@vibes.diy/identity 14.1.37 → 14.1.39

package/device-id/keybag-fixture.d.ts

@@ -0,0 +1,16 @@
+import type { SuperThis } from "../types/sthis.js";
+import type { DeviceIdKeyBagItem } from "../types/keybag-item.js";
+import type { JWKPrivate } from "../types/wire.js";
+export interface TestDeviceIdKeybagFile {
+    readonly id: string;
+    readonly clazz: "DeviceIdKeyBagItem";
+    readonly item: {
+        readonly deviceId: JWKPrivate;
+        readonly cert: NonNullable<DeviceIdKeyBagItem["cert"]>;
+    };
+}
+export declare function createTestDeviceIdKeybagFile(opts: {
+    readonly sthis: SuperThis;
+    readonly clerkUserId?: string;
+    readonly commonName?: string;
+}): Promise<TestDeviceIdKeybagFile>;

package/device-id/keybag-fixture.js

@@ -0,0 +1,43 @@
+import { DeviceIdKey } from "./key.js";
+import { DeviceIdCSR } from "./csr.js";
+import { createTestDeviceCA } from "./test-helpers.js";
+export async function createTestDeviceIdKeybagFile(opts) {
+    const deviceCA = await createTestDeviceCA(opts.sthis);
+    const devid = await DeviceIdKey.create();
+    const privateJWK = await devid.exportPrivateJWK();
+    const devkey = (await DeviceIdKey.createFromJWK(privateJWK)).Ok();
+    const rCsr = await new DeviceIdCSR(opts.sthis, devkey).createCSR({ commonName: opts.commonName ?? "test-device" });
+    const now = Math.floor(Date.now() / 1000);
+    const rCert = await deviceCA.processCSR(rCsr.Ok(), {
+        azp: "test-app",
+        exp: now + 3600,
+        iat: now,
+        iss: "test-issuer",
+        jti: opts.sthis.nextId().str,
+        nbf: now,
+        params: {
+            nick: "fixture-nick",
+            email: "fixture@example.com",
+            email_verified: true,
+            first: "Fixture",
+            image_url: "http://example.com/fixture.png",
+            last: "Device",
+            name: "Fixture Device",
+            public_meta: '{ "role": "fixture" }',
+        },
+        role: "device-id",
+        sub: `device-id-subject-${opts.sthis.nextId().str}`,
+        userId: opts.clerkUserId ?? "user_fixture",
+        aud: ["http://test-audience.localhost/"],
+    });
+    const issued = rCert.Ok();
+    return {
+        id: "z3QkefAC57rcrs",
+        clazz: "DeviceIdKeyBagItem",
+        item: {
+            deviceId: privateJWK,
+            cert: { certificateJWT: issued.certificateJWT, certificatePayload: issued.certificatePayload },
+        },
+    };
+}
+//# sourceMappingURL=keybag-fixture.js.map

package/device-id/keybag-fixture.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keybag-fixture.js","sourceRoot":"","sources":["../../jsr/device-id/keybag-fixture.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAkBvD,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,IAIlD;IACC,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,CAAC;IACzC,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,gBAAgB,EAAE,CAAC;IAClD,MAAM,MAAM,GAAG,CAAC,MAAM,WAAW,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAClE,MAAM,IAAI,GAAG,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,aAAa,EAAE,CAAC,CAAC;IACnH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE;QACjD,GAAG,EAAE,UAAU;QACf,GAAG,EAAE,GAAG,GAAG,IAAI;QACf,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,aAAa;QAClB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG;QAC5B,GAAG,EAAE,GAAG;QACR,MAAM,EAAE;YACN,IAAI,EAAE,cAAc;YACpB,KAAK,EAAE,qBAAqB;YAC5B,cAAc,EAAE,IAAI;YACpB,KAAK,EAAE,SAAS;YAChB,SAAS,EAAE,gCAAgC;YAC3C,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,gBAAgB;YACtB,WAAW,EAAE,uBAAuB;SACrC;QACD,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,qBAAqB,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;QACnD,MAAM,EAAE,IAAI,CAAC,WAAW,IAAI,cAAc;QAC1C,GAAG,EAAE,CAAC,iCAAiC,CAAC;KAChC,CAAC,CAAC;IACZ,MAAM,MAAM,GAAG,KAAK,CAAC,EAAE,EAAE,CAAC;IAC1B,OAAO;QACL,EAAE,EAAE,gBAAgB;QACpB,KAAK,EAAE,oBAAoB;QAC3B,IAAI,EAAE;YACJ,QAAQ,EAAE,UAAwB;YAClC,IAAI,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,EAAE;SAC/F;KACF,CAAC;AACJ,CAAC"}

