIA,eAAsB,mBAAA,CAAoB,SAAS,cAAA,EAA+B;AAC9E,EAAA,SAAA,CAAU,OAAO,MAAM,CAAA;AACvB,EAAA,MAAM,iBAAA,CAAkB,QAAQ,cAAc,CAAA;AAClD;AAEO,IAAM,QAAA,GAAW;AAAA,EACpB,yBAAA;AAAA,EACA;AACJ;;;ACtRA,eAAsB,YAAA,CAClB,OAAA,EACA,OAAA,GAA2B,EAAC,EACE;AAC9B,EAAA,MAAM,OAAA,GAAU,MAAMA,cAAA,CAAiB,OAAA,EAAS,OAAO,CAAA;AACvD,EAAA,IAAI,CAAC,OAAA,IAAW,OAAA,CAAQ,QAAA,KAAa,MAAA,wBAAiC,OAAO,CAAA;AAC7E,EAAA,OAAO,OAAA;AACX;AAEA,IAAI,cAAA,GAAiB,KAAA;AAQrB,SAAS,sBAAsB,OAAA,EAAgD;AAC3E,EAAA,IAAI,cAAA,EAAgB;AACpB,EAAA,MAAM,IAAA,GACF,OAAO,OAAA,KAAY,WAAA,IAAe,OAAA,YAAmB,UAC/C,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA,GAC1B,OAAA,CAAkC,aAAA;AAC7C,EAAA,MAAM,IAAI,OAAO,IAAA,KAAS,WAAW,+BAAA,CAAgC,IAAA,CAAK,IAAI,CAAA,GAAI,IAAA;AAClF,EAAA,IAAI,CAAC,CAAA,EAAG;AACR,EAAA,IAAI;AACA,IAAA,MAAM,UAAU,IAAA,CAAK,KAAA,CAAM,kBAAkB,CAAA,CAAE,CAAC,CAAE,CAAC,CAAA;AACnD,IAAA,IAAI,OAAA,CAAQ,QAAQ,KAAA,CAAA,EAAW;AAC/B,IAAA,cAAA,GAAiB,IAAA;AACjB,IAAA,OAAA,CAAQ,IAAA;AAAA,MACJ,CAAA,kDAAA,EAAqD,IAAA,CAAK,SAAA,CAAU,OAAA,CAAQ,GAAG,CAAC,CAAA,+IAAA;AAAA,KAGpF;AAAA,EACJ,CAAA,CAAA,MAAQ;AAAA,EAER;AACJ;AAEA,SAAS,kBAAkB,CAAA,EAAmB;AAC1C,EAAA,MAAM,GAAA,GAAM,EAAE,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AAClD,EAAA,IAAI,OAAO,IAAA,KAAS,UAAA,EAAY,OAAO,IAAA,CAAK,GAAA,GAAM,GAAA,CAAI,MAAA,CAAA,CAAQ,CAAA,GAAK,GAAA,CAAI,MAAA,GAAS,CAAA,IAAM,CAAC,CAAC,CAAA;AACxF,EAAA,OAAO,OAAO,IAAA,CAAK,CAAA,EAAG,WAAW,CAAA,CAAE,SAAS,MAAM,CAAA;AACtD;AAyCA,IAAM,aAAA,GAAgB,GAAA;AACtB,IAAM,QAAA,uBAAe,GAAA,EAAmD;AASxE,eAAe,mBAAmB,OAAA,EAAkE;AAChG,EAAA,MAAM,MAAM,OAAA,CAAQ,UAAA;AACpB,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,GAAA,CAAI,GAAG,CAAA;AAC5B,EAAA,IAAI,GAAA,IAAO,KAAK,GAAA,EAAI,GAAI,IAAI,EAAA,GAAK,aAAA,SAAsB,GAAA,CAAI,IAAA;AAC3D,EAAA,IAAI;AACA,IAAA,MAAM,IAAA,GAAO,QAAQ,QAAA,IAAY,oBAAA;AACjC,IAAA,MAAM,CAAA,GAAI,MAAM,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,gBAAA,EAAmB,kBAAA,CAAmB,GAAG,CAAC,CAAA,QAAA,CAAA,EAAY;AAAA,MAC/E,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,GAAI;AAAA,KACnC,CAAA;AACD,IAAA,IAAI,CAAC,EAAE,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,KAAA,EAAQ,CAAA,CAAE,MAAM,CAAA,CAAE,CAAA;AAC7C,IAAA,MAAM,CAAA,GAAK,MAAM,CAAA,CAAE,IAAA,EAAK;AAGxB,IAAA,MAAM,GAAA,GAAM,EAAE,YAAA,IAAgB,IAAA;AAC9B,IAAA,MAAM,IAAA,GAAO,MAAM,EAAE,OAAA,EAAS,IAAI,QAAA,EAAU,OAAA,EAAS,GAAA,CAAI,QAAA,EAAS,GAAI,IAAA;AACtE,IAAA,QAAA,CAAS,GAAA,CAAI,KAAK,EAAE,EAAA,EAAI,KAAK,GAAA,EAAI,EAAG,MAAM,CAAA;AAC1C,IAAA,OAAO,IAAA;AAAA,EACX,CAAA,CAAA,MAAQ;AACJ,IAAA,OAAO,GAAA,EAAK,IAAA;AAAA,EAChB;AACJ;AAGA,eAAe,SAAS,OAAA,EAAkE;AACtF,EAAA,IAAI,OAAA,CAAQ,WAAA,EAAa,OAAO,OAAA,CAAQ,WAAA;AACxC,EAAA,IAAI,OAAA,CAAQ,UAAA,EAAY,OAAO,kBAAA,CAAmB,OAAO,CAAA;AACzD,EAAA,OAAO,IAAA;AACX;AAGA,eAAe,OAAA,CACX,SACA,OAAA,EACiE;AACjE,EAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,OAAO,CAAA;AACnC,EAAA,IAAI,CAAC,OAAA,EAAS;AACV,IAAA,OAAO,OAAA,CAAQ,QAAA,IAAY,IAAA,KAAS,IAAA,GAC9B,EAAE,MAAA,EAAQ,GAAA,EAAK,IAAA,EAAM,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,iBAAA,IAAoB,GAC9D,IAAA;AAAA,EACV;AACA,EAAA,IAAI,SAAS,MAAA,EAAW;AACpB,IAAA,OAAO,EAAE,QAAQ,GAAA,EAAK,IAAA,EAAM,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,yBAAA,EAA0B,EAAE;AAAA,EACjF;AACA,EAAA,IAAI,IAAA,IAAQ,CAAC,SAAA,CAAU,OAAA,EAAS,IAAI,CAAA,EAAG;AACnC,IAAA,MAAM,IAAA,GAAO,cAAc,OAAO,CAAA;AAClC,IAAA,OAAO;AAAA,MACH,MAAA,EAAQ,GAAA;AAAA,MACR,IAAA,EAAM;AAAA,QACF,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,eAAA;AAAA,QACR,IAAA;AAAA,QACA,IAAA,EAAM,OAAO,EAAE,UAAA,EAAY,KAAK,UAAA,EAAY,UAAA,EAAY,IAAA,CAAK,UAAA,EAAW,GAAI;AAAA;AAChF,KACJ;AAAA,EACJ;AACA,EAAA,OAAO,IAAA;AACX;AAqBO,SAAS,UAAA,CACZ,OAAA,EACA,OAAA,GAA6B,EAAC,EAC7B;AACD,EAAA,MAAM,OAAA,GAAU,OAAO,GAAA,EAAyB,GAAA,KAA6B;AACzE,IAAA,GAAA,CAAI,SAAA,CAAU,iBAAiB,mBAAmB,CAAA;AAClD,IAAA,GAAA,CAAI,SAAA,CAAU,QAAQ,uBAAuB,CAAA;AAC7C,IAAA,MAAM,UAAU,MAAM,YAAA;AAAA,MAClB;AAAA,QACI,MAAA,EAAQ,OAAO,GAAA,CAAI,OAAA,CAAQ,WAAW,QAAA,GAAW,GAAA,CAAI,QAAQ,MAAA,GAAS,IAAA;AAAA,QACtE,aAAA,EACI,OAAO,GAAA,CAAI,OAAA,CAAQ,kBAAkB,QAAA,GAC/B,GAAA,CAAI,QAAQ,aAAA,GACZ;AAAA,OACd;AAAA,MACA;AAAA,KACJ;AACA,IAAA,GAAA,CAAI,SAAA,GAAY,OAAA;AAChB,IAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,OAAA,EAAS,OAAO,CAAA;AAC9C,IAAA,IAAI,OAAA,SAAgB,GAAA,CAAI,MAAA,CAAO,QAAQ,MAAM,CAAA,CAAE,IAAA,CAAK,OAAA,CAAQ,IAAI,CAAA;AAChE,IAAA,OAAO,OAAA,CAAQ,KAAK,GAAG,CAAA;AAAA,EAC3B,CAAA;AACA,EAAA,OAAO,OAAA;AACX;AAkCO,SAAS,aAAA,CAAc,OAAA,GAA6B,EAAC,EAAG;AAC3D,EAAA,OAAO,OAAO,GAAA,EAAyB,GAAA,EAA0B,IAAA,KAA0B;AACvF,IAAA,IAAI;AACA,MAAA,GAAA,CAAI,SAAA,CAAU,iBAAiB,mBAAmB,CAAA;AAClD,MAAA,GAAA,CAAI,SAAA,CAAU,QAAQ,uBAAuB,CAAA;AAC7C,MAAA,MAAM,UAAU,MAAM,YAAA;AAAA,QAClB;AAAA,UACI,MAAA,EAAQ,OAAO,GAAA,CAAI,OAAA,CAAQ,WAAW,QAAA,GAAW,GAAA,CAAI,QAAQ,MAAA,GAAS,IAAA;AAAA,UACtE,aAAA,EACI,OAAO,GAAA,CAAI,OAAA,CAAQ,kBAAkB,QAAA,GAC/B,GAAA,CAAI,QAAQ,aAAA,GACZ;AAAA,SACd;AAAA,QACA;AAAA,OACJ;AACA,MAAA,GAAA,CAAI,SAAA,GAAY,OAAA;AAChB,MAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,OAAA,EAAS,OAAO,CAAA;AAC9C,MAAA,IAAI,OAAA,EAAS;AACT,QAAA,GAAA,CAAI,OAAO,OAAA,CAAQ,MAAM,CAAA,CAAE,IAAA,CAAK,QAAQ,IAAI,CAAA;AAC5C,QAAA;AAAA,MACJ;AACA,MAAA,IAAA,EAAK;AAAA,IACT,SAAS,GAAA,EAAK;AACV,MAAA,IAAA,CAAK,GAAG,CAAA;AAAA,IACZ;AAAA,EACJ,CAAA;AACJ;AA2BO,SAAS,UAAA,CAAW,OAAA,GAA6B,EAAC,EAAG;AACxD,EAAA,OAAO,OAAO,GAAoB,IAAA,KAAuB;AACrD,IAAA,CAAA,CAAE,MAAA,CAAO,iBAAiB,mBAAmB,CAAA;AAC7C,IAAA,CAAA,CAAE,MAAA,CAAO,QAAQ,uBAAuB,CAAA;AACxC,IAAA,MAAM,UAAU,MAAM,YAAA,CAAa,EAAE,GAAA,CAAI,GAAA,CAAI,SAAS,OAAO,CAAA;AAC7D,IAAA,CAAA,CAAE,GAAA,CAAI,aAAa,OAAO,CAAA;AAC1B,IAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,OAAA,EAAS,OAAO,CAAA;AAC9C,IAAA,IAAI,SAAS,OAAO,CAAA,CAAE,KAAK,OAAA,CAAQ,IAAA,EAAM,QAAQ,MAAM,CAAA;AACvD,IAAA,MAAM,IAAA,EAAK;AAAA,EACf,CAAA;AACJ","file":"server.mjs","sourcesContent":["export