@open-charging-cloud/wwcp-poi 0.2.0 → 0.3.0

package/README.md

@@ -24,15 +24,19 @@ ML-DSA-44/65/87.
 
 ## Status
 
-**0.2.0 is prepared, not yet published to npm.** It includes the shared trust and session verification APIs previously
-supplied as 0.1.2-dev.0 development packages. See [the changelog](CHANGELOG.md#020-prepared-not-yet-published) for the
-changes and migration requirements. The experimental profiles below remain experimental; a package release does not
-establish production witness services or independently verified actual measurement time.
+**0.3.0 is prepared, not yet published to npm.** It reads, refuses and applies versions, change sets and histories as
+WWCP_POI3 does, in its words, and adds EV Taler phase 2. See [the changelog](CHANGELOG.md#030-prepared-not-yet-published)
+for the changes and migration requirements: versions, change sets and signatures 0.2.0 took are refused. Until then
+0.2.0, published to npm on 2 November 2026, is the latest release. The experimental profiles below remain experimental;
+a package release does not establish production witness services or independently verified actual measurement time.
 
 **Milestone 1: the examples of WWCP_POI, checked in TypeScript.** The examples A1 to A14 of
-[WWCP_POI/examples](https://github.com/OpenChargingCloud/WWCP_POI/tree/master/examples) at commit `33447ac` are checked
-from what the C# examples publish, as their `Validate()` methods check them, and the same for proofs of charging stations
-the C# implementation makes; also from a second run of the C# examples, with new keys. See [Tests](#tests).
+[WWCP_POI/examples](https://github.com/OpenChargingCloud/WWCP_POI/tree/master/examples) are checked from what the C#
+examples publish, as their `Validate()` methods check them, and the same for proofs of charging stations the C#
+implementation makes: in the tests from the run of WWCP_POI `045e180` vendored here, which also holds the EV Taler
+merchant of example A15, and every night from a new run of WWCP_POI master, with new keys. EV Taler phase 2, which
+example A16 shows, is checked on the proof of example A15 and probed against WWCP_POI3; what example A16 publishes is not
+checked yet. See [Tests](#tests).
 
 What a review of the C# implementation found while porting it is in
 [docs/csharp-review.md of WWCPPOIConformanceTests](https://github.com/OpenChargingCloud/WWCPPOIConformanceTests/blob/master/docs/csharp-review.md),
@@ -181,7 +185,8 @@ const history = History.fromSnapshot(checkpointSnapshotJSON, {
         trust.verifyOperatorSignatures(commit.signatures, (s, key) => commit.verifySignature(s, key), 'the commit');
         trust = trust.followedBy(after);        // the keys its operator states anew, signed by those trusted
     },
-    verifyCheckpoint: checkpoint => verifyCheckpointSignatures(checkpoint, trust, { witnesses, requiredWitnesses: 2 }),
+    // A checkpoint is taken with the signatures that verified here, the others left out (S39).
+    verifyCheckpoint: checkpoint => verifyCheckpointSignatures(checkpoint, trust, { witnesses, requiredWitnesses: 2 }).verified,
 });
 
 for (const commit of commitsSince)
@@ -200,20 +205,20 @@ epoch2.root.commit.id;    // the published genesis of epoch 2, 128 hexadecimal d
 | | |
 |---|---|
 | Canonical JSON, deterministic CBOR (Styx) | complete, including Styx's string escaping and decimals as `System.Decimal` holds them |
-| Keys, thumbprints, signatures | EC2, OKP and AKP COSE keys, read in the words of WWCP_POI; all signature algorithms of section 4; the key usages `infrastructure`, `tariffs`, `priceStatements`, `models`, `software`, `certificates`, `payments`, `party` |
+| Keys, thumbprints, signatures | EC2, OKP, AKP and RSA COSE keys, read in the words of WWCP_POI; all signature algorithms of section 4; the key usages `infrastructure`, `tariffs`, `priceStatements`, `models`, `software`, `certificates`, `payments`, `party` |
 | Trust anchors | QR code (`WWCP/TA-2:` and Base45 of CBOR), URL and JSON forms, read and written; key statements followed by succession |
-| Roaming networks | ETags `json`, `cbor`, `effectiveTree`; the roaming network operator, its key statement and certificates; the keys of every party and of the roaming network operator as WWCP_POI reads them, none twice, none both a signing and an identity key, no identity key naming usages; the identifications unique within the network (grid connection points, energy meters, parking entities, transparency software releases and certificates, energy meter templates and groups, groups of operators and providers, offers), each once, compared as the C# types compare them; hardware revisions, firmware versions and serial numbers as WWCP_POI reads them, not empty, no whitespace at either end, those of a model each once; certificates as WWCP_POI reads them, for exactly one model, with its versions and releases; the conformity assessment bodies issuing them as WWCP_POI reads them, a notified body number of four digits for one body only, the legislations they are notified for neither empty nor twice, in their ordinal order, a certificate only under one of them; the content as WWCP_POI writes it (SPECIFICATION.md 2): what it takes and writes otherwise is refused, as written again it would be another text than the one hashed (ordered lists out of their order or with untrimmed texts, lists it leaves out given empty or writes also empty left out, properties given as null, embedded objects naming a JSON-LD context, texts in languages not as Styx writes them or empty, timestamps not UTC to the millisecond, entities without their lastChange, parties without their name, identifications given as numbers, properties of keys and of EV Taler merchants and exchanges it does not read, their base URLs and currencies not as it writes them); the roaming network operator, its key statement and certificates, the tree hash algorithms and the identifications of entities in the words of WWCP_POI.; of every entity what its type in WWCP_POI3 neither writes nor reads, and values it writes otherwise (trimmed, with a scheme, in its case, coordinates as doubles), in the words of its written form since 3de830a ("the content leaves it out", "the content holds it as …"). Not yet: properties of another JSON type or missing, the formats of identifications, and the references, which WWCP_POI refuses |
+| Roaming networks | ETags `json`, `cbor`, `effectiveTree`; the roaming network operator, its key statement and certificates; the keys of every party and of the roaming network operator as WWCP_POI reads them, none twice, none both a signing and an identity key, no identity key naming usages; the identifications unique within the network (grid connection points, energy meters, parking entities, transparency software releases and certificates, energy meter templates and groups, groups of operators and providers, offers), each once, compared as the C# types compare them; transparency software releases and certificates identified under the manufacturer or body that has them (SPECIFICATION.md 4.1): its `@id`, a colon and a name without one, the prefix compared without case, also after a change set; hardware revisions, firmware versions and serial numbers as WWCP_POI reads them, not empty, no whitespace at either end, those of a model each once; certificates as WWCP_POI reads them, for exactly one model, with its versions and releases; the conformity assessment bodies issuing them as WWCP_POI reads them, a notified body number of four digits for one body only, the legislations they are notified for neither empty nor twice, in their ordinal order, a certificate only under one of them; the content as WWCP_POI writes it (SPECIFICATION.md 2): what it takes and writes otherwise is refused, as