package/device-id-env-value.test.d.ts

@@ -0,0 +1 @@
+export {};

package/device-id-env-value.test.js

@@ -0,0 +1,82 @@
+import { describe, expect, it } from "vitest";
+import { Buffer } from "node:buffer";
+import { ensureSuperThis } from "./index.js";
+import { parseDeviceIdEnvValue } from "./node.js";
+import { createTestDeviceIdKeybagFile } from "./testing.js";
+const ENV = "VIBES_DEVICE_ID_TEST";
+function keybagFile() {
+    return createTestDeviceIdKeybagFile({ sthis: ensureSuperThis(), clerkUserId: "user_fixture" });
+}
+describe("parseDeviceIdEnvValue", () => {
+    it("accepts a full, CA-issued keybag file — raw and base64", async () => {
+        const file = await keybagFile();
+        const raw = JSON.stringify(file);
+        const rRaw = parseDeviceIdEnvValue(raw, { envVarName: ENV });
+        expect(rRaw.isOk()).toBe(true);
+        expect(rRaw.Ok().cert.certificateJWT).toBe(file.item.cert.certificateJWT);
+        expect(rRaw.Ok().cert.certificatePayload.certificate.subject.commonName).toBe("test-device");
+        expect(parseDeviceIdEnvValue(Buffer.from(raw, "utf8").toString("base64"), { envVarName: ENV }).isOk()).toBe(true);
+    });
+    it("accepts the bare item shape too", async () => {
+        const file = await keybagFile();
+        expect(parseDeviceIdEnvValue(JSON.stringify(file.item), { envVarName: ENV }).isOk()).toBe(true);
+    });
+    it("REFUSES an empty certificate payload — the shape a truncated copy leaves behind", async () => {
+        const file = await keybagFile();
+        const broken = {
+            ...file,
+            item: { ...file.item, cert: { certificateJWT: "header.payload.sig", certificatePayload: {} } },
+        };
+        const r = parseDeviceIdEnvValue(JSON.stringify(broken), { envVarName: ENV });
+        expect(r.isErr()).toBe(true);
+        expect(r.Err().message).toContain(ENV);
+        expect(r.Err().message).toMatch(/malformed signed certificate/);
+    });
+    it("REFUSES a truncated certificate payload that keeps some fields", async () => {
+        const file = await keybagFile();
+        const payload = file.item.cert.certificatePayload;
+        const truncated = { sub: payload.sub, certificate: { commonName: payload.sub } };
+        const broken = { ...file, item: { ...file.item, cert: { certificateJWT: "a.b.c", certificatePayload: truncated } } };
+        const r = parseDeviceIdEnvValue(JSON.stringify(broken), { envVarName: ENV });
+        expect(r.isErr()).toBe(true);
+        expect(r.Err().message).toMatch(/malformed signed certificate/);
+    });
+    it("keeps the missing-certificate sentence distinct from the malformed one", async () => {
+        const file = await keybagFile();
+        const r = parseDeviceIdEnvValue(JSON.stringify({ ...file, item: { deviceId: file.item.deviceId } }), {
+            envVarName: ENV,
+        });
+        expect(r.isErr()).toBe(true);
+        expect(r.Err().message).toMatch(/missing the signed certificate/);
+    });
+    it("keeps the invalid-private-key sentence", async () => {
+        const file = await keybagFile();
+        const deviceId = { ...file.item.deviceId };
+        delete deviceId.d;
+        const r = parseDeviceIdEnvValue(JSON.stringify({ ...file, item: { ...file.item, deviceId } }), { envVarName: ENV });
+        expect(r.isErr()).toBe(true);
+        expect(r.Err().message).toMatch(/invalid device private key/);
+    });
+    it("keeps the not-JSON sentence", () => {
+        const r = parseDeviceIdEnvValue("%%% not json or base64 %%%", { envVarName: ENV });
+        expect(r.isErr()).toBe(true);
+        expect(r.Err().message).toMatch(/not valid JSON or base64-encoded JSON/);
+    });
+    it("never carries the VALUE into a refusal — the variable holds a signing key", async () => {
+        const file = await keybagFile();
+        const secretD = file.item.deviceId.d;
+        const secretJwt = file.item.cert.certificateJWT;
+        const broken = { ...file, item: { ...file.item, cert: { certificateJWT: secretJwt, certificatePayload: {} } } };
+        const raw = JSON.stringify(broken);
+        const message = parseDeviceIdEnvValue(raw, { envVarName: ENV }).Err().message;
+        expect(message).not.toContain(secretD);
+        expect(message).not.toContain(secretJwt);
+        expect(message).not.toContain(raw);
+        const deviceId = { ...file.item.deviceId };
+        deviceId.crv = secretD;
+        const keyRaw = JSON.stringify({ ...file, item: { ...file.item, deviceId } });
+        const keyMessage = parseDeviceIdEnvValue(keyRaw, { envVarName: ENV }).Err().message;
+        expect(keyMessage).not.toContain(secretD);
+    });
+});
+//# sourceMappingURL=device-id-env-value.test.js.map

