@vibes.diy/identity 2.6.3 → 2.6.4

package/device-id/ca.d.ts

@@ -0,0 +1,47 @@
+import type { BaseXXEndeCoder, Extensions, FPDeviceIDCSRPayload, IssueCertificateResult, JWKPublic, Subject, SuperThis, ClerkClaim } from "@fireproof/core-types-base";
+import { DeviceIdKey } from "./key.js";
+import { Result } from "@adviser/cement";
+import type { CAActions, CACertResult, DeviceIdCAIf, DeviceIdCAJsonParam } from "@fireproof/core-types-device-id";
+interface DeviceIdCAOpts {
+    readonly base64: BaseXXEndeCoder;
+    readonly caKey: DeviceIdKey;
+    readonly caSubject: Subject;
+    readonly actions: CAActions;
+    readonly caChain?: string[];
+    readonly validityPeriod?: number;
+}
+export declare class DeviceIdCA implements DeviceIdCAIf {
+    #private;
+    constructor(opts: DeviceIdCAOpts);
+    static from(sthis: SuperThis, caJson: DeviceIdCAJsonParam, actions: CAActions): Promise<Result<DeviceIdCA>>;
+    getCAKey(): DeviceIdKey;
+    processCSR(csrJWS: string, addition: ClerkClaim): Promise<Result<IssueCertificateResult>>;
+    caCertificate(): Promise<Result<CACertResult>>;
+    issueCertificate(devId: FPDeviceIDCSRPayload): Promise<Result<IssueCertificateResult>>;
+    buildCertificateExtensions(requestedExtensions: Extensions, subject: Subject, subjectPubKey: JWKPublic): Promise<{
+        basicConstraints: {
+            critical: boolean;
+            cA: boolean;
+            pathLenConstraint: null;
+        };
+        keyUsage: {
+            critical: boolean;
+            usage: ("cRLSign" | "dataEncipherment" | "decipherOnly" | "digitalSignature" | "encipherOnly" | "keyAgreement" | "keyCertSign" | "keyEncipherment" | "nonRepudiation")[];
+        };
+        extendedKeyUsage: {
+            critical: boolean;
+            usage: ("OCSPSigning" | "clientAuth" | "codeSigning" | "emailProtection" | "ipsecIKE" | "msCTLSign" | "msCodeCom" | "msCodeInd" | "msEFS" | "serverAuth" | "timeStamping")[];
+        };
+        subjectAltName: {
+            critical: boolean;
+            names: string[];
+        };
+        authorityKeyIdentifier: {
+            keyIdentifier: string;
+        };
+        subjectKeyIdentifier: {
+            keyIdentifier: string;
+        };
+    }>;
+}
+export {};

