@pulse-compute/crypto 1.0.0-beta.4 → 1.0.0-beta.6

package/README.md

@@ -2,20 +2,43 @@
 
 <!-- pulse-package-status:start -->
 > **Support tier:** Supported provider/extension surface<br>
-> **Audience:** Applications and first-party packages using provider-neutral cryptographic verification.<br>
-> **Install directly:** Yes, when an application uses the crypto verification surface directly; JWT applications receive it transitively.<br>
+> **Audience:** Applications and first-party packages using provider-neutral verification and exact-text SHA-256.<br>
+> **Install directly:** Yes, when an application uses verification or digestText directly; JWT applications receive it transitively.<br>
 > **Supported entry points:** `@pulse-compute/crypto`<br>
-> **Stability:** The package root is the supported bounded verification contract; realization and Native integration subpaths remain toolchain-only.<br>
+> **Stability:** The package root supports bounded verification and request-owned exact-text digests; provider, manifest/compiler and Native integration subpaths remain toolchain-only.<br>
 > **npm:** [`@pulse-compute/crypto`](https://www.npmjs.com/package/@pulse-compute/crypto)<br>
-> **Canonical documentation:** [Package guide](https://pulsecompute.io/v1.0.0-beta.4/packages/crypto/)
+> **Canonical documentation:** [Package guide](https://pulsecompute.io/v1.0.0-beta.6/packages/crypto/)
 >
-> This release-status block is generated from the synchronized `Pulse 1.0.0-beta.4` package policy.
+> This release-status block is generated from the synchronized `Pulse 1.0.0-beta.6` package policy.
 <!-- pulse-package-status:end -->
 
-Provider-neutral cryptographic verification contracts for Pulse.
+Provider-neutral verification and bounded exact-text SHA-256 for Pulse.
 
 This package and `@pulse-compute/jwt` are members of the synchronized
-`1.0.0-beta.4` release catalog.
+`1.0.0-beta.6` release catalog.
+
+## Exact-text SHA-256
+
+```ts
+import { crypto } from '@pulse-compute/crypto'
+
+const digest = await crypto.digestText(ctx, text)
+```
+
+Select `pulse.crypto: ['SHA-256']`. The current HTTP context owns this effect;
+use a directly awaited local variable or keyed `ctx.parallel` member.
+Success is `{ status: 'ok', sha256, byteLength }`: 64 lowercase hex characters
+and the exact UTF-8 length. The public `DIGEST_TEXT_MAX_BYTES` is 2097152, empty
+input is accepted, and unpaired surrogates are rejected without replacement.
+No normalization, parsing, BOM stripping, or newline conversion occurs.
+Failures are `{ status: 'failed', reason }`, where reason is `invalid-text`,
+`too-large`, `unavailable`, or `realization-failure`; cancellation terminates
+the invocation. The named `digestText` export has the same contract.
+
+Node/Fastly Native reuse the selected Crypto SHA-256 guest source. Node/Fastly
+JavaScript use selected Web Crypto. Neither falls back. This bound matches
+current S3 text capacity and leaves larger Catalog envelopes for capacity work.
+See the [exact-text digest contract](https://pulsecompute.io/v1.0.0-beta.6/packages/crypto/#exact-text-digest).
 
 ## Verification contract
 
@@ -132,9 +155,67 @@ deployment.
 S3 uses Crypto-owned SHA-256 and HMAC-SHA256 byte outputs. Native composes the
 existing guest-source unit; Node JavaScript explicitly binds Web Crypto through
 `@pulse-compute/crypto/provider`. The trusted seam snapshots Uint8Array input,
-allows at most 32768 data bytes and 8192 HMAC key bytes, returns exactly 32 bytes,
+allows at most 2097152 SHA-256 data bytes, 32768 HMAC data bytes and 8192 HMAC
+key bytes, returns exactly 32 bytes,
 and wipes input staging on success or failure. It rejects unavailable selected
 primitives and does not fall back. Empty HMAC keys use the equivalent padded
 zero block required by HMAC, preserving Native semantics despite Web Crypto's
 zero-length import restriction. This provider seam does not add an author-facing
 signing API or change JWT key limits.
+
+Large hashes use a separate lazy 2,097,184-byte Native staging frame; small
+hashes and HMAC keep the 40,992-byte frame. Primary-memory Native digest/S3
+modules have a 256 MiB Wasm maximum. Fixed-memory linked guests retain their
+separate ABI and do not establish the 2 MiB text capacity profile.
+
+
+## RS256 signature contract
+
+`crypto.signature.verify` accepts `algorithm: 'RS256'` and a
+`rsa-public-key-bytes` key. `normalizeRsaPublicKey({ n, e })` converts public
+JWK integers into that representation; `normalizeRs256JoseVerifyRequest`
+also decodes the canonical, fixed-width JOSE signature. JWT owns JWK metadata
+and selection policy. No generic public signing API is introduced.
+
+The normalized key is a little-endian 32-bit modulus byte length, the unsigned
+big-endian modulus, and a four-byte big-endian public exponent. Supported
+lengths are 256, 384, and 512 bytes; the modulus has its high bit set and is
+odd. Exponents are odd integers in `[3, 4294967295]`. Signature width equals
+modulus width, including any leading zero signature bytes. Data is at most
+12288 bytes. Verification returns the existing closed status taxonomy.
+
+The exact Native selection is `guest-linked:pulse-rs256-bearssl-i31` with
+`bearssl.0.6.rsa-i31.sha256.v1`. It shares the pinned ES256/RS256 prebuilt and
+fixed 2 MiB memory with ES256. The private signing adapter accepts normalized
+RSA/CRT bytes, validates their consistency, and checks every resulting
+signature by public exponentiation before release. The caller erases its
+16640-byte invocation frame and the borrowed 64 KiB guest stack on return.
+The Node wrapper also clears both regions on a trap; a Fastly Native trap
+aborts execution before in-Wasm cleanup can run. The guest has no retained
+key state, entropy imports, allocation, or host callbacks. PKCS#1 v1.5
+signing is deterministic and needs no nonce.
+
+BearSSL `i31` uses constant-time arithmetic rather than RSA blinding. Its
+security assumptions include constant-time integer multiplication and a
+compiler/engine that preserves the intended data-independent execution.
+This is not a formal timing proof for every Wasm engine or CPU. The pinned
+upstream source, license, archive hash, per-file hashes, compiler versions,
+and reproducible build command ship with the guest. The historical guest
+path and module name remain for compatibility; its ABI is now
+`pulse.crypto.es256-rs256.verify-and-sign.v3`.
+
+JavaScript explicitly selects `RSASSA-PKCS1-v1_5` with `SHA-256` in Web Crypto
+and independently verifies signing output. Redundant private-field import
+checks use JavaScript BigInt, which is not constant time; private
+exponentiation and blinding belong to the selected Web Crypto runtime.
+Immutable JWK strings and runtime-owned key objects cannot be explicitly
+erased by Pulse. The provider retains its existing cancellation and
+redaction boundaries.
+
+The combined prebuilt is 36378 bytes. The development corpus observed 6324
+bytes of guest stack writes within the reserved 65536 bytes. Local warmed
+4096-bit operations took roughly 43 ms to sign and 1.5 ms to verify; these
+are local Node Wasm observations, not performance guarantees or Fastly
+measurements. `crypto-rs256` regenerates the observations and tests independent
+interoperability, malformed PKCS#1 encodings, CRT corruption, frame bounds,
+and cleanup. `jwt-rs256` covers the provider and CLI paths.