package/device-id-env-value.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-id-env-value.test.js","sourceRoot":"","sources":["../jsr/device-id-env-value.test.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AAG5D,MAAM,GAAG,GAAG,sBAAsB,CAAC;AAEnC,SAAS,UAAU;IACjB,OAAO,4BAA4B,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC,CAAC;AACjG,CAAC;AAED,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,IAAI,GAAG,MAAM,UAAU,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,qBAAqB,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7D,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC1E,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC7F,MAAM,CAAC,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,IAAI,GAAG,MAAM,UAAU,EAAE,CAAC;QAChC,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;QAC/F,MAAM,IAAI,GAAG,MAAM,UAAU,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG;YACb,GAAG,IAAI;YACP,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,EAAE,EAAE,EAAE;SAC/F,CAAC;QACF,MAAM,CAAC,GAAG,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7E,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,IAAI,GAAG,MAAM,UAAU,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAwD,CAAC;QACxF,MAAM,SAAS,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC;QACjF,MAAM,MAAM,GAAG,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QACrH,MAAM,CAAC,GAAG,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7E,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,MAAM,IAAI,GAAG,MAAM,UAAU,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE;YACnG,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,IAAI,GAAG,MAAM,UAAU,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,EAAE,GAAI,IAAI,CAAC,IAAI,CAAC,QAA+C,EAAE,CAAC;QACnF,OAAO,QAAQ,CAAC,CAAC,CAAC;QAClB,MAAM,CAAC,GAAG,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACpH,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,CAAC,GAAG,qBAAqB,CAAC,4BAA4B,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACnF,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,uCAAuC,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,IAAI,GAAG,MAAM,UAAU,EAAE,CAAC;QAChC,MAAM,OAAO,GAAI,IAAI,CAAC,IAAI,CAAC,QAAqC,CAAC,CAAC,CAAC;QACnE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;QAChD,MAAM,MAAM,GAAG,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,SAAS,EAAE,kBAAkB,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;QAChH,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;QAC9E,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAGnC,MAAM,QAAQ,GAAG,EAAE,GAAI,IAAI,CAAC,IAAI,CAAC,QAA+C,EAAE,CAAC;QACnF,QAAQ,CAAC,GAAG,GAAG,OAAO,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC7E,MAAM,UAAU,GAAG,qBAAqB,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;QACpF,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/keybag/key-bag.js

@@ -1,24 +1,12 @@
 import { KeyedResolvOnce, Lazy, Option } from "@adviser/cement";
 import { hashStringAsync, hashStringSync } from "../runtime/hashing.js";
 import { z } from "zod";
-import { JWKPrivateSchema } from "../types/wire.js";
-import { CertificatePayloadSchema } from "../types/cert-payload.js";
+import { DeviceIdKeyBagItemSchema } from "../types/keybag-item-schema.js";
 const KeyedDeviceIdKeyBagItemSchema = z
     .object({
     id: z.string(),
     clazz: z.literal("DeviceIdKeyBagItem"),
-    item: z
-        .object({
-        deviceId: JWKPrivateSchema,
-        cert: z
-            .object({
-            certificateJWT: z.string(),
-            certificatePayload: CertificatePayloadSchema,
-        })
-            .readonly()
-            .optional(),
-    })
-        .readonly(),
+    item: DeviceIdKeyBagItemSchema,
 })
     .readonly();
 export class DeviceIdKeybagUnreadableError extends Error {