written again it would be another text than the one hashed (ordered lists out of their order or with untrimmed texts, lists it leaves out given empty or writes also empty left out, properties given as null, embedded objects naming a JSON-LD context, texts in languages not as Styx writes them or empty, timestamps not UTC to the millisecond, entities without their lastChange, parties without their name, identifications given as numbers, properties of keys and of EV Taler merchants and exchanges it does not read, their base URLs and currencies not as it writes them); the roaming network operator, its key statement and certificates, the tree hash algorithms and the identifications of entities in the words of WWCP_POI.; of every entity what its type in WWCP_POI3 neither writes nor reads, and values it writes otherwise (trimmed, with a scheme, in its case, coordinates as doubles, numbers, booleans and texts as their types, durations in whole ticks, opening times as Styx writes them, NUTS codes in upper case, countries of addresses by their alpha-3 codes), in the words of its written form since 3de830a ("the content leaves it out", "the content holds it as …"). Every entity WWCP_POI3 reads, as it reads it, refused in its words and order (`reading.ts`): JSON types, mandatory properties, values, identifications, names of enumerations, currencies, URLs, timestamps, texts in languages, data licenses, and what the constructor of each entity refuses of what it read; the references the constructor of the roaming network checks, with the identifications unique within it, in its order (`references.ts`): manufacturers, models, hardware revisions, firmware versions, releases, certificates, grid connection points, charging stations, parking spaces and maintainers the network has, stations and meters within what their models allow, no key of two parties; time zones of charging pools and their templates of a region of the IANA time zone database, as it writes them, which the platform knows; charging tariff offers of an operator not overlapping, in the time zones of their EVSEs, and of an e-mobility provider not made to overlap by a change set of it (`offers.ts`); measurement public keys and their certificates as WWCP_POI3 checks them with BouncyCastle (`measurementPublicKey.ts`): DER, RSA, EC of the 84 named curves BouncyCastle knows, Ed25519, Ed448, X25519, X448, DSA, ML-DSA, ML-KEM, SLH-DSA, each certificate issued by the next one. Taken as given, where WWCP_POI3 checks them: points on curves over binary fields, explicit curve parameters, keys of Diffie-Hellman, ElGamal, GOST and DSTU |
 | Effective members (9.2) | EVSEs, charging stations, charging pools, charging tariffs, energy meters. Parking spaces and energy meters of grid connection points taking templates are refused, not calculated |
-| Proofs (8.4), attestations (8.5) | complete, with the manufacturers and models of the station and its meters, the transparency software releases and certificates of the meters; subject attestations do not count for a whole proof |
-| Change sets (4) | `Add`, `Remove`, `UpdateProperty`, `RemoveProperty` of parties (charging station operators, e-mobility providers, grid and parking operators, charging station and energy meter manufacturers, transparency software manufacturers, conformity assessment bodies), the roaming network and its operator, of charging pools, stations, EVSEs, tariffs, templates and groups of charging station operators, energy meter templates and groups, models of manufacturers, transparency software releases and certificates, with their owners' signatures, quorum and proof of possession, and the properties a change set may change: not the version of a release, also not by removing it and adding it again; the `notifiedBodyNumber` and `notifiedFor` of a conformity assessment body by the roaming network operator only. Element changes, preconditions, offers and the entities of providers, grid and parking operators are refused, not applied. The references the C# implementation checks after every change set (a manufacturer, model, release or certificate a station, meter or certificate names) are not checked again: the `afterETags` of the change set pin the version it leads to. The identifications unique within the network are, as in every version |
-| Histories (5, 10, 11) | linear histories from snapshots, anchored in the trust anchor as a peer of WWCP_POI starts (10.5): a snapshot of a checkpoint by the checkpoint, signed as the roaming network operator, a snapshot of the head by its attestations, none without a trust anchor unless taken unanchored explicitly; commits, checkpoints, their lines and signatures, signed ones only with a verifier; proofs of commits, archive segments; epochs: their profiles, the final checkpoint, the genesis of the next epoch, its first checkpoint. Merges are not taken yet; no peer, no server |
+| Proofs (8.4), attestations (8.5) | complete, with the manufacturers and models of the station and its meters, the transparency software releases and certificates of the meters; subject attestations do not count for a whole proof; whether a proof gives a child array of an entity completely, and its size also where it gives some or none (`givesCompletely`, `sizeOf`) |
+| Change sets (4) | `Add`, `Remove`, `UpdateProperty`, `RemoveProperty` of parties (charging station operators, e-mobility providers, grid and parking operators, charging station and energy meter manufacturers, transparency software manufacturers, conformity assessment bodies), the roaming network and its operator, of charging pools, stations, EVSEs, tariffs, templates and groups of charging station operators, energy meter templates and groups, models of manufacturers, transparency software releases and certificates, with their owners' signatures, quorum and proof of possession, and the properties a change set may change: not the version of a release, also not by removing it and adding it again; the `notifiedBodyNumber` and `notifiedFor` of a conformity assessment body by the roaming network operator only. The charging tariff offers of operators and providers, the groups of providers, the grid connection points of grid operators, the parking data of parking operators and the parking spaces of operators, owned by the party embedding them, a grid connection point by its maintainer. `AddElement`, `RemoveElement`, `ReplaceElement`, `UpdateElementProperty`, `RemoveElementProperty` of all of these, by their element path, as WWCP_POI3 applies them (`elements.ts`): as the change of the property of the entity their path starts with, owned and checked as that change, their old value compared with the element they address; keys and tree hash algorithms changed as a whole only. The properties of infrastructure a change set may change, as WWCP_POI3 names them. Preconditions as WWCP_POI3 checks them (`preconditions.ts`): the ETag an entity still has in the version a change set is applied to, over its representation as the roaming network embeds it, in JSON or CBOR, the entity found by its type and identification as its type compares it. Stamped as WWCP_POI 12e993a stamps it (S5): the lastChange of the network, of what it changes, adds and embeds, and the created of what it adds without one, are its createdAt, or the lastChange of the version it is applied to where that is later, so that no lastChange goes back; its keys are checked at its createdAt. The references and the identifications unique within the network are checked after the last change, as the C# implementation checks them there, in its words and order; what an entity refuses as it is read keeps the words of a version, without the `Change N:` of the C# implementation |