package/device-id/ca.js

@@ -0,0 +1,154 @@
+import { CertificatePayloadSchema } from "@fireproof/core-types-base";
+import { JWKPrivateSchema } from "../types/wire.js";
+import { SignJWT, jwtVerify } from "jose";
+import { DeviceIdKey } from "./key.js";
+import { DeviceIdValidator } from "./validator.js";
+import { Certor } from "./certor.js";
+import { Result, exception2Result } from "@adviser/cement";
+import { hashObjectAsync } from "@fireproof/core-runtime";
+import { base58btc } from "multiformats/bases/base58";
+function defaultDeviceIdCAOpts(opts) {
+    return {
+        ...opts,
+        validityPeriod: opts.validityPeriod || 365 * 24 * 60 * 60,
+        caChain: opts.caChain || [],
+    };
+}
+export class DeviceIdCA {
+    #opts;
+    #caKey;
+    #caSubject;
+    constructor(opts) {
+        this.#opts = defaultDeviceIdCAOpts(opts);
+        this.#caKey = opts.caKey;
+        this.#caSubject = opts.caSubject;
+    }
+    static async from(sthis, caJson, actions) {
+        let privateKey;
+        if (typeof caJson.privateKey === "string") {
+            const rPrivateKey = await exception2Result(async () => {
+                const decoded = base58btc.decode(caJson.privateKey);
+                const jsonString = sthis.txt.decode(decoded);
+                return JSON.parse(jsonString);
+            });
+            if (rPrivateKey.isErr()) {
+                return Result.Err(`Failed to decode privateKey: ${rPrivateKey.Err().message}`);
+            }
+            const parseResult = JWKPrivateSchema.safeParse(rPrivateKey.Ok());
+            if (!parseResult.success) {
+                return Result.Err(`Invalid private key format: ${parseResult.error.message}`);
+            }
+            privateKey = parseResult.data;
+        }
+        else {
+            privateKey = caJson.privateKey;
+        }
+        const keyResult = await DeviceIdKey.createFromJWK(privateKey);
+        if (keyResult.isErr()) {
+            return Result.Err(`Failed to create DeviceIdKey: ${keyResult.Err().message}`);
+        }
+        const caKey = keyResult.Ok();
+        const publicKeyResult = await exception2Result(async () => await caKey.publicKey());
+        if (publicKeyResult.isErr()) {
+            return Result.Err(`Failed to get public key: ${publicKeyResult.Err().message}`);
+        }
+        const publicKey = publicKeyResult.Ok();
+        const verifyResult = await exception2Result(async () => await jwtVerify(caJson.signedCert, publicKey, { typ: "CERT+JWT", algorithms: ["ES256"] }));
+        if (verifyResult.isErr()) {
+            return Result.Err(`Certificate verification failed: ${verifyResult.Err().message}`);
+        }
+        const verified = verifyResult.Ok();
+        const parseResult = CertificatePayloadSchema.safeParse(verified.payload);
+        if (!parseResult.success) {
+            return Result.Err(`Invalid certificate payload: ${parseResult.error.message}: ${JSON.stringify(verified.payload)}`);
+        }
+        const claims = parseResult.data;
+        const caSubject = claims.certificate.issuer;
+        const deviceCA = new DeviceIdCA({ base64: sthis.txt.base64, caKey, caSubject, actions });
+        return Result.Ok(deviceCA);
+    }
+    getCAKey() {
+        return this.#caKey;
+    }
+    async processCSR(csrJWS, addition) {
+        const validator = new DeviceIdValidator();
+        const validation = await validator.validateCSR(csrJWS);
+        if (!validation.valid) {
+            return Result.Err(validation.error);
+        }
+        return this.issueCertificate({
+            ...validation.payload,
+            creatingUser: { type: "clerk", claims: addition },
+        });
+    }
+    async caCertificate() {
+        const rCert = await this.issueCertificate({
+            csr: { subject: this.#caSubject, publicKey: await this.#caKey.publicKey() },
+        });
+        if (rCert.isErr()) {
+            return Result.Err(rCert);
+        }
+        return Result.Ok({
+            certificate: Certor.fromUnverifiedJWT(this.#opts.base64, rCert.Ok().certificateJWT).asCert(),
+            jwtStr: rCert.Ok().certificateJWT,
+        });
+    }
+    async issueCertificate(devId) {
+        const now = Math.floor(Date.now() / 1000);
+        const serialNumber = await this.#opts.actions.generateSerialNumber(await this.#caKey.publicKey());
+        const certificatePayload = {
+            iss: this.#caSubject.commonName,
+            sub: devId.csr.subject.commonName,
+            aud: devId.aud || "certificate-users",
+            iat: now,
+            nbf: now,
+            exp: now + this.#opts.validityPeriod,
+            jti: serialNumber,
+            creatingUser: devId.creatingUser,
+            certificate: {
+                version: "3",
+                serialNumber: serialNumber,
+                subject: devId.csr.subject,
+                issuer: this.#caSubject,
+                validity: {
+                    notBefore: new Date(now * 1000).toISOString(),
+                    notAfter: new Date((now + this.#opts.validityPeriod) * 1000).toISOString(),
+                },
+                subjectPublicKeyInfo: devId.csr.publicKey,
+                signatureAlgorithm: "ES256",
+                keyUsage: ["digitalSignature", "keyEncipherment"],
+                extendedKeyUsage: ["serverAuth"],
+            },
+        };
+        const pKey = await this.#caKey.exportPrivateJWK();
+        const kid = await this.#caKey.fingerPrint();
+        const certificateJWC = await new SignJWT(certificatePayload)
+            .setProtectedHeader({ alg: "ES256", typ: "CERT+JWT", kid, x5c: this.#opts.caChain })
+            .sign(pKey);
+        return Result.Ok({
+            certificateJWT: certificateJWC,
+            certificatePayload: certificatePayload,
+            format: "JWS",
+            serialNumber: serialNumber,
+            issuer: this.#caSubject.commonName,
+            subject: devId.csr.subject.commonName,
+            validityPeriod: {
+                notBefore: new Date(now * 1000),
+                notAfter: new Date((now + this.#opts.validityPeriod) * 1000),
+            },
+            publicKey: devId.csr.publicKey,
+        });
+    }
+    async buildCertificateExtensions(requestedExtensions, subject, subjectPubKey) {
+        const extensions = {
+            basicConstraints: { critical: true, cA: false, pathLenConstraint: null },
+            keyUsage: { critical: true, usage: requestedExtensions.keyUsage || ["digitalSignature", "keyEncipherment"] },
+            extendedKeyUsage: { critical: false, usage: requestedExtensions.extendedKeyUsage || ["serverAuth"] },
+            subjectAltName: { critical: false, names: requestedExtensions.subjectAltName || [subject.commonName] },
+            authorityKeyIdentifier: { keyIdentifier: await this.#caKey.fingerPrint() },
+            subjectKeyIdentifier: { keyIdentifier: await hashObjectAsync(subjectPubKey) },
+        };
+        return extensions;
+    }
+}
+//# sourceMappingURL=ca.js.map

