@open-charging-cloud/chargy-core 0.13.0 → 0.14.0

package/dist/browser/index.js

@@ -5,7 +5,7 @@ import { ed448ph, ed448 } from '@noble/curves/ed448.js';
 import { p521, p384, p256 } from '@noble/curves/nist.js';
 import { secp256k1 } from '@noble/curves/secp256k1.js';
 import { ml_dsa87, ml_dsa65, ml_dsa44 } from '@noble/post-quantum/ml-dsa.js';
-import { sha256 as sha256$1 } from '@noble/hashes/sha2.js';
+import { sha256 as sha256$1, sha512 as sha512$1, sha384 as sha384$1 } from '@noble/hashes/sha2.js';
 import { fileTypeFromBuffer } from 'file-type';
 import isURL from 'is-url-superb';
 import jsQR from 'jsqr';
@@ -3073,10 +3073,10 @@ var NobleCompatibleCurve = class {
   keyFromPublic(publicKey, encoding) {
     if (encoding.toLowerCase() !== "hex")
       throw new TypeError("Only hexadecimal public keys are supported by the compatibility API.");
-    const publicKeyBytes = normalizeSEC1PublicKey(publicKey, this.coordinateLength);
-    if (!this.suite.isValidPublicKey(publicKeyBytes))
+    const publicKeyBytes2 = normalizeSEC1PublicKey(publicKey, this.coordinateLength);
+    if (!this.suite.isValidPublicKey(publicKeyBytes2))
       throw new TypeError("Public key is not a valid point on the selected curve.");
-    return new NobleCompatiblePublicKey(this.suite, publicKeyBytes, this.coordinateLength);
+    return new NobleCompatiblePublicKey(this.suite, publicKeyBytes2, this.coordinateLength);
   }
 };
 var suites = {
@@ -5910,7 +5910,7 @@ async function signJSONMessage(JSONMessage, KeyPairs, options) {
       continue;
     const publicKeyEncoding = isRawSignatureAlgorithm(algorithm) ? "raw" : "sec1";
     const signatureEncoding = options?.signatureEncoding ?? suite.signatureEncoding;
-    const publicKeyBytes = KeyPair.publicKey ?? suite.getPublicKey(KeyPair.privateKey);
+    const publicKeyBytes2 = KeyPair.publicKey ?? suite.getPublicKey(KeyPair.privateKey);
     const signatureBytes = suite.sign(
       plainText,
       KeyPair.privateKey,
@@ -5920,8 +5920,8 @@ async function signJSONMessage(JSONMessage, KeyPairs, options) {
       algorithm,
       publicKeyEncoding,
       signatureEncoding,
-      publicKey: bytesToBase64(publicKeyBytes),
-      publicKeyHEX: bytesToHex(publicKeyBytes),
+      publicKey: bytesToBase64(publicKeyBytes2),
+      publicKeyHEX: bytesToHex(publicKeyBytes2),
       signature: bytesToBase64(signatureBytes),
       signatureHEX: bytesToHex(signatureBytes)
     };
@@ -5932,7 +5932,7 @@ async function signJSONMessage(JSONMessage, KeyPairs, options) {
     const signatureIsValid = suite.verify(
       plainText,
       signatureBytes,
-      publicKeyBytes,
+      publicKeyBytes2,
       signatureOptions(options, signatureEncoding)
     );
     if (!signatureIsValid)
@@ -5975,11 +5975,11 @@ async function verifyJSONSignatureResult(JSONMessage, signature, options) {
   const resolvedOptions = resolveSignOptions(options);
   const algorithm = signature.algorithm ?? resolvedOptions.algorithm;
   const suite = getSignatureSuite(algorithm);
-  const publicKeyBytes = hexToBytes(signature.publicKeyHEX);
+  const publicKeyBytes2 = hexToBytes(signature.publicKeyHEX);
   const signatureBytes = hexToBytes(signature.signatureHEX);
   const signatureEncoding = signature.signatureEncoding ?? (isRawSignatureAlgorithm(algorithm) ? "raw" : "der");
   try {
-    const publicKeyIsValid = suite.isValidPublicKey(publicKeyBytes);
+    const publicKeyIsValid = suite.isValidPublicKey(publicKeyBytes2);
     if (!publicKeyIsValid)
       return verificationResult(
         "InvalidPublicKey" /* InvalidPublicKey */,
@@ -5995,7 +5995,7 @@ async function verifyJSONSignatureResult(JSONMessage, signature, options) {
     const signatureIsValid = suite.verify(
       plainText,
       signatureBytes,
-      publicKeyBytes,
+      publicKeyBytes2,
       signatureVerificationOptions(signature, options, signatureEncoding)
     );
     return signatureIsValid ? verificationResult("True" /* True */) : verificationResult(
@@ -8324,10 +8324,10 @@ var OCMF = class {
         try {
           if (typeof PublicKey !== "string")
             throw new TypeError("EdDSA and ML-DSA public keys must use a raw string encoding.");
-          const publicKeyBytes = decodeRawOCMFBytes(PublicKey, PublicKeyEncoding);
+          const publicKeyBytes2 = decodeRawOCMFBytes(PublicKey, PublicKeyEncoding);
