@orangecheck/me-client 0.32.3 → 0.33.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (18) hide show
  1. package/README.md +3 -3
  2. package/dist/{identity-6pjtyKYh.d.mts → identity-DfxCvxuH.d.mts} +1 -0
  3. package/dist/{identity-6pjtyKYh.d.ts → identity-DfxCvxuH.d.ts} +1 -0
  4. package/dist/index.d.mts +3 -2
  5. package/dist/index.d.ts +3 -2
  6. package/dist/index.js +272 -190
  7. package/dist/index.js.map +1 -1
  8. package/dist/index.mjs +272 -190
  9. package/dist/index.mjs.map +1 -1
  10. package/dist/integrator.js.map +1 -1
  11. package/dist/integrator.mjs.map +1 -1
  12. package/dist/server.d.mts +1 -1
  13. package/dist/server.d.ts +1 -1
  14. package/dist/server.js +251 -174
  15. package/dist/server.js.map +1 -1
  16. package/dist/server.mjs +251 -174
  17. package/dist/server.mjs.map +1 -1
  18. package/package.json +3 -3
package/dist/server.mjs.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"sources":["../node_modules/jose/dist/webapi/lib/buffer_utils.js","../node_modules/jose/dist/webapi/lib/base64.js","../node_modules/jose/dist/webapi/util/base64url.js","../node_modules/jose/dist/webapi/util/errors.js","../node_modules/jose/dist/webapi/lib/type_checks.js","../node_modules/jose/dist/webapi/lib/jwk_to_key.js","../node_modules/jose/dist/webapi/key/import.js","../src/identity.ts","../src/server.ts"],"names":["getOcSessionCore"],"mappings":";;;;;;;;AAAuB,IAAI,WAAA;AACpB,IAAM,OAAA,GAAU,IAAI,WAAA,EAAY;;;ACUhC,SAAS,aAAa,OAAA,EAAS;AAClC,EAAA,IAAI,WAAW,UAAA,EAAY;AACvB,IAAA,OAAO,UAAA,CAAW,WAAW,OAAO,CAAA;AAAA,EACxC;AACA,EAAA,MAAM,MAAA,GAAS,KAAK,OAAO,CAAA;AAC3B,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,MAAA,CAAO,MAAM,CAAA;AAC1C,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,QAAQ,CAAA,EAAA,EAAK;AACpC,IAAA,KAAA,CAAM,CAAC,CAAA,GAAI,MAAA,CAAO,UAAA,CAAW,CAAC,CAAA;AAAA,EAClC;AACA,EAAA,OAAO,KAAA;AACX;;;ACnBO,SAAS,OAAO,KAAA,EAAO;AAC1B,EAAA,IAAI,WAAW,UAAA,EAAY;AACvB,IAAA,OAAO,UAAA,CAAW,WAAW,OAAO,KAAA,KAAU,WAAW,KAAA,GAAQ,OAAA,CAAQ,MAAA,CAAO,KAAK,CAAA,EAAG;AAAA,MACpF,QAAA,EAAU;AAAA,KACb,CAAA;AAAA,EACL;AACA,EAAA,IAAI,OAAA,GAAU,KAAA;AACd,EAAA,IAAI,mBAAmB,UAAA,EAAY;AAC/B,IAAA,OAAA,GAAU,OAAA,CAAQ,OAAO,OAAO,CAAA;AAAA,EACpC;AACA,EAAA,OAAA,GAAU,QAAQ,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AACtD,EAAA,IAAI;AACA,IAAA,OAAO,aAAa,OAAO,CAAA;AAAA,EAC/B,CAAA,CAAA,MACM;AACF,IAAA,MAAM,IAAI,UAAU,mDAAmD,CAAA;AAAA,EAC3E;AACJ;;;ACnBO,IAAM,SAAA,GAAN,cAAwB,KAAA,CAAM;AAAA,EAGjC,WAAA,CAAY,SAAS,OAAA,EAAS;AAC1B,IAAA,KAAA,CAAM,SAAS,OAAO,CAAA;AAF1B,IAAA,aAAA,CAAA,IAAA,EAAA,MAAA,EAAO,kBAAA,CAAA;AAGH,IAAA,IAAA,CAAK,IAAA,GAAO,KAAK,WAAA,CAAY,IAAA;AAC7B,IAAA,KAAA,CAAM,iBAAA,GAAoB,IAAA,EAAM,IAAA,CAAK,WAAW,CAAA;AAAA,EACpD;AACJ,CAAA;AAPI,aAAA,CADS,WACF,MAAA,EAAO,kBAAA,CAAA;AAsCX,IAAM,gBAAA,GAAN,cAA+B,SAAA,CAAU;AAAA,EAAzC,WAAA,GAAA;AAAA,IAAA,KAAA,CAAA,GAAA,SAAA,CAAA;AAEH,IAAA,aAAA,CAAA,IAAA,EAAA,MAAA,EAAO,wBAAA,CAAA;AAAA,EAAA;AACX,CAAA;AAFI,aAAA,CADS,kBACF,MAAA,EAAO,wBAAA,CAAA;AAxClB,IAAA,EAAA,EAAA,EAAA;AA6EO,IAAM,wBAAA,GAAN,eAAuC,EAAA,GAAA,SAAA,EACzC,EAAA,GAAA,MAAA,CAAO,eADkC,EAAA,EAAU;AAAA,EAIpD,WAAA,CAAY,OAAA,GAAU,sDAAA,EAAwD,OAAA,EAAS;AACnF,IAAA,KAAA,CAAM,SAAS,OAAO,CAAA;AAJ1B,IAAA,aAAA,CAAA,IAAA,EAAC,EAAA,CAAA;AAED,IAAA,aAAA,CAAA,IAAA,EAAA,MAAA,EAAO,iCAAA,CAAA;AAAA,EAGP;AACJ,CAAA;AALI,aAAA,CAFS,0BAEF,MAAA,EAAO,iCAAA,CAAA;;;AC/ElB,IAAM,eAAe,CAAC,KAAA,KAAU,OAAO,KAAA,KAAU,YAAY,KAAA,KAAU,IAAA;AAChE,SAAS,SAAS,KAAA,EAAO;AAC5B,EAAA,IAAI,CAAC,YAAA,CAAa,KAAK,CAAA,IAAK,MAAA,CAAO,UAAU,QAAA,CAAS,IAAA,CAAK,KAAK,CAAA,KAAM,iBAAA,EAAmB;AACrF,IAAA,OAAO,KAAA;AAAA,EACX;AACA,EAAA,IAAI,MAAA,CAAO,cAAA,CAAe,KAAK,CAAA,KAAM,IAAA,EAAM;AACvC,IAAA,OAAO,IAAA;AAAA,EACX;AACA,EAAA,IAAI,KAAA,GAAQ,KAAA;AACZ,EAAA,OAAO,MAAA,CAAO,cAAA,CAAe,KAAK,CAAA,KAAM,IAAA,EAAM;AAC1C,IAAA,KAAA,GAAQ,MAAA,CAAO,eAAe,KAAK,CAAA;AAAA,EACvC;AACA,EAAA,OAAO,MAAA,CAAO,cAAA,CAAe,KAAK,CAAA,KAAM,KAAA;AAC5C;;;ACZA,IAAM,cAAA,GAAiB,8DAAA;AACvB,SAAS,cAAc,GAAA,EAAK;AACxB,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI,SAAA;AACJ,EAAA,QAAQ,IAAI,GAAA;AAAK,IACb,KAAK,KAAA,EAAO;AACR,MAAA,QAAQ,IAAI,GAAA;AAAK,QACb,KAAK,WAAA;AAAA,QACL,KAAK,WAAA;AAAA,QACL,KAAK,WAAA;AACD,UAAA,SAAA,GAAY,EAAE,IAAA,EAAM,GAAA,CAAI,GAAA,EAAI;AAC5B,UAAA,SAAA,GAAY,IAAI,IAAA,GAAO,CAAC,MAAM,CAAA,GAAI,CAAC,QAAQ,CAAA;AAC3C,UAAA;AAAA,QACJ;AACI,UAAA,MAAM,IAAI,iBAAiB,cAAc,CAAA;AAAA;AAEjD,MAAA;AAAA,IACJ;AAAA,IACA,KAAK,KAAA,EAAO;AACR,MAAA,QAAQ,IAAI,GAAA;AAAK,QACb,KAAK,OAAA;AAAA,QACL,KAAK,OAAA;AAAA,QACL,KAAK,OAAA;AACD,UAAA,SAAA,GAAY,EAAE,IAAA,EAAM,SAAA,EAAW,IAAA,EAAM,CAAA,IAAA,EAAO,IAAI,GAAA,CAAI,KAAA,CAAM,EAAE,CAAC,CAAA,CAAA,EAAG;AAChE,UAAA,SAAA,GAAY,IAAI,CAAA,GAAI,CAAC,MAAM,CAAA,GAAI,CAAC,QAAQ,CAAA;AACxC,UAAA;AAAA,QACJ,KAAK,OAAA;AAAA,QACL,KAAK,OAAA;AAAA,QACL,KAAK,OAAA;AACD,UAAA,SAAA,GAAY,EAAE,IAAA,EAAM,mBAAA,EAAqB,IAAA,EAAM,CAAA,IAAA,EAAO,IAAI,GAAA,CAAI,KAAA,CAAM,EAAE,CAAC,CAAA,CAAA,EAAG;AAC1E,UAAA,SAAA,GAAY,IAAI,CAAA,GAAI,CAAC,MAAM,CAAA,GAAI,CAAC,QAAQ,CAAA;AACxC,UAAA;AAAA,QACJ,KAAK,UAAA;AAAA,QACL,KAAK,cAAA;AAAA,QACL,KAAK,cAAA;AAAA,QACL,KAAK,cAAA;AACD,UAAA,SAAA,GAAY;AAAA,YACR,IAAA,EAAM,UAAA;AAAA,YACN,IAAA,EAAM,CAAA,IAAA,EAAO,QAAA,CAAS,GAAA,CAAI,GAAA,CAAI,MAAM,EAAE,CAAA,EAAG,EAAE,CAAA,IAAK,CAAC,CAAA;AAAA,WACrD;AACA,UAAA,SAAA,GAAY,GAAA,CAAI,IAAI,CAAC,SAAA,EAAW,WAAW,CAAA,GAAI,CAAC,WAAW,SAAS,CAAA;AACpE,UAAA;AAAA,QACJ;AACI,UAAA,MAAM,IAAI,iBAAiB,cAAc,CAAA;AAAA;AAEjD,MAAA;AAAA,IACJ;AAAA,IACA,KAAK,IAAA,EAAM;AACP,MAAA,QAAQ,IAAI,GAAA;AAAK,QACb,KAAK,OAAA;AAAA,QACL,KAAK,OAAA;AAAA,QACL,KAAK,OAAA;AACD,UAAA,SAAA,GAAY;AAAA,YACR,IAAA,EAAM,OAAA;AAAA,YACN,UAAA,EAAY,EAAE,KAAA,EAAO,OAAA,EAAS,KAAA,EAAO,SAAS,KAAA,EAAO,OAAA,EAAQ,CAAE,GAAA,CAAI,GAAG;AAAA,WAC1E;AACA,UAAA,SAAA,GAAY,IAAI,CAAA,GAAI,CAAC,MAAM,CAAA,GAAI,CAAC,QAAQ,CAAA;AACxC,UAAA;AAAA,QACJ,KAAK,SAAA;AAAA,QACL,KAAK,gBAAA;AAAA,QACL,KAAK,gBAAA;AAAA,QACL,KAAK,gBAAA;AACD,UAAA,SAAA,GAAY,EAAE,IAAA,EAAM,MAAA,EAAQ,UAAA,EAAY,IAAI,GAAA,EAAI;AAChD,UAAA,SAAA,GAAY,GAAA,CAAI,CAAA,GAAI,CAAC,YAAY,IAAI,EAAC;AACtC,UAAA;AAAA,QACJ;AACI,UAAA,MAAM,IAAI,iBAAiB,cAAc,CAAA;AAAA;AAEjD,MAAA;AAAA,IACJ;AAAA,IACA,KAAK,KAAA,EAAO;AACR,MAAA,QAAQ,IAAI,GAAA;AAAK,QACb,KAAK,SAAA;AAAA,QACL,KAAK,OAAA;AACD,UAAA,SAAA,GAAY,EAAE,MAAM,SAAA,EAAU;AAC9B,UAAA,SAAA,GAAY,IAAI,CAAA,GAAI,CAAC,MAAM,CAAA,GAAI,CAAC,QAAQ,CAAA;AACxC,UAAA;AAAA,QACJ,KAAK,SAAA;AAAA,QACL,KAAK,gBAAA;AAAA,QACL,KAAK,gBAAA;AAAA,QACL,KAAK,gBAAA;AACD,UAAA,SAAA,GAAY,EAAE,IAAA,EAAM,GAAA,CAAI,GAAA,EAAI;AAC5B,UAAA,SAAA,GAAY,GAAA,CAAI,CAAA,GAAI,CAAC,YAAY,IAAI,EAAC;AACtC,UAAA;AAAA,QACJ;AACI,UAAA,MAAM,IAAI,iBAAiB,cAAc,CAAA;AAAA;AAEjD,MAAA;AAAA,IACJ;AAAA,IACA;AACI,MAAA,MAAM,IAAI,iBAAiB,6DAA6D,CAAA;AAAA;AAEhG,EAAA,OAAO,EAAE,WAAW,SAAA,EAAU;AAClC;AACA,eAAsB,SAAS,GAAA,EAAK;AAChC,EAAA,IAAI,CAAC,IAAI,GAAA,EAAK;AACV,IAAA,MAAM,IAAI,UAAU,0DAA0D,CAAA;AAAA,EAClF;AACA,EAAA,MAAM,EAAE,SAAA,EAAW,SAAA,EAAU,GAAI,cAAc,GAAG,CAAA;AAClD,EAAA,MAAM,OAAA,GAAU,EAAE,GAAG,GAAA,EAAI;AACzB,EAAA,IAAI,OAAA,CAAQ,QAAQ,KAAA,EAAO;AACvB,IAAA,OAAO,OAAA,CAAQ,GAAA;AAAA,EACnB;AACA,EAAA,OAAO,OAAA,CAAQ,GAAA;AACf,EAAA,OAAO,OAAO,MAAA,CAAO,SAAA,CAAU,KAAA,EAAO,OAAA,EAAS,WAAW,GAAA,CAAI,GAAA,KAAQ,GAAA,CAAI,CAAA,IAAK,IAAI,IAAA,GAAO,KAAA,GAAQ,IAAA,CAAA,EAAO,GAAA,CAAI,WAAW,SAAS,CAAA;AACrI;;;ACnFA,eAAsB,SAAA,CAAU,GAAA,EAAK,GAAA,EAAK,OAAA,EAAS;AAC/C,EAAA,IAAI,CAAC,QAAA,CAAS,GAAG,CAAA,EAAG;AAChB,IAAA,MAAM,IAAI,UAAU,uBAAuB,CAAA;AAAA,EAC/C;AACA,EAAA,IAAI,GAAA;AAEJ,EAAA,GAAA,KAAA,GAAA,GAAgC,GAAA,CAAI,GAAA,CAAA;AACpC,EAAA,QAAQ,IAAI,GAAA;AAAK,IACb,KAAK,KAAA;AACD,MAAA,IAAI,OAAO,GAAA,CAAI,CAAA,KAAM,QAAA,IAAY,CAAC,IAAI,CAAA,EAAG;AACrC,QAAA,MAAM,IAAI,UAAU,yCAAyC,CAAA;AAAA,MACjE;AACA,MAAA,OAAO,MAAA,CAAgB,IAAI,CAAC,CAAA;AAAA,IAChC,KAAK,KAAA;AACD,MAAA,IAAI,KAAA,IAAS,GAAA,IAAO,GAAA,CAAI,GAAA,KAAQ,MAAA,EAAW;AACvC,QAAA,MAAM,IAAI,iBAAiB,oEAAoE,CAAA;AAAA,MACnG;AACA,MAAA,OAAO,SAAS,EAAE,GAAG,GAAA,EAAK,GAAA,EAAK,KAAK,CAAA;AAAA,IACxC,KAAK,KAAA,EAAO;AACR,MAAA,IAAI,OAAO,GAAA,CAAI,GAAA,KAAQ,QAAA,IAAY,CAAC,IAAI,GAAA,EAAK;AACzC,QAAA,MAAM,IAAI,UAAU,2CAA2C,CAAA;AAAA,MACnE;AACA,MAAA,IAAyB,GAAA,KAAQ,GAAA,CAAI,GAAA,EAAK;AACtC,QAAA,MAAM,IAAI,UAAU,uCAAuC,CAAA;AAAA,MAC/D;AACA,MAAA,OAAO,QAAA,CAAS,EAAE,GAAG,GAAA,EAAK,KAAK,CAAA;AAAA,IACnC;AAAA,IACA,KAAK,IAAA;AAAA,IACL,KAAK,KAAA;AACD,MAAA,OAAO,SAAS,EAAE,GAAG,GAAA,EAAK,GAAA,EAAK,KAAK,CAAA;AAAA,IACxC;AACI,MAAA,MAAM,IAAI,iBAAiB,8CAA8C,CAAA;AAAA;AAErF;;;AClCA,IAAM,cAAA,GAAiB,oBAAA;AACvB,IAAM,cAAA,GAAiB,KAAK,EAAA,GAAK,GAAA;AACjC,IAAM,kBAAA,GAAqB,oCAAA;AAsE3B,IAAM,SAAA,uBAAgB,GAAA,EAA4B;AAClD,IAAM,QAAA,uBAAe,GAAA,EAAqC;AAE1D,eAAe,iBAAA,CAAkB,QAAgB,KAAA,EAAwC;AACrF,EAAA,MAAM,MAAA,GAAS,SAAA,CAAU,GAAA,CAAI,MAAM,CAAA;AACnC,EAAA,IAAI,UAAU,IAAA,CAAK,GAAA,KAAQ,MAAA,CAAO,SAAA,GAAY,OAAO,OAAO,MAAA;AAC5D,EAAA,MAAM,QAAA,GAAW,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA;AACpC,EAAA,IAAI,UAAU,OAAO,QAAA;AACrB,EAAA,MAAM,KAAK,YAAqC;AAC5C,IAAA,IAAI;AACA,MAAA,MAAM,GAAA,GAAM,GAAG,MAAA,CAAO,OAAA,CAAQ,OAAO,EAAE,CAAC,GAAG,kBAAkB,CAAA,CAAA;AAC7D,MAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,SAAS,EAAE,MAAA,EAAQ,kBAAA,EAAmB,EAAG,CAAA;AACxE,MAAA,IAAI,CAAC,GAAA,CAAI,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,GAAG,CAAA,UAAA,EAAa,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAChF,MAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAC7B,MAAA,IAAI,CAAC,IAAA,IAAQ,CAAC,MAAM,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAA,EAAG;AACpC,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,iBAAA,EAAoB,GAAG,CAAA,+BAAA,CAA4B,CAAA;AAAA,MACvE;AACA,MAAA,MAAM,OAAgC,EAAC;AACvC,MAAA,KAAA,MAAW,CAAA,IAAK,KAAK,IAAA,EAAM;AACvB,QAAA,IAAI,OAAO,CAAA,CAAE,GAAA,KAAQ,QAAA,EAAU;AAC/B,QAAA,IAAI;AACA,UAAA,IAAA,CAAK,EAAE,GAAG,CAAA,GAAK,MAAM,SAAA,CAAU,GAAG,OAAO,CAAA;AAAA,QAC7C,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACJ;AACA,MAAA,MAAM,QAAwB,EAAE,IAAA,EAAM,SAAA,EAAW,IAAA,CAAK,KAAI,EAAE;AAC5D,MAAA,SAAA,CAAU,GAAA,CAAI,QAAQ,KAAK,CAAA;AAC3B,MAAA,OAAO,KAAA;AAAA,IACX,SAAS,GAAA,EAAK;AACV,MAAA,MAAM,KAAA,GAAQ,SAAA,CAAU,GAAA,CAAI,MAAM,CAAA;AAClC,MAAA,IAAI,OAAO,OAAO,KAAA;AAClB,MAAA,MAAM,GAAA;AAAA,IACV;AAAA,EACJ,CAAA,GAAG,CAAE,OAAA,CAAQ,MAAM;AACf,IAAA,QAAA,CAAS,OAAO,MAAM,CAAA;AAAA,EAC1B,CAAC,CAAA;AACD,EAAA,QAAA,CAAS,GAAA,CAAI,QAAQ,CAAC,CAAA;AACtB,EAAA,OAAO,CAAA;AACX;AAEA,SAAS,WAAW,GAAA,EAAgC;AAChD,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,OAAO,IAAA;AACpC,EAAA,MAAM,CAAA,GAAI,IAAI,IAAA,EAAK;AACnB,EAAA,IAAI,EAAE,MAAA,KAAW,CAAA,IAAK,EAAE,MAAA,GAAS,CAAA,KAAM,GAAG,OAAO,IAAA;AACjD,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,CAAA,CAAE,SAAS,CAAC,CAAA;AACvC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,GAAA,CAAI,QAAQ,CAAA,EAAA,EAAK;AACjC,IAAA,MAAM,CAAA,GAAI,QAAA,CAAS,CAAA,CAAE,KAAA,CAAM,CAAA,GAAI,GAAG,CAAA,GAAI,CAAA,GAAI,CAAC,CAAA,EAAG,EAAE,CAAA;AAChD,IAAA,IAAI,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA,EAAG,OAAO,IAAA;AAC5B,IAAA,GAAA,CAAI,CAAC,CAAA,GAAI,CAAA;AAAA,EACb;AACA,EAAA,OAAO,GAAA;AACX;AAEA,SAAS,cAAc,GAAA,EAAgC;AACnD,EAAA,IAAI;AACA,IAAA,MAAM,GAAA,GACF,OAAO,IAAA,KAAS,UAAA,GACV,IAAA,CAAK,GAAG,CAAA,GACR,MAAA,CAAO,IAAA,CAAK,GAAA,EAAK,QAAQ,CAAA,CAAE,SAAS,QAAQ,CAAA;AACtD,IAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA;AACrC,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,GAAA,CAAI,MAAA,EAAQ,CAAA,EAAA,EAAK,GAAA,CAAI,CAAC,CAAA,GAAI,GAAA,CAAI,UAAA,CAAW,CAAC,CAAA;AAC9D,IAAA,OAAO,GAAA;AAAA,EACX,CAAA,CAAA,MAAQ;AACJ,IAAA,OAAO,IAAA;AAAA,EACX;AACJ;AAEA,SAAS,WAAW,KAAA,EAA2B;AAC3C,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,MAAW,CAAA,IAAK,OAAO,GAAA,IAAO,CAAA,CAAE,SAAS,EAAE,CAAA,CAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAA;AAC5D,EAAA,OAAO,GAAA;AACX;AAEA,eAAe,OAAO,KAAA,EAAwC;AAC1D,EAAA,MAAM,MAAA,GACF,OAAO,UAAA,CAAW,MAAA,KAAW,WAAA,IAAe,WAAW,MAAA,CAAO,MAAA,GACxD,UAAA,CAAW,MAAA,CAAO,MAAA,GAClB,IAAA;AACV,EAAA,IAAI,CAAC,MAAA,EAAQ;AACT,IAAA,MAAM,IAAI,MAAM,8EAA2E,CAAA;AAAA,EAC/F;AACA,EAAA,MAAM,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,WAAW,KAA+B,CAAA;AAC1E,EAAA,OAAO,IAAI,WAAW,GAAG,CAAA;AAC7B;AAEA,SAAS,cAAc,IAAA,EAA+B;AAClD,EAAA,MAAM,GAAA,GAAM,IAAI,WAAA,CAAY,IAAA,CAAK,UAAU,CAAA;AAC3C,EAAA,IAAI,UAAA,CAAW,GAAG,CAAA,CAAE,GAAA,CAAI,IAAI,CAAA;AAC5B,EAAA,OAAO,GAAA;AACX;AAEA,eAAe,aAAA,CACX,GAAA,EACA,GAAA,EACA,GAAA,EACgB;AAChB,EAAA,MAAM,MAAA,GACF,OAAO,UAAA,CAAW,MAAA,KAAW,WAAA,IAAe,WAAW,MAAA,CAAO,MAAA,GACxD,UAAA,CAAW,MAAA,CAAO,MAAA,GAClB,IAAA;AACV,EAAA,IAAI,CAAC,QAAQ,OAAO,KAAA;AACpB,EAAA,IAAI;AACA,IAAA,OAAO,MAAM,MAAA,CAAO,MAAA;AAAA,MAChB,SAAA;AAAA,MACA,GAAA;AAAA,MACA,cAAc,GAAG,CAAA;AAAA,MACjB,cAAc,GAAG;AAAA,KACrB;AAAA,EACJ,CAAA,CAAA,MAAQ;AACJ,IAAA,OAAO,KAAA;AAAA,EACX;AACJ;AAGA,IAAM,aAAA,GAAgB;AAAA,EAClB,GAAA;AAAA,EACA,MAAA;AAAA,EACA,QAAA;AAAA,EACA,aAAA;AAAA,EACA,mBAAA;AAAA,EACA,eAAA;AAAA,EACA,2BAAA;AAAA,EACA,iBAAA;AAAA,EACA,aAAA;AAAA,EACA,aAAA;AAAA,EACA;AACJ,CAAA;AACA,IAAM,MAAA,GAAS;AAAA,EACX,aAAA;AAAA,EACA,mBAAA;AAAA,EACA,eAAA;AAAA,EACA,2BAAA;AAAA,EACA;AACJ,CAAA;AAIA,SAAS,qBAAA,CAAsB,WAAuB,EAAA,EAAwC;AAC1F,EAAA,MAAM,IAAA,GAAO,IAAI,WAAA,EAAY,CAAE,OAAO,SAAS,CAAA;AAC/C,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACA,IAAA,MAAA,GAAS,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EAC5B,CAAA,CAAA,MAAQ;AACJ,IAAA,OAAO,IAAA;AAAA,EACX;AACA,EAAA,IAAI,CAAC,UAAU,OAAO,MAAA,KAAW,YAAY,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG,OAAO,IAAA;AAC3E,EAAA,MAAM,CAAA,GAAI,MAAA;AACV,EAAA,IAAI,CAAA,CAAE,CAAA,KAAM,CAAA,IAAK,CAAA,CAAE,IAAA,KAAS,oBAAoB,OAAO,CAAA,CAAE,MAAA,KAAW,QAAA,EAAU,OAAO,IAAA;AACrF,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA,KAAM;AACjC,IAAA,MAAM,CAAA,GAAI,EAAE,CAAC,CAAA;AACb,IAAA,OAAO,OAAO,CAAA,KAAM,QAAA,IAAY,OAAO,aAAA,CAAc,CAAC,KAAK,CAAA,IAAK,CAAA;AAAA,EACpE,CAAC,CAAA;AACD,EAAA,IAAI,CAAC,UAAU,OAAO,IAAA;AACtB,EAAA,IAAI,EAAE,eAAA,KAAoB,IAAA,IAAQ,OAAO,CAAA,CAAE,eAAA,KAAoB,UAAU,OAAO,IAAA;AAChF,EAAA,IAAI,OAAO,EAAE,WAAA,KAAgB,QAAA,IAAY,OAAO,CAAA,CAAE,UAAA,KAAe,UAAU,OAAO,IAAA;AAClF,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,WAAA,CAAY,aAAA,CAAc,GAAA,CAAI,CAAC,CAAA,KAAM,CAAC,CAAA,EAAG,CAAA,CAAE,CAAC,CAAC,CAAC,CAAC,CAAA;AAEtE,EAAA,IAAI,IAAA,CAAK,SAAA,CAAU,OAAO,CAAA,KAAM,MAAM,OAAO,IAAA;AAC7C,EAAA,OAAO,EAAE,EAAA,EAAI,GAAI,OAAA,EAA4C;AACjE;AAGA,SAAS,eAAA,CAAgB,MAA2B,MAAA,EAAsC;AACtF,EAAA,MAAM,CAAA,GAAI,IAAA;AACV,EAAA,MAAM,CAAA,GAAI,MAAA;AACV,EAAA,OAAQ,CAAC,IAAA,EAAM,GAAG,aAAa,CAAA,CAAY,KAAA,CAAM,CAAC,CAAA,KAAM,CAAA,CAAE,CAAC,CAAA,KAAM,CAAA,CAAE,CAAC,CAAC,CAAA;AACzE;AAcA,eAAsB,yBAAA,CAClB,MAAA,EACA,OAAA,GAAiC,EAAC,EACL;AAC7B,EAAA,MAAM,SAAgC,EAAC;AAGvC,EAAA,MAAM,OAAA,GACF,CAAC,CAAC,MAAA,IACF,OAAO,MAAA,KAAW,QAAA,IAClB,OAAO,MAAA,CAAO,GAAA,KAAQ,QAAA,IACtB,OAAO,MAAA,CAAO,GAAA,KAAQ,QAAA,IACtB,OAAO,MAAA,CAAO,aAAA,KAAkB,QAAA,KAC/B,MAAA,CAAO,WAAA,KAAgB,MAAA,IACnB,CAAC,CAAC,MAAA,CAAO,WAAA,IAAe,OAAO,MAAA,CAAO,WAAA,KAAgB,QAAA,CAAA;AAC/D,EAAA,MAAA,CAAO,IAAA,CAAK;AAAA,IACR,EAAA,EAAI,OAAA;AAAA,IACJ,KAAA,EAAO;AAAA,GACV,CAAA;AACD,EAAA,IAAI,CAAC,OAAA,EAAS;AACV,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,wBAAwB,MAAA,EAAO;AAAA,EAC/D;AAGA,EAAA,MAAM,SAAA,GAAY,aAAA,CAAc,MAAA,CAAO,aAAa,CAAA;AACpD,EAAA,MAAA,CAAO,IAAA,CAAK;AAAA,IACR,IAAI,SAAA,KAAc,IAAA;AAAA,IAClB,KAAA,EAAO,uBAAA;AAAA,IACP,MAAA,EAAQ,SAAA,GAAY,CAAA,EAAG,SAAA,CAAU,MAAM,CAAA,MAAA,CAAA,GAAW;AAAA,GACrD,CAAA;AACD,EAAA,IAAI,CAAC,WAAW,OAAO,EAAE,IAAI,KAAA,EAAO,MAAA,EAAQ,gCAAgC,MAAA,EAAO;AAGnF,EAAA,MAAM,UAAA,GAAa,UAAA,CAAW,MAAM,MAAA,CAAO,SAAS,CAAC,CAAA;AACrD,EAAA,MAAM,MAAA,GAAS,qBAAA,CAAsB,SAAA,EAAW,UAAU,CAAA;AAC1D,EAAA,MAAA,CAAO,IAAA,CAAK;AAAA,IACR,IAAI,MAAA,KAAW,IAAA;AAAA,IACf,KAAA,EAAO;AAAA,GACV,CAAA;AACD,EAAA,IAAI,CAAC,QAAQ,OAAO,EAAE,IAAI,KAAA,EAAO,MAAA,EAAQ,mDAAmD,MAAA,EAAO;AAEnG,EAAA,MAAM,OAAO,MAAA,CAAO,WAAA;AACpB,EAAA,MAAM,MAAA,GAAS,IAAA,KAAS,MAAA,IAAa,eAAA,CAAgB,MAAM,MAAM,CAAA;AACjE,EAAA,MAAA,CAAO,IAAA,CAAK;AAAA,IACR,EAAA,EAAI,MAAA;AAAA,IACJ,KAAA,EAAO,gEAAA;AAAA,IACP,MAAA,EAAQ,SAAS,UAAA,GAAa;AAAA,GACjC,CAAA;AACD,EAAA,IAAI,CAAC,QAAQ,OAAO,EAAE,IAAI,KAAA,EAAO,MAAA,EAAQ,+CAA+C,MAAA,EAAO;AAG/F,EAAA,IAAI,GAAA,GAAsB,IAAA;AAC1B,EAAA,IAAI,QAAQ,GAAA,EAAK;AACb,IAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,GAAA,KAAQ,MAAA,CAAO,GAAA,EAAK;AAChC,MAAA,MAAA,CAAO,IAAA,CAAK;AAAA,QACR,EAAA,EAAI,KAAA;AAAA,QACJ,KAAA,EAAO,+BAAA;AAAA,QACP,QAAQ,CAAA,iBAAA,EAAoB,OAAA,CAAQ,IAAI,GAAG,CAAA,gBAAA,EAAmB,OAAO,GAAG,CAAA;AAAA,OAC3E,CAAA;AACD,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,kCAAkC,MAAA,EAAO;AAAA,IACzE;AACA,IAAA,IAAI;AACA,MAAA,GAAA,GAAO,MAAM,SAAA,CAAU,OAAA,CAAQ,GAAA,EAAK,OAAO,CAAA;AAC3C,MAAA,MAAA,CAAO,IAAA,CAAK,EAAE,EAAA,EAAI,IAAA,EAAM,KAAA,EAAO,+BAAA,EAAiC,MAAA,EAAQ,CAAA,IAAA,EAAO,MAAA,CAAO,GAAG,CAAA,WAAA,CAAA,EAAe,CAAA;AAAA,IAC5G,SAAS,GAAA,EAAK;AACV,MAAA,MAAA,CAAO,IAAA,CAAK;AAAA,QACR,EAAA,EAAI,KAAA;AAAA,QACJ,KAAA,EAAO,+BAAA;AAAA,QACP,MAAA,EAAQ,CAAA,4BAAA,EAAgC,GAAA,CAAc,OAAO,CAAA;AAAA,OAChE,CAAA;AACD,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,8BAA8B,MAAA,EAAO;AAAA,IACrE;AAAA,EACJ,CAAA,MAAO;AACH,IAAA,MAAM,MAAA,GAAS,QAAQ,MAAA,IAAU,cAAA;AACjC,IAAA,MAAM,GAAA,GAAM,QAAQ,cAAA,IAAkB,cAAA;AACtC,IAAA,IAAI;AACA,MAAA,IAAI,KAAA,GAAQ,MAAM,iBAAA,CAAkB,MAAA,EAAQ,GAAG,CAAA;AAC/C,MAAA,GAAA,GAAM,KAAA,CAAM,IAAA,CAAK,MAAA,CAAO,GAAG,CAAA,IAAK,IAAA;AAChC,MAAA,IAAI,CAAC,GAAA,EAAK;AAEN,QAAA,SAAA,CAAU,OAAO,MAAM,CAAA;AACvB,QAAA,KAAA,GAAQ,MAAM,iBAAA,CAAkB,MAAA,EAAQ,GAAG,CAAA;AAC3C,QAAA,GAAA,GAAM,KAAA,CAAM,IAAA,CAAK,MAAA,CAAO,GAAG,CAAA,IAAK,IAAA;AAAA,MACpC;AACA,MAAA,MAAA,CAAO,IAAA,CAAK;AAAA,QACR,EAAA,EAAI,CAAC,CAAC,GAAA;AAAA,QACN,KAAA,EAAO,+BAAA;AAAA,QACP,MAAA,EAAQ,GAAA,GAAM,CAAA,IAAA,EAAO,MAAA,CAAO,GAAG,CAAA,CAAA,GAAK,CAAA,gBAAA,EAAmB,MAAA,CAAO,GAAG,CAAA,IAAA,EAAO,MAAM,CAAA,EAAG,kBAAkB,CAAA;AAAA,OACtG,CAAA;AACD,MAAA,IAAI,CAAC,GAAA,EAAK;AACN,QAAA,OAAO,EAAE,IAAI,KAAA,EAAO,MAAA,EAAQ,OAAO,MAAA,CAAO,GAAG,yBAAyB,MAAA,EAAO;AAAA,MACjF;AAAA,IACJ,SAAS,GAAA,EAAK;AACV,MAAA,MAAA,CAAO,IAAA,CAAK;AAAA,QACR,EAAA,EAAI,KAAA;AAAA,QACJ,KAAA,EAAO,+BAAA;AAAA,QACP,MAAA,EAAQ,CAAA,2BAAA,EAA+B,GAAA,CAAc,OAAO,CAAA;AAAA,OAC/D,CAAA;AACD,MAAA,OAAO;AAAA,QACH,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,CAAA,2BAAA,EAA+B,GAAA,CAAc,OAAO,CAAA,CAAA;AAAA,QAC5D;AAAA,OACJ;AAAA,IACJ;AAAA,EACJ;AAEA,EAAA,MAAM,QAAA,GAAW,UAAA,CAAW,MAAA,CAAO,GAAG,CAAA;AACtC,EAAA,IAAI,CAAC,QAAA,EAAU;AACX,IAAA,MAAA,CAAO,IAAA,CAAK;AAAA,MACR,EAAA,EAAI,KAAA;AAAA,MACJ,KAAA,EAAO,kDAAA;AAAA,MACP,MAAA,EAAQ;AAAA,KACX,CAAA;AACD,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,iBAAiB,MAAA,EAAO;AAAA,EACxD;AACA,EAAA,MAAM,KAAA,GAAQ,MAAM,aAAA,CAAc,GAAA,EAAK,UAAU,SAAS,CAAA;AAC1D,EAAA,MAAA,CAAO,IAAA,CAAK;AAAA,IACR,EAAA,EAAI,KAAA;AAAA,IACJ,KAAA,EAAO,kDAAA;AAAA,IACP,MAAA,EAAQ,QAAQ,iBAAA,GAAoB;AAAA,GACvC,CAAA;AACD,EAAA,IAAI,CAAC,OAAO,OAAO,EAAE,IAAI,KAAA,EAAO,MAAA,EAAQ,4BAA4B,MAAA,EAAO;AAG3E,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,oBAAO,IAAI,IAAA,EAAK;AACpC,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,UAAU,CAAA;AAC9C,EAAA,MAAM,UAAU,MAAA,CAAO,QAAA,CAAS,SAAS,CAAA,IAAK,SAAA,GAAY,IAAI,OAAA,EAAQ;AACtE,EAAA,MAAA,CAAO,IAAA,CAAK;AAAA,IACR,EAAA,EAAI,OAAA;AAAA,IACJ,KAAA,EAAO,8BAAA;AAAA,IACP,MAAA,EAAQ,UACF,CAAA,QAAA,EAAW,IAAI,KAAK,SAAS,CAAA,CAAE,WAAA,EAAa,CAAA,CAAA,GAC5C;AAAA,GACT,CAAA;AACD,EAAA,IAAI,CAAC,SAAS,OAAO,EAAE,IAAI,KAAA,EAAO,MAAA,EAAQ,2BAA2B,MAAA,EAAO;AAE5E,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,WAAA,EAAa,QAAQ,MAAA,EAAO;AACnD;AAIA,eAAsB,mBAAA,CAAoB,SAAS,cAAA,EAA+B;AAC9E,EAAA,SAAA,CAAU,OAAO,MAAM,CAAA;AACvB,EAAA,MAAM,iBAAA,CAAkB,QAAQ,cAAc,CAAA;AAClD;AAEO,IAAM,QAAA,GAAW;AAAA,EACpB,yBAAA;AAAA,EACA;AACJ;;;ACrVA,eAAsB,YAAA,CAClB,OAAA,EACA,OAAA,GAA2B,EAAC,EACE;AAC9B,EAAA,MAAM,OAAA,GAAU,MAAMA,cAAA,CAAiB,OAAA,EAAS,OAAO,CAAA;AACvD,EAAA,IAAI,CAAC,OAAA,IAAW,OAAA,CAAQ,QAAA,KAAa,MAAA,wBAAiC,OAAO,CAAA;AAC7E,EAAA,OAAO,OAAA;AACX;AAEA,IAAI,cAAA,GAAiB,KAAA;AAQrB,SAAS,sBAAsB,OAAA,EAAgD;AAC3E,EAAA,IAAI,cAAA,EAAgB;AACpB,EAAA,MAAM,GAAA,GAAM,OAAO,OAAA,KAAY,WAAA,IAAe,OAAA,YAAmB,OAAA;AACjE,EAAA,MAAM,OAAO,GAAA,GAAM,OAAA,CAAQ,GAAA,CAAI,eAAe,IAAK,OAAA,CAAkC,aAAA;AACrF,EAAA,MAAM,SAAS,GAAA,GAAM,OAAA,CAAQ,GAAA,CAAI,QAAQ,IAAK,OAAA,CAAkC,MAAA;AAEhF,EAAA,MAAM,MAAA,GAAS,OAAO,IAAA,KAAS,QAAA,GAAW,mBAAA,CAAoB,IAAA,CAAK,IAAA,CAAK,IAAA,EAAM,CAAA,GAAI,CAAC,CAAA,GAAI,MAAA;AACvF,EAAA,MAAM,UAAA,GACF,OAAO,MAAA,KAAW,QAAA,GAAW,+BAA+B,IAAA,CAAK,