package/as/digest-text.as.ts

@@ -0,0 +1,34 @@
+// Crypto-owned text framing over the existing SHA-256 implementation.
+class __PulseTextDigestResult {
+  status: string = 'failed'
+  reason: string = ''
+  sha256: string = ''
+  byteLength: i32 = 0
+}
+function __pulse_crypto_digest_text(text: string | null): __PulseTextDigestResult {
+  const result = new __PulseTextDigestResult()
+  if (text === null) { result.reason = 'invalid-text'; return result }
+  if (text.length > 2097152) { result.reason = 'too-large'; return result }
+  let length = 0
+  for (let i = 0; i < text.length; i++) {
+    const c = text.charCodeAt(i)
+    if (c >= 0xd800 && c <= 0xdbff) {
+      i += 1
+      if (i >= text.length) { result.reason = 'invalid-text'; return result }
+      const low = text.charCodeAt(i)
+      if (low < 0xdc00 || low > 0xdfff) { result.reason = 'invalid-text'; return result }
+      length += 4
+    } else if (c >= 0xdc00 && c <= 0xdfff) { result.reason = 'invalid-text'; return result }
+    else length += c < 0x80 ? 1 : c < 0x800 ? 2 : 3
+  }
+  if (length > 2097152) { result.reason = 'too-large'; return result }
+  const data = Uint8Array.wrap(String.UTF8.encode(text)), digest = new Uint8Array(32)
+  const code = pulse_crypto_sha256_bytes_v1(data.dataStart, data.length, digest.dataStart, 32)
+  data.fill(0)
+  if (code != 1) { digest.fill(0); result.reason = 'realization-failure'; return result }
+  const alphabet = '0123456789abcdef'
+  for (let i = 0; i < 32; i++) result.sha256 += alphabet.charAt(digest[i] >> 4) + alphabet.charAt(digest[i] & 15)
+  digest.fill(0)
+  result.status = 'ok'; result.byteLength = length
+  return result
+}

package/as/pulse-hmac-as.ts

@@ -318,12 +318,18 @@ export function pulse_crypto_hs256_verify(
 // by Crypto; host callers may stage synchronously, copy the output, then wipe.
 // It does not grow Wasm memory per operation or overlap allocator-owned memory.
 const __pulse_crypto_bytes_frame = new Uint8Array(8192 + 32768 + 32)
+// Allocate the larger digest-only frame only when a host stages a large hash.
+// Small digest/MAC callers and fixed-memory JWT guests keep the original frame.
+@lazy const __pulse_crypto_digest_frame = new Uint8Array(2097152 + 32)
+export function pulse_crypto_digest_frame_v1(): i32 {
+  return <i32>__pulse_crypto_digest_frame.dataStart
+}
 export function pulse_crypto_bytes_frame_v1(): i32 {
   return <i32>__pulse_crypto_bytes_frame.dataStart
 }
 
 export function pulse_crypto_sha256_bytes_v1(dataPointer: i32, dataLength: i32, outputPointer: i32, outputLength: i32): i32 {
-  if (dataLength < 0 || dataLength > 32768 || outputLength != 32
+  if (dataLength < 0 || dataLength > 2097152 || outputLength != 32
     || !__pulse_crypto_memory_range_valid(dataPointer, dataLength)
     || !__pulse_crypto_memory_range_valid(outputPointer, outputLength)) return __PULSE_CRYPTO_INVALID_INPUT
   const digest = __pulse_crypto_sha256_memory(<usize><u32>dataPointer, dataLength)

package/conformance/digest-text.json

@@ -0,0 +1,38 @@
+{
+  "version": "pulse.crypto-text-digest-corpus.v1",
+  "algorithm": "SHA-256",
+  "encoding": "lowercase-hex",
+  "maxUtf8Bytes": 2097152,
+  "vectors": [
+    {
+      "text": "",
+      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+      "byteLength": 0
+    },
+    {
+      "text": "abc",
+      "sha256": "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad",
+      "byteLength": 3
+    },
+    {
+      "text": "\ufeff\u00e9\ud83d\ude00\u0000\r\n",
+      "sha256": "894e231659c59a0e7c35180fbca175d0fb836eb20485a8d0dd02bf5ff8c2a4e7",
+      "byteLength": 12
+    },
+    {
+      "text": "\u00e9",
+      "sha256": "4a99557e4033c3539de2eb65472017cad5f9557f7a0625a09f1c3f6e2ba69c4c",
+      "byteLength": 2
+    },
+    {
+      "text": "e\u0301",
+      "sha256": "bf12767b0f2a56b2190075bae8169f656e3ce8d6357d4aff184bc6c7ea48f9f6",
+      "byteLength": 3
+    },
+    {
+      "text": "{ \"b\":2, \"a\":1 }",
+      "sha256": "a782da44b228c14de003efcebc359fbe0a5bc35d90d5da70513e54e25fa5428a",
+      "byteLength": 16
+    }
+  ]
+}

package/conformance/hs256.json

@@ -0,0 +1,85 @@
+{
+  "version": "pulse.crypto.hs256-conformance.v2",
+  "sources": {
+    "sha256": "NIST FIPS 180-4",
+    "hmac": "RFC 2104",
+    "vectors": "RFC 4231 test cases 6 and 7"
+  },
+  "resultStatuses": [
+    "valid",
+    "invalid-authenticator",
+    "invalid-key",
+    "invalid-input",
+    "realization-failure"
+  ],
+  "resourceLimits": {
+    "hmacKeyBytesMinimum": 32,
+    "hmacKeyBytesMaximum": 4096,
+    "macDataBytesMaximum": 1048576,
+    "hs256TagBytes": 32
+  },
+  "publishedVectors": [
+    {
+      "id": "rfc4231-6",
+      "keyByte": 170,
+      "keyLength": 131,
+      "dataHex": "54657374205573696e67204c6172676572205468616e20426c6f636b2d53697a65204b6579202d2048617368204b6579204669727374",
+      "tagHex": "60e431591ee0b67f0d8a26aacbf5b77f8e0bc6213728c5140546040f0ee37f54"
+    },
+    {
+      "id": "rfc4231-7",
+      "keyByte": 170,
+      "keyLength": 131,
+      "dataHex": "5468697320697320612074657374207573696e672061206c6172676572207468616e20626c6f636b2d73697a65206b657920616e642061206c6172676572207468616e20626c6f636b2d73697a6520646174612e20546865206b6579206e6565647320746f20626520686173686564206265666f7265206265696e6720757365642062792074686520484d414320616c676f726974686d2e",
+      "tagHex": "9b09ffa71b942fcb27635fbcd5b0e944bfdc63644f0713938a7f51535c3a35e2"
+    }
+  ],
+  "boundaryVectors": {
+    "emptyData": {
+      "keyByte": 42,
+      "keyLength": 32,
+      "dataLength": 0,
+      "dataByte": 0,
+      "tagHex": "25e570b039a294705747f0783f32e9b538be395f8713fbcbf346844d84bc78ad"
+    },
+    "maximumData": {
+      "keyByte": 42,
+      "keyLength": 32,
+      "dataLength": 1048576,
+      "dataByte": 165,
+      "tagHex": "c897712d87b7a5649ec1115c6d7461372ff21fdebdc8711b23ddefc0a52e74a3"
+    }
+  },
+  "verificationCases": [
+    { "id": "valid-tag", "fixture": "rfc4231-6", "mutation": "none", "expected": "valid" },
+    { "id": "invalid-tag", "fixture": "rfc4231-6", "mutation": "zero-tag", "expected": "invalid-authenticator" },
+    { "id": "first-byte-mismatch", "fixture": "rfc4231-6", "mutation": "tag-byte-0", "expected": "invalid-authenticator" },
+    { "id": "middle-byte-mismatch", "fixture": "rfc4231-6", "mutation": "tag-byte-15", "expected": "invalid-authenticator" },
+    { "id": "last-byte-mismatch", "fixture": "rfc4231-6", "mutation": "tag-byte-31", "expected": "invalid-authenticator" },
+    { "id": "altered-data", "fixture": "rfc4231-6", "mutation": "data-byte-0", "expected": "invalid-authenticator" },
+    { "id": "wrong-key", "fixture": "rfc4231-6", "mutation": "key-byte-0", "expected": "invalid-authenticator" },
+    { "id": "undersized-key", "fixture": "rfc4231-6", "mutation": "key-length-31", "expected": "invalid-key" },
+    { "id": "malformed-key", "fixture": "rfc4231-6", "mutation": "malformed-key", "expected": "invalid-key" },
+    { "id": "empty-data", "fixture": "empty-data", "mutation": "none", "expected": "valid" },
+    { "id": "bounded-maximum-data", "fixture": "maximum-data", "mutation": "none", "expected": "valid" },
+    { "id": "over-limit-data", "fixture": "maximum-data", "mutation": "data-over-limit", "expected": "invalid-input" },
+    { "id": "malformed-tag", "fixture": "rfc4231-6", "mutation": "malformed-tag", "expected": "invalid-input" },
+    { "id": "wrong-length-tag", "fixture": "rfc4231-6", "mutation": "tag-length-31", "expected": "invalid-input" }
+  ],
+  "configurationCases": [
+    "inherited-global-crypto",
+    "named-profile-replacement",
+    "no-array-merging",
+    "no-object-merging",
+    "empty-array",
+    "empty-object",
+    "duplicate-array-entry",
+    "unknown-key",
+    "unknown-algorithm",
+    "unknown-realization",
+    "profile-missing-hs256",
+    "target-without-hs256",
+    "unavailable-exact-realization-pin",
+    "no-fallback-after-realization-failure"
+  ]
+}

