handsontable 18.0.0 → 18.1.0-rc7

package/utils/entitlementLicenseKey/classify.mjs

@@ -0,0 +1,96 @@
+import { parseIsoDateToTimestamp } from './encoding.mjs';
+import { TRIAL_FLAG, NO_CONSOLE_WARNS_FLAG, NO_UI_WARNS_FLAG, MILLISECONDS_PER_DAY } from './constants.mjs';
+/**
+ * The UTC midnight of the day an instant falls on. Every window boundary is a
+ * UTC midnight, so both sides of every comparison are snapped to one - the
+ * local calendar, the locale and DST are inputs the classification must not
+ * read at all.
+ *
+ * @param {number} timestamp The instant, in epoch milliseconds.
+ * @returns {number}
+ */ function utcMidnightOf(timestamp) {
+    return Math.floor(timestamp / MILLISECONDS_PER_DAY) * MILLISECONDS_PER_DAY;
+}
+/**
+ * Whole UTC days from today until the last licensed day. `0` on the last
+ * licensed day (which is still licensed in full) and negative once it has
+ * passed. Both sides are UTC midnights, so the count is a whole number of
+ * calendar days and never a rounded fraction.
+ *
+ * @param {number} expiryTimestamp The UTC midnight of the last licensed day.
+ * @param {number} now The current instant, in epoch milliseconds.
+ * @returns {number}
+ */ function daysUntil(expiryTimestamp, now) {
+    return (expiryTimestamp - utcMidnightOf(now)) / MILLISECONDS_PER_DAY;
+}
+/**
+ * Places a `usage_until` license in its window.
+ *
+ * The named day is licensed in full: the license runs until the UTC midnight
+ * that FOLLOWS it, and the grace period is measured from there. A `notice` of
+ * `0` means no advance warning at all, so the notice window is empty rather
+ * than one day long.
+ *
+ * @param {number} expiryTimestamp The UTC midnight of the last licensed day.
+ * @param {ProductEntitlement} entitlement The product entry the windows come from.
+ * @param {number} now The current instant, in epoch milliseconds.
+ * @returns {UsageWindow}
+ */ function resolveUsageWindow(expiryTimestamp, entitlement, now) {
+    const expiryBoundary = expiryTimestamp + MILLISECONDS_PER_DAY;
+    if (now >= expiryBoundary) {
+        return now < expiryBoundary + entitlement.grace * MILLISECONDS_PER_DAY ? 'soft_stop' : 'hard_stop';
+    }
+    const daysRemaining = daysUntil(expiryTimestamp, now);
+    return entitlement.notice > 0 && daysRemaining <= entitlement.notice ? 'notice' : 'valid';
+}
+/**
+ * Classifies one product entitlement into its lifecycle facet.
+ *
+ * Which of the two dates the entry carries decides how it is measured; the
+ * `trial` flag decides only what the user is told. Nothing here branches on a
+ * contract type, because the payload does not carry one.
+ *
+ * @param {ProductEntitlement} entitlement The verified product entry.
+ * @param {LicenseTimeReference} time The time references to measure against.
+ * @returns {LicenseLifecycle}
+ */ export function classifyEntitlement(entitlement, time) {
+    const isTrial = entitlement.flags.indexOf(TRIAL_FLAG) !== -1;
+    if (entitlement.release_until !== undefined) {
+        const releaseUntil = entitlement.release_until;
+        // Fail OPEN when the build release date is unavailable (a bundler consuming the source without
+        // the build-time define step, a broken build): a paying customer must never be told their
+        // license lapsed because of a build defect. The legacy path stays valid in the same
+        // environment.
+        const covered = releaseUntil >= time.buildDate || parseIsoDateToTimestamp(time.buildDate) === null;
+        return {
+            state: covered ? 'release_valid' : 'release_expired',
+            isTrial,
+            daysRemaining: null,
+            licensedUntil: releaseUntil
+        };
+    }
+    const usageUntil = `${entitlement.usage_until}`;
+    // Verified at read time, so the date always parses here; the fallback only keeps the arithmetic
+    // finite if this is ever called with an unverified entry.
+    const expiryTimestamp = parseIsoDateToTimestamp(usageUntil) ?? utcMidnightOf(time.now);
+    const window = resolveUsageWindow(expiryTimestamp, entitlement, time.now);
+    return {
+        state: `${isTrial ? 'trial' : 'usage'}_${window}`,
+        isTrial,
+        daysRemaining: daysUntil(expiryTimestamp, time.now),
+        licensedUntil: usageUntil
+    };
+}
+/**
+ * Reads which notification channels a product entitlement leaves open. Both
+ * flags are per product and default to open; a key issued for external,
+ * end-user-facing use carries both.
+ *
+ * @param {ProductEntitlement} entitlement The verified product entry.
+ * @returns {LicenseChannels}
+ */ export function resolveChannels(entitlement) {
+    return {
+        console: entitlement.flags.indexOf(NO_CONSOLE_WARNS_FLAG) === -1,
+        ui: entitlement.flags.indexOf(NO_UI_WARNS_FLAG) === -1
+    };
+}

