@flickfyi/flkr 0.0.146 → 0.0.156

package/node_modules/@flickfyi/http-message-sig/package.json

@@ -36,8 +36,9 @@
 	},
 	"dependencies": {
 		"@noble/curves": "2.4.0",
+		"@noble/hashes": "2.4.0",
+		"@sindresorhus/is": "8.1.0",
 		"structured-headers": "2.1.0",
-		"uint8array-extras": "1.5.0",
-		"@noble/hashes": "2.4.0"
+		"uint8array-extras": "1.5.0"
 	}
 }

package/node_modules/@flickfyi/http-message-sig/src/build.ts

@@ -1,3 +1,4 @@
+import { isArrayBuffer } from '@sindresorhus/is'
 import {
 	type BareItem,
 	isInnerList,
@@ -587,7 +588,8 @@ function toStructuredParameterValue(value: ParameterValue): BareItem {
 	if (
 		typeof value === 'string' ||
 		typeof value === 'number' ||
-		typeof value === 'boolean'
+		typeof value === 'boolean' ||
+		isArrayBuffer(value)
 	) {
 		return value
 	}

package/node_modules/@flickfyi/http-message-sig/tests/build.spec.ts

@@ -353,6 +353,12 @@ describe('build', () => {
 	})
 
 	describe('buildSignatureInputString', () => {
+		it('serializes binary proof parameters as structured byte sequences', () => {
+			expect(
+				buildSignatureInputString([], { proof: new Uint8Array([1, 2, 3]).buffer })
+			).toBe('();proof=:AQID:')
+		})
+
 		describe('specification test cases', () => {
 			it('constructs minimal example', () => {
 				const components: Component[] = []

package/node_modules/@flickfyi/identity/.turbo/turbo-build.log

@@ -12,18 +12,19 @@ dist/signature-parameters.js      2.10 kB │ gzip:  0.79 kB
 dist/signing.js                   2.29 kB │ gzip:  1.09 kB
 dist/cwt.d.ts                     2.48 kB │ gzip:  0.80 kB
 dist/biscuit.js                   7.65 kB │ gzip:  2.60 kB
-dist/index.d.ts                   7.98 kB │ gzip:  2.05 kB
+dist/index.d.ts                   8.26 kB │ gzip:  2.13 kB
 dist/base-BgCpAGbi.js            11.49 kB │ gzip:  3.79 kB
-dist/index.js                    13.61 kB │ gzip:  3.68 kB
+dist/index.js                    13.62 kB │ gzip:  3.68 kB
 dist/nist-BxBMnBNH.js            41.79 kB │ gzip: 13.28 kB
 dist/curve-DYf6id8S.js           91.31 kB │ gzip: 28.67 kB
 dist/cwt-C-BaViSq.js            107.64 kB │ gzip: 24.53 kB
 
-✓ built in 4.48s
-[PLUGIN_TIMINGS] JavaScript callbacks ran for 4.4s of this 4.5s build (99%).
+✓ built in 7.91s
+[PLUGIN_TIMINGS] JavaScript callbacks ran for 7.8s of this 7.9s build (99%).
 The slowest callbacks, timed inside each callback (the wait before a callback starts is excluded, the time it awaits is included):
-  - plugin rolldown-plugin-dts:generate load (94%, 4.2s, 9 calls)
-Additional callback time came from the callbacks below and from callbacks under 1s.
+  - plugin rolldown-plugin-dts:generate load (95%, 7.5s, 9 calls)
+  - plugin rolldown-plugin-dts:fake-js transform (43%, 3.4s, 9 calls)
+These rows add up to more than the total. Callbacks can overlap, so the same time counts for more than one row.
 1 callback is listed without a time. Its calls overlapped, so the time inside one call includes work from other calls. To find its cost, profile the build with `node --cpu-prof`:
   - plugin rolldown-plugin-dts:resolver resolveId (17 calls)
 See https://rolldown.rs/reference/InputOptions.checks#bundlertimings for more details.

