@parlor/auth 0.0.0-stage → 0.1.0

package/dist/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAcA,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAWf,CAAC;AAEH,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiBnB,CAAC;AAEF,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsBnB,CAAC;AAEF,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAcxB,CAAC;AAEF,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQf,CAAC;AAEH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyCvB,CAAC;AAEF,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkBxB,CAAC;AAEH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqB/B,CAAC;AAEF,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkC7B,CAAC;AAEF,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgC5B,CAAC;AAEF,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmBxB,CAAC;AAEF,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAG/B,CAAC;AAEH,eAAO,MAAM,aAAa;;;;;;;EAOvB,CAAC;AAEJ,eAAO,MAAM,gBAAgB;;;;EAO1B,CAAC;AAEJ,eAAO,MAAM,gBAAgB;;EAK1B,CAAC;AAEJ,eAAO,MAAM,oBAAoB;;;;;;EAS9B,CAAC;AAEJ,eAAO,MAAM,sBAAsB;;EAEhC,CAAC;AAEJ,eAAO,MAAM,4BAA4B;;;EAStC,CAAC;AAEJ,eAAO,MAAM,0BAA0B;;;;;EAiBtC,CAAC;AAEF,eAAO,MAAM,yBAAyB;;;;;EAiBnC,CAAC;AAEJ,eAAO,MAAM,qBAAqB;;;EAS/B,CAAC"}

package/dist/schema.js

@@ -0,0 +1,308 @@
+// The Better Auth tables for parlorAuth() defaults, as `auth generate` writes them for better-auth 1.7.7.
+// `schema.spec.ts` regenerates them and fails on any difference, so a Better Auth bump updates this file.
+import { relations } from "drizzle-orm";
+import { pgTable, text, timestamp, boolean, integer, jsonb, index, uniqueIndex, } from "drizzle-orm/pg-core";
+export const user = pgTable("user", {
+    id: text("id").primaryKey(),
+    name: text("name").notNull(),
+    email: text("email").notNull().unique(),
+    emailVerified: boolean("email_verified").default(false).notNull(),
+    image: text("image"),
+    createdAt: timestamp("created_at").defaultNow().notNull(),
+    updatedAt: timestamp("updated_at")
+        .defaultNow()
+        .$onUpdate(() => /* @__PURE__ */ new Date())
+        .notNull(),
+});
+export const session = pgTable("session", {
+    id: text("id").primaryKey(),
+    expiresAt: timestamp("expires_at").notNull(),
+    token: text("token").notNull().unique(),
+    createdAt: timestamp("created_at").defaultNow().notNull(),
+    updatedAt: timestamp("updated_at")
+        .$onUpdate(() => /* @__PURE__ */ new Date())
+        .notNull(),
+    ipAddress: text("ip_address"),
+    userAgent: text("user_agent"),
+    userId: text("user_id")
+        .notNull()
+        .references(() => user.id, { onDelete: "cascade" }),
+}, (table) => [index("session_userId_idx").on(table.userId)]);
+export const account = pgTable("account", {
+    id: text("id").primaryKey(),
+    accountId: text("account_id").notNull(),
+    providerId: text("provider_id").notNull(),
+    userId: text("user_id")
+        .notNull()
+        .references(() => user.id, { onDelete: "cascade" }),
+    accessToken: text("access_token"),
+    refreshToken: text("refresh_token"),
+    idToken: text("id_token"),
+    accessTokenExpiresAt: timestamp("access_token_expires_at"),
+    refreshTokenExpiresAt: timestamp("refresh_token_expires_at"),
+    scope: text("scope"),
+    password: text("password"),
+    createdAt: timestamp("created_at").defaultNow().notNull(),
+    updatedAt: timestamp("updated_at")
+        .$onUpdate(() => /* @__PURE__ */ new Date())
+        .notNull(),
+}, (table) => [index("account_userId_idx").on(table.userId)]);
+export const verification = pgTable("verification", {
+    id: text("id").primaryKey(),
+    identifier: text("identifier").notNull(),
+    value: text("value").notNull(),
+    expiresAt: timestamp("expires_at").notNull(),
+    createdAt: timestamp("created_at").defaultNow().notNull(),
+    updatedAt: timestamp("updated_at")
+        .defaultNow()
+        .$onUpdate(() => /* @__PURE__ */ new Date())
+        .notNull(),
+}, (table) => [index("verification_identifier_idx").on(table.identifier)]);
+export const jwks = pgTable("jwks", {
+    id: text("id").primaryKey(),
+    publicKey: text("public_key").notNull(),
+    privateKey: text("private_key").notNull(),
+    createdAt: timestamp("created_at").notNull(),
+    expiresAt: timestamp("expires_at"),
+    alg: text("alg"),
+    crv: text("crv"),
+});
+export const oauthClient = pgTable("oauth_client", {
+    id: text("id").primaryKey(),
+    clientId: text("client_id").notNull().unique(),
+    clientSecret: text("client_secret"),
+    clientDiscoveryId: text("client_discovery_id"),
+    disabled: boolean("disabled").default(false),
+    skipConsent: boolean("skip_consent"),
+    enableEndSession: boolean("enable_end_session"),
+    subjectType: text("subject_type"),
+    scopes: text("scopes").array(),
+    clientCredentialsScopes: text("client_credentials_scopes").array().default([]),
+    userId: text("user_id").references(() => user.id, { onDelete: "cascade" }),
+    createdAt: timestamp("created_at"),
+    updatedAt: timestamp("updated_at"),
+    name: text("name"),
+    uri: text("uri"),
+    icon: text("icon"),
+    contacts: text("contacts").array(),
+    tos: text("tos"),
+    policy: text("policy"),
+    softwareId: text("software_id"),
+    softwareVersion: text("software_version"),
+    softwareStatement: text("software_statement"),
+    redirectUris: text("redirect_uris").array().notNull(),
+    postLogoutRedirectUris: text("post_logout_redirect_uris").array(),
+    backchannelLogoutUri: text("backchannel_logout_uri"),
+    backchannelLogoutSessionRequired: boolean("backchannel_logout_session_required"),