package/utils/entitlementLicenseKey/constants.d.mts

@@ -0,0 +1 @@
+export * from './constants.js';

package/utils/entitlementLicenseKey/constants.d.ts

@@ -0,0 +1,69 @@
+/**
+ * The length of the checksum (SHA-512 as hex) that closes the machine-readable
+ * block of every entitlement license key.
+ *
+ * @type {number}
+ */
+export declare const CHECKSUM_LENGTH = 128;
+/**
+ * The two mutually exclusive date fields of a product entry. Exactly one of
+ * them is present:
+ *
+ *   - "usage_until"   the last licensed day (inclusive, compared in UTC),
+ *   - "release_until" builds released on or before that day may be used
+ *                     forever (compared against the build release date as
+ *                     text, no clock involved).
+ *
+ * The pair replaces the contract type - nothing in the payload says
+ * "subscription" or "perpetual".
+ *
+ * @type {string[]}
+ */
+export declare const DATE_FIELDS: string[];
+/**
+ * The name of the product this build reads its own license from. A key that
+ * does not grant it is not a Handsontable license, however many other products
+ * it grants. Product names are append-only - renaming one silently drops the
+ * entitlement it used to carry.
+ *
+ * @type {string}
+ */
+export declare const HANDSONTABLE_PRODUCT = "handsontable";
+/**
+ * The capability tokens this build understands. The key asserts an entitlement;
+ * what a token unlocks is defined here, never in the key. Unknown tokens are
+ * ignored, so a token added on the issuing side cannot break a build already in
+ * the field.
+ *
+ * @type {string[]}
+ */
+export declare const KNOWN_CAPABILITIES: string[];
+/**
+ * Marks a license as an evaluation one. A flag is present or absent - there is
+ * no `false` value - and an unrecognized flag is ignored, for the same reason
+ * an unrecognized capability token is.
+ *
+ * @type {string}
+ */
+export declare const TRIAL_FLAG = "trial";
+/**
+ * Closes the console channel: nothing this module has to say reaches it.
+ *
+ * @type {string}
+ */
+export declare const NO_CONSOLE_WARNS_FLAG = "no-console-warns";
+/**
+ * Closes the UI channel: no badge, no bar, no lock screen. Both this flag and
+ * the one above are the default for a key issued for external, end-user-facing
+ * use.
+ *
+ * @type {string}
+ */
+export declare const NO_UI_WARNS_FLAG = "no-ui-warns";
+/**
+ * The number of milliseconds in a day, used to walk from one UTC midnight to
+ * the next.
+ *
+ * @type {number}
+ */
+export declare const MILLISECONDS_PER_DAY = 86400000;

