@sparkvault/sdk-mobile 6.0.2 → 7.0.0

package/dist/app-sdk/transient.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Whether sending the SAME request again can succeed, read from its HTTP
+ * status: the one retry rule every client and every provider adapter applies.
+ *
+ * A retry rule restated beside every client drifts, and the copy that drifted
+ * decides whether a deliverable message is retried or abandoned, or whether a
+ * download is tried again. Each caller keeps its provider's own extras on top of
+ * this rule (a success body, a dead-token reason, a vendor error name).
+ *
+ * Browser-safe and import-free: sdk-js bundles it and sdk-mobile mirrors it.
+ */
+/**
+ * Is this HTTP status one a retry of the same request can turn into a success?
+ *
+ * RFC 9110: 408 means the server never received the whole request, 429 that it
+ * throttled it, and a 5xx that it failed; every other status is the server's
+ * verdict on this exact request. A caller that got no response at all (a network
+ * error, a timeout) has no status to pass and decides that case itself.
+ *
+ * @param {number} status
+ * @returns {boolean}
+ */
+export function isTransientHttpStatus(status: number): boolean;

package/dist/app-sdk/transient.js

@@ -0,0 +1,29 @@
+// GENERATED FILE — do not edit by hand.
+// Source of truth: packages/app-sdk/src/transient.js
+// Regenerate with: pnpm --filter @sparkvault/sdk-mobile build
+/**
+ * Whether sending the SAME request again can succeed, read from its HTTP
+ * status: the one retry rule every client and every provider adapter applies.
+ *
+ * A retry rule restated beside every client drifts, and the copy that drifted
+ * decides whether a deliverable message is retried or abandoned, or whether a
+ * download is tried again. Each caller keeps its provider's own extras on top of
+ * this rule (a success body, a dead-token reason, a vendor error name).
+ *
+ * Browser-safe and import-free: sdk-js bundles it and sdk-mobile mirrors it.
+ */
+/**
+ * Is this HTTP status one a retry of the same request can turn into a success?
+ *
+ * RFC 9110: 408 means the server never received the whole request, 429 that it
+ * throttled it, and a 5xx that it failed; every other status is the server's
+ * verdict on this exact request. A caller that got no response at all (a network
+ * error, a timeout) has no status to pass and decides that case itself.
+ *
+ * @param {number} status
+ * @returns {boolean}
+ */
+export function isTransientHttpStatus(status) {
+    return status === 408 || status === 429 || status >= 500;
+}
+//# sourceMappingURL=transient.js.map

package/dist/app-sdk/transient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transient.js","sourceRoot":"","sources":["../../src/app-sdk/transient.js"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,qDAAqD;AACrD,8DAA8D;AAE9D;;;;;;;;;;GAUG;AAEH;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAM;IAC1C,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,IAAI,GAAG,CAAC;AAC3D,CAAC"}

package/dist/app-sdk/vat-refusal.d.ts

@@ -0,0 +1,66 @@
+/**
+ * The VAT refusal a Core error answer names, or null when it is not one.
+ *
+ * @param {{ statusCode?: number, details?: { reason?: string } }} error - An
+ *   error as parsed from a Core response (status plus the body's `details`)
+ * @returns {string|null} One of VAT_REFUSAL_REASONS, or null
+ */
+export function vatRefusalReason(error: {
+    statusCode?: number;
+    details?: {
+        reason?: string;
+    };
+}): string | null;
+/**
+ * Whether a refusal says the token's vault session is over: an invalid or an
+ * expired token, which only a new unseal replaces, so a client forgets it. A
+ * read-only refusal leaves the session standing (the token still reads), and
+ * so does a refusal that names no VAT reason.
+ *
+ * @param {string|null} reason - What vatRefusalReason returned
+ * @returns {boolean}
+ */
+export function endsVatSession(reason: string | null): boolean;
+/**
+ * True when Core refused the request's login, not a Vault Access Token it
+ * carried: a 401 bearing Core's session code (AUTHENTICATION_ERROR, the
+ * mapped error's `upstreamCode`) that names no VAT refusal. Its token was
+ * refused, or its account is unavailable (details.reason ACCOUNT_UNAVAILABLE,
+ * ./refusal-reasons.js). A 401 for a credential in the request body (an
+ * unseal key) carries Core's credential code (UNAUTHORIZED) and is not one.
+ *
+ * @param {{ statusCode?: number, upstreamCode?: string|null, details?: { reason?: string } }} error -
+ *   An error as parsed from a Core response (parseApiError)
+ * @returns {boolean}
+ */
+export function isRefusedLogin(error: {
+    statusCode?: number;
+    upstreamCode?: string | null;
+    details?: {
+        reason?: string;
+    };
+}): boolean;
+/**
+ * Why Core refused a Vault Access Token (VAT): the `details.reason` every VAT
+ * refusal carries, and the one reading of it clients share.
+ *
+ *   401 VAT_INVALID    no token, or a malformed, unknown or swept one, or one a
+ *                      since-revoked DVAK minted — unseal again
+ *   403 VAT_EXPIRED    the token outlived its TTL — unseal again, retry as-is
+ *   403 VAT_READ_ONLY  a View Only token on a write — no unseal fixes it
+ *
+ * A 403 with no reason is a token for another vault or account, which no
+ * unseal of this vault fixes; a 401 with no reason is the login itself, never
+ * the VAT. Browser-safe: no imports.
+ */
+export const VAT_REFUSAL_REASONS: Readonly<{
+    INVALID: "VAT_INVALID";
+    EXPIRED: "VAT_EXPIRED";
+    READ_ONLY: "VAT_READ_ONLY";
+}>;
+/** The status each refusal is answered with. */
+export const VAT_REFUSAL_STATUS: Readonly<{
+    VAT_INVALID: 401;
+    VAT_EXPIRED: 403;
+    VAT_READ_ONLY: 403;
+}>;