package/keybag/key-bag.js.map

@@ -1 +1 @@
-{"version":3,"file":"key-bag.js","sourceRoot":"","sources":["../../jsr/keybag/key-bag.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAEhE,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAIxE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAEpE,MAAM,6BAA6B,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC;IACtC,IAAI,EAAE,CAAC;SACJ,MAAM,CAAC;QACN,QAAQ,EAAE,gBAAgB;QAC1B,IAAI,EAAE,CAAC;aACJ,MAAM,CAAC;YACN,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;YAC1B,kBAAkB,EAAE,wBAAwB;SAC7C,CAAC;aACD,QAAQ,EAAE;aACV,QAAQ,EAAE;KACd,CAAC;SACD,QAAQ,EAAE;CACd,CAAC;KACD,QAAQ,EAAE,CAAC;AAUd,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IACtD,YAAY,KAAc;QACxB,KAAK,CAAC,2CAA2C,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED,MAAM,UAAU,+BAA+B,CAAC,KAAc;IAC5D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAW,CAAC;IAChC,IAAI,GAAG,GAAY,KAAK,CAAC;IACzB,OAAO,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,IAAK,GAA0B,CAAC,IAAI,KAAK,+BAA+B;YAAE,OAAO,IAAI,CAAC;QACtF,GAAG,GAAI,GAA2B,CAAC,KAAK,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAOD,MAAM,sBAAsB,GAAG,iBAAiB,CAAC;AAEjD,SAAS,qBAAqB,CAAC,CAAU;IACvC,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACvD,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;AAC5D,CAAC;AAeD,MAAM,WAAW,GAAG,cAAc,CAAC,oBAAoB,CAAC,CAAC;AACzD,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAA2C,CAAC;AAE/E,MAAM,OAAO,MAAM;IACR,EAAE,CAAgB;IAClB,cAAc,CAAkC;IAEzD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAiB;QACnC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACvD,MAAM,aAAa,GAAG,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,eAAe,EAAkB,CAAC;QAChG,OAAO,IAAI,MAAM,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;IACvC,CAAC;IAED,YAAoB,EAAiB,EAAE,aAA8C;QACnF,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,cAAc,GAAG,aAAa,CAAC;IACtC,CAAC;IAED,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC;IAEhD,KAAK,CAAC,WAAW;QACf,MAAM,EAAE,GAAG,WAAW,CAAC;QACvB,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YACjD,IAAI,GAAY,CAAC;YACjB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;oBAG9B,MAAM,CAAC,CAAC;gBACV,CAAC;gBAKD,OAAO;oBACL,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAc;oBACnC,IAAI,EAAE,MAAM,CAAC,IAAI,EAA2C;oBAC5D,KAAK,EAAE,IAAI,6BAA6B,CAAC,CAAC,CAAC;iBAC5C,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,GAAG,6BAA6B,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACvD,IAAI,KAAK,GAAG,SAAS,CAAC;YACtB,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;gBACf,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;gBAChB,OAAO;oBACL,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAc;oBACnC,IAAI,EAAE,MAAM,CAAC,IAAI,EAA2C;oBAC5D,KAAK;iBACN,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAsB,CAAC;gBACzD,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAkC,CAAC;gBACjE,KAAK;aACN,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,SAAqB,EAAE,KAAkC;QACzE,MAAM,EAAE,GAAG,WAAW,CAAC;QACvB,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YACjD,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAC/B,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE;gBACR,EAAE;gBACF,KAAK,EAAE,oBAAoB;gBAC3B,IAAI,EAAE;oBACJ,QAAQ,EAAE,SAAS;oBACnB,IAAI,EAAE,KAAK;iBACZ;aACF,CAAC,CACH,CAAC;YACF,OAAO;gBACL,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;gBAChC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;aACzB,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"key-bag.js","sourceRoot":"","sources":["../../jsr/keybag/key-bag.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAEhE,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAIxE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAE1E,MAAM,6BAA6B,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC;IACtC,IAAI,EAAE,wBAAwB;CAC/B,CAAC;KACD,QAAQ,EAAE,CAAC;AAUd,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IACtD,YAAY,KAAc;QACxB,KAAK,CAAC,2CAA2C,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED,MAAM,UAAU,+BAA+B,CAAC,KAAc;IAC5D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAW,CAAC;IAChC,IAAI,GAAG,GAAY,KAAK,CAAC;IACzB,OAAO,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,IAAK,GAA0B,CAAC,IAAI,KAAK,+BAA+B;YAAE,OAAO,IAAI,CAAC;QACtF,GAAG,GAAI,GAA2B,CAAC,KAAK,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAOD,MAAM,sBAAsB,GAAG,iBAAiB,CAAC;AAEjD,SAAS,qBAAqB,CAAC,CAAU;IACvC,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACvD,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;AAC5D,CAAC;AAeD,MAAM,WAAW,GAAG,cAAc,CAAC,oBAAoB,CAAC,CAAC;AACzD,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAA2C,CAAC;AAE/E,MAAM,OAAO,MAAM;IACR,EAAE,CAAgB;IAClB,cAAc,CAAkC;IAEzD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAiB;QACnC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACvD,MAAM,aAAa,GAAG,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,eAAe,EAAkB,CAAC;QAChG,OAAO,IAAI,MAAM,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;IACvC,CAAC;IAED,YAAoB,EAAiB,EAAE,aAA8C;QACnF,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,cAAc,GAAG,aAAa,CAAC;IACtC,CAAC;IAED,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC;IAEhD,KAAK,CAAC,WAAW;QACf,MAAM,EAAE,GAAG,WAAW,CAAC;QACvB,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YACjD,IAAI,GAAY,CAAC;YACjB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;oBAG9B,MAAM,CAAC,CAAC;gBACV,CAAC;gBAKD,OAAO;oBACL,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAc;oBACnC,IAAI,EAAE,MAAM,CAAC,IAAI,EAA2C;oBAC5D,KAAK,EAAE,IAAI,6BAA6B,CAAC,CAAC,CAAC;iBAC5C,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,GAAG,6BAA6B,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACvD,IAAI,KAAK,GAAG,SAAS,CAAC;YACtB,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;gBACf,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;gBAChB,OAAO;oBACL,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAc;oBACnC,IAAI,EAAE,MAAM,CAAC,IAAI,EAA2C;oBAC5D,KAAK;iBACN,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAsB,CAAC;gBACzD,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAkC,CAAC;gBACjE,KAAK;aACN,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,SAAqB,EAAE,KAAkC;QACzE,MAAM,EAAE,GAAG,WAAW,CAAC;QACvB,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YACjD,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAC/B,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE;gBACR,EAAE;gBACF,KAAK,EAAE,oBAAoB;gBAC3B,IAAI,EAAE;oBACJ,QAAQ,EAAE,SAAS;oBACnB,IAAI,EAAE,KAAK;iBACZ;aACF,CAAC,CACH,CAAC;YACF,OAAO;gBACL,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;gBAChC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;aACzB,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/node.d.ts