MAAM,CAAA,GAAI,CAAC,CAAA,GAAI,MAAA;AACpF,EAAA,MAAM,CAAA,GAAI,qBAAA,CAAsB,IAAA,CAAK,MAAA,IAAU,cAAc,EAAE,CAAA;AAC/D,EAAA,IAAI,CAAC,CAAA,EAAG;AACR,EAAA,IAAI;AACA,IAAA,MAAM,UAAU,IAAA,CAAK,KAAA,CAAM,kBAAkB,CAAA,CAAE,CAAC,CAAE,CAAC,CAAA;AACnD,IAAA,IAAI,OAAA,CAAQ,QAAQ,KAAA,CAAA,EAAW;AAC/B,IAAA,cAAA,GAAiB,IAAA;AACjB,IAAA,OAAA,CAAQ,IAAA;AAAA,MACJ,CAAA,kDAAA,EAAqD,IAAA,CAAK,SAAA,CAAU,OAAA,CAAQ,GAAG,CAAC,CAAA,+IAAA;AAAA,KAGpF;AAAA,EACJ,CAAA,CAAA,MAAQ;AAAA,EAER;AACJ;AAEA,SAAS,kBAAkB,CAAA,EAAmB;AAC1C,EAAA,MAAM,GAAA,GAAM,EAAE,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AAClD,EAAA,IAAI,OAAO,IAAA,KAAS,UAAA,EAAY,OAAO,IAAA,CAAK,GAAA,GAAM,GAAA,CAAI,MAAA,CAAA,CAAQ,CAAA,GAAK,GAAA,CAAI,MAAA,GAAS,CAAA,IAAM,CAAC,CAAC,CAAA;AACxF,EAAA,OAAO,OAAO,IAAA,CAAK,CAAA,EAAG,WAAW,CAAA,CAAE,SAAS,MAAM,CAAA;AACtD;AA2CO,IAAM,gBAAA,GAAmB;AAEhC,IAAM,WAAA,uBAAkB,GAAA,EAAoB;AAC5C,IAAM,eAAA,0BAAyB,iBAAiB,CAAA;AAChD,IAAM,aAAA,GAAgB,GAAA;AAEtB,IAAM,eAAA,GAAkB,GAAA;AACxB,IAAM,QAAA,uBAAe,GAAA,EAAsE;AAU3F,eAAe,mBACX,OAAA,EAC6D;AAC7D,EAAA,MAAM,MAAM,OAAA,CAAQ,UAAA;AACpB,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,GAAA,CAAI,GAAG,CAAA;AAC5B,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,EAAA,IAAI,WAAA,CAAY,GAAA,CAAI,GAAG,CAAA,IAAK,GAAA,GAAM,YAAY,GAAA,CAAI,GAAG,CAAA,GAAK,aAAA,EAAe,OAAO,eAAA;AAChF,EAAA,IAAI,OAAO,GAAA,GAAM,GAAA,CAAI,EAAA,GAAK,aAAA,SAAsB,GAAA,CAAI,IAAA;AACpD,EAAA,IAAI,GAAA,EAAK,QAAA,IAAY,GAAA,GAAM,GAAA,CAAI,QAAA,GAAW,iBAAiB,OAAO,GAAA,CAAI,EAAA,GAAK,GAAA,CAAI,IAAA,GAAO,MAAA;AACtF,EAAA,IAAI;AACA,IAAA,MAAM,IAAA,GAAO,QAAQ,QAAA,IAAY,oBAAA;AACjC,IAAA,MAAM,CAAA,GAAI,MAAM,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,gBAAA,EAAmB,kBAAA,CAAmB,GAAG,CAAC,CAAA,QAAA,CAAA,EAAY;AAAA,MAC/E,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,GAAI;AAAA,KACnC,CAAA;AAED,IAAA,IAAI,CAAA,CAAE,WAAW,GAAA,EAAK;AAClB,MAAA,IAAI,CAAC,WAAA,CAAY,GAAA,CAAI,GAAG,CAAA,EAAG;AACvB,QAAA,OAAA,CAAQ,KAAA;AAAA,UACJ,wCAAwC,GAAG,CAAA,iEAAA;AAAA,SAC/C;AAAA,MACJ;AACA,MAAA,WAAA,CAAY,GAAA,CAAI,GAAA,EAAK,IAAA,CAAK,GAAA,EAAK,CAAA;AAC/B,MAAA,OAAO,eAAA;AAAA,IACX;AACA,IAAA,WAAA,CAAY,OAAO,GAAG,CAAA;AACtB,IAAA,IAAI,CAAC,EAAE,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,KAAA,EAAQ,CAAA,CAAE,MAAM,CAAA,CAAE,CAAA;AAC7C,IAAA,MAAM,CAAA,GAAK,MAAM,CAAA,CAAE,IAAA,EAAK;AAGxB,IAAA,MAAM,GAAA,GAAM,EAAE,YAAA,IAAgB,IAAA;AAC9B,IAAA,MAAM,IAAA,GAAO,MAAM,EAAE,OAAA,EAAS,IAAI,QAAA,EAAU,OAAA,EAAS,GAAA,CAAI,QAAA,EAAS,GAAI,IAAA;AACtE,IAAA,QAAA,CAAS,GAAA,CAAI,KAAK,EAAE,EAAA,EAAI,KAAK,GAAA,EAAI,EAAG,MAAM,CAAA;AAC1C,IAAA,OAAO,IAAA;AAAA,EACX,CAAA,CAAA,MAAQ;AACJ,IAAA,QAAA,CAAS,GAAA,CAAI,GAAA,EAAK,EAAE,EAAA,EAAI,KAAK,EAAA,IAAM,CAAA,EAAG,IAAA,EAAM,GAAA,EAAK,QAAQ,IAAA,EAAM,QAAA,EAAU,IAAA,CAAK,GAAA,IAAO,CAAA;AACrF,IAAA,OAAO,GAAA,EAAK,EAAA,GAAK,GAAA,CAAI,IAAA,GAAO,MAAA;AAAA,EAChC;AACJ;AAGA,eAAe,SACX,OAAA,EAC6D;AAC7D,EAAA,IAAI,OAAA,CAAQ,WAAA,EAAa,OAAO,OAAA,CAAQ,WAAA;AACxC,EAAA,IAAI,OAAA,CAAQ,UAAA,EAAY,OAAO,kBAAA,CAAmB,OAAO,CAAA;AACzD,EAAA,OAAO,IAAA;AACX;AAGA,eAAe,OAAA,CACX,SACA,OAAA,EACiE;AACjE,EAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,OAAO,CAAA;AACnC,EAAA,IAAI,CAAC,OAAA,IAAW,OAAA,CAAQ,QAAA,EAAU;AAC9B,IAAA,OAAO,EAAE,QAAQ,GAAA,EAAK,IAAA,EAAM,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,iBAAA,EAAkB,EAAE;AAAA,EACzE;AACA,EAAA,IAAI,SAAS,eAAA,EAAiB;AAC1B,IAAA,OAAO,EAAE,QAAQ,GAAA,EAAK,IAAA,EAAM,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,qBAAA,EAAsB,EAAE;AAAA,EAC7E;AACA,EAAA,IAAI,SAAS,MAAA,EAAW;AACpB,IAAA,OAAO,EAAE,QAAQ,GAAA,EAAK,IAAA,EAAM,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,yBAAA,EAA0B,EAAE;AAAA,EACjF;AACA,EAAA,IAAI,CAAC,OAAA,EAAS;AACV,IAAA,OAAO,IAAA,GAAO,EAAE,MAAA,EAAQ,GAAA,EAAK,IAAA,EAAM,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,iBAAA,EAAkB,EAAE,GAAI,IAAA;AAAA,EACpF;AACA,EAAA,IAAI,IAAA,IAAQ,CAAC,SAAA,CAAU,OAAA,EAAS,IAAI,CAAA,EAAG;AACnC,IAAA,MAAM,IAAA,GAAO,cAAc,OAAO,CAAA;AAClC,IAAA,OAAO;AAAA,MACH,MAAA,EAAQ,GAAA;AAAA,MACR,IAAA,EAAM;AAAA,QACF,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,eAAA;AAAA,QACR,IAAA,EAAM;AAAA,UACF,QAAA,EAAU,KAAK,OAAA,IAAW,CAAA;AAAA,UAC1B,QAAA,EAAU,KAAK,OAAA,IAAW,CAAA;AAAA,UAC1B,GAAI,KAAK,UAAA,KAAe,MAAA,GAAY,EAAE,YAAA,EAAc,IAAA,CAAK,UAAA,EAAW,GAAI;AAAC,SAC7E;AAAA,QACA,IAAA,EAAM,OAAO,EAAE,UAAA,EAAY,KAAK,UAAA,EAAY,UAAA,EAAY,IAAA,CAAK,UAAA,EAAW,GAAI,IAAA;AAAA,QAC5E,QAAA,EAAU;AAAA;AACd,KACJ;AAAA,EACJ;AACA,EAAA,OAAO,IAAA;AACX;AAqBO,SAAS,UAAA,CAIZ,OAAA,EACA,OAAA,GAA6B,EAAC,EACU;AACxC,EAAA,OAAO,OAAO,KAAU,GAAA,KAAa;AACjC,IAAA,GAAA,CAAI,SAAA,CAAU,iBAAiB,mBAAmB,CAAA;AAClD,IAAA,GAAA,CAAI,SAAA,CAAU,QAAQ,uBAAuB,CAAA;AAC7C,IAAA,MAAM,UAAU,MAAM,YAAA;AAAA,MAClB;AAAA,QACI,MAAA,EAAQ,OAAO,GAAA,CAAI,OAAA,CAAQ,WAAW,QAAA,GAAW,GAAA,CAAI,QAAQ,MAAA,GAAS,IAAA;AAAA,QACtE,aAAA,EACI,OAAO,GAAA,CAAI,OAAA,CAAQ,kBAAkB,QAAA,GAC/B,GAAA,CAAI,QAAQ,aAAA,GACZ;AAAA,OACd;AAAA,MACA;AAAA,KACJ;AACA,IAAA,MAAM,WAAA,GAAc,GAAA;AACpB,IAAA,WAAA,CAAY,SAAA,GAAY,OAAA;AACxB,IAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,OAAA,EAAS,OAAO,CAAA;AAC9C,IAAA,IAAI,OAAA,SAAgB,GAAA,CAAI,MAAA,CAAO,QAAQ,MAAM,CAAA,CAAE,IAAA,CAAK,OAAA,CAAQ,IAAI,CAAA;AAChE,IAAA,OAAO,OAAA,CAAQ,aAAa,GAAG,CAAA;AAAA,EACnC,CAAA;AACJ;AAgDO,SAAS,aAAA,CAAc,OAAA,GAA6B,EAAC,EAAG;AAC3D,EAAA,OAAO,OAAO,GAAA,EAAyB,GAAA,EAA0B,IAAA,KAA0B;AACvF,IAAA,IAAI;AACA,MAAA,GAAA,CAAI,SAAA,CAAU,iBAAiB,mBAAmB,CAAA;AAClD,MAAA,GAAA,CAAI,SAAA,CAAU,QAAQ,uBAAuB,CAAA;AAC7C,MAAA,MAAM,UAAU,MAAM,YAAA;AAAA,QAClB;AAAA,UACI,MAAA,EAAQ,OAAO,GAAA,CAAI,OAAA,CAAQ,WAAW,QAAA,GAAW,GAAA,CAAI,QAAQ,MAAA,GAAS,IAAA;AAAA,UACtE,aAAA,EACI,OAAO,GAAA,CAAI,OAAA,CAAQ,kBAAkB,QAAA,GAC/B,GAAA,CAAI,QAAQ,aAAA,GACZ;AAAA,SACd;AAAA,QACA;AAAA,OACJ;AACA,MAAA,GAAA,CAAI,SAAA,GAAY,OAAA;AAChB,MAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,OAAA,EAAS,OAAO,CAAA;AAC9C,MAAA,IAAI,OAAA,EAAS;AACT,QAAA,GAAA,CAAI,OAAO,OAAA,CAAQ,MAAM,CAAA,CAAE,IAAA,CAAK,QAAQ,IAAI,CAAA;AAC5C,QAAA;AAAA,MACJ;AACA,MAAA,IAAA,EAAK;AAAA,IACT,SAAS,GAAA,EAAK;AACV,MAAA,IAAA,CAAK,GAAG,CAAA;AAAA,IACZ;AAAA,EACJ,CAAA;AACJ;AA2BO,SAAS,UAAA,CAAW,OAAA,GAA6B,EAAC,EAAG;AACxD,EAAA,OAAO,OAAO,GAAoB,IAAA,KAAuB;AACrD,IAAA,CAAA,CAAE,MAAA,CAAO,iBAAiB,mBAAmB,CAAA;AAC7C,IAAA,CAAA,CAAE,MAAA,CAAO,QAAQ,uBAAuB,CAAA;AACxC,IAAA,MAAM,UAAU,MAAM,YAAA,CAAa,EAAE,GAAA,CAAI,GAAA,CAAI,SAAS,OAAO,CAAA;AAC7D,IAAA,CAAA,CAAE,GAAA,CAAI,aAAa,OAAO,CAAA;AAC1B,IAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,OAAA,EAAS,OAAO,CAAA;AAC9C,IAAA,IAAI,SAAS,OAAO,CAAA,CAAE,KAAK,OAAA,CAAQ,IAAA,EAAM,QAAQ,MAAM,CAAA;AACvD,IAAA,MAAM,IAAA,EAAK;AAAA,EACf,CAAA;AACJ","file":"server.mjs","sourcesContent":["export const encoder = new TextEncoder();\nexport const decoder = new TextDecoder();\nconst MAX_INT32 = 2 ** 32;\nexport function concat(...buffers) {\n const size = buffers.reduce((acc, { length }) => acc + length, 0);\n const buf = new Uint8Array(size);\n let i = 0;\n for (const buffer of buffers) {\n buf.set(buffer, i);\n i += buffer.length;\n }\n return buf;\n}\nfunction writeUInt32BE(buf, value, offset) {\n if (value < 0 || value >= MAX_INT32) {\n throw new RangeError(`value must be >= 0 and <= ${MAX_INT32 - 1}. Received ${value}`);\n }\n buf.set([value >>> 24, value >>> 16, value >>> 8, value & 0xff], offset);\n}\nexport function uint64be(value) {\n const high = Math.floor(value / MAX_INT32);\n const low = value % MAX_INT32;\n const buf = new Uint8Array(8);\n writeUInt32BE(buf, high, 0);\n writeUInt32BE(buf, low, 4);\n return buf;\n}\nexport function uint32be(value) {\n const buf = new Uint8Array(4);\n writeUInt32BE(buf, value);\n return buf;\n}\nexport function encode(string) {\n const bytes = new Uint8Array(string.length);\n for (let i = 0; i < string.length; i++) {\n const code = string.charCodeAt(i);\n if (code > 127) {\n throw new TypeError('non-ASCII string encountered in encode()');\n }\n bytes[i] = code;\n }\n return bytes;\n}\n","export function encodeBase64(input) {\n if (Uint8Array.prototype.toBase64) {\n return input.toBase64();\n }\n const CHUNK_SIZE = 0x8000;\n const arr = [];\n for (let i = 0; i < input.length; i += CHUNK_SIZE) {\n arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));\n }\n return btoa(arr.join(''));\n}\nexport function decodeBase64(encoded) {\n if (Uint8Array.fromBase64) {\n return Uint8Array.fromBase64(encoded);\n }\n const binary = atob(encoded);\n const bytes = new Uint8Array(binary.length);\n for (let i = 0; i < binary.length; i++) {\n bytes[i] = binary.charCodeAt(i);\n }\n return bytes;\n}\n","import { encoder, decoder } from '../lib/buffer_utils.js';\nimport { encodeBase64, decodeBase64 } from '../lib/base64.js';\nexport function decode(input) {\n if (Uint8Array.fromBase64) {\n return Uint8Array.fromBase64(typeof input === 'string' ? input : decoder.decode(input), {\n alphabet: 'base64url',\n });\n }\n let encoded = input;\n if (encoded instanceof Uint8Array) {\n encoded = decoder.decode(encoded);\n }\n encoded = encoded.replace(/-/g, '+').replace(/_/g, '/');\n try {\n return decodeBase64(encoded);\n }\n catch {\n throw new TypeError('The input to be decoded is not correctly encoded.');\n }\n}\nexport function encode(input) {\n let unencoded = input;\n if (typeof unencoded === 'string') {\n unencoded = encoder.encode(unencoded);\n }\n if (Uint8Array.prototype.toBase64) {\n return unencoded.toBase64({ alphabet: 'base64url', omitPadding: true });\n }\n return encodeBase64(unencoded).replace(/=/g, '').replace(/\\+/g, '-').replace(/\\//g, '_');\n}\n","export class JOSEError extends Error {\n static code = 'ERR_JOSE_GENERIC';\n code = 'ERR_JOSE_GENERIC';\n constructor(message, options) {\n super(message, options);\n this.name = this.constructor.name;\n Error.captureStackTrace?.(this, this.constructor);\n }\n}\nexport class JWTClaimValidationFailed extends JOSEError {\n static code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';\n code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';\n claim;\n reason;\n payload;\n constructor(message, payload, claim = 'unspecified', reason = 'unspecified') {\n super(message, { cause: { claim, reason, payload } });\n this.claim = claim;\n this.reason = reason;\n this.payload = payload;\n }\n}\nexport class JWTExpired extends JOSEError {\n static code = 'ERR_JWT_EXPIRED';\n code = 'ERR_JWT_EXPIRED';\n claim;\n reason;\n payload;\n constructor(message, payload, claim = 'unspecified', reason = 'unspecified') {\n super(message, { cause: { claim, reason, payload } });\n this.claim = claim;\n this.reason = reason;\n this.payload = payload;\n }\n}\nexport class JOSEAlgNotAllowed extends JOSEError {\n static code = 'ERR_JOSE_ALG_NOT_ALLOWED';\n code = 'ERR_JOSE_ALG_NOT_ALLOWED';\n}\nexport class JOSENotSupported extends JOSEError {\n static code = 'ERR_JOSE_NOT_SUPPORTED';\n code = 'ERR_JOSE_NOT_SUPPORTED';\n}\nexport class JWEDecryptionFailed extends JOSEError {\n static code = 'ERR_JWE_DECRYPTION_FAILED';\n code = 'ERR_JWE_DECRYPTION_FAILED';\n constructor(message = 'decryption operation failed', options) {\n super(message, options);\n }\n}\nexport class JWEInvalid extends JOSEError {\n static code = 'ERR_JWE_INVALID';\n code = 'ERR_JWE_INVALID';\n}\nexport class JWSInvalid extends JOSEError {\n static code = 'ERR_JWS_INVALID';\n code = 'ERR_JWS_INVALID';\n}\nexport class JWTInvalid extends JOSEError {\n static code = 'ERR_JWT_INVALID';\n code = 'ERR_JWT_INVALID';\n}\nexport class JWKInvalid extends JOSEError {\n static code = 'ERR_JWK_INVALID';\n code = 'ERR_JWK_INVALID';\n}\nexport class JWKSInvalid extends JOSEError {\n static code = 'ERR_JWKS_INVALID';\n code = 'ERR_JWKS_INVALID';\n}\nexport class JWKSNoMatchingKey extends JOSEError {\n static code = 'ERR_JWKS_NO_MATCHING_KEY';\n code = 'ERR_JWKS_NO_MATCHING_KEY';\n constructor(message = 'no applicable key found in the JSON Web Key Set', options) {\n super(message, options);\n }\n}\nexport class JWKSMultipleMatchingKeys extends JOSEError {\n [Symbol.asyncIterator];\n static code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';\n code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';\n constructor(message = 'multiple matching keys found in the JSON Web Key Set', options) {\n super(message, options);\n }\n}\nexport class JWKSTimeout extends JOSEError {\n static code = 'ERR_JWKS_TIMEOUT';\n code = 'ERR_JWKS_TIMEOUT';\n constructor(message = 'request timed out', options) {\n super(message, options);\n }\n}\nexport class JWSSignatureVerificationFailed extends JOSEError {\n static code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';\n code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';\n constructor(message = 'signature verification failed', options) {\n super(message, options);\n }\n}\n","const isObjectLike = (value) => typeof value === 'object' && value !== null;\nexport function isObject(input) {\n if (!isObjectLike(input) || Object.prototype.toString.call(input) !== '[object Object]') {\n return false;\n }\n if (Object.getPrototypeOf(input) === null) {\n return true;\n }\n let proto = input;\n while (Object.getPrototypeOf(proto) !== null) {\n proto = Object.getPrototypeOf(proto);\n }\n return Object.getPrototypeOf(input) === proto;\n}\nexport function isDisjoint(...headers) {\n const sources = headers.filter(Boolean);\n if (sources.length === 0 || sources.length === 1) {\n return true;\n }\n let acc;\n for (const header of sources) {\n const parameters = Object.keys(header);\n if (!acc || acc.size === 0) {\n acc = new Set(parameters);\n continue;\n }\n for (const parameter of parameters) {\n if (acc.has(parameter)) {\n return false;\n }\n acc.add(parameter);\n }\n }\n return true;\n}\nexport const isJWK = (key) => isObject(key) && typeof key.kty === 'string';\nexport const isPrivateJWK = (key) => key.kty !== 'oct' &&\n ((key.kty === 'AKP' && typeof key.priv === 'string') || typeof key.d === 'string');\nexport const isPublicJWK = (key) => key.kty !== 'oct' && key.d === undefined && key.priv === undefined;\nexport const isSecretJWK = (key) => key.kty === 'oct' && typeof key.k === 'string';\n","import { JOSENotSupported } from '../util/errors.js';\nconst unsupportedAlg = 'Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value';\nfunction subtleMapping(jwk) {\n let algorithm;\n let keyUsages;\n switch (jwk.kty) {\n case 'AKP': {\n switch (jwk.alg) {\n case 'ML-DSA-44':\n case 'ML-DSA-65':\n case 'ML-DSA-87':\n algorithm = { name: jwk.alg };\n keyUsages = jwk.priv ? ['sign'] : ['verify'];\n break;\n default:\n throw new JOSENotSupported(unsupportedAlg);\n }\n break;\n }\n case 'RSA': {\n switch (jwk.alg) {\n case 'PS256':\n case 'PS384':\n case 'PS512':\n algorithm = { name: 'RSA-PSS', hash: `SHA-${jwk.alg.slice(-3)}` };\n keyUsages = jwk.d ? ['sign'] : ['verify'];\n break;\n case 'RS256':\n case 'RS384':\n case 'RS512':\n algorithm = { name: 'RSASSA-PKCS1-v1_5', hash: `SHA-${jwk.alg.slice(-3)}` };\n keyUsages = jwk.d ? ['sign'] : ['verify'];\n break;\n case 'RSA-OAEP':\n case 'RSA-OAEP-256':\n case 'RSA-OAEP-384':\n case 'RSA-OAEP-512':\n algorithm = {\n name: 'RSA-OAEP',\n hash: `SHA-${parseInt(jwk.alg.slice(-3), 10) || 1}`,\n };\n keyUsages = jwk.d ? ['decrypt', 'unwrapKey'] : ['encrypt', 'wrapKey'];\n break;\n default:\n throw new JOSENotSupported(unsupportedAlg);\n }\n break;\n }\n case 'EC': {\n switch (jwk.alg) {\n case 'ES256':\n case 'ES384':\n case 'ES512':\n algorithm = {\n name: 'ECDSA',\n namedCurve: { ES256: 'P-256', ES384: 'P-384', ES512: 'P-521' }[jwk.alg],\n };\n keyUsages = jwk.d ? ['sign'] : ['verify'];\n break;\n case 'ECDH-ES':\n case 'ECDH-ES+A128KW':\n case 'ECDH-ES+A192KW':\n case 'ECDH-ES+A256KW':\n algorithm = { name: 'ECDH', namedCurve: jwk.crv };\n keyUsages = jwk.d ? ['deriveBits'] : [];\n break;\n default:\n throw new JOSENotSupported(unsupportedAlg);\n }\n break;\n }\n case 'OKP': {\n switch (jwk.alg) {\n case 'Ed25519':\n case 'EdDSA':\n algorithm = { name: 'Ed25519' };\n keyUsages = jwk.d ? ['sign'] : ['verify'];\n break;\n case 'ECDH-ES':\n case 'ECDH-ES+A128KW':\n case 'ECDH-ES+A192KW':\n case 'ECDH-ES+A256KW':\n algorithm = { name: jwk.crv };\n keyUsages = jwk.d ? ['deriveBits'] : [];\n break;\n default:\n throw new JOSENotSupported(unsupportedAlg);\n }\n break;\n }\n default:\n throw new JOSENotSupported('Invalid or unsupported JWK \"kty\" (Key Type) Parameter value');\n }\n return { algorithm, keyUsages };\n}\nexport async function jwkToKey(jwk) {\n if (!jwk.alg) {\n throw new TypeError('\"alg\" argument is required when \"jwk.alg\" is not present');\n }\n const { algorithm, keyUsages } = subtleMapping(jwk);\n const keyData = { ...jwk };\n if (keyData.kty !== 'AKP') {\n delete keyData.alg;\n }\n delete keyData.use;\n return crypto.subtle.importKey('jwk', keyData, algorithm, jwk.ext ?? (jwk.d || jwk.priv ? false : true), jwk.key_ops ?? keyUsages);\n}\n","import { decode as decodeBase64URL } from '../util/base64url.js';\nimport { fromSPKI, fromPKCS8, fromX509 } from '../lib/asn1.js';\nimport { jwkToKey } from '../lib/jwk_to_key.js';\nimport { JOSENotSupported } from '../util/errors.js';\nimport { isObject } from '../lib/type_checks.js';\nexport async function importSPKI(spki, alg, options) {\n if (typeof spki !== 'string' || spki.indexOf('-----BEGIN PUBLIC KEY-----') !== 0) {\n throw new TypeError('\"spki\" must be SPKI formatted string');\n }\n return fromSPKI(spki, alg, options);\n}\nexport async function importX509(x509, alg, options) {\n if (typeof x509 !== 'string' || x509.indexOf('-----BEGIN CERTIFICATE-----') !== 0) {\n throw new TypeError('\"x509\" must be X.509 formatted string');\n }\n return fromX509(x509, alg, options);\n}\nexport async function importPKCS8(pkcs8, alg, options) {\n if (typeof pkcs8 !== 'string' || pkcs8.indexOf('-----BEGIN PRIVATE KEY-----') !== 0) {\n throw new TypeError('\"pkcs8\" must be PKCS#8 formatted string');\n }\n return fromPKCS8(pkcs8, alg, options);\n}\nexport async function importJWK(jwk, alg, options) {\n if (!isObject(jwk)) {\n throw new TypeError('JWK must be an object');\n }\n let ext;\n alg ??= jwk.alg;\n ext ??= options?.extractable ?? jwk.ext;\n switch (jwk.kty) {\n case 'oct':\n if (typeof jwk.k !== 'string' || !jwk.k) {\n throw new TypeError('missing \"k\" (Key Value) Parameter value');\n }\n return decodeBase64URL(jwk.k);\n case 'RSA':\n if ('oth' in jwk && jwk.oth !== undefined) {\n throw new JOSENotSupported('RSA JWK \"oth\" (Other Primes Info) Parameter value is not supported');\n }\n return jwkToKey({ ...jwk, alg, ext });\n case 'AKP': {\n if (typeof jwk.alg !== 'string' || !jwk.alg) {\n throw new TypeError('missing \"alg\" (Algorithm) Parameter value');\n }\n if (alg !== undefined && alg !== jwk.alg) {\n throw new TypeError('JWK alg and alg option value mismatch');\n }\n return jwkToKey({ ...jwk, ext });\n }\n case 'EC':\n case 'OKP':\n return jwkToKey({ ...jwk, alg, ext });\n default:\n throw new JOSENotSupported('Unsupported \"kty\" (Key Type) Parameter value');\n }\n}\n","/**\n * `oc.identity.verifyActivityAttestation` — one-call ed25519 verifier\n * for a /api/me/activity-attestation bundle.\n *\n * Cashes the \"trivially to verify\" strategic claim: an integrator\n * receiving a signed attestation JSON from a user calls one function,\n * gets a typed result with per-check detail, never reaches into\n * @noble/curves or jose themselves.\n *\n * import { oc } from '@orangecheck/me-client';\n *\n * const result = await oc.identity.verifyActivityAttestation(bundle);\n * if (!result.ok) return res.status(401).send(result.reason);\n * // result.attestation is typed · safe to gate on lifetime_sats etc.\n *\n * The JWKS issuer is me.ochk.io (the envelope key), DISTINCT from\n * the auth host's ochk.io JWKS that signs webhooks. Same Ed25519\n * curve, same kid lookup pattern, fetched + cached separately.