           const signatureBytes = OCMFJSONDocument.signatureBytes;
           const rawPayload = OCMFJSONDocument.rawPayload;
-          if (!signatureSuite.isValidPublicKey(publicKeyBytes))
+          if (!signatureSuite.isValidPublicKey(publicKeyBytes2))
             throw new TypeError("Public key is invalid for the selected signature algorithm.");
           if (signatureBytes == null)
             throw new TypeError("Missing raw signature bytes.");
@@ -8336,7 +8336,7 @@ var OCMF = class {
           const signatureValid = signatureSuite.verify(
             new TextEncoder().encode(rawPayload),
             signatureBytes,
-            publicKeyBytes
+            publicKeyBytes2
           );
           if (!signatureValid)
             this.AddValidationError(OCMFJSONDocument, "Verification_SignatureMismatch");
@@ -8353,7 +8353,7 @@ var OCMF = class {
         if (curve === null)
           throw new Error(`Unsupported ECC curve '${OCMFJSONDocument.signature.SA ?? ""}'!`);
         OCMFJSONDocument.publicKey ??= PublicKey;
-        let publicKeyBytes = null;
+        let publicKeyBytes2 = null;
         if (typeof OCMFJSONDocument.publicKey === "string") {
           const ECPoint = this.chargy.asn1.define("ECPoint", function() {
             this.seq().obj(
@@ -8367,36 +8367,36 @@ var OCMF = class {
           if (PublicKeyEncoding != null && PublicKeyEncoding.length > 0) {
             switch (PublicKeyEncoding.toLowerCase()) {
               case "hex":
-                publicKeyBytes = Buffer.from(OCMFJSONDocument.publicKey, "hex");
+                publicKeyBytes2 = Buffer.from(OCMFJSONDocument.publicKey, "hex");
                 break;
               case "base32":
-                publicKeyBytes = Buffer.from(this.chargy.base32Decode(OCMFJSONDocument.publicKey, "RFC4648"));
+                publicKeyBytes2 = Buffer.from(this.chargy.base32Decode(OCMFJSONDocument.publicKey, "RFC4648"));
                 break;
               case "base64":
-                publicKeyBytes = Buffer.from(OCMFJSONDocument.publicKey, "base64");
+                publicKeyBytes2 = Buffer.from(OCMFJSONDocument.publicKey, "base64");
                 break;
             }
           }
-          if (publicKeyBytes == null) {
+          if (publicKeyBytes2 == null) {
             const hexRegex = /^[0-9A-Fa-f]+$/;
             const base32Regex = /^(?:[A-Z2-7]{8})*(?:[A-Z2-7]{2}={6}|[A-Z2-7]{4}={4}|[A-Z2-7]{5}={3}|[A-Z2-7]{7}=)?$/;
             const base64Regex = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
             if (hexRegex.test(OCMFJSONDocument.publicKey)) {
               PublicKeyEncoding = "hex";
-              publicKeyBytes = Buffer.from(OCMFJSONDocument.publicKey, "hex");
+              publicKeyBytes2 = Buffer.from(OCMFJSONDocument.publicKey, "hex");
             } else if (base32Regex.test(OCMFJSONDocument.publicKey)) {
               PublicKeyEncoding = "base32";
-              publicKeyBytes = Buffer.from(this.chargy.base32Decode(OCMFJSONDocument.publicKey, "RFC4648"));
+              publicKeyBytes2 = Buffer.from(this.chargy.base32Decode(OCMFJSONDocument.publicKey, "RFC4648"));
             } else if (base64Regex.test(OCMFJSONDocument.publicKey)) {
               PublicKeyEncoding = "base64";
-              publicKeyBytes = Buffer.from(OCMFJSONDocument.publicKey, "base64");
+              publicKeyBytes2 = Buffer.from(OCMFJSONDocument.publicKey, "base64");
             }
           }
-          if (publicKeyBytes == null) {
+          if (publicKeyBytes2 == null) {
             OCMFJSONDocument.validationStatus = "UnknownPublicKeyFormat" /* UnknownPublicKeyFormat */;
             return OCMFJSONDocument.validationStatus;
           }
-          const decodedPublicKeyASN1 = ECPoint.decode(publicKeyBytes, "der");
+          const decodedPublicKeyASN1 = ECPoint.decode(publicKeyBytes2, "der");
           const publicKeyASN1 = decodedPublicKeyASN1;
           const coordinates = publicKeyASN1.pubKey.data.subarray(1);
           const halfLength = coordinates.length / 2;
@@ -12057,7 +12057,9 @@ function toSessionVerificationResults(CTR, noRecordsMessage = { "en": "No charge
 var IChargeTransparencyLiveLink_exports = {};
 __export(IChargeTransparencyLiveLink_exports, {
   ChargeTransparencyLiveLinkContext: () => ChargeTransparencyLiveLinkContext,