package/node_modules/@flickfyi/identity/README.md

@@ -43,6 +43,42 @@ const result = await verifySignature(request, {
 // => { type: 'attestation', keyId: string, counter: number }
 ```
 
+### Verifying a supplied device proof
+
+Swift's `DeviceRegistration.sign` includes its cached Apple attestation as binary
+`attestation` metadata in the existing `Signature-Input`. The assertion signs that
+metadata along with the request. For public reads, the existing key resolver can
+verify the supplied proof instead of loading a stored key:
+
+```ts
+import { verifyAttestation as verifyAppleAttestation } from '@flickfyi/attestation'
+import { verifyAttestation, verifyIdentity } from '@flickfyi/identity'
+import is from '@sindresorhus/is'
+
+const identity = await verifyIdentity(request)
+await verifyAttestation({
+	request,
+	skipCounterVerification: true,
+	getAttestationKey: async (keyId, parameters) => {
+		const proof = parameters.attestation
+		if (!is.arrayBuffer(proof)) throw new Error('Missing attestation proof')
+		const key = await verifyAppleAttestation({
+			appId, // Trusted server configuration, never taken from the request.
+			attestation: new Uint8Array(proof),
+			challenge: new TextEncoder().encode(identity.publicKey),
+			expectedKeyId: keyId,
+		})
+		return { appId, counter: 0, publicKey: key.publicKeyBase58 }
+	},
+})
+```
+
+The proof's challenge is the identity key ID supplied when Swift first attested
+the device. Certificate dates do not expire that proof; Apple chain signatures
+and the request's signed timestamps are still verified. The public-read policy
+uses request freshness without a stored counter. Account authorization remains
+separate; supplying a proof does not grant access to private data.
+
 ## Headers
 
 Signed requests include:

package/node_modules/@flickfyi/identity/dist/index.d.ts

@@ -1,5 +1,6 @@
 import { IdentityTokenProof, MintIdentityTokenInput, VerifiedIdentityToken, mintIdentityToken, verifyIdentityToken } from "./cwt.js";
 import { SignIdentityOptions, signIdentity } from "./signing.js";
+import { Parameters } from "@flickfyi/http-message-sig";
 import { Tracer } from "@opentelemetry/api";
 //#region src/offline-sdk-authorization.d.ts
 type OfflineSDKAuthorizationCredential = {
@@ -91,12 +92,13 @@ type VerifyOptions = {
    */
   acceptableUrls?: string[];
   /**
-   * Callback to look up stored attestation key data.
+   * Resolves key data from storage or from a supplied attestation proof.
    * Required for attestation signature verification.
    * @param keyId - The base58-encoded App Attest credential ID
-   * @returns The stored key data (including appId), or undefined if not found
+   * @param parameters - Signature metadata; untrusted until verified
+   * @returns Verified key data (including appId), or undefined if not found
    */
-  getAttestationKey?: (keyId: string) => Promise<AttestationKeyData | undefined>;
+  getAttestationKey?: (keyId: string, parameters: Parameters) => Promise<AttestationKeyData | undefined>;
   /** Max allowed counter skew (default: 0). Tolerates counter being slightly behind expected. */
   maxCounterSkew?: number;
   /**
@@ -123,11 +125,12 @@ type VerifyAttestationOptions = {
    */
   acceptableUrls?: string[];
   /**
-   * Callback to look up stored attestation key data.
+   * Resolves key data from storage or from a supplied attestation proof.
