polite-crawler 0.1.4 → 0.2.1

package/build/signals-BHpy2xb2.d.mts

@@ -1,46 +0,0 @@
-//#region src/signals.d.ts
-/**
- * Usage signals are the preferences that a page states about the use of its content. The crawler
- * records them with each capture, so a later use can obey them.
- *
- * The signal that changes behavior is AI input: the `ai-input` content signal of Cloudflare and the
- * `ai-use` signal of the IETF AIPREF draft. The crawler keeps a page that says no, but it holds back
- * the text from an AI reader by default. The crawler records a training opt-out (`ai-train`,
- * `train-ai`, and the `noai` and `noimageai` tags of `X-Robots-Tag`), but the opt-out does not
- * apply, because the crawler trains no model. Search engine tags (`noarchive`, `nosnippet`) are for
- * public caches and snippets. The crawler records them, but they do not block.
- *
- * The values can be structured fields (RFC 9651): `ai-input=?0`, `ai-input="no"` and `ai-input=no`
- * have the same meaning.
- *
- * The crawler also records two other kinds of statement, and they change nothing. The first is the
- * `License` lines of RSL in robots.txt. The second is the TDMRep reservation of text and data
- * mining: the headers `tdm-reservation` and `tdm-policy`, and the `<meta>` tags with these names.
- * A TDM reservation is about mining, not about AI input, so it is not a no for AI input.
- */
-type AiInput = "yes" | "no" | "unset";
-interface Signals {
-  readonly ai_input: AiInput;
-  /** the raw lines and headers the verdict came from, for the audit trail */
-  readonly raw: readonly string[];
-  /** This value is the training preference. The crawler records it, and it does not change what the crawler does. */
-  readonly ai_train?: AiInput | undefined;
-  /** This line of `raw` decided `ai_input`. When no line states AI input, there is no line. */
-  readonly deciding?: string | undefined;
-}
-declare const NO_SIGNALS: Signals;
-/**
- * This function reads the TDMRep tags of a page (`<meta name="tdm-reservation" content="1">` and
- * `tdm-policy`) as lines for `readSignals`, for example `meta tdm-reservation: 1`. It reads the first
- * 64 KB of the page, and its time grows in proportion to that length.
- */
-declare const metaSignals: (html: string) => string[];
-/**
- * Read the signals from a site's robots.txt lines (`content-signal: …`,
- * `content-usage: …`) and the response's own headers. A "no" anywhere wins:
- * the most specific statement a site made is the one to respect.
- */
-declare const readSignals: (robotsLines: readonly string[], header: (name: string) => string | undefined, pageLines?: readonly string[]) => Signals;
-//#endregion
-export { readSignals as a, metaSignals as i, NO_SIGNALS as n, Signals as r, AiInput as t };
-//# sourceMappingURL=signals-BHpy2xb2.d.mts.map

package/build/transformers-BQMlaGj4.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"transformers-BQMlaGj4.mjs","names":[],"sources":["../src/transformers.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport type { EmbedCallOptions, Embedder } from \"./embed.ts\";\nimport type { EmbeddingModel } from \"./ollama.ts\";\n\n/**\n * The transformers embedder uses an embedding model in this process, with transformers.js\n * (`@huggingface/transformers`). The package is an optional peer: the embedder loads it at its\n * first text, as the renderer loads `playwright-core` at its first page.\n *\n * The first use of a model downloads its files from the Hugging Face Hub (huggingface.co). That\n * download does not go through the polite crawler. transformers.js keeps the files in `cacheDir`\n * (its default is `node_modules/@huggingface/transformers/.cache/`), so the next use reads the disk.\n */\n\n/** The text of the error when the optional package `@huggingface/transformers` is not installed. */\nexport const NO_TRANSFORMERS =\n  \"the transformers embedder needs the package @huggingface/transformers: npm install @huggingface/transformers. For the MCP server with npx, start it with npx -y -p polite-crawler -p @huggingface/transformers polite-crawler mcp --embedder transformers\";\n\n/** The pooling of the vectors of the tokens: their mean, or the vector of the first token (`cls`). */\nexport type Pooling = \"mean\" | \"cls\";\n\n/** These are the facts of the models that the embedder knows. Each one is on the Hugging Face Hub with ONNX files. */\nexport const TRANSFORMERS_MODELS: Readonly<\n  Record<string, EmbeddingModel & { readonly pooling: Pooling }>\n> = {\n  \"Xenova/bge-small-en-v1.5\": {\n    dimensions: 384,\n    maxInputTokens: 512,\n    pooling: \"cls\",\n    queryPrefix: \"Represent this sentence for searching relevant passages: \",\n  },\n  \"Xenova/bge-base-en-v1.5\": {\n    dimensions: 768,\n    maxInputTokens: 512,\n    pooling: \"cls\",\n    queryPrefix: \"Represent this sentence for searching relevant passages: \",\n  },\n  \"Xenova/all-MiniLM-L6-v2\": { dimensions: 384, maxInputTokens: 256, pooling: \"mean\" },\n  \"nomic-ai/nomic-embed-text-v1.5\": {\n    dimensions: 768,\n    maxInputTokens: 8192,\n    pooling: \"mean\",\n    queryPrefix: \"search_query: \",\n    documentPrefix: \"search_document: \",\n  },\n};\n\n/** These options make a transformers embedder. */\nexport interface TransformersEmbedderOptions {\n  /** This value is the model on the Hugging Face Hub. The default is `Xenova/bge-small-en-v1.5` (384 dimensions, approximately 34 MB quantized). */\n  readonly model?: string | undefined;\n  /** The value true (the default) loads the 8-bit model (`dtype: \"q8\"`). The value false loads the 32-bit model, which is larger. */\n  readonly quantized?: boolean | undefined;\n  /** This folder keeps the files of the model. The default is the cache of transformers.js. */\n  readonly cacheDir?: string | undefined;\n  /** The value true uses only the files in the cache, with no download. The default is false. */\n  readonly localOnly?: boolean | undefined;\n  /** This value is the pooling of the model. The default comes from `TRANSFORMERS_MODELS`, or it is `mean`. */\n  readonly pooling?: Pooling | undefined;\n  /** This value is the length of each vector. The default comes from `TRANSFORMERS_MODELS`, or from the first answer. */\n  readonly dimensions?: number | undefined;\n  /** This value is the input limit of the model in tokens. The default comes from `TRANSFORMERS_MODELS`, or it is 256. */\n  readonly maxInputTokens?: number | undefined;\n  /** This prefix goes before the text of a question. The default comes from `TRANSFORMERS_MODELS`. */\n  readonly queryPrefix?: string | undefined;\n  /** This prefix goes before each chunk of a stored text. The default comes from `TRANSFORMERS_MODELS`. */\n  readonly documentPrefix?: string | undefined;\n  /** This value is the number of texts that the model reads at one time. The default is 8. */\n  readonly batch?: number | undefined;\n}\n\n/** This is the part of a feature-extraction pipeline of transformers.js that the embedder uses. */\nexport interface FeatureExtractor {\n  (\n    texts: string[],\n    options: { readonly pooling: Pooling; readonly normalize: boolean },\n  ): Promise<{ readonly data: ArrayLike<number>; readonly dims: readonly number[] }>;\n  dispose?