signet-protocol 1.10.1 → 1.11.0

package/dist/bot-ownership.d.ts

@@ -0,0 +1,61 @@
+import type { NostrEvent, UnsignedEvent } from './types.js';
+export declare const BOT_OWNERSHIP_TYPE = "bot-ownership";
+export declare const BOT_OWNERSHIP_POLICY: Readonly<{
+    defaultDays: 30;
+    minDays: 1;
+    maxDays: 90;
+    renewBeforeDays: 10;
+    retrySeconds: 86400;
+    clockToleranceSeconds: 300;
+}>;
+/** The caller selects a persona, obtains explicit creation consent, and signs
+ * this ordinary Nostr event through its existing local or NIP-46 backend. */
+export declare function buildBotOwnership(args: {
+    ownerPubkey: string;
+    botPubkey: string;
+    label: string;
+    now: number;
+    expiresAt?: number;
+}): UnsignedEvent;
+export declare function buildBotOwnershipRevocation(args: {
+    ownerPubkey: string;
+    botPubkey: string;
+    now: number;
+}): UnsignedEvent;
+export interface BotOwnershipClaim {
+    ownerPubkey: string;
+    botPubkey: string;
+    label: string;
+    issuedAt: number;
+    expiresAt: number;
+    eventId: string;
+}
+export type BotOwnershipResult = {
+    status: 'invalid';
+} | {
+    status: 'revoked';
+    ownerPubkey: string;
+    botPubkey: string;
+    eventId: string;
+} | {
+    status: 'valid' | 'lapsed';
+    claim: BotOwnershipClaim;
+};
+/** No ownership trust is inherited by the bot. Callers pin the expected persona
+ * and bot and separately establish that they selected the newest event. */
+export declare function readBotOwnership(event: NostrEvent, expected: {
+    ownerPubkey: string;
+    botPubkey: string;
+    now: number;
+    maxLifetimeDays?: number;
+}): Promise<BotOwnershipResult>;
+/** Same validation for synchronous transport/storage codecs. */
+export declare function readBotOwnershipSync(event: NostrEvent, expected: {
+    ownerPubkey: string;
+    botPubkey: string;
+    now: number;
+    maxLifetimeDays?: number;
+}): BotOwnershipResult;
+/** Scheduling only: hardware signing still needs its normal approval. */
+export declare function botOwnershipRenewalDue(result: BotOwnershipResult, now: number, lastAttemptAt?: number): boolean;
+//# sourceMappingURL=bot-ownership.d.ts.map

package/dist/bot-ownership.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bot-ownership.d.ts","sourceRoot":"","sources":["../src/bot-ownership.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC5D,eAAO,MAAM,kBAAkB,kBAAkB,CAAC;AAClD,eAAO,MAAM,oBAAoB;;;;;;;EACwC,CAAC;AAQ1E;6EAC6E;AAC7E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,aAAa,CAOjJ;AACD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,aAAa,CAIxH;AACD,MAAM,WAAW,iBAAiB;IAAG,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAClJ,MAAM,MAAM,kBAAkB,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACnI;IAAE,MAAM,EAAE,OAAO,GAAG,QAAQ,CAAC;IAAC,KAAK,EAAE,iBAAiB,CAAA;CAAE,CAAC;AAC7D;2EAC2E;AAC3E,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAElL;AACD,gEAAgE;AAChE,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,kBAAkB,CA+BvK;AACD,yEAAyE;AACzE,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,kBAAkB,EAAE,GAAG,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAI/G"}

package/dist/bot-ownership.js

@@ -0,0 +1,88 @@
+/** Draft bot ownership profile of nostr-attestations. Builders never publish. */
+import { createAttestation, createRevocation, buildDTag } from 'nostr-attestations';
+import { verifyEventSync } from './crypto.js';
+import { isSafeLabel } from './utils.js';
+export const BOT_OWNERSHIP_TYPE = 'bot-ownership';
+export const BOT_OWNERSHIP_POLICY = Object.freeze({ defaultDays: 30, minDays: 1, maxDays: 90,
+    renewBeforeDays: 10, retrySeconds: 86400, clockToleranceSeconds: 300 });
+const DAY = 86400, HEX = /^[0-9a-f]{64}$/;
+const stamp = (value) => Number.isSafeInteger(value) && Number(value) >= 0;
+const labelOk = (label) => typeof label === 'string' && !!label.trim() && label.length <= 100
+    && isSafeLabel(label);
+function validateParties(ownerPubkey, botPubkey, now) {
+    if (!HEX.test(ownerPubkey) || !HEX.test(botPubkey) || ownerPubkey === botPubkey || !stamp(now))
+        throw new Error('Invalid bot ownership parties or time');
+}
+/** The caller selects a persona, obtains explicit creation consent, and signs
+ * this ordinary Nostr event through its existing local or NIP-46 backend. */
+export function buildBotOwnership(args) {
+    validateParties(args.ownerPubkey, args.botPubkey, args.now);
+    const expiresAt = args.expiresAt ?? args.now + BOT_OWNERSHIP_POLICY.defaultDays * DAY;
+    if (!labelOk(args.label) || !stamp(expiresAt) || expiresAt < args.now + DAY || expiresAt > args.now + 90 * DAY)
+        throw new Error('Bot ownership requires a label and a lifetime from one to ninety days');
+    return { ...createAttestation({ type: BOT_OWNERSHIP_TYPE, subject: args.botPubkey,
+            validFrom: args.now, validTo: expiresAt, expiration: expiresAt,
+            content: JSON.stringify({ v: 1, label: args.label.trim() }) }), pubkey: args.ownerPubkey, created_at: args.now };
+}
+export function buildBotOwnershipRevocation(args) {
+    validateParties(args.ownerPubkey, args.botPubkey, args.now);
+    return { ...createRevocation({ type: BOT_OWNERSHIP_TYPE, identifier: args.botPubkey, subject: args.botPubkey,
+            effective: args.now }), pubkey: args.ownerPubkey, created_at: args.now };
+}
+/** No ownership trust is inherited by the bot. Callers pin the expected persona
+ * and bot and separately establish that they selected the newest event. */
+export async function readBotOwnership(event, expected) {
+    return readBotOwnershipSync(event, expected);
+}
+/** Same validation for synchronous transport/storage codecs. */
+export function readBotOwnershipSync(event, expected) {
+    const invalid = { status: 'invalid' };
+    const maximum = expected.maxLifetimeDays ?? BOT_OWNERSHIP_POLICY.maxDays;
+    if (!stamp(expected.now) || !Number.isSafeInteger(maximum) || maximum < 1 || maximum > 90
+        || !event || event.kind !== 31000 || event.pubkey !== expected.ownerPubkey || !HEX.test(expected.ownerPubkey)
+        || !HEX.test(expected.botPubkey) || expected.ownerPubkey === expected.botPubkey
+        || !stamp(event.created_at) || event.created_at > expected.now + BOT_OWNERSHIP_POLICY.clockToleranceSeconds
+        || typeof event.content !== 'string' || event.content.length > 1000 || !Array.isArray(event.tags) || event.tags.length > 16
+        || !event.tags.every(tag => Array.isArray(tag) && tag.length >= 2 && tag.length <= 4 && tag.every(value => typeof value === 'string' && value.length <= 256)))
+        return invalid;
+    const single = (name) => {
+        const values = event.tags.filter(tag => tag[0] === name);
+        return values.length === 1 ? values[0][1] : undefined;
+    };
+    if (single('d') !== buildDTag(BOT_OWNERSHIP_TYPE, expected.botPubkey) || single('type') !== BOT_OWNERSHIP_TYPE
+        || single('p') !== expected.botPubkey || !verifyEventSync(event))
+        return invalid;
+    const statuses = event.tags.filter(tag => tag[0] === 'status');
+    if (statuses.length) {
+        if (statuses.length !== 1 || statuses[0][1] !== 'revoked' || event.content !== '')
+            return invalid;
+        return { status: 'revoked', ownerPubkey: event.pubkey, botPubkey: expected.botPubkey, eventId: event.id };
+    }
+    const start = single('valid_from'), end = single('valid_to'), expiration = single('expiration');
+    if (start !== String(event.created_at) || !end || !/^\d+$/.test(end) || end !== expiration)
+        return invalid;
+    const declared = Number(end);
+    if (!stamp(declared) || declared < event.created_at + DAY)
+        return invalid;
+    let body;
+    try {
+        body = JSON.parse(event.content);
+    }
+    catch {
+        return invalid;
+    }
+    if (!body || body.v !== 1 || !labelOk(body.label))
+        return invalid;
+    // A user may choose a stricter ceiling. It never extends the signed expiry.
+    const expiresAt = Math.min(declared, event.created_at + maximum * DAY, event.created_at + 90 * DAY);
+    return { status: expected.now > expiresAt + BOT_OWNERSHIP_POLICY.clockToleranceSeconds ? 'lapsed' : 'valid',
+        claim: { ownerPubkey: event.pubkey, botPubkey: expected.botPubkey, label: body.label.trim(), issuedAt: event.created_at, expiresAt, eventId: event.id } };
+}
+/** Scheduling only: hardware signing still needs its normal approval. */
+export function botOwnershipRenewalDue(result, now, lastAttemptAt) {
+    if (!stamp(now) || (lastAttemptAt !== undefined && (!stamp(lastAttemptAt) || now - lastAttemptAt < BOT_OWNERSHIP_POLICY.retrySeconds)))
+        return false;
+    return (result.status === 'valid' || result.status === 'lapsed') && now >= result.claim.issuedAt
+        && result.claim.expiresAt - now <= BOT_OWNERSHIP_POLICY.renewBeforeDays * DAY;
+}
+//# sourceMappingURL=bot-ownership.js.map