+    tokenEndpointAuthMethod: text("token_endpoint_auth_method"),
+    applicationType: text("application_type"),
+    jwks: text("jwks"),
+    jwksUri: text("jwks_uri"),
+    grantTypes: text("grant_types").array(),
+    responseTypes: text("response_types").array(),
+    requirePKCE: boolean("require_pkce"),
+    dpopBoundAccessTokens: boolean("dpop_bound_access_tokens").default(false),
+    referenceId: text("reference_id"),
+    metadata: jsonb("metadata"),
+}, (table) => [index("oauthClient_userId_idx").on(table.userId)]);
+export const oauthResource = pgTable("oauth_resource", {
+    id: text("id").primaryKey(),
+    identifier: text("identifier").notNull().unique(),
+    name: text("name").notNull(),
+    accessTokenTtl: integer("access_token_ttl"),
+    refreshTokenTtl: integer("refresh_token_ttl"),
+    signingAlgorithm: text("signing_algorithm"),
+    signingKeyId: text("signing_key_id"),
+    allowedScopes: text("allowed_scopes").array(),
+    customClaims: jsonb("custom_claims"),
+    dpopBoundAccessTokensRequired: boolean("dpop_bound_access_tokens_required").default(false),
+    disabled: boolean("disabled").default(false),
+    createdAt: timestamp("created_at"),
+    updatedAt: timestamp("updated_at"),
+    policyVersion: integer("policy_version").default(1),
+    metadata: jsonb("metadata"),
+});
+export const oauthClientResource = pgTable("oauth_client_resource", {
+    id: text("id").primaryKey(),
+    clientId: text("client_id")
+        .notNull()
+        .references(() => oauthClient.clientId, { onDelete: "cascade" }),
+    resourceId: text("resource_id")
+        .notNull()
+        .references(() => oauthResource.identifier, { onDelete: "cascade" }),
+    metadata: jsonb("metadata"),
+    createdAt: timestamp("created_at"),
+}, (table) => [
+    uniqueIndex("oauthClientResource_clientId_resourceId_uidx").on(table.clientId, table.resourceId),
+    index("oauthClientResource_clientId_idx").on(table.clientId),
+    index("oauthClientResource_resourceId_idx").on(table.resourceId),
+]);
+export const oauthRefreshToken = pgTable("oauth_refresh_token", {
+    id: text("id").primaryKey(),
+    token: text("token").notNull().unique(),
+    clientId: text("client_id")
+        .notNull()
+        .references(() => oauthClient.clientId, { onDelete: "cascade" }),
+    sessionId: text("session_id").references(() => session.id, {
+        onDelete: "set null",
+    }),
+    userId: text("user_id")
+        .notNull()
+        .references(() => user.id, { onDelete: "cascade" }),
+    referenceId: text("reference_id"),
+    authorizationCodeId: text("authorization_code_id"),
+    resources: text("resources").array(),
+    requestedUserInfoClaims: text("requested_user_info_claims").array(),
+    expiresAt: timestamp("expires_at").notNull(),
+    createdAt: timestamp("created_at").notNull(),
+    revoked: timestamp("revoked"),
+    rotatedAt: timestamp("rotated_at"),
+    rotationReplayResponse: text("rotation_replay_response"),
+    rotationReplayExpiresAt: timestamp("rotation_replay_expires_at"),
+    authTime: timestamp("auth_time"),
+    confirmation: jsonb("confirmation"),
+    scopes: text("scopes").array().notNull(),
+}, (table) => [
+    index("oauthRefreshToken_clientId_idx").on(table.clientId),
+    index("oauthRefreshToken_sessionId_idx").on(table.sessionId),
+    index("oauthRefreshToken_userId_idx").on(table.userId),
+    index("oauthRefreshToken_authorizationCodeId_idx").on(table.authorizationCodeId),
+]);
+export const oauthAccessToken = pgTable("oauth_access_token", {
+    id: text("id").primaryKey(),
+    token: text("token").notNull().unique(),
+    clientId: text("client_id")
+        .notNull()
+        .references(() => oauthClient.clientId, { onDelete: "cascade" }),
+    sessionId: text("session_id").references(() => session.id, {
+        onDelete: "set null",
+    }),
+    userId: text("user_id").references(() => user.id, { onDelete: "cascade" }),
+    referenceId: text("reference_id"),
+    authorizationCodeId: text("authorization_code_id"),
+    resources: text("resources").array(),
+    requestedUserInfoClaims: text("requested_user_info_claims").array(),
+    refreshId: text("refresh_id").references(() => oauthRefreshToken.id, {
+        onDelete: "cascade",
+    }),
+    expiresAt: timestamp("expires_at").notNull(),
+    createdAt: timestamp("created_at").notNull(),
+    revoked: timestamp("revoked"),
+    confirmation: jsonb("confirmation"),
+    scopes: text("scopes").array().notNull(),
+}, (table) => [
+    index("oauthAccessToken_clientId_idx").on(table.clientId),
+    index("oauthAccessToken_sessionId_idx").on(table.sessionId),
+    index("oauthAccessToken_userId_idx").on(table.userId),
+    index("oauthAccessToken_authorizationCodeId_idx").on(table.authorizationCodeId),
+    index("oauthAccessToken_refreshId_idx").on(table.refreshId),
+]);
+export const oauthConsent = pgTable("oauth_consent", {
+    id: text("id").primaryKey(),
+    clientId: text("client_id")
+        .notNull()
+        .references(() => oauthClient.clientId, { onDelete: "cascade" }),
+    userId: text("user_id").references(() => user.id, { onDelete: "cascade" }),
+    referenceId: text("reference_id"),
+    resources: text("resources").array(),
+    requestedUserInfoClaims: text("requested_user_info_claims").array(),
+    scopes: text("scopes").array().notNull(),
+    createdAt: timestamp("created_at").notNull(),
+    updatedAt: timestamp("updated_at").notNull(),
+}, (table) => [
+    index("oauthConsent_clientId_idx").on(table.clientId),
+    index("oauthConsent_userId_idx").on(table.userId),
+]);
+export const oauthClientAssertion = pgTable("oauth_client_assertion", {