(): Promise<unknown>;\n}\n\n/** This is the part of the module `@huggingface/transformers` that the embedder uses. */\nexport interface TransformersModule {\n  pipeline(\n    task: \"feature-extraction\",\n    model: string,\n    options: {\n      readonly dtype: \"q8\" | \"fp32\";\n      readonly cache_dir?: string | undefined;\n      readonly local_files_only?: boolean | undefined;\n    },\n  ): Promise<FeatureExtractor>;\n}\n\n/** This function loads the optional peer. A test gives a module of its own. */\nconst loadTransformers = async (): Promise<TransformersModule> =>\n  (await import(\"@huggingface/transformers\")) as unknown as TransformersModule;\n\n/**\n * This function makes an embedder that uses a model in this process with transformers.js. It loads\n * the package and the model at its first text, one time. It pools the vectors of the tokens as the\n * model expects (`cls` for BGE, `mean` for the others) and gives vectors with a length of 1. When\n * the package is not installed, `embed` rejects with `NO_TRANSFORMERS`. The signal stops the work\n * between two batches.\n */\nexport const transformersEmbedder = (\n  options: TransformersEmbedderOptions = {},\n  load: () => Promise<TransformersModule> = loadTransformers,\n): Embedder => {\n  const model = options.model ?? \"Xenova/bge-small-en-v1.5\";\n  if (model.trim() === \"\") throw new RangeError(\"the transformers model must have a name\");\n  const known = TRANSFORMERS_MODELS[model];\n  const quantized = options.quantized ?? true;\n  const pooling = options.pooling ?? known?.pooling ?? \"mean\";\n  if (pooling !== \"mean\" && pooling !== \"cls\")\n    throw new RangeError(`pooling must be \"mean\" or \"cls\", not ${JSON.stringify(pooling)}`);\n  const batch = Math.max(1, Math.floor(options.batch ?? 8));\n  const queryPrefix = options.queryPrefix ?? known?.queryPrefix ?? \"\";\n  const documentPrefix = options.documentPrefix ?? known?.documentPrefix ?? \"\";\n  const custom =\n    options.documentPrefix !== undefined && options.documentPrefix !== (known?.documentPrefix ?? \"\")\n      ? `#${createHash(\"sha256\").update(options.documentPrefix).digest(\"hex\").slice(0, 8)}`\n      : \"\";\n  let dimensions = options.dimensions ?? known?.dimensions ?? 0;\n  let extractor: Promise<FeatureExtractor> | undefined;\n\n  const open = (): Promise<FeatureExtractor> => {\n    extractor ??= (async () => {\n      let module: TransformersModule;\n      try {\n        module = await load();\n      } catch (cause) {\n        throw new Error(NO_TRANSFORMERS, { cause });\n      }\n      return module.pipeline(\"feature-extraction\", model, {\n        dtype: quantized ? \"q8\" : \"fp32\",\n        ...(options.cacheDir === undefined ? {} : { cache_dir: options.cacheDir }),\n        ...(options.localOnly === true ? { local_files_only: true } : {}),\n      });\n    })();\n    // a failed load is not kept: the next text tries again, for example after an install\n    extractor.catch(() => {\n      extractor = undefined;\n    });\n    return extractor;\n  };\n\n  return {\n    id: `transformers:${model}:${quantized ? \"q8\" : \"fp32\"}:${pooling}${custom}`,\n    get dimensions() {\n      return dimensions;\n    },\n    maxInputTokens: options.maxInputTokens ?? known?.maxInputTokens ?? 256,\n    async embed(texts: readonly string[], call: EmbedCallOptions = {}): Promise<Float32Array[]> {\n      call.signal?.throwIfAborted();\n      if (texts.length === 0) return [];\n      const run = await open();\n      const prefix = call.purpose === \"query\" ? queryPrefix : documentPrefix;\n      const out: Float32Array[] = [];\n      for (let at = 0; at < texts.length; at += batch) {\n        call.signal?.throwIfAborted();\n        const part = texts.slice(at, at + batch).map((text) => `${prefix}${text}`);\n        const tensor = await run(part, { pooling, normalize: true });\n        const width = tensor.dims.at(-1) ?? 0;\n        if (tensor.dims.length !== 2 || tensor.dims[0] !== part.length || width === 0) {\n          throw new Error(\n            `the model ${model} gave a tensor of the shape [${tensor.dims.join(\", \")}], not [${String(part.length)}, dimensions]`,\n          );\n        }\n        if (dimensions === 0) dimensions = width;\n        if (width !== dimensions) {\n          throw new Error(\n            `the model ${model} gave vectors of ${String(width)} dimensions, not ${String(dimensions)}`,\n          );\n        }\n        const data = tensor.data;\n        for (let row = 0; row < part.length; row += 1) {\n          const vector = new Float32Array(width);\n          for (let column = 0; column < width; column += 1)\n            vector[column] = data[row * width + column]!;\n          out.push(vector);\n        }\n      }\n      return out;\n    },\n    async close() {\n      const running = extractor;\n      extractor = undefined;\n      if (running === undefined) return;\n      try {\n        await (await running).dispose?.();\n      } catch {\n        // a model that did not load has nothing to release\n      }\n    },\n  };\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AAeA,MAAa,kBACX;;AAMF,MAAa,sBAET;CACF,4BAA4B;EAC1B,YAAY;EACZ,gBAAgB;EAChB,SAAS;EACT,aAAa;CACf;CACA,2BAA2B;EACzB,YAAY;EACZ,gBAAgB;EAChB,SAAS;EACT,aAAa;CACf;CACA,2BAA2B;EAAE,YAAY;EAAK,gBAAgB;EAAK,SAAS;CAAO;CACnF,kCAAkC;EAChC,YAAY;EACZ,gBAAgB;EAChB,SAAS;EACT,aAAa;EACb,gBAAgB;CAClB;AACF;;AAiDA,MAAM,mBAAmB,YACtB,MAAM,OAAO;;;;;;;;AAShB,MAAa,wBACX,UAAuC,CAAC,GACxC,OAA0C,qBAC7B;CACb,MAAM,QAAQ,QAAQ,SAAS;CAC/B,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,IAAI,WAAW,yCAAyC;CACvF,MAAM,QAAQ,oBAAoB;CAClC,MAAM,YAAY,QAAQ,aAAa;CACvC,MAAM,UAAU,QAAQ,WAAW,OAAO,WAAW;CACrD,IAAI,YAAY,UAAU,YAAY,OACpC,MAAM,IAAI,WAAW,wCAAwC,KAAK,UAAU,OAAO,GAAG;CACxF,MAAM,QAAQ,KAAK,IAAI,GAAG,KAAK,MAAM,QAAQ,SAAS,CAAC,CAAC;CACxD,MAAM,cAAc,QAAQ,eAAe,OAAO,eAAe;CACjE,MAAM,iBAAiB,QAAQ,kBAAkB,OAAO,kBAAkB;CAC1E,MAAM,SACJ,QAAQ,mBAAmB,KAAA,KAAa,QAAQ,oBAAoB,OAAO,kBAAkB,MACzF,IAAI,WAAW,QAAQ,CAAC,CAAC,OAAO,QAAQ,cAAc,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,MAChF;CACN,IAAI,aAAa,QAAQ,cAAc,OAAO,cAAc;CAC5D,IAAI;CAEJ,MAAM,aAAwC;EAC5C,eAAe,YAAY;GACzB,IAAI;GACJ,IAAI;IACF,SAAS,MAAM,KAAK;GACtB,SAAS,OAAO;IACd,MAAM,IAAI,MAAM,iBAAiB,EAAE,MAAM,CAAC;GAC5C;GACA,OAAO,OAAO,SAAS,sBAAsB,OAAO;IAClD,OAAO,YAAY,OAAO;IAC1B,GAAI,QAAQ,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,WAAW,QAAQ,SAAS;IACxE,GAAI,QAAQ,cAAc,OAAO,EAAE,kBAAkB,KAAK,IAAI,CAAC;GACjE,CAAC;EACH,EAAA,CAAG;EAEH,UAAU,YAAY;GACpB,YAAY,KAAA;EACd,CAAC;EACD,OAAO;CACT;CAEA,OAAO;EACL,IAAI,gBAAgB,MAAM,GAAG,YAAY,OAAO,OAAO,GAAG,UAAU;EACpE,IAAI,aAAa;GACf,OAAO;EACT;EACA,gBAAgB,QAAQ,kBAAkB,OAAO,kBAAkB;EACnE,MAAM,MAAM,OAA0B,OAAyB,CAAC,GAA4B;GAC1F,KAAK,QAAQ,eAAe;GAC5B,IAAI,MAAM,WAAW,GAAG,OAAO,CAAC;GAChC,MAAM,MAAM,MAAM,KAAK;GACvB,MAAM,SAAS,KAAK,YAAY,UAAU,cAAc;GACxD,MAAM,MAAsB,CAAC;GAC7B,KAAK,IAAI,KAAK,GAAG,KAAK,MAAM,QAAQ,MAAM,OAAO;IAC/C,KAAK,QAAQ,eAAe;IAC5B,MAAM,OAAO,MAAM,MAAM,IAAI,KAAK,KAAK,CAAC,CAAC,KAAK,SAAS,GAAG,SAAS,MAAM;IACzE,MAAM,SAAS,MAAM,IAAI,MAAM;KAAE;KAAS,WAAW;IAAK,CAAC;IAC3D,MAAM,QAAQ,OAAO,KAAK,GAAG,EAAE,KAAK;IACpC,IAAI,OAAO,KAAK,WAAW,KAAK,OAAO,KAAK,OAAO,KAAK,UAAU,UAAU,GAC1E,MAAM,IAAI,MACR,aAAa,MAAM,+BAA+B,OAAO,KAAK,KAAK,IAAI,EAAE,UAAU,OAAO,KAAK,MAAM,EAAE,cACzG;IAEF,IAAI,eAAe,GAAG,aAAa;IACnC,IAAI,UAAU,YACZ,MAAM,IAAI,MACR,aAAa,MAAM,mBAAmB,OAAO,KAAK,EAAE,mBAAmB,OAAO,UAAU,GAC1F;IAEF,MAAM,OAAO,OAAO;IACpB,KAAK,IAAI,MAAM,GAAG,MAAM,KAAK,QAAQ,OAAO,GAAG;KAC7C,MAAM,SAAS,IAAI,aAAa,KAAK;KACrC,KAAK,IAAI,SAAS,GAAG,SAAS,OAAO,UAAU,GAC7C,OAAO,UAAU,KAAK,MAAM,QAAQ;KACtC,IAAI,KAAK,MAAM;IACjB;GACF;GACA,OAAO;EACT;EACA,MAAM,QAAQ;GACZ,MAAM,UAAU;GAChB,YAAY,KAAA;GACZ,IAAI,YAAY,KAAA,GAAW;GAC3B,IAAI;IACF,OAAO,MAAM,QAAA,CAAS,UAAU;GAClC,QAAQ,CAER;EACF;CACF;AACF"}

package/build/urls-BTDSgDLC.d.mts

@@ -1,16 +0,0 @@
-//#region src/urls.d.ts
-/**
- * This function gives one URL for each page: a lowercase host, and no fragment, tracking
- * parameters, empty query or default port. It decodes the escapes of unreserved characters.