package/dist/bot-ownership.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bot-ownership.js","sourceRoot":"","sources":["../src/bot-ownership.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,MAAM,CAAC,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAClD,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE;IAC1F,eAAe,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC;AAC1E,MAAM,GAAG,GAAG,KAAK,EAAE,GAAG,GAAG,gBAAgB,CAAC;AAC1C,MAAM,KAAK,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACrG,MAAM,OAAO,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG;OAClH,WAAW,CAAC,KAAK,CAAC,CAAC;AACxB,SAAS,eAAe,CAAC,WAAmB,EAAE,SAAiB,EAAE,GAAW;IAC1E,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;AAC3J,CAAC;AACD;6EAC6E;AAC7E,MAAM,UAAU,iBAAiB,CAAC,IAAgG;IAChI,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,GAAG,oBAAoB,CAAC,WAAW,GAAG,GAAG,CAAC;IACtF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,IAAI,CAAC,GAAG,GAAG,GAAG,IAAI,SAAS,GAAG,IAAI,CAAC,GAAG,GAAG,EAAE,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IACzM,OAAO,EAAE,GAAG,iBAAiB,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS;YAC/E,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS;YAC9D,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;AACrH,CAAC;AACD,MAAM,UAAU,2BAA2B,CAAC,IAA6D;IACvG,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5D,OAAO,EAAE,GAAG,gBAAgB,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS;YAC1G,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;AAC7E,CAAC;AAID;2EAC2E;AAC3E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAiB,EAAE,QAA2F;IACnJ,OAAO,oBAAoB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;AAC/C,CAAC;AACD,gEAAgE;AAChE,MAAM,UAAU,oBAAoB,CAAC,KAAiB,EAAE,QAA2F;IACjJ,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;IAC/C,MAAM,OAAO,GAAG,QAAQ,CAAC,eAAe,IAAI,oBAAoB,CAAC,OAAO,CAAC;IACzE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,EAAE;WACpF,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;WAC1G,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,WAAW,KAAK,QAAQ,CAAC,SAAS;WAC5E,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,UAAU,GAAG,QAAQ,CAAC,GAAG,GAAG,oBAAoB,CAAC,qBAAqB;WACxG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,EAAE;WACxH,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC;QAAE,OAAO,OAAO,CAAC;IAChL,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE;QAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QACzD,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxD,CAAC,CAAC;IACF,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,kBAAkB,EAAE,QAAQ,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,kBAAkB;WACzG,MAAM,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,SAAS,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IACnF,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;IAC/D,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpB,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,EAAE;YAAE,OAAO,OAAO,CAAC;QAClG,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;IAC5G,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;IAChG,IAAI,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,UAAU;QAAE,OAAO,OAAO,CAAC;IAC3G,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,KAAK,CAAC,UAAU,GAAG,GAAG;QAAE,OAAO,OAAO,CAAC;IAC1E,IAAI,IAAsC,CAAC;IAC3C,IAAI,CAAC;QAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,OAAO,CAAC;IAAC,CAAC;IACnE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IAClE,4EAA4E;IAC5E,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,GAAG,OAAO,GAAG,GAAG,EAAE,KAAK,CAAC,UAAU,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC;IACpG,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,GAAG,SAAS,GAAG,oBAAoB,CAAC,qBAAqB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO;QACzG,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;AAC9J,CAAC;AACD,yEAAyE;AACzE,MAAM,UAAU,sBAAsB,CAAC,MAA0B,EAAE,GAAW,EAAE,aAAsB;IACpG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,GAAG,GAAG,aAAa,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrJ,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,OAAO,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ;WAC3F,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,GAAG,IAAI,oBAAoB,CAAC,eAAe,GAAG,GAAG,CAAC;AAClF,CAAC"}

package/dist/crypto.d.ts

@@ -20,6 +20,8 @@ export declare function getEventId(event: UnsignedEvent): string;
 export declare function signEvent(event: UnsignedEvent, privateKey: string): Promise<NostrEvent>;
 /** Verify a signed Nostr event's signature */
 export declare function verifyEvent(event: NostrEvent): Promise<boolean>;
+/** Synchronous verification for codecs that must reject invalid events inline. */
+export declare function verifyEventSync(event: NostrEvent): boolean;
 /** SHA-256 hash of arbitrary data, returned as hex */
 export declare function hash(data: Uint8Array): string;
 /** SHA-256 hash of a UTF-8 string, returned as hex */

package/dist/crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE5D;;;;;;0EAM0E;AAC1E,wBAAgB,eAAe,IAAI;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAU3E;AAED,8DAA8D;AAC9D,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,mDAAmD;AACnD,wBAAgB,cAAc,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAS3D;AAED,6DAA6D;AAC7D,wBAAgB,UAAU,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAGvD;AAED,0DAA0D;AAC1D,wBAAsB,SAAS,CAC7B,KAAK,EAAE,aAAa,EACpB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,UAAU,CAAC,CAQrB;AAED,8CAA8C;AAC9C,wBAAsB,WAAW,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAQrE;AAED,sDAAsD;AACtD,wBAAgB,IAAI,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAE7C;AAED,sDAAsD;AACtD,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE/C"}
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE5D;;;;;;0EAM0E;AAC1E,wBAAgB,eAAe,IAAI;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAU3E;AAED,8DAA8D;AAC9D,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,mDAAmD;AACnD,wBAAgB,cAAc,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAS3D;AAED,6DAA6D;AAC7D,wBAAgB,UAAU,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAGvD;AAED,0DAA0D;AAC1D,wBAAsB,SAAS,CAC7B,KAAK,EAAE,aAAa,EACpB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,UAAU,CAAC,CAQrB;AAED,8CAA8C;AAC9C,wBAAsB,WAAW,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAErE;AAED,kFAAkF;AAClF,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAQ1D;AAED,sDAAsD;AACtD,wBAAgB,IAAI,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAE7C;AAED,sDAAsD;AACtD,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE/C"}