const encoder = new TextEncoder();\nexport const decoder = new TextDecoder();\nconst MAX_INT32 = 2 ** 32;\nexport function concat(...buffers) {\n const size = buffers.reduce((acc, { length }) => acc + length, 0);\n const buf = new Uint8Array(size);\n let i = 0;\n for (const buffer of buffers) {\n buf.set(buffer, i);\n i += buffer.length;\n }\n return buf;\n}\nfunction writeUInt32BE(buf, value, offset) {\n if (value < 0 || value >= MAX_INT32) {\n throw new RangeError(`value must be >= 0 and <= ${MAX_INT32 - 1}. Received ${value}`);\n }\n buf.set([value >>> 24, value >>> 16, value >>> 8, value & 0xff], offset);\n}\nexport function uint64be(value) {\n const high = Math.floor(value / MAX_INT32);\n const low = value % MAX_INT32;\n const buf = new Uint8Array(8);\n writeUInt32BE(buf, high, 0);\n writeUInt32BE(buf, low, 4);\n return buf;\n}\nexport function uint32be(value) {\n const buf = new Uint8Array(4);\n writeUInt32BE(buf, value);\n return buf;\n}\nexport function encode(string) {\n const bytes = new Uint8Array(string.length);\n for (let i = 0; i < string.length; i++) {\n const code = string.charCodeAt(i);\n if (code > 127) {\n throw new TypeError('non-ASCII string encountered in encode()');\n }\n bytes[i] = code;\n }\n return bytes;\n}\n","export function encodeBase64(input) {\n if (Uint8Array.prototype.toBase64) {\n return input.toBase64();\n }\n const CHUNK_SIZE = 0x8000;\n const arr = [];\n for (let i = 0; i < input.length; i += CHUNK_SIZE) {\n arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));\n }\n return btoa(arr.join(''));\n}\nexport function decodeBase64(encoded) {\n if (Uint8Array.fromBase64) {\n return Uint8Array.fromBase64(encoded);\n }\n const binary = atob(encoded);\n const bytes = new Uint8Array(binary.length);\n for (let i = 0; i < binary.length; i++) {\n bytes[i] = binary.charCodeAt(i);\n }\n return bytes;\n}\n","import { encoder, decoder } from '../lib/buffer_utils.js';\nimport { encodeBase64, decodeBase64 } from '../lib/base64.js';\nexport function decode(input) {\n if (Uint8Array.fromBase64) {\n return Uint8Array.fromBase64(typeof input === 'string' ? input : decoder.decode(input), {\n alphabet: 'base64url',\n });\n }\n let encoded = input;\n if (encoded instanceof Uint8Array) {\n encoded = decoder.decode(encoded);\n }\n encoded = encoded.replace(/-/g, '+').replace(/_/g, '/');\n try {\n return decodeBase64(encoded);\n }\n catch {\n throw new TypeError('The input to be decoded is not correctly encoded.');\n }\n}\nexport function encode(input) {\n let unencoded = input;\n if (typeof unencoded === 'string') {\n unencoded = encoder.encode(unencoded);\n }\n if (Uint8Array.prototype.toBase64) {\n return unencoded.toBase64({ alphabet: 'base64url', omitPadding: true });\n }\n return encodeBase64(unencoded).replace(/=/g, '').replace(/\\+/g, '-').replace(/\\//g, '_');\n}\n","export class JOSEError extends Error {\n static code = 'ERR_JOSE_GENERIC';\n code = 'ERR_JOSE_GENERIC';\n constructor(message, options) {\n super(message, options);\n this.name = this.constructor.name;\n Error.captureStackTrace?.(this, this.constructor);\n }\n}\nexport class JWTClaimValidationFailed extends JOSEError {\n static code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';\n code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';\n claim;\n reason;\n payload;\n constructor(message, payload, claim = 'unspecified', reason = 'unspecified') {\n super(message, { cause: { claim, reason, payload } });\n this.claim = claim;\n this.reason = reason;\n this.payload = payload;\n }\n}\nexport class JWTExpired extends JOSEError {\n static code = 'ERR_JWT_EXPIRED';\n code = 'ERR_JWT_EXPIRED';\n claim;\n reason;\n payload;\n constructor(message, payload, claim = 'unspecified', reason = 'unspecified') {\n super(message, { cause: { claim, reason, payload } });\n this.claim = claim;\n this.reason = reason;\n this.payload = payload;\n }\n}\nexport class JOSEAlgNotAllowed extends JOSEError {\n static code = 'ERR_JOSE_ALG_NOT_ALLOWED';\n code = 'ERR_JOSE_ALG_NOT_ALLOWED';\n}\nexport class JOSENotSupported extends JOSEError {\n static code = 'ERR_JOSE_NOT_SUPPORTED';\n code = 'ERR_JOSE_NOT_SUPPORTED';\n}\nexport class JWEDecryptionFailed extends JOSEError {\n static code = 'ERR_JWE_DECRYPTION_FAILED';\n code = 'ERR_JWE_DECRYPTION_FAILED';\n constructor(message = 'decryption operation failed', options) {\n super(message, options);\n }\n}\nexport class JWEInvalid extends JOSEError {\n static code = 'ERR_JWE_INVALID';\n code = 'ERR_JWE_INVALID';\n}\nexport class JWSInvalid extends JOSEError {\n static code = 'ERR_JWS_INVALID';\n code = 'ERR_JWS_INVALID';\n}\nexport class JWTInvalid extends JOSEError {\n static code = 'ERR_JWT_INVALID';\n code = 'ERR_JWT_INVALID';\n}\nexport class JWKInvalid extends JOSEError {\n static code = 'ERR_JWK_INVALID';\n code = 'ERR_JWK_INVALID';\n}\nexport class JWKSInvalid extends JOSEError {\n static code = 'ERR_JWKS_INVALID';\n code = 'ERR_JWKS_INVALID';\n}\nexport class JWKSNoMatchingKey extends JOSEError {\n static code = 'ERR_JWKS_NO_MATCHING_KEY';\n code = 'ERR_JWKS_NO_MATCHING_KEY';\n constructor(message = 'no applicable key found in the JSON Web Key Set', options) {\n