+    id: text("id").primaryKey(),
+    expiresAt: timestamp("expires_at").notNull(),
+});
+export const userRelations = relations(user, ({ many }) => ({
+    sessions: many(session),
+    accounts: many(account),
+    oauthClients: many(oauthClient),
+    oauthRefreshTokens: many(oauthRefreshToken),
+    oauthAccessTokens: many(oauthAccessToken),
+    oauthConsents: many(oauthConsent),
+}));
+export const sessionRelations = relations(session, ({ one, many }) => ({
+    user: one(user, {
+        fields: [session.userId],
+        references: [user.id],
+    }),
+    oauthRefreshTokens: many(oauthRefreshToken),
+    oauthAccessTokens: many(oauthAccessToken),
+}));
+export const accountRelations = relations(account, ({ one }) => ({
+    user: one(user, {
+        fields: [account.userId],
+        references: [user.id],
+    }),
+}));
+export const oauthClientRelations = relations(oauthClient, ({ one, many }) => ({
+    user: one(user, {
+        fields: [oauthClient.userId],
+        references: [user.id],
+    }),
+    oauthClientResources: many(oauthClientResource),
+    oauthRefreshTokens: many(oauthRefreshToken),
+    oauthAccessTokens: many(oauthAccessToken),
+    oauthConsents: many(oauthConsent),
+}));
+export const oauthResourceRelations = relations(oauthResource, ({ many }) => ({
+    oauthClientResources: many(oauthClientResource),
+}));
+export const oauthClientResourceRelations = relations(oauthClientResource, ({ one }) => ({
+    oauthClient: one(oauthClient, {
+        fields: [oauthClientResource.clientId],
+        references: [oauthClient.clientId],
+    }),
+    oauthResource: one(oauthResource, {
+        fields: [oauthClientResource.resourceId],
+        references: [oauthResource.identifier],
+    }),
+}));
+export const oauthRefreshTokenRelations = relations(oauthRefreshToken, ({ one, many }) => ({
+    oauthClient: one(oauthClient, {
+        fields: [oauthRefreshToken.clientId],
+        references: [oauthClient.clientId],
+    }),
+    session: one(session, {
+        fields: [oauthRefreshToken.sessionId],
+        references: [session.id],
+    }),
+    user: one(user, {
+        fields: [oauthRefreshToken.userId],
+        references: [user.id],
+    }),
+    oauthAccessTokens: many(oauthAccessToken),
+}));
+export const oauthAccessTokenRelations = relations(oauthAccessToken, ({ one }) => ({
+    oauthClient: one(oauthClient, {
+        fields: [oauthAccessToken.clientId],
+        references: [oauthClient.clientId],
+    }),
+    session: one(session, {
+        fields: [oauthAccessToken.sessionId],
+        references: [session.id],
+    }),
+    user: one(user, {
+        fields: [oauthAccessToken.userId],
+        references: [user.id],
+    }),
+    oauthRefreshToken: one(oauthRefreshToken, {
+        fields: [oauthAccessToken.refreshId],
+        references: [oauthRefreshToken.id],
+    }),
+}));
+export const oauthConsentRelations = relations(oauthConsent, ({ one }) => ({
+    oauthClient: one(oauthClient, {
+        fields: [oauthConsent.clientId],
+        references: [oauthClient.clientId],
+    }),
+    user: one(user, {
+        fields: [oauthConsent.userId],
+        references: [user.id],
+    }),
+}));
+//# sourceMappingURL=schema.js.map

package/dist/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,0GAA0G;AAC1G,0GAA0G;AAC1G,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EACL,OAAO,EACP,IAAI,EACJ,SAAS,EACT,OAAO,EACP,OAAO,EACP,KAAK,EACL,KAAK,EACL,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAE7B,MAAM,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE;IAClC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IACvC,aAAa,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE;IACjE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;IACpB,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACzD,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC;SAC/B,UAAU,EAAE;SACZ,SAAS,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,IAAI,IAAI,EAAE,CAAC;SAC3C,OAAO,EAAE;CACb,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAC5B,SAAS,EACT;IACE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC5C,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IACvC,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACzD,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC;SAC/B,SAAS,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,IAAI,IAAI,EAAE,CAAC;SAC3C,OAAO,EAAE;IACZ,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;IAC7B,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;IAC7B,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;SACpB,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;CACtD,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAC1D,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAC5B,SAAS,EACT;IACE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IACzC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;SACpB,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACrD,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC;IACjC,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC;IACnC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC;IACzB,oBAAoB,EAAE,SAAS,CAAC,yBAAyB,CAAC;IAC1D,qBAAqB,EAAE,SAAS,CAAC,0BAA0B,CAAC;IAC5D,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;IACpB,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC;IAC1B,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACzD,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC;SAC/B,SAAS,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,IAAI,IAAI,EAAE,CAAC;SAC3C,OAAO,EAAE;CACb,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAC1D,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