\n */\n\nimport { importJWK, type CryptoKey, type KeyObject } from 'jose';\n\nconst DEFAULT_ISSUER = 'https://me.ochk.io';\nconst DEFAULT_TTL_MS = 60 * 60 * 1000;\nconst ENVELOPE_JWKS_PATH = '/.well-known/oc-envelope-jwks.json';\n\nexport interface ActivityAttestation {\n id: string;\n v: 1;\n kind: 'oc-me-activity';\n did_oc: string;\n event_count: number;\n human_event_count: number;\n lifetime_sats: number;\n distinct_integrator_count: number;\n oldest_event_at: string | null;\n active_days: number;\n computed_at: string;\n expires_at: string;\n}\n\nexport interface ActivityAttestationBundle {\n /** A readable copy. Never trusted: the result is read from the signed\n * bytes, and a copy that differs from them fails the check. */\n attestation?: ActivityAttestation;\n sig: string;\n kid: string;\n canonical_b64: string;\n}\n\nexport interface ActivityVerifyCheck {\n ok: boolean;\n label: string;\n detail?: string;\n}\n\nexport interface ActivityVerifyResult {\n ok: boolean;\n reason?: string;\n attestation?: ActivityAttestation;\n checks: ActivityVerifyCheck[];\n}\n\ninterface OcEnvelopePublicJwk {\n kty: 'OKP';\n crv: 'Ed25519';\n x: string;\n kid: string;\n alg?: 'EdDSA';\n use?: 'sig';\n}\n\nexport interface VerifyActivityOptions {\n /** Override the me.ochk.io issuer (defaults to https://me.ochk.io).\n * Useful for staging / self-hosted dev. */\n issuer?: string;\n /** Pass a JWK directly to skip the network fetch · convenient when\n * embedding the public key in your service for air-gapped or\n * edge-runtime deployments. */\n jwk?: OcEnvelopePublicJwk;\n /** JWKS cache TTL in ms. Defaults to 1h. Stale-on-error falls back\n * to the previous cached value. */\n jwksCacheTtlMs?: number;\n /** Optional · override \"now\" for deterministic tests. */\n now?: Date;\n}\n\ntype AuthKey = CryptoKey | KeyObject;\n\ninterface JwksCacheEntry {\n keys: Record<string, AuthKey>;\n fetchedAt: number;\n}\n\nconst jwksCache = new Map<string, JwksCacheEntry>();\nconst inflight = new Map<string, Promise<JwksCacheEntry>>();\n\nasync function fetchEnvelopeJwks(issuer: string, ttlMs: number): Promise<JwksCacheEntry> {\n const cached = jwksCache.get(issuer);\n if (cached && Date.now() - cached.fetchedAt < ttlMs) return cached;\n const existing = inflight.get(issuer);\n if (existing) return existing;\n const p = (async (): Promise<JwksCacheEntry> => {\n try {\n const url = `${issuer.replace(/\\/$/, '')}${ENVELOPE_JWKS_PATH}`;\n const res = await fetch(url, { headers: { Accept: 'application/json' } });\n if (!res.ok) throw new Error(`envelope JWKS fetch ${url} returned ${res.status}`);\n const json = (await res.json()) as { keys: OcEnvelopePublicJwk[] };\n if (!json || !Array.isArray(json.keys)) {\n throw new Error(`envelope JWKS at ${url} did not return {keys:[…]}`);\n }\n const keys: Record<string, AuthKey> = {};\n for (const k of json.keys) {\n if (typeof k.kid !== 'string') continue;\n try {\n keys[k.kid] = (await importJWK(k, 'EdDSA')) as AuthKey;\n } catch {\n /* skip keys that won't import */\n }\n }\n const entry: JwksCacheEntry = { keys, fetchedAt: Date.now() };\n jwksCache.set(issuer, entry);\n return entry;\n } catch (err) {\n const stale = jwksCache.get(issuer);\n if (stale) return stale;\n throw err;\n }\n })().finally(() => {\n inflight.delete(issuer);\n });\n inflight.set(issuer, p);\n return p;\n}\n\nfunction hexToBytes(hex: string): Uint8Array | null {\n if (typeof hex !== 'string') return null;\n const s = hex.trim();\n if (s.length === 0 || s.length % 2 !== 0) return null;\n const out = new Uint8Array(s.length / 2);\n for (let i = 0; i < out.length; i++) {\n const b = parseInt(s.slice(i * 2, i * 2 + 2), 16);\n if (Number.isNaN(b)) return null;\n out[i] = b;\n }\n return out;\n}\n\nfunction base64ToBytes(b64: string): Uint8Array | null {\n try {\n const bin =\n typeof atob === 'function'\n ? atob(b64)\n : Buffer.from(b64, 'base64').toString('binary');\n const out = new Uint8Array(bin.length);\n for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);\n return out;\n } catch {\n return null;\n }\n}\n\nfunction bytesToHex(bytes: Uint8Array): string {\n let out = '';\n for (const b of bytes) out += b.toString(16).padStart(2, '0');\n return out;\n}\n\nasync function sha256(bytes: Uint8Array): Promise<Uint8Array> {\n const subtle =\n typeof globalThis.crypto !== 'undefined' && globalThis.crypto.subtle\n ? globalThis.crypto.subtle\n : null;\n if (!subtle) {\n throw new Error('crypto.subtle unavailable · need Node 20+ / modern browser / Edge runtime');\n }\n const buf = await subtle.digest('SHA-256', bytes as unknown as ArrayBuffer);\n return new Uint8Array(buf);\n}\n\nfunction toArrayBuffer(view: Uint8Array): ArrayBuffer {\n const buf = new ArrayBuffer(view.byteLength);\n new Uint8Array(buf).set(view);\n return buf;\n}\n\nasync function verifyEd25519(\n key: AuthKey,\n sig: Uint8Array,\n msg: Uint8Array\n): Promise<boolean> {\n const subtle =\n typeof globalThis.crypto !== 'undefined' && globalThis.crypto.subtle\n ? globalThis.crypto.subtle\n : null;\n if (!subtle) return false;\n try {\n return await subtle.verify(\n 'Ed25519',\n key as CryptoKey,\n toArrayBuffer(sig),\n toArrayBuffer(msg)\n );\n } catch {\n return false;\n }\n}\n\n/** The signed fields, in the order me.ochk.io encodes them. */\nconst SIGNED_FIELDS = [\n 'v',\n 'kind',\n 'did_oc',\n 'event_count',\n 'human_event_count',\n 'lifetime_sats',\n 'distinct_integrator_count',\n 'oldest_event_at',\n 'active_days',\n 'computed_at',\n 'expires_at',\n] as const;\nconst COUNTS = [\n 'event_count',\n 'human_event_count',\n 'lifetime_sats',\n 'distinct_integrator_count',\n 'active_days',\n] as const;\n\n/** The attestation the signature covers, read from the signed bytes, or\n * null when they are not one in canonical form. */\nfunction readSignedAttestation(canonical: Uint8Array, id: string): ActivityAttestation | null {\n const text = new TextDecoder().decode(canonical);\n let parsed: unknown;\n try {\n parsed = JSON.parse(text);\n } catch {\n return null;\n }\n if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return null;\n const o = parsed as Record<string, unknown>;\n if (o.v !== 1 || o.kind !== 'oc-me-activity' || typeof o.did_oc !== 'string') return null;\n const countsOk = COUNTS.every((k) => {\n const n = o[k];\n return typeof n === 'number' && Number.isSafeInteger(n) && n >= 0;\n });\n if (!countsOk) return null;\n if (o.oldest_event_at !== null && typeof o.oldest_event_at !== 'string') return null;\n if (typeof o.computed_at !== 'string' || typeof o.expires_at !== 'string') return null;\n const ordered = Object.fromEntries(SIGNED_FIELDS.map((k) => [k, o[k]]));\n // Only the canonical encoding counts: no extra keys, no reordering, no whitespace.\n if (JSON.stringify(ordered) !== text) return null;\n return { id, ...(ordered as Omit<ActivityAttestation, 'id'>) };\n}\n\n/** True when every field of the readable copy equals the signed value. */\nfunction sameAttestation(copy: ActivityAttestation, signed: ActivityAttestation): boolean {\n const c = copy as unknown as Record<string, unknown>;\n const v = signed as unknown as Record<string, unknown>;\n return (['id', ...SIGNED_FIELDS] as const).every((k) => c[k] === v[k]);\n}\n\n/**\n * Verify a signed activity attestation bundle. Returns a typed\n * ActivityVerifyResult with per-check detail · never throws (network\n * + parse failures surface as ok=false rows in the checks array, so\n * the caller can log them without try/catch).\n *\n * Checks, in order: bundle shape, the signed bytes decode and are an\n * attestation in canonical form, the readable copy (when given) equals\n * them, JWK with matching kid present, ed25519 signature, freshness.\n * `attestation` in the result is read from the signed bytes, and is set\n * only when every check passes.\n */\nexport async function verifyActivityAttestation(\n bundle: ActivityAttestationBundle,\n options: VerifyActivityOptions = {}\n): Promise<ActivityVerifyResult> {\n const checks: ActivityVerifyCheck[] = [];\n\n // 1. Bundle shape\n const shapeOk =\n !!bundle &&\n typeof bundle === 'object' &&\n typeof bundle.sig === 'string' &&\n typeof bundle.kid === 'string' &&\n typeof bundle.canonical_b64 === 'string' &&\n (bundle.attestation === undefined ||\n (!!bundle.attestation && typeof bundle.attestation === 'object'));\n checks.push({\n ok: shapeOk,\n label: 'bundle shape · sig / kid / canonical_b64',\n });\n if (!shapeOk) {\n return { ok: false, reason: 'bundle shape invalid', checks };\n }\n\n // 2. canonical_b64 decodes\n const canonical = base64ToBytes(bundle.canonical_b64);\n checks.push({\n ok: canonical !== null,\n label: 'canonical_b64 decodes',\n detail: canonical ? `${canonical.length} bytes` : 'invalid base64',\n });\n if (!canonical) return { ok: false, reason: 'canonical_b64 invalid base64', checks };\n\n // 3. The signed bytes are an attestation, and the readable copy says the same\n const computedId = bytesToHex(await sha256(canonical));\n const signed = readSignedAttestation(canonical, computedId);\n checks.push({\n ok: signed !== null,\n label: 'canonical_bytes are an oc-me-activity attestation in canonical form',\n });\n if (!signed) return { ok: false, reason: 'canonical bytes are not an activity attestation', checks };\n\n const copy = bundle.attestation;\n const copyOk = copy === undefined || sameAttestation(copy, signed);\n checks.push({\n ok: copyOk,\n label: 'attestation === the signed bytes, id = sha256(canonical_bytes)',\n detail: copyOk ? computedId : 'the readable copy differs from what was signed',\n });\n if (!copyOk) return { ok: false, reason: 'attestation does not match the signed bytes', checks };\n\n // 4. JWK lookup + ed25519 verify\n let key: AuthKey | null = null;\n if (options.jwk) {\n if (options.jwk.kid !== bundle.kid) {\n checks.push({\n ok: false,\n label: 'JWK with matching kid present',\n detail: `provided jwk.kid=${options.jwk.kid} but bundle.kid=${bundle.kid}`,\n });\n return { ok: false, reason: 'kid mismatch with provided jwk', checks };\n }\n try {\n key = (await importJWK(options.jwk, 'EdDSA')) as AuthKey;\n checks.push({ ok: true, label: 'JWK with matching kid present', detail: `kid ${bundle.kid} (provided)` });\n } catch (err) {\n checks.push({\n ok: false,\n label: 'JWK with matching kid present',\n detail: `provided jwk failed import: ${(err as Error).message}`,\n });\n return { ok: false, reason: 'provided jwk failed import', checks };\n }\n } else {\n const issuer = options.issuer ?? DEFAULT_ISSUER;\n const ttl = options.jwksCacheTtlMs ?? DEFAULT_TTL_MS;\n try {\n let entry = await fetchEnvelopeJwks(issuer, ttl);\n key = entry.keys[bundle.kid] ?? null;\n if (!key) {\n // Cache miss · likely a rotation. Force-refresh once.\n jwksCache.delete(issuer);\n entry = await fetchEnvelopeJwks(issuer, ttl);\n key = entry.keys[bundle.kid] ?? null;\n }\n checks.push({\n ok: !!key,\n label: 'JWK with matching kid present',\n detail: key ? `kid ${bundle.kid}` : `no JWK with kid ${bundle.kid} at ${issuer}${ENVELOPE_JWKS_PATH}`,\n });\n if (!key) {\n return { ok: false, reason: `kid ${bundle.kid} not in envelope JWKS`, checks };\n }\n } catch (err) {\n checks.push({\n ok: false,\n label: 'JWK with matching kid present',\n detail: `envelope JWKS unavailable: ${(err as Error).message}`,\n });\n return {\n ok: false,\n reason: `envelope JWKS unavailable: ${(err as Error).message}`,\n checks,\n };\n }\n }\n\n const sigBytes = hexToBytes(bundle.sig);\n if (!sigBytes) {\n checks.push({\n ok: false,\n label: 'ed25519.verify(sig, canonical_bytes, jwk.public)',\n detail: 'malformed sig (expected hex)',\n });\n return { ok: false, reason: 'malformed sig', checks };\n }\n const sigOk = await verifyEd25519(key, sigBytes, canonical);\n checks.push({\n ok: sigOk,\n label: 'ed25519.verify(sig, canonical_bytes, jwk.public)',\n detail: sigOk ? 'signature valid' : 'signature does not match',\n });\n if (!sigOk) return { ok: false, reason: 'signature does not match', checks };\n\n // 5. Freshness, from the signed expiry\n const now = options.now ?? new Date();\n const expiresMs = Date.parse(signed.expires_at);\n const freshOk = Number.isFinite(expiresMs) && expiresMs > now.getTime();\n checks.push({\n ok: freshOk,\n label: 'now < attestation.expires_at',\n detail: freshOk\n ? `expires ${new Date(expiresMs).toISOString()}`\n : 'attestation has expired',\n });\n if (!freshOk) return { ok: false, reason: 'attestation has expired', checks };\n\n return { ok: true, attestation: signed, checks };\n}\n\n/** Force-refresh the envelope-JWKS cache · useful after a key rotation\n * if you don't want to wait for the TTL to expire. */\nexport async function refreshEnvelopeJwks(issuer = DEFAULT_ISSUER): Promise<void> {\n jwksCache.delete(issuer);\n await fetchEnvelopeJwks(issuer, DEFAULT_TTL_MS);\n}\n\nexport const identity = {\n verifyActivityAttestation,\n refreshEnvelopeJwks,\n};\n","/**\n * @orangecheck/me-client/server\n *\n * Server-side verification helpers for OC integrators.\n *\n * import {\n * withOcAuth,\n * getOcSession,\n * verifyOcToken,\n * verifyActivityAttestation,\n * } from '@orangecheck/me-client/server';\n *\n * Zero env vars, zero JWK handling. Internally lazy-fetches the auth\n * host's JWKS at https://ochk.io/.well-known/jwks.json and the\n * envelope JWKS at https://me.ochk.io/.well-known/oc-envelope-jwks.json,\n * caches both in-process. Integrators write code; we handle the crypto.\n *\n * Three layers of session verification, smallest to thickest:\n *\n * verifyOcToken(token) → SessionPayload | null\n * getOcSession(headers) → SessionPayload | null (cookie OR Bearer)\n * withOcAuth(handler) → Next.js Pages adapter that injects\n * req.ocSession on the request object\n * ocAuthExpress(opts?) → Express / Connect middleware\n * ocAuthHono(opts?) → Hono middleware\n *\n * Plus the activity-attestation verifier · for sybil-resistance gating:\n *\n * verifyActivityAttestation(bundle, opts?) → ActivityVerifyResult\n *\n * Same envelope-JWKS verification posture as the public /verify-activity\n * page; same five checks (shape / id / kid / sig / freshness). Use to\n * gate sensitive flows on cross-integrator lifetime_sats + duration +\n * distinct_count + active_days · all values are content-addressed and\n * signed.\n *\n * All thin wrappers around the same crypto primitives. Bring your own\n * framework.\n */\n\nimport {\n bondMeets,\n getOcSession as getOcSessionCore,\n readBondClaim,\n verifyOcToken,\n type BondClaim,\n type SessionPayload,\n type VerifyOcOptions,\n type SessionRequestHeaders,\n} from '@orangecheck/auth-core';\n\nexport { bondMeets, readBondClaim, verifyOcToken };\nexport type { BondClaim, SessionPayload, VerifyOcOptions };\n\n// Activity-attestation verifier · re-export from the identity module so\n// server-side integrators get the gating helper alongside session\n// verification without a second import path.\nexport {\n identity,\n verifyActivityAttestation,\n refreshEnvelopeJwks,\n} from './identity';\nexport type {\n ActivityAttestation,\n ActivityAttestationBundle,\n ActivityVerifyCheck,\n ActivityVerifyResult,\n VerifyActivityOptions,\n} from './identity';\n\n/**\n * Verify the OC session for a request. Accepts either:\n *\n * - A Web Headers object (Hono / edge / Fetch API): `c.req.raw.headers`\n * - A plain `{ cookie, authorization }` object (Express / Next.js Pages /\n * Fastify / etc.): `{ cookie: req.headers.cookie, authorization: req.headers.authorization }`\n *\n * Reads the `oc_session` cookie first; falls back to\n * `Authorization: Bearer <token>` so cross-domain integrators (no\n * .ochk.io cookie reach) verify the same way.\n *\n * Returns `null` for unauthenticated requests. Never throws.\n */\nexport async function getOcSession(\n headers: SessionRequestHeaders | Headers,\n options: VerifyOcOptions = {}\n): Promise<SessionPayload | null> {\n const session = await getOcSessionCore(headers, options);\n if (!session && options.audience === undefined) warnIfAudienceMissing(headers);\n return session;\n}\n\nlet warnedAudience = false;\n\n/**\n * The popup issues a token bound to your site's origin. Verified with no\n * `audience`, it is refused — correctly, since a verifier with no audience\n * accepts only family sessions — and every popup sign-in would 401 with no\n * clue why. Say so, once, the first time it happens.\n */\nfunction warnIfAudienceMissing(headers: SessionRequestHeaders | Headers): void {\n if (warnedAudience) return;\n const web = typeof Headers !== 'undefined' && headers instanceof Headers;\n const auth = web ? headers.get('authorization') : (headers as SessionRequestHeaders).authorization;\n const cookie = web ? headers.get('cookie') : (headers as SessionRequestHeaders).cookie;\n // The token arrives as a Bearer, or in the oc_session cookie your own route set.\n const bearer = typeof auth === 'string' ? /^Bearer\\s+(\\S+)$/i.exec(auth.trim())?.[1] : undefined;\n const fromCookie =\n typeof cookie === 'string' ? /(?:^|;\\s*)oc_session=([^;]+)/.exec(cookie)?.[1] : undefined;\n const m = /^([^.]+)\\.([^.]+)\\./.exec(bearer ?? fromCookie ?? '');\n if (!m) return;\n try {\n const payload = JSON.parse(base64UrlToString(m[2]!)) as { aud?: unknown };\n if (payload.aud === undefined) return;\n warnedAudience = true;\n console.warn(\n `[@orangecheck/me-client] a sign-in token bound to ${JSON.stringify(payload.aud)} was refused ` +\n 'because no `audience` is configured. Pass your site origin, e.g. ' +\n \"withOcAuth(handler, { audience: 'https://your-site.example' }).\"\n );\n } catch {\n // Not a JWT we can read · nothing useful to say.\n }\n}\n\nfunction base64UrlToString(s: string): string {\n const b64 = s.replace(/-/g, '+').replace(/_/g, '/');\n if (typeof atob === 'function') return atob(b64 + '='.repeat((4 - (b64.length % 4)) % 4));\n return Buffer.from(s, 'base64url').toString('utf8');\n}\n\n// ─── Next.js Pages Router adapter ────────────────────────────────────────\n\ninterface NextApiRequestLike {\n headers: { cookie?: string; authorization?: string; [k: string]: unknown };\n ocSession?: SessionPayload | null;\n}\ninterface NextApiResponseLike {\n status(code: number): NextApiResponseLike;\n json(body: unknown): unknown;\n setHeader(name: string, value: string | number | readonly string[]): unknown;\n}\n/** A request with the verified session attached: `WithOcSession<NextApiRequest>`. */\nexport type WithOcSession<Req> = Req & { ocSession?: SessionPayload | null };\n\nexport interface WithOcAuthOptions extends VerifyOcOptions {\n /** When true, unauthenticated requests get a 401 + `{ok:false}` response\n * before the wrapped handler runs. Default: false — handler runs and\n * receives `req.ocSession === null`, useful when the route serves both\n * signed-in and anonymous users. */\n required?: boolean;\n /**\n * Refuse a signed-in account (403, `reason: 'bond_required'`) unless a\n * bond backs it: one unspent coin of at least `minSats`, unspent at least\n * `minDays` days, checked within `maxAgeSecs`. The app never learns the\n * coin; `req.ocSession.oc_bond.nullifier` is the same for the same coin at\n * your site, so ban that to ban the coin. Implies `required`.\n */\n requireBond?: { minSats?: number; minDays?: number; maxAgeSecs?: number };\n /**\n * Your project key. The requirement you set in the project's settings\n * (\"who can sign in\") is read from me.ochk.io within a minute of a change\n * and enforced like `requireBond`, so you change it there, not in code.\n * An explicit `requireBond` wins over it.