    * @param keyId - The base58-encoded App Attest credential ID
-   * @returns The stored key data (including appId), or undefined if not found
+   * @param parameters - Signature metadata; untrusted until verified
+   * @returns Verified key data (including appId), or undefined if not found
    */
-  getAttestationKey: (keyId: string) => Promise<AttestationKeyData | undefined>;
+  getAttestationKey: (keyId: string, parameters: Parameters) => Promise<AttestationKeyData | undefined>;
   /** Max allowed counter skew (default: 0). Tolerates counter being slightly behind expected. */
   maxCounterSkew?: number;
   /** The incoming request to verify */

package/node_modules/@flickfyi/identity/dist/index.js

@@ -185,7 +185,7 @@ async function verifyAttestation(options) {
 					...request.headers.has("Content-Digest") ? ["content-digest"] : []
 				]);
 				const keyId = validateSignatureParameters(parameters);
-				const attestationKey = await traceOperation(tracer, "identity.attestation.key.load", () => getAttestationKey(keyId));
+				const attestationKey = await traceOperation(tracer, "identity.attestation.key.load", () => getAttestationKey(keyId, parameters));
 				if (!attestationKey) throw new Error("Attestation key not found");
 				const payload = new TextEncoder().encode(signatureBase);
 				return {

package/node_modules/@flickfyi/identity/src/types.ts

@@ -1,3 +1,4 @@
+import type { Parameters } from '@flickfyi/http-message-sig'
 import type { Tracer } from '@opentelemetry/api'
 
 /**
@@ -59,12 +60,16 @@ export type VerifyOptions = {
 	 */
 	acceptableUrls?: string[]
 	/**
-	 * Callback to look up stored attestation key data.
+	 * Resolves key data from storage or from a supplied attestation proof.
 	 * Required for attestation signature verification.
 	 * @param keyId - The base58-encoded App Attest credential ID
-	 * @returns The stored key data (including appId), or undefined if not found
+	 * @param parameters - Signature metadata; untrusted until verified
+	 * @returns Verified key data (including appId), or undefined if not found
 	 */
-	getAttestationKey?: (keyId: string) => Promise<AttestationKeyData | undefined>
+	getAttestationKey?: (
+		keyId: string,
+		parameters: Parameters
+	) => Promise<AttestationKeyData | undefined>
 	/** Max allowed counter skew (default: 0). Tolerates counter being slightly behind expected. */
 	maxCounterSkew?: number
 	/**

package/node_modules/@flickfyi/identity/src/verify-attestation.ts

@@ -1,5 +1,5 @@
 import { verifyAssertion } from '@flickfyi/attestation'
-import { verifySignatures } from '@flickfyi/http-message-sig'
+import { type Parameters, verifySignatures } from '@flickfyi/http-message-sig'
 import { traceOperation } from '@flickfyi/rwsdk-extensions/otel'
 import type { Tracer } from '@opentelemetry/api'
 
@@ -15,11 +15,15 @@ export type VerifyAttestationOptions = {
 	 */
 	acceptableUrls?: string[]
 	/**
-	 * Callback to look up stored attestation key data.
+	 * Resolves key data from storage or from a supplied attestation proof.
 	 * @param keyId - The base58-encoded App Attest credential ID
-	 * @returns The stored key data (including appId), or undefined if not found
+	 * @param parameters - Signature metadata; untrusted until verified
+	 * @returns Verified key data (including appId), or undefined if not found
 	 */
-	getAttestationKey: (keyId: string) => Promise<AttestationKeyData | undefined>
+	getAttestationKey: (