package/dist/contracts.d.ts

@@ -6,13 +6,12 @@ export declare const CRYPTO_ES256_RUNTIME_BUILTIN_IMPLEMENTATION: "webcrypto.sub
 export declare const CRYPTO_ES256_GUEST_LINKED_REALIZATION: "guest-linked:pulse-es256-rustcrypto-p256";
 export declare const CRYPTO_ES256_GUEST_LINKED_IMPLEMENTATION: "rustcrypto.p256-0.13.2.ecdsa-0.16.9.sha2-0.10.9.v1";
 /**
- * Executable algorithms remain intentionally narrower than frozen future
- * contracts. G3, not G0, owns activation of ES256.
+ * Executable verification algorithms. Signature keys remain algorithm-bound.
  */
-export declare const CRYPTO_ALGORITHMS: readonly ["HS256", "ES256"];
+export declare const CRYPTO_ALGORITHMS: readonly ["HS256", "ES256", "RS256"];
 export type CryptoAlgorithm = typeof CRYPTO_ALGORITHMS[number];
 export type MacAlgorithm = 'HS256';
-export type SignatureAlgorithm = 'ES256';
+export type SignatureAlgorithm = 'ES256' | 'RS256';
 export declare const CRYPTO_VERIFICATION_STATUSES: readonly ["valid", "invalid-authenticator", "invalid-key", "invalid-input", "realization-failure"];
 export type CryptoVerificationStatus = typeof CRYPTO_VERIFICATION_STATUSES[number];
 export type CryptoVerificationResult = {
@@ -50,14 +49,18 @@ export interface P256PublicKeyBytes {
     /** Exactly 64 bytes: 32-byte big-endian x followed by 32-byte big-endian y. */
     readonly bytes: Uint8Array;
 }
-export interface SignatureVerifyRequest {
-    readonly algorithm: SignatureAlgorithm;
-    readonly key: P256PublicKeyBytes;
+export type SignatureVerifyRequest = Readonly<{
     /** Exact original signing bytes; never a reserialized JWT representation. */
-    readonly data: Uint8Array;
-    /** Exactly 64 bytes: 32-byte big-endian r followed by 32-byte big-endian s. */
-    readonly signature: Uint8Array;
-}
+    data: Uint8Array;
+    /** JOSE P-256 r||s, or one RSA modulus-width octet string. */
+    signature: Uint8Array;
+}> & (Readonly<{
+    algorithm: 'ES256';
+    key: P256PublicKeyBytes;
+}> | Readonly<{
+    algorithm: 'RS256';
+    key: RsaPublicKeyBytes;
+}>);
 /**
  * Crypto-owned adapter input for the one JOSE representation accepted by the
  * JWT composition. JWT has already validated the public JWK policy; crypto
@@ -83,6 +86,9 @@ export declare const CRYPTO_RESOURCE_LIMITS: Readonly<{
     readonly es256PublicKeyBytes: 64;
     readonly es256SignatureBytes: 64;
     readonly es256SigningInputBytesMaximum: 16340;
+    readonly rs256ModulusBytes: readonly [256, 384, 512];
+    readonly rs256PublicExponentMaximum: 4294967295;
+    readonly rs256SigningInputBytesMaximum: 12288;
 }>;
 export declare const CRYPTO_ES256_CONTRACT: Readonly<{
     readonly version: "pulse.crypto.es256-verification.v1";
@@ -120,7 +126,7 @@ export declare const CRYPTO_ES256_CONTRACT: Readonly<{
         unitId: "pulse.crypto.es256.rustcrypto-p256.v1";
         module: "pulse_crypto_es256";
         owner: "@pulse-compute/crypto";
-        abi: "pulse.crypto.es256.verify.v1";
+        abi: "pulse.crypto.es256-rs256.verify-and-sign.v3";
         export: Readonly<{
             name: "pulse_crypto_es256_verify";
             parameters: readonly ["i32", "i32"];
@@ -195,4 +201,20 @@ export declare const CRYPTO_ES256_CONTRACT: Readonly<{
     }>;
     readonly automaticFallback: false;
 }>;
+export interface RsaPublicKeyBytes {
+    readonly type: 'rsa-public-key-bytes';
+    /** LE32 modulus byte length, big-endian modulus, four-byte public exponent. */
+    readonly bytes: Uint8Array;
+}
+export interface Rs256JoseVerifyInput {
+    readonly key: Readonly<{
+        n: string;
+        e: string;
+    }>;
+    readonly data: Uint8Array;
+    readonly signature: string;
+}
+export declare const CRYPTO_RS256_GUEST_LINKED_REALIZATION: "guest-linked:pulse-rs256-bearssl-i31";
+export declare const CRYPTO_RS256_GUEST_LINKED_IMPLEMENTATION: "bearssl.0.6.rsa-i31.sha256.v1";
+export declare const CRYPTO_RS256_RUNTIME_BUILTIN_IMPLEMENTATION: "webcrypto.subtle.rsassa-pkcs1-v1_5-sha-256.v1";
 //# sourceMappingURL=contracts.d.ts.map