@@ -1,5 +1,7 @@
 import { Result } from "@adviser/cement";
 import type { SuperThis } from "./types/sthis.js";
+import type { JWKPrivate } from "./types/wire.js";
+import type { DeviceIdKeyBagItem } from "./types/keybag-item.js";
 import type { CertificatePayload } from "./types/cert-payload.js";
 import type { DashAuthType } from "./dash-api/protocols-dashboard/index.js";
 export { getKeyBag } from "./keybag/keybag.js";
@@ -22,3 +24,13 @@ export declare function createDeviceIdGetToken(sthis: SuperThis, opts: {
     readonly missingCertMessage?: string;
     readonly corruptKeybagMessage?: string;
 }): Promise<() => Promise<Result<DashAuthType>>>;
+export interface DeviceIdCredentialItem {
+    readonly deviceId: JWKPrivate;
+    readonly cert: NonNullable<DeviceIdKeyBagItem["cert"]>;
+}
+export declare function createDeviceIdGetTokenFromItem(sthis: SuperThis, item: DeviceIdCredentialItem, opts: {
+    readonly iss: string;
+}): Promise<() => Promise<Result<DashAuthType>>>;
+export declare function parseDeviceIdEnvValue(raw: string, opts: {
+    readonly envVarName: string;
+}): Result<DeviceIdCredentialItem>;