+| Histories (5, 10, 11) | linear histories from snapshots, anchored in the trust anchor as a peer of WWCP_POI starts (10.5): a snapshot of a checkpoint by the checkpoint, signed as the roaming network operator, a snapshot of the head by its attestations, none without a trust anchor unless taken unanchored explicitly; its `effectiveLastChanges` read as WWCP_POI reads them, not taken, as the effective tree takes none (8.1); commits, checkpoints, their lines and signatures, signatures read as WWCP_POI reads them (texts trimmed, none empty), signed ones only with a verifier, checkpoints taken with the signatures that verify here, the others left out (S39), the roles they must be signed in (`requiredSignatureRoles`, `requiredCheckpointSignatureRoles`), a role of a commit only by a key its version lets sign in it (`keyMaySignIn`), the signatures of one key in one role counted once; proofs of commits, archive segments; epochs: their profiles, the final checkpoint, the genesis of the next epoch, its first checkpoint. Merges are not taken yet; no peer, no server |
 | Price statements (12) | statements, chains, checkpoint trees and proofs in every epoch |
 | Runtime status (12.5) | status updates, frames of the WebSocket, the runtime status of a snapshot. No WebSocket client: the app brings its own |
 | QI-Digital documents | a proof of concept of WWCP_POI, as example A14 uses it: digital calibration certificates, digital certificates of conformity of a model or of the quality system of a manufacturer, digital declarations of conformity, read in the words of WWCP_POI and checked against a roaming network (the keys of their issuers, the models, the charging stations and energy meters as they are at runtime) and against each other (a declaration and the certificates it names, a certificate and the meter it covers). Their signature input is what WWCP_POI writes again of what it read, numbers without trailing zeros. Read and checked, not signed |
-| EV Taler | phase 1 of WWCP_POI's concept of paying for charging with GNU Taler: the merchant of a charging station operator (`evTaler`), read and refused as WWCP_POI reads it, changed by a key that may sign `payments`; payment options an open set of names, none twice whatever its case; the payment option EVTaler of a charging pool or template only with a merchant; the EV Taler tariff of an EVSE and the exchanges in its currency, from the proof of its station (`evTalerTariffOf`, `evTalerExchangesAt`, `paymentOptionName`). Nothing here takes or makes a payment |
+| EV Taler | phase 1 of WWCP_POI's concept of paying for charging with GNU Taler: the merchant of a charging station operator (`evTaler`), read and refused as WWCP_POI reads it, changed by a key that may sign `payments`; payment options an open set of names, none twice whatever its case; the payment option EVTaler of a charging pool or template only with a merchant; the EV Taler tariff of an EVSE and the exchanges in its currency, from the proof of its station (`evTalerTariffOf`, `evTalerExchangesAt`, `paymentOptionName`). Phase 2, as WWCP_POI c2d39e5 checks it (`src/evTaler`): the contract terms of the steps of a session (`EVTalerContractTerms`, version 0), their step in `extra.wwcp` (`EVTalerStep`), a `taler://pay` URI (`EVTalerPayURI`), checked against the proof of the station: the operator's merchant and exchanges, the EV Taler tariff of the EVSE (`evTalerTariff`), the price statement current when the session began, each step following the one before, from step 2 on the signed meter value at the start verified with a measurement key the proof gives by a transparency software passed in (`EVTalerMeterValueVerifier`; WWCP_POI reads no format of a meter), the amount of a step recalculated where the prices are of the simple profile (`EVTalerRates`), as System.Decimal calculates it (`NetDecimal`); the settlement statement (`EVTalerSettlement`), signed by the operator with a key for `payments`, refused without both signed meter values, its price recalculated. Nothing here takes or makes a payment, nor signs a settlement |
 
-Whatever is not ported is refused with a `POIError` saying so, but for the references named above: the library never
-takes as checked what it can not check.
+Whatever is not ported is refused with a `POIError` saying so, but for what the row of roaming networks names as not
+yet ported: the library takes no other version the C# implementation refuses.
 And whatever it calculated otherwise than the C# implementation would end in other ETags or identifications, and be
 refused as well.
 
@@ -310,13 +315,19 @@ never edit them here, and its `VendoredCopiesTests` fail when these copies drift
 - `tests/vectors/poi-*.json`, the golden vectors: canonical JSON and CBOR, Base64 and Base45, the examples of section 6
   of the specification, station proofs of its example network signed with its keys against a trust anchor, what to
   calculate of the documents of the run below, documents to refuse, the QI-Digital documents of example A14 of that run
-  taken and refused as WWCP_POI checks them, and small histories WWCPPOIConformanceTests signs itself, replayed step by
-  step (the format: the
+  taken and refused as WWCP_POI checks them, small histories WWCPPOIConformanceTests signs itself, replayed step by
+  step, and the verifier extensions (`poi-verifier.json`) checked against the fixtures of ChargyWebApp below as
+  WWCP_POI3 checks them (the format: the
   [README of the vectors](https://github.com/OpenChargingCloud/WWCPPOIConformanceTests/blob/master/test-vectors/README.md));
-- `tests/vectors/csharp-33447ac`, what one run of the C# examples of WWCP_POI at commit `33447ac` published (public data
-  only; its output is `csharp-output.log` there), and in `proofs/`, what `proofs/MakeProofs.cs.txt` made of the same
-  history with the C# implementation: proofs of charging stations of epoch 2, the commits of epoch 2 up to the head, and
-  the ECDSA twin of a price statement.
+- `tests/vectors/csharp-045e180`, what one run of the C# examples A1 to A15 of WWCP_POI at commit `045e180` published
+  (public data only; its output is `csharp-output.log` there), and in `proofs/`, what `proofs/MakeProofs.cs.txt` made of
+  the same history with the C# implementation: proofs of charging stations of epoch 2, the commits of epoch 2 up to the
+  head, revision 11 after the EV Taler merchant of example A15, and the ECDSA twin of a price statement;
+- `tests/vectors/chargy-fc513cd`, the POI fixtures of ChargyWebApp at commit `fc513cd`, which `poi-verifier.json` names
+  its documents in: histories, prices, publications, sessions and trust transitions;
+- `tests/vectors/chargy`, what WWCPPOIConformanceTests makes of them itself, which `poi-verifier.json` names with
+  `"documents": "chargy"`: in `POIPrices/`, the price evidence of sessions as ChargyWebApp made it, every signature
+  deterministic.
 
 - `tests/conformance.test.ts`: the golden vectors, as the C# implementation runs them in WWCPPOIConformanceTests.
 - `tests/canonical.test.ts`, `tests/specification.test.ts`: the test vectors of Styx and of section 6 of the
@@ -332,6 +343,8 @@ never edit them here, and its `VendoredCopiesTests` fail when these copies drift
   with the keys of section 6 of the specification, to change them at will.
 - `tests/chargingStation.test.ts`, `tests/client.test.ts`: proofs of charging stations of epoch 2, as an app checks them.
 - `tests/replay.test.ts`: the whole history of `QA`, both epochs, commit by commit, with every checkpoint.
+- `tests/reading.test.ts`, `tests/references.test.ts`: `QA`, and `QA` with an entity of every kind
+  (`tests/richNetwork.ts`), changed as WWCP_POI3 at 89d2e02 refuses them, in its words.
 - `tests/build/bundle.test.js`, `tests/browser/browser.test.ts`: the bundle and the browser, as above.