package/dist/app-sdk/vat-refusal.js

@@ -0,0 +1,69 @@
+// GENERATED FILE — do not edit by hand.
+// Source of truth: packages/app-sdk/src/vat-refusal.js
+// Regenerate with: pnpm --filter @sparkvault/sdk-mobile build
+/**
+ * Why Core refused a Vault Access Token (VAT): the `details.reason` every VAT
+ * refusal carries, and the one reading of it clients share.
+ *
+ *   401 VAT_INVALID    no token, or a malformed, unknown or swept one, or one a
+ *                      since-revoked DVAK minted — unseal again
+ *   403 VAT_EXPIRED    the token outlived its TTL — unseal again, retry as-is
+ *   403 VAT_READ_ONLY  a View Only token on a write — no unseal fixes it
+ *
+ * A 403 with no reason is a token for another vault or account, which no
+ * unseal of this vault fixes; a 401 with no reason is the login itself, never
+ * the VAT. Browser-safe: no imports.
+ */
+export const VAT_REFUSAL_REASONS = Object.freeze({
+    INVALID: 'VAT_INVALID',
+    EXPIRED: 'VAT_EXPIRED',
+    READ_ONLY: 'VAT_READ_ONLY'
+});
+/** The status each refusal is answered with. */
+export const VAT_REFUSAL_STATUS = Object.freeze({
+    [VAT_REFUSAL_REASONS.INVALID]: 401,
+    [VAT_REFUSAL_REASONS.EXPIRED]: 403,
+    [VAT_REFUSAL_REASONS.READ_ONLY]: 403
+});
+/**
+ * The VAT refusal a Core error answer names, or null when it is not one.
+ *
+ * @param {{ statusCode?: number, details?: { reason?: string } }} error - An
+ *   error as parsed from a Core response (status plus the body's `details`)
+ * @returns {string|null} One of VAT_REFUSAL_REASONS, or null
+ */
+export function vatRefusalReason(error) {
+    const reason = error?.details?.reason;
+    return typeof reason === 'string' && Object.hasOwn(VAT_REFUSAL_STATUS, reason) &&
+        VAT_REFUSAL_STATUS[reason] === error?.statusCode
+        ? reason
+        : null;
+}
+/**
+ * Whether a refusal says the token's vault session is over: an invalid or an
+ * expired token, which only a new unseal replaces, so a client forgets it. A
+ * read-only refusal leaves the session standing (the token still reads), and
+ * so does a refusal that names no VAT reason.
+ *
+ * @param {string|null} reason - What vatRefusalReason returned
+ * @returns {boolean}
+ */
+export function endsVatSession(reason) {
+    return reason === VAT_REFUSAL_REASONS.INVALID || reason === VAT_REFUSAL_REASONS.EXPIRED;
+}
+/**
+ * True when Core refused the request's login, not a Vault Access Token it
+ * carried: a 401 bearing Core's session code (AUTHENTICATION_ERROR, the
+ * mapped error's `upstreamCode`) that names no VAT refusal. Its token was
+ * refused, or its account is unavailable (details.reason ACCOUNT_UNAVAILABLE,
+ * ./refusal-reasons.js). A 401 for a credential in the request body (an
+ * unseal key) carries Core's credential code (UNAUTHORIZED) and is not one.
+ *
+ * @param {{ statusCode?: number, upstreamCode?: string|null, details?: { reason?: string } }} error -
+ *   An error as parsed from a Core response (parseApiError)
+ * @returns {boolean}
+ */
+export function isRefusedLogin(error) {
+    return error?.statusCode === 401 && error?.upstreamCode === 'AUTHENTICATION_ERROR' && vatRefusalReason(error) === null;
+}
+//# sourceMappingURL=vat-refusal.js.map