\n */\n projectKey?: string;\n /** Where the project config is read. Default https://me.ochk.io. */\n meOrigin?: string;\n}\n\ntype BondNeed = NonNullable<WithOcAuthOptions['requireBond']>;\n/** Where someone turned away for want of backing can back their account. */\nexport const BACK_ACCOUNT_URL = 'https://ochk.app/me/account#backing';\n/** Keys me.ochk.io answered 404 for, and when; re-checked after a minute. */\nconst unknownKeys = new Map<string, number>();\nconst UNKNOWN_PROJECT = Symbol('unknown_project');\nconst POLICY_TTL_MS = 60_000;\n/** After a failed read, how long before me.ochk.io is asked again. */\nconst POLICY_RETRY_MS = 10_000;\nconst policies = new Map<string, { at: number; need: BondNeed | null; failedAt?: number }>();\n\n/**\n * The project's requirement, from its uncached sign-in endpoint, held a\n * minute here. (The price config is edge-cached for ten minutes: reading the\n * requirement there let a just-tightened app keep admitting unbacked accounts.)\n * When it can't be read, the last one read stands, and the next try waits ten\n * seconds so an outage doesn't hold every request; with none read yet it is\n * `undefined`, and the request is refused rather than let through unchecked.\n */\nasync function projectRequirement(\n options: WithOcAuthOptions\n): Promise<BondNeed | null | undefined | typeof UNKNOWN_PROJECT> {\n const key = options.projectKey!;\n const hit = policies.get(key);\n const now = Date.now();\n if (unknownKeys.has(key) && now - unknownKeys.get(key)! < POLICY_TTL_MS) return UNKNOWN_PROJECT;\n if (hit && now - hit.at < POLICY_TTL_MS) return hit.need;\n if (hit?.failedAt && now - hit.failedAt < POLICY_RETRY_MS) return hit.at ? hit.need : undefined;\n try {\n const base = options.meOrigin ?? 'https://me.ochk.io';\n const r = await fetch(`${base}/api/integrator/${encodeURIComponent(key)}/sign-in`, {\n signal: AbortSignal.timeout(4000),\n });\n // A key that names no project is a setup mistake, not an outage: say so once.\n if (r.status === 404) {\n if (!unknownKeys.has(key)) {\n console.error(\n `[@orangecheck/me-client] projectKey \"${key}\" is not a project. Copy yours from https://ochk.app/me/projects.`\n );\n }\n unknownKeys.set(key, Date.now());\n return UNKNOWN_PROJECT;\n }\n unknownKeys.delete(key);\n if (!r.ok) throw new Error(`HTTP ${r.status}`);\n const j = (await r.json()) as {\n require_bond?: { min_sats: number; min_days: number } | null;\n };\n const req = j.require_bond ?? null;\n const need = req ? { minSats: req.min_sats, minDays: req.min_days } : null;\n policies.set(key, { at: Date.now(), need });\n return need;\n } catch {\n policies.set(key, { at: hit?.at ?? 0, need: hit?.need ?? null, failedAt: Date.now() });\n return hit?.at ? hit.need : undefined;\n }\n}\n\n/** The requirement in force: explicit, else the project's, else none. */\nasync function bondNeed(\n options: WithOcAuthOptions\n): Promise<BondNeed | null | undefined | typeof UNKNOWN_PROJECT> {\n if (options.requireBond) return options.requireBond;\n if (options.projectKey) return projectRequirement(options);\n return null;\n}\n\n/** Why a session can't pass, as a status and body, or null when it can. */\nasync function refusal(\n session: SessionPayload | null,\n options: WithOcAuthOptions\n): Promise<{ status: number; body: Record<string, unknown> } | null> {\n const need = await bondNeed(options);\n if (!session && options.required) {\n return { status: 401, body: { ok: false, reason: 'unauthenticated' } };\n }\n if (need === UNKNOWN_PROJECT) {\n return { status: 500, body: { ok: false, reason: 'unknown_project_key' } };\n }\n if (need === undefined) {\n return { status: 503, body: { ok: false, reason: 'bond_policy_unavailable' } };\n }\n if (!session) {\n return need ? { status: 401, body: { ok: false, reason: 'unauthenticated' } } : null;\n }\n if (need && !bondMeets(session, need)) {\n const have = readBondClaim(session);\n return {\n status: 403,\n body: {\n ok: false,\n reason: 'bond_required',\n need: {\n min_sats: need.minSats ?? 0,\n min_days: need.minDays ?? 0,\n ...(need.maxAgeSecs !== undefined ? { max_age_secs: need.maxAgeSecs } : {}),\n },\n have: have ? { sats_floor: have.sats_floor, days_floor: have.days_floor } : null,\n back_url: BACK_ACCOUNT_URL,\n },\n };\n }\n return null;\n}\n\n/**\n * Wrap a Next.js Pages-Router API route handler. Adds `req.ocSession` —\n * the verified SessionPayload, or null when unauthenticated.\n *\n * // pages/api/me/profile.ts\n * import { withOcAuth } from '@orangecheck/me-client/server';\n *\n * export default withOcAuth(async (req, res) => {\n * if (!req.ocSession) return res.status(401).json({ ok: false });\n * res.status(200).json({ account: { address: req.ocSession.did_oc } });\n * }, { required: true, audience: 'https://your-site.example' });\n *\n * `audience` is your own origin. The sign-in popup issues each site a token\n * bound to it; a site on *.ochk.io that reads the family cookie omits it.\n *\n * `Cache-Control: no-store, private` and `Vary: Cookie, Authorization`\n * are set on every authenticated response — without them a cached 401\n * leaks anonymous to authenticated callers.\n */\nexport function withOcAuth<\n Req extends NextApiRequestLike = NextApiRequestLike,\n Res extends NextApiResponseLike = NextApiResponseLike,\n>(\n handler: (req: WithOcSession<Req>, res: Res) => unknown,\n options: WithOcAuthOptions = {}\n): (req: Req, res: Res) => Promise<unknown> {\n return async (req: Req, res: Res) => {\n res.setHeader('Cache-Control', 'no-store, private');\n res.setHeader('Vary', 'Cookie, Authorization');\n const session = await getOcSession(\n {\n cookie: typeof req.headers.cookie === 'string' ? req.headers.cookie : null,\n authorization:\n typeof req.headers.authorization === 'string'\n ? req.headers.authorization\n : null,\n },\n options\n );\n const withSession = req as WithOcSession<Req>;\n withSession.ocSession = session;\n const refused = await refusal(session, options);\n if (refused) return res.status(refused.status).json(refused.body);\n return handler(withSession, res);\n };\n}\n\n// ─── Express / Connect middleware ────────────────────────────────────────\n\n// `req.ocSession` on Express's own Request type, so `ocAuthExpress()` routes\n// type-check without a cast. Inert when @types/express is absent.\ndeclare global {\n // eslint-disable-next-line @typescript-eslint/no-namespace\n namespace Express {\n interface Request {\n ocSession?: SessionPayload | null;\n }\n }\n}\n\n/** Hono env for `ocAuthHono()`: `new Hono<OcHonoEnv>()` types `c.get('ocSession')`. */\nexport type OcHonoEnv = { Variables: { ocSession: SessionPayload | null } };\n\ninterface ExpressRequestLike {\n headers: { cookie?: string; authorization?: string; [k: string]: unknown };\n ocSession?: SessionPayload | null;\n}\ninterface ExpressResponseLike {\n status(code: number): ExpressResponseLike;\n json(body: unknown): unknown;\n setHeader(name: string, value: string | number | readonly string[]): unknown;\n}\ntype ExpressNextLike = (err?: unknown) => void;\n\n/**\n * Express / Connect middleware. Attaches `req.ocSession` (verified\n * SessionPayload | null) and calls next(). Use it as a global middleware\n * or per-route.\n *\n * import express from 'express';\n * import { ocAuthExpress } from '@orangecheck/me-client/server';\n *\n * const app = express();\n * app.use(ocAuthExpress());\n *\n * app.get('/api/profile', (req, res) => {\n * if (!req.ocSession) return res.status(401).json({ error: 'sign in' });\n * res.json({ address: req.ocSession.did_oc });\n * });\n *\n * Pass `{ required: true }` to short-circuit unauthenticated requests\n * with a 401 before they reach your handler.\n */\nexport function ocAuthExpress(options: WithOcAuthOptions = {}) {\n return async (req: ExpressRequestLike, res: ExpressResponseLike, next: ExpressNextLike) => {\n try {\n res.setHeader('Cache-Control', 'no-store, private');\n res.setHeader('Vary', 'Cookie, Authorization');\n const session = await getOcSession(\n {\n cookie: typeof req.headers.cookie === 'string' ? req.headers.cookie : null,\n authorization:\n typeof req.headers.authorization === 'string'\n ? req.headers.authorization\n : null,\n },\n options\n );\n req.ocSession = session;\n const refused = await refusal(session, options);\n if (refused) {\n res.status(refused.status).json(refused.body);\n return;\n }\n next();\n } catch (err) {\n next(err);\n }\n };\n}\n\n// ─── Hono middleware ─────────────────────────────────────────────────────\n\ninterface HonoContextLike {\n req: { raw: { headers: Headers } };\n set(key: string, value: unknown): void;\n json(body: unknown, status?: number): unknown;\n header(name: string, value: string): void;\n}\ntype HonoNextLike = () => Promise<void>;\n\n/**\n * Hono middleware. Attaches the verified session at `c.get('ocSession')`.\n *\n * import { Hono } from 'hono';\n * import { ocAuthHono, type OcHonoEnv } from '@orangecheck/me-client/server';\n *\n * const app = new Hono<OcHonoEnv>();\n * app.use('*', ocAuthHono());\n *\n * app.get('/api/profile', (c) => {\n * const session = c.get('ocSession');\n * if (!session) return c.json({ error: 'sign in' }, 401);\n * return c.json({ address: session.did_oc });\n * });\n */\nexport function ocAuthHono(options: WithOcAuthOptions = {}) {\n return async (c: HonoContextLike, next: HonoNextLike) => {\n c.header('Cache-Control', 'no-store, private');\n c.header('Vary', 'Cookie, Authorization');\n const session = await getOcSession(c.req.raw.headers, options);\n c.set('ocSession', session);\n const refused = await refusal(session, options);\n if (refused) return c.json(refused.body, refused.status);\n await next();\n };\n}\n"]}
1
+ {"version":3,"sources":["../node_modules/jose/dist/webapi/lib/buffer_utils.js","../node_modules/jose/dist/webapi/util/errors.js","../node_modules/jose/dist/webapi/util/base64url.js","../node_modules/jose/dist/webapi/lib/validate.js","../node_modules/jose/dist/webapi/lib/key.js","../node_modules/jose/dist/webapi/lib/key_descriptor.js","../node_modules/jose/dist/webapi/lib/jwe_algorithms.js","../node_modules/jose/dist/webapi/lib/jws_algorithms.js","../node_modules/jose/dist/webapi/lib/key_algorithm.js","../node_modules/jose/dist/webapi/key/import.js","../src/identity.ts","../src/server.ts"],"names":["sig","getOcSessionCore"],"mappings":";;;;;;;;AAAgB,IAAI,WAAA;AAApB,IAAmC,OAAA,GAAU,IAAI,WAAA,EAAY;AAAmB,IAAI,WAAA,CAAY,SAAS,EAAE,KAAA,EAAO,MAAI;AA8CtH,SAAS,YAAA,CAAa,OAAA,EAAS,GAAA,GAAM,KAAA,EAAI;AACvC,EAAA,IAAI,UAAA,CAAW,UAAA;AACb,IAAA,OAAO,UAAA,CAAW,WAAW,OAAA,EAAS,EAAE,UAAU,GAAA,GAAM,WAAA,GAAc,UAAU,CAAA;AAClF,EAAA,IAAI,GAAA,EAAK;AACP,IAAA,IAAI,QAAQ,QAAA,CAAS,GAAG,CAAA,IAAK,OAAA,CAAQ,SAAS,GAAG,CAAA;AAC/C,MAAA,MAAM,IAAI,UAAU,mBAAmB,CAAA;AACzC,IAAA,OAAA,GAAU,QAAQ,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AAAA,EACxD;AACA,EAAA,MAAM,MAAA,GAAS,KAAK,OAAO,CAAA,EAAG,QAAQ,IAAI,UAAA,CAAW,OAAO,MAAM,CAAA;AAClE,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,MAAA,EAAQ,CAAA,EAAA;AACjC,IAAA,KAAA,CAAM,CAAC,CAAA,GAAI,MAAA,CAAO,UAAA,CAAW,CAAC,CAAA;AAChC,EAAA,OAAO,KAAA;AACT;;;AC1DA,IAAM,SAAA,GAAN,cAAwB,KAAA,CAAM;AAAA,EAG5B,WAAA,CAAY,SAAS,OAAA,EAAS;AAC5B,IAAA,KAAA,CAAM,SAAS,OAAO,CAAA;AAFxB,IAAA,aAAA,CAAA,IAAA,EAAA,MAAA,EAAO,kBAAA,CAAA;AAEoB,IAAA,IAAA,CAAK,IAAA,GAAO,KAAK,WAAA,CAAY,IAAA,EAAM,MAAM,iBAAA,GAAoB,IAAA,EAAM,KAAK,WAAW,CAAA;AAAA,EAC9G;AACF,CAAA;AALE,aAAA,CADI,WACG,MAAA,EAAO,kBAAA,CAAA;AA8BhB,IAAM,gBAAA,GAAN,cAA+B,SAAA,CAAU;AAAA,EAAzC,WAAA,GAAA;AAAA,IAAA,KAAA,CAAA,GAAA,SAAA,CAAA;AAEE,IAAA,aAAA,CAAA,IAAA,EAAA,MAAA,EAAO,wBAAA,CAAA;AAAA,EAAA;AACT,CAAA;AAFE,aAAA,CADI,kBACG,MAAA,EAAO,wBAAA,CAAA;AAhChB,IAAA,EAAA,EAAA,EAAA;AAqEA,IAAM,wBAAA,GAAN,eAAuC,EAAA,GAAA,SAAA,EACpC,EAAA,GAAA,MAAA,CAAO,eAD6B,EAAA,EAAU;AAAA,EAK/C,WAAA,CAAY,OAAA,GAAU,sDAAA,EAAwD,OAAA,EAAS;AACrF,IAAA,KAAA,CAAM,SAAS,OAAO,CAAA;AALxB,IAAA,aAAA,CAAA,IAAA,EAAC,IAAwB,mBAAmB;AAAA,IAC5C,CAAA,CAAA;AAEA,IAAA,aAAA,CAAA,IAAA,EAAA,MAAA,EAAO,iCAAA,CAAA;AAAA,EAGP;AACF,CAAA;AALE,aAAA,CAHI,0BAGG,MAAA,EAAO,iCAAA,CAAA;;;ACvEhB,IAAM,OAAA,GAAU,mDAAA;AAChB,SAAS,OAAO,KAAA,EAAO;AACrB,EAAA,IAAI;AACF,IAAA,OAAO,YAAA,CAAa,OAAO,KAAA,IAAS,QAAA,GAAW,QAAQ,OAAA,CAAQ,MAAA,CAAO,KAAK,CAAA,EAAG,IAAE,CAAA;AAAA,EAClF,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,SAAA,CAAU,OAAA,EAAS,EAAE,OAAO,CAAA;AAAA,EACxC;AACF;;;ACDA,SAAS,SAAS,KAAA,EAAO;AACvB,EAAA,IAAI,OAAO,KAAA,IAAS,QAAA,IAAY,KAAA,KAAU,IAAA,IAAQ,OAAO,SAAA,CAAU,QAAA,CAAS,IAAA,CAAK,KAAK,CAAA,KAAM,iBAAA;AAC1F,IAAA,OAAO,KAAA;AACT,EAAA,MAAM,SAAA,GAAY,MAAA,CAAO,cAAA,CAAe,KAAK,CAAA;AAC7C,EAAA,OAAO,SAAA,KAAc,IAAA,IAAQ,MAAA,CAAO,cAAA,CAAe,SAAS,CAAA,KAAM,IAAA;AACpE;;;ACkGA,SAAS,YAAY,GAAA,EAAK;AACxB,EAAA,OAAO,EAAE,SAAA,EAAW,IAAA,EAAM,GAAG,GAAA,EAAI;AACnC;AACA,SAAS,aAAa,GAAA,EAAK;AACzB,EAAA,MAAM,UAAA,GAAa,YAAY,GAAG,CAAA;AAClC,EAAA,IAAI,UAAA,CAAW,GAAA,KAAQ,MAAA,IAAU,OAAO,WAAW,GAAA,IAAO,SAAA;AACxD,IAAA,MAAM,IAAI,UAAU,iDAAiD,CAAA;AACvE,EAAA,IAAI,UAAA,CAAW,YAAY,MAAA,EAAQ;AACjC,IAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,OAAA,EAAS,MAAA,GAAS,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,GAAI,CAAC,GAAG,KAAK,CAAA,GAAI,MAAA;AAC/E,IAAA,IAAI,CAAC,MAAA,IAAU,MAAA,CAAO,IAAA,CAAK,CAAC,SAAA,KAAc,OAAO,SAAA,IAAa,QAAQ,KAAK,IAAI,GAAA,CAAI,MAAM,CAAA,CAAE,SAAS,MAAA,CAAO,MAAA;AACzG,MAAA,MAAM,IAAI,UAAU,yEAAyE,CAAA;AAC/F,IAAA,UAAA,CAAW,OAAA,GAAU,MAAA;AAAA,EACvB;AACA,EAAA,OAAO,UAAA;AACT;AAMA,eAAe,QAAA,CAAS,KAAA,EAAO,GAAA,EAAK,WAAA,EAAa;AAC/C,EAAA,IAAI,CAAC,KAAA,CAAM,GAAA,CAAI,QAAA,CAAS,IAAI,GAAG,CAAA;AAC7B,IAAA,MAAM,IAAI,iBAAiB,8DAA8D,CAAA;AAC3F,EAAA,MAAM,SAAA,GAAY,KAAA,CAAM,OAAA,GAAU,EAAE,GAAA,EAAK,GAAA,CAAI,GAAA,EAAK,GAAA,EAAK,GAAA,CAAI,GAAA,EAAK,CAAA,IAAK,KAAA,CAAM,MAAA,EAAQ,SAAA,GAAY,CAAC,EAAE,GAAA,CAAI,CAAA,IAAK,GAAA,CAAI,IAAA,CAAA,EAAO,OAAA,GAAU,EAAE,GAAG,GAAA,EAAK,GAAA,EAAoB,GAAA,CAAI,GAAA,EAAI;AACtK,EAAA,OAAO,OAAA,CAAQ,GAAA,KAAQ,KAAA,IAAS,OAAO,OAAA,CAAQ,GAAA,EAAK,OAAO,OAAA,CAAQ,GAAA,EAAK,MAAA,CAAO,MAAA,CAAO,SAAA,CAAU,KAAA,EAAO,SAAS,SAAA,EAAW,OAAA,CAAQ,GAAA,IAAO,CAAC,SAAA,EAAW,GAAA,CAAI,OAAA,IAAW,KAAA,CAAM,MAAA,CAAO,SAAA,GAAY,CAAA,GAAI,CAAC,CAAC,CAAA;AACtM;;;ACvIA,SAAS,MAAM,OAAA,EAAS;AACtB,EAAA,MAAM,GAAA,GAAM,EAAE,SAAA,EAAW,IAAA,EAAK;AAC9B,EAAA,KAAA,MAAW,GAAA,IAAO,OAAA;AAChB,IAAA,GAAA,CAAI,GAAG,CAAA,GAAI,EAAE,GAAG,OAAA,CAAQ,GAAG,GAAG,GAAA,EAAI;AACpC,EAAA,OAAO,GAAA;AACT;;;ACHA,IAAM,IAAA,GAAO;AAAA,EACX,CAAC,WAAW,SAAS,CAAA;AAAA,EACrB,CAAC,WAAW,WAAW;AACzB,CAAA;AAHA,IAGG,SAAS,CAAC,EAAC,EAAG,CAAC,YAAY,CAAC,CAAA;AAH/B,IAGkC,IAAA,GAAO,CAAC,EAAC,EAAG,EAAE,CAAA;AAChD,SAAS,MAAM,IAAA,EAAM;AACnB,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,CAAC,KAAK,CAAA;AAAA,IACX,IAAA,EAAM,gBAAA;AAAA,IACN,QAAQ,EAAE,IAAA,EAAM,YAAY,IAAA,EAAM,CAAA,IAAA,EAAO,IAAI,CAAA,CAAA,EAAG;AAAA,IAChD,MAAA,EAAQ,IAAA;AAAA,IACR,GAAA,EAAK,CAAC,SAAA,EAAW,WAAW;AAAA,GAC9B;AACF;AACA,SAAS,KAAK,IAAA,EAAM;AAClB,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,CAAC,IAAA,EAAM,KAAK,CAAA;AAAA,IACjB,IAAA;AAAA,IACA,MAAA,EAAQ,EAAE,IAAA,EAAM,MAAA,EAAO;AAAA,IACvB,SAAS,CAAC,EAAE,GAAA,EAAK,GAAA,EAAK,mBAAkB,KAAM;AAC5C,MAAA,IAAI,GAAA,KAAQ,YAAY,iBAAA,KAAsB,QAAA;AAC5C,QAAA,OAAO,EAAE,MAAM,QAAA,EAAS;AAC1B,MAAA,IAAI,GAAA,KAAQ,KAAA;AACV,QAAA,MAAM,IAAI,iBAAiB,8DAA8D,CAAA;AAC3F,MAAA,OAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,UAAA,EAAY,GAAA,EAAI;AAAA,IACzC,CAAA;AAAA,IACA,MAAA,EAAQ,MAAA;AAAA,IACR,GAAA,EAAK,CAAC,MAAA,EAAQ,YAAY;AAAA,GAC5B;AACF;AACA,SAAS,KAAA,CAAM,IAAA,EAAM,GAAA,GAAM,KAAA,EAAI;AAC7B,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,CAAC,KAAK,CAAA;AAAA,IACX,IAAA,EAAM,cAAA;AAAA,IACN,MAAA,EAAQ,IAAA;AAAA,IACR,QAAQ,EAAE,IAAA,EAAM,MAAM,SAAA,GAAY,QAAA,EAAU,QAAQ,IAAA,EAAK;AAAA,IACzD,MAAA,EAAQ,IAAA;AAAA,IACR,GAAA,EAAK,MAAM,CAAC,SAAA,EAAW,SAAS,CAAA,GAAI,CAAC,WAAW,WAAW;AAAA,GAC7D;AACF;AACA,SAAS,KAAA,GAAQ;AACf,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,CAAC,KAAK,CAAA;AAAA,IACX,IAAA,EAAM,cAAA;AAAA,IACN,MAAA,EAAQ,IAAA;AAAA,IACR,MAAA,EAAQ,EAAE,IAAA,EAAM,QAAA,EAAS;AAAA,IACzB,MAAA,EAAQ,IAAA;AAAA,IACR,GAAA,EAAK,CAAC,YAAA,EAAc,YAAY;AAAA,GAClC;AACF;AACA,IAAM,MAAM,KAAA,CAAM;AAAA,EAChB,GAAA,EAAK;AAAA,IACH,GAAA,EAAK,CAAC,KAAK,CAAA;AAAA,IACX,IAAA,EAAM,mBAAA;AAAA,IACN,MAAA,EAAQ,IAAA;AAAA,IACR,MAAA,EAAQ,EAAE,IAAA,EAAM,SAAA,EAAU;AAAA,IAC1B,MAAA,EAAQ,IAAA;AAAA,IACR,GAAA,EAAK,CAAC,SAAA,EAAW,SAAS;AAAA,GAC5B;AAAA,EACA,UAAA,EAAY,MAAM,CAAC,CAAA;AAAA,EACnB,cAAA,EAAgB,MAAM,GAAG,CAAA;AAAA,EACzB,cAAA,EAAgB,MAAM,GAAG,CAAA;AAAA,EACzB,cAAA,EAAgB,MAAM,GAAG,CAAA;AAAA,EACzB,SAAA,EAAW,KAAK,sBAAsB,CAAA;AAAA,EACtC,gBAAA,EAAkB,KAAK,iCAAiC,CAAA;AAAA,EACxD,gBAAA,EAAkB,KAAK,iCAAiC,CAAA;AAAA,EACxD,gBAAA,EAAkB,KAAK,iCAAiC,CAAA;AAAA,EACxD,MAAA,EAAQ,MAAM,GAAG,CAAA;AAAA,EACjB,MAAA,EAAQ,MAAM,GAAG,CAAA;AAAA,EACjB,MAAA,EAAQ,MAAM,GAAG,CAAA;AAAA,EACjB,SAAA,EAAW,KAAA,CAAM,GAAA,EAAK,IAAE,CAAA;AAAA,EACxB,SAAA,EAAW,KAAA,CAAM,GAAA,EAAK,IAAE,CAAA;AAAA,EACxB,SAAA,EAAW,KAAA,CAAM,GAAA,EAAK,IAAE,CAAA;AAAA,EACxB,sBAAsB,KAAA,EAAM;AAAA,EAC5B,sBAAsB,KAAA,EAAM;AAAA,EAC5B,sBAAsB,KAAA;AACxB,CAAC,CAAA;AA1BD,IA0BI,UAAA,GAAa,CAAC,SAAA,EAAW,SAAS,CAAA;AACtC,SAAS,iBAAA,CAAkB,IAAA,EAAM,GAAA,GAAM,KAAA,EAAI;AACzC,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,CAAC,KAAK,CAAA;AAAA,IACX,MAAA,EAAQ,IAAA;AAAA,IACR,QAAQ,EAAE,IAAA,EAAM,MAAM,SAAA,GAAY,SAAA,EAAW,QAAQ,IAAA,EAAK;AAAA,IAC1D,MAAA,EAAQ,IAAA;AAAA,IACR,GAAA,EAAK,UAAA;AAAA,IACL,OAAA,EAAS,IAAA;AAAA,IACT,MAAA,EAAQ,MAAM,GAAA,GAAM,EAAA;AAAA,IACpB;AAAA,GACF;AACF;AACY,KAAA,CAAM;AAAA,EAChB,OAAA,EAAS,kBAAkB,GAAG,CAAA;AAAA,EAC9B,OAAA,EAAS,kBAAkB,GAAG,CAAA;AAAA,EAC9B,OAAA,EAAS,kBAAkB,GAAG,CAAA;AAAA,EAC9B,eAAA,EAAiB,iBAAA,CAAkB,GAAA,EAAK,IAAE,CAAA;AAAA,EAC1C,eAAA,EAAiB,iBAAA,CAAkB,GAAA,EAAK,IAAE,CAAA;AAAA,EAC1C,eAAA,EAAiB,iBAAA,CAAkB,GAAA,EAAK,IAAE;AAC5C,CAAC;;;AC/FD,IAAM,MAAM,CAAC,CAAC,QAAQ,CAAA,EAAG,CAAC,MAAM,CAAC,CAAA;AACjC,SAAS,KAAK,IAAA,EAAM;AAClB,EAAA,MAAM,SAAS,EAAE,IAAA,EAAM,QAAQ,IAAA,EAAM,CAAA,IAAA,EAAO,IAAI,CAAA,CAAA,EAAG;AACnD,EAAA,OAAO,EAAE,GAAA,EAAK,CAAC,KAAK,CAAA,EAAG,MAAA,EAAQ,IAAA,EAAI,MAAA,EAAQ,OAAA,EAAS,MAAA,EAAQ,MAAA,EAAQ,GAAA,EAAI;AAC1E;AACA,SAAS,GAAA,CAAI,MAAM,UAAA,EAAY;AAC7B,EAAA,MAAM,MAAA,GAAS,EAAE,IAAA,EAAM,UAAA,GAAa,YAAY,mBAAA,EAAqB,IAAA,EAAM,CAAA,IAAA,EAAO,IAAI,CAAA,CAAA,EAAG;AACzF,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,CAAC,KAAK,CAAA;AAAA,IACX,MAAA;AAAA,IACA,SAAS,UAAA,GAAa,EAAE,GAAG,MAAA,EAAQ,YAAW,GAAI,MAAA;AAAA,IAClD,MAAA,EAAQ,GAAA;AAAA,IACR,UAAA,EAAY;AAAA,GACd;AACF;AACA,SAAS,KAAA,CAAM,KAAK,IAAA,EAAM;AACxB,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,CAAC,IAAI,CAAA;AAAA,IACV,GAAA;AAAA,IACA,MAAA,EAAQ,EAAE,IAAA,EAAM,OAAA,EAAS,YAAY,GAAA,EAAI;AAAA,IACzC,SAAS,EAAE,IAAA,EAAM,SAAS,IAAA,EAAM,CAAA,IAAA,EAAO,IAAI,CAAA,CAAA,EAAG;AAAA,IAC9C,MAAA,EAAQ;AAAA,GACV;AACF;AACA,SAAS,KAAA,GAAQ;AACf,EAAA,MAAM,MAAA,GAAS,EAAE,IAAA,EAAM,SAAA,EAAU;AACjC,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,CAAC,KAAK,CAAA;AAAA,IACX,GAAA,EAAK,SAAA;AAAA,IACL,MAAA;AAAA,IACA,OAAA,EAAS,MAAA;AAAA,IACT,MAAA,EAAQ;AAAA,GACV;AACF;AACA,SAAS,MAAM,YAAA,EAAc;AAC3B,EAAA,MAAM,MAAA,GAAS,EAAE,IAAA,EAAM,CAAA,OAAA,EAAU,YAAY,CAAA,CAAA,EAAG;AAChD,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,CAAC,KAAK,CAAA;AAAA,IACX,MAAA;AAAA,IACA,OAAA,EAAS,MAAA;AAAA,IACT,MAAA,EAAQ;AAAA,GACV;AACF;AACA,IAAM,MAAM,KAAA,CAAM;AAAA,EAChB,KAAA,EAAO,KAAK,GAAG,CAAA;AAAA,EACf,KAAA,EAAO,KAAK,GAAG,CAAA;AAAA,EACf,KAAA,EAAO,KAAK,GAAG,CAAA;AAAA,EACf,KAAA,EAAO,IAAI,GAAG,CAAA;AAAA,EACd,KAAA,EAAO,IAAI,GAAG,CAAA;AAAA,EACd,KAAA,EAAO,IAAI,GAAG,CAAA;AAAA,EACd,KAAA,EAAO,GAAA,CAAI,GAAA,EAAK,EAAE,CAAA;AAAA,EAClB,KAAA,EAAO,GAAA,CAAI,GAAA,EAAK,EAAE,CAAA;AAAA,EAClB,KAAA,EAAO,GAAA,CAAI,GAAA,EAAK,EAAE,CAAA;AAAA,EAClB,KAAA,EAAO,KAAA,CAAM,OAAA,EAAS,GAAG,CAAA;AAAA,EACzB,KAAA,EAAO,KAAA,CAAM,OAAA,EAAS,GAAG,CAAA;AAAA,EACzB,KAAA,EAAO,KAAA,CAAM,OAAA,EAAS,GAAG,CAAA;AAAA,EACzB,OAAO,KAAA,EAAM;AAAA,EACb,SAAS,KAAA,EAAM;AAAA,EACf,WAAA,EAAa,MAAM,EAAE,CAAA;AAAA,EACrB,WAAA,EAAa,MAAM,EAAE,CAAA;AAAA,EACrB,WAAA,EAAa,MAAM,EAAE;AACvB,CAAC,CAAA;;;AC3DD,SAAS,cAAA,CAAe,SAAS,iCAAA,EAAmC;AAClE,EAAA,MAAM,IAAI,gBAAA,CAAiB,CAAA,uBAAA,EAA0B,MAAM,CAAA,MAAA,CAAQ,CAAA;AACrE;AACA,SAAS,YAAA,CAAa,KAAK,MAAA,EAAQ;AACjC,EAAA,OAAA,CAAQ,OAAO,GAAA,IAAO,QAAA,GAAW,GAAA,CAAI,GAAG,CAAA,IAAK,GAAA,CAAI,GAAG,CAAA,GAAI,MAAA,KAAW,cAAA,CAAe,MAAM,CAAA;AAC1F;;;ACYA,eAAe,SAAA,CAAU,GAAA,EAAK,GAAA,EAAK,OAAA,EAAS;AAC1C,EAAA,IAAI,CAAC,SAAS,GAAG,CAAA;AACf,IAAA,MAAM,IAAI,UAAU,uBAAuB,CAAA;AAC7C,EAAA,MAAM,UAAA,GAAa,YAAA,CAAa,GAAG,CAAA,CAAA,CAAkE,EAAE,GAAA,EAAK,MAAA,EAAO,GAAI;AACvH,EAAA,IAAoB,UAAA,CAAW,GAAA,KAAQ,SAAS,CAAC,GAAA;AAC/C,IAAA;AACF,EAAA,QAAQ,WAAW,GAAA;AAAK,IACtB,KAAK,KAAA;AACH,MAAA,IAAI,OAAO,WAAW,CAAA,IAAK,QAAA;AACzB,QAAA,MAAM,IAAI,UAAU,yCAAyC,CAAA;AAC/D,MAAA,OAAO,MAAA,CAAgB,WAAW,CAAC,CAAA;AAAA,IACrC,KAAK,KAAA,EAAO;AACV,MAAA,IAAI,OAAO,MAAA,IAAU,QAAA,IAAY,CAAC,MAAA;AAChC,QAAA,MAAM,IAAI,UAAU,2CAA2C,CAAA;AACjE,MAAA,IAAI,GAAA,KAAQ,MAAA;AACV,QAAA,MAAM,IAAI,UAAU,uCAAuC,CAAA;AAC7D,MAAA,OAAO,QAAA,CAAS,YAAA,CAAa,GAAG,CAAA,EAAG,UAAuB,CAAA;AAAA,IAC5D;AAAA,IACA,KAAK,KAAA;AAAA,IACL,KAAK,IAAA;AAAA,IACL,KAAK,KAAA;AACH,MAAA,OAAO,QAAA,CAAS,YAAA,CAAa,GAAG,CAAA,EAAG,UAAuB,CAAA;AAAA,IAC5D;AACE,MAAA,MAAM,IAAI,iBAAiB,8CAA8C,CAAA;AAAA;AAE/E;;;ACxBA,IAAM,cAAA,GAAiB,oBAAA;AACvB,IAAM,cAAA,GAAiB,KAAK,EAAA,GAAK,GAAA;AAEjC,IAAM,oBAAA,GAAuB,CAAA,GAAI,EAAA,GAAK,EAAA,GAAK,GAAA;AAE3C,IAAM,8BAAA,GAAiC,GAAA;AACvC,IAAM,kBAAA,GAAqB,oCAAA;AAyE3B,IAAM,SAAA,uBAAgB,GAAA,EAA4B;AAClD,IAAM,QAAA,uBAAe,GAAA,EAAqC;AAC1D,IAAM,iBAAA,uBAAwB,GAAA,EAAoB;AAElD,eAAe,iBAAA,CACX,MAAA,EACA,KAAA,EACA,UAAA,GAAa,oBAAA,EACU;AACvB,EAAA,MAAM,MAAA,GAAS,SAAA,CAAU,GAAA,CAAI,MAAM,CAAA;AACnC,EAAA,IAAI,UAAU,IAAA,CAAK,GAAA,KAAQ,MAAA,CAAO,SAAA,GAAY,OAAO,OAAO,MAAA;AAC5D,EAAA,MAAM,QAAA,GAAW,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA;AACpC,EAAA,IAAI,UAAU,OAAO,QAAA;AACrB,EAAA,MAAM,KAAK,YAAqC;AAC5C,IAAA,IAAI;AACA,MAAA,MAAM,GAAA,GAAM,GAAG,MAAA,CAAO,OAAA,CAAQ,OAAO,EAAE,CAAC,GAAG,kBAAkB,CAAA,CAAA;AAC7D,MAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,SAAS,EAAE,MAAA,EAAQ,kBAAA,EAAmB,EAAG,CAAA;AACxE,MAAA,IAAI,CAAC,GAAA,CAAI,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,GAAG,CAAA,UAAA,EAAa,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAChF,MAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAC7B,MAAA,IAAI,CAAC,IAAA,IAAQ,CAAC,MAAM,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAA,EAAG;AACpC,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,iBAAA,EAAoB,GAAG,CAAA,+BAAA,CAA4B,CAAA;AAAA,MACvE;AACA,MAAA,MAAM,OAAgC,EAAC;AACvC,MAAA,KAAA,MAAW,CAAA,IAAK,KAAK,IAAA,EAAM;AACvB,QAAA,IAAI,OAAO,CAAA,CAAE,GAAA,KAAQ,QAAA,EAAU;AAC/B,QAAA,IAAI;AACA,UAAA,IAAA,CAAK,EAAE,GAAG,CAAA,GAAK,MAAM,SAAA,CAAU,GAAG,OAAO,CAAA;AAAA,QAC7C,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACJ;AACA,MAAA,MAAM,QAAwB,EAAE,IAAA,EAAM,SAAA,EAAW,IAAA,CAAK,KAAI,EAAE;AAC5D,MAAA,SAAA,CAAU,GAAA,CAAI,QAAQ,KAAK,CAAA;AAC3B,MAAA,OAAO,KAAA;AAAA,IACX,SAAS,GAAA,EAAK;AAEV,MAAA,MAAM,KAAA,GAAQ,SAAA,CAAU,GAAA,CAAI,MAAM,CAAA;AAClC,MAAA,IAAI,SAAS,IAAA,CAAK,GAAA,KAAQ,KAAA,CAAM,SAAA,GAAY,YAAY,OAAO,KAAA;AAC/D,MAAA,MAAM,GAAA;AAAA,IACV;AAAA,EACJ,CAAA,GAAG,CAAE,OAAA,CAAQ,MAAM;AACf,IAAA,QAAA,CAAS,OAAO,MAAM,CAAA;AAAA,EAC1B,CAAC,CAAA;AACD,EAAA,QAAA,CAAS,GAAA,CAAI,QAAQ,CAAC,CAAA;AACtB,EAAA,OAAO,CAAA;AACX;AAEA,SAAS,WAAW,GAAA,EAAgC;AAChD,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,OAAO,IAAA;AACpC,EAAA,MAAM,CAAA,GAAI,IAAI,IAAA,EAAK;AACnB,EAAA,IAAI,EAAE,MAAA,KAAW,CAAA,IAAK,EAAE,MAAA,GAAS,CAAA,KAAM,GAAG,OAAO,IAAA;AACjD,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,CAAA,CAAE,SAAS,CAAC,CAAA;AACvC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,GAAA,CAAI,QAAQ,CAAA,EAAA,EAAK;AACjC,IAAA,MAAM,CAAA,GAAI,QAAA,CAAS,CAAA,CAAE,KAAA,CAAM,CAAA,GAAI,GAAG,CAAA,GAAI,CAAA,GAAI,CAAC,CAAA,EAAG,EAAE,CAAA;AAChD,IAAA,IAAI,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA,EAAG,OAAO,IAAA;AAC5B,IAAA,GAAA,CAAI,CAAC,CAAA,GAAI,CAAA;AAAA,EACb;AACA,EAAA,OAAO,GAAA;AACX;AAEA,SAAS,cAAc,GAAA,EAAgC;AACnD,EAAA,IAAI;AACA,IAAA,MAAM,GAAA,GACF,OAAO,IAAA,KAAS,UAAA,GACV,IAAA,CAAK,GAAG,CAAA,GACR,MAAA,CAAO,IAAA,CAAK,GAAA,EAAK,QAAQ,CAAA,CAAE,SAAS,QAAQ,CAAA;AACtD,IAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA;AACrC,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,GAAA,CAAI,MAAA,EAAQ,CAAA,EAAA,EAAK,GAAA,CAAI,CAAC,CAAA,GAAI,GAAA,CAAI,UAAA,CAAW,CAAC,CAAA;AAC9D,IAAA,OAAO,GAAA;AAAA,EACX,CAAA,CAAA,MAAQ;AACJ,IAAA,OAAO,IAAA;AAAA,EACX;AACJ;AAEA,SAAS,WAAW,KAAA,EAA2B;AAC3C,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,MAAW,CAAA,IAAK,OAAO,GAAA,IAAO,CAAA,CAAE,SAAS,EAAE,CAAA,CAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAA;AAC5D,EAAA,OAAO,GAAA;AACX;AAEA,eAAe,OAAO,KAAA,EAAwC;AAC1D,EAAA,MAAM,MAAA,GACF,OAAO,UAAA,CAAW,MAAA,KAAW,WAAA,IAAe,WAAW,MAAA,CAAO,MAAA,GACxD,UAAA,CAAW,MAAA,CAAO,MAAA,GAClB,IAAA;AACV,EAAA,IAAI,CAAC,MAAA,EAAQ;AACT,IAAA,MAAM,IAAI,MAAM,8EAA2E,CAAA;AAAA,EAC/F;AACA,EAAA,MAAM,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,WAAW,KAA+B,CAAA;AAC1E,EAAA,OAAO,IAAI,WAAW,GAAG,CAAA;AAC7B;AAEA,SAAS,cAAc,IAAA,EAA+B;AAClD,EAAA,MAAM,GAAA,GAAM,IAAI,WAAA,CAAY,IAAA,CAAK,UAAU,CAAA;AAC3C,EAAA,IAAI,UAAA,CAAW,GAAG,CAAA,CAAE,GAAA,CAAI,IAAI,CAAA;AAC5B,EAAA,OAAO,GAAA;AACX;AAEA,eAAe,aAAA,CACX,GAAA,EACAA,IAAAA,EACA,GAAA,EACgB;AAChB,EAAA,MAAM,MAAA,GACF,OAAO,UAAA,CAAW,MAAA,KAAW,WAAA,IAAe,WAAW,MAAA,CAAO,MAAA,GACxD,UAAA,CAAW,MAAA,CAAO,MAAA,GAClB,IAAA;AACV,EAAA,IAAI,CAAC,QAAQ,OAAO,KAAA;AACpB,EAAA,IAAI;AACA,IAAA,OAAO,MAAM,MAAA,CAAO,MAAA;AAAA,MAChB,SAAA;AAAA,MACA,GAAA;AAAA,MACA,cAAcA,IAAG,CAAA;AAAA,MACjB,cAAc,GAAG;AAAA,KACrB;AAAA,EACJ,CAAA,CAAA,MAAQ;AACJ,IAAA,OAAO,KAAA;AAAA,EACX;AACJ;AAGA,IAAM,aAAA,GAAgB;AAAA,EAClB,GAAA;AAAA,EACA,MAAA;AAAA,EACA,QAAA;AAAA,EACA,aAAA;AAAA,EACA,mBAAA;AAAA,EACA,eAAA;AAAA,EACA,2BAAA;AAAA,EACA,iBAAA;AAAA,EACA,aAAA;AAAA,EACA,aAAA;AAAA,EACA;AACJ,CAAA;AACA,IAAM,MAAA,GAAS;AAAA,EACX,aAAA;AAAA,EACA,mBAAA;AAAA,EACA,eAAA;AAAA,EACA,2BAAA;AAAA,EACA;AACJ,CAAA;AAIA,SAAS,qBAAA,CAAsB,WAAuB,EAAA,EAAwC;AAC1F,EAAA,MAAM,IAAA,GAAO,IAAI,WAAA,EAAY,CAAE,OAAO,SAAS,CAAA;AAC/C,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACA,IAAA,MAAA,GAAS,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EAC5B,CAAA,CAAA,MAAQ;AACJ,IAAA,OAAO,IAAA;AAAA,EACX;AACA,EAAA,IAAI,CAAC,UAAU,OAAO,MAAA,KAAW,YAAY,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG,OAAO,IAAA;AAC3E,EAAA,MAAM,CAAA,GAAI,MAAA;AACV,EAAA,IAAI,CAAA,CAAE,CAAA,KAAM,CAAA,IAAK,CAAA,CAAE,IAAA,KAAS,oBAAoB,OAAO,CAAA,CAAE,MAAA,KAAW,QAAA,EAAU,OAAO,IAAA;AACrF,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA,KAAM;AACjC,IAAA,MAAM,CAAA,GAAI,EAAE,CAAC,CAAA;AACb,IAAA,OAAO,OAAO,CAAA,KAAM,QAAA,IAAY,OAAO,aAAA,CAAc,CAAC,KAAK,CAAA,IAAK,CAAA;AAAA,EACpE,CAAC,CAAA;AACD,EAAA,IAAI,CAAC,UAAU,OAAO,IAAA;AACtB,EAAA,IAAI,EAAE,eAAA,KAAoB,IAAA,IAAQ,OAAO,CAAA,CAAE,eAAA,KAAoB,UAAU,OAAO,IAAA;AAChF,EAAA,IAAI,OAAO,EAAE,WAAA,KAAgB,QAAA,IAAY,OAAO,CAAA,CAAE,UAAA,KAAe,UAAU,OAAO,IAAA;AAClF,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,WAAA,CAAY,aAAA,CAAc,GAAA,CAAI,CAAC,CAAA,KAAM,CAAC,CAAA,EAAG,CAAA,CAAE,CAAC,CAAC,CAAC,CAAC,CAAA;AAEtE,EAAA,IAAI,IAAA,CAAK,SAAA,CAAU,OAAO,CAAA,KAAM,MAAM,OAAO,IAAA;AAC7C,EAAA,OAAO,EAAE,EAAA,EAAI,GAAI,OAAA,EAA4C;AACjE;AAGA,SAAS,eAAA,CAAgB,MAA2B,MAAA,EAAsC;AACtF,EAAA,MAAM,CAAA,GAAI,IAAA;AACV,EAAA,MAAM,CAAA,GAAI,MAAA;AACV,EAAA,OAAQ,CAAC,IAAA,EAAM,GAAG,aAAa,CAAA,CAAY,KAAA,CAAM,CAAC,CAAA,KAAM,CAAA,CAAE,CAAC,CAAA,KAAM,CAAA,CAAE,CAAC,CAAC,CAAA;AACzE;AAcA,eAAsB,yBAAA,CAClB,MAAA,EACA,OAAA,GAAiC,EAAC,EACL;AAC7B,EAAA,MAAM,SAAgC,EAAC;AAGvC,EAAA,MAAM,OAAA,GACF,CAAC,CAAC,MAAA,IACF,OAAO,MAAA,KAAW,QAAA,IAClB,OAAO,MAAA,CAAO,GAAA,KAAQ,QAAA,IACtB,OAAO,MAAA,CAAO,GAAA,KAAQ,QAAA,IACtB,OAAO,MAAA,CAAO,aAAA,KAAkB,QAAA,KAC/B,MAAA,CAAO,WAAA,KAAgB,MAAA,IACnB,CAAC,CAAC,MAAA,CAAO,WAAA,IAAe,OAAO,MAAA,CAAO,WAAA,KAAgB,QAAA,CAAA;AAC/D,EAAA,MAAA,CAAO,IAAA,CAAK;AAAA,IACR,EAAA,EAAI,OAAA;AAAA,IACJ,KAAA,EAAO;AAAA,GACV,CAAA;AACD,EAAA,IAAI,CAAC,OAAA,EAAS;AACV,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,wBAAwB,MAAA,EAAO;AAAA,EAC/D;AAGA,EAAA,MAAM,SAAA,GAAY,aAAA,CAAc,MAAA,CAAO,aAAa,CAAA;AACpD,EAAA,MAAA,CAAO,IAAA,CAAK;AAAA,IACR,IAAI,SAAA,KAAc,IAAA;AAAA,IAClB,KAAA,EAAO,uBAAA;AAAA,IACP,MAAA,EAAQ,SAAA,GAAY,CAAA,EAAG,SAAA,CAAU,MAAM,CAAA,MAAA,CAAA,GAAW;AAAA,GACrD,CAAA;AACD,EAAA,IAAI,CAAC,WAAW,OAAO,EAAE,IAAI,KAAA,EAAO,MAAA,EAAQ,gCAAgC,MAAA,EAAO;AAGnF,EAAA,MAAM,UAAA,GAAa,UAAA,CAAW,MAAM,MAAA,CAAO,SAAS,CAAC,CAAA;AACrD,EAAA,MAAM,MAAA,GAAS,qBAAA,CAAsB,SAAA,EAAW,UAAU,CAAA;AAC1D,EAAA,MAAA,CAAO,IAAA,CAAK;AAAA,IACR,IAAI,MAAA,KAAW,IAAA;AAAA,IACf,KAAA,EAAO;AAAA,GACV,CAAA;AACD,EAAA,IAAI,CAAC,QAAQ,OAAO,EAAE,IAAI,KAAA,EAAO,MAAA,EAAQ,mDAAmD,MAAA,EAAO;AAEnG,EAAA,MAAM,OAAO,MAAA,CAAO,WAAA;AACpB,EAAA,MAAM,MAAA,GAAS,IAAA,KAAS,MAAA,IAAa,eAAA,CAAgB,MAAM,MAAM,CAAA;AACjE,EAAA,MAAA,CAAO,IAAA,CAAK;AAAA,IACR,EAAA,EAAI,MAAA;AAAA,IACJ,KAAA,EAAO,gEAAA;AAAA,IACP,MAAA,EAAQ,SAAS,UAAA,GAAa;AAAA,GACjC,CAAA;AACD,EAAA,IAAI,CAAC,QAAQ,OAAO,EAAE,IAAI,KAAA,EAAO,MAAA,EAAQ,+CAA+C,MAAA,EAAO;AAG/F,EAAA,IAAI,GAAA,GAAsB,IAAA;AAC1B,EAAA,IAAI,QAAQ,GAAA,EAAK;AACb,IAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,GAAA,KAAQ,MAAA,CAAO,GAAA,EAAK;AAChC,MAAA,MAAA,CAAO,IAAA,CAAK;AAAA,QACR,EAAA,EAAI,KAAA;AAAA,QACJ,KAAA,EAAO,+BAAA;AAAA,QACP,QAAQ,CAAA,iBAAA,EAAoB,OAAA,CAAQ,IAAI,GAAG,CAAA,gBAAA,EAAmB,OAAO,GAAG,CAAA;AAAA,OAC3E,CAAA;AACD,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,kCAAkC,MAAA,EAAO;AAAA,IACzE;AACA,IAAA,IAAI;AACA,MAAA,GAAA,GAAO,MAAM,SAAA,CAAU,OAAA,CAAQ,GAAA,EAAK,OAAO,CAAA;AAC3C,MAAA,MAAA,CAAO,IAAA,CAAK,EAAE,EAAA,EAAI,IAAA,EAAM,KAAA,EAAO,+BAAA,EAAiC,MAAA,EAAQ,CAAA,IAAA,EAAO,MAAA,CAAO,GAAG,CAAA,WAAA,CAAA,EAAe,CAAA;AAAA,IAC5G,SAAS,GAAA,EAAK;AACV,MAAA,MAAA,CAAO,IAAA,CAAK;AAAA,QACR,EAAA,EAAI,KAAA;AAAA,QACJ,KAAA,EAAO,+BAAA;AAAA,QACP,MAAA,EAAQ,CAAA,4BAAA,EAAgC,GAAA,CAAc,OAAO,CAAA;AAAA,OAChE,CAAA;AACD,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,8BAA8B,MAAA,EAAO;AAAA,IACrE;AAAA,EACJ,CAAA,MAAO;AACH,IAAA,MAAM,MAAA,GAAS,QAAQ,MAAA,IAAU,cAAA;AACjC,IAAA,MAAM,GAAA,GAAM,QAAQ,cAAA,IAAkB,cAAA;AACtC,IAAA,MAAM,QAAA,GAAW,QAAQ,cAAA,IAAkB,oBAAA;AAC3C,IAAA,IAAI;AACA,MAAA,IAAI,KAAA,GAAQ,MAAM,iBAAA,CAAkB,MAAA,EAAQ,KAAK,QAAQ,CAAA;AACzD,MAAA,GAAA,GAAM,KAAA,CAAM,IAAA,CAAK,MAAA,CAAO,GAAG,CAAA,IAAK,IAAA;AAChC,MAAA,IAAI,CAAC,GAAA,IAAO,IAAA,CAAK,GAAA,EAAI,IAAK,kBAAkB,GAAA,CAAI,MAAM,CAAA,IAAK,CAAA,CAAA,IAAM,8BAAA,EAAgC;AAE7F,QAAA,iBAAA,CAAkB,GAAA,CAAI,MAAA,EAAQ,IAAA,CAAK,GAAA,EAAK,CAAA;AACxC,QAAA,KAAA,GAAQ,MAAM,iBAAA,CAAkB,MAAA,EAAQ,CAAA,EAAG,QAAQ,CAAA;AACnD,QAAA,GAAA,GAAM,KAAA,CAAM,IAAA,CAAK,MAAA,CAAO,GAAG,CAAA,IAAK,IAAA;AAAA,MACpC;AACA,MAAA,MAAA,CAAO,IAAA,CAAK;AAAA,QACR,EAAA,EAAI,CAAC,CAAC,GAAA;AAAA,QACN,KAAA,EAAO,+BAAA;AAAA,QACP,MAAA,EAAQ,GAAA,GAAM,CAAA,IAAA,EAAO,MAAA,CAAO,GAAG,CAAA,CAAA,GAAK,CAAA,gBAAA,EAAmB,MAAA,CAAO,GAAG,CAAA,IAAA,EAAO,MAAM,CAAA,EAAG,kBAAkB,CAAA;AAAA,OACtG,CAAA;AACD,MAAA,IAAI,CAAC,GAAA,EAAK;AACN,QAAA,OAAO,EAAE,IAAI,KAAA,EAAO,MAAA,EAAQ,OAAO,MAAA,CAAO,GAAG,yBAAyB,MAAA,EAAO;AAAA,MACjF;AAAA,IACJ,SAAS,GAAA,EAAK;AACV,MAAA,MAAA,CAAO,IAAA,CAAK;AAAA,QACR,EAAA,EAAI,KAAA;AAAA,QACJ,KAAA,EAAO,+BAAA;AAAA,QACP,MAAA,EAAQ,CAAA,2BAAA,EAA+B,GAAA,CAAc,OAAO,CAAA;AAAA,OAC/D,CAAA;AACD,MAAA,OAAO;AAAA,QACH,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,CAAA,2BAAA,EAA+B,GAAA,CAAc,OAAO,CAAA,CAAA;AAAA,QAC5D;AAAA,OACJ;AAAA,IACJ;AAAA,EACJ;AAEA,EAAA,MAAM,QAAA,GAAW,UAAA,CAAW,MAAA,CAAO,GAAG,CAAA;AACtC,EAAA,IAAI,CAAC,QAAA,EAAU;AACX,IAAA,MAAA,CAAO,IAAA,CAAK;AAAA,MACR,EAAA,EAAI,KAAA;AAAA,MACJ,KAAA,EAAO,kDAAA;AAAA,MACP,MAAA,EAAQ;AAAA,KACX,CAAA;AACD,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,iBAAiB,MAAA,EAAO;AAAA,EACxD;AACA,EAAA,MAAM,KAAA,GAAQ,MAAM,aAAA,CAAc,GAAA,EAAK,UAAU,SAAS,CAAA;AAC1D,EAAA,MAAA,CAAO,IAAA,CAAK;AAAA,IACR,EAAA,EAAI,KAAA;AAAA,IACJ,KAAA,EAAO,kDAAA;AAAA,IACP,MAAA,EAAQ,QAAQ,iBAAA,GAAoB;AAAA,GACvC,CAAA;AACD,EAAA,IAAI,CAAC,OAAO,OAAO,EAAE,IAAI,KAAA,EAAO,MAAA,EAAQ,4BAA4B,MAAA,EAAO;AAG3E,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,oBAAO,IAAI,IAAA,EAAK;AACpC,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,UAAU,CAAA;AAC9C,EAAA,MAAM,UAAU,MAAA,CAAO,QAAA,CAAS,SAAS,CAAA,IAAK,SAAA,GAAY,IAAI,OAAA,EAAQ;AACtE,EAAA,MAAA,CAAO,IAAA,CAAK;AAAA,IACR,EAAA,EAAI,OAAA;AAAA,IACJ,KAAA,EAAO,8BAAA;AAAA,IACP,MAAA,EAAQ,UACF,CAAA,QAAA,EAAW,IAAI,KAAK,SAAS,CAAA,CAAE,WAAA,EAAa,CAAA,CAAA,GAC5C;AAAA,GACT,CAAA;AACD,EAAA,IAAI,CAAC,SAAS,OAAO,EAAE,IAAI,KAAA,EAAO,MAAA,EAAQ,2BAA2B,MAAA,EAAO;AAE5E,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,WAAA,EAAa,QAAQ,MAAA,EAAO;AACnD;AAIA,eAAsB,mBAAA,CAAoB,SAAS,cAAA,EAA+B;AAC9E,EAAA,SAAA,CAAU,OAAO,MAAM,CAAA;AACvB,EAAA,MAAM,iBAAA,CAAkB,QAAQ,cAAc,CAAA;AAClD;AAEO,IAAM,QAAA,GAAW;AAAA,EACpB,yBAAA;AAAA,EACA;AACJ;;;ACnWA,eAAsB,YAAA,CAClB,OAAA,EACA,OAAA,GAA2B,EAAC,EACE;AAC9B,EAAA,MAAM,OAAA,GAAU,MAAMC,cAAA,CAAiB,OAAA,EAAS,OAAO,CAAA;AACvD,EAAA,IAAI,CAAC,OAAA,IAAW,OAAA,CAAQ,QAAA,KAAa,MAAA,wBAAiC,OAAO,CAAA;AAC7E,EAAA,OAAO,OAAA;AACX;AAEA,IAAI,cAAA,GAAiB,KAAA;AAQrB,SAAS,sBAAsB,OAAA,EAAgD;AAC3E,EAAA,IAAI,cAAA,EAAgB;AACpB,EAAA,MAAM,GAAA,GAAM,OAAO,OAAA,KAAY,WAAA,IAAe,OAAA,YAAmB,OAAA;AACjE,EAAA,MAAM,OAAO,GAAA,GAAM,OAAA,CAAQ,GAAA,CAAI,eAAe,IAAK,OAAA,CAAkC,aAAA;AACrF,EAAA,MAAM,SAAS,GAAA,GAAM,OAAA,CAAQ,GAAA,CAAI,QAAQ,IAAK,OAAA,CAAkC,MAAA;AAEhF,EAAA,MAAM,MAAA,GAAS,OAAO,IAAA,KAAS,QAAA,GAAW,mBAAA,CAAoB,IAAA,CAAK,IAAA,CAAK,IAAA,EAAM,CAAA,GAAI,CAAC,CAAA,GAAI,MAAA;AACvF,EAAA,MAAM,UAAA,GACF,OAAO,MAAA,KAAW,QAAA,GAAW,+BAA+B,IAAA,CAAK,MAAM,CAAA,GAAI,CAAC,CAAA,GAAI,MAAA;AACpF,EAAA,MAAM,CAAA,GAAI,qBAAA,CAAsB,IAAA,CAAK,MAAA,IAAU,cAAc,EAAE,CAAA;AAC/D,EAAA,IAAI,CAAC,CAAA,EAAG;AACR,EAAA,IAAI;AACA,IAAA,MAAM,UAAU,IAAA,CAAK,KAAA,CAAM,kBAAkB,CAAA,CAAE,CAAC,CAAE,CAAC,CAAA;AACnD,IAAA,IAAI,OAAA,CAAQ,QAAQ,KAAA,CAAA,EAAW;AAC/B,IAAA,cAAA,GAAiB,IAAA;AACjB,IAAA,OAAA,CAAQ,IAAA;AAAA,MACJ,CAAA,kDAAA,EAAqD,IAAA,CAAK,SAAA,CAAU,OAAA,CAAQ,GAAG,CAAC,CAAA,+IAAA;AAAA,KAGpF;AAAA,EACJ,CAAA,CAAA,MAAQ;AAAA,EAER;AACJ;AAEA,SAAS,kBAAkB,CAAA,EAAmB;AAC1C,EAAA,MAAM,GAAA,GAAM,EAAE,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AAClD,EAAA,IAAI,OAAO,IAAA,KAAS,UAAA,EAAY,OAAO,IAAA,CAAK,GAAA,GAAM,GAAA,CAAI,MAAA,CAAA,CAAQ,CAAA,GAAK,GAAA,CAAI,MAAA,GAAS,CAAA,IAAM,CAAC,CAAC,CAAA;AACxF,EAAA,OAAO,OAAO,IAAA,CAAK,CAAA,EAAG,WAAW,CAAA,CAAE,SAAS,MAAM,CAAA;AACtD;AA2CO,IAAM,gBAAA,GAAmB;AAEhC,IAAM,WAAA,uBAAkB,GAAA,EAAoB;AAC5C,IAAM,eAAA,0BAAyB,iBAAiB,CAAA;AAChD,IAAM,aAAA,GAAgB,GAAA;AAEtB,IAAM,eAAA,GAAkB,GAAA;AACxB,IAAM,QAAA,uBAAe,GAAA,EAAsE;AAU3F,eAAe,mBACX,OAAA,EAC6D;AAC7D,EAAA,MAAM,MAAM,OAAA,CAAQ,UAAA;AACpB,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,GAAA,CAAI,GAAG,CAAA;AAC5B,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,EAAA,IAAI,WAAA,CAAY,GAAA,CAAI,GAAG,CAAA,IAAK,GAAA,GAAM,YAAY,GAAA,CAAI,GAAG,CAAA,GAAK,aAAA,EAAe,OAAO,eAAA;AAChF,EAAA,IAAI,OAAO,GAAA,GAAM,GAAA,CAAI,EAAA,GAAK,aAAA,SAAsB,GAAA,CAAI,IAAA;AACpD,EAAA,IAAI,GAAA,EAAK,QAAA,IAAY,GAAA,GAAM,GAAA,CAAI,QAAA,GAAW,iBAAiB,OAAO,GAAA,CAAI,EAAA,GAAK,GAAA,CAAI,IAAA,GAAO,MAAA;AACtF,EAAA,IAAI;AACA,IAAA,MAAM,IAAA,GAAO,QAAQ,QAAA,IAAY,oBAAA;AACjC,IAAA,MAAM,CAAA,GAAI,MAAM,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,gBAAA,EAAmB,kBAAA,CAAmB,GAAG,CAAC,CAAA,QAAA,CAAA,EAAY;AAAA,MAC/E,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,GAAI;AAAA,KACnC,CAAA;AAED,IAAA,IAAI,CAAA,CAAE,WAAW,GAAA,EAAK;AAClB,MAAA,IAAI,CAAC,WAAA,CAAY,GAAA,CAAI,GAAG,CAAA,EAAG;AACvB,QAAA,OAAA,CAAQ,KAAA;AAAA,UACJ,wCAAwC,GAAG,CAAA,iEAAA;AAAA,SAC/C;AAAA,MACJ;AACA,MAAA,WAAA,CAAY,GAAA,CAAI,GAAA,EAAK,IAAA,CAAK,GAAA,EAAK,CAAA;AAC/B,MAAA,OAAO,eAAA;AAAA,IACX;AACA,IAAA,WAAA,CAAY,OAAO,GAAG,CAAA;AACtB,IAAA,IAAI,CAAC,EAAE,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,KAAA,EAAQ,CAAA,CAAE,MAAM,CAAA,CAAE,CAAA;AAC7C,IAAA,MAAM,CAAA,GAAK,MAAM,CAAA,CAAE,IAAA,EAAK;AAGxB,IAAA,MAAM,GAAA,GAAM,EAAE,YAAA,IAAgB,IAAA;AAC9B,IAAA,MAAM,IAAA,GAAO,MAAM,EAAE,OAAA,EAAS,IAAI,QAAA,EAAU,OAAA,EAAS,GAAA,CAAI,QAAA,EAAS,GAAI,IAAA;AACtE,IAAA,QAAA,CAAS,GAAA,CAAI,KAAK,EAAE,EAAA,EAAI,KAAK,GAAA,EAAI,EAAG,MAAM,CAAA;AAC1C,IAAA,OAAO,IAAA;AAAA,EACX,CAAA,CAAA,MAAQ;AACJ,IAAA,QAAA,CAAS,GAAA,CAAI,GAAA,EAAK,EAAE,EAAA,EAAI,KAAK,EAAA,IAAM,CAAA,EAAG,IAAA,EAAM,GAAA,EAAK,QAAQ,IAAA,EAAM,QAAA,EAAU,IAAA,CAAK,GAAA,IAAO,CAAA;AACrF,IAAA,OAAO,GAAA,EAAK,EAAA,GAAK,GAAA,CAAI,IAAA,GAAO,MAAA;AAAA,EAChC;AACJ;AAGA,eAAe,SACX,OAAA,EAC6D;AAC7D,EAAA,IAAI,OAAA,CAAQ,WAAA,EAAa,OAAO,OAAA,CAAQ,WAAA;AACxC,EAAA,IAAI,OAAA,CAAQ,UAAA,EAAY,OAAO,kBAAA,CAAmB,OAAO,CAAA;AACzD,EAAA,OAAO,IAAA;AACX;AAGA,eAAe,OAAA,CACX,SACA,OAAA,EACiE;AACjE,EAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,OAAO,CAAA;AACnC,EAAA,IAAI,CAAC,OAAA,IAAW,OAAA,CAAQ,QAAA,EAAU;AAC9B,IAAA,OAAO,EAAE,QAAQ,GAAA,EAAK,IAAA,EAAM,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,iBAAA,EAAkB,EAAE;AAAA,EACzE;AACA,EAAA,IAAI,SAAS,eAAA,EAAiB;AAC1B,IAAA,OAAO,EAAE,QAAQ,GAAA,EAAK,IAAA,EAAM,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,qBAAA,EAAsB,EAAE;AAAA,EAC7E;AACA,EAAA,IAAI,SAAS,MAAA,EAAW;AACpB,IAAA,OAAO,EAAE,QAAQ,GAAA,EAAK,IAAA,EAAM,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,yBAAA,EAA0B,EAAE;AAAA,EACjF;AACA,EAAA,IAAI,CAAC,OAAA,EAAS;AACV,IAAA,OAAO,IAAA,GAAO,EAAE,MAAA,EAAQ,GAAA,EAAK,IAAA,EAAM,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,iBAAA,EAAkB,EAAE,GAAI,IAAA;AAAA,EACpF;AACA,EAAA,IAAI,IAAA,IAAQ,CAAC,SAAA,CAAU,OAAA,EAAS,IAAI,CAAA,EAAG;AACnC,IAAA,MAAM,IAAA,GAAO,cAAc,OAAO,CAAA;AAClC,IAAA,OAAO;AAAA,MACH,MAAA,EAAQ,GAAA;AAAA,MACR,IAAA,EAAM;AAAA,QACF,EAAA,EAAI,KAAA;AAAA,QACJ,MAAA,EAAQ,eAAA;AAAA,QACR,IAAA,EAAM;AAAA,UACF,QAAA,EAAU,KAAK,OAAA,IAAW,CAAA;AAAA,UAC1B,QAAA,EAAU,KAAK,OAAA,IAAW,CAAA;AAAA,UAC1B,GAAI,KAAK,UAAA,KAAe,MAAA,GAAY,EAAE,YAAA,EAAc,IAAA,CAAK,UAAA,EAAW,GAAI;AAAC,SAC7E;AAAA,QACA,IAAA,EAAM,OAAO,EAAE,UAAA,EAAY,KAAK,UAAA,EAAY,UAAA,EAAY,IAAA,CAAK,UAAA,EAAW,GAAI,IAAA;AAAA,QAC5E,QAAA,EAAU;AAAA;AACd,KACJ;AAAA,EACJ;AACA,EAAA,OAAO,IAAA;AACX;AAqBO,SAAS,UAAA,CAIZ,OAAA,EACA,OAAA,GAA6B,EAAC,EACU;AACxC,EAAA,OAAO,OAAO,KAAU,GAAA,KAAa;AACjC,IAAA,GAAA,CAAI,SAAA,CAAU,iBAAiB,mBAAmB,CAAA;AAClD,IAAA,GAAA,CAAI,SAAA,CAAU,QAAQ,uBAAuB,CAAA;AAC7C,IAAA,MAAM,UAAU,MAAM,YAAA;AAAA,MAClB;AAAA,QACI,MAAA,EAAQ,OAAO,GAAA,CAAI,OAAA,CAAQ,WAAW,QAAA,GAAW,GAAA,CAAI,QAAQ,MAAA,GAAS,IAAA;AAAA,QACtE,aAAA,EACI,OAAO,GAAA,CAAI,OAAA,CAAQ,kBAAkB,QAAA,GAC/B,GAAA,CAAI,QAAQ,aAAA,GACZ;AAAA,OACd;AAAA,MACA;AAAA,KACJ;AACA,IAAA,MAAM,WAAA,GAAc,GAAA;AACpB,IAAA,WAAA,CAAY,SAAA,GAAY,OAAA;AACxB,IAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,OAAA,EAAS,OAAO,CAAA;AAC9C,IAAA,IAAI,OAAA,SAAgB,GAAA,CAAI,MAAA,CAAO,QAAQ,MAAM,CAAA,CAAE,IAAA,CAAK,OAAA,CAAQ,IAAI,CAAA;AAChE,IAAA,OAAO,OAAA,CAAQ,aAAa,GAAG,CAAA;AAAA,EACnC,CAAA;AACJ;AAgDO,SAAS,aAAA,CAAc,OAAA,GAA6B,EAAC,EAAG;AAC3D,EAAA,OAAO,OAAO,GAAA,EAAyB,GAAA,EAA0B,IAAA,KAA0B;AACvF,IAAA,IAAI;AACA,MAAA,GAAA,CAAI,SAAA,CAAU,iBAAiB,mBAAmB,CAAA;AAClD,MAAA,GAAA,CAAI,SAAA,CAAU,QAAQ,uBAAuB,CAAA;AAC7C,MAAA,MAAM,UAAU,MAAM,YAAA;AAAA,QAClB;AAAA,UACI,MAAA,EAAQ,OAAO,GAAA,CAAI,OAAA,CAAQ,WAAW,QAAA,GAAW,GAAA,CAAI,QAAQ,MAAA,GAAS,IAAA;AAAA,UACtE,aAAA,EACI,OAAO,GAAA,CAAI,OAAA,CAAQ,kBAAkB,QAAA,GAC/B,GAAA,CAAI,QAAQ,aAAA,GACZ;AAAA,SACd;AAAA,QACA;AAAA,OACJ;AACA,MAAA,GAAA,CAAI,SAAA,GAAY,OAAA;AAChB,MAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,OAAA,EAAS,OAAO,CAAA;AAC9C,MAAA,IAAI,OAAA,EAAS;AACT,QAAA,GAAA,CAAI,OAAO,OAAA,CAAQ,MAAM,CAAA,CAAE,IAAA,CAAK,QAAQ,IAAI,CAAA;AAC5C,QAAA;AAAA,MACJ;AACA,MAAA,IAAA,EAAK;AAAA,IACT,SAAS,GAAA,EAAK;AACV,MAAA,IAAA,CAAK,GAAG,CAAA;AAAA,IACZ;AAAA,EACJ,CAAA;AACJ;AA2BO,SAAS,UAAA,CAAW,OAAA,GAA6B,EAAC,EAAG;AACxD,EAAA,OAAO,OAAO,GAAoB,IAAA,KAAuB;AACrD,IAAA,CAAA,CAAE,MAAA,CAAO,iBAAiB,mBAAmB,CAAA;AAC7C,IAAA,CAAA,CAAE,MAAA,CAAO,QAAQ,uBAAuB,CAAA;AACxC,IAAA,MAAM,UAAU,MAAM,YAAA,CAAa,EAAE,GAAA,CAAI,GAAA,CAAI,SAAS,OAAO,CAAA;AAC7D,IAAA,CAAA,CAAE,GAAA,CAAI,aAAa,OAAO,CAAA;AAC1B,IAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,OAAA,EAAS,OAAO,CAAA;AAC9C,IAAA,IAAI,SAAS,OAAO,CAAA,CAAE,KAAK,OAAA,CAAQ,IAAA,EAAM,QAAQ,MAAM,CAAA;AACvD,IAAA,MAAM,IAAA,EAAK;AAAA,EACf,CAAA;AACJ","file":"server.mjs","sourcesContent":["const encoder = new TextEncoder(), decoder = new TextDecoder(), strictDecoder = new TextDecoder(\"utf-8\", { fatal: !0 }), UINT32_RANGE = 2 ** 32;\nfunction concat(...buffers) {\n const size = buffers.reduce((acc, { length }) => acc + length, 0), buf = new Uint8Array(size);\n let i = 0;\n for (const buffer of buffers)\n buf.set(buffer, i), i += buffer.length;\n return buf;\n}\nfunction writeUInt32BE(buf, value, offset) {\n if (value < 0 || value >= UINT32_RANGE)\n throw new RangeError(`value must be >= 0 and <= ${UINT32_RANGE - 1}. Received ${value}`);\n buf.set([value >>> 24, value >>> 16, value >>> 8, value & 255], offset);\n}\nfunction uint64be(value) {\n const high = Math.floor(value / UINT32_RANGE), low = value % UINT32_RANGE, buf = new Uint8Array(8);\n return writeUInt32BE(buf, high, 0), writeUInt32BE(buf, low, 4), buf;\n}\nfunction uint32be(value) {\n const buf = new Uint8Array(4);\n return writeUInt32BE(buf, value), buf;\n}\nconst NON_ASCII = /[^\\x00-\\x7f]/;\nfunction encode(string) {\n if (typeof string == \"string\" && string.length >= 128) {\n if (NON_ASCII.test(string))\n throw new TypeError(\"non-ASCII string encountered in encode()\");\n return encoder.encode(string);\n }\n const bytes = new Uint8Array(string.length);\n for (let i = 0; i < string.length; i++) {\n const code = string.charCodeAt(i);\n if (code > 127)\n throw new TypeError(\"non-ASCII string encountered in encode()\");\n bytes[i] = code;\n }\n return bytes;\n}\nfunction encodeBase64(input, url = !1) {\n if (Uint8Array.prototype.toBase64)\n return input.toBase64({ alphabet: url ? \"base64url\" : \"base64\", omitPadding: url });\n const CHUNK_SIZE = 32768, arr = [];\n for (let i = 0; i < input.length; i += CHUNK_SIZE)\n arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));\n const encoded = btoa(arr.join(\"\"));\n return url ? encoded.replace(/=/g, \"\").replace(/\\+/g, \"-\").replace(/\\//g, \"_\") : encoded;\n}\nfunction decodeBase64(encoded, url = !1) {\n if (Uint8Array.fromBase64)\n return Uint8Array.fromBase64(encoded, { alphabet: url ? \"base64url\" : \"base64\" });\n if (url) {\n if (encoded.includes(\"+\") || encoded.includes(\"/\"))\n throw new TypeError(\"Invalid base64url\");\n encoded = encoded.replace(/-/g, \"+\").replace(/_/g, \"/\");\n }\n const binary = atob(encoded), bytes = new Uint8Array(binary.length);\n for (let i = 0; i < binary.length; i++)\n bytes[i] = binary.charCodeAt(i);\n return bytes;\n}\nasync function digest(algorithm, data) {\n const subtleDigest = `SHA-${algorithm.slice(-3)}`;\n return new Uint8Array(await crypto.subtle.digest(subtleDigest, data));\n}\nexport {\n concat,\n decodeBase64,\n decoder,\n digest,\n encode,\n encodeBase64,\n encoder,\n strictDecoder,\n uint32be,\n uint64be\n};\n","class JOSEError extends Error {\n static code = \"ERR_JOSE_GENERIC\";\n code = \"ERR_JOSE_GENERIC\";\n constructor(message, options) {\n super(message, options), this.name = this.constructor.name, Error.captureStackTrace?.