super(message, options);\n }\n}\nexport class JWKSMultipleMatchingKeys extends JOSEError {\n [Symbol.asyncIterator];\n static code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';\n code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';\n constructor(message = 'multiple matching keys found in the JSON Web Key Set', options) {\n super(message, options);\n }\n}\nexport class JWKSTimeout extends JOSEError {\n static code = 'ERR_JWKS_TIMEOUT';\n code = 'ERR_JWKS_TIMEOUT';\n constructor(message = 'request timed out', options) {\n super(message, options);\n }\n}\nexport class JWSSignatureVerificationFailed extends JOSEError {\n static code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';\n code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';\n constructor(message = 'signature verification failed', options) {\n super(message, options);\n }\n}\n","const isObjectLike = (value) => typeof value === 'object' && value !== null;\nexport function isObject(input) {\n if (!isObjectLike(input) || Object.prototype.toString.call(input) !== '[object Object]') {\n return false;\n }\n if (Object.getPrototypeOf(input) === null) {\n return true;\n }\n let proto = input;\n while (Object.getPrototypeOf(proto) !== null) {\n proto = Object.getPrototypeOf(proto);\n }\n return Object.getPrototypeOf(input) === proto;\n}\nexport function isDisjoint(...headers) {\n const sources = headers.filter(Boolean);\n if (sources.length === 0 || sources.length === 1) {\n return true;\n }\n let acc;\n for (const header of sources) {\n const parameters = Object.keys(header);\n if (!acc || acc.size === 0) {\n acc = new Set(parameters);\n continue;\n }\n for (const parameter of parameters) {\n if (acc.has(parameter)) {\n return false;\n }\n acc.add(parameter);\n }\n }\n return true;\n}\nexport const isJWK = (key) => isObject(key) && typeof key.kty === 'string';\nexport const isPrivateJWK = (key) => key.kty !== 'oct' &&\n ((key.kty === 'AKP' && typeof key.priv === 'string') || typeof key.d === 'string');\nexport const isPublicJWK = (key) => key.kty !== 'oct' && key.d === undefined && key.priv === undefined;\nexport const isSecretJWK = (key) => key.kty === 'oct' && typeof key.k === 'string';\n","import { JOSENotSupported } from '../util/errors.js';\nconst unsupportedAlg = 'Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value';\nfunction subtleMapping(jwk) {\n let algorithm;\n let keyUsages;\n switch (jwk.kty) {\n case 'AKP': {\n switch (jwk.alg) {\n case 'ML-DSA-44':\n case 'ML-DSA-65':\n case 'ML-DSA-87':\n algorithm = { name: jwk.alg };\n keyUsages = jwk.priv ? ['sign'] : ['verify'];\n break;\n default:\n throw new JOSENotSupported(unsupportedAlg);\n }\n break;\n }\n case 'RSA': {\n switch (jwk.alg) {\n case 'PS256':\n case 'PS384':\n case 'PS512':\n algorithm = { name: 'RSA-PSS', hash: `SHA-${jwk.alg.slice(-3)}` };\n keyUsages = jwk.d ? ['sign'] : ['verify'];\n break;\n case 'RS256':\n case 'RS384':\n case 'RS512':\n algorithm = { name: 'RSASSA-PKCS1-v1_5', hash: `SHA-${jwk.alg.slice(-3)}` };\n keyUsages = jwk.d ? ['sign'] : ['verify'];\n break;\n case 'RSA-OAEP':\n case 'RSA-OAEP-256':\n case 'RSA-OAEP-384':\n case 'RSA-OAEP-512':\n algorithm = {\n name: 'RSA-OAEP',\n hash: `SHA-${parseInt(jwk.alg.slice(-3), 10) || 1}`,\n };\n keyUsages = jwk.d ? ['decrypt', 'unwrapKey'] : ['encrypt', 'wrapKey'];\n break;\n default:\n throw new JOSENotSupported(unsupportedAlg);\n }\n break;\n }\n case 'EC': {\n switch (jwk.alg) {\n case 'ES256':\n case 'ES384':\n case 'ES512':\n algorithm = {\n name: 'ECDSA',\n namedCurve: { ES256: 'P-256', ES384: 'P-384', ES512: 'P-521' }[jwk.alg],\n };\n keyUsages = jwk.d ? ['sign'] : ['verify'];\n break;\n case 'ECDH-ES':\n case 'ECDH-ES+A128KW':\n case 'ECDH-ES+A192KW':\n case 'ECDH-ES+A256KW':\n algorithm = { name: 'ECDH', namedCurve: jwk.crv };\n keyUsages = jwk.d ? ['deriveBits'] : [];\n break;\n default:\n throw new JOSENotSupported(unsupportedAlg);\n }\n break;\n }\n case 'OKP': {\n switch (jwk.alg) {\n case 'Ed25519':\n case 'EdDSA':\n algorithm = { name: 'Ed25519' };\n keyUsages = jwk.d ? ['sign'] : ['verify'];\n break;\n case 'ECDH-ES':\n case 'ECDH-ES+A128KW':\n case 'ECDH-ES+A192KW':\n case 'ECDH-ES+A256KW':\n algorithm = { name: jwk.crv };\n keyUsages = jwk.d ? ['deriveBits'] : [];\n break;\n default:\n throw new JOSENotSupported(unsupportedAlg);\n }\n break;\n }\n default:\n throw new JOSENotSupported('Invalid or unsupported JWK \"kty\" (Key Type) Parameter value');\n }\n return { algorithm, keyUsages };\n}\nexport async function jwkToKey(jwk) {\n if (!jwk.alg) {\n throw new TypeError('\"alg\" argument is required when \"jwk.alg\" is not present');\n }\n const { algorithm, keyUsages } = subtleMapping(jwk);\n const keyData = { ...jwk };\n if (keyData.kty !== 'AKP') {\n delete keyData.alg;\n }\n delete keyData.use;\n return crypto.subtle.importKey('jwk', keyData, algorithm, jwk.ext ?? (jwk.d || jwk.priv ? false : true), jwk.key_ops ?? keyUsages);\n}\n","import { decode as decodeBase64URL } from '../util/base64url.js';\nimport { fromSPKI, fromPKCS8, fromX509 } from '../lib/asn1.js';\nimport { jwkToKey } from '../lib/jwk_to_key.js';\nimport { JOSENotSupported } from '../util/errors.js';\nimport { isObject } from '../lib/type_checks.js';\nexport async function importSPKI(spki, alg, options) {\n if (typeof spki !== 'string' || spki.indexOf('-----BEGIN PUBLIC KEY-----') !