package/dist/app-sdk/vat-refusal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vat-refusal.js","sourceRoot":"","sources":["../../src/app-sdk/vat-refusal.js"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,uDAAuD;AACvD,8DAA8D;AAE9D;;;;;;;;;;;;GAYG;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/C,OAAO,EAAE,aAAa;IACtB,OAAO,EAAE,aAAa;IACtB,SAAS,EAAE,eAAe;CAC3B,CAAC,CAAC;AAEH,gDAAgD;AAChD,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC9C,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,GAAG;IAClC,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,GAAG;IAClC,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,GAAG;CACrC,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAK;IACpC,MAAM,MAAM,GAAG,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;IACtC,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC;QAC5E,kBAAkB,CAAC,MAAM,CAAC,KAAK,KAAK,EAAE,UAAU;QAChD,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,MAAM;IACnC,OAAO,MAAM,KAAK,mBAAmB,CAAC,OAAO,IAAI,MAAM,KAAK,mBAAmB,CAAC,OAAO,CAAC;AAC1F,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAAC,KAAK;IAClC,OAAO,KAAK,EAAE,UAAU,KAAK,GAAG,IAAI,KAAK,EAAE,YAAY,KAAK,sBAAsB,IAAI,gBAAgB,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;AACzH,CAAC"}

package/dist/billing.d.ts

@@ -1,27 +1,19 @@
 import type { MobileHttpClient } from './http.js';
-import type { IapPlatform, SparkVaultSubscription } from './types.js';
-/** Short-lived Stripe Customer Portal URL for managing the subscription on web. */
-export interface PortalSession {
-    portal_url: string;
-}
+import type { IapPlatform, IapValidation, SparkVaultSubscription } from './types.js';
 export declare class MobileBillingClient {
     private readonly http;
     constructor(http: MobileHttpClient);
     /**
-     * Current subscription: plan, licensed vs. used seats, capacity blocks, live
-     * pool usage, and Identity attempts. Drives the subscription / usage view.
+     * Current subscription: billing lifecycle, licensed vs. used seats, capacity
+     * blocks, live pool usage, and Identity attempts. Drives the subscription /
+     * usage view.
      */
     getSubscription(): Promise<SparkVaultSubscription>;
     /**
-     * Open the Stripe Customer Portal to manage the subscription on web (seat /
-     * block changes that fixed native SKUs cannot carry route here). The caller
-     * loads the returned URL in the WebView.
-     */
-    createPortalSession(): Promise<PortalSession>;
-    /**
-     * Validate a native in-app purchase receipt server-side and apply the
-     * resulting entitlements. Returns the refreshed subscription so the client
-     * can update its plan / usage view immediately after purchase.
+     * Validate a native in-app purchase server-side and apply the entitlements
+     * it buys. `receipt` is the App Store signed transaction (JWS) or the Play
+     * purchase token. Answers whether Core provisioned the purchase; read the
+     * subscription again with getSubscription() to show the change.
      */
-    iapValidate(platform: IapPlatform, productId: string, receipt: string): Promise<SparkVaultSubscription>;
+    iapValidate(platform: IapPlatform, productId: string, receipt: string): Promise<IapValidation>;
 }

package/dist/billing.js

@@ -1,34 +1,31 @@
+import { apiPath } from './request-path.js';
 export class MobileBillingClient {
     constructor(http) {
         this.http = http;
     }
     /**
-     * Current subscription: plan, licensed vs. used seats, capacity blocks, live
-     * pool usage, and Identity attempts. Drives the subscription / usage view.
+     * Current subscription: billing lifecycle, licensed vs. used seats, capacity
+     * blocks, live pool usage, and Identity attempts. Drives the subscription /
+     * usage view.
      */
     async getSubscription() {
-        const response = await this.http.get('/billing/subscription');
+        const response = await this.http.get(apiPath `/billing/subscription`);
         return response.data;
     }
     /**
-     * Open the Stripe Customer Portal to manage the subscription on web (seat /
-     * block changes that fixed native SKUs cannot carry route here). The caller
-     * loads the returned URL in the WebView.
-     */
-    async createPortalSession() {
-        const response = await this.http.post('/billing/portal');
-        return response.data;
-    }
-    /**
-     * Validate a native in-app purchase receipt server-side and apply the
-     * resulting entitlements. Returns the refreshed subscription so the client
-     * can update its plan / usage view immediately after purchase.
+     * Validate a native in-app purchase server-side and apply the entitlements
+     * it buys. `receipt` is the App Store signed transaction (JWS) or the Play
+     * purchase token. Answers whether Core provisioned the purchase; read the
+     * subscription again with getSubscription() to show the change.
      */
     async iapValidate(platform, productId, receipt) {
-        const response = await this.http.post('/billing/iap/validate', {
+        // Core reads an App Store purchase's signed transaction as `receipt` and a
+        // Play purchase's token as `purchase_token`.
+        const credential = platform === 'android' ? { purchase_token: receipt } : { receipt };
+        const response = await this.http.post(apiPath `/billing/iap/validate`, {
             platform,
             product_id: productId,
-            receipt,
+            ...credential,
         });
         return response.data;
     }