package/node.js

@@ -1,4 +1,6 @@
+import { Buffer } from "node:buffer";
 import { exception2Result, Lazy, Result } from "@adviser/cement";
+import { DeviceIdKeyBagItemSchema } from "./types/keybag-item-schema.js";
 import { getKeyBag } from "./keybag/keybag.js";
 import { isUnreadableDeviceIdKeybagError } from "./keybag/key-bag.js";
 import { DeviceIdKey } from "./device-id/key.js";
@@ -42,11 +44,15 @@ export async function createDeviceIdGetToken(sthis, opts) {
     if (devid.cert.IsNone()) {
         throw new Error(opts.missingCertMessage ?? "Run 'npx vibes-diy login' to authenticate this device");
     }
-    const rDevkey = await DeviceIdKey.createFromJWK(devid.deviceId.Unwrap());
+    const certResult = devid.cert.Unwrap();
+    return createDeviceIdGetTokenFromItem(sthis, { deviceId: devid.deviceId.Unwrap(), cert: certResult }, { iss: opts.iss });
+}
+export async function createDeviceIdGetTokenFromItem(sthis, item, opts) {
+    const rDevkey = await DeviceIdKey.createFromJWK(item.deviceId);
     if (rDevkey.isErr()) {
         throw rDevkey.Err();
     }
-    const certResult = devid.cert.Unwrap();
+    const certResult = item.cert;
     const signer = new DeviceIdSignMsg(sthis.txt.base64, rDevkey.Ok(), certResult.certificatePayload, certResult.certificateJWT);
     let seq = 0;
     return Lazy(async () => {
@@ -64,4 +70,58 @@ export async function createDeviceIdGetToken(sthis, opts) {
         return Result.Ok({ type: "device-id", token });
     }, { resetAfter: 60, skipUnref: true });
 }
+function parseDeviceIdEnvJson(raw, envVarName) {
+    const trimmed = raw.trim();
+    const notJson = () => new Error(`${envVarName} is not valid JSON or base64-encoded JSON`);
+    try {
+        return Result.Ok(JSON.parse(trimmed));
+    }
+    catch {
+    }
+    let decoded;
+    try {
+        decoded = Buffer.from(trimmed, "base64").toString("utf8");
+    }
+    catch {
+        return Result.Err(notJson());
+    }
+    try {
+        return Result.Ok(JSON.parse(decoded));
+    }
+    catch {
+        return Result.Err(notJson());
+    }
+}
+function asDeviceIdRecord(v) {
+    return v && typeof v === "object" ? v : undefined;
+}
+export function parseDeviceIdEnvValue(raw, opts) {
+    const envVarName = opts.envVarName;
+    const rParsed = parseDeviceIdEnvJson(raw, envVarName);
+    if (rParsed.isErr())
+        return Result.Err(rParsed.Err());
+    const top = asDeviceIdRecord(rParsed.Ok());
+    const item = asDeviceIdRecord(top?.item) ?? top;
+    if (!item || !("deviceId" in item)) {
+        return Result.Err(new Error(`${envVarName} must contain a device-id keybag item with "deviceId" and "cert"`));
+    }
+    if (item.cert === undefined || item.cert === null) {
+        return Result.Err(new Error(`${envVarName} is missing the signed certificate — copy the full ~/.fireproof/keybag/<id>.json written by 'vibes-diy login'`));
+    }
+    const rItem = DeviceIdKeyBagItemSchema.safeParse(item);
+    if (!rItem.success) {
+        const paths = rItem.error.issues.map((i) => i.path.join("."));
+        const keyIssue = paths.some((path) => path === "deviceId" || path.startsWith("deviceId."));
+        if (keyIssue) {
+            return Result.Err(new Error(`${envVarName} has an invalid device private key (fields: ${paths.join(", ")})`));
+        }
+        return Result.Err(new Error(`${envVarName} has a malformed signed certificate (fields: ${paths.join(", ")}) — copy the full ` +
+            `~/.fireproof/keybag/<id>.json written by 'vibes-diy login' rather than a truncated or hand-edited copy`));
+    }
+    const cert = rItem.data.cert;
+    if (cert === undefined) {
+        return Result.Err(new Error(`${envVarName} is missing the signed certificate — copy the full ~/.fireproof/keybag/<id>.json written by 'vibes-diy login'`));
+    }
+    return Result.Ok({ deviceId: rItem.data.deviceId, cert });
+}
 //# sourceMappingURL=node.js.map