 
 To check a run of your own of the C# examples, with its new keys:
@@ -479,8 +492,8 @@ signature encodings nor changed tariff definitions reuse another original's rece
 
 ## Publishing
 
-Version 0.2.0 is prepared locally. Preparation does not publish to npm, create a release tag or change a consumer's
-pinned development package. Validate the source and inspect the package before approving a release:
+Version 0.3.0 is prepared locally. Preparation does not publish to npm, create a release tag or change a consumer's
+dependency. Published versions are immutable. Validate the source and inspect the package before approving a release:
 
 ```bash
 npm ci
@@ -496,10 +509,10 @@ status and date, rebuild and check the final archive. Commit the reviewed releas
 commit to each configured remote:
 
 ```bash
-git tag -s v0.2.0 -m "v0.2.0"
-git push origin master v0.2.0
-git push git1 master v0.2.0
-git push git2 master v0.2.0
+git tag -s v0.3.0 -m "v0.3.0"
+git push origin master v0.3.0
+git push git1 master v0.3.0
+git push git2 master v0.3.0
 ```
 
 Publish the inspected archive only after that separate approval:
@@ -507,12 +520,11 @@ Publish the inspected archive only after that separate approval:
 ```bash
 npm login
 npm whoami
-npm publish ./open-charging-cloud-wwcp-poi-0.2.0.tgz --access public
+npm publish ./open-charging-cloud-wwcp-poi-0.3.0.tgz --access public
 ```
 
-After publication, consumers can replace their local POI development archive with
-`@open-charging-cloud/wwcp-poi@^0.2.0`, refresh their lockfile and verify a clean install. Their separate ChargyCore
-candidate still needs its own release; publishing POI alone does not replace it.
+After publication, consumers read [Migration](CHANGELOG.md#migration) and move to `@open-charging-cloud/wwcp-poi@^0.3.0`,
+which a range of `^0.2.0` does not take, then refresh their lockfile and verify a clean install.
 
 
 ## License

package/dist/crypto/ber.d.ts

@@ -0,0 +1,48 @@
+/** Universal tags. */
+export declare const TAG: {
+    readonly boolean: 1;
+    readonly integer: 2;
+    readonly bitString: 3;
+    readonly octetString: 4;
+    readonly null: 5;
+    readonly objectIdentifier: 6;
+    readonly sequence: 16;
+    readonly set: 17;
+};
+export declare const CONTEXT = 2;
+/** A record of BER. */
+export interface BER {
+    /** Universal 0, application 1, context-specific 2, private 3. */
+    readonly tagClass: number;
+    readonly tagNumber: number;
+    readonly constructed: boolean;
+    /** The value of a primitive record, of a string in segments its segments joined. */
+    readonly content: Uint8Array;
+    readonly children: readonly BER[];
+    /** Whether DER writes it and what it holds as given. */
+    readonly der: boolean;
+    /** The record as given. */
+    readonly encoded: Uint8Array;
+}
+export declare class BERError extends Error {
+}
+export declare const isSequence: (record: BER) => boolean;
+export declare const isInteger: (record: BER) => boolean;
+export declare const isNull: (record: BER) => boolean;
+export declare const isOID: (record: BER) => boolean;
+export declare const isBitString: (record: BER) => boolean;
+/** The one record of the given bytes, as `Asn1Object.FromByteArray` reads it: nothing after it. */
+export declare function readBER(bytes: Uint8Array): BER;
+/** The first record of the given bytes, as `Asn1InputStream.ReadObject` reads it from a stream: what follows it left. */
+export declare function readFirstBER(bytes: Uint8Array): BER;
+/** What `GetInstance` of a class throws of a record of another one. */
+export declare const illegal: (record: BER) => BERError;
+/** An integer as `DerInteger` reads it: two's complement in its fewest octets. */
+export declare function integerOf(record: BER): bigint;
+/** An object identifier in dotted decimal, as `DerObjectIdentifier` reads it: each arc in its fewest octets. */
+export declare function oidOf(record: BER): string;
+/** The octets of a bit string, as `DerBitString.GetOctets` gives them: of whole octets. */
+export declare function octetsOf(record: BER): Uint8Array;
+/** The children of a sequence of the given sizes, as a `GetInstance` of a sequence takes them. */
+export declare function sequenceOf(record: BER, sizes: readonly number[]): readonly BER[];
+//# sourceMappingURL=ber.d.ts.map

package/dist/crypto/ber.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ber.d.ts","sourceRoot":"","sources":["../../src/crypto/ber.ts"],"names":[],"mappings":"AAuBA,sBAAsB;AACtB,eAAO,MAAM,GAAG;;;;;;;;;CASN,CAAC;AAEX,eAAO,MAAM,OAAO,IAAI,CAAC;AAEzB,uBAAuB;AACvB,MAAM,WAAW,GAAG;IAChB,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,EAAM,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAK,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAG,OAAO,CAAC;IAC/B,oFAAoF;IACpF,QAAQ,CAAC,OAAO,EAAO,UAAU,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAM,SAAS,GAAG,EAAE,CAAC;IACtC,wDAAwD;IACxD,QAAQ,CAAC,GAAG,EAAW,OAAO,CAAC;IAC/B,2BAA2B;IAC3B,QAAQ,CAAC,OAAO,EAAO,UAAU,CAAC;CACrC;AAED,qBAAa,QAAS,SAAQ,KAAK;CAAG;AAKtC,eAAO,MAAM,UAAU,GAAI,QAAQ,GAAG,KAAG,OAA4C,CAAC;AACtF,eAAO,MAAM,SAAS,GAAK,QAAQ,GAAG,KAAG,OAA2C,CAAC;AACrF,eAAO,MAAM,MAAM,GAAQ,QAAQ,GAAG,KAAG,OAAwC,CAAC;AAClF,eAAO,MAAM,KAAK,GAAS,QAAQ,GAAG,KAAG,OAAoD,CAAC;AAC9F,eAAO,MAAM,WAAW,GAAI,QAAQ,GAAG,KAAG,OAA6C,CAAC;AAwLxF,mGAAmG;AACnG,wBAAgB,OAAO,CAAC,KAAK,EAAE,UAAU,GAAG,GAAG,CAY9C;AAED,yHAAyH;AACzH,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,GAAG,CAOnD;AAuBD,uEAAuE;AACvE,eAAO,MAAM,OAAO,GAAI,QAAQ,GAAG,KAAG,QACsE,CAAC;AAE7G,kFAAkF;AAClF,wBAAgB,SAAS,CAAC,MAAM,EAAE,GAAG,GAAG,MAAM,CAgB7C;AAED,gHAAgH;AAChH,wBAAgB,KAAK,CAAC,MAAM,EAAE,GAAG,GAAG,MAAM,CAgCzC;AAED,2FAA2F;AAC3F,wBAAgB,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,UAAU,CAkBhD;AAED,kGAAkG;AAClG,wBAAgB,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,EAAE,CAUhF"}

package/dist/crypto/certificates.d.ts

@@ -0,0 +1,21 @@
+import { type BER } from './ber.ts';
+import { type SubjectPublicKeyInfo } from './publicKeys.ts';
+export interface Certificate {
+    /** Its content, the TBSCertificate the signature is of. */
+    readonly tbs: BER;
+    readonly signatureAlgorithm: BER;
+    readonly tbsAlgorithm: BER;
+    readonly signature: BER;
+    readonly subjectPublicKeyInfo: SubjectPublicKeyInfo;
+}
+/** The DER of a certificate, as `ReadCertificate` reads it: undefined where it gives none, as it does of what is no sequence. */
+export declare function certificateOf(bytes: Uint8Array): {
+    certificate: Certificate;
+    der: boolean;
+} | undefined;
+/**
+ * Whether the certificate is issued by the other one, as `X509Certificate.Verify` with the public key of the other one
+ * tells: of a key BouncyCastle makes, the signature algorithm the one of the content, the signature verified.