+		keyId: string,
+		parameters: Parameters
+	) => Promise<AttestationKeyData | undefined>
 	/** Max allowed counter skew (default: 0). Tolerates counter being slightly behind expected. */
 	maxCounterSkew?: number
 	/** The incoming request to verify */
@@ -90,11 +94,11 @@ export async function verifyAttestation(
 
 								const keyId = validateSignatureParameters(parameters)
 
-								// Look up the attestation key
+								// Resolve the attestation key
 								const attestationKey = await traceOperation(
 									tracer,
 									'identity.attestation.key.load',
-									() => getAttestationKey(keyId)
+									() => getAttestationKey(keyId, parameters)
 								)
 								if (!attestationKey) {
 									throw new Error('Attestation key not found')

package/node_modules/@flickfyi/identity/tests/fixtures/expired-attestation.json

@@ -0,0 +1,9 @@
+{
+  "appId": "TEST.com.example.app",
+  "challenge": "MjM2aDdwdWt2cWk2dThBRHU1M2VyYld5TFlYTnlORXVCOUJSTk1YdFZLVWZa",
+  "data": "o2NmbXRvYXBwbGUtYXBwYXR0ZXN0Z2F0dFN0bXSiY3g1Y4FZAYYwggGCMIIBKKADAgECAhEA6bJS1B8t2ojGddeL1wZPcTAKBggqhkjOPQQDAjAmMSQwIgYDVQQDExtBcHAgQXR0ZXN0IFRlc3QgQ2VydGlmaWNhdGUwHhcNMDAwMTAxMDAwMDAwWhcNMDEwMTAxMDAwMDAwWjAmMSQwIgYDVQQDExtBcHAgQXR0ZXN0IFRlc3QgQ2VydGlmaWNhdGUwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARrF9Hy4SxCR/i85uVjpEDydwN9gS3rM6D0oTlF2JjClk/jQuL+Gn+bjufrSnwPnhYrzjNXazFezsu2QGg3v1H1ozcwNTAzBgkqhkiG92NkCAIEJjAkoSIEINOCdMSDXws3g7cMLogy2weRCmvs9luC271skT+IICXSMAoGCCqGSM49BAMCA0gAMEUCICzizbVCmoPjlOLHNysQpfegnx+vGdp51uV9Ve1aUC6qAiEA7gvJrloFuQDMlE0hTUgLg+iVAdh4Eejhtf+DFlJSCwlncmVjZWlwdEBoYXV0aERhdGFYpCGoMoaOUNW050OWHh6y1DvvF+yjmpIZ3oGk6nhhJ6gjQAAAAABhcHBhdHRlc3RkZXZlbG9wACBpi+pj3ESjRGY/8UKa6hCELfJ7a5ke8lhmssbALNzFvqUBAgMmIAEhWCBrF9Hy4SxCR/i85uVjpEDydwN9gS3rM6D0oTlF2JjCliJYIE/jQuL+Gn+bjufrSnwPnhYrzjNXazFezsu2QGg3v1H1",
+  "identityPrivateKey": "0000000000000000000000000000000000000000000000000000000000000002",
+  "keyId": "871YvGnK3pybLyqN9Z4FwbuUd6T2WRXCdAnwBsujPiNh",
+  "privateKey": "0000000000000000000000000000000000000000000000000000000000000001",
+  "rootCertificate": "-----BEGIN CERTIFICATE-----\nMIIBgjCCASigAwIBAgIRAOmyUtQfLdqIxnXXi9cGT3EwCgYIKoZIzj0EAwIwJjEk\nMCIGA1UEAxMbQXBwIEF0dGVzdCBUZXN0IENlcnRpZmljYXRlMB4XDTAwMDEwMTAw\nMDAwMFoXDTAxMDEwMTAwMDAwMFowJjEkMCIGA1UEAxMbQXBwIEF0dGVzdCBUZXN0\nIENlcnRpZmljYXRlMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEaxfR8uEsQkf4\nvOblY6RA8ncDfYEt6zOg9KE5RdiYwpZP40Li/hp/m47n60p8D54WK84zV2sxXs7L\ntkBoN79R9aM3MDUwMwYJKoZIhvdjZAgCBCYwJKEiBCDTgnTEg18LN4O3DC6IMtsH\nkQpr7PZbgtu9bJE/iCAl0jAKBggqhkjOPQQDAgNIADBFAiAs4s21QpqD45Tixzcr\nEKX3oJ8frxnaedblfVXtWlAuqgIhAO4Lya5aBbkAzJRNIU1IC4PolQHYeBHo4bX/\ngxZSUgsJ\n-----END CERTIFICATE-----"
+}

package/node_modules/@flickfyi/identity/tests/supplied-attestation.test.ts

@@ -0,0 +1,104 @@
+import { verifyAttestation as verifyAppleAttestation } from '@flickfyi/attestation'
+import { signAssertion } from '@flickfyi/attestation/testing'
+import { type Parameters, signatureHeaders } from '@flickfyi/http-message-sig'
+import is from '@sindresorhus/is'
+import { describe, expect, it } from 'vitest'
+
+import { verifySignature } from '~/index'
+import { signIdentity } from '~/sign-identity'
+import { verifyAttestation } from '~/verify-attestation'
+import { verifyIdentity } from '~/verify-identity'
+
+import fixture from './fixtures/expired-attestation.json'
+