package/dist/contracts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contracts.d.ts","sourceRoot":"","sources":["../src/contracts.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,uBAAuB,EAAG,8BAAuC,CAAC;AAC/E,eAAO,MAAM,qCAAqC,EAChD,kCAA2C,CAAC;AAC9C,eAAO,MAAM,kCAAkC,EAC7C,kBAA2B,CAAC;AAC9B,eAAO,MAAM,6BAA6B,EACxC,oCAA6C,CAAC;AAChD,eAAO,MAAM,2CAA2C,EACtD,wCAAiD,CAAC;AACpD,eAAO,MAAM,qCAAqC,EAChD,0CAAmD,CAAC;AACtD,eAAO,MAAM,wCAAwC,EACnD,oDAA6D,CAAC;AAEhE;;;GAGG;AACH,eAAO,MAAM,iBAAiB,6BAGnB,CAAC;AAEZ,MAAM,MAAM,eAAe,GAAG,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC;AAC/D,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC;AACnC,MAAM,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAEzC,eAAO,MAAM,4BAA4B,oGAM9B,CAAC;AAEZ,MAAM,MAAM,wBAAwB,GAClC,OAAO,4BAA4B,CAAC,MAAM,CAAC,CAAC;AAE9C,MAAM,MAAM,wBAAwB,GAChC;IAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAA;CAAE,GAC5C;IAAE,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAClC;IAAE,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;CAAE,GACpC;IAAE,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAA;CAAE,CAAC;AAE/C;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B;AAED,MAAM,MAAM,mBAAmB,GAAG,YAAY,CAAC;AAE/C,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,mBAAmB,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;IACvC,+EAA+E;IAC/E,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC;IACjC,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,+EAA+E;IAC/E,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;CAChC;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;QACrB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC,CAAC;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,sBAAsB;;;;;;;;EAQxB,CAAC;AAEZ,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoHvB,CAAC"}
+{"version":3,"file":"contracts.d.ts","sourceRoot":"","sources":["../src/contracts.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,uBAAuB,EAAG,8BAAuC,CAAC;AAC/E,eAAO,MAAM,qCAAqC,EAChD,kCAA2C,CAAC;AAC9C,eAAO,MAAM,kCAAkC,EAC7C,kBAA2B,CAAC;AAC9B,eAAO,MAAM,6BAA6B,EACxC,oCAA6C,CAAC;AAChD,eAAO,MAAM,2CAA2C,EACtD,wCAAiD,CAAC;AACpD,eAAO,MAAM,qCAAqC,EAChD,0CAAmD,CAAC;AACtD,eAAO,MAAM,wCAAwC,EACnD,oDAA6D,CAAC;AAEhE;;GAEG;AACH,eAAO,MAAM,iBAAiB,sCAInB,CAAC;AAEZ,MAAM,MAAM,eAAe,GAAG,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC;AAC/D,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC;AACnC,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,OAAO,CAAC;AAEnD,eAAO,MAAM,4BAA4B,oGAM9B,CAAC;AAEZ,MAAM,MAAM,wBAAwB,GAClC,OAAO,4BAA4B,CAAC,MAAM,CAAC,CAAC;AAE9C,MAAM,MAAM,wBAAwB,GAChC;IAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAA;CAAE,GAC5C;IAAE,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAClC;IAAE,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;CAAE,GACpC;IAAE,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAA;CAAE,CAAC;AAE/C;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B;AAED,MAAM,MAAM,mBAAmB,GAAG,YAAY,CAAC;AAE/C,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,mBAAmB,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;IACvC,+EAA+E;IAC/E,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B;AAED,MAAM,MAAM,sBAAsB,GAAG,QAAQ,CAAC;IAC5C,6EAA6E;IAC7E,IAAI,EAAE,UAAU,CAAC;IACjB,8DAA8D;IAC9D,SAAS,EAAE,UAAU,CAAC;CACvB,CAAC,GAAG,CAAC,QAAQ,CAAC;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,kBAAkB,CAAA;CAAE,CAAC,GAC3D,QAAQ,CAAC;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,iBAAiB,CAAA;CAAE,CAAC,CAAC,CAAC;AAE9D;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;QACrB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC,CAAC;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,sBAAsB;;;;;;;;;;;EAWxB,CAAC;AAEZ,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoHvB,CAAC;AAEZ,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B;AACD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;QAAE,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AACD,eAAO,MAAM,qCAAqC,EAAG,sCAA+C,CAAC;AACrG,eAAO,MAAM,wCAAwC,EAAG,+BAAwC,CAAC;AACjG,eAAO,MAAM,2CAA2C,EAAG,+CAAwD,CAAC"}

package/dist/contracts.js

@@ -6,12 +6,12 @@ export const CRYPTO_ES256_RUNTIME_BUILTIN_IMPLEMENTATION = 'webcrypto.subtle.ecd
 export const CRYPTO_ES256_GUEST_LINKED_REALIZATION = 'guest-linked:pulse-es256-rustcrypto-p256';
 export const CRYPTO_ES256_GUEST_LINKED_IMPLEMENTATION = 'rustcrypto.p256-0.13.2.ecdsa-0.16.9.sha2-0.10.9.v1';
 /**
- * Executable algorithms remain intentionally narrower than frozen future
- * contracts. G3, not G0, owns activation of ES256.
+ * Executable verification algorithms. Signature keys remain algorithm-bound.
  */
 export const CRYPTO_ALGORITHMS = Object.freeze([
     'HS256',
     'ES256',
+    'RS256',
 ]);
 export const CRYPTO_VERIFICATION_STATUSES = Object.freeze([
     'valid',
@@ -28,6 +28,9 @@ export const CRYPTO_RESOURCE_LIMITS = Object.freeze({
     es256PublicKeyBytes: 64,
     es256SignatureBytes: 64,
     es256SigningInputBytesMaximum: 16_340,
+    rs256ModulusBytes: Object.freeze([256, 384, 512]),
+    rs256PublicExponentMaximum: 0xffffffff,
+    rs256SigningInputBytesMaximum: 12_288,
 });
 export const CRYPTO_ES256_CONTRACT = Object.freeze({
     version: CRYPTO_ES256_CONTRACT_VERSION,
@@ -71,7 +74,7 @@ export const CRYPTO_ES256_CONTRACT = Object.freeze({
         unitId: 'pulse.crypto.es256.rustcrypto-p256.v1',
         module: 'pulse_crypto_es256',
         owner: '@pulse-compute/crypto',
-        abi: 'pulse.crypto.es256.verify.v1',
+        abi: 'pulse.crypto.es256-rs256.verify-and-sign.v3',
         export: Object.freeze({
             name: 'pulse_crypto_es256_verify',
             parameters: Object.freeze(['i32', 'i32']),
@@ -146,4 +149,7 @@ export const CRYPTO_ES256_CONTRACT = Object.freeze({
     }),
     automaticFallback: false,
 });
+export const CRYPTO_RS256_GUEST_LINKED_REALIZATION = 'guest-linked:pulse-rs256-bearssl-i31';
+export const CRYPTO_RS256_GUEST_LINKED_IMPLEMENTATION = 'bearssl.0.6.rsa-i31.sha256.v1';
+export const CRYPTO_RS256_RUNTIME_BUILTIN_IMPLEMENTATION = 'webcrypto.subtle.rsassa-pkcs1-v1_5-sha-256.v1';
 //# sourceMappingURL=contracts.js.map