CACjC,cAAc,EACd;IACE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACxC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;IAC9B,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC5C,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACzD,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC;SAC/B,UAAU,EAAE;SACZ,SAAS,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,IAAI,IAAI,EAAE,CAAC;SAC3C,OAAO,EAAE;CACb,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CACvE,CAAC;AAEF,MAAM,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE;IAClC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IACzC,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC5C,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC;IAClC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC;IAChB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC;CACjB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAChC,cAAc,EACd;IACE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IAC9C,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC;IACnC,iBAAiB,EAAE,IAAI,CAAC,qBAAqB,CAAC;IAC9C,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC5C,WAAW,EAAE,OAAO,CAAC,cAAc,CAAC;IACpC,gBAAgB,EAAE,OAAO,CAAC,oBAAoB,CAAC;IAC/C,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC;IACjC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE;IAC9B,uBAAuB,EAAE,IAAI,CAAC,2BAA2B,CAAC,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9E,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAC1E,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC;IAClC,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC;IAClC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;IAClB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC;IAChB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;IAClB,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE;IAClC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC;IAChB,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC;IACtB,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;IAC/B,eAAe,EAAE,IAAI,CAAC,kBAAkB,CAAC;IACzC,iBAAiB,EAAE,IAAI,CAAC,oBAAoB,CAAC;IAC7C,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE;IACrD,sBAAsB,EAAE,IAAI,CAAC,2BAA2B,CAAC,CAAC,KAAK,EAAE;IACjE,oBAAoB,EAAE,IAAI,CAAC,wBAAwB,CAAC;IACpD,gCAAgC,EAAE,OAAO,CAAC,qCAAqC,CAAC;IAChF,uBAAuB,EAAE,IAAI,CAAC,4BAA4B,CAAC;IAC3D,eAAe,EAAE,IAAI,CAAC,kBAAkB,CAAC;IACzC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;IAClB,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC;IACzB,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,KAAK,EAAE;IACvC,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,KAAK,EAAE;IAC7C,WAAW,EAAE,OAAO,CAAC,cAAc,CAAC;IACpC,qBAAqB,EAAE,OAAO,CAAC,0BAA0B,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACzE,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC;IACjC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC;CAC5B,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAC9D,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC,gBAAgB,EAAE;IACrD,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IACjD,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,cAAc,EAAE,OAAO,CAAC,kBAAkB,CAAC;IAC3C,eAAe,EAAE,OAAO,CAAC,mBAAmB,CAAC;IAC7C,gBAAgB,EAAE,IAAI,CAAC,mBAAmB,CAAC;IAC3C,YAAY,EAAE,IAAI,CAAC,gBAAgB,CAAC;IACpC,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,KAAK,EAAE;IAC7C,YAAY,EAAE,KAAK,CAAC,eAAe,CAAC;IACpC,6BAA6B,EAAE,OAAO,CAAC,mCAAmC,CAAC,CAAC,OAAO,CACjF,KAAK,CACN;IACD,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC5C,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC;IAClC,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC;IAClC,aAAa,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACnD,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,OAAO,CACxC,uBAAuB,EACvB;IACE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC;SACxB,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAClE,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;SAC5B,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACtE,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC;IAC3B,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC;CACnC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,WAAW,CAAC,8CAA8C,CAAC,CAAC,EAAE,CAC5D,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,UAAU,CACjB;IACD,KAAK,CAAC,kCAAkC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC;IAC5D,KAAK,CAAC,oCAAoC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC;CACjE,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CACtC,qBAAqB,EACrB;IACE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IACvC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC;SACxB,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAClE,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE;QACzD,QAAQ,EAAE,UAAU;KACrB,CAAC;IACF,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;SACpB,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACrD,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC;IACjC,mBAAmB,EAAE,IAAI,CAAC,uBAAuB,CAAC;IAClD,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE;IACpC,uBAAuB,EAAE,IAAI,CAAC,4BAA4B,CAAC,CAAC,KAAK,EAAE;IACnE,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC5C,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC5C,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC;IAC7B,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC;IAClC,sBAAsB,EAAE,IAAI,CAAC,0BAA0B,CAAC;IACxD,uBAAuB,EAAE,SAAS,CAAC,4BAA4B,CAAC;IAChE,QAAQ,EAAE,SAAS,CAAC,WAAW,CAAC;IAChC,YAAY,EAAE,KAAK,CAAC,cAAc,CAAC;IACnC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE;CACzC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,KAAK,CAAC,gCAAgC