package/device-id/ca.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ca.js","sourceRoot":"","sources":["../../jsr/device-id/ca.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAWpD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAgBtD,SAAS,qBAAqB,CAAC,IAAoB;IACjD,OAAO;QACL,GAAG,IAAI;QACP,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;QACzD,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE;KAC5B,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,UAAU;IACZ,KAAK,CAA0B;IAC/B,MAAM,CAAc;IACpB,UAAU,CAAU;IAE7B,YAAY,IAAoB;QAC9B,IAAI,CAAC,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC;IACnC,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAgB,EAAE,MAA2B,EAAE,OAAkB;QACjF,IAAI,UAAU,CAAC;QACf,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC1C,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,KAAK,IAAI,EAAE;gBACpD,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,UAAoB,CAAC,CAAC;gBAC9D,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAChC,CAAC,CAAC,CAAC;YACH,IAAI,WAAW,CAAC,KAAK,EAAE,EAAE,CAAC;gBACxB,OAAO,MAAM,CAAC,GAAG,CAAC,gCAAgC,WAAW,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YACjF,CAAC;YACD,MAAM,WAAW,GAAG,gBAAgB,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC;YACjE,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;gBACzB,OAAO,MAAM,CAAC,GAAG,CAAC,+BAA+B,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAChF,CAAC;YACD,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QACjC,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QAC9D,IAAI,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,GAAG,CAAC,iCAAiC,SAAS,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,EAAE,CAAC;QAC7B,MAAM,eAAe,GAAG,MAAM,gBAAgB,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QACpF,IAAI,eAAe,CAAC,KAAK,EAAE,EAAE,CAAC;YAC5B,OAAO,MAAM,CAAC,GAAG,CAAC,6BAA6B,eAAe,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,SAAS,GAAG,eAAe,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,YAAY,GAAG,MAAM,gBAAgB,CACzC,KAAK,IAAI,EAAE,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CACtG,CAAC;QACF,IAAI,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC,GAAG,CAAC,oCAAoC,YAAY,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,EAAE,CAAC;QACnC,MAAM,WAAW,GAAG,wBAAwB,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACzE,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC,GAAG,CAAC,gCAAgC,WAAW,CAAC,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACtH,CAAC;QACD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC;QAChC,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC;QAC5C,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QACzF,OAAO,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,QAAoB;QACnD,MAAM,SAAS,GAAG,IAAI,iBAAiB,EAAE,CAAC;QAC1C,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,IAAI,CAAC,gBAAgB,CAAC;YAC3B,GAAG,UAAU,CAAC,OAAO;YACrB,YAAY,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE;SAC1B,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC;YACxC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE;SACpD,CAAC,CAAC;QAC3B,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;YAClB,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,MAAM,CAAC,EAAE,CAAC;YACf,WAAW,EAAE,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE;YAC5F,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc;SAClB,CAAC,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,KAA2B;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QAClG,MAAM,kBAAkB,GAAG;YACzB,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,UAAU;YAC/B,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU;YACjC,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,mBAAmB;YACrC,GAAG,EAAE,GAAG;YACR,GAAG,EAAE,GAAG;YACR,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc;YACpC,GAAG,EAAE,YAAY;YACjB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,WAAW,EAAE;gBACX,OAAO,EAAE,GAAG;gBACZ,YAAY,EAAE,YAAY;gBAC1B,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO;gBAC1B,MAAM,EAAE,IAAI,CAAC,UAAU;gBACvB,QAAQ,EAAE;oBACR,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;oBAC7C,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;iBAC3E;gBACD,oBAAoB,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS;gBACzC,kBAAkB,EAAE,OAAO;gBAC3B,QAAQ,EAAE,CAAC,kBAAkB,EAAE,iBAAiB,CAAC;gBACjD,gBAAgB,EAAE,CAAC,YAAY,CAAC;aACjC;SACF,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,cAAc,GAAG,MAAM,IAAI,OAAO,CAAC,kBAA6C,CAAC;aACpF,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;aACnF,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,OAAO,MAAM,CAAC,EAAE,CAAC;YACf,cAAc,EAAE,cAAc;YAC9B,kBAAkB,EAAE,kBAAkB;YACtC,MAAM,EAAE,KAAK;YACb,YAAY,EAAE,YAAY;YAC1B,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,UAAU;YAClC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU;YACrC,cAAc,EAAE;gBACd,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC;gBAC/B,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC;aAC7D;YACD,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS;SACM,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,0BAA0B,CAAC,mBAA+B,EAAE,OAAgB,EAAE,aAAwB;QAC1G,MAAM,UAAU,GAAG;YACjB,gBAAgB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE;YACxE,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,mBAAmB,CAAC,QAAQ,IAAI,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,EAAE;YAC5G,gBAAgB,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,CAAC,gBAAgB,IAAI,CAAC,YAAY,CAAC,EAAE;YACpG,cAAc,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE;YACtG,sBAAsB,EAAE,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE;YAC1E,oBAAoB,EAAE,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC,aAAa,CAAC,EAAE;SAC9E,CAAC;QACF,OAAO,UAAU,CAAC;IACpB,CAAC;CACF"}