+const proof = new Uint8Array(Buffer.from(fixture.data, 'base64')).buffer
+
+describe('supplied App Attest proof', () => {
+	it('verifies an expired proof and a fresh assertion without stored key data', async () => {
+		const request = await signedRequest(proof)
+		const options = await verificationOptions(request)
+		const expected = { counter: 1, keyId: fixture.keyId, type: 'attestation' }
+
+		await expect(verifyAttestation({ ...options, request })).resolves.toEqual(expected)
+		await expect(verifySignature(request, options)).resolves.toEqual(expected)
+		expect([...request.headers.keys()].toSorted()).toEqual([
+			'signature',
+			'signature-input',
+		])
+	})
+
+	it.each([undefined, 'not-bytes'])(
+		'rejects missing or nonbinary proof metadata: %s',
+		async attestation => {
+			const request = await signedRequest(attestation)
+			await expect(
+				verifyAttestation({ ...(await verificationOptions(request)), request })
+			).rejects.toThrow('Missing attestation proof')
+		}
+	)
+
+	it('rejects malformed proof bytes', async () => {
+		const request = await signedRequest(new Uint8Array([0]).buffer)
+		await expect(
+			verifyAttestation({ ...(await verificationOptions(request)), request })
+		).rejects.toThrow('Invalid attestation object')
+	})
+
+	it('rejects changed signature metadata even with a valid attestation proof', async () => {
+		const request = await signedRequest(proof)
+		request.headers.set(
+			'Signature-Input',
+			`${request.headers.get('Signature-Input')};extra="changed"`
+		)
+		await expect(
+			verifyAttestation({ ...(await verificationOptions(request)), request })
+		).rejects.toThrow('Invalid assertion signature')
+	})
+})
+
+async function verificationOptions(request: Request) {
+	const identity = await verifyIdentity(request)
+	return {
+		async getAttestationKey(keyId: string, parameters: Parameters) {
+			const attestation = parameters.attestation
+			if (!is.arrayBuffer(attestation)) {
+				throw new Error('Missing attestation proof')
+			}
+			const key = await verifyAppleAttestation({
+				appId: fixture.appId,
+				attestation: new Uint8Array(attestation),
+				challenge: new TextEncoder().encode(identity.publicKey),
+				expectedKeyId: keyId,
+				trustedRootCerts: [fixture.rootCertificate],
+			})
+			return { appId: fixture.appId, counter: 0, publicKey: key.publicKeyBase58 }
+		},
+		skipCounterVerification: true as const,
+	}
+}
+
+async function signedRequest(attestation: Parameters['attestation'] | undefined) {
+	const request = await signIdentity(new Request('https://example.com/deployments'), {
+		privateKey: Buffer.from(fixture.identityPrivateKey, 'hex'),
+	})
+	const headers = await signatureHeaders(request, {
+		attestation,
+		components: ['@method', '@target-uri'],
+		expires: new Date(Date.now() + 60_000),
+		key: 'sig2',
+		signer: {
+			keyid: fixture.keyId,
+			sign: data =>
+				signAssertion({
+					appId: fixture.appId,
+					counter: 1,
+					payload: new TextEncoder().encode(data),
+					privateKey: Buffer.from(fixture.privateKey, 'hex'),
+				}),
+		},
+		tag: 'app-attest',
+	})
+	request.headers.append('Signature', headers.Signature)
+	request.headers.append('Signature-Input', headers['Signature-Input'])
+	return request
+}

package/node_modules/@flickfyi/lens/.turbo/turbo-build.log

@@ -9,12 +9,12 @@ dist/bundle-plugin.js     2.52 kB │ gzip: 1.11 kB
 dist/index.d.ts           6.08 kB │ gzip: 2.00 kB
 dist/index.js            28.55 kB │ gzip: 7.81 kB
 