package/utils/entitlementLicenseKey/constants.js

@@ -0,0 +1,54 @@
+/**
+ * The length of the checksum (SHA-512 as hex) that closes the machine-readable
+ * block of every entitlement license key.
+ *
+ * @type {number}
+ */ "use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+function _export(target, all) {
+    for(var name in all)Object.defineProperty(target, name, {
+        enumerable: true,
+        get: Object.getOwnPropertyDescriptor(all, name).get
+    });
+}
+_export(exports, {
+    get CHECKSUM_LENGTH () {
+        return CHECKSUM_LENGTH;
+    },
+    get DATE_FIELDS () {
+        return DATE_FIELDS;
+    },
+    get HANDSONTABLE_PRODUCT () {
+        return HANDSONTABLE_PRODUCT;
+    },
+    get KNOWN_CAPABILITIES () {
+        return KNOWN_CAPABILITIES;
+    },
+    get MILLISECONDS_PER_DAY () {
+        return MILLISECONDS_PER_DAY;
+    },
+    get NO_CONSOLE_WARNS_FLAG () {
+        return NO_CONSOLE_WARNS_FLAG;
+    },
+    get NO_UI_WARNS_FLAG () {
+        return NO_UI_WARNS_FLAG;
+    },
+    get TRIAL_FLAG () {
+        return TRIAL_FLAG;
+    }
+});
+const CHECKSUM_LENGTH = 128;
+const DATE_FIELDS = [
+    'usage_until',
+    'release_until'
+];
+const HANDSONTABLE_PRODUCT = 'handsontable';
+const KNOWN_CAPABILITIES = [
+    'core'
+];
+const TRIAL_FLAG = 'trial';
+const NO_CONSOLE_WARNS_FLAG = 'no-console-warns';
+const NO_UI_WARNS_FLAG = 'no-ui-warns';
+const MILLISECONDS_PER_DAY = 86400000;

package/utils/entitlementLicenseKey/constants.mjs

@@ -0,0 +1,66 @@
+/**
+ * The length of the checksum (SHA-512 as hex) that closes the machine-readable
+ * block of every entitlement license key.
+ *
+ * @type {number}
+ */ export const CHECKSUM_LENGTH = 128;
+/**
+ * The two mutually exclusive date fields of a product entry. Exactly one of
+ * them is present:
+ *
+ *   - "usage_until"   the last licensed day (inclusive, compared in UTC),
+ *   - "release_until" builds released on or before that day may be used
+ *                     forever (compared against the build release date as
+ *                     text, no clock involved).
+ *
+ * The pair replaces the contract type - nothing in the payload says
+ * "subscription" or "perpetual".
+ *
+ * @type {string[]}
+ */ export const DATE_FIELDS = [
+    'usage_until',
+    'release_until'
+];
+/**
+ * The name of the product this build reads its own license from. A key that
+ * does not grant it is not a Handsontable license, however many other products
+ * it grants. Product names are append-only - renaming one silently drops the
+ * entitlement it used to carry.
+ *
+ * @type {string}
+ */ export const HANDSONTABLE_PRODUCT = 'handsontable';
+/**
+ * The capability tokens this build understands. The key asserts an entitlement;
+ * what a token unlocks is defined here, never in the key. Unknown tokens are
+ * ignored, so a token added on the issuing side cannot break a build already in
+ * the field.
+ *
+ * @type {string[]}
+ */ export const KNOWN_CAPABILITIES = [
+    'core'
+];
+/**
+ * Marks a license as an evaluation one. A flag is present or absent - there is
+ * no `false` value - and an unrecognized flag is ignored, for the same reason
+ * an unrecognized capability token is.
+ *
+ * @type {string}
+ */ export const TRIAL_FLAG = 'trial';
+/**
+ * Closes the console channel: nothing this module has to say reaches it.
+ *
+ * @type {string}
+ */ export const NO_CONSOLE_WARNS_FLAG = 'no-console-warns';
+/**
+ * Closes the UI channel: no badge, no bar, no lock screen. Both this flag and
+ * the one above are the default for a key issued for external, end-user-facing
+ * use.
+ *
+ * @type {string}
+ */ export const NO_UI_WARNS_FLAG = 'no-ui-warns';
+/**
+ * The number of milliseconds in a day, used to walk from one UTC midnight to
+ * the next.
+ *
+ * @type {number}
+ */ export const MILLISECONDS_PER_DAY = 86400000;