package/dist/contracts.js.map

@@ -1 +1 @@
-{"version":3,"file":"contracts.js","sourceRoot":"","sources":["../src/contracts.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,uBAAuB,GAAG,8BAAuC,CAAC;AAC/E,MAAM,CAAC,MAAM,qCAAqC,GAChD,kCAA2C,CAAC;AAC9C,MAAM,CAAC,MAAM,kCAAkC,GAC7C,kBAA2B,CAAC;AAC9B,MAAM,CAAC,MAAM,6BAA6B,GACxC,oCAA6C,CAAC;AAChD,MAAM,CAAC,MAAM,2CAA2C,GACtD,wCAAiD,CAAC;AACpD,MAAM,CAAC,MAAM,qCAAqC,GAChD,0CAAmD,CAAC;AACtD,MAAM,CAAC,MAAM,wCAAwC,GACnD,oDAA6D,CAAC;AAEhE;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7C,OAAO;IACP,OAAO;CACC,CAAC,CAAC;AAMZ,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC,MAAM,CAAC;IACxD,OAAO;IACP,uBAAuB;IACvB,aAAa;IACb,eAAe;IACf,qBAAqB;CACb,CAAC,CAAC;AAoEZ,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,CAAC;IAClD,mBAAmB,EAAE,EAAE;IACvB,mBAAmB,EAAE,CAAC,GAAG,IAAI;IAC7B,mBAAmB,EAAE,IAAI,GAAG,IAAI;IAChC,aAAa,EAAE,EAAE;IACjB,mBAAmB,EAAE,EAAE;IACvB,mBAAmB,EAAE,EAAE;IACvB,6BAA6B,EAAE,MAAM;CAC7B,CAAC,CAAC;AAEZ,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,CAAC;IACjD,OAAO,EAAE,6BAA6B;IACtC,MAAM,EAAE,eAAe;IACvB,aAAa,EAAE,uBAAuB;IACtC,SAAS,EAAE,OAAO;IAClB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC;QACvB,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,SAAS;KAChB,CAAC;IACF,SAAS,EAAE,QAAQ;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;QACrB,QAAQ,EAAE,yBAAyB;QACnC,OAAO,EAAE,uBAAuB;QAChC,iBAAiB,EAAE,oBAAoB;QACvC,cAAc,EAAE,sBAAsB,CAAC,mBAAmB;QAC1D,gBAAgB,EAAE,sBAAsB,CAAC,6BAA6B;QACtE,iBAAiB,EAAE,qBAAqB;QACxC,cAAc,EAAE,sBAAsB,CAAC,mBAAmB;QAC1D,WAAW,EAAE,KAAK;KACnB,CAAC;IACF,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC;QAC5B,WAAW,EAAE,iBAAiB;QAC9B,cAAc,EAAE,2CAA2C;QAC3D,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC;YAC7B,iBAAiB;YACjB,mBAAmB;SACX,CAAC;KACZ,CAAC;IACF,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;QACpB,WAAW,EAAE,qCAAqC;QAClD,cAAc,EAAE,wCAAwC;QACxD,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC;YAC7B,aAAa;YACb,eAAe;SACP,CAAC;KACZ,CAAC;IACF,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;QACnB,WAAW,EAAE,qBAAqB;QAClC,MAAM,EAAE,uCAAuC;QAC/C,MAAM,EAAE,oBAAoB;QAC5B,KAAK,EAAE,uBAAuB;QAC9B,GAAG,EAAE,8BAA8B;QACnC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;YACpB,IAAI,EAAE,2BAA2B;YACjC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,CAAU,CAAC;YAClD,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAU,CAAC;SACzC,CAAC;QACF,MAAM,EAAE,kBAAkB;QAC1B,iCAAiC,EAAE,KAAK;QACxC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;YACpB,QAAQ,EAAE,wCAAwC;YAClD,MAAM,EAAE,YAAY;YACpB,YAAY,EAAE,EAAE;YAChB,YAAY,EAAE,EAAE;YAChB,QAAQ,EAAE,KAAK;SAChB,CAAC;QACF,KAAK,EAAE,WAAW;QAClB,aAAa,EAAE,KAAK;QACpB,SAAS,EAAE,KAAK;KACjB,CAAC;IACF,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,wCAAwC;QAClD,SAAS,EAAE,eAAe;QAC1B,gBAAgB,EAAE,EAAE;QACpB,KAAK,EAAE,UAAU;QACjB,OAAO,EAAE,CAAC;QACV,WAAW,EAAE,EAAE;QACf,aAAa,EAAE,MAAM;QACrB,cAAc,EAAE,EAAE;QAClB,wBAAwB,EAAE,MAAM;QAChC,cAAc,EAAE,EAAE;QAClB,cAAc,EAAE,EAAE;QAClB,sBAAsB,EAAE,MAAM;QAC9B,+BAA+B,EAAE,GAAG;QACpC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC;YAC9B,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,GAAG;YACd,YAAY,EAAE,GAAG;SAClB,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;YACpB,KAAK,EAAE,CAAC;YACR,OAAO,EAAE,CAAC;YACV,YAAY,EAAE,CAAC;YACf,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,EAAE;YACb,KAAK,EAAE,EAAE;YACT,kBAAkB,EAAE,EAAE;YACtB,kBAAkB,EAAE,EAAE;YACtB,eAAe,EAAE,EAAE;YACnB,eAAe,EAAE,EAAE;YACnB,eAAe,EAAE,EAAE;YACnB,eAAe,EAAE,EAAE;YACnB,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,EAAE;SACd,CAAC;QACF,aAAa,EAAE,CAAC;QAChB,KAAK,EAAE,CAAC;QACR,iBAAiB,EAAE,CAAC;QACpB,iBAAiB,EAAE,CAAC;QACpB,WAAW,EAAE,IAAI;QACjB,WAAW,EAAE,IAAI;QACjB,UAAU,EAAE,KAAK;QACjB,8BAA8B,EAAE,IAAI;KACrC,CAAC;IACF,cAAc,EAAE,4BAA4B;IAC5C,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC;QACzB,KAAK,EAAE,CAAC;QACR,oBAAoB,EAAE,CAAC;QACvB,UAAU,EAAE,CAAC,CAAC;QACd,YAAY,EAAE,CAAC,CAAC;QAChB,kBAAkB,EAAE,CAAC,CAAC;KACvB,CAAC;IACF,iBAAiB,EAAE,KAAK;CAChB,CAAC,CAAC"}
+{"version":3,"file":"contracts.js","sourceRoot":"","sources":["../src/contracts.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,uBAAuB,GAAG,8BAAuC,CAAC;AAC/E,MAAM,CAAC,MAAM,qCAAqC,GAChD,kCAA2C,CAAC;AAC9C,MAAM,CAAC,MAAM,kCAAkC,GAC7C,kBAA2B,CAAC;AAC9B,MAAM,CAAC,MAAM,6BAA6B,GACxC,oCAA6C,CAAC;AAChD,MAAM,CAAC,MAAM,2CAA2C,GACtD,wCAAiD,CAAC;AACpD,MAAM,CAAC,MAAM,qCAAqC,GAChD,0CAAmD,CAAC;AACtD,MAAM,CAAC,MAAM,wCAAwC,GACnD,oDAA6D,CAAC;AAEhE;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7C,OAAO;IACP,OAAO;IACP,OAAO;CACC,CAAC,CAAC;AAMZ,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC,MAAM,CAAC;IACxD,OAAO;IACP,uBAAuB;IACvB,aAAa;IACb,eAAe;IACf,qBAAqB;CACb,CAAC,CAAC;AAmEZ,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,CAAC;IAClD,mBAAmB,EAAE,EAAE;IACvB,mBAAmB,EAAE,CAAC,GAAG,IAAI;IAC7B,mBAAmB,EAAE,IAAI,GAAG,IAAI;IAChC,aAAa,EAAE,EAAE;IACjB,mBAAmB,EAAE,EAAE;IACvB,mBAAmB,EAAE,EAAE;IACvB,6BAA6B,EAAE,MAAM;IACrC,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAU,CAAC;IAC1D,0BAA0B,EAAE,UAAU;IACtC,6BAA6B,EAAE,MAAM;CAC7B,CAAC,CAAC;AAEZ,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,CAAC;IACjD,OAAO,EAAE,6BAA6B;IACtC,MAAM,EAAE,eAAe;IACvB,aAAa,EAAE,uBAAuB;IACtC,SAAS,EAAE,OAAO;IAClB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC;QACvB,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,SAAS;KAChB,CAAC;IACF,SAAS,EAAE,QAAQ;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;QACrB,QAAQ,EAAE,yBAAyB;QACnC,OAAO,EAAE,uBAAuB;QAChC,iBAAiB,EAAE,oBAAoB;QACvC,cAAc,EAAE,sBAAsB,CAAC,mBAAmB;QAC1D,gBAAgB,EAAE,sBAAsB,CAAC,6BAA6B;QACtE,iBAAiB,EAAE,qBAAqB;QACxC,cAAc,EAAE,sBAAsB,CAAC,mBAAmB;QAC1D,WAAW,EAAE,KAAK;KACnB,CAAC;IACF,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC;QAC5B,WAAW,EAAE,iBAAiB;QAC9B,cAAc,EAAE,2CAA2C;QAC3D,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC;YAC7B,iBAAiB;YACjB,mBAAmB;SACX,CAAC;KACZ,CAAC;IACF,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;QACpB,WAAW,EAAE,qCAAqC;QAClD,cAAc,EAAE,wCAAwC;QACxD,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC;YAC7B,aAAa;YACb,eAAe;SACP,CAAC;KACZ,CAAC;IACF,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;QACnB,WAAW,EAAE,qBAAqB;QAClC,MAAM,EAAE,uCAAuC;QAC/C,MAAM,EAAE,oBAAoB;QAC5B,KAAK,EAAE,uBAAuB;QAC9B,GAAG,EAAE,6CAA6C;QAClD,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;YACpB,IAAI,EAAE,2BAA2B;YACjC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,CAAU,CAAC;YAClD,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAU,CAAC;SACzC,CAAC;QACF,MAAM,EAAE,kBAAkB;QAC1B,iCAAiC,EAAE,KAAK;QACxC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;YACpB,QAAQ,EAAE,wCAAwC;YAClD,MAAM,EAAE,YAAY;YACpB,YAAY,EAAE,EAAE;YAChB,YAAY,EAAE,EAAE;YAChB,QAAQ,EAAE,KAAK;SAChB,CAAC;QACF,KAAK,EAAE,WAAW;QAClB,aAAa,EAAE,KAAK;QACpB,SAAS,EAAE,KAAK;KACjB,CAAC;IACF,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,wCAAwC;QAClD,SAAS,EAAE,eAAe;QAC1B,gBAAgB,EAAE,EAAE;QACpB,KAAK,EAAE,UAAU;QACjB,OAAO,EAAE,CAAC;QACV,WAAW,EAAE,EAAE;QACf,aAAa,EAAE,MAAM;QACrB,cAAc,EAAE,EAAE;QAClB,wBAAwB,EAAE,MAAM;QAChC,cAAc,EAAE,EAAE;QAClB,cAAc,EAAE,EAAE;QAClB,sBAAsB,EAAE,MAAM;QAC9B,+BAA+B,EAAE,GAAG;QACpC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC;YAC9B,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,GAAG;YACd,YAAY,EAAE,GAAG;SAClB,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;YACpB,KAAK,EAAE,CAAC;YACR,OAAO,EAAE,CAAC;YACV,YAAY,EAAE,CAAC;YACf,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,EAAE;YACb,KAAK,EAAE,EAAE;YACT,kBAAkB,EAAE,EAAE;YACtB,kBAAkB,EAAE,EAAE;YACtB,eAAe,EAAE,EAAE;YACnB,eAAe,EAAE,EAAE;YACnB,eAAe,EAAE,EAAE;YACnB,eAAe,EAAE,EAAE;YACnB,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,EAAE;SACd,CAAC;QACF,aAAa,EAAE,CAAC;QAChB,KAAK,EAAE,CAAC;QACR,iBAAiB,EAAE,CAAC;QACpB,iBAAiB,EAAE,CAAC;QACpB,WAAW,EAAE,IAAI;QACjB,WAAW,EAAE,IAAI;QACjB,UAAU,EAAE,KAAK;QACjB,8BAA8B,EAAE,IAAI;KACrC,CAAC;IACF,cAAc,EAAE,4BAA4B;IAC5C,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC;QACzB,KAAK,EAAE,CAAC;QACR,oBAAoB,EAAE,CAAC;QACvB,UAAU,EAAE,CAAC,CAAC;QACd,YAAY,EAAE,CAAC,CAAC;QAChB,kBAAkB,EAAE,CAAC,CAAC;KACvB,CAAC;IACF,iBAAiB,EAAE,KAAK;CAChB,CAAC,CAAC;AAYZ,MAAM,CAAC,MAAM,qCAAqC,GAAG,sCAA+C,CAAC;AACrG,MAAM,CAAC,MAAM,wCAAwC,GAAG,+BAAwC,CAAC;AACjG,MAAM,CAAC,MAAM,2CAA2C,GAAG,+CAAwD,CAAC"}