+ */
+export declare function issuedBy(certificate: Certificate, issuer: Certificate): boolean;
+//# sourceMappingURL=certificates.d.ts.map

package/dist/crypto/certificates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"certificates.d.ts","sourceRoot":"","sources":["../../src/crypto/certificates.ts"],"names":[],"mappings":"AAmBA,OAAO,EAA0H,KAAK,GAAG,EAAE,MAAM,UAAU,CAAC;AAE5J,OAAO,EAAuD,KAAK,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAWjH,MAAM,WAAW,WAAW;IACxB,2DAA2D;IAC3D,QAAQ,CAAC,GAAG,EAAmB,GAAG,CAAC;IACnC,QAAQ,CAAC,kBAAkB,EAAI,GAAG,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAU,GAAG,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAa,GAAG,CAAC;IACnC,QAAQ,CAAC,oBAAoB,EAAE,oBAAoB,CAAC;CACvD;AAqFD,iIAAiI;AACjI,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG;IAAE,WAAW,EAAE,WAAW,CAAC;IAAC,GAAG,EAAE,OAAO,CAAA;CAAE,GAAG,SAAS,CAgEvG;AA6JD;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAQ/E"}

package/dist/crypto/curves.d.ts

@@ -0,0 +1,25 @@
+export interface PrimeCurve {
+    readonly oid: string;
+    readonly name: string;
+    /** What BouncyCastle names its field elements, e.g. `SecP256R1FieldElement`, `Fp field element`. */
+    readonly field: string;
+    readonly bits: number;
+    readonly p: bigint;
+    readonly a: bigint;
+    readonly b: bigint;
+    readonly n: bigint;
+    readonly h: bigint;
+    readonly gx: bigint;
+    readonly gy: bigint;
+}
+export interface BinaryCurve {
+    readonly oid: string;
+    readonly name: string;
+    readonly field: string;
+    readonly bits: number;
+}
+/** The prime curves by their object identifiers. */
+export declare const PRIME_CURVES: ReadonlyMap<string, PrimeCurve>;
+/** The curves over binary fields by their object identifiers, of which this library tells the lengths of points only. */
+export declare const BINARY_CURVES: ReadonlyMap<string, BinaryCurve>;
+//# sourceMappingURL=curves.d.ts.map

package/dist/crypto/curves.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"curves.d.ts","sourceRoot":"","sources":["../../src/crypto/curves.ts"],"names":[],"mappings":"AAwBA,MAAM,WAAW,UAAU;IACvB,QAAQ,CAAC,GAAG,EAAK,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAI,MAAM,CAAC;IACxB,oGAAoG;IACpG,QAAQ,CAAC,KAAK,EAAG,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAI,MAAM,CAAC;IACxB,QAAQ,CAAC,CAAC,EAAO,MAAM,CAAC;IACxB,QAAQ,CAAC,CAAC,EAAO,MAAM,CAAC;IACxB,QAAQ,CAAC,CAAC,EAAO,MAAM,CAAC;IACxB,QAAQ,CAAC,CAAC,EAAO,MAAM,CAAC;IACxB,QAAQ,CAAC,CAAC,EAAO,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAM,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAM,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IACxB,QAAQ,CAAC,GAAG,EAAK,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAI,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAG,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAI,MAAM,CAAC;CAC3B;AA8bD,oDAAoD;AACpD,eAAO,MAAM,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CACiE,CAAC;AAE3H,yHAAyH;AACzH,eAAO,MAAM,aAAa,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAClB,CAAC"}

package/dist/crypto/ecc.d.ts

@@ -0,0 +1,34 @@
+import type { PrimeCurve } from './curves.ts';
+export declare const mod: (value: bigint, modulus: bigint) => bigint;
+export declare function modPow(base: bigint, exponent: bigint, modulus: bigint): bigint;
+/** The inverse modulo the given modulus; undefined, where there is none. */
+export declare function modInverse(value: bigint, modulus: bigint): bigint | undefined;
+export declare function gcd(a: bigint, b: bigint): bigint;
+export declare const bitLength: (value: bigint) => number;
+export declare const bigintOf: (bytes: Uint8Array) => bigint;
+/** The square root modulo an odd prime (Tonelli and Shanks); undefined, where there is none. */
+export declare function sqrtMod(value: bigint, p: bigint): bigint | undefined;
+/** A point of a curve; undefined is the point at infinity. */
+export interface Point {
+    readonly x: bigint;
+    readonly y: bigint;
+}
+/** k·P. */
+export declare const multiply: (curve: PrimeCurve, point: Point, k: bigint) => Point | undefined;
+export declare const onCurve: (curve: PrimeCurve, { x, y }: Point) => boolean;
+/** Whether a point is of the order of the curve, of a curve of a cofactor 1 always (`SatisfiesOrder`). */
+export declare const satisfiesOrder: (curve: PrimeCurve, point: Point) => boolean;
+export declare class PointError extends Error {
+}
+/**
+ * A point of a prime curve as `ECCurve.DecodePoint` of BouncyCastle decodes it, compressed (02, 03), uncompressed (04) or
+ * hybrid (06, 07), and refuses it in its words; undefined for the point at infinity (00).