package/dist/crypto.js

@@ -54,6 +54,10 @@ export async function signEvent(event, privateKey) {
 }
 /** Verify a signed Nostr event's signature */
 export async function verifyEvent(event) {
+    return verifyEventSync(event);
+}
+/** Synchronous verification for codecs that must reject invalid events inline. */
+export function verifyEventSync(event) {
     try {
         const expectedId = getEventId(event);
         if (expectedId !== event.id)

package/dist/crypto.js.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA,iCAAiC;AACjC,kEAAkE;AAElE,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAGvC;;;;;;0EAM0E;AAC1E,MAAM,UAAU,eAAe;IAC7B,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;IACtD,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;IAC7C,MAAM,YAAY,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IAC3C,SAAS,CAAC,aAAa,CAAC,CAAC;IACzB,OAAO;QACL,UAAU;QACV,SAAS,EAAE,YAAY;KACxB,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,YAAY,CAAC,UAAkB;IAC7C,OAAO,UAAU,CAAC,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,cAAc,CAAC,KAAoB;IACjD,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,CAAC;QACD,KAAK,CAAC,MAAM;QACZ,KAAK,CAAC,UAAU;QAChB,KAAK,CAAC,IAAI;QACV,KAAK,CAAC,IAAI;QACV,KAAK,CAAC,OAAO;KACd,CAAC,CAAC;AACL,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,UAAU,CAAC,KAAoB;IAC7C,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,0DAA0D;AAC1D,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,KAAoB,EACpB,UAAkB;IAElB,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IACjE,OAAO;QACL,GAAG,KAAK;QACR,EAAE;QACF,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC;KACrB,CAAC;AACJ,CAAC;AAED,8CAA8C;AAC9C,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAiB;IACjD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,UAAU,KAAK,KAAK,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QAC1C,OAAO,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,IAAI,CAAC,IAAgB;IACnC,OAAO,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;AACjC,CAAC"}
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA,iCAAiC;AACjC,kEAAkE;AAElE,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAGvC;;;;;;0EAM0E;AAC1E,MAAM,UAAU,eAAe;IAC7B,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;IACtD,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;IAC7C,MAAM,YAAY,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IAC3C,SAAS,CAAC,aAAa,CAAC,CAAC;IACzB,OAAO;QACL,UAAU;QACV,SAAS,EAAE,YAAY;KACxB,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,YAAY,CAAC,UAAkB;IAC7C,OAAO,UAAU,CAAC,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,cAAc,CAAC,KAAoB;IACjD,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,CAAC;QACD,KAAK,CAAC,MAAM;QACZ,KAAK,CAAC,UAAU;QAChB,KAAK,CAAC,IAAI;QACV,KAAK,CAAC,IAAI;QACV,KAAK,CAAC,OAAO;KACd,CAAC,CAAC;AACL,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,UAAU,CAAC,KAAoB;IAC7C,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,0DAA0D;AAC1D,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,KAAoB,EACpB,UAAkB;IAElB,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IACjE,OAAO;QACL,GAAG,KAAK;QACR,EAAE;QACF,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC;KACrB,CAAC;AACJ,CAAC;AAED,8CAA8C;AAC9C,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAiB;IACjD,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAAC,KAAiB;IAC/C,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,UAAU,KAAK,KAAK,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QAC1C,OAAO,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,IAAI,CAAC,IAAgB;IACnC,OAAO,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;AACjC,CAAC"}

package/dist/experimental.d.ts

@@ -0,0 +1,19 @@
+/**
+ * signet-protocol/experimental — UNSTABLE, UNRELEASED draft contracts.
+ *
+ * The private vault checkpoint (docs/private-vault-v1.md) and the bot ownership
+ * profile (docs/bot-ownership-v1.md) are still under protocol review. Anything
+ * exported here may change or be removed in any release, including a minor or
+ * patch, without a deprecation period. Do not depend on it for production data.
+ * None of these names are exported from the package root.
+ */
+export { vaultPurpose, parseVaultPurpose, vaultKeyContext, deriveVaultIdentity, vaultIdentityFromMnemonic } from './vault-keys.js';
+export type { VaultDataset } from './vault-keys.js';
+export { VAULT_EVENT_KIND, MAX_VAULT_CHUNKS, MAX_VAULT_DEVICES, MAX_VAULT_CONTROL_BYTES, MAX_VAULT_CHUNK_BYTES, vaultCheckpointTag, vaultContentHash, parseVaultCheckpoint, matchesVaultChunk, vaultCheckpointShapedTag } from './vault-checkpoint.js';
+export type { VaultCheckpoint, VaultChunkRef } from './vault-checkpoint.js';
+export { readVaultSnapshot, readVaultRotations, readVaultHeads, readVaultHeadRotations, VAULT_CLOCK_TOLERANCE_SECONDS } from './vault-recovery.js';
+export type { VaultReadResult, VaultReader, VaultHeadsResult } from './vault-recovery.js';
+export { createVaultRelayReader, fetchVaultEvents, MAX_VAULT_EVENTS_PER_RELAY, VaultRelayError } from './vault-relay.js';
+export { BOT_OWNERSHIP_TYPE, BOT_OWNERSHIP_POLICY, buildBotOwnership, buildBotOwnershipRevocation, readBotOwnership, readBotOwnershipSync, botOwnershipRenewalDue } from './bot-ownership.js';
+export type { BotOwnershipClaim, BotOwnershipResult } from './bot-ownership.js';
+//# sourceMappingURL=experimental.d.ts.map

package/dist/experimental.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"experimental.d.ts","sourceRoot":"","sources":["../src/experimental.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,eAAe,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAA;AAClI,YAAY,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,uBAAuB,EACrF,qBAAqB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,oBAAoB,EACjF,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AAC5E,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAC3E,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,cAAc,EAAE,sBAAsB,EACpF,6BAA6B,EAAE,MAAM,qBAAqB,CAAA;AAC5D,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEzF,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAExH,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,2BAA2B,EAC/F,gBAAgB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC7F,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/experimental.js

@@ -0,0 +1,16 @@
+/**
+ * signet-protocol/experimental — UNSTABLE, UNRELEASED draft contracts.
+ *
+ * The private vault checkpoint (docs/private-vault-v1.md) and the bot ownership
+ * profile (docs/bot-ownership-v1.md) are still under protocol review. Anything
+ * exported here may change or be removed in any release, including a minor or
+ * patch, without a deprecation period. Do not depend on it for production data.
+ * None of these names are exported from the package root.
+ */
+// Private vault: dedicated dataset keys (flat derivation; index means rotation).
+export { vaultPurpose, parseVaultPurpose, vaultKeyContext, deriveVaultIdentity, vaultIdentityFromMnemonic } from './vault-keys.js';
+export { VAULT_EVENT_KIND, MAX_VAULT_CHUNKS, MAX_VAULT_DEVICES, MAX_VAULT_CONTROL_BYTES, MAX_VAULT_CHUNK_BYTES, vaultCheckpointTag, vaultContentHash, parseVaultCheckpoint, matchesVaultChunk, vaultCheckpointShapedTag } from './vault-checkpoint.js';
+export { readVaultSnapshot, readVaultRotations, readVaultHeads, readVaultHeadRotations, VAULT_CLOCK_TOLERANCE_SECONDS } from './vault-recovery.js';
+export { createVaultRelayReader, fetchVaultEvents, MAX_VAULT_EVENTS_PER_RELAY, VaultRelayError } from './vault-relay.js';
+export { BOT_OWNERSHIP_TYPE, BOT_OWNERSHIP_POLICY, buildBotOwnership, buildBotOwnershipRevocation, readBotOwnership, readBotOwnershipSync, botOwnershipRenewalDue } from './bot-ownership.js';
+//# sourceMappingURL=experimental.js.map

package/dist/experimental.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"experimental.js","sourceRoot":"","sources":["../src/experimental.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,iFAAiF;AACjF,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,eAAe,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAA;AAElI,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,uBAAuB,EACrF,qBAAqB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,oBAAoB,EACjF,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AAE5E,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,cAAc,EAAE,sBAAsB,EACpF,6BAA6B,EAAE,MAAM,qBAAqB,CAAA;AAG5D,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAExH,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,2BAA2B,EAC/F,gBAAgB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/index.js