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC;IAC1D,KAAK,CAAC,iCAAiC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IAC5D,KAAK,CAAC,8BAA8B,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;IACtD,KAAK,CAAC,2CAA2C,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC;CACjF,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CACrC,oBAAoB,EACpB;IACE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IACvC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC;SACxB,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAClE,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE;QACzD,QAAQ,EAAE,UAAU;KACrB,CAAC;IACF,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAC1E,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC;IACjC,mBAAmB,EAAE,IAAI,CAAC,uBAAuB,CAAC;IAClD,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE;IACpC,uBAAuB,EAAE,IAAI,CAAC,4BAA4B,CAAC,CAAC,KAAK,EAAE;IACnE,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE;QACnE,QAAQ,EAAE,SAAS;KACpB,CAAC;IACF,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC5C,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC5C,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC;IAC7B,YAAY,EAAE,KAAK,CAAC,cAAc,CAAC;IACnC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE;CACzC,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,KAAK,CAAC,+BAA+B,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC;IACzD,KAAK,CAAC,gCAAgC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IAC3D,KAAK,CAAC,6BAA6B,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;IACrD,KAAK,CAAC,0CAA0C,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC;IAC/E,KAAK,CAAC,gCAAgC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;CAC5D,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CACjC,eAAe,EACf;IACE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC;SACxB,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAClE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAC1E,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC;IACjC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE;IACpC,uBAAuB,EAAE,IAAI,CAAC,4BAA4B,CAAC,CAAC,KAAK,EAAE;IACnE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE;IACxC,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC5C,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CAC7C,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,KAAK,CAAC,2BAA2B,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC;IACrD,KAAK,CAAC,yBAAyB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;CAClD,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,OAAO,CAAC,wBAAwB,EAAE;IACpE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CAC7C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1D,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC;IACvB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC;IACvB,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC;IAC/B,kBAAkB,EAAE,IAAI,CAAC,iBAAiB,CAAC;IAC3C,iBAAiB,EAAE,IAAI,CAAC,gBAAgB,CAAC;IACzC,aAAa,EAAE,IAAI,CAAC,YAAY,CAAC;CAClC,CAAC,CAAC,CAAC;AAEJ,MAAM,CAAC,MAAM,gBAAgB,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACrE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;QACd,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;QACxB,UAAU,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;KACtB,CAAC;IACF,kBAAkB,EAAE,IAAI,CAAC,iBAAiB,CAAC;IAC3C,iBAAiB,EAAE,IAAI,CAAC,gBAAgB,CAAC;CAC1C,CAAC,CAAC,CAAC;AAEJ,MAAM,CAAC,MAAM,gBAAgB,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IAC/D,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;QACd,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;QACxB,UAAU,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;KACtB,CAAC;CACH,CAAC,CAAC,CAAC;AAEJ,MAAM,CAAC,MAAM,oBAAoB,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAC7E,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;QACd,MAAM,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC;QAC5B,UAAU,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;KACtB,CAAC;IACF,oBAAoB,EAAE,IAAI,CAAC,mBAAmB,CAAC;IAC/C,kBAAkB,EAAE,IAAI,CAAC,iBAAiB,CAAC;IAC3C,iBAAiB,EAAE,IAAI,CAAC,gBAAgB,CAAC;IACzC,aAAa,EAAE,IAAI,CAAC,YAAY,CAAC;CAClC,CAAC,CAAC,CAAC;AAEJ,MAAM,CAAC,MAAM,sBAAsB,GAAG,SAAS,CAAC,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5E,oBAAoB,EAAE,IAAI,CAAC,mBAAmB,CAAC;CAChD,CAAC,CAAC,CAAC;AAEJ,MAAM,CAAC,MAAM,4BAA4B,GAAG,SAAS,CAAC,mBAAmB,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IACvF,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE;QAC5B,MAAM,EAAE,CAAC,mBAAmB,CAAC,QAAQ,CAAC;QACtC,UAAU,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC;KACnC,CAAC;IACF,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE;QAChC,MAAM,EAAE,CAAC,mBAAmB,CAAC,UAAU,CAAC;QACxC,UAAU,EAAE,CAAC,aAAa,CAAC,UAAU,CAAC;KACvC,CAAC;CACH,CAAC,CAAC,CAAC;AAEJ,MAAM,CAAC,MAAM,0BAA0B,GAAG,SAAS,CACjD,iBAAiB,EACjB,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAClB,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE;QAC5B,MAAM,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC;QACpC,UAAU,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC;KACnC,CAAC;IACF,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE;QACpB,MAAM,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;QACrC,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;KACzB,CAAC;IACF,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;QACd,MAAM,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC;QAClC,UAAU,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;KACtB,CAAC;IACF,iBAAiB,EAAE,IAAI,CAAC,gBAAgB,CAAC;CAC1C,CAAC,CACH,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAG,SAAS,CAAC,gBAAgB,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IACjF,