package/utils/entitlementLicenseKey/detectFormat.d.mts

@@ -0,0 +1 @@
+export * from './detectFormat.js';

package/utils/entitlementLicenseKey/detectFormat.d.ts

@@ -0,0 +1,23 @@
+import type { LicenseKeyFormat } from './types';
+/**
+ * Tells which format a license key is in, without validating it. The
+ * entitlement key carries no leading tag - it starts with prose and ends with
+ * the bracketed machine-readable block - so the formats have to be told apart
+ * in one place, and this is it.
+ *
+ * The answer is about SHAPE only. An "entitlement" result means "read this with
+ * the entitlement reader", not "this key is valid".
+ *
+ * @param {string} licenseKey The license key to inspect.
+ * @returns {LicenseKeyFormat}
+ */
+export declare function detectLicenseKeyFormat(licenseKey: unknown): LicenseKeyFormat;
+/**
+ * Tells whether a license key has the shape of an entitlement key. This is the
+ * cheap routing test taken before any parsing - a legacy key pays two string
+ * scans for it.
+ *
+ * @param {string} licenseKey The license key to test.
+ * @returns {boolean}
+ */
+export declare function isEntitlementKey(licenseKey: unknown): boolean;

package/utils/entitlementLicenseKey/detectFormat.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+function _export(target, all) {
+    for(var name in all)Object.defineProperty(target, name, {
+        enumerable: true,
+        get: Object.getOwnPropertyDescriptor(all, name).get
+    });
+}
+_export(exports, {
+    get detectLicenseKeyFormat () {
+        return detectLicenseKeyFormat;
+    },
+    get isEntitlementKey () {
+        return isEntitlementKey;
+    }
+});
+/**
+ * The literal keys that stand for a license rather than encode one.
+ *
+ * Only formats Handsontable itself honors belong here. `gpl-v3` is deliberately absent: the
+ * specification lists it among the unchanged legacy keys, but that list covers HyperFormula too and
+ * nothing in this library has ever recognized it - the frozen validator rejects it like any other
+ * unknown string. Naming it here advertised support that does not exist, and since an unreadable key
+ * now blocks the grid, a reader who trusted the table would ship a blocked grid.
+ *
+ * @type {Record<string, LicenseKeyFormat>}
+ */ const LITERAL_KEYS = {
+    'non-commercial-and-evaluation': 'non-commercial-and-evaluation'
+};
+/**
+ * The classic 25-character key, once its dashes are stripped.
+ *
+ * @type {RegExp}
+ */ const LEGACY_KEY = /^[0-9a-fA-F]{25}$/;
+function detectLicenseKeyFormat(licenseKey) {
+    if (typeof licenseKey !== 'string') {
+        return 'unknown';
+    }
+    const key = licenseKey.trim();
+    const literalKey = key.toLowerCase();
+    if (Object.prototype.hasOwnProperty.call(LITERAL_KEYS, literalKey)) {
+        return LITERAL_KEYS[literalKey];
+    }
+    // The bracketed block closes an entitlement key. Its presence is what
+    // separates the new format from everything else, so it is checked before the
+    // shape-based ones.
+    const blockStart = key.lastIndexOf('[');
+    if (blockStart !== -1 && key.indexOf(']', blockStart) !== -1) {
+        return 'entitlement';
+    }
+    if (LEGACY_KEY.test(key.replace(/-/g, ''))) {
+        return 'legacy';
+    }
+    return 'unknown';
+}
+function isEntitlementKey(licenseKey) {
+    return detectLicenseKeyFormat(licenseKey) === 'entitlement';
+}