(this, this.constructor);\n }\n}\nclass JWTClaimValidationFailed extends JOSEError {\n static code = \"ERR_JWT_CLAIM_VALIDATION_FAILED\";\n code = \"ERR_JWT_CLAIM_VALIDATION_FAILED\";\n claim;\n reason;\n payload;\n constructor(message, payload, claim = \"unspecified\", reason = \"unspecified\") {\n super(message, { cause: { claim, reason, payload } }), this.claim = claim, this.reason = reason, this.payload = payload;\n }\n}\nclass JWTExpired extends JOSEError {\n static code = \"ERR_JWT_EXPIRED\";\n code = \"ERR_JWT_EXPIRED\";\n claim;\n reason;\n payload;\n constructor(message, payload, claim = \"unspecified\", reason = \"unspecified\") {\n super(message, { cause: { claim, reason, payload } }), this.claim = claim, this.reason = reason, this.payload = payload;\n }\n}\nclass JOSEAlgNotAllowed extends JOSEError {\n static code = \"ERR_JOSE_ALG_NOT_ALLOWED\";\n code = \"ERR_JOSE_ALG_NOT_ALLOWED\";\n}\nclass JOSENotSupported extends JOSEError {\n static code = \"ERR_JOSE_NOT_SUPPORTED\";\n code = \"ERR_JOSE_NOT_SUPPORTED\";\n}\nclass JWEDecryptionFailed extends JOSEError {\n static code = \"ERR_JWE_DECRYPTION_FAILED\";\n code = \"ERR_JWE_DECRYPTION_FAILED\";\n constructor(message = \"decryption operation failed\", options) {\n super(message, options);\n }\n}\nclass JWEInvalid extends JOSEError {\n static code = \"ERR_JWE_INVALID\";\n code = \"ERR_JWE_INVALID\";\n}\nclass JWSInvalid extends JOSEError {\n static code = \"ERR_JWS_INVALID\";\n code = \"ERR_JWS_INVALID\";\n}\nclass JWTInvalid extends JOSEError {\n static code = \"ERR_JWT_INVALID\";\n code = \"ERR_JWT_INVALID\";\n}\nclass JWKInvalid extends JOSEError {\n static code = \"ERR_JWK_INVALID\";\n code = \"ERR_JWK_INVALID\";\n}\nclass JWKSInvalid extends JOSEError {\n static code = \"ERR_JWKS_INVALID\";\n code = \"ERR_JWKS_INVALID\";\n}\nclass JWKSNoMatchingKey extends JOSEError {\n static code = \"ERR_JWKS_NO_MATCHING_KEY\";\n code = \"ERR_JWKS_NO_MATCHING_KEY\";\n constructor(message = \"no applicable key found in the JSON Web Key Set\", options) {\n super(message, options);\n }\n}\nclass JWKSMultipleMatchingKeys extends JOSEError {\n [Symbol.asyncIterator] = async function* () {\n };\n static code = \"ERR_JWKS_MULTIPLE_MATCHING_KEYS\";\n code = \"ERR_JWKS_MULTIPLE_MATCHING_KEYS\";\n constructor(message = \"multiple matching keys found in the JSON Web Key Set\", options) {\n super(message, options);\n }\n}\nclass JWKSTimeout extends JOSEError {\n static code = \"ERR_JWKS_TIMEOUT\";\n code = \"ERR_JWKS_TIMEOUT\";\n constructor(message = \"request timed out\", options) {\n super(message, options);\n }\n}\nclass JWSSignatureVerificationFailed extends JOSEError {\n static code = \"ERR_JWS_SIGNATURE_VERIFICATION_FAILED\";\n code = \"ERR_JWS_SIGNATURE_VERIFICATION_FAILED\";\n constructor(message = \"signature verification failed\", options) {\n super(message, options);\n }\n}\nexport {\n JOSEAlgNotAllowed,\n JOSEError,\n JOSENotSupported,\n JWEDecryptionFailed,\n JWEInvalid,\n JWKInvalid,\n JWKSInvalid,\n JWKSMultipleMatchingKeys,\n JWKSNoMatchingKey,\n JWKSTimeout,\n JWSInvalid,\n JWSSignatureVerificationFailed,\n JWTClaimValidationFailed,\n JWTExpired,\n JWTInvalid\n};\n","import { encoder, decoder, encodeBase64, decodeBase64 } from \"../lib/buffer_utils.js\";\nconst invalid = \"The input to be decoded is not correctly encoded.\";\nfunction decode(input) {\n try {\n return decodeBase64(typeof input == \"string\" ? input : decoder.decode(input), !0);\n } catch (cause) {\n throw new TypeError(invalid, { cause });\n }\n}\nfunction encode(input) {\n return encodeBase64(typeof input == \"string\" ? encoder.encode(input) : input, !0);\n}\nexport {\n decode,\n encode\n};\n","import { JOSENotSupported, JWSInvalid } from \"../util/errors.js\";\nimport { decode } from \"../util/base64url.js\";\nimport { encode, strictDecoder } from \"./buffer_utils.js\";\nfunction assertUint8Array(input, label) {\n if (!(input instanceof Uint8Array))\n throw new TypeError(`${label} must be an instance of Uint8Array`);\n}\nfunction isObject(input) {\n if (typeof input != \"object\" || input === null || Object.prototype.toString.call(input) !== \"[object Object]\")\n return !1;\n const prototype = Object.getPrototypeOf(input);\n return prototype === null || Object.getPrototypeOf(prototype) === null;\n}\nfunction isJwkSet(input) {\n return isObject(input) && Array.isArray(input.keys) && Array.from(input.keys).every(isObject);\n}\nfunction isDisjoint(...headers) {\n const parameters = /* @__PURE__ */ new Set();\n for (const header of headers)\n if (header)\n for (const parameter of Object.keys(header)) {\n if (parameters.has(parameter))\n return !1;\n parameters.add(parameter);\n }\n return !0;\n}\nfunction assertNotSet(value, name) {\n if (value !== void 0)\n throw new TypeError(`${name} can only be called once`);\n}\nfunction decodeBase64url(value, label, ErrorClass) {\n try {\n return decode(value);\n } catch (cause) {\n throw new ErrorClass(`Failed to base64url decode the ${label}`, { cause });\n }\n}\nfunction encodeAsciiMember(value, label, ErrorClass) {\n try {\n return encode(value);\n } catch (cause) {\n throw new ErrorClass(`The ${label} is not a valid base64url string`, { cause });\n }\n}\nfunction parseJoseHeader(encodedProtectedHeader, ErrorClass, message) {\n let parsed;\n try {\n parsed = JSON.parse(strictDecoder.decode(decode(encodedProtectedHeader)));\n } catch (cause) {\n throw new ErrorClass(message, { cause });\n }\n if (!isObject(parsed))\n throw new ErrorClass(message);\n return parsed;\n}\nconst JWS_RECOGNIZED = { __proto__: null, b64: !0 }, JWE_RECOGNIZED = { __proto__: null };\nfunction validateAlgorithms(option, algorithms) {\n if (algorithms !== void 0 && (!Array.isArray(algorithms) || algorithms.some((s) => typeof s != \"string\")))\n throw new TypeError(`\"${option}\" option must be an array of strings`);\n return algorithms === void 0 ? void 0 : new Set(algorithms);\n}\nfunction validateCritDuplicates(Err, protectedHeader) {\n const { crit } = protectedHeader ?? {};\n if (Array.isArray(crit) && new Set(crit).size !== crit.length)\n throw new Err('\"crit\" (Critical) Header Parameter MUST NOT contain duplicate values');\n}\nfunction validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {\n if (joseHeader.crit !== void 0 && protectedHeader?.crit === void 0)\n throw new Err('\"crit\" (Critical) Header Parameter MUST be integrity protected');\n if (!protectedHeader || protectedHeader.crit === void 0)\n return [];\n if (!Array.isArray(protectedHeader.crit) || protectedHeader.crit.length === 0 || protectedHeader.crit.some((input) => typeof input != \"string\" || input.length === 0))\n throw new Err('\"crit\" (Critical) Header Parameter MUST be an array of non-empty strings when present');\n const recognized = recognizedOption === void 0 ? recognizedDefault : { __proto__: null, ...recognizedOption, ...recognizedDefault };\n for (const parameter of protectedHeader.crit) {\n if (!(parameter in recognized))\n throw new JOSENotSupported(`Extension Header Parameter \"${parameter}\" is not recognized`);\n if (!Object.hasOwn(joseHeader, parameter) || joseHeader[parameter] === void 0)\n throw new Err(`Extension Header Parameter \"${parameter}\" is missing`);\n if (recognized[parameter] && (!Object.hasOwn(protectedHeader, parameter) || protectedHeader[parameter] === void 0))\n throw new Err(`Extension Header Parameter \"${parameter}\" MUST be integrity protected`);\n }\n return protectedHeader.crit;\n}\nfunction validateB64(protectedHeader, extensions) {\n if (extensions.includes(\"b64\")) {\n const b64 = protectedHeader.b64;\n if (typeof b64 != \"boolean\")\n throw new JWSInvalid('The \"b64\" (base64url-encode payload) Header Parameter must be a boolean');\n return b64;\n }\n return !0;\n}\nfunction serializeJoseHeader(Err, header) {\n let serialized, parsed;\n try {\n serialized = JSON.stringify(header), parsed = JSON.parse(serialized);\n } catch (cause) {\n throw new Err(\"JOSE Header is not valid JSON\", { cause });\n }\n if (!isObject(parsed))\n throw new Err(\"JOSE Header is not a JSON object\");\n return [parsed, serialized];\n}\nexport {\n JWE_RECOGNIZED,\n JWS_RECOGNIZED,\n assertNotSet,\n assertUint8Array,\n decodeBase64url,\n encodeAsciiMember,\n isDisjoint,\n isJwkSet,\n isObject,\n parseJoseHeader,\n serializeJoseHeader,\n validateAlgorithms,\n validateB64,\n validateCrit,\n validateCritDuplicates\n};\n","import { isObject } from \"./validate.js\";\nimport { decode } from \"../util/base64url.js\";\nimport { JOSENotSupported } from \"../util/errors.js\";\nconst tag = (key) => key[Symbol.toStringTag], jwkMatchesOp = (entry, key, usage) => {\n const { alg } = entry;\n if (key.use !== void 0) {\n const expected = usage === \"sign\" || usage === \"verify\" ? \"sig\" : \"enc\";\n if (key.use !== expected)\n throw new TypeError(`Invalid key for this operation, its \"use\" must be \"${expected}\" when present`);\n }\n if (key.alg !== void 0 && key.alg !== alg)\n throw new TypeError(`Invalid key for this operation, its \"alg\" must be \"${alg}\" when present`);\n if (Array.isArray(key.key_ops)) {\n const expectedKeyOp = usage === \"encrypt\" || usage === \"decrypt\" ? entry.ops?.[usage === \"encrypt\" ? 0 : 1] : usage;\n if (expectedKeyOp && !key.key_ops.includes(expectedKeyOp))\n throw new TypeError(`Invalid key for this operation, its \"key_ops\" must include \"${expectedKeyOp}\" when present`);\n }\n};\nasync function prepareKey(entry, key, usage) {\n const { alg, secret } = entry, requiresPrivateKey = usage === \"decrypt\" || usage === \"sign\";\n if (secret && key instanceof Uint8Array)\n return key;\n let normalized, keyObject;\n if (isObject(key)) {\n if (normalized = normalizeJwk(key), typeof normalized.kty != \"string\")\n throw invalidKeyType(alg, key, secret);\n if (!(secret ? normalized.kty === \"oct\" && typeof normalized.k == \"string\" : normalized.kty !== \"oct\" && (requiresPrivateKey ? normalized.kty === \"AKP\" && typeof normalized.priv == \"string\" || typeof normalized.d == \"string\" : normalized.d === void 0 && normalized.priv === void 0)))\n throw new TypeError(secret ? 'JSON Web Key for symmetric algorithms must have JWK \"kty\" (Key Type) equal to \"oct\" and the JWK \"k\" (Key Value) present' : `JSON Web Key for this operation must be a ${requiresPrivateKey ? \"private\" : \"public\"} JWK`);\n if (jwkMatchesOp(entry, normalized, usage), normalized.kty === \"oct\")\n return decode(normalized.k);\n if (!Object.isFrozen(key)) {\n const { key_ops } = key;\n Array.isArray(key_ops) && Object.freeze(key_ops), Object.freeze(key);\n }\n } else {\n if (!isKeyLike(key))\n throw invalidKeyType(alg, key, secret);\n const expectedType = secret ? \"secret\" : requiresPrivateKey ? \"private\" : \"public\";\n if (key.type !== expectedType && (secret || [\"secret\", \"public\", \"private\"].includes(key.type)))\n throw new TypeError(`${tag(key)} instances must be of type \"${expectedType}\" for the ${alg} algorithm`);\n if (isCryptoKey(key))\n return key;\n if (keyObject = key, keyObject.type === \"secret\")\n return keyObject.export();\n }\n cache ||= /* @__PURE__ */ new WeakMap();\n const cacheKey = key;\n let cached = cache.get(cacheKey);\n if (cached?.[alg])\n return cached[alg];\n if (cached || cache.set(cacheKey, cached = {}), keyObject && typeof keyObject.toCryptoKey == \"function\") {\n const isPublic = keyObject.type === \"public\", crv = nist[keyObject.asymmetricKeyDetails?.namedCurve], params = entry.resolve?.({ crv, asymmetricKeyType: keyObject.asymmetricKeyType }) ?? entry.subtle;\n return cached[alg] = keyObject.toCryptoKey(params, isPublic, entry.usages[isPublic ? 0 : 1]);\n }\n return normalized ??= keyObject.export({ format: \"jwk\" }), normalized.alg = alg, cached[alg] = await jwkToKey(entry, normalized);\n}\nlet cache;\nconst nist = {\n __proto__: null,\n prime256v1: \"P-256\",\n secp384r1: \"P-384\",\n secp521r1: \"P-521\"\n};\nfunction assertCryptoKey(key) {\n if (!isCryptoKey(key))\n throw new Error(\"CryptoKey instance expected\");\n}\nconst isCryptoKey = (key) => {\n if (key?.[Symbol.toStringTag] === \"CryptoKey\")\n return !0;\n try {\n return key instanceof CryptoKey;\n } catch {\n return !1;\n }\n}, isKeyObject = (key) => key?.[Symbol.toStringTag] === \"KeyObject\", isKeyLike = (key) => isCryptoKey(key) || isKeyObject(key);\nfunction message(msg, actual, ...types) {\n if (types.length > 2) {\n const last = types.pop();\n msg += `one of type ${types.join(\", \")}, or ${last}.`;\n } else types.length === 2 ? msg += `one of type ${types[0]} or ${types[1]}.` : msg += `of type ${types[0]}.`;\n return actual == null ? msg += ` Received ${actual}` : typeof actual == \"function\" && actual.name ? msg += ` Received function ${actual.name}` : typeof actual == \"object\" && actual != null && actual.constructor?.name && (msg += ` Received an instance of ${actual.constructor.name}`), msg;\n}\nconst invalidKeyInput = (actual, ...types) => message(\"Key must be \", actual, ...types);\nfunction invalidKeyType(alg, actual, secret) {\n const types = [\"CryptoKey\", \"KeyObject\", \"JSON Web Key\"];\n return secret && types.push(\"Uint8Array\"), new TypeError(message(`Key for the ${alg} algorithm must be `, actual, ...types));\n}\nconst unusable = (name, prop = \"algorithm.name\") => new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);\nfunction checkUsage(key, usage) {\n if (usage && !key.usages.includes(usage))\n throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);\n}\nfunction checkModulusLength(alg, key) {\n const { modulusLength } = key.algorithm;\n if (typeof modulusLength != \"number\" || modulusLength < 2048)\n throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);\n}\nfunction checkCryptoKey(key, expected, usage) {\n const algorithm = key.algorithm;\n if (algorithm.name !== expected.name)\n throw unusable(expected.name);\n if (expected.hash && algorithm.hash?.name !== expected.hash)\n throw unusable(expected.hash, \"algorithm.hash\");\n if (expected.namedCurve && algorithm.namedCurve !== expected.namedCurve)\n throw unusable(expected.namedCurve, \"algorithm.namedCurve\");\n if (expected.length !== void 0 && algorithm.length !== expected.length)\n throw unusable(expected.length, \"algorithm.length\");\n checkUsage(key, usage);\n}\nfunction snapshotJwk(jwk) {\n return { __proto__: null, ...jwk };\n}\nfunction normalizeJwk(jwk) {\n const normalized = snapshotJwk(jwk);\n if (normalized.ext !== void 0 && typeof normalized.ext != \"boolean\")\n throw new TypeError('\"ext\" (Extractable) Parameter must be a boolean');\n if (normalized.key_ops !== void 0) {\n const value = normalized.key_ops, keyOps = Array.isArray(value) ? [...value] : void 0;\n if (!keyOps || keyOps.some((operation) => typeof operation != \"string\") || new Set(keyOps).size !== keyOps.length)\n throw new TypeError('\"key_ops\" (Key Operations) Parameter must be an array of unique strings');\n normalized.key_ops = keyOps;\n }\n return normalized;\n}\nfunction validateExtractableOption(extractable) {\n if (extractable !== void 0 && typeof extractable != \"boolean\")\n throw new TypeError('\"extractable\" option must be a boolean');\n return extractable;\n}\nasync function jwkToKey(entry, jwk, extractable) {\n if (!entry.kty.includes(jwk.kty))\n throw new JOSENotSupported('Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value');\n const algorithm = entry.resolve?.({ kty: jwk.kty, crv: jwk.crv }) ?? entry.subtle, isPrivate = !!(jwk.d || jwk.priv), keyData = { ...jwk, ext: extractable ?? jwk.ext };\n return keyData.kty !== \"AKP\" && delete keyData.alg, delete keyData.use, crypto.subtle.importKey(\"jwk\", keyData, algorithm, keyData.ext ?? !isPrivate, jwk.key_ops ?? entry.usages[isPrivate ? 