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE;QAC5B,MAAM,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC;QACnC,UAAU,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC;KACnC,CAAC;IACF,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE;QACpB,MAAM,EAAE,CAAC,gBAAgB,CAAC,SAAS,CAAC;QACpC,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;KACzB,CAAC;IACF,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;QACd,MAAM,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC;QACjC,UAAU,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;KACtB,CAAC;IACF,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,EAAE;QACxC,MAAM,EAAE,CAAC,gBAAgB,CAAC,SAAS,CAAC;QACpC,UAAU,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC;KACnC,CAAC;CACH,CAAC,CAAC,CAAC;AAEJ,MAAM,CAAC,MAAM,qBAAqB,GAAG,SAAS,CAAC,YAAY,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IACzE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE;QAC5B,MAAM,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC;QAC/B,UAAU,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC;KACnC,CAAC;IACF,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;QACd,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC;QAC7B,UAAU,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;KACtB,CAAC;CACH,CAAC,CAAC,CAAC"}

package/dist/statements.d.ts

@@ -0,0 +1,92 @@
+import type { DeviceSignature, PresenceSignature } from "@parlor/capabilities";
+import type { AnswerToSign, LoggedItem, PromptToSign } from "@parlor/chat";
+import type { DeviceId } from "@parlor/core";
+import type { PresenceKey } from "@parlor/server";
+export interface PromptStatement {
+    readonly v: 1;
+    readonly kind: "prompt";
+    /** The app's origin: a statement for one app is worthless to another. */
+    readonly app: string;
+    readonly threadId: string;
+    readonly turnId: string;
+    /** `<hostId>/<agentId>`: a prompt cannot be replayed to another agent. */
+    readonly agent: string;
+    /** base64url SHA-256 of the prompt text */
+    readonly digest: string;
+    readonly at: number;
+}
+export interface AnswerStatement {
+    readonly v: 1;
+    readonly kind: "answer";
+    readonly app: string;
+    readonly threadId: string;
+    readonly askId: string;
+    /** An option id, `"declined"`, or the digest of a form's values. */
+    readonly choice: string;
+    readonly at: number;
+}
+/** A linked device's word that the device behind `commitment` is the user's. */
+export interface VouchStatement {
+    readonly v: 1;
+    readonly kind: "vouch";
+    readonly app: string;
+    readonly voucher: string;
+    readonly device: string;
+    /** `deviceCommitment` of the new device's keys, as the voucher checked it. */
+    readonly commitment: string;
+    readonly at: number;
+}
+/** A linked device's word, with presence, that `device` should no longer use the user's agents. */
+export interface RemoveStatement {
+    readonly v: 1;
+    readonly kind: "remove";
+    readonly app: string;
+    readonly actor: string;
+    readonly device: string;
+    readonly at: number;
+}
+export type Statement = PromptStatement | AnswerStatement | VouchStatement | RemoveStatement;
+export interface Signed<S extends Statement> {
+    readonly statement: S;
+    readonly deviceId: DeviceId;
+    readonly signature: S extends AnswerStatement ? DeviceSignature | PresenceSignature : S extends VouchStatement | RemoveStatement ? PresenceSignature : DeviceSignature;
+}
+/** A device key the verifier pinned itself, never one that travelled with the statement. */
+export interface PinnedDevice {
+    readonly deviceId: DeviceId;
+    readonly signingKey: JsonWebKey;
+    readonly presenceKey?: PresenceKey | undefined;
+}
+export type VerifyOutcome = "valid" | "invalid" | "stale" | "presence_required";
+export interface VerifyOptions {
+    readonly requirePresence: boolean;
+    readonly now: number;
+    readonly maxAgeMs: number;
+}
+export declare function promptStatement(app: string, prompt: PromptToSign, at: number): Promise<PromptStatement>;
+export declare function answerStatement(app: string, answer: AnswerToSign, at: number): Promise<AnswerStatement>;
+export declare function signedPrompt(app: string, item: LoggedItem<"prompt">): Promise<Signed<PromptStatement> | undefined>;
+export declare function statementBytes(statement: Statement): Uint8Array;
+export declare const LINK_CODE_LENGTH = 10;
+/**
+ * What a new device shows to be linked: a hash of its keys, so whoever links it checks the
+ * keys the backend hands over are the ones this device holds.
+ */
+export declare function deviceCommitment(app: string, deviceId: string, signingKey: JsonWebKey, presenceKey: JsonWebKey | undefined): Promise<string>;
+/** The commitment's first 50 bits in Crockford base32, short enough to type. */
+export declare function linkCode(commitment: string): string;
+/** Upper case, no separators, the letters Crockford reads as digits mapped back. */
+export declare function normalizeLinkCode(typed: string): string;
+export declare function formatLinkCode(code: string): string;
+export declare function vouchStatement(app: string, voucher: string, device: string, commitment: string, at: number): VouchStatement;
+export declare function removeStatement(app: string, actor: string, device: string, at: number): RemoveStatement;
+/** The fragment Parlor Host's loopback redirect carries back to the browser that approved `connect`. */
+export declare const HOST_PAIRING_FRAGMENT = "parlor-host-pairing";
+/**
+ * The browser that approved `connect` gets the host's pairing secret through the loopback
+ * redirect, never through the app; this binds it to one device's keys.