-  IsAChargeTransparencyLiveLink: () => IsAChargeTransparencyLiveLink
+  IsAChargeTransparencyLiveLink: () => IsAChargeTransparencyLiveLink,
+  isConnector: () => isConnector,
+  isTransport: () => isTransport
 });
 var ChargeTransparencyLiveLinkContext = "https://open.charging.cloud/contexts/chargeTransparency/live/link/1.0";
 function isConnector(data) {
@@ -12083,9 +12085,7 @@ function isTransport(data) {
   return (data["url"] === void 0 || typeof data["url"] === "string") && (data["urls"] === void 0 || Array.isArray(data["urls"]) && data["urls"].every(isTransportURL)) && (data["totp"] === void 0 || isTOTPConfig(data["totp"]));
 }
 function IsAChargeTransparencyLiveLink(data) {
-  if (!isMandatoryJSONObject(data))
-    return false;
-  return data["@context"] === ChargeTransparencyLiveLinkContext && (data["created"] === void 0 || data["created"] === null || typeof data["created"] === "string") && (data["description"] === void 0 || isI18NString(data["description"])) && (data["imageURLs"] === void 0 || Array.isArray(data["imageURLs"]) && data["imageURLs"].every((value) => typeof value === "string")) && (data["geoLocation"] === void 0 || isGeoLocation(data["geoLocation"])) && (data["connector"] === void 0 || isConnector(data["connector"])) && (data["liveTransports"] === void 0 || Array.isArray(data["liveTransports"]) && data["liveTransports"].every(isTransport)) && (data["signatures"] === void 0 || Array.isArray(data["signatures"]));
+  return isMandatoryJSONObject(data) && data["@context"] === ChargeTransparencyLiveLinkContext;
 }
 function isTOTPConfig(data) {
   return isObject(data) && typeof data["initialSharedSecret"] === "string" && typeof data["timeStep"] === "number";
@@ -12329,6 +12329,259 @@ var validationRules_default = {
     }
   }
 };
+var defaultKeyIdGeneration = ["SubjectPublicKeyInfo", "DER", "SHA-256", "hex"];
+var defaultExcludedProperties = ["signatures"];
+var canonicalJSONEncodings = ["JSON", "JCS", "UTF-8"];
+var subjectPublicKeyInfoHeaders = {
+  "EdDSA-Ed25519": "302A300506032B6570032100",
+  "EdDSA-Ed448": "3043300506032B6571033A00",
+  "ECDSA-secp256r1": "3059301306072A8648CE3D020106082A8648CE3D030107034200",
+  "ECDSA-secp384r1": "3076301006072A8648CE3D020106052B81040022036200",
+  "ECDSA-secp521r1": "30819B301006072A8648CE3D020106052B8104002303818600"
+};
+function readDERLength2(bytes, offset) {
+  const first = bytes[offset];
+  if (first === void 0)
+    throw new Error("Truncated ASN.1 length!");
+  if (first < 128)
+    return { length: first, size: 1 };
+  const count = first & 127;
+  if (count === 0 || count > 4)
+    throw new Error("Unsupported ASN.1 length!");
+  let length = 0;
+  for (let index = 1; index <= count; index++) {
+    const byte = bytes[offset + index];
+    if (byte === void 0)
+      throw new Error("Truncated ASN.1 length!");
+    length = length * 256 + byte;
+  }
+  return { length, size: count + 1 };
+}
+function subjectPublicKeyInfoKeyMaterial(spki) {
+  if (spki[0] !== 48)
+    throw new Error("A SubjectPublicKeyInfo must start with a SEQUENCE!");
+  let index = 1 + readDERLength2(spki, 1).size;
+  if (spki[index] !== 48)
+    throw new Error("The SubjectPublicKeyInfo does not start with an AlgorithmIdentifier!");
+  const algorithmLength = readDERLength2(spki, index + 1);
+  index += 1 + algorithmLength.size + algorithmLength.length;
+  if (spki[index] !== 3)
+    throw new Error("The SubjectPublicKeyInfo does not contain a BIT STRING!");
+  const keyLength = readDERLength2(spki, index + 1);
+  const start = index + 1 + keyLength.size;
+  if (spki[start] !== 0)
+    throw new Error("The SubjectPublicKeyInfo BIT STRING has unused bits!");
+  const keyMaterial = spki.subarray(start + 1, start + keyLength.length);
+  if (keyMaterial.length === 0)
+    throw new Error("The SubjectPublicKeyInfo contains no key material!");
+  return keyMaterial;
+}
+function wrapInSubjectPublicKeyInfo(keyMaterial, algorithm) {
+  const header = subjectPublicKeyInfoHeaders[algorithm];
+  if (header === void 0)
+    throw new Error("Cannot wrap a raw " + algorithm + " key into a SubjectPublicKeyInfo!");
+  const headerBytes = hexToBytes(header);
+  const spki = new Uint8Array(headerBytes.length + keyMaterial.length);
+  spki.set(headerBytes, 0);
+  spki.set(keyMaterial, headerBytes.length);
+  return spki;
+}
+function decodeText(value, encoding) {