package/dist/billing.js.map

@@ -1 +1 @@
-{"version":3,"file":"billing.js","sourceRoot":"","sources":["../src/billing.ts"],"names":[],"mappings":"AAQA,MAAM,OAAO,mBAAmB;IAG9B,YAAY,IAAsB;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe;QACnB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAyB,uBAAuB,CAAC,CAAC;QACtF,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,mBAAmB;QACvB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAgB,iBAAiB,CAAC,CAAC;QACxE,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CACf,QAAqB,EACrB,SAAiB,EACjB,OAAe;QAEf,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAyB,uBAAuB,EAAE;YACrF,QAAQ;YACR,UAAU,EAAE,SAAS;YACrB,OAAO;SACR,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;CACF"}
+{"version":3,"file":"billing.js","sourceRoot":"","sources":["../src/billing.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAE5C,MAAM,OAAO,mBAAmB;IAG9B,YAAY,IAAsB;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe;QACnB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAyB,OAAO,CAAA,uBAAuB,CAAC,CAAC;QAC7F,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CACf,QAAqB,EACrB,SAAiB,EACjB,OAAe;QAEf,2EAA2E;QAC3E,6CAA6C;QAC7C,MAAM,UAAU,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;QACtF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAgB,OAAO,CAAA,uBAAuB,EAAE;YACnF,QAAQ;YACR,UAAU,EAAE,SAAS;YACrB,GAAG,UAAU;SACd,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;CACF"}

package/dist/config.d.ts

@@ -1,4 +1,5 @@
 import type { FetchLike, MobileBackgroundTransfer, MobileBackgroundUploader, MobileFileDownloader, MobileFileReader, SparkVaultLogger, TokenStorageAdapter } from './types.js';
+import { type ApiPath } from './request-path.js';
 export interface SparkVaultMobileConfig {
     tokenStorage: TokenStorageAdapter;
     apiBaseUrl?: string;
@@ -31,6 +32,11 @@ export interface SparkVaultMobileConfig {
      */
     backgroundUploader?: MobileBackgroundUploader;
     logger?: Partial<SparkVaultLogger>;
+    /**
+     * Host allowlist for the backend-issued Forge transfer URLs the SDK sends an
+     * ingot's ISTK to (downloads and uploads alike). Defaults to the SparkVault
+     * platform's own hosts; override only when pointing at another deployment.
+     */
     allowedDownloadHostPatterns?: RegExp[];
 }
 export interface ResolvedMobileConfig {
@@ -53,4 +59,4 @@ export interface ResolvedMobileConfig {
     allowedDownloadHostPatterns: RegExp[];
 }
 export declare function resolveMobileConfig(config: SparkVaultMobileConfig): ResolvedMobileConfig;
-export declare function identityUrl(config: ResolvedMobileConfig, path: string): string;
+export declare function identityUrl(config: ResolvedMobileConfig, path: ApiPath): string;