+ */
+export declare function pairingProof(secret: string, deviceId: string, signingKey: JsonWebKey): Promise<string>;
+export declare function checkPairingProof(secret: string, proof: string, deviceId: string, signingKey: JsonWebKey): Promise<boolean>;
+export declare function verifyStatement(signed: Signed<Statement>, pinned: PinnedDevice, options: VerifyOptions): Promise<VerifyOutcome>;
+//# sourceMappingURL=statements.d.ts.map

package/dist/statements.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"statements.d.ts","sourceRoot":"","sources":["../src/statements.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAM/E,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC3E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAIlD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;IACd,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,yEAAyE;IACzE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,2CAA2C;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;IACd,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,oEAAoE;IACpE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,gFAAgF;AAChF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;IACd,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8EAA8E;IAC9E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,mGAAmG;AACnG,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;IACd,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,SAAS,GACjB,eAAe,GACf,eAAe,GACf,cAAc,GACd,eAAe,CAAC;AAEpB,MAAM,WAAW,MAAM,CAAC,CAAC,SAAS,SAAS;IACzC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,CAAC,SAAS,eAAe,GACzC,eAAe,GAAG,iBAAiB,GACnC,CAAC,SAAS,cAAc,GAAG,eAAe,GACxC,iBAAiB,GACjB,eAAe,CAAC;CACvB;AAED,4FAA4F;AAC5F,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;CAChD;AAED,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,SAAS,GAAG,OAAO,GAAG,mBAAmB,CAAC;AAOhF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAOD,wBAAsB,eAAe,CACnC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,YAAY,EACpB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,eAAe,CAAC,CAW1B;AAED,wBAAsB,eAAe,CACnC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,YAAY,EACpB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,eAAe,CAAC,CAe1B;AAED,wBAAsB,YAAY,CAChC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,GACzB,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,SAAS,CAAC,CAY9C;AAED,wBAAgB,cAAc,CAAC,SAAS,EAAE,SAAS,GAAG,UAAU,CAE/D;AAGD,eAAO,MAAM,gBAAgB,KAAK,CAAC;AAEnC;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,UAAU,EACtB,WAAW,EAAE,UAAU,GAAG,SAAS,GAClC,OAAO,CAAC,MAAM,CAAC,CAYjB;AAED,gFAAgF;AAChF,wBAAgB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAWnD;AAED,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMvD;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,wBAAgB,cAAc,CAC5B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,GACT,cAAc,CAUhB;AAED,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,MAAM,GACT,eAAe,CAEjB;AAED,wGAAwG;AACxG,eAAO,MAAM,qBAAqB,wBAAwB,CAAC;AAwB3D;;;GAGG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,MAAM,CAAC,CAOjB;AAED,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,OAAO,CAAC,CAWlB;AA+DD,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,EACzB,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,aAAa,CAAC,CAaxB"}

package/dist/statements.js

@@ -0,0 +1,199 @@
+import { canonicalBytes, decodeBase64url, encodeBase64url, } from "@parlor/capabilities/encoding";
+import { derToRaw, verifyEs256 } from "./es256.js";
+const FUTURE_SKEW_MS = 5 * 60_000;
+const USER_PRESENT = 0x01;
+const USER_VERIFIED = 0x04;
+const AUTH_DATA_MIN_BYTES = 37;
+const sha256 = async (bytes) => new Uint8Array(await crypto.subtle.digest("SHA-256", new Uint8Array(bytes)));
+const digestOf = async (bytes) => encodeBase64url(await sha256(bytes));
+export async function promptStatement(app, prompt, at) {
+    return {
+        v: 1,
+        kind: "prompt",
+        app,
+        threadId: prompt.threadId,
+        turnId: prompt.turnId,
+        agent: `${prompt.agent.hostId}/${prompt.agent.agentId}`,
+        digest: await digestOf(new TextEncoder().encode(prompt.text)),
+        at,
+    };
+}
+export async function answerStatement(app, answer, at) {
+    return {
+        v: 1,
+        kind: "answer",
+        app,
+        threadId: answer.threadId,
+        askId: answer.askId,
+        choice: answer.values === undefined
+            ? answer.choice
+            : await digestOf(canonicalBytes({ choice: answer.choice, values: answer.values })),
+        at,
+    };
+}
+export async function signedPrompt(app, item) {
+    const { signed, agent, text } = item.body;
+    if (!signed)
+        return undefined;
+    return {
+        statement: await promptStatement(app, { threadId: item.threadId, turnId: item.turnId, agent, text }, signed.at),
+        deviceId: signed.deviceId,
+        signature: signed.signature,
+    };
+}
+export function statementBytes(statement) {
+    return canonicalBytes(statement);
+}
+const CROCKFORD = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+export const LINK_CODE_LENGTH = 10;
+/**
+ * What a new device shows to be linked: a hash of its keys, so whoever links it checks the
+ * keys the backend hands over are the ones this device holds.