== 0) {\n throw new TypeError('\"spki\" must be SPKI formatted string');\n }\n return fromSPKI(spki, alg, options);\n}\nexport async function importX509(x509, alg, options) {\n if (typeof x509 !== 'string' || x509.indexOf('-----BEGIN CERTIFICATE-----') !== 0) {\n throw new TypeError('\"x509\" must be X.509 formatted string');\n }\n return fromX509(x509, alg, options);\n}\nexport async function importPKCS8(pkcs8, alg, options) {\n if (typeof pkcs8 !== 'string' || pkcs8.indexOf('-----BEGIN PRIVATE KEY-----') !== 0) {\n throw new TypeError('\"pkcs8\" must be PKCS#8 formatted string');\n }\n return fromPKCS8(pkcs8, alg, options);\n}\nexport async function importJWK(jwk, alg, options) {\n if (!isObject(jwk)) {\n throw new TypeError('JWK must be an object');\n }\n let ext;\n alg ??= jwk.alg;\n ext ??= options?.extractable ?? jwk.ext;\n switch (jwk.kty) {\n case 'oct':\n if (typeof jwk.k !== 'string' || !jwk.k) {\n throw new TypeError('missing \"k\" (Key Value) Parameter value');\n }\n return decodeBase64URL(jwk.k);\n case 'RSA':\n if ('oth' in jwk && jwk.oth !== undefined) {\n throw new JOSENotSupported('RSA JWK \"oth\" (Other Primes Info) Parameter value is not supported');\n }\n return jwkToKey({ ...jwk, alg, ext });\n case 'AKP': {\n if (typeof jwk.alg !== 'string' || !jwk.alg) {\n throw new TypeError('missing \"alg\" (Algorithm) Parameter value');\n }\n if (alg !== undefined && alg !== jwk.alg) {\n throw new TypeError('JWK alg and alg option value mismatch');\n }\n return jwkToKey({ ...jwk, ext });\n }\n case 'EC':\n case 'OKP':\n return jwkToKey({ ...jwk, alg, ext });\n default:\n throw new JOSENotSupported('Unsupported \"kty\" (Key Type) Parameter value');\n }\n}\n","/**\n * `oc.identity.verifyActivityAttestation` — one-call ed25519 verifier\n * for a /api/me/activity-attestation bundle.\n *\n * Cashes the \"trivially to verify\" strategic claim: an integrator\n * receiving a signed attestation JSON from a user calls one function,\n * gets a typed result with per-check detail, never reaches into\n * @noble/curves or jose themselves.\n *\n * import { oc } from '@orangecheck/me-client';\n *\n * const result = await oc.identity.verifyActivityAttestation(bundle);\n * if (!result.ok) return res.status(401).send(result.reason);\n * // result.attestation is typed · safe to gate on lifetime_sats etc.\n *\n * The JWKS issuer is me.ochk.io (the envelope key), DISTINCT from\n * the auth host's ochk.io JWKS that signs webhooks. Same Ed25519\n * curve, same kid lookup pattern, fetched + cached separately.\n */\n\nimport { importJWK, type CryptoKey, type KeyObject } from 'jose';\n\nconst DEFAULT_ISSUER = 'https://me.ochk.io';\nconst DEFAULT_TTL_MS = 60 * 60 * 1000;\nconst ENVELOPE_JWKS_PATH = '/.well-known/oc-envelope-jwks.json';\n\nexport interface ActivityAttestation {\n id: string;\n v: 1;\n kind: 'oc-me-activity';\n did_oc: string;\n event_count: number;\n human_event_count: number;\n lifetime_sats: number;\n distinct_integrator_count: number;\n oldest_event_at: string | null;\n active_days: number;\n computed_at: string;\n expires_at: string;\n}\n\nexport interface ActivityAttestationBundle {\n attestation: ActivityAttestation;\n sig: string;\n kid: string;\n canonical_b64: string;\n}\n\nexport interface ActivityVerifyCheck {\n ok: boolean;\n label: string;\n detail?: string;\n}\n\nexport interface ActivityVerifyResult {\n ok: boolean;\n reason?: string;\n attestation?: ActivityAttestation;\n checks: ActivityVerifyCheck[];\n}\n\ninterface OcEnvelopePublicJwk {\n kty: 'OKP';\n crv: 'Ed25519';\n x: string;\n kid: string;\n alg?: 'EdDSA';\n use?: 'sig';\n}\n\nexport interface VerifyActivityOptions {\n /** Override the me.ochk.io issuer (defaults to https://me.ochk.io).\n * Useful for staging / self-hosted dev. */\n issuer?: string;\n /** Pass a JWK directly to skip the network fetch · convenient when\n * embedding the public key in your service for air-gapped or\n * edge-runtime deployments. */\n jwk?: OcEnvelopePublicJwk;\n /** JWKS cache TTL in ms. Defaults to 1h. Stale-on-error falls back\n * to the previous cached value. */\n jwksCacheTtlMs?: number;\n /** Optional · override \"now\" for deterministic tests. */\n now?: Date;\n}\n\ntype AuthKey = CryptoKey | KeyObject;\n\ninterface JwksCacheEntry {\n keys: Record<string, AuthKey>;\n fetchedAt: number;\n}\n\nconst jwksCache = new Map<string, JwksCacheEntry>();\nconst inflight = new Map<string, Promise<JwksCacheEntry>>();\n\nasync function fetchEnvelopeJwks(issuer: string, ttlMs: number): Promise<JwksCacheEntry> {\n const cached = jwksCache.get(issuer);\n if (cached && Date.now() - cached.fetchedAt < ttlMs) return cached;\n const existing = inflight.get(issuer);\n if (existing) return existing;\n const p = (async (): Promise<JwksCacheEntry> => {\n try {\n const url = `${issuer.replace(/\\/$/, '')}${ENVELOPE_JWKS_PATH}`;\n const res = await fetch(url, { headers: { Accept: 'application/json' } });\n if (!res.ok) throw new Error(`envelope JWKS fetch ${url} returned ${res.status}`);\n const json = (await res.json()) as { keys: OcEnvelopePublicJwk[] };\n if (!json || !Array.isArray(json.keys)) {\n throw new Error(`envelope JWKS at ${url} did not return {keys:[…]}`);\n }\n const keys: Record<string, AuthKey> = {};\n for (const k of json.keys) {\n if (typeof k.kid !