+  switch (encoding) {
+    case "hex":
+      return hexToBytes(value);
+    case "base64":
+      return base64ToBytes(value);
+    default:
+      throw new Error("Unsupported text encoding: " + String(encoding));
+  }
+}
+function encodeText(bytes, encoding) {
+  switch (encoding) {
+    case "hex":
+      return bytesToHex(bytes).toUpperCase();
+    case "base64":
+      return bytesToBase64(bytes);
+    default:
+      return null;
+  }
+}
+function publicKeyBytes(publicKey, structure) {
+  const storedStructure = publicKey.encodings[0];
+  const storedBytes = decodeText(publicKey.value, publicKey.encodings[publicKey.encodings.length - 1]);
+  if (storedStructure === structure)
+    return storedBytes;
+  if (storedStructure === "SubjectPublicKeyInfo" && structure === "raw")
+    return subjectPublicKeyInfoKeyMaterial(storedBytes);
+  if (storedStructure === "raw" && structure === "SubjectPublicKeyInfo")
+    return wrapInSubjectPublicKeyInfo(storedBytes, publicKey.algorithm);
+  throw new Error("Cannot represent a " + String(storedStructure) + " key as " + structure + "!");
+}
+function computeKeyId(publicKey, keyIdGeneration) {
+  let index = 0;
+  const structure = keyIdGeneration[index++];
+  if (structure === void 0)
+    return null;
+  if (structure === "SubjectPublicKeyInfo" && keyIdGeneration[index] === "DER")
+    index++;
+  let bytes;
+  try {
+    bytes = publicKeyBytes(publicKey, structure);
+  } catch {
+    return null;
+  }
+  for (; index < keyIdGeneration.length; index++) {
+    const step = keyIdGeneration[index];
+    if (step === void 0)
+      return null;
+    switch (step) {
+      case "SHA-256":
+        bytes = sha256$1(bytes);
+        break;
+      case "SHA-384":
+        bytes = sha384$1(bytes);
+        break;
+      case "SHA-512":
+        bytes = sha512$1(bytes);
+        break;
+      // A pipeline ends with the text encoding of the id.
+      default:
+        return encodeText(bytes, step);
+    }
+  }
+  return null;
+}
+function nobleSignatureAlgorithm(algorithm) {
+  switch (algorithm) {
+    case "ECDSA-secp256r1-SHA256":
+      return "ECDSA-P256";
+    case "ECDSA-secp384r1-SHA384":
+      return "ECDSA-P384";
+    case "ECDSA-secp521r1-SHA512":
+      return "ECDSA-P521";
+    case "EdDSA-Ed25519":
+      return "Ed25519";
+    case "EdDSA-Ed448":
+      return "Ed448";
+    case "ML-DSA-44":
+      return "ML-DSA-44";
+    case "ML-DSA-65":
+      return "ML-DSA-65";
+    case "ML-DSA-87":
+      return "ML-DSA-87";
+    default:
+      return null;
+  }
+}
+function asStringArray(value) {
+  return Array.isArray(value) && value.every((entry) => typeof entry === "string") ? value : void 0;
+}
+function collectDocumentPublicKeys(Document) {
+  const publicKeys = new Array();
+  const collectFrom = (candidates) => {
+    if (!Array.isArray(candidates))
+      return;
+    for (const candidate of candidates) {
+      const entry = asJSONObject(candidate);
+      if (entry === void 0)
+        continue;
+      const algorithm = asString(entry["algorithm"]);
+      const value = asString(entry["value"]);
+      const encodings = asStringArray(entry["encodings"]);
+      const keyUsage = asStringArray(entry["keyUsage"]) ?? [];
+      if (algorithm === void 0 || algorithm === "" || value === void 0 || value === "" || encodings === void 0 || encodings.length === 0) {
+        continue;
+      }
+      publicKeys.push({ algorithm, encodings, value, keyUsage });
+    }
+  };
+  const chargingStation = asJSONObject(Document["chargingStation"]);
+  const evse = asJSONObject(chargingStation?.["EVSE"]);
+  collectFrom(asJSONObject(Document["chargingStationOperator"])?.["publicKeys"]);
+  collectFrom(asJSONObject(evse?.["energyMeter"])?.["publicKeys"]);
+  return publicKeys;
+}
+function verifyDocumentSignature(Document, Signature, Index, PublicKeys, KeyIdGeneration) {
+  const entry = asJSONObject(Signature);
+  if (entry === void 0)
+    return { index: Index, status: "malformed", details: "The signature is not a JSON object." };
+  const keyId = asString(entry["keyId"]);
+  const algorithm = asString(entry["algorithm"]);
+  const value = asString(entry["value"]);
+  const encodings = asStringArray(entry["encodings"]);
+  const signedData = asJSONObject(entry["signedData"]);
+  const described = (status, details) => ({