- */
-declare const canonicalUrl: (value: string) => string;
-/** These options set the hosts that a crawl or a discovery keeps. */
-interface ScopeOptions {
-  /** With the default value true, the URLs on the sites of the start URLs are in scope. */
-  readonly sameSite?: boolean | undefined;
-  /** The URLs on these hosts are in scope too. A name that starts with `*.` names the hosts under it. */
-  readonly allowHosts?: readonly string[] | undefined;
-}
-//#endregion
-export { canonicalUrl as n, ScopeOptions as t };
-//# sourceMappingURL=urls-BTDSgDLC.d.mts.map

package/build/version-BPem-XZd.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"version-BPem-XZd.mjs","names":[],"sources":["../src/duration.ts","../src/version.ts"],"sourcesContent":["/** A duration is a count of milliseconds, or a text, for example `\"30m\"`, `\"24h\"` or `\"7d\"`. */\nexport type Duration = number | string;\n\nconst UNITS: Readonly<Record<string, number>> = {\n  ms: 1,\n  s: 1000,\n  m: 60_000,\n  h: 3_600_000,\n  d: 86_400_000,\n  w: 604_800_000,\n};\n\n/**\n * This function changes a duration into milliseconds. The units are `ms`, `s`, `m` (minutes), `h`,\n * `d` and `w`, in any case. The unit `M` is an error, because a month is not a unit. A bare `0`\n * is zero. The function throws an error for a text that it cannot read.\n */\nexport const durationMs = (duration: Duration): number => {\n  if (typeof duration === \"number\") {\n    if (!Number.isFinite(duration) || duration < 0)\n      throw new Error(`not a duration: ${String(duration)}`);\n    return duration;\n  }\n  if (/^\\s*0+(\\.0+)?\\s*$/.test(duration)) return 0;\n  const match = /^\\s*(\\d+(?:\\.\\d+)?)\\s*(ms|s|m|h|d|w)\\s*$/i.exec(duration);\n  const unit = match?.[2];\n  const factor = unit === undefined || unit === \"M\" ? undefined : UNITS[unit.toLowerCase()];\n  if (match === null || factor === undefined) {\n    throw new Error(\n      `not a duration: \"${duration}\" (write a number and ms, s, m, h, d or w; m is minutes)`,\n    );\n  }\n  return Number(match[1]) * factor;\n};\n","/** This is the version of the package. A test makes sure that it agrees with `package.json`. */\nexport const VERSION = \"0.1.4\";\n\n/** This is the product token that robots.txt rules match when an application gives no token. */\nexport const DEFAULT_TOKEN = \"PoliteCrawler\";\n\n/** This page tells a site owner what the crawler is and how to control it. */\nexport const BOT_PAGE = \"https://mark1russell7.github.io/crawler/bot/\";\n"],"mappings":";AAGA,MAAM,QAA0C;CAC9C,IAAI;CACJ,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;CACH,GAAG;AACL;;;;;;AAOA,MAAa,cAAc,aAA+B;CACxD,IAAI,OAAO,aAAa,UAAU;EAChC,IAAI,CAAC,OAAO,SAAS,QAAQ,KAAK,WAAW,GAC3C,MAAM,IAAI,MAAM,mBAAmB,OAAO,QAAQ,GAAG;EACvD,OAAO;CACT;CACA,IAAI,oBAAoB,KAAK,QAAQ,GAAG,OAAO;CAC/C,MAAM,QAAQ,4CAA4C,KAAK,QAAQ;CACvE,MAAM,OAAO,QAAQ;CACrB,MAAM,SAAS,SAAS,KAAA,KAAa,SAAS,MAAM,KAAA,IAAY,MAAM,KAAK,YAAY;CACvF,IAAI,UAAU,QAAQ,WAAW,KAAA,GAC/B,MAAM,IAAI,MACR,oBAAoB,SAAS,yDAC/B;CAEF,OAAO,OAAO,MAAM,EAAE,IAAI;AAC5B;;;;AChCA,MAAa,UAAU;;AAGvB,MAAa,gBAAgB;;AAG7B,MAAa,WAAW"}

package/build/webbotauth-CjJdTAfE.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"webbotauth-CjJdTAfE.mjs","names":["signBytes","verifyBytes"],"sources":["../src/webbotauth.ts"],"sourcesContent":["import type { JsonWebKeyInput, KeyObject } from \"node:crypto\";\nimport {\n  createHash,\n  createPrivateKey,\n  createPublicKey,\n  randomBytes,\n  sign as signBytes,\n  verify as verifyBytes,\n} from \"node:crypto\";\n\n/**\n * Signed requests: HTTP Message Signatures (RFC 9421), as the IETF Web Bot Auth profile tells\n * (`draft-ietf-webbotauth-httpsig-protocol-00`, 1 September 2026). A signature lets a site verify that\n * a request comes from the holder of a key that the operator publishes.\n *\n * - Each request gets three headers: `Signature-Agent`, `Signature-Input` and `Signature`.\n * - `Signature-Agent` is a dictionary. Its member names the key directory of the operator.\n * - The signature covers `@authority` and that member of `Signature-Agent`.\n * - The parameters are `created`, `keyid` (the JWK thumbprint of the key), `alg=\"ed25519\"`,\n *   `expires`, a random `nonce` and `tag=\"web-bot-auth\"`.\n * - The key is an Ed25519 key, and `node:crypto` signs. The package adds no dependency.\n *\n * A signature adds an identity. It does not replace the `User-Agent` header, which stays honest.\n */\n\n/** The path of the key directory on the host of the operator (the well-known URI of the draft). */\nexport const KEY_DIRECTORY_PATH = \"/.well-known/http-message-signatures-directory\";\n\n/** The media type of the key directory. The host of the directory sends it as `Content-Type`. */\nexport const KEY_DIRECTORY_TYPE = \"application/http-message-signatures-directory+json\";\n\n/** The value of the `tag` parameter of a Web Bot Auth signature. */\nexport const WEB_BOT_AUTH_TAG = \"web-bot-auth\";\n\n/**\n * This value tells how a site finds the keys from the URL of `Signature-Agent`:\n *\n * - `directory` (the default): the URL is an origin, and the keys are at `KEY_DIRECTORY_PATH` on it.\n * - `jwks_uri`: the URL is the address of a JSON Web Key Set, on any path.\n */\nexport type SignatureAgentType = \"directory\" | \"jwks_uri\";\n\n/** A key in one of the forms that `node:crypto` reads: a `KeyObject`, PEM text, DER bytes (PKCS#8 or SPKI) or a JWK. */\n/**\n * This type is a JSON Web Key, as `createPrivateKey` of `node:crypto` reads it. The type comes from `JsonWebKeyInput`, which\n * `@types/node` 22 and 26 both have: version 26 has no `JsonWebKey` export in `node:crypto`.\n */\ntype JsonWebKey = JsonWebKeyInput[\"key\"];\n\nexport type KeyInput = KeyObject | string | Uint8Array | JsonWebKey;\n\n/** These options make a signer for Web Bot Auth. */\nexport interface WebBotAuthOptions {\n  /** This key signs. It is an Ed25519 private key: a `KeyObject`, PKCS#8 (PEM text or DER bytes) or a JWK with `d`. */\n  readonly privateKey: KeyInput;\n  /**\n   * This text is the `keyid` of each signature: the JWK thumbprint of the key (RFC 8037). The signer\n   * calculates it. A value that is not the thumbprint of the key throws an error.\n   */\n  readonly keyId?: string | undefined;\n  /**\n   * This URL tells a site where the keys are. For the type `directory`, it is an https origin, for\n   * example `https://bot.example.com`. For `jwks_uri`, it is the https URL of a JSON Web Key Set.\n   */\n  readonly signatureAgent: string;\n  /** This value tells how a site finds the keys from `signatureAgent`. The default is `directory`. */\n  readonly agentType?: SignatureAgentType | undefined;\n  /** This value is the time that a signature stays valid, in milliseconds. The default is 5 minutes, and the maximum is 24 hours. */\n  readonly lifetimeMs?: number | undefined;\n  /** This text is the label of the signature, and the key of the member of `Signature-Agent`. The default is `sig1`. */\n  readonly label?: string | undefined;\n}\n\n/**\n * A request signer gives the signature headers of one request. The crawler uses it for each\n * request, robots.txt too. `createWebBotAuthSigner` makes one. A signer of your own can sign with a\n * key in a hardware module, for example.