1 : 0]);\n}\nasync function rawKey(key, expected, usage, extractable = !1) {\n return key instanceof Uint8Array && (key = await crypto.subtle.importKey(\"raw\", key, expected, extractable, [usage])), checkCryptoKey(key, expected, usage), key;\n}\nexport {\n assertCryptoKey,\n checkCryptoKey,\n checkModulusLength,\n checkUsage,\n invalidKeyInput,\n isCryptoKey,\n isKeyLike,\n isKeyObject,\n jwkToKey,\n normalizeJwk,\n prepareKey,\n rawKey,\n snapshotJwk,\n validateExtractableOption\n};\n","function table(entries) {\n const out = { __proto__: null };\n for (const alg in entries)\n out[alg] = { ...entries[alg], alg };\n return out;\n}\nexport {\n table\n};\n","import { JOSENotSupported } from \"../util/errors.js\";\nimport { table } from \"./key_descriptor.js\";\nconst wrap = [\n [\"encrypt\", \"wrapKey\"],\n [\"decrypt\", \"unwrapKey\"]\n], derive = [[], [\"deriveBits\"]], none = [[], []];\nfunction rsaes(bits) {\n return {\n kty: [\"RSA\"],\n mode: \"key-encryption\",\n subtle: { name: \"RSA-OAEP\", hash: `SHA-${bits}` },\n usages: wrap,\n ops: [\"wrapKey\", \"unwrapKey\"]\n };\n}\nfunction ecdh(mode) {\n return {\n kty: [\"EC\", \"OKP\"],\n mode,\n subtle: { name: \"ECDH\" },\n resolve: ({ kty, crv, asymmetricKeyType }) => {\n if (crv === \"X25519\" || asymmetricKeyType === \"x25519\")\n return { name: \"X25519\" };\n if (kty === \"OKP\")\n throw new JOSENotSupported('Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value');\n return { name: \"ECDH\", namedCurve: crv };\n },\n usages: derive,\n ops: [void 0, \"deriveBits\"]\n };\n}\nfunction aeskw(bits, gcm = !1) {\n return {\n kty: [\"oct\"],\n mode: \"key-wrapping\",\n secret: !0,\n subtle: { name: gcm ? \"AES-GCM\" : \"AES-KW\", length: bits },\n usages: none,\n ops: gcm ? [\"encrypt\", \"decrypt\"] : [\"wrapKey\", \"unwrapKey\"]\n };\n}\nfunction pbes2() {\n return {\n kty: [\"oct\"],\n mode: \"key-wrapping\",\n secret: !0,\n subtle: { name: \"PBKDF2\" },\n usages: none,\n ops: [\"deriveBits\", \"deriveBits\"]\n };\n}\nconst JWE = table({\n dir: {\n kty: [\"oct\"],\n mode: \"direct-encryption\",\n secret: !0,\n subtle: { name: \"AES-GCM\" },\n usages: none,\n ops: [\"encrypt\", \"decrypt\"]\n },\n \"RSA-OAEP\": rsaes(1),\n \"RSA-OAEP-256\": rsaes(256),\n \"RSA-OAEP-384\": rsaes(384),\n \"RSA-OAEP-512\": rsaes(512),\n \"ECDH-ES\": ecdh(\"direct-key-agreement\"),\n \"ECDH-ES+A128KW\": ecdh(\"key-agreement-with-key-wrapping\"),\n \"ECDH-ES+A192KW\": ecdh(\"key-agreement-with-key-wrapping\"),\n \"ECDH-ES+A256KW\": ecdh(\"key-agreement-with-key-wrapping\"),\n A128KW: aeskw(128),\n A192KW: aeskw(192),\n A256KW: aeskw(256),\n A128GCMKW: aeskw(128, !0),\n A192GCMKW: aeskw(192, !0),\n A256GCMKW: aeskw(256, !0),\n \"PBES2-HS256+A128KW\": pbes2(),\n \"PBES2-HS384+A192KW\": pbes2(),\n \"PBES2-HS512+A256KW\": pbes2()\n}), contentOps = [\"encrypt\", \"decrypt\"];\nfunction contentEncryption(bits, cbc = !1) {\n return {\n kty: [\"oct\"],\n secret: !0,\n subtle: { name: cbc ? \"AES-CBC\" : \"AES-GCM\", length: bits },\n usages: none,\n ops: contentOps,\n cekBits: bits,\n ivBits: cbc ? 128 : 96,\n cbc\n };\n}\nconst ENC = table({\n A128GCM: contentEncryption(128),\n A192GCM: contentEncryption(192),\n A256GCM: contentEncryption(256),\n \"A128CBC-HS256\": contentEncryption(256, !0),\n \"A192CBC-HS384\": contentEncryption(384, !0),\n \"A256CBC-HS512\": contentEncryption(512, !0)\n});\nfunction unsupported(parameter, name) {\n throw new JOSENotSupported(`Invalid or unsupported \"${parameter}\" (JWE ${name}) header value`);\n}\nfunction jweAlgorithm(alg) {\n return (typeof alg == \"string\" ? JWE[alg] : void 0) ?? unsupported(\"alg\", \"Algorithm\");\n}\nfunction isJWECEKTransport(algorithm) {\n return algorithm.mode === \"key-wrapping\" || algorithm.mode === \"key-encryption\" || algorithm.mode === \"key-agreement-with-key-wrapping\";\n}\nfunction jweEncryption(enc) {\n return (typeof enc == \"string\" ? ENC[enc] : void 0) ?? unsupported(\"enc\", \"Encryption Algorithm\");\n}\nexport {\n JWE,\n isJWECEKTransport,\n jweAlgorithm,\n jweEncryption\n};\n","import { JOSENotSupported } from \"../util/errors.js\";\nimport { table } from \"./key_descriptor.js\";\nconst sig = [[\"verify\"], [\"sign\"]];\nfunction hmac(bits) {\n const subtle = { name: \"HMAC\", hash: `SHA-${bits}` };\n return { kty: [\"oct\"], secret: !0, subtle, signing: subtle, usages: sig };\n}\nfunction rsa(bits, saltLength) {\n const subtle = { name: saltLength ? \"RSA-PSS\" : \"RSASSA-PKCS1-v1_5\", hash: `SHA-${bits}` };\n return {\n kty: [\"RSA\"],\n subtle,\n signing: saltLength ? { ...subtle, saltLength } : subtle,\n usages: sig,\n minRsaBits: 2048\n };\n}\nfunction ecdsa(crv, bits) {\n return {\n kty: [\"EC\"],\n crv,\n subtle: { name: \"ECDSA\", namedCurve: crv },\n signing: { name: \"ECDSA\", hash: `SHA-${bits}` },\n usages: sig\n };\n}\nfunction eddsa() {\n const subtle = { name: \"Ed25519\" };\n return {\n kty: [\"OKP\"],\n crv: \"Ed25519\",\n subtle,\n signing: subtle,\n usages: sig\n };\n}\nfunction mldsa(parameterSet) {\n const subtle = { name: `ML-DSA-${parameterSet}` };\n return {\n kty: [\"AKP\"],\n subtle,\n signing: subtle,\n usages: sig\n };\n}\nconst JWS = table({\n HS256: hmac(256),\n HS384: hmac(384),\n HS512: hmac(512),\n RS256: rsa(256),\n RS384: rsa(384),\n RS512: rsa(512),\n PS256: rsa(256, 32),\n PS384: rsa(384, 48),\n PS512: rsa(512, 64),\n ES256: ecdsa(\"P-256\", 256),\n ES384: ecdsa(\"P-384\", 384),\n ES512: ecdsa(\"P-521\", 512),\n EdDSA: eddsa(),\n Ed25519: eddsa(),\n \"ML-DSA-44\": mldsa(44),\n \"ML-DSA-65\": mldsa(65),\n \"ML-DSA-87\": mldsa(87)\n});\nfunction jwsAlgorithm(alg) {\n const entry = typeof alg == \"string\" ? JWS[alg] : void 0;\n if (!entry)\n throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);\n return entry;\n}\nexport {\n JWS,\n jwsAlgorithm\n};\n","import { JOSENotSupported } from \"../util/errors.js\";\nimport { JWS } from \"./jws_algorithms.js\";\nimport { JWE } from \"./jwe_algorithms.js\";\nconst algArgument = '\"alg\" (Algorithm)';\nfunction unsupportedAlg(source = 'JWK \"alg\" (Algorithm) Parameter') {\n throw new JOSENotSupported(`Invalid or unsupported ${source} value`);\n}\nfunction keyAlgorithm(alg, source) {\n return (typeof alg == \"string\" ? JWS[alg] ?? JWE[alg] : void 0) ?? unsupportedAlg(source);\n}\nexport {\n algArgument,\n keyAlgorithm,\n unsupportedAlg\n};\n","import { decode as decodeBase64URL } from \"../util/base64url.js\";\nimport { fromSPKI, fromPKCS8, fromX509 } from \"../lib/asn1.js\";\nimport { jwkToKey, validateExtractableOption, normalizeJwk } from \"../lib/key.js\";\nimport { keyAlgorithm } from \"../lib/key_algorithm.js\";\nimport { JOSENotSupported } from \"../util/errors.js\";\nimport { isObject } from \"../lib/validate.js\";\nasync function importSPKI(spki, alg, options) {\n if (typeof spki != \"string\" || spki.indexOf(\"-----BEGIN PUBLIC KEY-----\") !== 0)\n throw new TypeError('\"spki\" must be SPKI formatted string');\n return fromSPKI(spki, alg, options);\n}\nasync function importX509(x509, alg, options) {\n if (typeof x509 != \"string\" || x509.indexOf(\"-----BEGIN CERTIFICATE-----\") !== 0)\n throw new TypeError('\"x509\" must be X.509 formatted string');\n return fromX509(x509, alg, options);\n}\nasync function importPKCS8(pkcs8, alg, options) {\n if (typeof pkcs8 != \"string\" || pkcs8.indexOf(\"-----BEGIN PRIVATE KEY-----\") !== 0)\n throw new TypeError('\"pkcs8\" must be PKCS#8 formatted string');\n return fromPKCS8(pkcs8, alg, options);\n}\nasync function importJWK(jwk, alg, options) {\n if (!isObject(jwk))\n throw new TypeError(\"JWK must be an object\");\n const normalized = normalizeJwk(jwk), extractable = validateExtractableOption(options?.extractable), { alg: jwkAlg } = normalized;\n if (alg ??= jwkAlg, normalized.kty !== \"oct\" && !alg)\n throw new TypeError('\"alg\" argument is required when \"jwk.alg\" is not present');\n switch (normalized.kty) {\n case \"oct\":\n if (typeof normalized.k != \"string\")\n throw new TypeError('missing \"k\" (Key Value) Parameter value');\n return decodeBase64URL(normalized.k);\n case \"AKP\": {\n if (typeof jwkAlg != \"string\" || !jwkAlg)\n throw new TypeError('missing \"alg\" (Algorithm) Parameter value');\n if (alg !== jwkAlg)\n throw new TypeError(\"JWK alg and alg option value mismatch\");\n return jwkToKey(keyAlgorithm(alg), normalized, extractable);\n }\n case \"RSA\":\n case \"EC\":\n case \"OKP\":\n return jwkToKey(keyAlgorithm(alg), normalized, extractable);\n default:\n throw new JOSENotSupported('Unsupported \"kty\" (Key Type) Parameter value');\n }\n}\nexport {\n importJWK,\n importPKCS8,\n importSPKI,\n importX509\n};\n","/**\n * `oc.identity.verifyActivityAttestation` — one-call ed25519 verifier\n * for a /api/me/activity-attestation bundle.\n *\n * Cashes the \"trivially to verify\" strategic claim: an integrator\n * receiving a signed attestation JSON from a user calls one function,\n * gets a typed result with per-check detail, never reaches into\n * @noble/curves or jose themselves.\n *\n * import { oc } from '@orangecheck/me-client';\n *\n * const result = await oc.identity.verifyActivityAttestation(bundle);\n * if (!result.ok) return res.status(401).send(result.reason);\n * // result.attestation is typed · safe to gate on lifetime_sats etc.\n *\n * The JWKS issuer is me.ochk.io (the envelope key), DISTINCT from\n * the auth host's ochk.io JWKS that signs webhooks. Same Ed25519\n * curve, same kid lookup pattern, fetched + cached separately.\n */\n\nimport { importJWK, type CryptoKey, type KeyObject } from 'jose';\n\nconst DEFAULT_ISSUER = 'https://me.ochk.io';\nconst DEFAULT_TTL_MS = 60 * 60 * 1000;\n/** How old a key list may be and still stand in for one that can't be fetched. */\nconst DEFAULT_MAX_STALE_MS = 6 * 60 * 60 * 1000;\n/** An unknown kid refetches the key list at most this often per issuer. */\nconst FORCED_REFRESH_MIN_INTERVAL_MS = 60_000;\nconst ENVELOPE_JWKS_PATH = '/.well-known/oc-envelope-jwks.json';\n\nexport interface ActivityAttestation {\n id: string;\n v: 1;\n kind: 'oc-me-activity';\n did_oc: string;\n event_count: number;\n human_event_count: number;\n lifetime_sats: number;\n distinct_integrator_count: number;\n oldest_event_at: string | null;\n active_days: number;\n computed_at: string;\n expires_at: string;\n}\n\nexport interface ActivityAttestationBundle {\n /** A readable copy. Never trusted: the result is read from the signed\n * bytes, and a copy that differs from them fails the check. */\n attestation?: ActivityAttestation;\n sig: string;\n kid: string;\n canonical_b64: string;\n}\n\nexport interface ActivityVerifyCheck {\n ok: boolean;\n label: string;\n detail?: string;\n}\n\nexport interface ActivityVerifyResult {\n ok: boolean;\n reason?: string;\n attestation?: ActivityAttestation;\n checks: ActivityVerifyCheck[];\n}\n\ninterface OcEnvelopePublicJwk {\n kty: 'OKP';\n crv: 'Ed25519';\n x: string;\n kid: string;\n alg?: 'EdDSA';\n use?: 'sig';\n}\n\nexport interface VerifyActivityOptions {\n /** Override the me.ochk.io issuer (defaults to https://me.ochk.io).\n * Useful for staging / self-hosted dev. */\n issuer?: string;\n /** Pass a JWK directly to skip the network fetch · convenient when\n * embedding the public key in your service for air-gapped or\n * edge-runtime deployments. */\n jwk?: OcEnvelopePublicJwk;\n /** JWKS cache TTL in ms. Defaults to 1h. Stale-on-error falls back\n * to the previous cached value, for at most `jwksMaxStaleMs`. */\n jwksCacheTtlMs?: number;\n /** How old a cached JWKS may be and still stand in during an outage.\n * Defaults to 6h; past it, verification fails closed. */\n jwksMaxStaleMs?: number;\n /** Optional · override \"now\" for deterministic tests. */\n now?: Date;\n}\n\ntype AuthKey = CryptoKey | KeyObject;\n\ninterface JwksCacheEntry {\n keys: Record<string, AuthKey>;\n fetchedAt: number;\n}\n\nconst jwksCache = new Map<string, JwksCacheEntry>();\nconst inflight = new Map<string, Promise<JwksCacheEntry>>();\nconst lastForcedRefresh = new Map<string, number>();\n\nasync function fetchEnvelopeJwks(\n issuer: string,\n ttlMs: number,\n maxStaleMs = DEFAULT_MAX_STALE_MS\n): Promise<JwksCacheEntry> {\n const cached = jwksCache.get(issuer);\n if (cached && Date.now() - cached.fetchedAt < ttlMs) return cached;\n const existing = inflight.get(issuer);\n if (existing) return existing;\n const p = (async (): Promise<JwksCacheEntry> => {\n try {\n const url = `${issuer.replace(/\\/$/, '')}${ENVELOPE_JWKS_PATH}`;\n const res = await fetch(url, { headers: { Accept: 'application/json' } });\n if (!res.ok) throw new Error(`envelope JWKS fetch ${url} returned ${res.status}`);\n const json = (await res.json()) as { keys: OcEnvelopePublicJwk[] };\n if (!json || !Array.isArray(json.keys)) {\n throw new Error(`envelope JWKS at ${url} did not return {keys:[…]}`);\n }\n const keys: Record<string, AuthKey> = {};\n for (const k of json.keys) {\n if (typeof k.kid !== 'string') continue;\n try {\n keys[k.kid] = (await importJWK(k, 'EdDSA')) as AuthKey;\n } catch {\n /* skip keys that won't import */\n }\n }\n const entry: JwksCacheEntry = { keys, fetchedAt: Date.now() };\n jwksCache.set(issuer, entry);\n return entry;\n } catch (err) {\n // A key the issuer removed must stop verifying even while its list can't be fetched.\n const stale = jwksCache.get(issuer);\n if (stale && Date.now() - stale.fetchedAt < maxStaleMs) return stale;\n throw err;\n }\n })().finally(() => {\n inflight.delete(issuer);\n });\n inflight.set(issuer, p);\n return p;\n}\n\nfunction hexToBytes(hex: string): Uint8Array | null {\n if (typeof hex !== 'string') return null;\n const s = hex.trim();\n if (s.length === 0 || s.length % 2 !== 0) return null;\n const out = new Uint8Array(s.length / 2);\n for (let i = 0; i < out.length; i++) {\n const b = parseInt(s.slice(i * 2, i * 2 + 2), 16);\n if (Number.isNaN(b)) return null;\n out[i] = b;\n }\n return out;\n}\n\nfunction base64ToBytes(b64: string): Uint8Array | null {\n try {\n const bin =\n typeof atob === 'function'\n ? atob(b64)\n : Buffer.from(b64, 'base64').toString('binary');\n const out = new Uint8Array(bin.length);\n for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);\n return out;\n } catch {\n return null;\n }\n}\n\nfunction bytesToHex(bytes: Uint8Array): string {\n let out = '';\n for (const b of bytes) out += b.toString(16).padStart(2, '0');\n return out;\n}\n\nasync function sha256(bytes: Uint8Array): Promise<Uint8Array> {\n const subtle =\n typeof globalThis.crypto !== 'undefined' && globalThis.crypto.subtle\n ? globalThis.crypto.subtle\n : null;\n if (!subtle) {\n throw new Error('crypto.subtle unavailable · need Node 20+ / modern browser / Edge runtime');\n }\n const buf = await subtle.digest('SHA-256', bytes as unknown as ArrayBuffer);\n return new Uint8Array(buf);\n}\n\nfunction toArrayBuffer(view: Uint8Array): ArrayBuffer {\n const buf = new ArrayBuffer(view.byteLength);\n new Uint8Array(buf).set(view);\n return buf;\n}\n\nasync function verifyEd25519(\n key: AuthKey,\n sig: Uint8Array,\n msg: Uint8Array\n): Promise<boolean> {\n const subtle =\n typeof globalThis.crypto !== 'undefined' && globalThis.crypto.subtle\n ? globalThis.crypto.subtle\n : null;\n if (!subtle) return false;\n try {\n return await subtle.verify(\n 'Ed25519',\n key as CryptoKey,\n toArrayBuffer(sig),\n toArrayBuffer(msg)\n );\n } catch {\n return false;\n }\n}\n\n/** The signed fields, in the order me.ochk.io encodes them. */\nconst SIGNED_FIELDS = [\n 'v',\n 'kind',\n 'did_oc',\n 'event_count',\n 'human_event_count',\n 'lifetime_sats',\n 'distinct_integrator_count',\n 'oldest_event_at',\n 'active_days',\n 'computed_at',\n 'expires_at',\n] as const;\nconst COUNTS = [\n 'event_count',\n 'human_event_count',\n 'lifetime_sats',\n 'distinct_integrator_count',\n 'active_days',\n] as const;\n\n/** The attestation the signature covers, read from the signed bytes, or\n * null when they are not one in canonical form. */\nfunction readSignedAttestation(canonical: Uint8Array, id: string): ActivityAttestation | null {\n const text = new TextDecoder().decode(canonical);\n let parsed: unknown;\n try {\n parsed = JSON.parse(text);\n } catch {\n return null;\n }\n if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return null;\n const o = parsed as Record<string, unknown>;\n if (o.v !== 1 || o.kind !== 'oc-me-activity' || typeof o.did_oc !== 'string') return null;\n const countsOk = COUNTS.every((k) => {\n const n = o[k];\n return typeof n === 'number' && Number.isSafeInteger(n) && n >= 0;\n });\n if (!countsOk) return null;\n if (o.oldest_event_at !== null && typeof o.oldest_event_at !== 'string') return null;\n if (typeof o.computed_at !== 'string' || typeof o.expires_at !== 'string') return null;\n const ordered = Object.fromEntries(SIGNED_FIELDS.map((k) => [k, o[k]]));\n // Only the canonical encoding counts: no extra keys, no reordering, no whitespace.\n if (JSON.stringify(ordered) !== text) return null;\n return { id, ...(ordered as Omit<ActivityAttestation, 'id'>) };\n}\n\n/** True when every field of the readable copy equals the signed value. */\nfunction sameAttestation(copy: ActivityAttestation, signed: ActivityAttestation): boolean {\n const c = copy as unknown as Record<string, unknown>;\n const v = signed as unknown as Record<string, unknown>;\n return (['id', ...SIGNED_FIELDS] as const).every((k) => c[k] === v[k]);\n}\n\n/**\n * Verify a signed activity attestation bundle. Returns a typed\n * ActivityVerifyResult with per-check detail · never throws (network\n * + parse failures surface as ok=false rows in the checks array, so\n * the caller can log them without try/catch).\n *\n * Checks, in order: bundle shape, the signed bytes decode and are an\n * attestation in canonical form, the readable copy (when given) equals\n * them, JWK with matching kid present, ed25519 signature, freshness.\n * `attestation` in the result is read from the signed bytes, and is set\n * only when every check passes.\n */\nexport async function verifyActivityAttestation(\n bundle: ActivityAttestationBundle,\n options: VerifyActivityOptions = {}\n): Promise<ActivityVerifyResult> {\n const checks: ActivityVerifyCheck[] = [];\n\n // 1. Bundle shape\n const shapeOk =\n !!bundle &&\n typeof bundle === 'object' &&\n typeof bundle.sig === 'string' &&\n typeof bundle.kid === 'string' &&\n typeof bundle.canonical_b64 === 'string' &&\n (bundle.attestation === undefined ||\n (!!bundle.attestation && typeof bundle.attestation === 'object'));\n checks.push({\n ok: shapeOk,\n label: 'bundle shape · sig / kid / canonical_b64',\n });\n if (!shapeOk) {\n return { ok: false, reason: 'bundle shape invalid', checks };\n }\n\n // 2. canonical_b64 decodes\n const canonical = base64ToBytes(bundle.canonical_b64);\n checks.push({\n ok: canonical !== null,\n label: 'canonical_b64 decodes',\n detail: canonical ? `${canonical.length} bytes` : 'invalid base64',\n });\n if (!canonical) return { ok: false, reason: 'canonical_b64 invalid base64', checks };\n\n // 3. The signed bytes are an attestation, and the readable copy says the same\n const computedId = bytesToHex(await sha256(canonical));\n const signed = readSignedAttestation(canonical, computedId);\n checks.push({\n ok: signed !== null,\n label: 'canonical_bytes are an oc-me-activity attestation in canonical form',\n });\n if (!signed) return { ok: false, reason: 'canonical bytes are not an activity attestation', checks };\n\n const copy = bundle.attestation;\n const copyOk = copy === undefined || sameAttestation(copy, signed);\n checks.push({\n ok: copyOk,\n label: 'attestation === the signed bytes, id = sha256(canonical_bytes)',\n detail: copyOk ? computedId : 'the readable copy differs from what was signed',\n });\n if (!copyOk) return { ok: false, reason: 'attestation does not match the signed bytes', checks };\n\n // 4. JWK lookup + ed25519 verify\n let key: AuthKey | null = null;\n if (options.jwk) {\n if (options.jwk.kid !== bundle.kid) {\n checks.push({\n ok: false,\n label: 'JWK with matching kid present',\n detail: `provided jwk.kid=${options.jwk.kid} but bundle.kid=${bundle.kid}`,\n });\n return { ok: false, reason: 'kid mismatch with provided jwk', checks };\n }\n try {\n key = (await importJWK(options.jwk, 'EdDSA')) as AuthKey;\n checks.push({ ok: true, label: 'JWK with matching kid present', detail: `kid ${bundle.kid} (provided)` });\n } catch (err) {\n checks.push({\n ok: false,\n label: 'JWK with matching kid present',\n detail: `provided jwk failed import: ${(err as Error).message}`,\n });\n return { ok: false, reason: 'provided jwk failed import', checks };\n }\n } else {\n const issuer = options.issuer ?? DEFAULT_ISSUER;\n const ttl = options.jwksCacheTtlMs ?? DEFAULT_TTL_MS;\n const maxStale = options.jwksMaxStaleMs ?? DEFAULT_MAX_STALE_MS;\n try {\n let entry = await fetchEnvelopeJwks(issuer, ttl, maxStale);\n key = entry.keys[bundle.kid] ?? null;\n if (!key && Date.now() - (lastForcedRefresh.get(issuer) ?? 