package/dist/digest.d.ts

@@ -0,0 +1,14 @@
+import type { PulseContext, PulseParallelEffect } from '@pulse-compute/runtime';
+/** Exact UTF-8 text bound, independent of HMAC and JWT limits. */
+export declare const DIGEST_TEXT_MAX_BYTES: 2097152;
+export type TextDigestResult = {
+    readonly status: 'ok';
+    readonly sha256: string;
+    readonly byteLength: number;
+} | {
+    readonly status: 'failed';
+    readonly reason: 'invalid-text' | 'too-large' | 'unavailable' | 'realization-failure';
+};
+/** Hash exact, well-formed text without normalization, parsing or uploading. */
+export declare function digestText(ctx: PulseContext, text: string): PulseParallelEffect<TextDigestResult>;
+//# sourceMappingURL=digest.d.ts.map

package/dist/digest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"digest.d.ts","sourceRoot":"","sources":["../src/digest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAIhF,kEAAkE;AAClE,eAAO,MAAM,qBAAqB,EAAG,OAAgB,CAAC;AACtD,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC/E;IAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,WAAW,GAAG,aAAa,GAAG,qBAAqB,CAAA;CAAE,CAAC;AAOzH,gFAAgF;AAChF,wBAAgB,UAAU,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,GAAG,mBAAmB,CAAC,gBAAgB,CAAC,CAMjG"}

package/dist/digest.js

@@ -0,0 +1,17 @@
+import packageRuntime from '@pulse-compute/runtime/package';
+import digestProvider from '../src/provider.cjs';
+/** Exact UTF-8 text bound, independent of HMAC and JWT limits. */
+export const DIGEST_TEXT_MAX_BYTES = 2097152;
+const runtime = packageRuntime.createPackageRuntime({
+    package: '@pulse-compute/crypto', contractId: 'pulse.crypto', providerKind: 'crypto',
+    operations: { digestText: { kind: 'crypto.digestText', capability: 'crypto.digestText', result: 'text-digest-result' } },
+});
+/** Hash exact, well-formed text without normalization, parsing or uploading. */
+export function digestText(ctx, text) {
+    // Preserve the over-limit signal without copying unbounded text into the
+    // shared effect envelope. This prefix is itself over the code-unit bound
+    // and is rejected before UTF-8 encoding or hashing on every realization.
+    const boundedText = typeof text === 'string' ? text.slice(0, DIGEST_TEXT_MAX_BYTES + 1) : null;
+    return runtime.effect(ctx, 'digestText', { text: boundedText }, digestProvider.normalizeTextDigestResult);
+}
+//# sourceMappingURL=digest.js.map