package/dist/config.js

@@ -1,18 +1,9 @@
 import { SparkVaultValidationError } from './errors.js';
-import { SPARKVAULT_PLATFORM_SV_HOSTS, SPARKVAULT_ROOT_DOMAIN, } from './platform-domains.generated.js';
+import { isResourceIdOf } from './app-sdk/ids.js';
+import { SPARKVAULT_IDENTITY_HOST, SPARKVAULT_OWNED_HOST_PATTERNS } from './app-sdk/platform-domains.js';
+import { apiPath } from './request-path.js';
 const DEFAULT_API_BASE_URL = 'https://api.sparkvault.com/v1';
-const DEFAULT_IDENTITY_BASE_URL = 'https://auth.sparkvault.com';
-function escapeRegExp(value) {
-    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-}
-// Hosts that are allowed to serve backend-issued ingot download URLs, derived
-// from the canonical platform domain registry baked in at build time.
-const DEFAULT_ALLOWED_DOWNLOAD_HOST_PATTERNS = [
-    new RegExp(`(^|\\.)${escapeRegExp(SPARKVAULT_ROOT_DOMAIN)}$`, 'i'),
-    new RegExp(`(^|\\.)(${SPARKVAULT_PLATFORM_SV_HOSTS.map(escapeRegExp).join('|')})$`, 'i'),
-    /\.amazonaws\.com$/i,
-    /\.cloudfront\.net$/i,
-];
+const DEFAULT_IDENTITY_BASE_URL = `https://${SPARKVAULT_IDENTITY_HOST}`;
 const noopLogger = {
     debug: () => undefined,
     info: () => undefined,
@@ -60,8 +51,10 @@ export function resolveMobileConfig(config) {
             received: identityAccountId,
         });
     }
-    if (!identityAccountId.startsWith('acc_')) {
-        throw new SparkVaultValidationError('identityAccountId must start with "acc_"', {
+    // The account id names Identity request paths: the platform's one id
+    // grammar keeps it a single path segment.
+    if (!isResourceIdOf('account', identityAccountId)) {
+        throw new SparkVaultValidationError('identityAccountId must be a SparkVault account id (acc_...)', {
             field: 'identityAccountId',
             received: identityAccountId,
         });
@@ -83,10 +76,10 @@ export function resolveMobileConfig(config) {
         backgroundTransfer: config.backgroundTransfer,
         backgroundUploader: config.backgroundUploader,
         logger: { ...noopLogger, ...config.logger },
-        allowedDownloadHostPatterns: config.allowedDownloadHostPatterns ?? DEFAULT_ALLOWED_DOWNLOAD_HOST_PATTERNS,
+        allowedDownloadHostPatterns: config.allowedDownloadHostPatterns ?? [...SPARKVAULT_OWNED_HOST_PATTERNS],
     };
 }
 export function identityUrl(config, path) {
-    return `${config.identityBaseUrl}/${config.identityAccountId}${path}`;
+    return `${config.identityBaseUrl}${apiPath `/${config.identityAccountId}`}${path}`;
 }
 //# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,GACvB,MAAM,iCAAiC,CAAC;AAWzC,MAAM,oBAAoB,GAAG,+BAA+B,CAAC;AAC7D,MAAM,yBAAyB,GAAG,6BAA6B,CAAC;AAEhE,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED,8EAA8E;AAC9E,sEAAsE;AACtE,MAAM,sCAAsC,GAAa;IACvD,IAAI,MAAM,CAAC,UAAU,YAAY,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,CAAC;IAClE,IAAI,MAAM,CAAC,WAAW,4BAA4B,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC;IACxF,oBAAoB;IACpB,qBAAqB;CACtB,CAAC;AAEF,MAAM,UAAU,GAAqB;IACnC,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS;IACtB,IAAI,EAAE,GAAG,EAAE,CAAC,SAAS;IACrB,IAAI,EAAE,GAAG,EAAE,CAAC,SAAS;IACrB,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS;CACvB,CAAC;AAyDF,SAAS,gBAAgB,CAAC,GAAW,EAAE,KAAa;IAClD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,MAAM,IAAI,yBAAyB,CAAC,GAAG,KAAK,6BAA6B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,YAAY,CACnB,GAAW,EACX,OAA8C;IAE9C,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;QAChC,MAAM,IAAI,yBAAyB,CAAC,oDAAoD,CAAC,CAAC;IAC5F,CAAC;IAED,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;IAC7C,IAAI,CAAC,SAAS,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,yEAAyE;IACzE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC;IACjC,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;YACzB,UAAU,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAA8B;IAChE,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACzB,MAAM,IAAI,yBAAyB,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;IAC7F,CAAC;IAED,MAAM,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAC;IACnD,IAAI,CAAC,iBAAiB,IAAI,OAAO,iBAAiB,KAAK,QAAQ,EAAE,CAAC;QAChE,MAAM,IAAI,yBAAyB,CAAC,+BAA+B,EAAE;YACnE,KAAK,EAAE,mBAAmB;YAC1B,QAAQ,EAAE,iBAAiB;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,yBAAyB,CAAC,0CAA0C,EAAE;YAC9E,KAAK,EAAE,mBAAmB;YAC1B,QAAQ,EAAE,iBAAiB;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,UAAU,EAAE,gBAAgB,CAAC,MAAM,CAAC,UAAU,IAAI,oBAAoB,EAAE,YAAY,CAAC;QACrF,eAAe,EAAE,gBAAgB,CAAC,MAAM,CAAC,eAAe,IAAI,yBAAyB,EAAE,iBAAiB,CAAC;QACzG,iBAAiB;QACjB,qBAAqB,EAAE,MAAM,CAAC,qBAAqB,IAAI,IAAI;QAC3D,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,2BAA2B;QAC1D,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,KAAK;QACpC,qBAAqB,EAAE,MAAM,CAAC,qBAAqB,IAAI,MAAM;QAC7D,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,IAAI,KAAK;QAClD,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,IAAI,MAAM;QACrD,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,YAAY;QACnC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;QAC7C,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;QAC7C,MAAM,EAAE,EAAE,GAAG,UAAU,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE;QAC3C,2BAA2B,EAAE,MAAM,CAAC,2BAA2B,IAAI,sCAAsC;KAC1G,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,MAA4B,EAAE,IAAY;IACpE,OAAO,GAAG,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,iBAAiB,GAAG,IAAI,EAAE,CAAC;AACxE,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,wBAAwB,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAUzG,OAAO,EAAE,OAAO,EAAgB,MAAM,mBAAmB,CAAC;AAE1D,MAAM,oBAAoB,GAAG,+BAA+B,CAAC;AAC7D,MAAM,yBAAyB,GAAG,WAAW,wBAAwB,EAAE,CAAC;AAExE,MAAM,UAAU,GAAqB;IACnC,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS;IACtB,IAAI,EAAE,GAAG,EAAE,CAAC,SAAS;IACrB,IAAI,EAAE,GAAG,EAAE,CAAC,SAAS;IACrB,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS;CACvB,CAAC;AA8DF,SAAS,gBAAgB,CAAC,GAAW,EAAE,KAAa;IAClD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,MAAM,IAAI,yBAAyB,CAAC,GAAG,KAAK,6BAA6B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,YAAY,CACnB,GAAW,EACX,OAA8C;IAE9C,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;QAChC,MAAM,IAAI,yBAAyB,CAAC,oDAAoD,CAAC,CAAC;IAC5F,CAAC;IAED,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;IAC7C,IAAI,CAAC,SAAS,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,yEAAyE;IACzE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC;IACjC,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;YACzB,UAAU,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAA8B;IAChE,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACzB,MAAM,IAAI,yBAAyB,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;IAC7F,CAAC;IAED,MAAM,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAC;IACnD,IAAI,CAAC,iBAAiB,IAAI,OAAO,iBAAiB,KAAK,QAAQ,EAAE,CAAC;QAChE,MAAM,IAAI,yBAAyB,CAAC,+BAA+B,EAAE;YACnE,KAAK,EAAE,mBAAmB;YAC1B,QAAQ,EAAE,iBAAiB;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,qEAAqE;IACrE,0CAA0C;IAC1C,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,iBAAiB,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,yBAAyB,CAAC,6DAA6D,EAAE;YACjG,KAAK,EAAE,mBAAmB;YAC1B,QAAQ,EAAE,iBAAiB;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,UAAU,EAAE,gBAAgB,CAAC,MAAM,CAAC,UAAU,IAAI,oBAAoB,EAAE,YAAY,CAAC;QACrF,eAAe,EAAE,gBAAgB,CAAC,MAAM,CAAC,eAAe,IAAI,yBAAyB,EAAE,iBAAiB,CAAC;QACzG,iBAAiB;QACjB,qBAAqB,EAAE,MAAM,CAAC,qBAAqB,IAAI,IAAI;QAC3D,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,2BAA2B;QAC1D,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,KAAK;QACpC,qBAAqB,EAAE,MAAM,CAAC,qBAAqB,IAAI,MAAM;QAC7D,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,IAAI,KAAK;QAClD,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,IAAI,MAAM;QACrD,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,YAAY;QACnC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;QAC7C,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;QAC7C,MAAM,EAAE,EAAE,GAAG,UAAU,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE;QAC3C,2BAA2B,EAAE,MAAM,CAAC,2BAA2B,IAAI,CAAC,GAAG,8BAA8B,CAAC;KACvG,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,MAA4B,EAAE,IAAa;IACrE,OAAO,GAAG,MAAM,CAAC,eAAe,GAAG,OAAO,CAAA,IAAI,MAAM,CAAC,iBAAiB,EAAE,GAAG,IAAI,EAAE,CAAC;AACpF,CAAC"}