0) >= FORCED_REFRESH_MIN_INTERVAL_MS) {\n // Cache miss · likely a rotation. Refetch, at most once a minute.\n lastForcedRefresh.set(issuer, Date.now());\n entry = await fetchEnvelopeJwks(issuer, 0, maxStale);\n key = entry.keys[bundle.kid] ?? null;\n }\n checks.push({\n ok: !!key,\n label: 'JWK with matching kid present',\n detail: key ? `kid ${bundle.kid}` : `no JWK with kid ${bundle.kid} at ${issuer}${ENVELOPE_JWKS_PATH}`,\n });\n if (!key) {\n return { ok: false, reason: `kid ${bundle.kid} not in envelope JWKS`, checks };\n }\n } catch (err) {\n checks.push({\n ok: false,\n label: 'JWK with matching kid present',\n detail: `envelope JWKS unavailable: ${(err as Error).message}`,\n });\n return {\n ok: false,\n reason: `envelope JWKS unavailable: ${(err as Error).message}`,\n checks,\n };\n }\n }\n\n const sigBytes = hexToBytes(bundle.sig);\n if (!sigBytes) {\n checks.push({\n ok: false,\n label: 'ed25519.verify(sig, canonical_bytes, jwk.public)',\n detail: 'malformed sig (expected hex)',\n });\n return { ok: false, reason: 'malformed sig', checks };\n }\n const sigOk = await verifyEd25519(key, sigBytes, canonical);\n checks.push({\n ok: sigOk,\n label: 'ed25519.verify(sig, canonical_bytes, jwk.public)',\n detail: sigOk ? 'signature valid' : 'signature does not match',\n });\n if (!sigOk) return { ok: false, reason: 'signature does not match', checks };\n\n // 5. Freshness, from the signed expiry\n const now = options.now ?? new Date();\n const expiresMs = Date.parse(signed.expires_at);\n const freshOk = Number.isFinite(expiresMs) && expiresMs > now.getTime();\n checks.push({\n ok: freshOk,\n label: 'now < attestation.expires_at',\n detail: freshOk\n ? `expires ${new Date(expiresMs).toISOString()}`\n : 'attestation has expired',\n });\n if (!freshOk) return { ok: false, reason: 'attestation has expired', checks };\n\n return { ok: true, attestation: signed, checks };\n}\n\n/** Force-refresh the envelope-JWKS cache · useful after a key rotation\n * if you don't want to wait for the TTL to expire. */\nexport async function refreshEnvelopeJwks(issuer = DEFAULT_ISSUER): Promise<void> {\n jwksCache.delete(issuer);\n await fetchEnvelopeJwks(issuer, DEFAULT_TTL_MS);\n}\n\nexport const identity = {\n verifyActivityAttestation,\n refreshEnvelopeJwks,\n};\n","/**\n * @orangecheck/me-client/server\n *\n * Server-side verification helpers for OC integrators.\n *\n * import {\n * withOcAuth,\n * getOcSession,\n * verifyOcToken,\n * verifyActivityAttestation,\n * } from '@orangecheck/me-client/server';\n *\n * Zero env vars, zero JWK handling. Internally lazy-fetches the auth\n * host's JWKS at https://ochk.io/.well-known/jwks.json and the\n * envelope JWKS at https://me.ochk.io/.well-known/oc-envelope-jwks.json,\n * caches both in-process. Integrators write code; we handle the crypto.\n *\n * Three layers of session verification, smallest to thickest:\n *\n * verifyOcToken(token) → SessionPayload | null\n * getOcSession(headers) → SessionPayload | null (cookie OR Bearer)\n * withOcAuth(handler) → Next.js Pages adapter that injects\n * req.ocSession on the request object\n * ocAuthExpress(opts?) → Express / Connect middleware\n * ocAuthHono(opts?) → Hono middleware\n *\n * Plus the activity-attestation verifier · for sybil-resistance gating:\n *\n * verifyActivityAttestation(bundle, opts?) → ActivityVerifyResult\n *\n * Same envelope-JWKS verification posture as the public /verify-activity\n * page; same five checks (shape / id / kid / sig / freshness). Use to\n * gate sensitive flows on cross-integrator lifetime_sats + duration +\n * distinct_count + active_days · all values are content-addressed and\n * signed.\n *\n * All thin wrappers around the same crypto primitives. Bring your own\n * framework.\n */\n\nimport {\n bondMeets,\n getOcSession as getOcSessionCore,\n readBondClaim,\n verifyOcToken,\n type BondClaim,\n type SessionPayload,\n type VerifyOcOptions,\n type SessionRequestHeaders,\n} from '@orangecheck/auth-core';\n\nexport { bondMeets, readBondClaim, verifyOcToken };\nexport type { BondClaim, SessionPayload, VerifyOcOptions };\n\n// Activity-attestation verifier · re-export from the identity module so\n// server-side integrators get the gating helper alongside session\n// verification without a second import path.\nexport {\n identity,\n verifyActivityAttestation,\n refreshEnvelopeJwks,\n} from './identity';\nexport type {\n ActivityAttestation,\n ActivityAttestationBundle,\n ActivityVerifyCheck,\n ActivityVerifyResult,\n VerifyActivityOptions,\n} from './identity';\n\n/**\n * Verify the OC session for a request. Accepts either:\n *\n * - A Web Headers object (Hono / edge / Fetch API): `c.req.raw.headers`\n * - A plain `{ cookie, authorization }` object (Express / Next.js Pages /\n * Fastify / etc.): `{ cookie: req.headers.cookie, authorization: req.headers.authorization }`\n *\n * Reads the `oc_session` cookie first; falls back to\n * `Authorization: Bearer <token>` so cross-domain integrators (no\n * .ochk.io cookie reach) verify the same way.\n *\n * Returns `null` for unauthenticated requests. Never throws.\n */\nexport async function getOcSession(\n headers: SessionRequestHeaders | Headers,\n options: VerifyOcOptions = {}\n): Promise<SessionPayload | null> {\n const session = await getOcSessionCore(headers, options);\n if (!session && options.audience === undefined) warnIfAudienceMissing(headers);\n return session;\n}\n\nlet warnedAudience = false;\n\n/**\n * The popup issues a token bound to your site's origin. Verified with no\n * `audience`, it is refused — correctly, since a verifier with no audience\n * accepts only family sessions — and every popup sign-in would 401 with no\n * clue why. Say so, once, the first time it happens.\n */\nfunction warnIfAudienceMissing(headers: SessionRequestHeaders | Headers): void {\n if (warnedAudience) return;\n const web = typeof Headers !== 'undefined' && headers instanceof Headers;\n const auth = web ? headers.get('authorization') : (headers as SessionRequestHeaders).authorization;\n const cookie = web ? headers.get('cookie') : (headers as SessionRequestHeaders).cookie;\n // The token arrives as a Bearer, or in the oc_session cookie your own route set.\n const bearer = typeof auth === 'string' ? /^Bearer\\s+(\\S+)$/i.exec(auth.trim())?.[1] : undefined;\n const fromCookie =\n typeof cookie === 'string' ? /(?:^|;\\s*)oc_session=([^;]+)/.exec(cookie)?.[1] : undefined;\n const m = /^([^.]+)\\.([^.]+)\\./.exec(bearer ?? fromCookie ?? '');\n if (!m) return;\n try {\n const payload = JSON.parse(base64UrlToString(m[2]!)) as { aud?: unknown };\n if (payload.aud === undefined) return;\n warnedAudience = true;\n console.warn(\n `[@orangecheck/me-client] a sign-in token bound to ${JSON.stringify(payload.aud)} was refused ` +\n 'because no `audience` is configured. Pass your site origin, e.g. ' +\n \"withOcAuth(handler, { audience: 'https://your-site.example' }).\"\n );\n } catch {\n // Not a JWT we can read · nothing useful to say.\n }\n}\n\nfunction base64UrlToString(s: string): string {\n const b64 = s.replace(/-/g, '+').replace(/_/g, '/');\n if (typeof atob === 'function') return atob(b64 + '='.repeat((4 - (b64.length % 4)) % 4));\n return Buffer.from(s, 'base64url').toString('utf8');\n}\n\n// ─── Next.js Pages Router adapter ────────────────────────────────────────\n\ninterface NextApiRequestLike {\n headers: { cookie?: string; authorization?: string; [k: string]: unknown };\n ocSession?: SessionPayload | null;\n}\ninterface NextApiResponseLike {\n status(code: number): NextApiResponseLike;\n json(body: unknown): unknown;\n setHeader(name: string, value: string | number | readonly string[]): unknown;\n}\n/** A request with the verified session attached: `WithOcSession<NextApiRequest>`. */\nexport type WithOcSession<Req> = Req & { ocSession?: SessionPayload | null };\n\nexport interface WithOcAuthOptions extends VerifyOcOptions {\n /** When true, unauthenticated requests get a 401 + `{ok:false}` response\n * before the wrapped handler runs. Default: false — handler runs and\n * receives `req.ocSession === null`, useful when the route serves both\n * signed-in and anonymous users. */\n required?: boolean;\n /**\n * Refuse a signed-in account (403, `reason: 'bond_required'`) unless a\n * bond backs it: one unspent coin of at least `minSats`, unspent at least\n * `minDays` days, checked within `maxAgeSecs`. The app never learns the\n * coin; `req.ocSession.oc_bond.nullifier` is the same for the same coin at\n * your site, so ban that to ban the coin. Implies `required`.\n */\n requireBond?: { minSats?: number; minDays?: number; maxAgeSecs?: number };\n /**\n * Your project key. The requirement you set in the project's settings\n * (\"who can sign in\") is read from me.ochk.io within a minute of a change\n * and enforced like `requireBond`, so you change it there, not in code.\n * An explicit `requireBond` wins over it.\n */\n projectKey?: string;\n /** Where the project config is read. Default https://me.ochk.io. */\n meOrigin?: string;\n}\n\ntype BondNeed = NonNullable<WithOcAuthOptions['requireBond']>;\n/** Where someone turned away for want of backing can back their account. */\nexport const BACK_ACCOUNT_URL = 'https://ochk.app/me/account#backing';\n/** Keys me.ochk.io answered 404 for, and when; re-checked after a minute. */\nconst unknownKeys = new Map<string, number>();\nconst UNKNOWN_PROJECT = Symbol('unknown_project');\nconst POLICY_TTL_MS = 60_000;\n/** After a failed read, how long before me.ochk.io is asked again. */\nconst POLICY_RETRY_MS = 10_000;\nconst policies = new Map<string, { at: number; need: BondNeed | null; failedAt?: number }>();\n\n/**\n * The project's requirement, from its uncached sign-in endpoint, held a\n * minute here. (The price config is edge-cached for ten minutes: reading the\n * requirement there let a just-tightened app keep admitting unbacked accounts.)\n * When it can't be read, the last one read stands, and the next try waits ten\n * seconds so an outage doesn't hold every request; with none read yet it is\n * `undefined`, and the request is refused rather than let through unchecked.\n */\nasync function projectRequirement(\n options: WithOcAuthOptions\n): Promise<BondNeed | null | undefined | typeof UNKNOWN_PROJECT> {\n const key = options.projectKey!;\n const hit = policies.get(key);\n const now = Date.now();\n if (unknownKeys.has(key) && now - unknownKeys.get(key)! < POLICY_TTL_MS) return UNKNOWN_PROJECT;\n if (hit && now - hit.at < POLICY_TTL_MS) return hit.need;\n if (hit?.failedAt && now - hit.failedAt < POLICY_RETRY_MS) return hit.at ? hit.need : undefined;\n try {\n const base = options.meOrigin ?? 'https://me.ochk.io';\n const r = await fetch(`${base}/api/integrator/${encodeURIComponent(key)}/sign-in`, {\n signal: AbortSignal.timeout(4000),\n });\n // A key that names no project is a setup mistake, not an outage: say so once.\n if (r.status === 404) {\n if (!unknownKeys.has(key)) {\n console.error(\n `[@orangecheck/me-client] projectKey \"${key}\" is not a project. Copy yours from https://ochk.app/me/projects.`\n );\n }\n unknownKeys.set(key, Date.now());\n return UNKNOWN_PROJECT;\n }\n unknownKeys.delete(key);\n if (!r.ok) throw new Error(`HTTP ${r.status}`);\n const j = (await r.json()) as {\n require_bond?: { min_sats: number; min_days: number } | null;\n };\n const req = j.require_bond ?? null;\n const need = req ? { minSats: req.min_sats, minDays: req.min_days } : null;\n policies.set(key, { at: Date.now(), need });\n return need;\n } catch {\n policies.set(key, { at: hit?.at ?? 0, need: hit?.need ?? null, failedAt: Date.now() });\n return hit?.at ? hit.need : undefined;\n }\n}\n\n/** The requirement in force: explicit, else the project's, else none. */\nasync function bondNeed(\n options: WithOcAuthOptions\n): Promise<BondNeed | null | undefined | typeof UNKNOWN_PROJECT> {\n if (options.requireBond) return options.requireBond;\n if (options.projectKey) return projectRequirement(options);\n return null;\n}\n\n/** Why a session can't pass, as a status and body, or null when it can. */\nasync function refusal(\n session: SessionPayload | null,\n options: WithOcAuthOptions\n): Promise<{ status: number; body: Record<string, unknown> } | null> {\n const need = await bondNeed(options);\n if (!session && options.required) {\n return { status: 401, body: { ok: false, reason: 'unauthenticated' } };\n }\n if (need === UNKNOWN_PROJECT) {\n return { status: 500, body: { ok: false, reason: 'unknown_project_key' } };\n }\n if (need === undefined) {\n return { status: 503, body: { ok: false, reason: 'bond_policy_unavailable' } };\n }\n if (!session) {\n return need ? { status: 401, body: { ok: false, reason: 'unauthenticated' } } : null;\n }\n if (need && !bondMeets(session, need)) {\n const have = readBondClaim(session);\n return {\n status: 403,\n body: {\n ok: false,\n reason: 'bond_required',\n need: {\n min_sats: need.minSats ?? 0,\n min_days: need.minDays ?? 0,\n ...(need.maxAgeSecs !== undefined ? { max_age_secs: need.maxAgeSecs } : {}),\n },\n have: have ? { sats_floor: have.sats_floor, days_floor: have.days_floor } : null,\n back_url: BACK_ACCOUNT_URL,\n },\n };\n }\n return null;\n}\n\n/**\n * Wrap a Next.js Pages-Router API route handler. Adds `req.ocSession` —\n * the verified SessionPayload, or null when unauthenticated.\n *\n * // pages/api/me/profile.ts\n * import { withOcAuth } from '@orangecheck/me-client/server';\n *\n * export default withOcAuth(async (req, res) => {\n * if (!req.ocSession) return res.status(401).json({ ok: false });\n * res.status(200).json({ account: { address: req.ocSession.did_oc } });\n * }, { required: true, audience: 'https://your-site.example' });\n *\n * `audience` is your own origin. The sign-in popup issues each site a token\n * bound to it; a site on *.ochk.io that reads the family cookie omits it.\n *\n * `Cache-Control: no-store, private` and `Vary: Cookie, Authorization`\n * are set on every authenticated response — without them a cached 401\n * leaks anonymous to authenticated callers.\n */\nexport function withOcAuth<\n Req extends NextApiRequestLike = NextApiRequestLike,\n Res extends NextApiResponseLike = NextApiResponseLike,\n>(\n handler: (req: WithOcSession<Req>, res: Res) => unknown,\n options: WithOcAuthOptions = {}\n): (req: Req, res: Res) => Promise<unknown> {\n return async (req: Req, res: Res) => {\n res.setHeader('Cache-Control', 'no-store, private');\n res.setHeader('Vary', 'Cookie, Authorization');\n const session = await getOcSession(\n {\n cookie: typeof req.headers.cookie === 'string' ? req.headers.cookie : null,\n authorization:\n typeof req.headers.authorization === 'string'\n ? req.headers.authorization\n : null,\n },\n options\n );\n const withSession = req as WithOcSession<Req>;\n withSession.ocSession = session;\n const refused = await refusal(session, options);\n if (refused) return res.status(refused.status).json(refused.body);\n return handler(withSession, res);\n };\n}\n\n// ─── Express / Connect middleware ────────────────────────────────────────\n\n// `req.ocSession` on Express's own Request type, so `ocAuthExpress()` routes\n// type-check without a cast. Inert when @types/express is absent.\ndeclare global {\n // eslint-disable-next-line @typescript-eslint/no-namespace\n namespace Express {\n interface Request {\n ocSession?: SessionPayload | null;\n }\n }\n}\n\n/** Hono env for `ocAuthHono()`: `new Hono<OcHonoEnv>()` types `c.get('ocSession')`. */\nexport type OcHonoEnv = { Variables: { ocSession: SessionPayload | null } };\n\ninterface ExpressRequestLike {\n headers: { cookie?: string; authorization?: string; [k: string]: unknown };\n ocSession?: SessionPayload | null;\n}\ninterface ExpressResponseLike {\n status(code: number): ExpressResponseLike;\n json(body: unknown): unknown;\n setHeader(name: string, value: string | number | readonly string[]): unknown;\n}\ntype ExpressNextLike = (err?: unknown) => void;\n\n/**\n * Express / Connect middleware. Attaches `req.ocSession` (verified\n * SessionPayload | null) and calls next(). Use it as a global middleware\n * or per-route.\n *\n * import express from 'express';\n * import { ocAuthExpress } from '@orangecheck/me-client/server';\n *\n * const app = express();\n * app.use(ocAuthExpress());\n *\n * app.get('/api/profile', (req, res) => {\n * if (!req.ocSession) return res.status(401).json({ error: 'sign in' });\n * res.json({ address: req.ocSession.did_oc });\n * });\n *\n * Pass `{ required: true }` to short-circuit unauthenticated requests\n * with a 401 before they reach your handler.\n */\nexport function ocAuthExpress(options: WithOcAuthOptions = {}) {\n return async (req: ExpressRequestLike, res: ExpressResponseLike, next: ExpressNextLike) => {\n try {\n res.setHeader('Cache-Control', 'no-store, private');\n res.setHeader('Vary', 'Cookie, Authorization');\n const session = await getOcSession(\n {\n cookie: typeof req.headers.cookie === 'string' ? req.headers.cookie : null,\n authorization:\n typeof req.headers.authorization === 'string'\n ? req.headers.authorization\n : null,\n },\n options\n );\n req.ocSession = session;\n const refused = await refusal(session, options);\n if (refused) {\n res.status(refused.status).json(refused.body);\n return;\n }\n next();\n } catch (err) {\n next(err);\n }\n };\n}\n\n// ─── Hono middleware ─────────────────────────────────────────────────────\n\ninterface HonoContextLike {\n req: { raw: { headers: Headers } };\n set(key: string, value: unknown): void;\n json(body: unknown, status?: number): unknown;\n header(name: string, value: string): void;\n}\ntype HonoNextLike = () => Promise<void>;\n\n/**\n * Hono middleware. Attaches the verified session at `c.get('ocSession')`.\n *\n * import { Hono } from 'hono';\n * import { ocAuthHono, type OcHonoEnv } from '@orangecheck/me-client/server';\n *\n * const app = new Hono<OcHonoEnv>();\n * app.use('*', ocAuthHono());\n *\n * app.get('/api/profile', (c) => {\n * const session = c.get('ocSession');\n * if (!session) return c.json({ error: 'sign in' }, 401);\n * return c.json({ address: session.did_oc });\n * });\n */\nexport function ocAuthHono(options: WithOcAuthOptions = {}) {\n return async (c: HonoContextLike, next: HonoNextLike) => {\n c.header('Cache-Control', 'no-store, private');\n c.header('Vary', 'Cookie, Authorization');\n const session = await getOcSession(c.req.raw.headers, options);\n c.set('ocSession', session);\n const refused = await refusal(session, options);\n if (refused) return c.json(refused.body, refused.status);\n await next();\n };\n}\n"]}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@orangecheck/me-client",
3
- "version": "0.32.3",
3
+ "version": "0.33.0",
4
4
  "description": "Server and browser client for orangecheck sign-in and paying your users: withOcAuth for Next.js, ocAuthExpress and ocAuthHono (no env vars, no JWK handling), signInWithOc() popup, events, webhooks and the price taxonomy. No React.",
5
5
  "keywords": [
6
6
  "orangecheck",
@@ -13,7 +13,7 @@
13
13
  ],
14
14
  "author": "OrangeCheck",
15
15
  "license": "MIT",
16
- "homepage": "https://docs.ochk.io/me/quickstart",
16
+ "homepage": "https://ochk.io/docs/me/quickstart",
17
17
  "repository": {
18
18
  "type": "git",
19
19
  "url": "https://github.com/orangecheck/oc-packages.git",
@@ -61,7 +61,7 @@
61
61
  "prepublishOnly": "npm run clean && npm run build"
62
62
  },
63
63
  "dependencies": {
64
- "@orangecheck/auth-core": "^2.8.0"
64
+ "@orangecheck/auth-core": "^2.10.0"
65
65
  },
66
66
  "peerDependencies": {
67
67
  "express": "^4.0.0 || ^5.0.0",