+ */
+export async function deviceCommitment(app, deviceId, signingKey, presenceKey) {
+    const point = (key) => ({ crv: key.crv, kty: key.kty, x: key.x, y: key.y });
+    return digestOf(canonicalBytes({
+        v: 1,
+        kind: "device",
+        app: new URL(app).origin,
+        deviceId,
+        signing: point(signingKey),
+        presence: presenceKey ? point(presenceKey) : null,
+    }));
+}
+/** The commitment's first 50 bits in Crockford base32, short enough to type. */
+export function linkCode(commitment) {
+    const bytes = decodeBase64url(commitment);
+    let bits = 0n;
+    for (let index = 0; index < 7; index += 1)
+        bits = (bits << 8n) | BigInt(bytes[index]);
+    bits >>= 6n;
+    let code = "";
+    for (let index = 0; index < LINK_CODE_LENGTH; index += 1) {
+        code = CROCKFORD[Number(bits & 31n)] + code;
+        bits >>= 5n;
+    }
+    return code;
+}
+/** Upper case, no separators, the letters Crockford reads as digits mapped back. */
+export function normalizeLinkCode(typed) {
+    return typed
+        .toUpperCase()
+        .replace(/[\s-]/g, "")
+        .replace(/O/g, "0")
+        .replace(/[IL]/g, "1");
+}
+export function formatLinkCode(code) {
+    return `${code.slice(0, 4)}-${code.slice(4, 8)}-${code.slice(8)}`;
+}
+export function vouchStatement(app, voucher, device, commitment, at) {
+    return {
+        v: 1,
+        kind: "vouch",
+        app: new URL(app).origin,
+        voucher,
+        device,
+        commitment,
+        at,
+    };
+}
+export function removeStatement(app, actor, device, at) {
+    return { v: 1, kind: "remove", app: new URL(app).origin, actor, device, at };
+}
+/** The fragment Parlor Host's loopback redirect carries back to the browser that approved `connect`. */
+export const HOST_PAIRING_FRAGMENT = "parlor-host-pairing";
+const pairingKey = (secret) => crypto.subtle.importKey("raw", new Uint8Array(decodeBase64url(secret)), { name: "HMAC", hash: "SHA-256" }, false, ["sign", "verify"]);
+const pairingBytes = (deviceId, signingKey) => canonicalBytes({
+    v: 1,
+    kind: "pairing",
+    deviceId,
+    signingKey: {
+        crv: signingKey.crv,
+        kty: signingKey.kty,
+        x: signingKey.x,
+        y: signingKey.y,
+    },
+});
+/**
+ * The browser that approved `connect` gets the host's pairing secret through the loopback
+ * redirect, never through the app; this binds it to one device's keys.
+ */
+export async function pairingProof(secret, deviceId, signingKey) {
+    const mac = await crypto.subtle.sign("HMAC", await pairingKey(secret), new Uint8Array(pairingBytes(deviceId, signingKey)));
+    return encodeBase64url(new Uint8Array(mac));
+}
+export async function checkPairingProof(secret, proof, deviceId, signingKey) {
+    try {
+        return await crypto.subtle.verify("HMAC", await pairingKey(secret), new Uint8Array(decodeBase64url(proof)), new Uint8Array(pairingBytes(deviceId, signingKey)));
+    }
+    catch {
+        return false;
+    }
+}
+async function assertionHolds(statement, signature, presenceKey) {
+    if (presenceKey?.format !== "webauthn" || signature.presence !== "user")
+        return false;
+    if (signature.authenticatorData === undefined ||
+        signature.clientDataJSON === undefined) {
+        return false;
+    }
+    if (signature.keyId !== presenceKey.credentialId)
+        return false;
+    if (new URL(statement.app).hostname !== presenceKey.rpId)
+        return false;
+    const clientDataBytes = decodeBase64url(signature.clientDataJSON);
+    const clientData = JSON.parse(new TextDecoder().decode(clientDataBytes));
+    const challenge = await digestOf(statementBytes(statement));
+    if (clientData.type !== "webauthn.get" ||
+        clientData.challenge !== challenge ||
+        clientData.origin !== statement.app ||
+        clientData.crossOrigin === true) {
+        return false;
+    }
+    const authData = decodeBase64url(signature.authenticatorData);
+    const flags = authData[32];
+    if (authData.length < AUTH_DATA_MIN_BYTES || flags === undefined)
+        return false;
+    if ((flags & USER_PRESENT) === 0 || (flags & USER_VERIFIED) === 0)
+        return false;
+    const rpIdHash = await sha256(new TextEncoder().encode(presenceKey.rpId));
+    if (encodeBase64url(authData.slice(0, 32)) !== encodeBase64url(rpIdHash))
+        return false;
+    const raw = derToRaw(decodeBase64url(signature.signature));
+    if (!raw)
+        return false;
+    const signed = new Uint8Array([...authData, ...(await sha256(clientDataBytes))]);
+    return verifyEs256(presenceKey.publicKey, raw, signed);
+}
+async function signatureHolds(statement, signature, pinned) {
+    if (signature.format === "webauthn") {
+        return assertionHolds(statement, signature, pinned.presenceKey);
+    }
+    const bytes = statementBytes(statement);
+    const raw = decodeBase64url(signature.signature);
+    if (signature.presence === "none")
+        return verifyEs256(pinned.signingKey, raw, bytes);
+    const { presenceKey } = pinned;
+    return presenceKey?.format === "es256-raw"
+        ? verifyEs256(presenceKey.publicKey, raw, bytes)
+        : false;
+}
+export async function verifyStatement(signed, pinned, options) {
+    const { statement, signature } = signed;
+    if (signed.deviceId !== pinned.deviceId)
+        return "invalid";
+    if (options.now - statement.at > options.maxAgeMs)
+        return "stale";
+    if (statement.at - options.now > FUTURE_SKEW_MS)
+        return "invalid";
+    if (options.requirePresence && signature.presence !== "user") {
+        return "presence_required";
+    }
+    try {
+        return (await signatureHolds(statement, signature, pinned)) ? "valid" : "invalid";
+    }
+    catch {
+        return "invalid";
+    }
+}
+//# sourceMappingURL=statements.js.map