package/dist/digest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"digest.js","sourceRoot":"","sources":["../src/digest.ts"],"names":[],"mappings":"AACA,OAAO,cAAc,MAAM,gCAAgC,CAAC;AAC5D,OAAO,cAAc,MAAM,qBAAqB,CAAC;AAEjD,kEAAkE;AAClE,MAAM,CAAC,MAAM,qBAAqB,GAAG,OAAgB,CAAC;AAKtD,MAAM,OAAO,GAAG,cAAc,CAAC,oBAAoB,CAAC;IAClD,OAAO,EAAE,uBAAuB,EAAE,UAAU,EAAE,cAAc,EAAE,YAAY,EAAE,QAAQ;IACpF,UAAU,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,EAAE,oBAAoB,EAAE,EAAE;CAChH,CAAC,CAAC;AAEZ,gFAAgF;AAChF,MAAM,UAAU,UAAU,CAAC,GAAiB,EAAE,IAAY;IACxD,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,MAAM,WAAW,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,qBAAqB,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/F,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,cAAc,CAAC,yBAAyB,CAAC,CAAC;AAC5G,CAAC"}

package/dist/index.d.ts

@@ -1,3 +1,6 @@
+export { normalizeRsaPublicKey, normalizeRs256JoseVerifyRequest } from './internal/rsa.js';
+export type { RsaPublicKeyBytes, Rs256JoseVerifyInput } from './contracts.js';
+export { CRYPTO_RS256_GUEST_LINKED_REALIZATION, CRYPTO_RS256_GUEST_LINKED_IMPLEMENTATION, CRYPTO_RS256_RUNTIME_BUILTIN_IMPLEMENTATION } from './contracts.js';
 import { CRYPTO_ALGORITHMS, CRYPTO_CONTRACT_VERSION, CRYPTO_ES256_CONTRACT, CRYPTO_ES256_CONTRACT_VERSION, CRYPTO_ES256_GUEST_LINKED_IMPLEMENTATION, CRYPTO_ES256_GUEST_LINKED_REALIZATION, CRYPTO_ES256_RUNTIME_BUILTIN_IMPLEMENTATION, CRYPTO_GUEST_SOURCE_IMPLEMENTATION, CRYPTO_RESOURCE_LIMITS, CRYPTO_RUNTIME_BUILTIN_IMPLEMENTATION, CRYPTO_VERIFICATION_STATUSES, type CryptoAlgorithm, type CryptoVerificationResult, type CryptoVerificationStatus, type Es256JoseVerifyInput, type HmacKeyBytes, type HmacVerificationKey, type MacAlgorithm, type MacVerifyRequest, type P256PublicKeyBytes, type P256PublicKeyCoordinates, type SignatureAlgorithm, type SignatureVerifyRequest } from './contracts.js';
 import { normalizeEs256JoseVerifyRequest, normalizeP256PublicKeyCoordinates } from './internal/verification.js';
 export { CRYPTO_ALGORITHMS, CRYPTO_CONTRACT_VERSION, CRYPTO_ES256_CONTRACT, CRYPTO_ES256_CONTRACT_VERSION, CRYPTO_ES256_GUEST_LINKED_IMPLEMENTATION, CRYPTO_ES256_GUEST_LINKED_REALIZATION, CRYPTO_ES256_RUNTIME_BUILTIN_IMPLEMENTATION, CRYPTO_GUEST_SOURCE_IMPLEMENTATION, CRYPTO_RESOURCE_LIMITS, CRYPTO_RUNTIME_BUILTIN_IMPLEMENTATION, CRYPTO_VERIFICATION_STATUSES, };
@@ -11,7 +14,10 @@ export declare const mac: Readonly<{
 export declare const signature: Readonly<{
     verify: typeof verifySignature;
 }>;
+export { DIGEST_TEXT_MAX_BYTES, digestText, type TextDigestResult } from './digest.js';
+import { digestText } from './digest.js';
 export declare const crypto: Readonly<{
+    digestText: typeof digestText;
     mac: Readonly<{
         verify: typeof verifyMac;
     }>;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,6BAA6B,EAC7B,wCAAwC,EACxC,qCAAqC,EACrC,2CAA2C,EAC3C,kCAAkC,EAClC,sBAAsB,EACtB,qCAAqC,EACrC,4BAA4B,EAC5B,KAAK,eAAe,EACpB,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC5B,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,+BAA+B,EAE/B,iCAAiC,EAGlC,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,6BAA6B,EAC7B,wCAAwC,EACxC,qCAAqC,EACrC,2CAA2C,EAC3C,kCAAkC,EAClC,sBAAsB,EACtB,qCAAqC,EACrC,4BAA4B,GAC7B,CAAC;AACF,YAAY,EACV,eAAe,EACf,wBAAwB,EACxB,wBAAwB,EACxB,oBAAoB,EACpB,YAAY,EACZ,mBAAmB,EACnB,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,GACvB,CAAC;AAEF,OAAO,EACL,+BAA+B,EAC/B,iCAAiC,GAClC,CAAC;AAEF,wBAAsB,SAAS,CAC7B,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,wBAAwB,CAAC,CAcnC;AAED,wBAAsB,eAAe,CACnC,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,wBAAwB,CAAC,CAenC;AAED,eAAO,MAAM,GAAG;;EAEd,CAAC;AAEH,eAAO,MAAM,SAAS;;EAEpB,CAAC;AAEH,eAAO,MAAM,MAAM;;;;;;;EAGjB,CAAC;AAEH,eAAe,MAAM,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,qBAAqB,EAAE,+BAA+B,EAAE,MAAM,mBAAmB,CAAC;AAC3F,YAAY,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAC9E,OAAO,EAAE,qCAAqC,EAAE,wCAAwC,EAAE,2CAA2C,EAAE,MAAM,gBAAgB,CAAC;AAC9J,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,6BAA6B,EAC7B,wCAAwC,EACxC,qCAAqC,EACrC,2CAA2C,EAC3C,kCAAkC,EAClC,sBAAsB,EACtB,qCAAqC,EACrC,4BAA4B,EAC5B,KAAK,eAAe,EACpB,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC5B,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,+BAA+B,EAE/B,iCAAiC,EAGlC,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,6BAA6B,EAC7B,wCAAwC,EACxC,qCAAqC,EACrC,2CAA2C,EAC3C,kCAAkC,EAClC,sBAAsB,EACtB,qCAAqC,EACrC,4BAA4B,GAC7B,CAAC;AACF,YAAY,EACV,eAAe,EACf,wBAAwB,EACxB,wBAAwB,EACxB,oBAAoB,EACpB,YAAY,EACZ,mBAAmB,EACnB,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,GACvB,CAAC;AAEF,OAAO,EACL,+BAA+B,EAC/B,iCAAiC,GAClC,CAAC;AAEF,wBAAsB,SAAS,CAC7B,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,wBAAwB,CAAC,CAcnC;AAED,wBAAsB,eAAe,CACnC,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,wBAAwB,CAAC,CAuBnC;AAED,eAAO,MAAM,GAAG;;EAEd,CAAC;AAEH,eAAO,MAAM,SAAS;;EAEpB,CAAC;AAEH,OAAO,EAAE,qBAAqB,EAAE,UAAU,EAAE,KAAK,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACvF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,eAAO,MAAM,MAAM;;;;;;;;EAIjB,CAAC;AAEH,eAAe,MAAM,CAAC"}