== 'string') continue;\n try {\n keys[k.kid] = (await importJWK(k, 'EdDSA')) as AuthKey;\n } catch {\n /* skip keys that won't import */\n }\n }\n const entry: JwksCacheEntry = { keys, fetchedAt: Date.now() };\n jwksCache.set(issuer, entry);\n return entry;\n } catch (err) {\n const stale = jwksCache.get(issuer);\n if (stale) return stale;\n throw err;\n }\n })().finally(() => {\n inflight.delete(issuer);\n });\n inflight.set(issuer, p);\n return p;\n}\n\nfunction hexToBytes(hex: string): Uint8Array | null {\n if (typeof hex !== 'string') return null;\n const s = hex.trim();\n if (s.length === 0 || s.length % 2 !== 0) return null;\n const out = new Uint8Array(s.length / 2);\n for (let i = 0; i < out.length; i++) {\n const b = parseInt(s.slice(i * 2, i * 2 + 2), 16);\n if (Number.isNaN(b)) return null;\n out[i] = b;\n }\n return out;\n}\n\nfunction base64ToBytes(b64: string): Uint8Array | null {\n try {\n const bin =\n typeof atob === 'function'\n ? atob(b64)\n : Buffer.from(b64, 'base64').toString('binary');\n const out = new Uint8Array(bin.length);\n for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);\n return out;\n } catch {\n return null;\n }\n}\n\nfunction bytesToHex(bytes: Uint8Array): string {\n let out = '';\n for (const b of bytes) out += b.toString(16).padStart(2, '0');\n return out;\n}\n\nasync function sha256(bytes: Uint8Array): Promise<Uint8Array> {\n const subtle =\n typeof globalThis.crypto !== 'undefined' && globalThis.crypto.subtle\n ? globalThis.crypto.subtle\n : null;\n if (!subtle) {\n throw new Error('crypto.subtle unavailable · need Node 20+ / modern browser / Edge runtime');\n }\n const buf = await subtle.digest('SHA-256', bytes as unknown as ArrayBuffer);\n return new Uint8Array(buf);\n}\n\nfunction toArrayBuffer(view: Uint8Array): ArrayBuffer {\n const buf = new ArrayBuffer(view.byteLength);\n new Uint8Array(buf).set(view);\n return buf;\n}\n\nasync function verifyEd25519(\n key: AuthKey,\n sig: Uint8Array,\n msg: Uint8Array\n): Promise<boolean> {\n const subtle =\n typeof globalThis.crypto !== 'undefined' && globalThis.crypto.subtle\n ? globalThis.crypto.subtle\n : null;\n if (!subtle) return false;\n try {\n return await subtle.verify(\n 'Ed25519',\n key as CryptoKey,\n toArrayBuffer(sig),\n toArrayBuffer(msg)\n );\n } catch {\n return false;\n }\n}\n\n/**\n * Verify a signed activity attestation bundle. Returns a typed\n * ActivityVerifyResult with per-check detail · never throws (network\n * + parse failures surface as ok=false rows in the checks array, so\n * the caller can log them without try/catch).\n *\n * Five checks, in order: bundle shape, canonical-bytes hash matches\n * id, JWK with matching kid present, ed25519 signature, freshness.\n */\nexport async function verifyActivityAttestation(\n bundle: ActivityAttestationBundle,\n options: VerifyActivityOptions = {}\n): Promise<ActivityVerifyResult> {\n const checks: ActivityVerifyCheck[] = [];\n\n // 1. Bundle shape\n const shapeOk =\n !!bundle &&\n typeof bundle === 'object' &&\n typeof bundle.sig === 'string' &&\n typeof bundle.kid === 'string' &&\n typeof bundle.canonical_b64 === 'string' &&\n !!bundle.attestation &&\n typeof bundle.attestation.id === 'string' &&\n typeof bundle.attestation.expires_at === 'string';\n checks.push({\n ok: shapeOk,\n label: 'bundle shape · sig / kid / canonical_b64 / attestation',\n });\n if (!shapeOk) {\n return { ok: false, reason: 'bundle shape invalid', checks };\n }\n\n const a = bundle.attestation;\n\n // 2. canonical_b64 decodes\n const canonical = base64ToBytes(bundle.canonical_b64);\n checks.push({\n ok: canonical !== null,\n label: 'canonical_b64 decodes',\n detail: canonical ? `${canonical.length} bytes` : 'invalid base64',\n });\n if (!canonical) return { ok: false, reason: 'canonical_b64 invalid base64', checks, attestation: a };\n\n // 3. sha256 === id\n const digest = await sha256(canonical);\n const computedId = bytesToHex(digest);\n const idOk = computedId === a.id;\n checks.push({\n ok: idOk,\n label: 'sha256(canonical_bytes) === id',\n detail: idOk ? a.id : `expected ${a.id}, got ${computedId}`,\n });\n if (!idOk) return { ok: false, reason: 'id does not match canonical-bytes hash', checks, attestation: a };\n\n // 4. JWK lookup + ed25519 verify\n let key: AuthKey | null = null;\n if (options.jwk) {\n if (options.jwk.kid !== bundle.kid) {\n checks.push({\n ok: false,\n label: 'JWK with matching kid present',\n detail: `provided jwk.kid=${options.jwk.kid} but bundle.kid=${bundle.kid}`,\n });\n return { ok: false, reason: 'kid mismatch with provided jwk', checks, attestation: a };\n }\n try {\n key = (await importJWK(options.jwk, 'EdDSA')) as AuthKey;\n checks.push({ ok: true, label: 'JWK with matching kid present', detail: `kid ${bundle.kid} (provided)` });\n } catch (err) {\n checks.push({\n ok: false,\n label: 'JWK with matching kid present',\n detail: `provided jwk failed import: ${(err as Error).message}`,\n });\n return { ok: false, reason: 'provided jwk failed import', checks, attestation: a };\n }\n } else {\n const issuer = options.issuer ?? DEFAULT_ISSUER;\n const ttl = options.jwksCacheTtlMs ?? DEFAULT_TTL_MS;\n try {\n let entry = await fetchEnvelopeJwks(issuer, ttl);\n key = entry.keys[bundle.kid] ?? null;\n if (!key) {\n // Cache miss · likely a rotation. Force-refresh once.