+    index: Index,
+    ...keyId !== void 0 ? { keyId } : {},
+    ...algorithm !== void 0 ? { algorithm } : {},
+    status,
+    ...details !== void 0 ? { details } : {}
+  });
+  if (keyId === void 0 || keyId === "" || algorithm === void 0 || algorithm === "" || value === void 0 || value === "" || encodings === void 0 || encodings.length === 0) {
+    return described("malformed", "A signature needs a keyId, an algorithm, encodings and a value.");
+  }
+  const signedEncodings = asStringArray(signedData?.["encodings"]) ?? canonicalJSONEncodings;
+  if (signedEncodings.length !== canonicalJSONEncodings.length || !signedEncodings.every((step, position) => step === canonicalJSONEncodings[position])) {
+    return described(
+      "unsupportedAlgorithm",
+      "Only [ " + canonicalJSONEncodings.join(", ") + " ] signed data is understood here."
+    );
+  }
+  const excludedProperties = asStringArray(signedData?.["excludedProperties"]) ?? defaultExcludedProperties;
+  if (!excludedProperties.includes("signatures"))
+    excludedProperties.push("signatures");
+  let signedBytes;
+  try {
+    signedBytes = canonicalJSONBytes(
+      Object.fromEntries(
+        Object.entries(Document).filter(([property]) => !excludedProperties.includes(property))
+      )
+    );
+  } catch (exception) {
+    return described(
+      "malformed",
+      "The signed properties could not be canonicalized: " + (exception instanceof Error ? exception.message : String(exception))
+    );
+  }
+  const suiteAlgorithm = nobleSignatureAlgorithm(algorithm);
+  if (suiteAlgorithm === null)
+    return described("unsupportedAlgorithm", "Unsupported signature algorithm: " + algorithm);
+  const wantedKeyId = keyId.toUpperCase();
+  const publicKey = PublicKeys.find((candidate) => computeKeyId(candidate, KeyIdGeneration)?.toUpperCase() === wantedKeyId);
+  if (publicKey === void 0)
+    return described("unknownPublicKey", "No public key of this document has the key id " + keyId + ".");
+  try {
+    const suite = getSignatureSuite(suiteAlgorithm);
+    const publicKeyBytes_ = publicKeyBytes(publicKey, "raw");
+    const signatureBytes = decodeText(value, encodings[encodings.length - 1]);
+    if (!suite.isValidPublicKey(publicKeyBytes_))
+      return described("malformed", "The public key is not valid for " + algorithm + ".");
+    return described(suite.verify(signedBytes, signatureBytes, publicKeyBytes_) ? "validSignature" : "invalidSignature");
+  } catch (exception) {
+    return described(
+      "malformed",
+      exception instanceof Error ? exception.message : String(exception)
+    );
+  }
+}
+function verifyDocumentSignatures(Document) {
+  const signatures = Document["signatures"];
+  if (!Array.isArray(signatures) || signatures.length === 0)
+    return { status: "unsigned", signatures: [], validCount: 0 };
+  const keyIdGeneration = asStringArray(Document["keyIdGeneration"]) ?? defaultKeyIdGeneration;
+  const publicKeys = collectDocumentPublicKeys(Document);
+  const results = signatures.map(
+    (signature, index) => verifyDocumentSignature(Document, signature, index, publicKeys, keyIdGeneration)
+  );
+  const validCount = results.filter((result) => result.status === "validSignature").length;
+  return {
+    status: validCount === 0 ? "noneValid" : validCount === results.length ? "allValid" : "someValid",
+    signatures: results,
+    validCount
+  };
+}
+
+// src/chargy.ts
 function isPdfAttachment(value) {
   if (!isMandatoryJSONObject(value))
     return false;
@@ -13265,6 +13518,7 @@ var Chargy = class {
             throw new Error("Parsed JSON content is not a JSON object!");
           const JSONContext = JSONContent["@context"];
           if (IsAChargeTransparencyLiveLink(JSONContent)) {
+            this.verifyLiveLinkSignatures(JSONContent);
             JSONContent.created ??= (/* @__PURE__ */ new Date()).toISOString();
             processedFile.result = JSONContent;
           } else if (JSONContent["format"] === "ptb")
@@ -13434,6 +13688,56 @@ var Chargy = class {
     return IsAChargeTransparencyRecord(verifiedCTR) ? verifiedCTR : void 0;
   }
   //#endregion
+  //#region (private) verifyLiveLinkSignatures(LiveLink)
+  // A live link may be signed as a whole by the operator, which is what ties
+  // the transport URLs and the listed public keys to whoever signed them.