+ */
+export declare function decodePoint(curve: PrimeCurve, encoded: Uint8Array): Point | undefined;
+/** The leftmost bits of a digest as wide as the order, as `CalculateE` of ECDsaSigner and DsaSigner takes them. */
+export declare function truncatedDigest(order: bigint, digest: Uint8Array): bigint;
+/** Whether (r, s) is a signature of the digest by the key Q of the curve (`ECDsaSigner.VerifySignature`). */
+export declare function verifyECDSA(curve: PrimeCurve, q: Point, digest: Uint8Array, r: bigint, s: bigint): boolean;
+/** Whether (r, s) is a signature of the digest by the key y of the group (p, q, g) (`DsaSigner.VerifySignature`). */
+export declare function verifyDSA(p: bigint, q: bigint, g: bigint, y: bigint, digest: Uint8Array, r: bigint, s: bigint): boolean;
+//# sourceMappingURL=ecc.d.ts.map

package/dist/crypto/ecc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ecc.d.ts","sourceRoot":"","sources":["../../src/crypto/ecc.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAQ9C,eAAO,MAAM,GAAG,GAAI,OAAO,MAAM,EAAE,SAAS,MAAM,KAAG,MAGpD,CAAC;AAEF,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAU9E;AAED,4EAA4E;AAC5E,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQ7E;AAED,wBAAgB,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAMhD;AAED,eAAO,MAAM,SAAS,GAAI,OAAO,MAAM,KAAG,MACI,CAAC;AAE/C,eAAO,MAAM,QAAQ,GAAI,OAAO,UAAU,KAAG,MACY,CAAC;AAE1D,gGAAgG;AAChG,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAuCpE;AAMD,8DAA8D;AAC9D,MAAM,WAAW,KAAK;IAClB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;CACtB;AA6ED,WAAW;AACX,eAAO,MAAM,QAAQ,GAAI,OAAO,UAAU,EAAE,OAAO,KAAK,EAAE,GAAG,MAAM,KAAG,KAAK,GAAG,SAC5B,CAAC;AAEnD,eAAO,MAAM,OAAO,GAAI,OAAO,UAAU,EAAE,UAAU,KAAK,KAAG,OACO,CAAC;AAErE,0GAA0G;AAC1G,eAAO,MAAM,cAAc,GAAI,OAAO,UAAU,EAAE,OAAO,KAAK,KAAG,OACE,CAAC;AAEpE,qBAAa,UAAW,SAAQ,KAAK;CAAG;AAExC;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,GAAG,KAAK,GAAG,SAAS,CA2DrF;AAED,mHAAmH;AACnH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,MAAM,CAKzE;AAED,6GAA6G;AAC7G,wBAAgB,WAAW,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAiB1G;AAED,qHAAqH;AACrH,wBAAgB,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAcvH"}

package/dist/crypto/publicKeys.d.ts

@@ -0,0 +1,51 @@
+import { type BER } from './ber.ts';
+import { type PrimeCurve } from './curves.ts';
+import { type Point } from './ecc.ts';
+export type PublicKey = {
+    readonly kind: 'ec';
+    readonly curve: PrimeCurve;
+    readonly q: Point;
+} | {
+    readonly kind: 'rsa';
+    readonly n: bigint;
+    readonly e: bigint;
+} | {
+    readonly kind: 'dsa';
+    readonly y: bigint;
+    readonly group: {
+        readonly p: bigint;
+        readonly q: bigint;
+        readonly g: bigint;
+    } | undefined;
+} | {
+    readonly kind: 'eddsa';
+    readonly curve: 'Ed25519' | 'Ed448';
+    readonly bytes: Uint8Array;
+} | {
+    readonly kind: 'ml-dsa';
+    readonly set: 'ML-DSA-44' | 'ML-DSA-65' | 'ML-DSA-87';
+    readonly bytes: Uint8Array;
+} | {
+    readonly kind: 'other';
+    readonly oid: string;
+};
+/** What BouncyCastle refuses of a key it makes, in its words. */
+export declare class KeyError extends Error {
+}
+/** A SubjectPublicKeyInfo as `SubjectPublicKeyInfo.GetInstance` reads it. */
+export interface SubjectPublicKeyInfo {
+    readonly record: BER;
+    readonly algorithm: string;
+    readonly parameters: BER | undefined;
+    readonly key: BER;
+}
+/** The SubjectPublicKeyInfo of the given record: a sequence of an algorithm identifier and a bit string. */
+export declare function subjectPublicKeyInfoOf(record: BER): SubjectPublicKeyInfo;
+/** The SubjectPublicKeyInfo of the given bytes, as `Asn1Object.FromByteArray` reads them: one record of BER, nothing after it. */
+export declare const subjectPublicKeyInfo: (bytes: Uint8Array) => SubjectPublicKeyInfo;
+/**
+ * The key of the given SubjectPublicKeyInfo, as `PublicKeyFactory.CreateKey` of BouncyCastle makes it; what it refuses
+ * thrown as a `KeyError` or a `BERError` in its words.
+ */
+export declare function publicKeyOf(info: SubjectPublicKeyInfo): PublicKey;
+//# sourceMappingURL=publicKeys.d.ts.map

package/dist/crypto/publicKeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publicKeys.d.ts","sourceRoot":"","sources":["../../src/crypto/publicKeys.ts"],"names":[],"mappings":"AAiBA,OAAO,EAA6F,KAAK,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/H,OAAO,EAA+B,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAA8D,KAAK,KAAK,EAAE,MAAM,UAAU,CAAC;AAYlG,MAAM,MAAM,SAAS,GACf;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAAK,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAA;CAAE,GAC1E;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAI,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAA;CAAE,GACnE;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAI,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAA;CAAE,GAC3I;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GAC5F;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,WAAW,GAAG,WAAW,GAAG,WAAW,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GAC9G;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAExD,iEAAiE;AACjE,qBAAa,QAAS,SAAQ,KAAK;CAAG;AAEtC,6EAA6E;AAC7E,MAAM,WAAW,oBAAoB;IACjC,QAAQ,CAAC,MAAM,EAAO,GAAG,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAI,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAG,GAAG,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAU,GAAG,CAAC;CAC7B;AAED,4GAA4G;AAC5G,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,GAAG,GAAG,oBAAoB,CAUxE;AAED,kIAAkI;AAClI,eAAO,MAAM,oBAAoB,GAAI,OAAO,UAAU,KAAG,oBACf,CAAC;AAsK3C;;;GAGG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,oBAAoB,GAAG,SAAS,CA0DjE"}

package/dist/crypto/rsa.d.ts

@@ -0,0 +1,30 @@
+/** A digest by the object identifier of its algorithm. */
+export interface Digest {
+    readonly oid: string;
+    readonly size: number;
+    readonly digest: (data: Uint8Array) => Uint8Array;
+}
+export declare const DIGESTS: {
+    readonly md5: Digest;
+    readonly sha1: Digest;
+    readonly sha224: Digest;
+    readonly sha256: Digest;
+    readonly sha384: Digest;
+    readonly sha512: Digest;
+    readonly sha512_224: Digest;
+    readonly sha512_256: Digest;
+    readonly sha3_224: Digest;
+    readonly sha3_256: Digest;
+    readonly sha3_384: Digest;
+    readonly sha3_512: Digest;
+};
+export declare const digestByOid: (oid: string) => Digest | undefined;
+/** Whether an odd integer above 3 is probably prime, by rounds of Miller and Rabin with random bases. */
+export declare function isProbablePrime(candidate: bigint, rounds?: number): boolean;
+/** The error, when RsaKeyParameters of BouncyCastle refuses a public key, in its words and order; undefined for none. */
+export declare function rsaKeyError(modulus: bigint, exponent: bigint): string | undefined;
+/** Whether the signature of PKCS #1 v1.5 is of the message, its DigestInfo with NULL parameters or without (`RsaDigestSigner`). */
+export declare function verifyPKCS1(modulus: bigint, exponent: bigint, algorithm: Digest, message: Uint8Array, signature: Uint8Array): boolean;
+/** Whether the signature of PSS is of the message, with its digest, the digest of its mask and its salt length (`PssSigner`). */
+export declare function verifyPSS(modulus: bigint, exponent: bigint, algorithm: Digest, maskDigest: Digest, saltLength: number, message: Uint8Array, signature: Uint8Array): boolean;
+//# sourceMappingURL=rsa.d.ts.map

package/dist/crypto/rsa.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsa.d.ts","sourceRoot":"","sources":["../../src/crypto/rsa.ts"],"names":[],"mappings":"AA4BA,0DAA0D;AAC1D,MAAM,WAAW,MAAM;IACnB,QAAQ,CAAC,GAAG,EAAK,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAI,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,UAAU,CAAC;CACrD;AAKD,eAAO,MAAM,OAAO;;;;;;;;;;;;;CAaV,CAAC;AAEX,eAAO,MAAM,WAAW,GAAI,KAAK,MAAM,KAAG,MAAM,GAAG,SACgB,CAAC;AA8BpE,yGAAyG;AACzG,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,SAAK,GAAG,OAAO,CAuBvE;AAED,yHAAyH;AACzH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CA6BjF;AAyCD,mIAAmI;AACnI,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAmBrI;AAaD,iIAAiI;AACjI,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAsC3K"}

package/dist/encoding/text.d.ts

@@ -11,6 +11,15 @@ export declare function toBase64(bytes: Uint8Array): string;
  * padding and nonzero padding bits, as POI requires of keys and signature values (SPECIFICATION.md section 4).