package/device-id/key.js

@@ -1,5 +1,5 @@
 import { Result } from "@adviser/cement";
-import { JWKPrivateSchema, JWKPublicSchema } from "@fireproof/core-types-base";
+import { JWKPrivateSchema, JWKPublicSchema } from "../types/wire.js";
 import { generateKeyPair, exportJWK, calculateJwkThumbprint } from "jose";
 import { sts } from "@fireproof/core-runtime";
 export class DeviceIdKey {

package/device-id/key.js.map

@@ -1 +1 @@
-{"version":3,"file":"key.js","sourceRoot":"","sources":["../../jsr/device-id/key.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAG/E,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,sBAAsB,EAA+B,MAAM,MAAM,CAAC;AACvG,OAAO,EAAE,GAAG,EAAE,MAAM,yBAAyB,CAAC;AAE9C,MAAM,OAAO,WAAW;IACb,WAAW,CAAY;IAEhC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,GAA2B,EAAE,WAAW,EAAE,IAAI,EAAE;QACtE,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAClD,OAAO,IAAI,WAAW,CAAC,IAAI,CAAC,UAAuB,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,GAAe,EAAE,IAAI,GAA2B,EAAE,WAAW,EAAE,IAAI,EAAE;QAC9F,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,MAAM,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC;QACtB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QACrD,IAAI,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YACjB,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,OAAO,MAAM,CAAC,EAAE,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,GAAgB,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,YAAoB,IAAe;QACjC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,WAAW;QACf,OAAO,sBAAsB,CAAC,MAAM,IAAI,CAAC,gBAAgB,EAAE,EAAE,QAAQ,CAAC,CAAC;IACzE,CAAC;IAED,KAAK,CAAC,gBAAgB;QACpB,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC9C,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,SAAS;QACb,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,eAAe,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACvE,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,uBAAuB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}
+{"version":3,"file":"key.js","sourceRoot":"","sources":["../../jsr/device-id/key.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAGrE,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,sBAAsB,EAA+B,MAAM,MAAM,CAAC;AACvG,OAAO,EAAE,GAAG,EAAE,MAAM,yBAAyB,CAAC;AAE9C,MAAM,OAAO,WAAW;IACb,WAAW,CAAY;IAEhC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,GAA2B,EAAE,WAAW,EAAE,IAAI,EAAE;QACtE,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAClD,OAAO,IAAI,WAAW,CAAC,IAAI,CAAC,UAAuB,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,GAAe,EAAE,IAAI,GAA2B,EAAE,WAAW,EAAE,IAAI,EAAE;QAC9F,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,MAAM,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC;QACtB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QACrD,IAAI,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YACjB,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,OAAO,MAAM,CAAC,EAAE,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,GAAgB,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,YAAoB,IAAe;QACjC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,WAAW;QACf,OAAO,sBAAsB,CAAC,MAAM,IAAI,CAAC,gBAAgB,EAAE,EAAE,QAAQ,CAAC,CAAC;IACzE,CAAC;IAED,KAAK,CAAC,gBAAgB;QACpB,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC9C,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,SAAS;QACb,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,eAAe,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACvE,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,uBAAuB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/device-id/validator.d.ts