package/dist/index.js

@@ -1,3 +1,7 @@
+import { normalizeRs256Request, verifyRs256 } from './internal/rsa.js';
+import { ownDataProperty } from './internal/data.js';
+export { normalizeRsaPublicKey, normalizeRs256JoseVerifyRequest } from './internal/rsa.js';
+export { CRYPTO_RS256_GUEST_LINKED_REALIZATION, CRYPTO_RS256_GUEST_LINKED_IMPLEMENTATION, CRYPTO_RS256_RUNTIME_BUILTIN_IMPLEMENTATION } from './contracts.js';
 import { CRYPTO_ALGORITHMS, CRYPTO_CONTRACT_VERSION, CRYPTO_ES256_CONTRACT, CRYPTO_ES256_CONTRACT_VERSION, CRYPTO_ES256_GUEST_LINKED_IMPLEMENTATION, CRYPTO_ES256_GUEST_LINKED_REALIZATION, CRYPTO_ES256_RUNTIME_BUILTIN_IMPLEMENTATION, CRYPTO_GUEST_SOURCE_IMPLEMENTATION, CRYPTO_RESOURCE_LIMITS, CRYPTO_RUNTIME_BUILTIN_IMPLEMENTATION, CRYPTO_VERIFICATION_STATUSES, } from './contracts.js';
 import { verifyEs256, verifyHs256 } from './internal/realization.js';
 import { normalizeEs256JoseVerifyRequest, normalizeMacVerifyRequest, normalizeP256PublicKeyCoordinates, normalizeSignatureVerifyRequest, normalizeVerificationResult, } from './internal/verification.js';
@@ -21,6 +25,19 @@ export async function verifyMac(request) {
     }
 }
 export async function verifySignature(request) {
+    let rsa = false;
+    try {
+        rsa = ownDataProperty(request, 'algorithm').value === 'RS256';
+    }
+    catch {
+        return normalizeVerificationResult({ status: 'invalid-input' });
+    }
+    if (rsa) {
+        const normalized = normalizeRs256Request(request);
+        if (!normalized.ok)
+            return normalized.result;
+        return normalizeVerificationResult(await verifyRs256(normalized.request));
+    }
     let normalized;
     try {
         normalized = normalizeSignatureVerifyRequest(request);
@@ -44,7 +61,10 @@ export const mac = Object.freeze({
 export const signature = Object.freeze({
     verify: verifySignature,
 });
+export { DIGEST_TEXT_MAX_BYTES, digestText } from './digest.js';
+import { digestText } from './digest.js';
 export const crypto = Object.freeze({
+    digestText,
     mac,
     signature,
 });

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,6BAA6B,EAC7B,wCAAwC,EACxC,qCAAqC,EACrC,2CAA2C,EAC3C,kCAAkC,EAClC,sBAAsB,EACtB,qCAAqC,EACrC,4BAA4B,GAa7B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EACL,+BAA+B,EAC/B,yBAAyB,EACzB,iCAAiC,EACjC,+BAA+B,EAC/B,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,6BAA6B,EAC7B,wCAAwC,EACxC,qCAAqC,EACrC,2CAA2C,EAC3C,kCAAkC,EAClC,sBAAsB,EACtB,qCAAqC,EACrC,4BAA4B,GAC7B,CAAC;AAgBF,OAAO,EACL,+BAA+B,EAC/B,iCAAiC,GAClC,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAAyB;IAEzB,IAAI,UAAwD,CAAC;IAC7D,IAAI,CAAC;QACH,UAAU,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,2BAA2B,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,EAAE;QAAE,OAAO,UAAU,CAAC,MAAM,CAAC;IAE7C,IAAI,CAAC;QACH,OAAO,2BAA2B,CAAC,MAAM,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,2BAA2B,CAAC,SAAS,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAA+B;IAE/B,IAAI,UAA8D,CAAC;IACnE,IAAI,CAAC;QACH,UAAU,GAAG,+BAA+B,CAAC,OAAO,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,2BAA2B,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,EAAE;QAAE,OAAO,UAAU,CAAC,MAAM,CAAC;IAE7C,IAAI,CAAC;QACH,OAAO,2BAA2B,CAAC,MAAM,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrC,OAAO,2BAA2B,CAAC,SAAS,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/B,MAAM,EAAE,SAAS;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;IACrC,MAAM,EAAE,eAAe;CACxB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAClC,GAAG;IACH,SAAS;CACV,CAAC,CAAC;AAEH,eAAe,MAAM,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,+BAA+B,EAAE,MAAM,mBAAmB,CAAC;AAE3F,OAAO,EAAE,qCAAqC,EAAE,wCAAwC,EAAE,2CAA2C,EAAE,MAAM,gBAAgB,CAAC;AAC9J,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,6BAA6B,EAC7B,wCAAwC,EACxC,qCAAqC,EACrC,2CAA2C,EAC3C,kCAAkC,EAClC,sBAAsB,EACtB,qCAAqC,EACrC,4BAA4B,GAa7B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EACL,+BAA+B,EAC/B,yBAAyB,EACzB,iCAAiC,EACjC,+BAA+B,EAC/B,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,6BAA6B,EAC7B,wCAAwC,EACxC,qCAAqC,EACrC,2CAA2C,EAC3C,kCAAkC,EAClC,sBAAsB,EACtB,qCAAqC,EACrC,4BAA4B,GAC7B,CAAC;AAgBF,OAAO,EACL,+BAA+B,EAC/B,iCAAiC,GAClC,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAAyB;IAEzB,IAAI,UAAwD,CAAC;IAC7D,IAAI,CAAC;QACH,UAAU,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,2BAA2B,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,EAAE;QAAE,OAAO,UAAU,CAAC,MAAM,CAAC;IAE7C,IAAI,CAAC;QACH,OAAO,2BAA2B,CAAC,MAAM,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,2BAA2B,CAAC,SAAS,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAA+B;IAE/B,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,IAAI,CAAC;QAAC,GAAG,GAAG,eAAe,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC;IAAC,CAAC;IACtE,MAAM,CAAC;QAAC,OAAO,2BAA2B,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;IAAC,CAAC;IAC1E,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,UAAU,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,UAAU,CAAC,EAAE;YAAE,OAAO,UAAU,CAAC,MAAM,CAAC;QAC7C,OAAO,2BAA2B,CAAC,MAAM,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,UAA8D,CAAC;IACnE,IAAI,CAAC;QACH,UAAU,GAAG,+BAA+B,CAAC,OAAO,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,2BAA2B,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,EAAE;QAAE,OAAO,UAAU,CAAC,MAAM,CAAC;IAE7C,IAAI,CAAC;QACH,OAAO,2BAA2B,CAAC,MAAM,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrC,OAAO,2BAA2B,CAAC,SAAS,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/B,MAAM,EAAE,SAAS;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;IACrC,MAAM,EAAE,eAAe;CACxB,CAAC,CAAC;AAEH,OAAO,EAAE,qBAAqB,EAAE,UAAU,EAAyB,MAAM,aAAa,CAAC;AACvF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAClC,UAAU;IACV,GAAG;IACH,SAAS;CACV,CAAC,CAAC;AAEH,eAAe,MAAM,CAAC"}