\n */\nexport interface RequestSigner {\n  /** This text is the `keyid` of the signatures. */\n  readonly keyId: string;\n  /** This URL is the value of the member of `Signature-Agent`: where a site finds the keys. */\n  readonly signatureAgent: string;\n  /** This method gives the headers that sign a request to `url` at the time `now` (milliseconds since the epoch). */\n  sign(url: URL, now: number): Readonly<Record<string, string>>;\n}\n\n/** The signer that `createWebBotAuthSigner` makes. It also gives its public key for the key directory. */\nexport interface WebBotAuthSigner extends RequestSigner {\n  /** This JWK is the public key of the signer, with no private part. Give it to `keyDirectory`. */\n  readonly publicKey: JsonWebKey;\n}\n\n/** One key of a key directory: an Ed25519 public key as a JWK, with its thumbprint as `kid`. */\nexport interface DirectoryKey {\n  readonly kty: \"OKP\";\n  readonly crv: \"Ed25519\";\n  readonly kid: string;\n  readonly x: string;\n  readonly use: \"sig\";\n}\n\n/** A key directory: a JSON Web Key Set. The operator serves it as JSON at `KEY_DIRECTORY_PATH`, with the type `KEY_DIRECTORY_TYPE`. */\nexport interface KeyDirectory {\n  readonly keys: readonly DirectoryKey[];\n}\n\n/** The parts of a request that `verifySignature` reads. */\nexport interface SignedRequest {\n  readonly url: string;\n  /** The default is `GET`. */\n  readonly method?: string | undefined;\n  /** These are the headers of the request. A name can be in any case, and a header can have more than one line. */\n  readonly headers: Readonly<Record<string, string | readonly string[] | undefined>>;\n}\n\n/** The result of `verifySignature`. */\nexport interface SignatureCheck {\n  /** This value is true when a Web Bot Auth signature of the request verifies with a key of the directory. */\n  readonly verified: boolean;\n  /** This text is the label of the signature that the check examined last, or null. */\n  readonly label: string | null;\n  readonly keyId: string | null;\n  /** This URL is the member of `Signature-Agent` that the signature covers, or null. */\n  readonly agent: string | null;\n  /** This text tells why the request does not verify. It is null when it verifies. */\n  readonly reason: string | null;\n}\n\n// ── structured fields (RFC 9651): the parts that the signature headers use ──\n\n/** A token of a structured field, for example `ed25519` in `alg=ed25519`. */\nclass Token {\n  constructor(readonly value: string) {}\n}\n\ntype BareItem = string | number | boolean | Uint8Array | Token;\ntype Params = ReadonlyArray<readonly [string, BareItem]>;\n\ninterface Item {\n  readonly value: BareItem;\n  readonly params: Params;\n}\n\ninterface InnerList {\n  readonly items: readonly Item[];\n  readonly params: Params;\n}\n\ntype Member = Item | InnerList;\n\nconst isInnerList = (member: Member): member is InnerList => \"items\" in member;\n\n/** This error tells that a structured field does not parse. */\nclass FieldError extends Error {}\n\nconst KEY_START = /[a-z*]/;\nconst KEY_CHAR = /[a-z0-9_\\-.*]/;\nconst TOKEN_START = /[A-Za-z*]/;\nconst TOKEN_CHAR = /[!#$%&'*+\\-.^_`|~0-9A-Za-z:/]/;\nconst BASE64 = /^[A-Za-z0-9+/=]*$/;\n\n/** This class reads one structured field from its text. */\nclass FieldParser {\n  private at = 0;\n  constructor(private readonly text: string) {}\n\n  private peek(): string {\n    return this.text[this.at] ?? \"\";\n  }\n\n  private spaces(): void {\n    while (this.peek() === \" \") this.at += 1;\n  }\n\n  private ows(): void {\n    while (this.peek() === \" \" || this.peek() === \"\\t\") this.at += 1;\n  }\n\n  dictionary(): Map<string, Member> {\n    const out = new Map<string, Member>();\n    this.spaces();\n    while (this.at < this.text.length) {\n      const key = this.key();\n      let member: Member;\n      if (this.peek() === \"=\") {\n        this.at += 1;\n        member = this.peek() === \"(\" ? this.innerList() : this.item();\n      } else {\n        member = { value: true, params: this.params() };\n      }\n      out.set(key, member);\n      this.ows();\n      if (this.at >= this.text.length) break;\n      if (this.peek() !== \",\") throw new FieldError(`a \",\" is necessary at ${String(this.at)}`);\n      this.at += 1;\n      this.ows();\n      if (this.at >= this.text.length) throw new FieldError(\"the field ends with a comma\");\n    }\n    return out;\n  }\n\n  /** This method reads one item and checks that the field has nothing after it. */\n  wholeItem(): Item {\n    this.spaces();\n    const item = this.item();\n    this.spaces();\n    if (this.at < this.text.length) throw new FieldError(\"text after the item\");\n    return item;\n  }\n\n  private key(): string {\n    if (!KEY_START.test(this.peek())) throw new FieldError(`no key at ${String(this.at)}`);\n    const start = this.at;\n    while (KEY_CHAR.test(this.peek()) && this.at < this.text.length) this.at += 1;\n    return this.text.slice(start, this.at);\n  }\n\n  private innerList(): InnerList {\n    this.at += 1;\n    const items: Item[] = [];\n    for (;;) {\n      this.spaces();\n      if (this.peek() === \")\") {\n        this.at += 1;\n        return { items, params: this.params() };\n      }\n      if (this.at >= this.text.length) throw new FieldError(\"an inner list has no end\");\n      items.push(this.item());\n      if (this.peek() !== \" \" && this.peek() !== \")\")\n        throw new FieldError(`a space or \")\" is necessary at ${String(this.at)}`);\n    }\n  }\n\n  private item(): Item {\n    const value = this.bare();\n    return { value, params: this.params() };\n  }\n\n  private params(): Params {\n    const out: Array<readonly [string, BareItem]> = [];\n    while (this.peek() === \";\") {\n      this.at += 1;\n      this.spaces();\n      const key = this.key();\n      let value: BareItem = true;\n      if (this.peek() === \"=\") {\n        this.at += 1;\n        value = this.bare();\n      }\n      const known = out.findIndex(([name]) => name === key);\n      if (known === -1) out.push([key, value]);\n      else out[known] = [key, value];\n    }\n    return out;\n  }\n\n  private bare(): BareItem {\n    const char = this.peek();\n    if (char === \"-\" || /[0-9]/.test(char)) return this.number();\n    if (char === '\"') return this.string();\n    if (char === \":\") return this.bytes();\n    if (char === \"?\") return this.boolean();\n    if (TOKEN_START.test(char)) return this.token();\n    throw new FieldError(`no item at ${String(this.at)}`);\n  }\n\n  private number(): number {\n    const match = /^-?(\\d{1,15})(\\.\\d{1,3})?/.exec(this.text.slice(this.at));\n    if (match === null || (match[2] !== undefined && match[1]!.length > 12))\n      throw new FieldError(`not a number at ${String(this.at)}`);\n    this.at += match[0].length;\n    return Number(match[0]);\n  }\n\n  private string(): string {\n    this.at += 1;\n    let out = \"\";\n    for (;;) {\n      const char = this.peek();\n      if (char === \"\") throw new FieldError(\"a string has no end\");\n      this.at += 1;\n      if (char === \"\\\\\") {\n        const next = this.peek();\n        if (next !== '\"' && next !== \"\\\\\") throw new FieldError(\"a bad escape in a string\");\n        out += next;\n        this.at += 1;\n      } else if (char === '\"') {\n        return out;\n      } else {\n        const code = char.charCodeAt(0);\n        if (code < 0x20 || code > 0x7e)\n          throw new FieldError(\"a string holds a character that is not printable ASCII\");\n        out += char;\n      }\n    }\n  }\n\n  private bytes(): Uint8Array {\n    this.at += 1;\n    const end = this.text.indexOf(\":\", this.at);\n    if (end === -1) throw new FieldError(\"a byte sequence has no end\");\n    const text = this.text.slice(this.at, end);\n    if (!BASE64.test(text)) throw new FieldError(\"a byte sequence is not base64\");\n    this.at = end + 1;\n    return new Uint8Array(Buffer.from(text, \"base64\"));\n  }\n\n  private boolean(): boolean {\n    const value = this.text.slice(this.at, this.at + 2);\n    if (value !== \"?1\" && value !== \"?0\") throw new FieldError(\"not a boolean\");\n    this.at += 2;\n    return value === \"?1\";\n  }\n\n  private token(): Token {\n    const start = this.at;\n    this.at += 1;\n    while (TOKEN_CHAR.test(this.peek()) && this.at < this.text.length) this.at += 1;\n    return new Token(this.text.slice(start, this.at));\n  }\n}\n\nconst serializeBare = (value: BareItem): string => {\n  if (value instanceof Token) return value.value;\n  if (value instanceof Uint8Array) return `:${Buffer.from(value).toString(\"base64\")}:`;\n  if (typeof value === \"boolean\") return value ? \"?1\" : \"?0\";\n  if (typeof value === \"number\")\n    return Number.isInteger(value) ? String(value) : String(Math.round(value * 1000) / 1000);\n  return `\"${value.replace(/[\"\\\\]/g, (char) => `\\\\${char}`)}\"`;\n};\n\nconst serializeParams = (params: Params): string =>\n  params\n    .map(([key, value]) => (value === true ? `;${key}` : `;${key}=${serializeBare(value)}`))\n    .join(\"\");\n\nconst serializeItem = (item: Item): string =>\n  `${serializeBare(item.value)}${serializeParams(item.params)}`;\n\nconst serializeMember = (member: Member): string =>\n  isInnerList(member)\n    ? `(${member.items.map(serializeItem).join(\" \")})${serializeParams(member.params)}`\n    : serializeItem(member);\n\n/** This function tells if a text is a key of a structured field: a label of a signature, for example. */\nconst isKey = (text: string): boolean => /^[a-z*][a-z0-9_\\-.