@@ -103,4 +103,6 @@ export { getSignetMeDisplay, verifySignetMe, SIGNET_ME_ROTATION_SECONDS, SIGNET_
 export { buildVenueEntryEventTemplate, VENUE_ENTRY_KIND, } from './venue-entry.js';
 // Migration (kind 31000, type: migration — see spec/protocol.md §21.4.3)
 export { createMigrationEvent, parseMigrationEvent, followMigrationChain, } from './migration.js';
+// Private vault and bot-ownership contracts are unreleased drafts: import them
+// from 'signet-protocol/experimental'. Nothing from them is exported here.
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,gDAAgD;AAkDhD,kDAAkD;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAEnD,YAAY;AACZ,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,YAAY,EACZ,YAAY,EACZ,uBAAuB,EACvB,wBAAwB,EACxB,iCAAiC,EACjC,4BAA4B,EAC5B,mBAAmB,EACnB,aAAa,EACb,UAAU,EACV,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,YAAY,EACZ,sBAAsB,EACtB,aAAa,EACb,wBAAwB;AACxB,iBAAiB;AACjB,qBAAqB,EACrB,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AAExB,SAAS;AACT,OAAO,EACL,eAAe,EACf,YAAY,EACZ,SAAS,EACT,WAAW,EACX,UAAU,EACV,IAAI,EACJ,UAAU,GACX,MAAM,aAAa,CAAC;AAErB,6CAA6C;AAC7C,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,2BAA2B,EAC3B,4BAA4B,EAC5B,2BAA2B,EAC3B,gBAAgB,EAChB,mBAAmB,EACnB,eAAe;AACf,uCAAuC;AACvC,6BAA6B,EAC7B,kCAAkC,EAClC,0BAA0B;AAC1B,qBAAqB;AACrB,eAAe,EACf,YAAY;AACZ,0BAA0B;AAC1B,2BAA2B;AAC3B,kBAAkB;AAClB,UAAU;AACV,oBAAoB;AACpB,mBAAmB,EACnB,sBAAsB,EACtB,YAAY;AACZ,sBAAsB;AACtB,gBAAgB,EAChB,uBAAuB,EACvB,sBAAsB;AACtB,oCAAoC;AACpC,sBAAsB,EACtB,wBAAwB,EACxB,6BAA6B;AAC7B,sBAAsB;AACtB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAI1B,oCAAoC;AACpC,OAAO,EACL,eAAe,EACf,WAAW,EACX,UAAU,EACV,sBAAsB,EACtB,gBAAgB,EAChB,WAAW,GACZ,MAAM,cAAc,CAAC;AAEtB,+BAA+B;AAC/B,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,qBAAqB,EACrB,aAAa,GACd,MAAM,eAAe,CAAC;AAEvB,yCAAyC;AACzC,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,aAAa,EACb,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AAExB,6EAA6E;AAC7E,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,WAAW,EACX,eAAe,EACf,cAAc,EACd,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAIpB,sEAAsE;AACtE,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,cAAc,EACd,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,2BAA2B,EAC3B,6BAA6B,GAC9B,MAAM,iBAAiB,CAAC;AAEzB,eAAe;AACf,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,kBAAkB,CAAC;AAE1B,cAAc;AACd,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,aAAa,CAAC;AAErB,kBAAkB;AAClB,OAAO,EACL,aAAa,EACb,QAAQ,EACR,UAAU,EACV,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAI7B,kCAAkC;AAClC,OAAO,EACL,aAAa,IAAI,kBAAkB,EACnC,eAAe,EACf,QAAQ,EACR,UAAU,EACV,oBAAoB,GACrB,MAAM,WAAW,CAAC;AAInB,sDAAsD;AACtD,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,mBAAmB,EACnB,eAAe,EACf,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAE9B,sCAAsC;AACtC,OAAO,EACL,MAAM,EACN,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAI1B,eAAe;AACf,OAAO,EACL,WAAW,EACX,eAAe,EACf,cAAc,GACf,MAAM,YAAY,CAAC;AAUpB,cAAc;AACd,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAGzC,oBAAoB;AACpB,OAAO,EACL,eAAe,EACf,gBAAgB,GACjB,MAAM,cAAc,CAAC;AAQtB,oDAAoD;AACpD,OAAO,EACL,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,qBAAqB,EACrB,4BAA4B,EAC5B,qBAAqB,EACrB,8BAA8B,EAC9B,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,0BAA0B,EAC1B,6BAA6B,EAC7B,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAY1B,uBAAuB;AACvB,OAAO,EACL,WAAW,EACX,WAAW,EACX,qBAAqB,EACrB,CAAC,EACD,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,WAAW,CAAC;AAInB,aAAa;AACb,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAC1B,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,gCAAgC,EAChC,8BAA8B,GAC/B,MAAM,iBAAiB,CAAC;AAWzB,aAAa;AACb,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,aAAa,EACb,WAAW,EACX,YAAY,GACb,MAAM,iBAAiB,CAAC;AAIzB,SAAS;AACT,OAAO,EACL,WAAW,EACX,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAErB,kBAAkB;AAClB,OAAO,EAAE,QAAQ,IAAI,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAE/E,oBAAoB;AACpB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,kBAAkB,IAAI,cAAc,EAAE,MAAM,cAAc,CAAC;AAEpE,wCAAwC;AACxC,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,uBAAuB,EACvB,uBAAuB,EACvB,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAI5B,uBAAuB;AACvB,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAChF,gFAAgF;AAChF,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAG5C,uCAAuC;AACvC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEpF,0BAA0B;AAC1B,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,YAAY,EACZ,YAAY,GACb,MAAM,0BAA0B,CAAC;AAIlC,mCAAmC;AACnC,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,gBAAgB,EAChB,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAI1B,sCAAsC;AACtC,OAAO,EACL,YAAY,EACZ,aAAa,EACb,gBAAgB,EAChB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AAIpB,mEAAmE;AACnE,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,QAAQ,EACR,WAAW,EACX,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAI3B,0GAA0G;AAC1G,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,4BAA4B,EAC5B,4BAA4B,GAE7B,MAAM,gBAAgB,CAAC;AAIxB,0DAA0D;AAC1D,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,0BAA0B,EAC1B,gBAAgB,GAGjB,MAAM,mBAAmB,CAAC;AAE3B,iDAAiD;AACjD,OAAO,EACL,OAAO,EACP,mBAAmB,GAIpB,MAAM,gBAAgB,CAAC;AAExB,+CAA+C;AAC/C,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AAEvB,6DAA6D;AAC7D,OAAO,EACL,wBAAwB,EACxB,2BAA2B,EAC3B,8BAA8B,GAE/B,MAAM,mBAAmB,CAAC;AAE3B,6CAA6C;AAC7C,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,0BAA0B,EAC1B,mBAAmB,GAEpB,MAAM,gBAAgB,CAAC;AAExB,yCAAyC;AACzC,OAAO,EACL,4BAA4B,EAC5B,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAK1B,yEAAyE;AACzE,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,gDAAgD;AAkDhD,kDAAkD;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAEnD,YAAY;AACZ,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,YAAY,EACZ,YAAY,EACZ,uBAAuB,EACvB,wBAAwB,EACxB,iCAAiC,EACjC,4BAA4B,EAC5B,mBAAmB,EACnB,aAAa,EACb,UAAU,EACV,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,YAAY,EACZ,sBAAsB,EACtB,aAAa,EACb,wBAAwB;AACxB,iBAAiB;AACjB,qBAAqB,EACrB,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AAExB,SAAS;AACT,OAAO,EACL,eAAe,EACf,YAAY,EACZ,SAAS,EACT,WAAW,EACX,UAAU,EACV,IAAI,EACJ,UAAU,GACX,MAAM,aAAa,CAAC;AAErB,6CAA6C;AAC7C,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,2BAA2B,EAC3B,4BAA4B,EAC5B,2BAA2B,EAC3B,gBAAgB,EAChB,mBAAmB,EACnB,eAAe;AACf,uCAAuC;AACvC,6BAA6B,EAC7B,kCAAkC,EAClC,0BAA0B;AAC1B,qBAAqB;AACrB,eAAe,EACf,YAAY;AACZ,0BAA0B;AAC1B,2BAA2B;AAC3B,kBAAkB;AAClB,UAAU;AACV,oBAAoB;AACpB,mBAAmB,EACnB,sBAAsB,EACtB,YAAY;AACZ,sBAAsB;AACtB,gBAAgB,EAChB,uBAAuB,EACvB,sBAAsB;AACtB,oCAAoC;AACpC,sBAAsB,EACtB,wBAAwB,EACxB,6BAA6B;AAC7B,sBAAsB;AACtB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAI1B,oCAAoC;AACpC,OAAO,EACL,eAAe,EACf,WAAW,EACX,UAAU,EACV,sBAAsB,EACtB,gBAAgB,EAChB,WAAW,GACZ,MAAM,cAAc,CAAC;AAEtB,+BAA+B;AAC/B,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,qBAAqB,EACrB,aAAa,GACd,MAAM,eAAe,CAAC;AAEvB,yCAAyC;AACzC,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,aAAa,EACb,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AAExB,6EAA6E;AAC7E,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,WAAW,EACX,eAAe,EACf,cAAc,EACd,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAIpB,sEAAsE;AACtE,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,cAAc,EACd,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,2BAA2B,EAC3B,6BAA6B,GAC9B,MAAM,iBAAiB,CAAC;AAEzB,eAAe;AACf,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,kBAAkB,CAAC;AAE1B,cAAc;AACd,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,aAAa,CAAC;AAErB,kBAAkB;AAClB,OAAO,EACL,aAAa,EACb,QAAQ,EACR,UAAU,EACV,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAI7B,kCAAkC;AAClC,OAAO,EACL,aAAa,IAAI,kBAAkB,EACnC,eAAe,EACf,QAAQ,EACR,UAAU,EACV,oBAAoB,GACrB,MAAM,WAAW,CAAC;AAInB,sDAAsD;AACtD,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,mBAAmB,EACnB,eAAe,EACf,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAE9B,sCAAsC;AACtC,OAAO,EACL,MAAM,EACN,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAI1B,eAAe;AACf,OAAO,EACL,WAAW,EACX,eAAe,EACf,cAAc,GACf,MAAM,YAAY,CAAC;AAUpB,cAAc;AACd,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAGzC,oBAAoB;AACpB,OAAO,EACL,eAAe,EACf,gBAAgB,GACjB,MAAM,cAAc,CAAC;AAQtB,oDAAoD;AACpD,OAAO,EACL,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,qBAAqB,EACrB,4BAA4B,EAC5B,qBAAqB,EACrB,8BAA8B,EAC9B,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,0BAA0B,EAC1B,6BAA6B,EAC7B,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAY1B,uBAAuB;AACvB,OAAO,EACL,WAAW,EACX,WAAW,EACX,qBAAqB,EACrB,CAAC,EACD,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,WAAW,CAAC;AAInB,aAAa;AACb,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAC1B,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,gCAAgC,EAChC,8BAA8B,GAC/B,MAAM,iBAAiB,CAAC;AAWzB,aAAa;AACb,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,aAAa,EACb,WAAW,EACX,YAAY,GACb,MAAM,iBAAiB,CAAC;AAIzB,SAAS;AACT,OAAO,EACL,WAAW,EACX,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAErB,kBAAkB;AAClB,OAAO,EAAE,QAAQ,IAAI,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAE/E,oBAAoB;AACpB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,kBAAkB,IAAI,cAAc,EAAE,MAAM,cAAc,CAAC;AAEpE,wCAAwC;AACxC,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,uBAAuB,EACvB,uBAAuB,EACvB,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAI5B,uBAAuB;AACvB,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAChF,gFAAgF;AAChF,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAG5C,uCAAuC;AACvC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEpF,0BAA0B;AAC1B,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,YAAY,EACZ,YAAY,GACb,MAAM,0BAA0B,CAAC;AAIlC,mCAAmC;AACnC,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,gBAAgB,EAChB,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAI1B,sCAAsC;AACtC,OAAO,EACL,YAAY,EACZ,aAAa,EACb,gBAAgB,EAChB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AAIpB,mEAAmE;AACnE,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,QAAQ,EACR,WAAW,EACX,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAI3B,0GAA0G;AAC1G,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,4BAA4B,EAC5B,4BAA4B,GAE7B,MAAM,gBAAgB,CAAC;AAIxB,0DAA0D;AAC1D,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,0BAA0B,EAC1B,gBAAgB,GAGjB,MAAM,mBAAmB,CAAC;AAE3B,iDAAiD;AACjD,OAAO,EACL,OAAO,EACP,mBAAmB,GAIpB,MAAM,gBAAgB,CAAC;AAExB,+CAA+C;AAC/C,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AAEvB,6DAA6D;AAC7D,OAAO,EACL,wBAAwB,EACxB,2BAA2B,EAC3B,8BAA8B,GAE/B,MAAM,mBAAmB,CAAC;AAE3B,6CAA6C;AAC7C,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,0BAA0B,EAC1B,mBAAmB,GAEpB,MAAM,gBAAgB,CAAC;AAExB,yCAAyC;AACzC,OAAO,EACL,4BAA4B,EAC5B,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAK1B,yEAAyE;AACzE,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAExB,+EAA+E;AAC/E,2EAA2E"}