-✓ built in 4.48s
-[PLUGIN_TIMINGS] JavaScript callbacks ran for 4.3s of this 4.5s build (97%).
+✓ built in 4.52s
+[PLUGIN_TIMINGS] JavaScript callbacks ran for 4.4s of this 4.5s build (98%).
 The slowest callbacks, timed inside each callback (the wait before a callback starts is excluded, the time it awaits is included):
-  - plugin rolldown-plugin-dts:generate load (94%, 4.2s, 2 calls)
+  - plugin rolldown-plugin-dts:generate load (96%, 4.3s, 2 calls)
 Additional callback time came from callbacks under 1s.
 See https://rolldown.rs/reference/InputOptions.checks#bundlertimings for more details.
 
-◇ injected env (0) from .env // tip: ⌘ suppress logs { quiet: true }
+◇ injected env (0) from .env // tip: ⌁ auth for agents [www.vestauth.com]
 Publishing @flickfyi/lens@0.0.6...

package/node_modules/@flickfyi/photon/.turbo/turbo-build.log

@@ -5,7 +5,7 @@ transforming...
 rendering chunks...
 
 [unplugin:dts] Start generate declaration files...
-[unplugin:dts] Declaration files built in 3124ms.
+[unplugin:dts] Declaration files built in 3293ms.
 
 computing gzip size...
 dist/version.js      0.08 kB │ gzip: 0.09 kB
@@ -22,12 +22,12 @@ dist/jsx-runtime.cjs  0.51 kB │ gzip: 0.30 kB
 dist/schemas.cjs      1.35 kB │ gzip: 0.47 kB
 dist/index.cjs        2.39 kB │ gzip: 0.80 kB
 
-✓ built in 3.32s
-[PLUGIN_TIMINGS] JavaScript callbacks ran for 3.2s of this 3.3s build (98%).
+✓ built in 3.55s
+[PLUGIN_TIMINGS] JavaScript callbacks ran for 3.4s of this 3.5s build (98%).
 The slowest callbacks, timed inside each callback (the wait before a callback starts is excluded, the time it awaits is included):
-  - plugin unplugin-dts buildStart (90%, 3.0s, 2 calls)
+  - plugin unplugin-dts buildStart (87%, 3.0s, 2 calls)
 Additional callback time came from callbacks under 1s.
 See https://rolldown.rs/reference/InputOptions.checks#bundlertimings for more details.
 
-◇ injected env (2) from .env // tip: ⌘ enable debugging { debug: true }
+◇ injected env (2) from .env // tip: ⌘ suppress logs { quiet: true }
 Publishing @flickfyi/photon@0.0.35...

package/node_modules/@flickfyi/rwsdk-extensions/.turbo/turbo-build.log

@@ -5,7 +5,7 @@ transforming...
 rendering chunks...
 
 [unplugin:dts] Start generate declaration files...
-[unplugin:dts] Declaration files built in 8876ms.
+[unplugin:dts] Declaration files built in 10405ms.
 
 computing gzip size...
 dist/otel-worker.js  0.56 kB │ gzip: 0.36 kB
@@ -16,10 +16,10 @@ dist/otel.js         4.44 kB │ gzip: 1.45 kB
 dist/rpc-client.js   6.34 kB │ gzip: 2.44 kB
 dist/lifecycles.js   6.35 kB │ gzip: 2.27 kB
 
-✓ built in 9.11s
-[PLUGIN_TIMINGS] JavaScript callbacks ran for 8.9s of this 9.1s build (98%).
+✓ built in 10.72s
+[PLUGIN_TIMINGS] JavaScript callbacks ran for 10.5s of this 10.7s build (98%).
 The slowest callbacks, timed inside each callback (the wait before a callback starts is excluded, the time it awaits is included):
-  - plugin unplugin-dts buildStart (93%, 8.5s, 1 call)
+  - plugin unplugin-dts buildStart (94%, 10.0s, 1 call)
 Additional callback time came from callbacks under 1s.
 See https://rolldown.rs/reference/InputOptions.checks#bundlertimings for more details.
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@flickfyi/flkr",
-	"version": "0.0.146",
+	"version": "0.0.156",
 	"description": "A tool for managing your Flicks",
 	"homepage": "https://flick.fyi/docs/flkr/quick-start",
 	"bugs": {