@@ -0,0 +1,15 @@
+import type { FPDeviceIDCSRPayload, JWKPublic } from "@fireproof/core-types-base";
+interface ValidateCSRError {
+    readonly valid: false;
+    readonly error: string;
+}
+interface ValidateCSRSuccess {
+    readonly valid: true;
+    readonly payload: FPDeviceIDCSRPayload;
+    readonly publicKey: JWKPublic;
+}
+type ValidateCSRResult = ValidateCSRError | ValidateCSRSuccess;
+export declare class DeviceIdValidator {
+    validateCSR(csrJWS: string): Promise<ValidateCSRResult>;
+}
+export {};

package/device-id/validator.js

@@ -0,0 +1,40 @@
+import { FPDeviceIDCSRPayloadSchema } from "@fireproof/core-types-base";
+import { JWKPublicSchema } from "../types/wire.js";
+import { jwtVerify, decodeProtectedHeader, calculateJwkThumbprint } from "jose";
+import { sts } from "@fireproof/core-runtime";
+export class DeviceIdValidator {
+    async validateCSR(csrJWS) {
+        try {
+            const header = decodeProtectedHeader(csrJWS);
+            if (!header.jwk) {
+                throw new Error("No public key in CSR header");
+            }
+            const { success: successPub, data: publicKey } = JWKPublicSchema.safeParse(header.jwk);
+            if (!successPub || !publicKey) {
+                return { valid: false, error: "Invalid public key in CSR header" };
+            }
+            const rKeyLike = await sts.importJWK(publicKey, header.alg);
+            if (rKeyLike.isErr()) {
+                return { valid: false, error: `Failed to import public key: ${rKeyLike.Err()}` };
+            }
+            const { key: keyLike, alg } = rKeyLike.Ok();
+            const { payload: fromPayload } = await jwtVerify(csrJWS, keyLike, { typ: "CSR+JWT", algorithms: [alg] });
+            const { success, data: payload } = FPDeviceIDCSRPayloadSchema.safeParse(fromPayload);
+            if (!success || !payload) {
+                return { valid: false, error: "Invalid CSR payload" };
+            }
+            const [hdrThumb, payloadThumb] = await Promise.all([
+                calculateJwkThumbprint(publicKey),
+                calculateJwkThumbprint(payload.csr.publicKey),
+            ]);
+            if (hdrThumb !== payloadThumb) {
+                return { valid: false, error: "CSR public key mismatch between header and payload" };
+            }
+            return { valid: true, payload, publicKey };
+        }
+        catch (error) {
+            return { valid: false, error: error.message };
+        }
+    }
+}
+//# sourceMappingURL=validator.js.map

package/device-id/validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validator.js","sourceRoot":"","sources":["../../jsr/device-id/validator.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,sBAAsB,EAAY,MAAM,MAAM,CAAC;AAC1F,OAAO,EAAE,GAAG,EAAE,MAAM,yBAAyB,CAAC;AAa9C,MAAM,OAAO,iBAAiB;IAC5B,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;YAC7C,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YACjD,CAAC;YACD,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACvF,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS,EAAE,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC;YACrE,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;YAC5D,IAAI,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;gBACrB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,gCAAgC,QAAQ,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC;YACnF,CAAC;YACD,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAC,EAAE,EAAE,CAAC;YAC5C,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACzG,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,0BAA0B,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;YACrF,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;gBACzB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;YACxD,CAAC;YACD,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACjD,sBAAsB,CAAC,SAAgB,CAAC;gBACxC,sBAAsB,CAAC,OAAO,CAAC,GAAG,CAAC,SAAgB,CAAC;aACrD,CAAC,CAAC;YACH,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,oDAAoD,EAAE,CAAC;YACvF,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC;QAC3D,CAAC;IACH,CAAC;CACF"}