package/utils/entitlementLicenseKey/detectFormat.mjs

@@ -0,0 +1,60 @@
+/**
+ * The literal keys that stand for a license rather than encode one.
+ *
+ * Only formats Handsontable itself honors belong here. `gpl-v3` is deliberately absent: the
+ * specification lists it among the unchanged legacy keys, but that list covers HyperFormula too and
+ * nothing in this library has ever recognized it - the frozen validator rejects it like any other
+ * unknown string. Naming it here advertised support that does not exist, and since an unreadable key
+ * now blocks the grid, a reader who trusted the table would ship a blocked grid.
+ *
+ * @type {Record<string, LicenseKeyFormat>}
+ */ const LITERAL_KEYS = {
+    'non-commercial-and-evaluation': 'non-commercial-and-evaluation'
+};
+/**
+ * The classic 25-character key, once its dashes are stripped.
+ *
+ * @type {RegExp}
+ */ const LEGACY_KEY = /^[0-9a-fA-F]{25}$/;
+/**
+ * Tells which format a license key is in, without validating it. The
+ * entitlement key carries no leading tag - it starts with prose and ends with
+ * the bracketed machine-readable block - so the formats have to be told apart
+ * in one place, and this is it.
+ *
+ * The answer is about SHAPE only. An "entitlement" result means "read this with
+ * the entitlement reader", not "this key is valid".
+ *
+ * @param {string} licenseKey The license key to inspect.
+ * @returns {LicenseKeyFormat}
+ */ export function detectLicenseKeyFormat(licenseKey) {
+    if (typeof licenseKey !== 'string') {
+        return 'unknown';
+    }
+    const key = licenseKey.trim();
+    const literalKey = key.toLowerCase();
+    if (Object.prototype.hasOwnProperty.call(LITERAL_KEYS, literalKey)) {
+        return LITERAL_KEYS[literalKey];
+    }
+    // The bracketed block closes an entitlement key. Its presence is what
+    // separates the new format from everything else, so it is checked before the
+    // shape-based ones.
+    const blockStart = key.lastIndexOf('[');
+    if (blockStart !== -1 && key.indexOf(']', blockStart) !== -1) {
+        return 'entitlement';
+    }
+    if (LEGACY_KEY.test(key.replace(/-/g, ''))) {
+        return 'legacy';
+    }
+    return 'unknown';
+}
+/**
+ * Tells whether a license key has the shape of an entitlement key. This is the
+ * cheap routing test taken before any parsing - a legacy key pays two string
+ * scans for it.
+ *
+ * @param {string} licenseKey The license key to test.
+ * @returns {boolean}
+ */ export function isEntitlementKey(licenseKey) {
+    return detectLicenseKeyFormat(licenseKey) === 'entitlement';
+}

package/utils/entitlementLicenseKey/encoding.d.mts

@@ -0,0 +1 @@
+export * from './encoding.js';

package/utils/entitlementLicenseKey/encoding.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Encodes the string as UTF-8 bytes. The plain implementation is used on purpose.
+ * It does not depend on `TextEncoder` or `Buffer`, so the same code works in
+ * Node.js and in every browser, including plain http:// pages.
+ *
+ * @param {string} string The string to encode.
+ * @returns {number[]}
+ */
+export declare function stringToUtf8Bytes(string: string): number[];
+/**
+ * Decodes UTF-8 bytes back into a string.
+ *
+ * @param {number[]} bytes The bytes to decode.
+ * @returns {string}
+ */
+export declare function utf8BytesToString(bytes: number[]): string;
+/**
+ * Encodes the bytes as a base64 string (standard alphabet, with padding).
+ *
+ * @param {number[]} bytes The bytes to encode.
+ * @returns {string}
+ */
+export declare function bytesToBase64(bytes: number[]): string;
+/**
+ * Decodes a base64 string (standard or URL-safe alphabet, padding optional)
+ * back into bytes. Returns `null` when the string is not valid base64.
+ *
+ * @param {string} base64 The base64 string to decode.
+ * @returns {number[]|null}
+ */
+export declare function base64ToBytes(base64: string): number[] | null;
+/**
+ * Encodes the string as a URL-safe base64 string without padding (the same
+ * format as the JWT payload segment).
+ *
+ * @param {string} string The string to encode.
+ * @returns {string}
+ */
+export declare function stringToBase64Url(string: string): string;
+/**
+ * Decodes a base64 (standard or URL-safe) string back into a string.
+ * Returns `null` when the input is not valid base64.
+ *
+ * @param {string} base64 The base64 string to decode.
+ * @returns {string|null}
+ */
+export declare function base64ToString(base64: string): string | null;
+/**
+ * Parses a date in the "YYYY-MM-DD" format into the epoch milliseconds of its
+ * UTC midnight. Returns `null` when the date is malformed or does not exist in
+ * the calendar (for example "2027-02-30"). Unlike the generator side, the
+ * reader never throws on a bad date - a broken payload simply makes the key
+ * unreadable.
+ *
+ * @param {string} isoDate The date to parse.
+ * @returns {number|null}
+ */
+export declare function parseIsoDateToTimestamp(isoDate: string): number | null;