package/dist/url-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"url-auth.d.ts","sourceRoot":"","sources":["../src/url-auth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAmBnD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAoEtE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,SAAS,CAAC,EAAE,MAAM,GACjB,MAAM,CAcR;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAK9D;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAIzD"}
+{"version":3,"file":"url-auth.d.ts","sourceRoot":"","sources":["../src/url-auth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAoBnD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAoEtE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,SAAS,CAAC,EAAE,MAAM,GACjB,MAAM,CAcR;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAK9D;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAIzD"}

package/dist/url-auth.js

@@ -5,6 +5,7 @@
  * a challenge, origin, callback, and site name. The app signs the challenge
  * and redirects back with the signature.
  */
+import { UNSAFE_TEXT_CHARS } from './utils.js';
 /** Check if a URL is https:// or http://localhost (dev). */
 function isValidAuthUrl(url) {
     try {
@@ -146,6 +147,6 @@ export function buildAuthDeniedUrl(callbackUrl) {
 export function getUrlAuthSiteName(search) {
     const params = new URLSearchParams(search);
     const name = params.get('name') ?? '';
-    return name.replace(/[\x00-\x1f\x7f-\x9f\u200b-\u200f\u2028-\u202e\u2066-\u2069]/g, '').slice(0, 64);
+    return name.replace(new RegExp(UNSAFE_TEXT_CHARS.source, 'gu'), '').slice(0, 64);
 }
 //# sourceMappingURL=url-auth.js.map