\n jwksCache.delete(issuer);\n entry = await fetchEnvelopeJwks(issuer, ttl);\n key = entry.keys[bundle.kid] ?? null;\n }\n checks.push({\n ok: !!key,\n label: 'JWK with matching kid present',\n detail: key ? `kid ${bundle.kid}` : `no JWK with kid ${bundle.kid} at ${issuer}${ENVELOPE_JWKS_PATH}`,\n });\n if (!key) {\n return { ok: false, reason: `kid ${bundle.kid} not in envelope JWKS`, checks, attestation: a };\n }\n } catch (err) {\n checks.push({\n ok: false,\n label: 'JWK with matching kid present',\n detail: `envelope JWKS unavailable: ${(err as Error).message}`,\n });\n return {\n ok: false,\n reason: `envelope JWKS unavailable: ${(err as Error).message}`,\n checks,\n attestation: a,\n };\n }\n }\n\n const sigBytes = hexToBytes(bundle.sig);\n if (!sigBytes) {\n checks.push({\n ok: false,\n label: 'ed25519.verify(sig, canonical_bytes, jwk.public)',\n detail: 'malformed sig (expected hex)',\n });\n return { ok: false, reason: 'malformed sig', checks, attestation: a };\n }\n const sigOk = await verifyEd25519(key, sigBytes, canonical);\n checks.push({\n ok: sigOk,\n label: 'ed25519.verify(sig, canonical_bytes, jwk.public)',\n detail: sigOk ? 'signature valid' : 'signature does not match',\n });\n if (!sigOk) return { ok: false, reason: 'signature does not match', checks, attestation: a };\n\n // 5. Freshness\n const now = options.now ?? new Date();\n const expiresMs = Date.parse(a.expires_at);\n const freshOk = Number.isFinite(expiresMs) && expiresMs > now.getTime();\n checks.push({\n ok: freshOk,\n label: 'now < attestation.expires_at',\n detail: freshOk\n ? `expires ${new Date(expiresMs).toISOString()}`\n : 'attestation has expired',\n });\n if (!freshOk) return { ok: false, reason: 'attestation has expired', checks, attestation: a };\n\n return { ok: true, attestation: a, checks };\n}\n\n/** Force-refresh the envelope-JWKS cache · useful after a key rotation\n * if you don't want to wait for the TTL to expire. */\nexport async function refreshEnvelopeJwks(issuer = DEFAULT_ISSUER): Promise<void> {\n jwksCache.delete(issuer);\n await fetchEnvelopeJwks(issuer, DEFAULT_TTL_MS);\n}\n\nexport const identity = {\n verifyActivityAttestation,\n refreshEnvelopeJwks,\n};\n","/**\n * @orangecheck/me-client/server\n *\n * Server-side verification helpers for OC integrators.\n *\n * import {\n * withOcAuth,\n * getOcSession,\n * verifyOcToken,\n * verifyActivityAttestation,\n * } from '@orangecheck/me-client/server';\n *\n * Zero env vars, zero JWK handling. Internally lazy-fetches the auth\n * host's JWKS at https://ochk.io/.well-known/jwks.json and the\n * envelope JWKS at https://me.ochk.io/.well-known/oc-envelope-jwks.json,\n * caches both in-process. Integrators write code; we handle the crypto.\n *\n * Three layers of session verification, smallest to thickest:\n *\n * verifyOcToken(token) → SessionPayload | null\n * getOcSession(headers) → SessionPayload | null (cookie OR Bearer)\n * withOcAuth(handler) → Next.js Pages adapter that injects\n * req.ocSession on the request object\n * ocAuthExpress(opts?) → Express / Connect middleware\n * ocAuthHono(opts?) → Hono middleware\n *\n * Plus the activity-attestation verifier · for sybil-resistance gating:\n *\n * verifyActivityAttestation(bundle, opts?) → ActivityVerifyResult\n *\n * Same envelope-JWKS verification posture as the public /verify-activity\n * page; same five checks (shape / id / kid / sig / freshness). Use to\n * gate sensitive flows on cross-integrator lifetime_sats + duration +\n * distinct_count + active_days · all values are content-addressed and\n * signed.\n *\n * All thin wrappers around the same crypto primitives. Bring your own\n * framework.\n */\n\nimport {\n bondMeets,\n getOcSession as getOcSessionCore,\n readBondClaim,\n verifyOcToken,\n type BondClaim,\n type SessionPayload,\n type VerifyOcOptions,\n type SessionRequestHeaders,\n} from '@orangecheck/auth-core';\n\nexport { bondMeets, readBondClaim, verifyOcToken };\nexport type { BondClaim, SessionPayload, VerifyOcOptions };\n\n// Activity-attestation verifier · re-export from the identity module so\n// server-side integrators get the gating helper alongside session\n// verification without a second import path.\nexport {\n identity,\n verifyActivityAttestation,\n refreshEnvelopeJwks,\n} from './identity';\nexport type {\n ActivityAttestation,\n ActivityAttestationBundle,\n ActivityVerifyCheck,\n ActivityVerifyResult,\n VerifyActivityOptions,\n} from './identity';\n\n/**\n * Verify the OC session for a request. Accepts either:\n *\n * - A Web Headers object (Hono / edge / Fetch API): `c.req.raw.headers`\n * - A plain `{ cookie, authorization }` object (Express / Next.js Pages /\n * Fastify / etc.): `{ cookie: req.headers.cookie, authorization: req.headers.authorization }`\n *\n * Reads the `oc_session` cookie first; falls back to\n * `Authorization: Bearer <token>` so cross-domain integrators (no\n * .ochk.io cookie reach) verify the same way.\n *\n * Returns `null` for unauthenticated requests. Never throws.\n */\nexport async function getOcSession(\n headers: SessionRequestHeaders | Headers,\n options: VerifyOcOptions = {}\n): Promise<SessionPayload | null> {\n const session = await getOcSessionCore(headers, options);\n if (!session && options.audience === undefined) warnIfAudienceMissing(headers);\n return session;\n}\n\nlet warnedAudience = false;\n\n/**\n * The popup issues a token bound to your site's origin. Verified with no\n * `audience`, it is refused — correctly, since a verifier with no audience\n * accepts only family sessions — and every popup sign-in would 401 with no\n * clue why. Say so, once, the first time it happens.