+  // Those signatures are verified whenever the document carries any.
+  //
+  // Nothing here rejects a document. An unsigned live link, an unknown key or
+  // even a signature that does not match is reported as a warning and the
+  // document stays usable: its transports still work, and its signed meter
+  // values carry their own signatures, which are verified separately. What a
+  // reader makes of the warning is the reader's decision.
+  //
+  // Must run before anything is added to the document - see the note at the
+  // call site.
+  verifyLiveLinkSignatures(LiveLink) {
+    const result = verifyDocumentSignatures(LiveLink);
+    const warnings = new Array();
+    const warn = (messageKey, level) => {
+      const message = this.GetMultilanguageText(messageKey);
+      if (!warnings.some((warning) => warning.message === message))
+        warnings.push({ level, message });
+    };
+    if (result.status === "unsigned")
+      warn("DocumentSignature_Missing", "low" /* low */);
+    for (const signature of result.signatures) {
+      switch (signature.status) {
+        case "validSignature":
+          break;
+        // A signature that demonstrably does not match its document is
+        // the one case that says something is actually wrong.
+        case "invalidSignature":
+          warn("DocumentSignature_Mismatch", "high" /* high */);
+          break;
+        // The rest mean "cannot be judged here", which is a weaker
+        // statement than "is wrong".
+        case "unknownPublicKey":
+          warn("DocumentSignature_UnknownPublicKey", "medium" /* medium */);
+          break;
+        case "unsupportedAlgorithm":
+          warn("DocumentSignature_UnsupportedAlgorithm", "medium" /* medium */);
+          break;
+        case "malformed":
+          warn("DocumentSignature_Malformed", "medium" /* medium */);
+          break;
+      }
+    }
+    LiveLink.signatureVerification = result;
+    if (warnings.length > 0)
+      LiveLink.warnings = [...LiveLink.warnings ?? [], ...warnings];
+  }
+  //#endregion
   //#region (private) collectLiveLinkMeterValueKeys(LiveLink)
   // Every public key of the document that is allowed to sign meter values.
   // A charging session is regularly signed by more than one of them: the
@@ -13813,6 +14117,6 @@ buffer/index.js:
    *)
 */
 
-export { ACrypt, Alfen, AlfenCrypt01, BSMCrypt01, CanonicalJSONError, ChargeIT, ChargePoint, ChargePointCrypt01, IChargeTransparencyLiveLink_exports as ChargeTransparencyLiveLink, ChargeTransparencyLiveLinkContext, IChargeTransparencyRecord_exports as ChargeTransparencyRecord, Chargy, chargyInterfaces_exports as ChargyInterfaces, Clone, CloneCTR, ConcatenateBuffers, CreateDiv, CreateDiv2, CreateError, CreateWarning, CryptoAlgorithms, CryptoHashAlgorithms, DayOfWeek, DisplayPrefixes, EDL40, EDL40Crypt01, EDL40ValidationError, EDL40_OBIS, EDL40_SESSION_CONTEXT, EDL40_SIGNATURE_CONTEXT, EMHCrypt01, ErrorLevel, GDFCrypt01, IECCurves, IEncoding, InformationRelevance, InformationRelevanceToString, IsAChargeTransparencyLiveLink, IsAChargeTransparencyRecord, IsAPublicKey, IsAPublicKeyLookup, IsAPublicKeySignature, IsAPublicKeyXY, IsASessionCryptoResult, IsAURL, IsNullOrEmpty, IsValidURL, JSONSignatureVerificationStatus, MENNEKES_EDL40_OBIS, MENNEKES_EDL40_XMLNS, Mennekes, MennekesCrypt01, OBIS2Hex, OBIS2MeasurementName, OBIS_RegExpr, OCMF, OCMFBonnTariffParseError, OCMFTransactionTypes, OCMF_SIGNATURE_ALGORITHMS, OCMFv1_x, OCPI, OIDInfo, PCDF, PCDFCrypt01, PCDFParseError, PCDFValidationError, PCDF_FIELD_ORDER, PCDF_PREFIX, PTB, ParseJSON_LD, PublicKeyFormats, IPublicKeyInfo_exports