package/device-id/verify.d.ts

@@ -0,0 +1,14 @@
+import { Result } from "@adviser/cement";
+import type { BaseXXEndeCoder, CertificatePayload } from "@fireproof/core-types-base";
+import type { CACertResult, HeaderCertInfo, VerifyWithCertificateError, VerifyWithCertificateOptions, VerifyWithCertificateResult } from "@fireproof/core-types-device-id";
+export declare class DeviceIdVerifyMsg {
+    #private;
+    constructor(base64: BaseXXEndeCoder, trustedCAs: CACertResult[], options: VerifyWithCertificateOptions);
+    createVerifyWithCertificateError(error: Result<unknown>, partialResults?: Partial<VerifyWithCertificateError["partialResults"]>): VerifyWithCertificateError;
+    verifyWithCertificate<S>(jwt: string, schema?: S): Promise<VerifyWithCertificateResult<S>>;
+    extractCertificateFromJWT(jwt: string): Result<HeaderCertInfo>;
+    validateCertificateThumbprint(certInfo: HeaderCertInfo): Promise<Result<boolean>>;
+    validateCertificate(certor: HeaderCertInfo["certificate"]): Promise<Result<unknown>>;
+    findTrustedCA(cert: CertificatePayload, trustedCAs: CertificatePayload[]): CertificatePayload | undefined;
+    getErrorCode(ierror: unknown): VerifyWithCertificateError["errorCode"];
+}