\n */\nfunction warnIfAudienceMissing(headers: SessionRequestHeaders | Headers): void {\n if (warnedAudience) return;\n const auth =\n typeof Headers !== 'undefined' && headers instanceof Headers\n ? headers.get('authorization')\n : (headers as SessionRequestHeaders).authorization;\n const m = typeof auth === 'string' ? /^Bearer\\s+([^.]+)\\.([^.]+)\\./i.exec(auth) : null;\n if (!m) return;\n try {\n const payload = JSON.parse(base64UrlToString(m[2]!)) as { aud?: unknown };\n if (payload.aud === undefined) return;\n warnedAudience = true;\n console.warn(\n `[@orangecheck/me-client] a sign-in token bound to ${JSON.stringify(payload.aud)} was refused ` +\n 'because no `audience` is configured. Pass your site origin, e.g. ' +\n \"withOcAuth(handler, { audience: 'https://your-site.example' }).\"\n );\n } catch {\n // Not a JWT we can read · nothing useful to say.\n }\n}\n\nfunction base64UrlToString(s: string): string {\n const b64 = s.replace(/-/g, '+').replace(/_/g, '/');\n if (typeof atob === 'function') return atob(b64 + '='.repeat((4 - (b64.length % 4)) % 4));\n return Buffer.from(s, 'base64url').toString('utf8');\n}\n\n// ─── Next.js Pages Router adapter ────────────────────────────────────────\n\ninterface NextApiRequestLike {\n headers: { cookie?: string; authorization?: string; [k: string]: unknown };\n ocSession?: SessionPayload | null;\n}\ninterface NextApiResponseLike {\n status(code: number): NextApiResponseLike;\n json(body: unknown): unknown;\n setHeader(name: string, value: string | number | readonly string[]): unknown;\n}\ntype NextApiHandlerLike = (req: NextApiRequestLike, res: NextApiResponseLike) => unknown | Promise<unknown>;\n\nexport interface WithOcAuthOptions extends VerifyOcOptions {\n /** When true, unauthenticated requests get a 401 + `{ok:false}` response\n * before the wrapped handler runs. Default: false — handler runs and\n * receives `req.ocSession === null`, useful when the route serves both\n * signed-in and anonymous users. */\n required?: boolean;\n /**\n * Refuse a signed-in account (403, `reason: 'bond_required'`) unless a\n * bond backs it: one unspent coin of at least `minSats`, unspent at least\n * `minDays` days, checked within `maxAgeSecs`. The app never learns the\n * coin; `req.ocSession.oc_bond.nullifier` is the same for the same coin at\n * your site, so ban that to ban the coin. Implies `required`.\n */\n requireBond?: { minSats?: number; minDays?: number; maxAgeSecs?: number };\n /**\n * Your project key. The requirement you set in the project's settings\n * (\"who can sign in\") is read from me.ochk.io within a minute of a change\n * and enforced like `requireBond`, so you change it there, not in code.\n * An explicit `requireBond` wins over it.\n */\n projectKey?: string;\n /** Where the project config is read. Default https://me.ochk.io. */\n meOrigin?: string;\n}\n\ntype BondNeed = NonNullable<WithOcAuthOptions['requireBond']>;\nconst POLICY_TTL_MS = 60_000;\nconst policies = new Map<string, { at: number; need: BondNeed | null }>();\n\n/**\n * The project's requirement, from its uncached sign-in endpoint, held a\n * minute here. (The price config is edge-cached for ten minutes: reading the\n * requirement there let a just-tightened app keep admitting unbacked accounts.)\n * When it can't be read, the last one read stands; with none read yet it is\n * `undefined`, and the request is refused rather than let through unchecked.\n */\nasync function projectRequirement(options: WithOcAuthOptions): Promise<BondNeed | null | undefined> {\n const key = options.projectKey!;\n const hit = policies.get(key);\n if (hit && Date.now() - hit.at < POLICY_TTL_MS) return hit.need;\n try {\n const base = options.meOrigin ?? 'https://me.ochk.io';\n const r = await fetch(`${base}/api/integrator/${encodeURIComponent(key)}/sign-in`, {\n signal: AbortSignal.timeout(4000),\n });\n if (!r.ok) throw new Error(`HTTP ${r.status}`);\n const j = (await r.json()) as {\n require_bond?: { min_sats: number; min_days: number } | null;\n };\n const req = j.require_bond ?? null;\n const need = req ? { minSats: req.min_sats, minDays: req.min_days } : null;\n policies.set(key, { at: Date.now(), need });\n return need;\n } catch {\n return hit?.need;\n }\n}\n\n/** The requirement in force: explicit, else the project's, else none. */\nasync function bondNeed(options: WithOcAuthOptions): Promise<BondNeed | null | undefined> {\n if (options.requireBond) return options.requireBond;\n if (options.projectKey) return projectRequirement(options);\n return null;\n}\n\n/** Why a session can't pass, as a status and body, or null when it can. */\nasync function refusal(\n session: SessionPayload | null,\n options: WithOcAuthOptions\n): Promise<{ status: number; body: Record<string, unknown> } | null> {\n const need = await bondNeed(options);\n if (!session) {\n return options.required || need !== null\n ? { status: 401, body: { ok: false, reason: 'unauthenticated' } }\n : null;\n }\n if (need === undefined) {\n return { status: 503, body: { ok: false, reason: 'bond_policy_unavailable' } };\n }\n if (need && !bondMeets(session, need)) {\n const have = readBondClaim(session);\n return {\n status: 403,\n body: {\n ok: false,\n reason: 'bond_required',\n need,\n have: have ? { sats_floor: have.sats_floor, days_floor: have.days_floor } : null,\n },\n };\n }\n return null;\n}\n\n/**\n * Wrap a Next.js Pages-Router API route handler. Adds `req.ocSession` —\n * the verified SessionPayload, or null when unauthenticated.