as PublicKeyInfo, SAFEXML, SessionVerificationResult, SetHex, SetInt8, SetText, SetText_withLength, SetTimestamp, SetTimestamp32, SetUInt32, SetUInt32_withCode, SetUInt64, SetUInt64D, SignMessage, SignatureFormats, IURL_exports as SimpleURL, TimeStatusTypes, URLContext, UTC2human, VerificationResult, VerifyJSONMessageSignatures, WarningLevel, WhenNullOrEmpty, XMLContainer, asJSONArray, asJSONObject, asNumber, asString, base64ToBytes, buf2hex, buildEDL40Signature, buildIsaSignature, buildMennekesSignatureData, bytesToBase64, bytesToHex, canParseEDL40, canonicalJSONBytes, canonicalJSONStringify, cleanHex, closeFullscreen, createCompatibleCurve, createHexString, createLegacyP192Curve, dateToMennekesLocalEpochSeconds, decodeSmlMessages, extractMennekesChargingProcesses, findEntryByObis, findGetListRes, firstKey, firstValue, generateSignatureKeyPair, getArrayElement, getArrayLikeElement, getDirectChildByLocalName, getDirectChildrenByLocalName, getElementsByLocalName, getFirstArrayElement, getInt16Bytes, getInt32Bytes, getInt64Bytes, getInt8Bytes, getLastArrayElement, getOCMFSignatureDisplay, getSignatureSuite, getTrimmedTextContent, hashFile, hex2bin, hex32, hexToArrayBuffer, hexToBytes, intFromBytes, isEncodedValue, isGeoLocation, isI18NString, isICryptoResult, isIFileInfo, isISessionCryptoResult1, isISessionCryptoResult2, isJSONLDObject, isMandatoryArrayOfStrings, isMandatoryBoolean, isMandatoryDecimal, isMandatoryJSONArray, isMandatoryJSONObject, isMandatoryNumber, isMandatoryString, isMandatoryURL, isOIDInfo, isObject, isOptionalArrayOfStrings, isOptionalDecimal, isOptionalJSONArray, isOptionalJSONArrayError, isOptionalJSONArrayOk, isOptionalJSONObject, isOptionalNumber, isOptionalString, isOptionalStringArray, isOptionalStringOrOIDInfo, isOptionalURL, isPCDFText, isPublicKeySubject, isString, isStringArray, isStringOrOIDInfo, isStringOrStringArray, isaListNameContext, jsonPrettyPrinter, measurementName2human, meterTimeZone, normalizePCDFPublicKeyHex, normalizeXMLText, ocmfBonnTariffToChargingTariff, openFullscreen, pad, parseAndVerifyJSONSignatures, parseDescription, parseEDL40, parseHexString, parseMennekesXMLDocument, parseNumber, parseOBIS, parseOCMFBonnTariffText, parsePCDFDocument, parsePCDFPublicKey, parsePCDFSignature, parseSmlTime, parseUTC, readQRCodeTextFromImage, readQRCodeTextFromImageData, readTLV, secp224k1, setUILocale, sha256, sha256____, sha384, sha384____, sha512, sha512____, signJSONMessage, signMessage, stripPCDFControlCharacters, stripTransport, time2human, timeZoneOffsetMinutes, toArrayBuffer, toSessionVerificationResults, toUint8Array, transformEDL40Status, tryParseOCMFBonnTariffText, unquotePCDFText, validatePCDFFields, verifyEDL40Document, verifyJSONMessageSignatureResults, verifyJSONMessageSignatures, verifyJSONSignature, verifyJSONSignatureResult, verifyPCDFDocument };
+export { ACrypt, Alfen, AlfenCrypt01, BSMCrypt01, CanonicalJSONError, ChargeIT, ChargePoint, ChargePointCrypt01, IChargeTransparencyLiveLink_exports as ChargeTransparencyLiveLink, ChargeTransparencyLiveLinkContext, IChargeTransparencyRecord_exports as ChargeTransparencyRecord, Chargy, chargyInterfaces_exports as