package/device-id/verify.js

@@ -0,0 +1,208 @@
+import { jwtVerify, decodeProtectedHeader } from "jose";
+import { Certor } from "./certor.js";
+import { exception2Result, Result } from "@adviser/cement";
+import { sts } from "@fireproof/core-runtime";
+export class DeviceIdVerifyMsg {
+    #base64;
+    #trustedCAs;
+    #options;
+    constructor(base64, trustedCAs, options) {
+        this.#base64 = base64;
+        this.#trustedCAs = trustedCAs.map((ca) => ca.certificate);
+        this.#options = options;
+    }
+    createVerifyWithCertificateError(error, partialResults = {}) {
+        return {
+            valid: false,
+            error: error.Err(),
+            errorCode: this.getErrorCode(error.Err()),
+            partialResults: {
+                certificateExtracted: partialResults.certificateExtracted ?? false,
+                jwtSignatureValid: partialResults.jwtSignatureValid ?? false,
+                certificateInfo: partialResults.certificateInfo,
+            },
+            verificationTimestamp: new Date().toISOString(),
+        };
+    }
+    async verifyWithCertificate(jwt, schema) {
+        let certInfo = undefined;
+        const rCertInfo = this.extractCertificateFromJWT(jwt);
+        if (rCertInfo.isErr()) {
+            return this.createVerifyWithCertificateError(rCertInfo);
+        }
+        certInfo = rCertInfo.Ok();
+        const rThumbprint = await this.validateCertificateThumbprint(certInfo);
+        if (rThumbprint.isErr()) {
+            return this.createVerifyWithCertificateError(rThumbprint, {
+                certificateExtracted: true,
+                certificateInfo: certInfo,
+            });
+        }
+        if (!rThumbprint.Ok()) {
+            return this.createVerifyWithCertificateError(Result.Err("Certificate thumbprint validation failed"), {
+                certificateExtracted: true,
+                certificateInfo: certInfo,
+            });
+        }
+        const rVerify = await exception2Result(async () => {
+            const rKey = await sts.importJWK(certInfo.certificate.asCert().certificate.subjectPublicKeyInfo, certInfo.algorithm);
+            if (rKey.isErr()) {
+                throw rKey.Err();
+            }
+            return jwtVerify(jwt, rKey.Ok().key, {
+                clockTolerance: this.#options.clockTolerance,
+                maxTokenAge: this.#options.maxAge,
+            });
+        });
+        if (rVerify.isErr()) {
+            return this.createVerifyWithCertificateError(rVerify, {
+                certificateExtracted: true,
+                certificateInfo: certInfo,
+            });
+        }
+        const jwtVerification = rVerify.Ok();
+        if (!jwtVerification) {
+            return this.createVerifyWithCertificateError(Result.Err("JWT verification failed"), {
+                certificateExtracted: true,
+                certificateInfo: certInfo,
+            });
+        }
+        let jwtPayload = jwtVerification.payload;
+        const jwtHeader = jwtVerification.protectedHeader;
+        const rCertValidation = await this.validateCertificate(certInfo.certificate);
+        if (rCertValidation.isErr()) {
+            return this.createVerifyWithCertificateError(rCertValidation, {
+                certificateExtracted: true,
+                certificateInfo: certInfo,
+                jwtSignatureValid: true,
+            });
+        }
+        if (certInfo.certificateChain.length > 1) {
+            return this.createVerifyWithCertificateError(Result.Err("Certificate chain validation not implemented"), {
+                certificateExtracted: true,
+                certificateInfo: certInfo,
+            });
+        }
+        if (schema) {
+            const rPayloadParse = schema.safeParse(jwtPayload);
+            if (!rPayloadParse.success) {
+                return this.createVerifyWithCertificateError(Result.Err(rPayloadParse.error), {
+                    certificateExtracted: true,
+                    certificateInfo: certInfo,
+                    jwtSignatureValid: true,
+                });
+            }
+            jwtPayload = rPayloadParse.data;
+        }
+        return {
+            valid: true,
+            payload: jwtPayload,
+            header: jwtHeader,
+            certificate: {
+                ...certInfo,
+                validation: rCertValidation.Ok(),
+                publicKey: certInfo.certificate.asCert().certificate.subjectPublicKeyInfo,
+            },
+            verificationTimestamp: new Date().toISOString(),
+        };
+    }
+    extractCertificateFromJWT(jwt) {
+        return exception2Result(() => {
+            const header = decodeProtectedHeader(jwt);
+            if (!header.x5c || !Array.isArray(header.x5c) || header.x5c.length === 0) {
+                throw new Error("No certificate chain (x5c) found in JWT header");
+            }
+            const certificateChain = header.x5c.map((cert) => Certor.fromString(this.#base64, cert));
+            const mainCertificate = certificateChain[0];
+            return {
+                certificate: mainCertificate,
+                certificateChain: certificateChain,
+                thumbprint: header.x5t,
+                thumbprintSha256: header["x5t#S256"],
+                keyId: header.kid,
+                algorithm: header.alg,
+                certificateUrl: header.x5u,
+                rawHeader: header,
+            };
+        });
+    }
+    async validateCertificateThumbprint(certInfo) {
+        if (certInfo.thumbprint) {
+            const calculatedThumbprint = await certInfo.certificate.asSHA1();
+            if (certInfo.thumbprint !== calculatedThumbprint) {
+                return Result.Err(new Error("Certificate SHA-1 thumbprint mismatch - certificate may have been tampered with"));
+            }
+        }
+        if (certInfo.thumbprintSha256) {
+            const calculatedThumbprintSha256 = await certInfo.certificate.asSHA256();
+            if (certInfo.thumbprintSha256 !== calculatedThumbprintSha256) {
+                return Result.Err(new Error("Certificate SHA-256 thumbprint mismatch - certificate may have been tampered with"));
+            }
+        }
+        return Result.Ok(true);
+    }
+    async validateCertificate(certor) {
+        const now = new Date();
+        return exception2Result(() => {
+            const cert = certor.asCert();
+            const subject = certor.parseCertificateSubject(cert.sub);
+            const issuer = certor.parseCertificateSubject(cert.iss);
+            const notBefore = new Date(cert.nbf * 1000);
+            const notAfter = new Date(cert.exp * 1000);
+            if (notBefore > now) {
+                throw new Error(`Certificate is not yet valid (valid from: ${notBefore.toISOString()})`);
+            }
+            if (notAfter < now) {
+                throw new Error(`Certificate has expired (valid to: ${notAfter.toISOString()})`);
+            }
+            const trustedCA = this.findTrustedCA(cert, this.#trustedCAs) ?? null;
+            if (!trustedCA) {
+                throw new Error("Certificate not issued by a trusted CA");
+            }
+            return {
+                valid: true,
+                subject: subject,
+                issuer: issuer,
+                serialNumber: cert.certificate.serialNumber,
+                notBefore: notBefore,
+                notAfter: notAfter,
+                publicKey: cert.certificate.subjectPublicKeyInfo,
+                trustedCA: trustedCA,
+                validityPeriod: {
+                    days: Math.floor((notAfter.getTime() - notBefore.getTime()) / (1000 * 60 * 60 * 24)),
+                },
+            };
+        });
+    }
+    findTrustedCA(cert, trustedCAs) {
+        return trustedCAs.find((trustedCA) => {
+            try {
+                return cert.iss === trustedCA.sub;
+            }
+            catch {
+                return false;
+            }
+        });
+    }
+    getErrorCode(ierror) {
+        const { message: errorMessage } = ierror;
+        if (errorMessage.includes("thumbprint mismatch"))
+            return "CERT_THUMBPRINT_MISMATCH";
+        if (errorMessage.includes("expired"))
+            return "CERT_EXPIRED";
+        if (errorMessage.includes("not yet valid"))
+            return "CERT_NOT_YET_VALID";
+        if (errorMessage.includes("self-signed"))
+            return "CERT_SELF_SIGNED";
+        if (errorMessage.includes("not trusted"))
+            return "CERT_NOT_TRUSTED";
+        if (errorMessage.includes("revoked"))
+            return "CERT_REVOKED";
+        if (errorMessage.includes("signature verification failed"))
+            return "JWT_SIGNATURE_INVALID";
+        if (errorMessage.includes("No certificate"))
+            return "CERT_NOT_FOUND";
+        return "VERIFICATION_FAILED";
+    }
+}
+//# sourceMappingURL=verify.js.map