*]*$/.test(text);\n\n// ── keys ──\n\nconst base64url = (bytes: Uint8Array): string => Buffer.from(bytes).toString(\"base64url\");\n\nconst isKeyObject = (key: KeyInput): key is KeyObject =>\n  typeof key === \"object\" && key !== null && \"asymmetricKeyType\" in key && \"export\" in key;\n\n/** This function reads a private key. Its errors do not hold the key. */\nconst privateKeyOf = (input: KeyInput): KeyObject => {\n  let key: KeyObject;\n  try {\n    if (isKeyObject(input)) key = input;\n    else if (typeof input === \"string\")\n      key = input.trim().startsWith(\"{\")\n        ? createPrivateKey({ key: JSON.parse(input) as JsonWebKey, format: \"jwk\" })\n        : createPrivateKey(input);\n    else if (input instanceof Uint8Array)\n      key = createPrivateKey({ key: Buffer.from(input), format: \"der\", type: \"pkcs8\" });\n    else key = createPrivateKey({ key: input, format: \"jwk\" });\n  } catch (cause) {\n    throw new Error(\n      \"the private key of the signer does not parse: give an Ed25519 key as PKCS#8 (PEM or DER) or as a JWK\",\n      { cause },\n    );\n  }\n  if (key.type !== \"private\")\n    throw new Error(\"the key of the signer is not a private key: give the Ed25519 private key\");\n  if (key.asymmetricKeyType !== \"ed25519\")\n    throw new Error(\n      `the key of the signer is ${key.asymmetricKeyType ?? \"not an asymmetric key\"}, not ed25519: Web Bot Auth here uses Ed25519 keys`,\n    );\n  return key;\n};\n\n/** This function reads a public key, or the public part of a private key. Its errors do not hold the key. */\nconst publicKeyOf = (input: KeyInput): KeyObject => {\n  let key: KeyObject;\n  try {\n    if (isKeyObject(input)) key = input.type === \"private\" ? createPublicKey(input) : input;\n    else if (typeof input === \"string\")\n      key = input.trim().startsWith(\"{\")\n        ? createPublicKey({ key: JSON.parse(input) as JsonWebKey, format: \"jwk\" })\n        : createPublicKey(input);\n    else if (input instanceof Uint8Array) {\n      const bytes = Buffer.from(input);\n      try {\n        key = createPublicKey({ key: bytes, format: \"der\", type: \"spki\" });\n      } catch {\n        key = createPublicKey(createPrivateKey({ key: bytes, format: \"der\", type: \"pkcs8\" }));\n      }\n    } else key = createPublicKey({ key: input, format: \"jwk\" });\n  } catch (cause) {\n    throw new Error(\"a key of the directory does not parse: give an Ed25519 key\", { cause });\n  }\n  if (key.asymmetricKeyType !== \"ed25519\")\n    throw new Error(\n      `a key of the directory is ${key.asymmetricKeyType ?? \"not an asymmetric key\"}, not ed25519`,\n    );\n  return key;\n};\n\n/** This function gives the JWK thumbprint of an Ed25519 public key (RFC 7638, RFC 8037 appendix A.3). */\nconst thumbprintOf = (x: string): string =>\n  base64url(\n    createHash(\"sha256\")\n      .update(JSON.stringify({ crv: \"Ed25519\", kty: \"OKP\", x }), \"utf8\")\n      .digest(),\n  );\n\nconst directoryKeyOf = (key: KeyObject): DirectoryKey => {\n  const jwk = key.export({ format: \"jwk\" });\n  const x = typeof jwk.x === \"string\" ? jwk.x : \"\";\n  return { kty: \"OKP\", crv: \"Ed25519\", kid: thumbprintOf(x), x, use: \"sig\" };\n};\n\n/**\n * This function makes the key directory for the operator to host: a JSON Web Key Set with each\n * public key and its thumbprint as `kid`. It takes public keys, or private keys, and it writes only\n * their public parts. Serve the JSON at `KEY_DIRECTORY_PATH` with the type `KEY_DIRECTORY_TYPE`.\n */\nexport const keyDirectory = (publicKeys: readonly KeyInput[]): KeyDirectory => {\n  const keys = new Map<string, DirectoryKey>();\n  for (const input of publicKeys) {\n    const key = directoryKeyOf(publicKeyOf(input));\n    keys.set(key.kid, key);\n  }\n  return { keys: [...keys.values()] };\n};\n\n// ── signing ──\n\n/** The parts of one signature. The signer and the tests use this function. */\nexport interface SignatureParts {\n  /** The value of `@authority`: the host and a port that is not the default port, in lowercase. */\n  readonly authority: string;\n  readonly label: string;\n  /** The key of the member of `Signature-Agent`. The draft uses the label of the signature. */\n  readonly agentKey: string;\n  /** The serialized value of the member: a string, and its parameters. */\n  readonly agentValue: string;\n  readonly keyId: string;\n  readonly created: number;\n  readonly expires: number;\n  readonly nonce?: string | undefined;\n}\n\n/** This function gives the `@signature-params` value: the covered components and the parameters, in the order of the draft. */\nconst signatureParams = (parts: SignatureParts): string =>\n  `(\"@authority\" \"signature-agent\";key=${serializeBare(parts.agentKey)});created=${String(parts.created)};keyid=${serializeBare(parts.keyId)};alg=\"ed25519\";expires=${String(parts.expires)}${parts.nonce === undefined ? \"\" : `;nonce=${serializeBare(parts.nonce)}`};tag=\"${WEB_BOT_AUTH_TAG}\"`;\n\n/** This function gives the signature base of RFC 9421, section 2.5, for the components of Web Bot Auth. */\nexport const signatureBase = (parts: SignatureParts): string =>\n  [\n    `\"@authority\": ${parts.authority}`,\n    `\"signature-agent\";key=${serializeBare(parts.agentKey)}: ${parts.agentValue}`,\n    `\"@signature-params\": ${signatureParams(parts)}`,\n  ].join(\"\\n\");\n\n/** This function signs the parts with an Ed25519 key, and gives the three headers. */\nexport const signParts = (\n  parts: SignatureParts,\n  key: KeyObject,\n): {\n  readonly \"signature-agent\": string;\n  readonly \"signature-input\": string;\n  readonly signature: string;\n} => {\n  const signature = signBytes(null, Buffer.from(signatureBase(parts), \"utf8\"), key);\n  return {\n    \"signature-agent\": `${parts.agentKey}=${parts.agentValue}`,\n    \"signature-input\": `${parts.label}=${signatureParams(parts)}`,\n    signature: `${parts.label}=:${signature.toString(\"base64\")}:`,\n  };\n};\n\nconst DEFAULT_LIFETIME_MS = 5 * 60_000;\nconst MAX_LIFETIME_MS = 24 * 60 * 60_000;\n\n/** This function checks the URL of `Signature-Agent`, and gives the URL and the serialized value of the member. */\nconst agentOf = (\n  url: string,\n  type: SignatureAgentType,\n): { readonly url: string; readonly value: string } => {\n  let target: URL;\n  try {\n    target = new URL(url);\n  } catch {\n    throw new Error(\n      `signatureAgent \"${url}\" is not a URL: give the https URL of the key directory`,\n    );\n  }\n  if (target.protocol !== \"https:\")\n    throw new Error(`signatureAgent \"${url}\" is not an https URL: the draft permits only https`);\n  if (target.username !== \"\" || target.password !== \"\" || target.hash !== \"\")\n    throw new Error(`signatureAgent \"${url}\" has a user name, a password or a fragment`);\n  if (type === \"directory\") {\n    if (target.pathname !== \"/\" || target.search !== \"\")\n      throw new Error(\n        `signatureAgent \"${url}\" is not an origin: the type directory takes only an origin, such as https://bot.example.com. For a key set on a path, set agentType to jwks_uri`,\n      );\n    return { url: target.origin, value: serializeBare(target.origin) };\n  }\n  return { url: target.href, value: `${serializeBare(target.href)};type=${type}` };\n};\n\n/**\n * This function makes a signer for Web Bot Auth with an Ed25519 key. Each signature covers\n * `@authority` and the member of `Signature-Agent`. It has a new random nonce, and it expires after\n * `lifetimeMs`. The signer keeps the private key in a closure: no property of the signer holds it.