ChargyInterfaces, Clone, CloneCTR, ConcatenateBuffers, CreateDiv, CreateDiv2, CreateError, CreateWarning, CryptoAlgorithms, CryptoHashAlgorithms, DayOfWeek, DisplayPrefixes, EDL40, EDL40Crypt01, EDL40ValidationError, EDL40_OBIS, EDL40_SESSION_CONTEXT, EDL40_SIGNATURE_CONTEXT, EMHCrypt01, ErrorLevel, GDFCrypt01, IECCurves, IEncoding, InformationRelevance, InformationRelevanceToString, IsAChargeTransparencyLiveLink, IsAChargeTransparencyRecord, IsAPublicKey, IsAPublicKeyLookup, IsAPublicKeySignature, IsAPublicKeyXY, IsASessionCryptoResult, IsAURL, IsNullOrEmpty, IsValidURL, JSONSignatureVerificationStatus, MENNEKES_EDL40_OBIS, MENNEKES_EDL40_XMLNS, Mennekes, MennekesCrypt01, OBIS2Hex, OBIS2MeasurementName, OBIS_RegExpr, OCMF, OCMFBonnTariffParseError, OCMFTransactionTypes, OCMF_SIGNATURE_ALGORITHMS, OCMFv1_x, OCPI, OIDInfo, PCDF, PCDFCrypt01, PCDFParseError, PCDFValidationError, PCDF_FIELD_ORDER, PCDF_PREFIX, PTB, ParseJSON_LD, PublicKeyFormats, IPublicKeyInfo_exports as PublicKeyInfo, SAFEXML, SessionVerificationResult, SetHex, SetInt8, SetText, SetText_withLength, SetTimestamp, SetTimestamp32, SetUInt32, SetUInt32_withCode, SetUInt64, SetUInt64D, SignMessage, SignatureFormats, IURL_exports as SimpleURL, TimeStatusTypes, URLContext, UTC2human, VerificationResult, VerifyJSONMessageSignatures, WarningLevel, WhenNullOrEmpty, XMLContainer, asJSONArray, asJSONObject, asNumber, asString, base64ToBytes, buf2hex, buildEDL40Signature, buildIsaSignature, buildMennekesSignatureData, bytesToBase64, bytesToHex, canParseEDL40, canonicalJSONBytes, canonicalJSONStringify, cleanHex, closeFullscreen, collectDocumentPublicKeys, createCompatibleCurve, createHexString, createLegacyP192Curve, dateToMennekesLocalEpochSeconds, decodeSmlMessages, extractMennekesChargingProcesses, findEntryByObis, findGetListRes, firstKey, firstValue, generateSignatureKeyPair, getArrayElement, getArrayLikeElement, getDirectChildByLocalName, getDirectChildrenByLocalName, getElementsByLocalName, getFirstArrayElement, getInt16Bytes, getInt32Bytes, getInt64Bytes, getInt8Bytes, getLastArrayElement, getOCMFSignatureDisplay, getSignatureSuite, getTrimmedTextContent, hashFile, hex2bin, hex32, hexToArrayBuffer, hexToBytes, intFromBytes, isEncodedValue, isGeoLocation, isI18NString, isICryptoResult, isIFileInfo, isISessionCryptoResult1, isISessionCryptoResult2, isJSONLDObject, isMandatoryArrayOfStrings, isMandatoryBoolean, isMandatoryDecimal, isMandatoryJSONArray, isMandatoryJSONObject, isMandatoryNumber, isMandatoryString, isMandatoryURL, isOIDInfo, isObject, isOptionalArrayOfStrings, isOptionalDecimal, isOptionalJSONArray, isOptionalJSONArrayError, isOptionalJSONArrayOk, isOptionalJSONObject, isOptionalNumber, isOptionalString, isOptionalStringArray, isOptionalStringOrOIDInfo, isOptionalURL, isPCDFText, isPublicKeySubject, isString, isStringArray, isStringOrOIDInfo, isStringOrStringArray, isaListNameContext, jsonPrettyPrinter, measurementName2human, meterTimeZone, normalizePCDFPublicKeyHex, normalizeXMLText, ocmfBonnTariffToChargingTariff, openFullscreen, pad, parseAndVerifyJSONSignatures, parseDescription, parseEDL40, parseHexString, parseMennekesXMLDocument, parseNumber, parseOBIS, parseOCMFBonnTariffText, parsePCDFDocument, parsePCDFPublicKey, parsePCDFSignature, parseSmlTime, parseUTC, readQRCodeTextFromImage, readQRCodeTextFromImageData, readTLV, secp224k1, setUILocale, sha256, sha256____, sha384, sha384____, sha512, sha512____, signJSONMessage, signMessage, stripPCDFControlCharacters, stripTransport, time2human, timeZoneOffsetMinutes, toArrayBuffer, toSessionVerificationResults, toUint8Array, transformEDL40Status, tryParseOCMFBonnTariffText, unquotePCDFText, validatePCDFFields, verifyDocumentSignatures, verifyEDL40Document, verifyJSONMessageSignatureResults, verifyJSONMessageSignatures, verifyJSONSignature, verifyJSONSignatureResult, verifyPCDFDocument };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map