package/dist/encoding.d.ts

@@ -1,7 +1,33 @@
+/**
+ * Base64 and UTF-8 for the mobile SDK.
+ *
+ * The base64 codec is the platform's one copy, mirrored from
+ * `@sparkvault/app-sdk/encoding` into `./app-sdk/encoding.js`; the decoders here
+ * raise this SDK's validation error where that codec refuses a text. UTF-8 is
+ * converted here rather than with TextEncoder/TextDecoder, which the JavaScript
+ * engines of the React Native versions this SDK supports need not provide.
+ * Decoding UTF-8 is fatal: bytes that are not UTF-8 are refused, never read as
+ * invented characters.
+ */
+import { bytesToBase64, bytesToBase64url } from './app-sdk/encoding.js';
+export { bytesToBase64, bytesToBase64url };
+/**
+ * Decode standard base64.
+ * @throws SparkVaultValidationError when the text is not base64
+ */
+export declare function base64ToBytes(value: string): Uint8Array;
+/**
+ * Decode base64url.
+ * @throws SparkVaultValidationError when the text is not base64url
+ */
+export declare function base64UrlToBytes(value: string): Uint8Array;
 export declare function utf8ToBytes(value: string): Uint8Array;
-export declare function base64EncodeUtf8(value: string): string;
+/**
+ * Decode UTF-8 by the WHATWG decoder's rules in fatal mode: a byte that cannot
+ * start a sequence, a sequence cut short, an overlong form, a surrogate or a
+ * code point past U+10FFFF refuses the whole input.
+ * @throws SparkVaultValidationError when the bytes are not UTF-8
+ */
 export declare function bytesToUtf8(bytes: Uint8Array): string;
-export declare function base64UrlToBytes(value: string): Uint8Array;
+export declare function base64EncodeUtf8(value: string): string;
 export declare function base64UrlToUtf8(value: string): string;
-export declare function bytesToBase64(bytes: Uint8Array): string;
-export declare function base64ToBytes(value: string): Uint8Array;