\n */\nexport const createWebBotAuthSigner = (options: WebBotAuthOptions): WebBotAuthSigner => {\n  const key = privateKeyOf(options.privateKey);\n  const publicKey = directoryKeyOf(createPublicKey(key));\n  if (options.keyId !== undefined && options.keyId !== publicKey.kid)\n    throw new Error(\n      `keyId \"${options.keyId}\" is not the JWK thumbprint of the key (${publicKey.kid}): Web Bot Auth uses the thumbprint as keyid`,\n    );\n  const agent = agentOf(options.signatureAgent, options.agentType ?? \"directory\");\n  const label = options.label ?? \"sig1\";\n  if (!isKey(label))\n    throw new Error(\n      `label \"${label}\" is not a key of a structured field: use lowercase letters, digits, \"_\", \"-\", \".\" and \"*\"`,\n    );\n  const lifetimeMs = options.lifetimeMs ?? DEFAULT_LIFETIME_MS;\n  if (!Number.isFinite(lifetimeMs) || lifetimeMs < 1000 || lifetimeMs > MAX_LIFETIME_MS)\n    throw new RangeError(\n      `lifetimeMs must be from 1000 (1 second) to ${String(MAX_LIFETIME_MS)} (24 hours), not ${String(lifetimeMs)}`,\n    );\n  const { kty, crv, x } = publicKey;\n  return {\n    keyId: publicKey.kid,\n    signatureAgent: agent.url,\n    publicKey: { kty, crv, x },\n    sign(url, now) {\n      const created = Math.floor(now / 1000);\n      return signParts(\n        {\n          authority: url.host.toLowerCase(),\n          label,\n          agentKey: label,\n          agentValue: agent.value,\n          keyId: publicKey.kid,\n          created,\n          expires: created + Math.ceil(lifetimeMs / 1000),\n          nonce: randomBytes(32).toString(\"base64\"),\n        },\n        key,\n      );\n    },\n  };\n};\n\n/** This function tells if a value is a request signer, not the options of one. */\nexport const isRequestSigner = (value: RequestSigner | WebBotAuthOptions): value is RequestSigner =>\n  typeof (value as Partial<RequestSigner>).sign === \"function\";\n\n/** This function gives a request signer: the signer itself, or a new signer from its options. */\nexport const signerOf = (\n  value: RequestSigner | WebBotAuthOptions | undefined,\n): RequestSigner | undefined =>\n  value === undefined ? undefined : isRequestSigner(value) ? value : createWebBotAuthSigner(value);\n\n// ── verification ──\n\n/** A signature can start this long before the clock of the verifier, for a small difference of the clocks. */\nconst CLOCK_SKEW_S = 60;\n\nconst headerLines = (\n  headers: SignedRequest[\"headers\"],\n  name: string,\n): readonly string[] | undefined => {\n  for (const [key, value] of Object.entries(headers)) {\n    if (key.toLowerCase() !== name || value === undefined) continue;\n    return typeof value === \"string\" ? [value] : value;\n  }\n  return undefined;\n};\n\n/** This function gives the value of a header as RFC 9421 section 2.1 combines it: each line without its outer spaces, with \", \" between. */\nconst fieldValue = (headers: SignedRequest[\"headers\"], name: string): string | undefined =>\n  headerLines(headers, name)\n    ?.map((line) => line.replace(/\\r?\\n[ \\t]+/g, \" \").trim())\n    .join(\", \");\n\n/** This function gives the value of one component of a request, or an error text. */\nconst componentValue = (\n  component: Item,\n  request: SignedRequest,\n  target: URL,\n): { readonly value: string } | { readonly error: string } => {\n  const name = component.value;\n  if (typeof name !== \"string\") return { error: \"a component is not a string\" };\n  const params = new Map(component.params);\n  if (name.startsWith(\"@\")) {\n    if (params.size > 0) return { error: `the parameters of ${name} are not supported` };\n    switch (name) {\n      case \"@method\":\n        return { value: (request.method ?? \"GET\").toUpperCase() };\n      case \"@authority\":\n        return { value: target.host.toLowerCase() };\n      case \"@scheme\":\n        return { value: target.protocol.slice(0, -1).toLowerCase() };\n      case \"@target-uri\":\n        return { value: target.href };\n      case \"@path\":\n        return { value: target.pathname === \"\" ? \"/\" : target.pathname };\n      case \"@query\":\n        return { value: target.search === \"\" ? \"?\" : target.search };\n      case \"@request-target\":\n        return { value: `${target.pathname}${target.search}` };\n      default:\n        return { error: `the component ${name} is not supported` };\n    }\n  }\n  const value = fieldValue(request.headers, name);\n  if (value === undefined) return { error: `the request has no ${name} header` };\n  if ([...params.keys()].some((param) => param !== \"key\"))\n    return { error: `the parameters of ${name} are not supported` };\n  const key = params.get(\"key\");\n  if (key === undefined) return { value };\n  if (typeof key !== \"string\") return { error: `the key of ${name} is not a string` };\n  let member: Member | undefined;\n  try {\n    member = new FieldParser(value).dictionary().get(key);\n  } catch (error) {\n    return { error: `the ${name} header is not a dictionary: ${(error as Error).message}` };\n  }\n  if (member === undefined) return { error: `the ${name} header has no member ${key}` };\n  return { value: serializeMember(member) };\n};\n\nconst failed = (\n  reason: string,\n  facts: { label?: string | null; keyId?: string | null; agent?: string | null } = {},\n): SignatureCheck => ({\n  verified: false,\n  label: facts.label ?? null,\n  keyId: facts.keyId ?? null,\n  agent: facts.agent ?? null,\n  reason,\n});\n\n/**\n * This function verifies the Web Bot Auth signatures of a request with the keys of a directory. It\n * applies RFC 9421 section 3.2 and the profile of the draft. The profile asks for the tag\n * `web-bot-auth`, `created`, `expires` and `@authority`. It also asks for the member of\n * `Signature-Agent`, and a key with the thumbprint of `keyid`. The tests use it, and an operator can check a setup with it. It sends no request.\n */\nexport const verifySignature = (\n  request: SignedRequest,\n  directory: KeyDirectory,\n  options: { readonly now?: number | undefined } = {},\n): SignatureCheck => {\n  let target: URL;\n  try {\n    target = new URL(request.url);\n  } catch {\n    return failed(\"the URL of the request is not a URL\");\n  }\n  const inputText = fieldValue(request.headers, \"signature-input\");\n  const signatureText = fieldValue(request.headers, \"signature\");\n  if (inputText === undefined || signatureText === undefined)\n    return failed(\"the request has no Signature-Input or no Signature header\");\n  let inputs: Map<string, Member>;\n  let signatures: Map<string, Member>;\n  try {\n    inputs = new FieldParser(inputText).dictionary();\n    signatures = new FieldParser(signatureText).dictionary();\n  } catch (error) {\n    return failed(`a signature header does not parse: ${(error as Error).message}`);\n  }\n  const now = Math.floor((options.now ?? Date.now()) / 1000);\n  const keys = new Map<string, KeyObject>();\n  for (const entry of directory.keys) {\n    try {\n      const key = createPublicKey({\n        key: { kty: entry.kty, crv: entry.crv, x: entry.x },\n        format: \"jwk\",\n      });\n      keys.set(thumbprintOf(entry.x), key);\n    } catch {\n      // a key that does not parse verifies nothing\n    }\n  }\n  let last: SignatureCheck = failed(\"the request has no Web Bot Auth signature\");\n  for (const [label, input] of inputs) {\n    if (!isInnerList(input)) continue;\n    const params = new Map(input.params);\n    if (params.get(\"tag\") !== WEB_BOT_AUTH_TAG) continue;\n    const keyId = typeof params.get(\"keyid\") === \"string\" ? (params.get(\"keyid\") as string) : null;\n    const covered = input.items;\n    const names = covered.map((item) => serializeItem(item));\n    const agentItem = covered.find((item) => item.value === \"signature-agent\");\n    let agent: string | null = null;\n    if (agentItem !