  */
 export declare function fromBase64(text: string): Uint8Array;
+/** What `Convert.FromBase64String` of .NET says of a text it can not read. */
+export declare const DOTNET_BAD_BASE64 = "The input is not a valid Base-64 string as it contains a non-base 64 character, more than two padding characters, or an illegal character among the padding characters.";
+/**
+ * Whether `Convert.FromBase64String` of .NET reads the given text, though perhaps not canonically: white space left out
+ * anywhere, groups of four characters of the alphabet, at most two padding characters at the end, unused bits of any value.
+ */
+export declare const isDotNetBase64: (text: string) => boolean;
+/** Whether the given text is nonempty canonical Base64: what `Convert.ToBase64String` writes again of what it reads. */
+export declare const isCanonicalBase64: (text: string) => boolean;
 /** Base45 [RFC 9285], the encoding of the QR code of a trust anchor. */
 export declare function toBase45(bytes: Uint8Array): string;
 /** Reads Base45 [RFC 9285], refusing characters outside its alphabet and triples above 65535. */

package/dist/encoding/text.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"text.d.ts","sourceRoot":"","sources":["../../src/encoding/text.ts"],"names":[],"mappings":"AAyBA,+EAA+E;AAC/E,wBAAgB,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAK/C;AAED,2GAA2G;AAC3G,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,UAAQ,GAAG,UAAU,CAYnE;AAED,sFAAsF;AACtF,eAAO,MAAM,UAAU,GAAI,MAAM,OAAO,EAAE,QAAQ,MAAM,KAAG,IAAI,IAAI,MAIb,CAAC;AAevD,oCAAoC;AACpC,wBAAgB,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAmBlD;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAoCnD;AAMD,wEAAwE;AACxE,wBAAgB,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAgBlD;AAED,iGAAiG;AACjG,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAmCnD;AAGD,4CAA4C;AAC5C,wBAAgB,UAAU,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAWvE;AAED,mCAAmC;AACnC,wBAAgB,MAAM,CAAC,GAAG,KAAK,EAAE,UAAU,EAAE,GAAG,UAAU,CAYzD;AAED,aAAa;AACb,eAAO,MAAM,IAAI,GAAI,MAAM,MAAM,KAAG,UACF,CAAC"}
+{"version":3,"file":"text.d.ts","sourceRoot":"","sources":["../../src/encoding/text.ts"],"names":[],"mappings":"AAyBA,+EAA+E;AAC/E,wBAAgB,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAK/C;AAED,2GAA2G;AAC3G,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,UAAQ,GAAG,UAAU,CAYnE;AAED,sFAAsF;AACtF,eAAO,MAAM,UAAU,GAAI,MAAM,OAAO,EAAE,QAAQ,MAAM,KAAG,IAAI,IAAI,MAIb,CAAC;AAiBvD,oCAAoC;AACpC,wBAAgB,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAmBlD;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAwCnD;AAGD,8EAA8E;AAC9E,eAAO,MAAM,iBAAiB,4KAA4K,CAAC;AAE3M;;;GAGG;AACH,eAAO,MAAM,cAAc,GAAI,MAAM,MAAM,KAAG,OAG7C,CAAC;AAEF,wHAAwH;AACxH,eAAO,MAAM,iBAAiB,GAAI,MAAM,MAAM,KAAG,OAOhD,CAAC;AAMF,wEAAwE;AACxE,wBAAgB,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAgBlD;AAED,iGAAiG;AACjG,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAmCnD;AAGD,4CAA4C;AAC5C,wBAAgB,UAAU,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAWvE;AAED,mCAAmC;AACnC,wBAAgB,MAAM,CAAC,GAAG,KAAK,EAAE,UAAU,EAAE,GAAG,UAAU,CAYzD;AAED,aAAa;AACb,eAAO,MAAM,IAAI,GAAI,MAAM,MAAM,KAAG,UACF,CAAC"}

package/dist/evTaler/amounts.d.ts

@@ -0,0 +1,89 @@
+import { Decimal } from '../json/decimal.ts';
+import { type JSONObject } from '../json/value.ts';
+import type { EVTalerCovers } from './step.ts';
+/**
+ * A number as System.Decimal holds and calculates it: a mantissa below 2^96 and at most 28 decimal places; a result it can
+ * not hold exactly rounded half to even, to as many places as it holds (DecCalc of .NET).