package/dist/url-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"url-auth.js","sourceRoot":"","sources":["../src/url-auth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,4DAA4D;AAC5D,SAAS,cAAc,CAAC,GAAW;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC9C,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;QACrH,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,SAAS,eAAe,CAAC,GAAW;IAClC,OAAO,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,4CAA4C,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAE5C,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAExC,2BAA2B;IAC3B,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE7D,0DAA0D;IAC1D,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,MAAM,mBAAmB,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;IAEpD,uCAAuC;IACvC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IAEvD,wDAAwD;IACxD,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzC,0DAA0D;IAC1D,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAE3C,kEAAkE;IAClE,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;QAChD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;QAC7C,IAAI,cAAc,KAAK,aAAa;YAAE,OAAO,IAAI,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAClE,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC,CAAC,2CAA2C;IAC7E,MAAM,SAAS,GAAG,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IAC/C,IAAI,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IAEnF,+CAA+C;IAC/C,2EAA2E;IAC3E,uEAAuE;IACvE,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAEvD,IAAI,KAAyB,CAAC;IAC9B,IAAI,aAAiC,CAAC;IAEtC,IAAI,UAAU,KAAK,IAAI,IAAI,kBAAkB,KAAK,IAAI,EAAE,CAAC;QACvD,IAAI,CAAC,UAAU,IAAI,CAAC,kBAAkB;YAAE,OAAO,IAAI,CAAC;QACpD,IAAI,UAAU,CAAC,MAAM,GAAG,IAAI;YAAE,OAAO,IAAI,CAAC;QAC1C,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9C,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,kBAAkB,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7D,KAAK,GAAG,UAAU,CAAC;QACnB,aAAa,GAAG,kBAAkB,CAAC,WAAW,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,MAAM,GAAiB;QAC3B,IAAI,EAAE,sBAAsB;QAC5B,SAAS,EAAE,mBAAmB,EAAE,0CAA0C;QAC1E,SAAS,EAAE,mBAAmB;QAC9B,MAAM;QACN,WAAW,EAAE,QAAQ;QACrB,SAAS;KACV,CAAC;IACF,IAAI,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IAC9C,IAAI,aAAa,KAAK,SAAS;QAAE,MAAM,CAAC,aAAa,GAAG,aAAa,CAAC;IACtE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAmB,EACnB,MAAc,EACd,IAAY,EACZ,SAAiB,EACjB,OAAe,EACf,SAAkB;IAElB,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACjC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACvC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACnC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC7C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACzC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC7E,CAAC;QACD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAmB;IACpD,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACjC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACxC,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACtC,OAAO,IAAI,CAAC,OAAO,CAAC,8DAA8D,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACvG,CAAC"}
+{"version":3,"file":"url-auth.js","sourceRoot":"","sources":["../src/url-auth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE/C,4DAA4D;AAC5D,SAAS,cAAc,CAAC,GAAW;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC9C,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;QACrH,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,SAAS,eAAe,CAAC,GAAW;IAClC,OAAO,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,4CAA4C,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAE5C,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAExC,2BAA2B;IAC3B,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE7D,0DAA0D;IAC1D,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,MAAM,mBAAmB,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;IAEpD,uCAAuC;IACvC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IAEvD,wDAAwD;IACxD,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzC,0DAA0D;IAC1D,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAE3C,kEAAkE;IAClE,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;QAChD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;QAC7C,IAAI,cAAc,KAAK,aAAa;YAAE,OAAO,IAAI,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAClE,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC,CAAC,2CAA2C;IAC7E,MAAM,SAAS,GAAG,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IAC/C,IAAI,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IAEnF,+CAA+C;IAC/C,2EAA2E;IAC3E,uEAAuE;IACvE,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAEvD,IAAI,KAAyB,CAAC;IAC9B,IAAI,aAAiC,CAAC;IAEtC,IAAI,UAAU,KAAK,IAAI,IAAI,kBAAkB,KAAK,IAAI,EAAE,CAAC;QACvD,IAAI,CAAC,UAAU,IAAI,CAAC,kBAAkB;YAAE,OAAO,IAAI,CAAC;QACpD,IAAI,UAAU,CAAC,MAAM,GAAG,IAAI;YAAE,OAAO,IAAI,CAAC;QAC1C,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9C,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,kBAAkB,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7D,KAAK,GAAG,UAAU,CAAC;QACnB,aAAa,GAAG,kBAAkB,CAAC,WAAW,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,MAAM,GAAiB;QAC3B,IAAI,EAAE,sBAAsB;QAC5B,SAAS,EAAE,mBAAmB,EAAE,0CAA0C;QAC1E,SAAS,EAAE,mBAAmB;QAC9B,MAAM;QACN,WAAW,EAAE,QAAQ;QACrB,SAAS;KACV,CAAC;IACF,IAAI,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IAC9C,IAAI,aAAa,KAAK,SAAS;QAAE,MAAM,CAAC,aAAa,GAAG,aAAa,CAAC;IACtE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAmB,EACnB,MAAc,EACd,IAAY,EACZ,SAAiB,EACjB,OAAe,EACf,SAAkB;IAElB,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACjC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACvC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACnC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC7C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACzC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC7E,CAAC;QACD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAmB;IACpD,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACjC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACxC,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACtC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACnF,CAAC"}

package/dist/utils.d.ts

@@ -8,4 +8,50 @@ export declare function zeroBytes(buf: Uint8Array): void;
  * but all callers compare fixed-size buffers (32-byte scalars), so this is safe.
  */
 export declare function constantTimeEqual(a: Uint8Array, b: Uint8Array): boolean;
+/**
+ * One character class for text that is shown to people: C0 controls, DEL, C1
+ * controls, Arabic letter mark (U+061C), zero-width and LRM/RLM (U+200B-U+200F),
+ * line/paragraph separators and bidi embeddings/overrides (U+2028-U+202E), and
+ * bidi isolates (U+2066-U+2069). Not global: build a `g` copy to strip.
+ */
+export declare const UNSAFE_TEXT_CHARS: RegExp;
+/**
+ * `UNSAFE_TEXT_CHARS` minus U+200D (zero-width joiner), which is not a bidi
+ * control and is needed for emoji sequences, plus other invisible/deprecated-
+ * format characters a label has no legitimate use for: soft hyphen (U+00AD),
+ * Mongolian vowel separator (U+180E), word joiner and the deprecated invisible
+ * math operators (U+2060-U+2064), and the BOM / zero width no-break space
+ * (U+FEFF). This is a fixed denylist only; it does not cover every Unicode
+ * "format" (Cf) or Default_Ignorable code point (variation selectors, emoji
+ * tag characters, Hangul fillers, Arabic number-sign marks, deprecated music
+ * format controls, ...). Use `isSafeLabel` to validate labels \u2014 it checks
+ * this denylist plus those two Unicode categories, carving out only the
+ * narrow, positionally-constrained exceptions emoji sequences require.
+ */
+export declare const UNSAFE_LABEL_CHARS: RegExp;
+/**
+ * A label is unsafe if it contains a lone (unpaired) UTF-16 surrogate, any
+ * `UNSAFE_LABEL_CHARS` character, or any Unicode format (Cf) or
+ * Default_Ignorable_Code_Point code point, EXCEPT the narrow in-context uses
+ * emoji sequences need:
+ *
+ *  1. U+200D (ZWJ) only between two emoji elements: the code point before it
+ *     ends in an emoji element (see `endsInEmojiElement`) and the code point
+ *     after it is Extended_Pictographic. A leading, trailing or doubled ZWJ,
+ *     or one between ordinary letters, is rejected.
+ *  2. U+FE0E / U+FE0F (text/emoji variation selectors) only directly after
+ *     an Extended_Pictographic code point or a keycap base ([#*0-9]). Every
+ *     other variation selector (U+FE00-FE0D, U+E0100-E01EF) is rejected
+ *     everywhere.
+ *  3. Tag characters U+E0020-E007E only inside one of the three RGI UK
+ *     subdivision emoji flag sequences: U+1F3F4 (waving black flag) followed
+ *     by the exact tag-character spelling of "gbeng", "gbsct" or "gbwls"
+ *     then the cancel tag U+E007F, with nothing else in between. Any other
+ *     tag run — a different or misspelled subdivision code, extra or missing
+ *     tag characters, a hidden payload, a missing/extra cancel tag, or tag
+ *     characters with no U+1F3F4 base — is rejected, as is U+E0001 anywhere.
+ *
+ * Iterates by code point, not UTF-16 code unit.
+ */
+export declare function isSafeLabel(label: string): boolean;
 //# sourceMappingURL=utils.d.ts.map