== undefined) {\n      const value = componentValue(agentItem, request, target);\n      if (\"value\" in value) {\n        try {\n          const member = new FieldParser(value.value).wholeItem().value;\n          agent = typeof member === \"string\" ? member : null;\n        } catch {\n          agent = null;\n        }\n      }\n    }\n    const facts = { label, keyId, agent };\n    if (new Set(names).size !== names.length) {\n      last = failed(\"a component is covered two times\", facts);\n      continue;\n    }\n    if (!names.includes('\"@authority\"') && !names.includes('\"@target-uri\"')) {\n      last = failed(\"the signature does not cover @authority or @target-uri\", facts);\n      continue;\n    }\n    if (agentItem === undefined) {\n      last = failed(\"the signature does not cover Signature-Agent\", facts);\n      continue;\n    }\n    const created = params.get(\"created\");\n    const expires = params.get(\"expires\");\n    if (typeof created !== \"number\" || typeof expires !== \"number\") {\n      last = failed(\"the signature has no created or no expires\", facts);\n      continue;\n    }\n    if (expires <= now) {\n      last = failed(\"the signature expired\", facts);\n      continue;\n    }\n    if (created > now + CLOCK_SKEW_S) {\n      last = failed(\"the signature was created in the future\", facts);\n      continue;\n    }\n    const alg = params.get(\"alg\");\n    if (alg !== undefined && alg !== \"ed25519\") {\n      last = failed(`the algorithm ${serializeBare(alg)} is not ed25519`, facts);\n      continue;\n    }\n    const key = keyId === null ? undefined : keys.get(keyId);\n    if (key === undefined) {\n      last = failed(\"no key of the directory has the thumbprint of keyid\", facts);\n      continue;\n    }\n    const lines: string[] = [];\n    let error: string | undefined;\n    for (const item of covered) {\n      const value = componentValue(item, request, target);\n      if (\"error\" in value) {\n        error = value.error;\n        break;\n      }\n      lines.push(`${serializeItem(item)}: ${value.value}`);\n    }\n    if (error !== undefined) {\n      last = failed(error, facts);\n      continue;\n    }\n    lines.push(`\"@signature-params\": ${serializeMember(input)}`);\n    const signature = signatures.get(label);\n    if (\n      signature === undefined ||\n      isInnerList(signature) ||\n      !(signature.value instanceof Uint8Array)\n    ) {\n      last = failed(`the Signature header has no byte sequence for ${label}`, facts);\n      continue;\n    }\n    const good = verifyBytes(null, Buffer.from(lines.join(\"\\n\"), \"utf8\"), key, signature.value);\n    if (good) return { verified: true, label, keyId, agent, reason: null };\n    last = failed(\"the signature does not match the signature base\", facts);\n  }\n  return last;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0BA,MAAa,qBAAqB;;AAGlC,MAAa,qBAAqB;;AAGlC,MAAa,mBAAmB;;AAoGhC,IAAM,QAAN,MAAY;CACW;CAArB,YAAY,OAAwB;EAAf,KAAA,QAAA;CAAgB;AACvC;AAiBA,MAAM,eAAe,WAAwC,WAAW;;AAGxE,IAAM,aAAN,cAAyB,MAAM,CAAC;AAEhC,MAAM,YAAY;AAClB,MAAM,WAAW;AACjB,MAAM,cAAc;AACpB,MAAM,aAAa;AACnB,MAAM,SAAS;;AAGf,IAAM,cAAN,MAAkB;CAEa;CAD7B,KAAa;CACb,YAAY,MAA+B;EAAd,KAAA,OAAA;CAAe;CAE5C,OAAuB;EACrB,OAAO,KAAK,KAAK,KAAK,OAAO;CAC/B;CAEA,SAAuB;EACrB,OAAO,KAAK,KAAK,MAAM,KAAK,KAAK,MAAM;CACzC;CAEA,MAAoB;EAClB,OAAO,KAAK,KAAK,MAAM,OAAO,KAAK,KAAK,MAAM,KAAM,KAAK,MAAM;CACjE;CAEA,aAAkC;EAChC,MAAM,sBAAM,IAAI,IAAoB;EACpC,KAAK,OAAO;EACZ,OAAO,KAAK,KAAK,KAAK,KAAK,QAAQ;GACjC,MAAM,MAAM,KAAK,IAAI;GACrB,IAAI;GACJ,IAAI,KAAK,KAAK,MAAM,KAAK;IACvB,KAAK,MAAM;IACX,SAAS,KAAK,KAAK,MAAM,MAAM,KAAK,UAAU,IAAI,KAAK,KAAK;GAC9D,OACE,SAAS;IAAE,OAAO;IAAM,QAAQ,KAAK,OAAO;GAAE;GAEhD,IAAI,IAAI,KAAK,MAAM;GACnB,KAAK,IAAI;GACT,IAAI,KAAK,MAAM,KAAK,KAAK,QAAQ;GACjC,IAAI,KAAK,KAAK,MAAM,KAAK,MAAM,IAAI,WAAW,yBAAyB,OAAO,KAAK,EAAE,GAAG;GACxF,KAAK,MAAM;GACX,KAAK,IAAI;GACT,IAAI,KAAK,MAAM,KAAK,KAAK,QAAQ,MAAM,IAAI,WAAW,6BAA6B;EACrF;EACA,OAAO;CACT;;CAGA,YAAkB;EAChB,KAAK,OAAO;EACZ,MAAM,OAAO,KAAK,KAAK;EACvB,KAAK,OAAO;EACZ,IAAI,KAAK,KAAK,KAAK,KAAK,QAAQ,MAAM,IAAI,WAAW,qBAAqB;EAC1E,OAAO;CACT;CAEA,MAAsB;EACpB,IAAI,CAAC,UAAU,KAAK,KAAK,KAAK,CAAC,GAAG,MAAM,IAAI,WAAW,aAAa,OAAO,KAAK,EAAE,GAAG;EACrF,MAAM,QAAQ,KAAK;EACnB,OAAO,SAAS,KAAK,KAAK,KAAK,CAAC,KAAK,KAAK,KAAK,KAAK,KAAK,QAAQ,KAAK,MAAM;EAC5E,OAAO,KAAK,KAAK,MAAM,OAAO,KAAK,EAAE;CACvC;CAEA,YAA+B;EAC7B,KAAK,MAAM;EACX,MAAM,QAAgB,CAAC;EACvB,SAAS;GACP,KAAK,OAAO;GACZ,IAAI,KAAK,KAAK,MAAM,KAAK;IACvB,KAAK,MAAM;IACX,OAAO;KAAE;KAAO,QAAQ,KAAK,OAAO;IAAE;GACxC;GACA,IAAI,KAAK,MAAM,KAAK,KAAK,QAAQ,MAAM,IAAI,WAAW,0BAA0B;GAChF,MAAM,KAAK,KAAK,KAAK,CAAC;GACtB,IAAI,KAAK,KAAK,MAAM,OAAO,KAAK,KAAK,MAAM,KACzC,MAAM,IAAI,WAAW,kCAAkC,OAAO,KAAK,EAAE,GAAG;EAC5E;CACF;CAEA,OAAqB;EAEnB,OAAO;GAAE,OADK,KAAK,KACN;GAAG,QAAQ,KAAK,OAAO;EAAE;CACxC;CAEA,SAAyB;EACvB,MAAM,MAA0C,CAAC;EACjD,OAAO,KAAK,KAAK,MAAM,KAAK;GAC1B,KAAK,MAAM;GACX,KAAK,OAAO;GACZ,MAAM,MAAM,KAAK,IAAI;GACrB,IAAI,QAAkB;GACtB,IAAI,KAAK,KAAK,MAAM,KAAK;IACvB,KAAK,MAAM;IACX,QAAQ,KAAK,KAAK;GACpB;GACA,MAAM,QAAQ,IAAI,WAAW,CAAC,UAAU,SAAS,GAAG;GACpD,IAAI,UAAU,IAAI,IAAI,KAAK,CAAC,KAAK,KAAK,CAAC;QAClC,IAAI,SAAS,CAAC,KAAK,KAAK;EAC/B;EACA,OAAO;CACT;CAEA,OAAyB;EACvB,MAAM,OAAO,KAAK,KAAK;EACvB,IAAI,SAAS,OAAO,QAAQ,KAAK,IAAI,GAAG,OAAO,KAAK,OAAO;EAC3D,IAAI,SAAS,MAAK,OAAO,KAAK,OAAO;EACrC,IAAI,SAAS,KAAK,OAAO,KAAK,MAAM;EACpC,IAAI,SAAS,KAAK,OAAO,KAAK,QAAQ;EACtC,IAAI,YAAY,KAAK,IAAI,GAAG,OAAO,KAAK,MAAM;EAC9C,MAAM,IAAI,WAAW,cAAc,OAAO,KAAK,EAAE,GAAG;CACtD;CAEA,SAAyB;EACvB,MAAM,QAAQ,4BAA4B,KAAK,KAAK,KAAK,MAAM,KAAK,EAAE,CAAC;EACvE,IAAI,UAAU,QAAS,MAAM,OAAO,KAAA,KAAa,MAAM,EAAE,CAAE,SAAS,IAClE,MAAM,IAAI,WAAW,mBAAmB,OAAO,KAAK,EAAE,GAAG;EAC3D,KAAK,MAAM,MAAM,EAAE,CAAC;EACpB,OAAO,OAAO,MAAM,EAAE;CACxB;CAEA,SAAyB;EACvB,KAAK,MAAM;EACX,IAAI,MAAM;EACV,SAAS;GACP,MAAM,OAAO,KAAK,KAAK;GACvB,IAAI,SAAS,IAAI,MAAM,IAAI,WAAW,qBAAqB;GAC3D,KAAK,MAAM;GACX,IAAI,SAAS,MAAM;IACjB,MAAM,OAAO,KAAK,KAAK;IACvB,IAAI,SAAS,QAAO,SAAS,MAAM,MAAM,IAAI,WAAW,0BAA0B;IAClF,OAAO;IACP,KAAK,MAAM;GACb,OAAO,IAAI,SAAS,MAClB,OAAO;QACF;IACL,MAAM,OAAO,KAAK,WAAW,CAAC;IAC9B,IAAI,OAAO,MAAQ,OAAO,KACxB,MAAM,IAAI,WAAW,wDAAwD;IAC/E,OAAO;GACT;EACF;CACF;CAEA,QAA4B;EAC1B,KAAK,MAAM;EACX,MAAM,MAAM,KAAK,KAAK,QAAQ,KAAK,KAAK,EAAE;EAC1C,IAAI,QAAQ,IAAI,MAAM,IAAI,WAAW,4BAA4B;EACjE,MAAM,OAAO,KAAK,KAAK,MAAM,KAAK,IAAI,GAAG;EACzC,IAAI,CAAC,OAAO,KAAK,IAAI,GAAG,MAAM,IAAI,WAAW,+BAA+B;EAC5E,KAAK,KAAK,MAAM;EAChB,OAAO,IAAI,WAAW,OAAO,KAAK,MAAM,QAAQ,CAAC;CACnD;CAEA,UAA2B;EACzB,MAAM,QAAQ,KAAK,KAAK,MAAM,KAAK,IAAI,KAAK,KAAK,CAAC;EAClD,IAAI,UAAU,QAAQ,UAAU,MAAM,MAAM,IAAI,WAAW,eAAe;EAC1E,KAAK,MAAM;EACX,OAAO,UAAU;CACnB;CAEA,QAAuB;EACrB,MAAM,QAAQ,KAAK;EACnB,KAAK,MAAM;EACX,OAAO,WAAW,KAAK,KAAK,KAAK,CAAC,KAAK,KAAK,KAAK,KAAK,KAAK,QAAQ,KAAK,MAAM;EAC9E,OAAO,IAAI,MAAM,KAAK,KAAK,MAAM,OAAO,KAAK,EAAE,CAAC;CAClD;AACF;AAEA,MAAM,iBAAiB,UAA4B;CACjD,IAAI,iBAAiB,OAAO,OAAO,MAAM;CACzC,IAAI,iBAAiB,YAAY,OAAO,IAAI,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,QAAQ,EAAE;CAClF,IAAI,OAAO,UAAU,WAAW,OAAO,QAAQ,OAAO;CACtD,IAAI,OAAO,UAAU,UACnB,OAAO,OAAO,UAAU,KAAK,IAAI,OAAO,KAAK,IAAI,OAAO,KAAK,MAAM,QAAQ,GAAI,IAAI,GAAI;CACzF,OAAO,IAAI,MAAM,QAAQ,WAAW,SAAS,KAAK,MAAM,EAAE;AAC5D;AAEA,MAAM,mBAAmB,WACvB,OACG,KAAK,CAAC,KAAK,WAAY,UAAU,OAAO,IAAI,QAAQ,IAAI,IAAI,GAAG,cAAc,KAAK,GAAI,CAAC,CACvF,KAAK,EAAE;AAEZ,MAAM,iBAAiB,SACrB,GAAG,cAAc,KAAK,KAAK,IAAI,gBAAgB,KAAK,MAAM;AAE5D,MAAM,mBAAmB,WACvB,YAAY,MAAM,IACd,IAAI,OAAO,MAAM,IAAI,aAAa,CAAC,CAAC,KAAK,GAAG,EAAE,GAAG,gBAAgB,OAAO,MAAM,MAC9E,cAAc,MAAM;;AAG1B,MAAM,SAAS,SAA0B,yBAAyB,KAAK,IAAI;AAI3E,MAAM,aAAa,UAA8B,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,WAAW;AAExF,MAAM,eAAe,QACnB,OAAO,QAAQ,YAAY,QAAQ,QAAQ,uBAAuB,OAAO,YAAY;;AAGvF,MAAM,gBAAgB,UAA+B;CACnD,IAAI;CACJ,IAAI;EACF,IAAI,YAAY,KAAK,GAAG,MAAM;OACzB,IAAI,OAAO,UAAU,UACxB,MAAM,MAAM,KAAK,CAAC,CAAC,WAAW,GAAG,IAC7B,iBAAiB;GAAE,KAAK,KAAK,MAAM,KAAK;GAAiB,QAAQ;EAAM,CAAC,IACxE,iBAAiB,KAAK;OACvB,IAAI,iBAAiB,YACxB,MAAM,iBAAiB;GAAE,KAAK,OAAO,KAAK,KAAK;GAAG,QAAQ;GAAO,MAAM;EAAQ,CAAC;OAC7E,MAAM,iBAAiB;GAAE,KAAK;GAAO,QAAQ;EAAM,CAAC;CAC3D,SAAS,OAAO;EACd,MAAM,IAAI,MACR,wGACA,EAAE,MAAM,CACV;CACF;CACA,IAAI,IAAI,SAAS,WACf,MAAM,IAAI,MAAM,0EAA0E;CAC5F,IAAI,IAAI,sBAAsB,WAC5B,MAAM,IAAI,MACR,4BAA4B,IAAI,qBAAqB,wBAAwB,mDAC/E;CACF,OAAO;AACT;;AAGA,MAAM,eAAe,UAA+B;CAClD,IAAI;CACJ,IAAI;EACF,IAAI,YAAY,KAAK,GAAG,MAAM,MAAM,SAAS,YAAY,gBAAgB,KAAK,IAAI;OAC7E,IAAI,OAAO,UAAU,UACxB,MAAM,MAAM,KAAK,CAAC,CAAC,WAAW,GAAG,IAC7B,gBAAgB;GAAE,KAAK,KAAK,MAAM,KAAK;GAAiB,QAAQ;EAAM,CAAC,IACvE,gBAAgB,KAAK;OACtB,IAAI,iBAAiB,YAAY;GACpC,MAAM,QAAQ,OAAO,KAAK,KAAK;GAC/B,IAAI;IACF,MAAM,gBAAgB;KAAE,KAAK;KAAO,QAAQ;KAAO,MAAM;IAAO,CAAC;GACnE,QAAQ;IACN,MAAM,gBAAgB,iBAAiB;KAAE,KAAK;KAAO,QAAQ;KAAO,MAAM;IAAQ,CAAC,CAAC;GACtF;EACF,OAAO,MAAM,gBAAgB;GAAE,KAAK;GAAO,QAAQ;EAAM,CAAC;CAC5D,SAAS,OAAO;EACd,MAAM,IAAI,MAAM,8DAA8D,EAAE,MAAM,CAAC;CACzF;CACA,IAAI,IAAI,sBAAsB,WAC5B,MAAM,IAAI,MACR,6BAA6B,IAAI,qBAAqB,wBAAwB,cAChF;CACF,OAAO;AACT;;AAGA,MAAM,gBAAgB,MACpB,UACE,WAAW,QAAQ,CAAC,CACjB,OAAO,KAAK,UAAU;CAAE,KAAK;CAAW,KAAK;CAAO;AAAE,CAAC,GAAG,MAAM,CAAC,CACjE,OAAO,CACZ;AAEF,MAAM,kBAAkB,QAAiC;CACvD,MAAM,MAAM,IAAI,OAAO,EAAE,QAAQ,MAAM,CAAC;CACxC,MAAM,IAAI,OAAO,IAAI,MAAM,WAAW,IAAI,IAAI;CAC9C,OAAO;EAAE,KAAK;EAAO,KAAK;EAAW,KAAK,aAAa,CAAC;EAAG;EAAG,KAAK;CAAM;AAC3E;;;;;;AAOA,MAAa,gBAAgB,eAAkD;CAC7E,MAAM,uBAAO,IAAI,IAA0B;CAC3C,KAAK,MAAM,SAAS,YAAY;EAC9B,MAAM,MAAM,eAAe,YAAY,KAAK,CAAC;EAC7C,KAAK,IAAI,IAAI,KAAK,GAAG;CACvB;CACA,OAAO,EAAE,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,EAAE;AACpC;;AAoBA,MAAM,mBAAmB,UACvB,uCAAuC,cAAc,MAAM,QAAQ,EAAE,YAAY,OAAO,MAAM,OAAO,EAAE,SAAS,cAAc,MAAM,KAAK,EAAE,yBAAyB,OAAO,MAAM,OAAO,IAAI,MAAM,UAAU,KAAA,IAAY,KAAK,UAAU,cAAc,MAAM,KAAK,IAAI,QAAQ,iBAAiB;;AAG/R,MAAa,iBAAiB,UAC5B;CACE,iBAAiB,MAAM;CACvB,yBAAyB,cAAc,MAAM,QAAQ,EAAE,IAAI,MAAM;CACjE,wBAAwB,gBAAgB,KAAK;AAC/C,CAAC,CAAC,KAAK,IAAI;;AAGb,MAAa,aACX,OACA,QAKG;CACH,MAAM,YAAYA,KAAU,MAAM,OAAO,KAAK,cAAc,KAAK,GAAG,MAAM,GAAG,GAAG;CAChF,OAAO;EACL,mBAAmB,GAAG,MAAM,SAAS,GAAG,MAAM;EAC9C,mBAAmB,GAAG,MAAM,MAAM,GAAG,gBAAgB,KAAK;EAC1D,WAAW,GAAG,MAAM,MAAM,IAAI,UAAU,SAAS,QAAQ,EAAE;CAC7D;AACF;AAEA,MAAM,sBAAsB;AAC5B,MAAM,kBAAkB;;AAGxB,MAAM,WACJ,KACA,SACqD;CACrD,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,IAAI,GAAG;CACtB,QAAQ;EACN,MAAM,IAAI,MACR,mBAAmB,IAAI,wDACzB;CACF;CACA,IAAI,OAAO,aAAa,UACtB,MAAM,IAAI,MAAM,mBAAmB,IAAI,oDAAoD;CAC7F,IAAI,OAAO,aAAa,MAAM,OAAO,aAAa,MAAM,OAAO,SAAS,IACtE,MAAM,IAAI,MAAM,mBAAmB,IAAI,4CAA4C;CACrF,IAAI,SAAS,aAAa;EACxB,IAAI,OAAO,aAAa,OAAO,OAAO,WAAW,IAC/C,MAAM,IAAI,MACR,mBAAmB,IAAI,iJACzB;EACF,OAAO;GAAE,KAAK,OAAO;GAAQ,OAAO,cAAc,OAAO,MAAM;EAAE;CACnE;CACA,OAAO;EAAE,KAAK,OAAO;EAAM,OAAO,GAAG,cAAc,OAAO,IAAI,EAAE,QAAQ;CAAO;AACjF;;;;;;AAOA,MAAa,0BAA0B,YAAiD;CACtF,MAAM,MAAM,aAAa,QAAQ,UAAU;CAC3C,MAAM,YAAY,eAAe,gBAAgB,GAAG,CAAC;CACrD,IAAI,QAAQ,UAAU,KAAA,KAAa,QAAQ,UAAU,UAAU,KAC7D,MAAM,IAAI,MACR,UAAU,QAAQ,MAAM,0CAA0C,UAAU,IAAI,6CAClF;CACF,MAAM,QAAQ,QAAQ,QAAQ,gBAAgB,QAAQ,aAAa,WAAW;CAC9E,MAAM,QAAQ,QAAQ,SAAS;CAC/B,IAAI,CAAC,MAAM,KAAK,GACd,MAAM,IAAI,MACR,UAAU,MAAM,2FAClB;CACF,MAAM,aAAa,QAAQ,cAAc;CACzC,IAAI,CAAC,OAAO,SAAS,UAAU,KAAK,aAAa,OAAQ,aAAa,iBACpE,MAAM,IAAI,WACR,8CAA8C,OAAO,eAAe,EAAE,mBAAmB,OAAO,UAAU,GAC5G;CACF,MAAM,EAAE,KAAK,KAAK,MAAM;CACxB,OAAO;EACL,OAAO,UAAU;EACjB,gBAAgB,MAAM;EACtB,WAAW;GAAE;GAAK;GAAK;EAAE;EACzB,KAAK,KAAK,KAAK;GACb,MAAM,UAAU,KAAK,MAAM,MAAM,GAAI;GACrC,OAAO,UACL;IACE,WAAW,IAAI,KAAK,YAAY;IAChC;IACA,UAAU;IACV,YAAY,MAAM;IAClB,OAAO,UAAU;IACjB;IACA,SAAS,UAAU,KAAK,KAAK,aAAa,GAAI;IAC9C,OAAO,YAAY,EAAE,CAAC,CAAC,SAAS,QAAQ;GAC1C,GACA,GACF;EACF;CACF;AACF;;AAGA,MAAa,mBAAmB,UAC9B,OAAQ,MAAiC,SAAS;;AAGpD,MAAa,YACX,UAEA,UAAU,KAAA,IAAY,KAAA,IAAY,gBAAgB,KAAK,IAAI,QAAQ,uBAAuB,KAAK;;AAKjG,MAAM,eAAe;AAErB,MAAM,eACJ,SACA,SACkC;CAClC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAAG;EAClD,IAAI,IAAI,YAAY,MAAM,QAAQ,UAAU,KAAA,GAAW;EACvD,OAAO,OAAO,UAAU,WAAW,CAAC,KAAK,IAAI;CAC/C;AAEF;;AAGA,MAAM,cAAc,SAAmC,SACrD,YAAY,SAAS,IAAI,CAAC,EACtB,KAAK,SAAS,KAAK,QAAQ,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CACxD,KAAK,IAAI;;AAGd,MAAM,kBACJ,WACA,SACA,WAC4D;CAC5D,MAAM,OAAO,UAAU;CACvB,IAAI,OAAO,SAAS,UAAU,OAAO,EAAE,OAAO,8BAA8B;CAC5E,MAAM,SAAS,IAAI,IAAI,UAAU,MAAM;CACvC,IAAI,KAAK,WAAW,GAAG,GAAG;EACxB,IAAI,OAAO,OAAO,GAAG,OAAO,EAAE,OAAO,qBAAqB,KAAK,oBAAoB;EACnF,QAAQ,MAAR;GACE,KAAK,WACH,OAAO,EAAE,QAAQ,QAAQ,UAAU,MAAA,CAAO,YAAY,EAAE;GAC1D,KAAK,cACH,OAAO,EAAE,OAAO,OAAO,KAAK,YAAY,EAAE;GAC5C,KAAK,WACH,OAAO,EAAE,OAAO,OAAO,SAAS,MAAM,GAAG,EAAE,CAAC,CAAC,YAAY,EAAE;GAC7D,KAAK,eACH,OAAO,EAAE,OAAO,OAAO,KAAK;GAC9B,KAAK,SACH,OAAO,EAAE,OAAO,OAAO,aAAa,KAAK,MAAM,OAAO,SAAS;GACjE,KAAK,UACH,OAAO,EAAE,OAAO,OAAO,WAAW,KAAK,MAAM,OAAO,OAAO;GAC7D,KAAK,mBACH,OAAO,EAAE,OAAO,GAAG,OAAO,WAAW,OAAO,SAAS;GACvD,SACE,OAAO,EAAE,OAAO,iBAAiB,KAAK,mBAAmB;EAC7D;CACF;CACA,MAAM,QAAQ,WAAW,QAAQ,SAAS,IAAI;CAC9C,IAAI,UAAU,KAAA,GAAW,OAAO,EAAE,OAAO,sBAAsB,KAAK,SAAS;CAC7E,IAAI,CAAC,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,UAAU,UAAU,KAAK,GACpD,OAAO,EAAE,OAAO,qBAAqB,KAAK,oBAAoB;CAChE,MAAM,MAAM,OAAO,IAAI,KAAK;CAC5B,IAAI,QAAQ,KAAA,GAAW,OAAO,EAAE,MAAM;CACtC,IAAI,OAAO,QAAQ,UAAU,OAAO,EAAE,OAAO,cAAc,KAAK,kBAAkB;CAClF,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,YAAY,KAAK,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,GAAG;CACtD,SAAS,OAAO;EACd,OAAO,EAAE,OAAO,OAAO,KAAK,+BAAgC,MAAgB,UAAU;CACxF;CACA,IAAI,WAAW,KAAA,GAAW,OAAO,EAAE,OAAO,OAAO,KAAK,wBAAwB,MAAM;CACpF,OAAO,EAAE,OAAO,gBAAgB,MAAM,EAAE;AAC1C;AAEA,MAAM,UACJ,QACA,QAAiF,CAAC,OAC9D;CACpB,UAAU;CACV,OAAO,MAAM,SAAS;CACtB,OAAO,MAAM,SAAS;CACtB,OAAO,MAAM,SAAS;CACtB;AACF;;;;;;;AAQA,MAAa,mBACX,SACA,WACA,UAAiD,CAAC,MAC/B;CACnB,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,IAAI,QAAQ,GAAG;CAC9B,QAAQ;EACN,OAAO,OAAO,qCAAqC;CACrD;CACA,MAAM,YAAY,WAAW,QAAQ,SAAS,iBAAiB;CAC/D,MAAM,gBAAgB,WAAW,QAAQ,SAAS,WAAW;CAC7D,IAAI,cAAc,KAAA,KAAa,kBAAkB,KAAA,GAC/C,OAAO,OAAO,2DAA2D;CAC3E,IAAI;CACJ,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,YAAY,SAAS,CAAC,CAAC,WAAW;EAC/C,aAAa,IAAI,YAAY,aAAa,CAAC,CAAC,WAAW;CACzD,SAAS,OAAO;EACd,OAAO,OAAO,sCAAuC,MAAgB,SAAS;CAChF;CACA,MAAM,MAAM,KAAK,OAAO,QAAQ,OAAO,KAAK,IAAI,KAAK,GAAI;CACzD,MAAM,uBAAO,IAAI,IAAuB;CACxC,KAAK,MAAM,SAAS,UAAU,MAC5B,IAAI;EACF,MAAM,MAAM,gBAAgB;GAC1B,KAAK;IAAE,KAAK,MAAM;IAAK,KAAK,MAAM;IAAK,GAAG,MAAM;GAAE;GAClD,QAAQ;EACV,CAAC;EACD,KAAK,IAAI,aAAa,MAAM,CAAC,GAAG,GAAG;CACrC,QAAQ,CAER;CAEF,IAAI,OAAuB,OAAO,2CAA2C;CAC7E,KAAK,MAAM,CAAC,OAAO,UAAU,QAAQ;EACnC,IAAI,CAAC,YAAY,KAAK,GAAG;EACzB,MAAM,SAAS,IAAI,IAAI,MAAM,MAAM;EACnC,IAAI,OAAO,IAAI,KAAK,MAAA,gBAAwB;EAC5C,MAAM,QAAQ,OAAO,OAAO,IAAI,OAAO,MAAM,WAAY,OAAO,IAAI,OAAO,IAAe;EAC1F,MAAM,UAAU,MAAM;EACtB,MAAM,QAAQ,QAAQ,KAAK,SAAS,cAAc,IAAI,CAAC;EACvD,MAAM,YAAY,QAAQ,MAAM,SAAS,KAAK,UAAU,iBAAiB;EACzE,IAAI,QAAuB;EAC3B,IAAI,cAAc,KAAA,GAAW;GAC3B,MAAM,QAAQ,eAAe,WAAW,SAAS,MAAM;GACvD,IAAI,WAAW,OACb,IAAI;IACF,MAAM,SAAS,IAAI,YAAY,MAAM,KAAK,CAAC,CAAC,UAAU,CAAC,CAAC;IACxD,QAAQ,OAAO,WAAW,WAAW,SAAS;GAChD,QAAQ;IACN,QAAQ;GACV;EAEJ;EACA,MAAM,QAAQ;GAAE;GAAO;GAAO;EAAM;EACpC,IAAI,IAAI,IAAI,KAAK,CAAC,CAAC,SAAS,MAAM,QAAQ;GACxC,OAAO,OAAO,oCAAoC,KAAK;GACvD;EACF;EACA,IAAI,CAAC,MAAM,SAAS,gBAAc,KAAK,CAAC,MAAM,SAAS,iBAAe,GAAG;GACvE,OAAO,OAAO,0DAA0D,KAAK;GAC7E;EACF;EACA,IAAI,cAAc,KAAA,GAAW;GAC3B,OAAO,OAAO,gDAAgD,KAAK;GACnE;EACF;EACA,MAAM,UAAU,OAAO,IAAI,SAAS;EACpC,MAAM,UAAU,OAAO,IAAI,SAAS;EACpC,IAAI,OAAO,YAAY,YAAY,OAAO,YAAY,UAAU;GAC9D,OAAO,OAAO,8CAA8C,KAAK;GACjE;EACF;EACA,IAAI,WAAW,KAAK;GAClB,OAAO,OAAO,yBAAyB,KAAK;GAC5C;EACF;EACA,IAAI,UAAU,MAAM,cAAc;GAChC,OAAO,OAAO,2CAA2C,KAAK;GAC9D;EACF;EACA,MAAM,MAAM,OAAO,IAAI,KAAK;EAC5B,IAAI,QAAQ,KAAA,KAAa,QAAQ,WAAW;GAC1C,OAAO,OAAO,iBAAiB,cAAc,GAAG,EAAE,kBAAkB,KAAK;GACzE;EACF;EACA,MAAM,MAAM,UAAU,OAAO,KAAA,IAAY,KAAK,IAAI,KAAK;EACvD,IAAI,QAAQ,KAAA,GAAW;GACrB,OAAO,OAAO,uDAAuD,KAAK;GAC1E;EACF;EACA,MAAM,QAAkB,CAAC;EACzB,IAAI;EACJ,KAAK,MAAM,QAAQ,SAAS;GAC1B,MAAM,QAAQ,eAAe,MAAM,SAAS,MAAM;GAClD,IAAI,WAAW,OAAO;IACpB,QAAQ,MAAM;IACd;GACF;GACA,MAAM,KAAK,GAAG,cAAc,IAAI,EAAE,IAAI,MAAM,OAAO;EACrD;EACA,IAAI,UAAU,KAAA,GAAW;GACvB,OAAO,OAAO,OAAO,KAAK;GAC1B;EACF;EACA,MAAM,KAAK,wBAAwB,gBAAgB,KAAK,GAAG;EAC3D,MAAM,YAAY,WAAW,IAAI,KAAK;EACtC,IACE,cAAc,KAAA,KACd,YAAY,SAAS,KACrB,EAAE,UAAU,iBAAiB,aAC7B;GACA,OAAO,OAAO,iDAAiD,SAAS,KAAK;GAC7E;EACF;EAEA,IADaC,OAAY,MAAM,OAAO,KAAK,MAAM,KAAK,IAAI,GAAG,MAAM,GAAG,KAAK,UAAU,KAC9E,GAAG,OAAO;GAAE,UAAU;GAAM;GAAO;GAAO;GAAO,QAAQ;EAAK;EACrE,OAAO,OAAO,mDAAmD,KAAK;CACxE;CACA,OAAO;AACT"}