\n *\n * // pages/api/me/profile.ts\n * import { withOcAuth } from '@orangecheck/me-client/server';\n *\n * export default withOcAuth(async (req, res) => {\n * if (!req.ocSession) return res.status(401).json({ ok: false });\n * res.status(200).json({ account: { address: req.ocSession.did_oc } });\n * }, { required: true, audience: 'https://your-site.example' });\n *\n * `audience` is your own origin. The sign-in popup issues each site a token\n * bound to it; a site on *.ochk.io that reads the family cookie omits it.\n *\n * `Cache-Control: no-store, private` and `Vary: Cookie, Authorization`\n * are set on every authenticated response — without them a cached 401\n * leaks anonymous to authenticated callers.\n */\nexport function withOcAuth<T extends NextApiHandlerLike>(\n handler: T,\n options: WithOcAuthOptions = {}\n): T {\n const wrapped = async (req: NextApiRequestLike, res: NextApiResponseLike) => {\n res.setHeader('Cache-Control', 'no-store, private');\n res.setHeader('Vary', 'Cookie, Authorization');\n const session = await getOcSession(\n {\n cookie: typeof req.headers.cookie === 'string' ? req.headers.cookie : null,\n authorization:\n typeof req.headers.authorization === 'string'\n ? req.headers.authorization\n : null,\n },\n options\n );\n req.ocSession = session;\n const refused = await refusal(session, options);\n if (refused) return res.status(refused.status).json(refused.body);\n return handler(req, res);\n };\n return wrapped as unknown as T;\n}\n\n// ─── Express / Connect middleware ────────────────────────────────────────\n\ninterface ExpressRequestLike {\n headers: { cookie?: string; authorization?: string; [k: string]: unknown };\n ocSession?: SessionPayload | null;\n}\ninterface ExpressResponseLike {\n status(code: number): ExpressResponseLike;\n json(body: unknown): unknown;\n setHeader(name: string, value: string | number | readonly string[]): unknown;\n}\ntype ExpressNextLike = (err?: unknown) => void;\n\n/**\n * Express / Connect middleware. Attaches `req.ocSession` (verified\n * SessionPayload | null) and calls next(). Use it as a global middleware\n * or per-route.\n *\n * import express from 'express';\n * import { ocAuthExpress } from '@orangecheck/me-client/server';\n *\n * const app = express();\n * app.use(ocAuthExpress());\n *\n * app.get('/api/profile', (req, res) => {\n * if (!req.ocSession) return res.status(401).json({ error: 'sign in' });\n * res.json({ address: req.ocSession.did_oc });\n * });\n *\n * Pass `{ required: true }` to short-circuit unauthenticated requests\n * with a 401 before they reach your handler.\n */\nexport function ocAuthExpress(options: WithOcAuthOptions = {}) {\n return async (req: ExpressRequestLike, res: ExpressResponseLike, next: ExpressNextLike) => {\n try {\n res.setHeader('Cache-Control', 'no-store, private');\n res.setHeader('Vary', 'Cookie, Authorization');\n const session = await getOcSession(\n {\n cookie: typeof req.headers.cookie === 'string' ? req.headers.cookie : null,\n authorization:\n typeof req.headers.authorization === 'string'\n ? req.headers.authorization\n : null,\n },\n options\n );\n req.ocSession = session;\n const refused = await refusal(session, options);\n if (refused) {\n res.status(refused.status).json(refused.body);\n return;\n }\n next();\n } catch (err) {\n next(err);\n }\n };\n}\n\n// ─── Hono middleware ─────────────────────────────────────────────────────\n\ninterface HonoContextLike {\n req: { raw: { headers: Headers } };\n set(key: string, value: unknown): void;\n json(body: unknown, status?: number): unknown;\n header(name: string, value: string): void;\n}\ntype HonoNextLike = () => Promise<void>;\n\n/**\n * Hono middleware. Attaches the verified session at `c.get('ocSession')`.\n *\n * import { Hono } from 'hono';\n * import { ocAuthHono } from '@orangecheck/me-client/server';\n *\n * const app = new Hono();\n * app.use('*', ocAuthHono());\n *\n * app.get('/api/profile', (c) => {\n * const session = c.get('ocSession');\n * if (!session) return c.json({ error: 'sign in' }, 401);\n * return c.json({ address: session.did_oc });\n * });\n */\nexport function ocAuthHono(options: WithOcAuthOptions = {}) {\n return async (c: HonoContextLike, next: HonoNextLike) => {\n c.header('Cache-Control', 'no-store, private');\n c.header('Vary', 'Cookie, Authorization');\n const session = await getOcSession(c.req.raw.headers, options);\n c.set('ocSession', session);\n const refused = await refusal(session, options);\n if (refused) return c.json(refused.body, refused.status);\n await next();\n };\n}\n"]}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@orangecheck/me-client",
3
- "version": "0.27.2",
3
+ "version": "0.27.3",
4
4
  "description": "Drop-in client for me.ochk.io. Three entry points: React surface (OcSignInButton, useOcSession), server-side verification (withOcAuth for Next.js, ocAuthExpress, ocAuthHono — zero env vars, zero JWK handling), and a browser-only popup orchestrator (signInWithOc). Plus session lifecycle hooks, payment authorization, and the canonical billable-event taxonomy as types.",
5
5
  "keywords": [
6
6
  "orangecheck",