package/dist/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,wBAAgB,SAAS,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAE/C;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,GAAG,OAAO,CAOvE"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,wBAAgB,SAAS,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAE/C;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,GAAG,OAAO,CAOvE;AAED;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,QAA+E,CAAC;AAE9G;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,kBAAkB,QAAyH,CAAC;AAmCzJ;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAwClD"}

package/dist/utils.js

@@ -18,4 +18,131 @@ export function constantTimeEqual(a, b) {
     }
     return diff === 0;
 }
+/**
+ * One character class for text that is shown to people: C0 controls, DEL, C1
+ * controls, Arabic letter mark (U+061C), zero-width and LRM/RLM (U+200B-U+200F),
+ * line/paragraph separators and bidi embeddings/overrides (U+2028-U+202E), and
+ * bidi isolates (U+2066-U+2069). Not global: build a `g` copy to strip.
+ */
+export const UNSAFE_TEXT_CHARS = /[\u0000-\u001f\u007f-\u009f\u061c\u200b-\u200f\u2028-\u202e\u2066-\u2069]/u;
+/**
+ * `UNSAFE_TEXT_CHARS` minus U+200D (zero-width joiner), which is not a bidi
+ * control and is needed for emoji sequences, plus other invisible/deprecated-
+ * format characters a label has no legitimate use for: soft hyphen (U+00AD),
+ * Mongolian vowel separator (U+180E), word joiner and the deprecated invisible
+ * math operators (U+2060-U+2064), and the BOM / zero width no-break space
+ * (U+FEFF). This is a fixed denylist only; it does not cover every Unicode
+ * "format" (Cf) or Default_Ignorable code point (variation selectors, emoji
+ * tag characters, Hangul fillers, Arabic number-sign marks, deprecated music
+ * format controls, ...). Use `isSafeLabel` to validate labels \u2014 it checks
+ * this denylist plus those two Unicode categories, carving out only the
+ * narrow, positionally-constrained exceptions emoji sequences require.
+ */
+export const UNSAFE_LABEL_CHARS = /[\u0000-\u001f\u007f-\u009f\u00ad\u061c\u180e\u200b\u200c\u200e\u200f\u2028-\u202e\u2060-\u2064\u2066-\u2069\ufeff]/u;
+const CF_OR_DEFAULT_IGNORABLE = /[\p{Cf}\p{Default_Ignorable_Code_Point}]/u;
+const EXTENDED_PICTOGRAPHIC = /\p{Extended_Pictographic}/u;
+const KEYCAP_BASE = /[#*0-9]/;
+// A single unpaired UTF-16 surrogate is not a valid code point. In `u`-mode a
+// correctly paired surrogate combines into one astral code point first and
+// never matches this class; only a lone (unpaired) half does.
+const LONE_SURROGATE = /[\uD800-\uDFFF]/u;
+const ZWJ = 0x200d;
+const VS15 = 0xfe0e, VS16 = 0xfe0f;
+const SKIN_TONE_MIN = 0x1f3fb, SKIN_TONE_MAX = 0x1f3ff;
+const TAG_CHAR_MIN = 0xe0020, TAG_CHAR_MAX = 0xe007e, TAG_CANCEL = 0xe007f, FLAG_BASE = 0x1f3f4;
+// RGI emoji tag sequences: only these three UK subdivision flags are
+// well-formed. Each entry is the tag-character run (base and cancel tag
+// excluded) spelling the ISO 3166-2 subdivision code in lowercase ASCII,
+// shifted into the U+E0000 tag-character plane.
+const RGI_FLAG_TAG_SEQUENCES = ['gbeng', 'gbsct', 'gbwls'].map(code => Array.from(code, ch => 0xe0000 + ch.codePointAt(0)));
+/**
+ * Whether `codePoints[index]` is "an emoji element" for the zero-width-joiner
+ * rule below: an Extended_Pictographic code point itself, or U+FE0F / an
+ * emoji skin-tone modifier (U+1F3FB-1F3FF) that directly follows one.
+ */
+function endsInEmojiElement(codePoints, index) {
+    if (index < 0)
+        return false;
+    const ch = codePoints[index];
+    if (EXTENDED_PICTOGRAPHIC.test(ch))
+        return true;
+    const cp = ch.codePointAt(0);
+    if (cp !== VS16 && !(cp >= SKIN_TONE_MIN && cp <= SKIN_TONE_MAX))
+        return false;
+    const prev = codePoints[index - 1];
+    return prev !== undefined && EXTENDED_PICTOGRAPHIC.test(prev);
+}
+/**
+ * A label is unsafe if it contains a lone (unpaired) UTF-16 surrogate, any
+ * `UNSAFE_LABEL_CHARS` character, or any Unicode format (Cf) or
+ * Default_Ignorable_Code_Point code point, EXCEPT the narrow in-context uses
+ * emoji sequences need:
+ *
+ *  1. U+200D (ZWJ) only between two emoji elements: the code point before it
+ *     ends in an emoji element (see `endsInEmojiElement`) and the code point
+ *     after it is Extended_Pictographic. A leading, trailing or doubled ZWJ,
+ *     or one between ordinary letters, is rejected.
+ *  2. U+FE0E / U+FE0F (text/emoji variation selectors) only directly after
+ *     an Extended_Pictographic code point or a keycap base ([#*0-9]). Every
+ *     other variation selector (U+FE00-FE0D, U+E0100-E01EF) is rejected
+ *     everywhere.
+ *  3. Tag characters U+E0020-E007E only inside one of the three RGI UK
+ *     subdivision emoji flag sequences: U+1F3F4 (waving black flag) followed
+ *     by the exact tag-character spelling of "gbeng", "gbsct" or "gbwls"
+ *     then the cancel tag U+E007F, with nothing else in between. Any other
+ *     tag run — a different or misspelled subdivision code, extra or missing
+ *     tag characters, a hidden payload, a missing/extra cancel tag, or tag
+ *     characters with no U+1F3F4 base — is rejected, as is U+E0001 anywhere.
+ *
+ * Iterates by code point, not UTF-16 code unit.
+ */
+export function isSafeLabel(label) {
+    if (LONE_SURROGATE.test(label) || UNSAFE_LABEL_CHARS.test(label))
+        return false;
+    const codePoints = Array.from(label);
+    // Indices that are part of one of the three well-formed RGI subdivision
+    // flag tag sequences: the exact tag-character spelling plus its cancel tag,
+    // immediately following a U+1F3F4.
+    const reservedTagIndex = new Set();
+    for (let i = 0; i < codePoints.length; i++) {
+        if (codePoints[i].codePointAt(0) !== FLAG_BASE)
+            continue;
+        for (const seq of RGI_FLAG_TAG_SEQUENCES) {
+            const cancelIndex = i + 1 + seq.length;
+            if (cancelIndex >= codePoints.length)
+                continue;
+            const matchesSpelling = seq.every((cp, k) => codePoints[i + 1 + k].codePointAt(0) === cp);
+            if (matchesSpelling && codePoints[cancelIndex].codePointAt(0) === TAG_CANCEL) {
+                for (let k = i + 1; k <= cancelIndex; k++)
+                    reservedTagIndex.add(k);
+                break;
+            }
+        }
+    }
+    for (let i = 0; i < codePoints.length; i++) {
+        const ch = codePoints[i];
+        if (!CF_OR_DEFAULT_IGNORABLE.test(ch))
+            continue;
+        const cp = ch.codePointAt(0);
+        if (cp === ZWJ) {
+            const next = codePoints[i + 1];
+            if (endsInEmojiElement(codePoints, i - 1) && next !== undefined && EXTENDED_PICTOGRAPHIC.test(next))
+                continue;
+            return false;
+        }
+        if (cp === VS15 || cp === VS16) {
+            const prev = codePoints[i - 1];
+            if (prev !== undefined && (EXTENDED_PICTOGRAPHIC.test(prev) || KEYCAP_BASE.test(prev)))
+                continue;
+            return false;
+        }
+        if ((cp >= TAG_CHAR_MIN && cp <= TAG_CHAR_MAX) || cp === TAG_CANCEL) {
+            if (reservedTagIndex.has(i))
+                continue;
+            return false;
+        }
+        return false;
+    }
+    return true;
+}
 //# sourceMappingURL=utils.js.map