+ */
+export declare class NetDecimal {
+    readonly mantissa: bigint;
+    readonly scale: number;
+    private constructor();
+    static readonly ZERO: NetDecimal;
+    /** The given mantissa and scale, rounded half to even to what System.Decimal holds. */
+    private static fitted;
+    static of(value: number | bigint | Decimal): NetDecimal;
+    /** A text of digits, as `Decimal.TryParse` with `NumberStyles.AllowDecimalPoint` reads it; undefined beyond its range. */
+    static parse(text: string): NetDecimal | undefined;
+    /** An exact quotient of integers, e.g. milliseconds as seconds. */
+    static ofFraction(mantissa: bigint, scale: number): NetDecimal;
+    private aligned;
+    plus(other: NetDecimal): NetDecimal;
+    minus(other: NetDecimal): NetDecimal;
+    times(other: NetDecimal): NetDecimal;
+    /** The quotient as System.Decimal divides: exact where it holds it, else rounded half to even to as many places as it holds. */
+    dividedBy(other: NetDecimal): NetDecimal;
+    compareTo(other: NetDecimal): -1 | 0 | 1;
+    equals(other: NetDecimal): boolean;
+    isNegative(): boolean;
+    /** `Math.Round` to the given number of decimal places in the given way. */
+    round(places: number, mode: 'toEven' | 'awayFromZero' | 'toPositiveInfinity' | 'toZero'): NetDecimal;
+    /** `Math.Ceiling`. */
+    ceiling(): NetDecimal;
+    /** The digits of the given number of decimal places, as `ToString("F" + places)` writes a value that has no more. */
+    toFixed(places: number): string;
+    /** As `ToString("0.############################")` writes it: without trailing zeros, "-0" as "0". */
+    toString(): string;
+}
+/** The number of decimal digits of the minor unit of the given ISO 4217 currency: 2 unless it is known otherwise. */
+export declare const minorUnitDigits: (currency: string) => number;
+/** The given value rounded up to the minor unit of the given currency, as the amount of a step. */
+export declare const roundUp: (value: NetDecimal, currency: string) => NetDecimal;
+/** The given value rounded to the nearest minor unit of the given currency, half away from zero, as the price of a session. */
+export declare const roundToNearest: (value: NetDecimal, currency: string) => NetDecimal;
+/** The given amount with the digits of the minor unit of its currency, e.g. "3.20", or with all of its digits where it has more. */
+export declare function writeAmount(value: NetDecimal, currency: string): string;
+/** The given value as a text without trailing zeros, e.g. "13.412". */
+export declare const writeDecimal: (value: NetDecimal) => string;
+/**
+ * An amount as GNU Taler writes it, e.g. "EUR:3.25": a currency of at most 11 letters, no sign, at most 8 fractional
+ * digits, an integer part of at most 2^52; its error otherwise, as WWCP_POI words it.
+ */
+export declare function talerAmountOf(text: string | undefined): {
+    currency: string;
+    value: NetDecimal;
+} | string;
+/** The given property as a decimal written as a text, not negative, e.g. "13.412"; its error otherwise. */
+export declare function decimalTextOf(json: JSONObject, name: string): NetDecimal | string;
+/**
+ * The gross rates an EV Taler session is priced by, where its prices are those of the simple profile (`EVTalerRates`): one
+ * element, without restrictions, of ENERGY, TIME and FLAT components each at most once, with their VAT added; no minimum
+ * or maximum price. A session of other prices is paid in steps all the same, but its amounts and its price are not
+ * recalculated by a reader.
+ */
+export declare class EVTalerRates {
+    readonly currency: string;
+    /** The gross price of a kWh, if the tariff prices energy. */
+    readonly energyPerKWh: NetDecimal | undefined;
+    /** The billing increment of energy, in Wh. */
+    readonly energyStepWh: NetDecimal | undefined;
+    /** The gross price of an hour of charging, if the tariff prices time. */
+    readonly timePerHour: NetDecimal | undefined;
+    /** The billing increment of time, in seconds. */
+    readonly timeStepSeconds: NetDecimal | undefined;
+    /** The gross flat fee, if any. */
+    readonly flatFee: NetDecimal | undefined;
+    private constructor();
+    /** The rates of the simple profile of the given elements of the given charging tariff, or why there are none. */
+    static of(currency: string, tariff: JSONObject, elements: readonly JSONObject[]): EVTalerRates | {
+        readonly reason: string;
+    };
+    /** The price of what a step covers, rounded up to the minor unit: its kWh at the price of energy, its minutes at the price of time. */
+    stepPrice(covers: EVTalerCovers): NetDecimal | string;
+    /**
+     * The price of a session of the given energy, in kWh, and duration, in milliseconds: the flat fee, the energy and the
+     * time each billed in its increments, rounded to the nearest minor unit of the currency.
+     */
+    sessionPrice(energy: NetDecimal, durationMs: number): NetDecimal;
+}
+//# sourceMappingURL=amounts.d.ts.map

package/dist/evTaler/amounts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"amounts.d.ts","sourceRoot":"","sources":["../../src/evTaler/amounts.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAA0B,KAAK,UAAU,EAAkB,MAAM,kBAAkB,CAAC;AAC3F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAqC/C;;;GAGG;AACH,qBAAa,UAAU;aAGC,QAAQ,EAAG,MAAM;aACjB,KAAK,EAAM,MAAM;IAFrC,OAAO;IAKP,gBAAuB,IAAI,aAAyB;IAEpD,uFAAuF;IACvF,OAAO,CAAC,MAAM,CAAC,MAAM;WAcP,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,UAAU;IAM9D,0HAA0H;WAC5G,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAmBzD,mEAAmE;WACrD,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,UAAU;IAIrE,OAAO,CAAC,OAAO;IAKR,IAAI,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU;IAKnC,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU;IAKpC,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU;IAI3C,gIAAgI;IACzH,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU;IAmCxC,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAKxC,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO;IAIlC,UAAU,IAAI,OAAO;IAI5B,2EAA2E;IACpE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,cAAc,GAAG,oBAAoB,GAAG,QAAQ,GAAG,UAAU;IAyB3G,sBAAsB;IACf,OAAO,IAAI,UAAU;IAI5B,qHAAqH;IAC9G,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAKtC,sGAAsG;IAC/F,QAAQ,IAAI,MAAM;CAc5B;AAwBD,qHAAqH;AACrH,eAAO,MAAM,eAAe,GAAI,UAAU,MAAM,KAAG,MACjB,CAAC;AAEnC,mGAAmG;AACnG,eAAO,MAAM,OAAO,GAAI,OAAO,UAAU,EAAE,UAAU,MAAM,KAAG,UACE,CAAC;AAEjE,+HAA+H;AAC/H,eAAO,MAAM,cAAc,GAAI,OAAO,UAAU,EAAE,UAAU,MAAM,KAAG,UACX,CAAC;AAE3D,oIAAoI;AACpI,wBAAgB,WAAW,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGvE;AAED,uEAAuE;AACvE,eAAO,MAAM,YAAY,GAAI,OAAO,UAAU,KAAG,MAC7B,CAAC;AAErB;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GAAG,MAAM,CAUxG;AAED,2GAA2G;AAC3G,wBAAgB,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAOjF;AAQD;;;;;GAKG;AACH,qBAAa,YAAY;aAGD,QAAQ,EAAU,MAAM;IACxC,6DAA6D;aAC7C,YAAY,EAAM,UAAU,GAAG,SAAS;IACxD,8CAA8C;aAC9B,YAAY,EAAM,UAAU,GAAG,SAAS;IACxD,yEAAyE;aACzD,WAAW,EAAO,UAAU,GAAG,SAAS;IACxD,iDAAiD;aACjC,eAAe,EAAG,UAAU,GAAG,SAAS;IACxD,kCAAkC;aAClB,OAAO,EAAW,UAAU,GAAG,SAAS;IAX5D,OAAO;IAcP,iHAAiH;WACnG,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,UAAU,EAAE,GAAG,YAAY,GAAG;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE;IA0DnI,uIAAuI;IAChI,SAAS,CAAC,MAAM,EAAE,aAAa,GAAG,UAAU,GAAG,MAAM;IAgB5D;;;OAGG;IACI,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU;CAiB1E"}