package/utils/entitlementLicenseKey/encoding.js

@@ -0,0 +1,161 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+function _export(target, all) {
+    for(var name in all)Object.defineProperty(target, name, {
+        enumerable: true,
+        get: Object.getOwnPropertyDescriptor(all, name).get
+    });
+}
+_export(exports, {
+    get base64ToBytes () {
+        return base64ToBytes;
+    },
+    get base64ToString () {
+        return base64ToString;
+    },
+    get bytesToBase64 () {
+        return bytesToBase64;
+    },
+    get parseIsoDateToTimestamp () {
+        return parseIsoDateToTimestamp;
+    },
+    get stringToBase64Url () {
+        return stringToBase64Url;
+    },
+    get stringToUtf8Bytes () {
+        return stringToUtf8Bytes;
+    },
+    get utf8BytesToString () {
+        return utf8BytesToString;
+    }
+});
+/* eslint-disable no-bitwise */ /**
+ * The base64 alphabet.
+ *
+ * @type {string}
+ */ const BASE64_ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
+function stringToUtf8Bytes(string) {
+    const bytes = [];
+    for(let i = 0; i < string.length; i += 1){
+        let codePoint = string.charCodeAt(i);
+        // Combine a surrogate pair into a single code point.
+        if (codePoint >= 0xd800 && codePoint <= 0xdbff && i + 1 < string.length) {
+            const lowSurrogate = string.charCodeAt(i + 1);
+            if (lowSurrogate >= 0xdc00 && lowSurrogate <= 0xdfff) {
+                codePoint = (codePoint - 0xd800) * 0x400 + (lowSurrogate - 0xdc00) + 0x10000;
+                i += 1;
+            }
+        }
+        if (codePoint < 0x80) {
+            bytes.push(codePoint);
+        } else if (codePoint < 0x800) {
+            bytes.push(0xc0 | codePoint >> 6, 0x80 | codePoint & 0x3f);
+        } else if (codePoint < 0x10000) {
+            bytes.push(0xe0 | codePoint >> 12, 0x80 | codePoint >> 6 & 0x3f, 0x80 | codePoint & 0x3f);
+        } else {
+            bytes.push(0xf0 | codePoint >> 18, 0x80 | codePoint >> 12 & 0x3f, 0x80 | codePoint >> 6 & 0x3f, 0x80 | codePoint & 0x3f);
+        }
+    }
+    return bytes;
+}
+function utf8BytesToString(bytes) {
+    let string = '';
+    let i = 0;
+    while(i < bytes.length){
+        const byte = bytes[i];
+        let codePoint;
+        if (byte < 0x80) {
+            codePoint = byte;
+            i += 1;
+        } else if (byte < 0xe0) {
+            codePoint = (byte & 0x1f) << 6 | bytes[i + 1] & 0x3f;
+            i += 2;
+        } else if (byte < 0xf0) {
+            codePoint = (byte & 0x0f) << 12 | (bytes[i + 1] & 0x3f) << 6 | bytes[i + 2] & 0x3f;
+            i += 3;
+        } else {
+            codePoint = (byte & 0x07) << 18 | (bytes[i + 1] & 0x3f) << 12 | (bytes[i + 2] & 0x3f) << 6 | bytes[i + 3] & 0x3f;
+            i += 4;
+        }
+        if (codePoint >= 0x10000) {
+            // Split the code point back into a surrogate pair.
+            codePoint -= 0x10000;