package/node.js.map

@@ -1 +1 @@
-{"version":3,"file":"node.js","sourceRoot":"","sources":["../jsr/node.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAKjE,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,+BAA+B,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAQtD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAI/C,OAAO,EAAE,6BAA6B,EAAE,+BAA+B,EAAE,MAAM,qBAAqB,CAAC;AAQrG,MAAM,UAAU,6BAA6B,CAAC,IAA2C;IACvF,MAAM,QAAQ,GAAG,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,cAAc,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC;IACjG,OAAO,oGAAoG,QAAQ,EAAE,CAAC;AACxH,CAAC;AAKD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAO/C,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAgBxF,MAAM,UAAU,0BAA0B,CAAC,OAAuC;IAChF,MAAM,YAAY,GAAG,OAAO,EAAE,YAAY,CAAC;IAC3C,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IAClF,MAAM,MAAM,GAAY,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC;IACnD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACxE,OAAO,MAAM,CAAC;AAChB,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAAgB;IACxD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC1F,IAAI,MAAM,CAAC,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,EAAE,CAAC;IAC1B,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,0BAA0B,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC;AAC7E,CAAC;AAiBD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAgB,EAChB,IAA4G;IAE5G,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,+BAA+B,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAGjD,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,oBAAoB,IAAI,6BAA6B,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,kBAAkB,IAAI,uDAAuD,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACzE,IAAI,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QACpB,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC;IACtB,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,EAAG,CAAC;IAKxC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,kBAAkB,EAAE,UAAU,CAAC,cAAc,CAAC,CAAC;IAC7H,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,OAAO,IAAI,CACT,KAAK,IAAmC,EAAE;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAC7B;YACE,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG,EAAE,WAAW;YAChB,QAAQ,EAAE,MAAM,OAAO,CAAC,EAAE,EAAE,CAAC,WAAW,EAAE;YAC1C,GAAG,EAAE,EAAE,GAAG;YACV,GAAG,EAAE,GAAG,GAAG,GAAG;YACd,GAAG,EAAE,GAAG,GAAG,CAAC;YACZ,GAAG,EAAE,GAAG;YACR,GAAG,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG;SACI,EAC7B,OAAO,CACR,CAAC;QACF,OAAO,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,CAAC,EACD,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CACpC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"node.js","sourceRoot":"","sources":["../jsr/node.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAIjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAIzE,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,+BAA+B,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAQtD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAI/C,OAAO,EAAE,6BAA6B,EAAE,+BAA+B,EAAE,MAAM,qBAAqB,CAAC;AAQrG,MAAM,UAAU,6BAA6B,CAAC,IAA2C;IACvF,MAAM,QAAQ,GAAG,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,cAAc,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC;IACjG,OAAO,oGAAoG,QAAQ,EAAE,CAAC;AACxH,CAAC;AAKD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAO/C,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAgBxF,MAAM,UAAU,0BAA0B,CAAC,OAAuC;IAChF,MAAM,YAAY,GAAG,OAAO,EAAE,YAAY,CAAC;IAC3C,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IAClF,MAAM,MAAM,GAAY,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC;IACnD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACxE,OAAO,MAAM,CAAC;AAChB,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAAgB;IACxD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC1F,IAAI,MAAM,CAAC,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,EAAE,CAAC;IAC1B,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,0BAA0B,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC;AAC7E,CAAC;AAiBD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAgB,EAChB,IAA4G;IAE5G,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,+BAA+B,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAGjD,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,oBAAoB,IAAI,6BAA6B,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,kBAAkB,IAAI,uDAAuD,CAAC,CAAC;IACtG,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,EAAG,CAAC;IAGxC,OAAO,8BAA8B,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;AAC3H,CAAC;AAkBD,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAgB,EAChB,IAA4B,EAC5B,IAA8B;IAE9B,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QACpB,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC;IACtB,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC;IAK7B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,kBAAkB,EAAE,UAAU,CAAC,cAAc,CAAC,CAAC;IAC7H,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,OAAO,IAAI,CACT,KAAK,IAAmC,EAAE;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAC7B;YACE,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG,EAAE,WAAW;YAChB,QAAQ,EAAE,MAAM,OAAO,CAAC,EAAE,EAAE,CAAC,WAAW,EAAE;YAC1C,GAAG,EAAE,EAAE,GAAG;YACV,GAAG,EAAE,GAAG,GAAG,GAAG;YACd,GAAG,EAAE,GAAG,GAAG,CAAC;YACZ,GAAG,EAAE,GAAG;YACR,GAAG,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG;SACI,EAC7B,OAAO,CACR,CAAC;QACF,OAAO,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,CAAC,EACD,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CACpC,CAAC;AACJ,CAAC;AAYD,SAAS,oBAAoB,CAAC,GAAW,EAAE,UAAkB;IAC3D,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,GAAU,EAAE,CAAC,IAAI,KAAK,CAAC,GAAG,UAAU,2CAA2C,CAAC,CAAC;IACjG,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;IAET,CAAC;IACD,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAU;IAClC,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAA6B,CAAC,CAAC,CAAC,SAAS,CAAC;AACjF,CAAC;AAmBD,MAAM,UAAU,qBAAqB,CAAC,GAAW,EAAE,IAAqC;IACtF,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACnC,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACtD,IAAI,OAAO,CAAC,KAAK,EAAE;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;IAE3C,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC;IAChD,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC,EAAE,CAAC;QACnC,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,UAAU,kEAAkE,CAAC,CAAC,CAAC;IAChH,CAAC;IAGD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAClD,OAAO,MAAM,CAAC,GAAG,CACf,IAAI,KAAK,CACP,GAAG,UAAU,+GAA+G,CAC7H,CACF,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,wBAAwB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACvD,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;QAC3F,IAAI,QAAQ,EAAE,CAAC;YAGb,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,UAAU,+CAA+C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAChH,CAAC;QACD,OAAO,MAAM,CAAC,GAAG,CACf,IAAI,KAAK,CACP,GAAG,UAAU,gDAAgD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB;YAC/F,wGAAwG,CAC3G,CACF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;IAC7B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAIvB,OAAO,MAAM,CAAC,GAAG,CACf,IAAI,KAAK,CACP,GAAG,UAAU,+GAA+G,CAC7H,CACF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;AAC5D,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibes.diy/identity",
-  "version": "14.1.37",
+  "version": "14.1.39",
   "license": "Apache-2.0",
   "type": "module",
   "main": "./index.js",
@@ -19,7 +19,7 @@
     "@adviser/ts-xxhash": "~1.0.2",
     "@clerk/shared": "~4.31.1",
     "@hono/node-server": "~2.1.1",
-    "@vibes.diy/cmd-tools": "14.1.37",
+    "@vibes.diy/cmd-tools": "14.1.39",
     "arktype": "~2.2.3",
     "hono": "~4.13.7",
     "jose": "~6.2.12",