package/dist/encoding.js

@@ -1,5 +1,39 @@
-const BASE64_ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
-const BASE64_LOOKUP = new Map(Array.from(BASE64_ALPHABET).map((char, index) => [char, index]));
+/**
+ * Base64 and UTF-8 for the mobile SDK.
+ *
+ * The base64 codec is the platform's one copy, mirrored from
+ * `@sparkvault/app-sdk/encoding` into `./app-sdk/encoding.js`; the decoders here
+ * raise this SDK's validation error where that codec refuses a text. UTF-8 is
+ * converted here rather than with TextEncoder/TextDecoder, which the JavaScript
+ * engines of the React Native versions this SDK supports need not provide.
+ * Decoding UTF-8 is fatal: bytes that are not UTF-8 are refused, never read as
+ * invented characters.
+ */
+import { base64ToBytes as decodeBase64, base64urlToBytes as decodeBase64url, bytesToBase64, bytesToBase64url, } from './app-sdk/encoding.js';
+import { SparkVaultValidationError } from './errors.js';
+export { bytesToBase64, bytesToBase64url };
+/**
+ * Decode standard base64.
+ * @throws SparkVaultValidationError when the text is not base64
+ */
+export function base64ToBytes(value) {
+    const bytes = decodeBase64(value);
+    if (bytes === null) {
+        throw new SparkVaultValidationError('Invalid base64 input');
+    }
+    return bytes;
+}
+/**
+ * Decode base64url.
+ * @throws SparkVaultValidationError when the text is not base64url
+ */
+export function base64UrlToBytes(value) {
+    const bytes = decodeBase64url(value);
+    if (bytes === null) {
+        throw new SparkVaultValidationError('Invalid base64url input');
+    }
+    return bytes;
+}
 export function utf8ToBytes(value) {
     const bytes = [];
     for (let i = 0; i < value.length; i++) {
@@ -26,98 +60,70 @@ export function utf8ToBytes(value) {
     }
     return new Uint8Array(bytes);
 }
-export function base64EncodeUtf8(value) {
-    return bytesToBase64(utf8ToBytes(value));
-}
+/**
+ * Decode UTF-8 by the WHATWG decoder's rules in fatal mode: a byte that cannot
+ * start a sequence, a sequence cut short, an overlong form, a surrogate or a
+ * code point past U+10FFFF refuses the whole input.
+ * @throws SparkVaultValidationError when the bytes are not UTF-8
+ */
 export function bytesToUtf8(bytes) {
     let output = '';
-    let i = 0;
-    while (i < bytes.length) {
-        const byte1 = bytes[i++];
-        if (byte1 < 0x80) {
-            output += String.fromCharCode(byte1);
+    let index = 0;
+    while (index < bytes.length) {
+        const lead = bytes[index++];
+        if (lead < 0x80) {
+            output += String.fromCharCode(lead);
             continue;
         }
-        if (byte1 >= 0xc0 && byte1 < 0xe0) {
-            const byte2 = bytes[i++];
-            output += String.fromCharCode(((byte1 & 0x1f) << 6) | (byte2 & 0x3f));
-            continue;
+        // The first continuation byte's range is what excludes overlong forms,
+        // surrogates and code points past U+10FFFF.
+        let continuations;
+        let codePoint;
+        let lower = 0x80;
+        let upper = 0xbf;
+        if (lead >= 0xc2 && lead <= 0xdf) {
+            continuations = 1;
+            codePoint = lead & 0x1f;
         }
-        if (byte1 >= 0xe0 && byte1 < 0xf0) {
-            const byte2 = bytes[i++];
-            const byte3 = bytes[i++];
-            output += String.fromCharCode(((byte1 & 0x0f) << 12) |
-                ((byte2 & 0x3f) << 6) |
-                (byte3 & 0x3f));
-            continue;
+        else if (lead >= 0xe0 && lead <= 0xef) {
+            continuations = 2;
+            codePoint = lead & 0x0f;
+            if (lead === 0xe0)
+                lower = 0xa0;
+            if (lead === 0xed)
+                upper = 0x9f;
         }
-        const byte2 = bytes[i++];
-        const byte3 = bytes[i++];
-        const byte4 = bytes[i++];
-        const codePoint = (((byte1 & 0x07) << 18) |
-            ((byte2 & 0x3f) << 12) |
-            ((byte3 & 0x3f) << 6) |
-            (byte4 & 0x3f)) - 0x10000;
-        output += String.fromCharCode(0xd800 + (codePoint >> 10), 0xdc00 + (codePoint & 0x3ff));
+        else if (lead >= 0xf0 && lead <= 0xf4) {
+            continuations = 3;
+            codePoint = lead & 0x07;
+            if (lead === 0xf0)
+                lower = 0x90;
+            if (lead === 0xf4)
+                upper = 0x8f;
+        }
+        else {
+            throw new SparkVaultValidationError('Invalid UTF-8 input');
+        }
+        for (let seen = 0; seen < continuations; seen++) {
+            if (index >= bytes.length) {
+                throw new SparkVaultValidationError('Invalid UTF-8 input');
+            }
+            const next = bytes[index++];
+            if (next < lower || next > upper) {
+                throw new SparkVaultValidationError('Invalid UTF-8 input');
+            }
+            lower = 0x80;
+            upper = 0xbf;
+            codePoint = (codePoint << 6) | (next & 0x3f);
+        }
+        output += String.fromCodePoint(codePoint);
     }
     return output;
 }
-export function base64UrlToBytes(value) {
-    return base64ToBytes(value);
+export function base64EncodeUtf8(value) {
+    return bytesToBase64(utf8ToBytes(value));
 }
 export function base64UrlToUtf8(value) {
     return bytesToUtf8(base64UrlToBytes(value));
 }
-export function bytesToBase64(bytes) {
-    let output = '';
-    for (let i = 0; i < bytes.length; i += 3) {
-        const byte1 = bytes[i];
-        const byte2 = bytes[i + 1] ?? 0;
-        const byte3 = bytes[i + 2] ?? 0;
-        const triplet = (byte1 << 16) | (byte2 << 8) | byte3;
-        output += BASE64_ALPHABET[(triplet >> 18) & 0x3f];
-        output += BASE64_ALPHABET[(triplet >> 12) & 0x3f];
-        output += i + 1 < bytes.length ? BASE64_ALPHABET[(triplet >> 6) & 0x3f] : '=';
-        output += i + 2 < bytes.length ? BASE64_ALPHABET[triplet & 0x3f] : '=';
-    }
-    return output;
-}
-export function base64ToBytes(value) {
-    const sanitized = value.replace(/\s/g, '').replace(/-/g, '+').replace(/_/g, '/');
-    if (sanitized.length % 4 === 1) {
-        throw new Error('Invalid base64 input');
-    }
-    const padded = sanitized.padEnd(Math.ceil(sanitized.length / 4) * 4, '=');
-    // Preallocate the exact output size: 3 bytes per quartet, minus one byte per
-    // '=' (a '=' in quartet positions 1-2 throws below, so counting every '=' is
-    // safe). Multi-megabyte upload chunks decode through here, so per-byte array
-    // growth is not acceptable.
-    let paddingCount = 0;
-    for (let i = 0; i < padded.length; i++) {
-        if (padded[i] === '=')
-            paddingCount++;
-    }
-    const bytes = new Uint8Array((padded.length / 4) * 3 - paddingCount);
-    let outIndex = 0;
-    for (let i = 0; i < padded.length; i += 4) {
-        const c1 = padded[i];
-        const c2 = padded[i + 1];
-        const c3 = padded[i + 2];
-        const c4 = padded[i + 3];
-        const v1 = BASE64_LOOKUP.get(c1);
-        const v2 = BASE64_LOOKUP.get(c2);
-        const v3 = c3 === '=' ? 0 : BASE64_LOOKUP.get(c3);
-        const v4 = c4 === '=' ? 0 : BASE64_LOOKUP.get(c4);
-        if (v1 === undefined || v2 === undefined || v3 === undefined || v4 === undefined) {
-            throw new Error('Invalid base64 input');
-        }
-        const triplet = (v1 << 18) | (v2 << 12) | (v3 << 6) | v4;
-        bytes[outIndex++] = (triplet >> 16) & 0xff;
-        if (c3 !== '=')
-            bytes[outIndex++] = (triplet >> 8) & 0xff;
-        if (c4 !== '=')
-            bytes[outIndex++] = triplet & 0xff;
-    }
-    return bytes;
-}
 //# sourceMappingURL=encoding.js.map