+            string += String.fromCharCode(0xd800 + (codePoint >> 10), 0xdc00 + (codePoint & 0x3ff));
+        } else {
+            string += String.fromCharCode(codePoint);
+        }
+    }
+    return string;
+}
+function bytesToBase64(bytes) {
+    let base64 = '';
+    for(let i = 0; i < bytes.length; i += 3){
+        const byte1 = bytes[i];
+        const byte2 = bytes[i + 1];
+        const byte3 = bytes[i + 2];
+        base64 += BASE64_ALPHABET.charAt(byte1 >> 2);
+        base64 += BASE64_ALPHABET.charAt((byte1 & 0x03) << 4 | (byte2 === undefined ? 0 : byte2 >> 4));
+        base64 += byte2 === undefined ? '=' : BASE64_ALPHABET.charAt((byte2 & 0x0f) << 2 | (byte3 === undefined ? 0 : byte3 >> 6));
+        base64 += byte3 === undefined ? '=' : BASE64_ALPHABET.charAt(byte3 & 0x3f);
+    }
+    return base64;
+}
+function base64ToBytes(base64) {
+    const normalized = `${base64}`.replace(/-/g, '+').replace(/_/g, '/').replace(/=+$/, '');
+    if (!/^[A-Za-z0-9+/]*$/.test(normalized) || normalized.length % 4 === 1) {
+        return null;
+    }
+    const bytes = [];
+    for(let i = 0; i < normalized.length; i += 4){
+        const chunk = [
+            0,
+            1,
+            2,
+            3
+        ].map((offset)=>{
+            const char = normalized.charAt(i + offset);
+            // `indexOf('')` would return 0, so the missing characters of the last
+            // chunk have to be mapped to -1 explicitly.
+            return char === '' ? -1 : BASE64_ALPHABET.indexOf(char);
+        });
+        bytes.push(chunk[0] << 2 | chunk[1] >> 4);
+        if (chunk[2] !== -1) {
+            bytes.push((chunk[1] & 0x0f) << 4 | chunk[2] >> 2);
+        }
+        if (chunk[3] !== -1) {
+            bytes.push((chunk[2] & 0x03) << 6 | chunk[3]);
+        }
+    }
+    return bytes;
+}
+function stringToBase64Url(string) {
+    return bytesToBase64(stringToUtf8Bytes(string)).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+function base64ToString(base64) {
+    const bytes = base64ToBytes(base64);
+    return bytes === null ? null : utf8BytesToString(bytes);
+}
+function parseIsoDateToTimestamp(isoDate) {
+    const match = /^(\d{4})-(\d{2})-(\d{2})$/.exec(`${isoDate}`);
+    if (match === null) {
+        return null;
+    }
+    const year = parseInt(match[1], 10);
+    const month = parseInt(match[2], 10);
+    const day = parseInt(match[3], 10);
+    // Date.UTC maps years 0-99 to 1900-1999, which would make the round-trip
+    // check below report a "not a valid calendar date" lie.
+    if (year < 100) {
+        return null;
+    }
+    const timestamp = Date.UTC(year, month - 1, day);
+    const date = new Date(timestamp);
+    // An impossible date (e.g. "2027-02-30") makes `Date.UTC` roll over to
+    // the next month, so a round-trip comparison catches it.
+    if (date.getUTCFullYear() !== year || date.getUTCMonth() !== month - 1 || date.getUTCDate() !== day) {
+        return null;
+    }
+    return timestamp;
+}