package/dist/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,MAAM,UAAU,SAAS,CAAC,GAAe;IACvC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAa,EAAE,CAAa;IAC5D,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC"}
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,MAAM,UAAU,SAAS,CAAC,GAAe;IACvC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAa,EAAE,CAAa;IAC5D,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,4EAA4E,CAAC;AAE9G;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,sHAAsH,CAAC;AAEzJ,MAAM,uBAAuB,GAAG,2CAA2C,CAAC;AAC5E,MAAM,qBAAqB,GAAG,4BAA4B,CAAC;AAC3D,MAAM,WAAW,GAAG,SAAS,CAAC;AAC9B,8EAA8E;AAC9E,2EAA2E;AAC3E,8DAA8D;AAC9D,MAAM,cAAc,GAAG,kBAAkB,CAAC;AAC1C,MAAM,GAAG,GAAG,MAAM,CAAC;AACnB,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,GAAG,MAAM,CAAC;AACnC,MAAM,aAAa,GAAG,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC;AACvD,MAAM,YAAY,GAAG,OAAO,EAAE,YAAY,GAAG,OAAO,EAAE,UAAU,GAAG,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC;AAChG,qEAAqE;AACrE,wEAAwE;AACxE,yEAAyE;AACzE,gDAAgD;AAChD,MAAM,sBAAsB,GAAmC,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CACpG,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,GAAI,EAAE,CAAC,WAAW,CAAC,CAAC,CAAY,CAAC,CAAC,CAAC;AAEnE;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,UAAoB,EAAE,KAAa;IAC7D,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,CAAW,CAAC;IACvC,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,EAAE,IAAI,aAAa,IAAI,EAAE,IAAI,aAAa,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/E,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACnC,OAAO,IAAI,KAAK,SAAS,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/E,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,wEAAwE;IACxE,4EAA4E;IAC5E,mCAAmC;IACnC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,SAAS;QACzD,KAAK,MAAM,GAAG,IAAI,sBAAsB,EAAE,CAAC;YACzC,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC;YACvC,IAAI,WAAW,IAAI,UAAU,CAAC,MAAM;gBAAE,SAAS;YAC/C,MAAM,eAAe,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YAC1F,IAAI,eAAe,IAAI,UAAU,CAAC,WAAW,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;gBAC7E,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,EAAE;oBAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACnE,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,SAAS;QAChD,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,CAAW,CAAC;QACvC,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/B,IAAI,kBAAkB,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,KAAK,SAAS,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC9G,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/B,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAAE,SAAS;YACjG,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,EAAE,IAAI,YAAY,IAAI,EAAE,IAAI,YAAY,CAAC,IAAI,EAAE,KAAK,UAAU,EAAE,CAAC;YACpE,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,SAAS;YACtC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/vault-checkpoint.d.ts

@@ -0,0 +1,50 @@
+export declare const VAULT_EVENT_KIND = 30078;
+export declare const MAX_VAULT_CHUNKS = 32;
+export declare const MAX_VAULT_DEVICES = 16;
+export declare const MAX_VAULT_CONTROL_BYTES: number;
+export declare const MAX_VAULT_CHUNK_BYTES = 100000;
+export interface VaultChunkRef {
+    /** Exact signed event ID, never a mutable latest-by-tag lookup. */
+    eventId: string;
+    author: string;
+    /** SHA-256 of the UTF-8 encrypted event content. */
+    contentHash: string;
+    contentBytes: number;
+}
+export interface VaultCheckpoint {
+    v: 1;
+    purpose: string;
+    rotation: number;
+    sequence: number;
+    /** SHA-256 of the complete plaintext, checked before accepting a restored copy. */
+    revision: string;
+    /** Device whose independently replaceable checkpoint this is. */
+    publisher?: string;
+    devicePubkeys: string[];
+    /** Ordered chunk references; empty datasets still have one encrypted chunk. */
+    chunks: VaultChunkRef[];
+    /** Optional pointer, exactly rotation + 1; recovery follows it from index zero. */
+    nextRotation?: number;
+}
+/** Publicly computable opaque tag; confidentiality comes from encryption and private keys. */
+export declare function vaultCheckpointTag(author: string, publisher?: string): string;
+/** The single d-tag of a checkpoint-shaped event, or null. Every checkpoint tag
+ * is `vaultCheckpointTag` output: 32 lowercase hex characters. Necessary, not
+ * sufficient: the publisher is encrypted, so the shape cannot prove the tag. */
+export declare function vaultCheckpointShapedTag(event: {
+    tags?: unknown;
+}): string | null;
+export declare function vaultContentHash(content: string): string;
+/** Accept no partial checkpoint. A bad reference must never silently lose data. */
+export declare function parseVaultCheckpoint(raw: string, expected: {
+    purpose: string;
+    rotation: number;
+}): VaultCheckpoint | null;
+/** Integrity check before decrypting. Signature and event-ID verification is also required. */
+export declare function matchesVaultChunk(ref: VaultChunkRef, event: {
+    id: string;
+    pubkey: string;
+    kind: number;
+    content: string;
+}): boolean;
+//# sourceMappingURL=vault-checkpoint.d.ts.map

package/dist/vault-checkpoint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-checkpoint.d.ts","sourceRoot":"","sources":["../src/vault-checkpoint.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,gBAAgB,QAAQ,CAAA;AACrC,eAAO,MAAM,gBAAgB,KAAK,CAAA;AAClC,eAAO,MAAM,iBAAiB,KAAK,CAAA;AACnC,eAAO,MAAM,uBAAuB,QAAY,CAAA;AAChD,eAAO,MAAM,qBAAqB,SAAU,CAAA;AAM5C,MAAM,WAAW,aAAa;IAC5B,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,CAAC,EAAE,CAAC,CAAA;IACJ,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,mFAAmF;IACnF,QAAQ,EAAE,MAAM,CAAA;IAChB,iEAAiE;IACjE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,+EAA+E;IAC/E,MAAM,EAAE,aAAa,EAAE,CAAA;IACvB,mFAAmF;IACnF,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,8FAA8F;AAC9F,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAI7E;AAID;;gFAEgF;AAChF,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,GAAG,IAAI,CAKjF;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,mFAAmF;AACnF,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,eAAe,GAAG,IAAI,CAyBzH;AAED,+FAA+F;AAC/F,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAInI"}