package/testing.d.ts

@@ -1,4 +1,6 @@
 export { createTestDeviceCA, createTestUser } from "./device-id/test-helpers.js";
+export { createTestDeviceIdKeybagFile } from "./device-id/keybag-fixture.js";
+export type { TestDeviceIdKeybagFile } from "./device-id/keybag-fixture.js";
 export type { CreateTestUserParams, TestUser } from "./device-id/test-helpers.js";
 export { DeviceIdKey } from "./device-id/key.js";
 export { DeviceIdSignMsg } from "./device-id/sign.js";

package/testing.js

@@ -1,4 +1,5 @@
 export { createTestDeviceCA, createTestUser } from "./device-id/test-helpers.js";
+export { createTestDeviceIdKeybagFile } from "./device-id/keybag-fixture.js";
 export { DeviceIdKey } from "./device-id/key.js";
 export { DeviceIdSignMsg } from "./device-id/sign.js";
 export { DeviceIdCSR } from "./device-id/csr.js";

package/testing.js.map

@@ -1 +1 @@
-{"version":3,"file":"testing.js","sourceRoot":"","sources":["../jsr/testing.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAEjF,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"testing.js","sourceRoot":"","sources":["../jsr/testing.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAEjF,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAG7E,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC"}

package/types/keybag-item-schema.d.ts

@@ -0,0 +1,4 @@
+import { z } from "zod";
+import type { DeviceIdKeyBagItem } from "./keybag-item.js";
+export declare const DeviceIdCertSchema: z.ZodType<NonNullable<DeviceIdKeyBagItem["cert"]>>;
+export declare const DeviceIdKeyBagItemSchema: z.ZodType<DeviceIdKeyBagItem>;

package/types/keybag-item-schema.js

@@ -0,0 +1,16 @@
+import { z } from "zod";
+import { JWKPrivateSchema } from "./wire.js";
+import { CertificatePayloadSchema } from "./cert-payload.js";
+export const DeviceIdCertSchema = z
+    .object({
+    certificateJWT: z.string(),
+    certificatePayload: CertificatePayloadSchema,
+})
+    .readonly();
+export const DeviceIdKeyBagItemSchema = z
+    .object({
+    deviceId: JWKPrivateSchema,
+    cert: DeviceIdCertSchema.optional(),
+})
+    .readonly();
+//# sourceMappingURL=keybag-item-schema.js.map

package/types/keybag-item-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keybag-item-schema.js","sourceRoot":"","sources":["../../jsr/types/keybag-item-schema.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAI7D,MAAM,CAAC,MAAM,kBAAkB,GAAuD,CAAC;KACpF,MAAM,CAAC;IACN,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,kBAAkB,EAAE,wBAAwB;CAC7C,CAAC;KACD,QAAQ,EAAwD,CAAC;AAMpE,MAAM,CAAC,MAAM,wBAAwB,GAAkC,CAAC;KACrE,MAAM,CAAC;IACN,QAAQ,EAAE,gBAAgB;IAC1B,IAAI,EAAE,kBAAkB,CAAC,QAAQ,EAAE;CACpC,CAAC;KACD,QAAQ,EAAmC,CAAC"}