package/device-id/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../jsr/device-id/verify.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,MAAM,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,GAAG,EAAE,MAAM,yBAAyB,CAAC;AAU9C,MAAM,OAAO,iBAAiB;IACnB,OAAO,CAAkB;IACzB,WAAW,CAAuB;IAClC,QAAQ,CAA+B;IAEhD,YAAY,MAAuB,EAAE,UAA0B,EAAE,OAAqC;QACpG,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;IAC1B,CAAC;IAED,gCAAgC,CAC9B,KAAsB,EACtB,cAAc,GAA0D,EAAE;QAE1E,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE;YAClB,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YACzC,cAAc,EAAE;gBACd,oBAAoB,EAAE,cAAc,CAAC,oBAAoB,IAAI,KAAK;gBAClE,iBAAiB,EAAE,cAAc,CAAC,iBAAiB,IAAI,KAAK;gBAC5D,eAAe,EAAE,cAAc,CAAC,eAAe;aAChD;YACD,qBAAqB,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAChD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAI,GAAW,EAAE,MAAU;QACpD,IAAI,QAAQ,GAA+B,SAAS,CAAC;QACrD,MAAM,SAAS,GAAG,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC;QACtD,IAAI,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,gCAAgC,CAAC,SAAS,CAAmC,CAAC;QAC5F,CAAC;QACD,QAAQ,GAAG,SAAS,CAAC,EAAE,EAAE,CAAC;QAC1B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,6BAA6B,CAAC,QAAQ,CAAC,CAAC;QACvE,IAAI,WAAW,CAAC,KAAK,EAAE,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,gCAAgC,CAAC,WAAW,EAAE;gBACxD,oBAAoB,EAAE,IAAI;gBAC1B,eAAe,EAAE,QAAQ;aAC1B,CAAmC,CAAC;QACvC,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,gCAAgC,CAAC,MAAM,CAAC,GAAG,CAAC,0CAA0C,CAAC,EAAE;gBACnG,oBAAoB,EAAE,IAAI;gBAC1B,eAAe,EAAE,QAAQ;aAC1B,CAAmC,CAAC;QACvC,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,KAAK,IAAI,EAAE;YAChD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,oBAAoB,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;YACrH,IAAI,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;YACnB,CAAC;YACD,OAAO,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE;gBACnC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc;gBAC5C,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM;aAClC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,gCAAgC,CAAC,OAAO,EAAE;gBACpD,oBAAoB,EAAE,IAAI;gBAC1B,eAAe,EAAE,QAAQ;aAC1B,CAAmC,CAAC;QACvC,CAAC;QACD,MAAM,eAAe,GAAG,OAAO,CAAC,EAAE,EAAE,CAAC;QACrC,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC,gCAAgC,CAAC,MAAM,CAAC,GAAG,CAAC,yBAAyB,CAAC,EAAE;gBAClF,oBAAoB,EAAE,IAAI;gBAC1B,eAAe,EAAE,QAAQ;aAC1B,CAAmC,CAAC;QACvC,CAAC;QACD,IAAI,UAAU,GAAY,eAAe,CAAC,OAAO,CAAC;QAClD,MAAM,SAAS,GAAY,eAAe,CAAC,eAAe,CAAC;QAC3D,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC7E,IAAI,eAAe,CAAC,KAAK,EAAE,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,gCAAgC,CAAC,eAAe,EAAE;gBAC5D,oBAAoB,EAAE,IAAI;gBAC1B,eAAe,EAAE,QAAQ;gBACzB,iBAAiB,EAAE,IAAI;aACxB,CAAmC,CAAC;QACvC,CAAC;QACD,IAAI,QAAQ,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC,gCAAgC,CAAC,MAAM,CAAC,GAAG,CAAC,8CAA8C,CAAC,EAAE;gBACvG,oBAAoB,EAAE,IAAI;gBAC1B,eAAe,EAAE,QAAQ;aAC1B,CAAmC,CAAC;QACvC,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,aAAa,GACjB,MACD,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;YACxB,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;gBAC3B,OAAO,IAAI,CAAC,gCAAgC,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,KAAc,CAAC,EAAE;oBACrF,oBAAoB,EAAE,IAAI;oBAC1B,eAAe,EAAE,QAAQ;oBACzB,iBAAiB,EAAE,IAAI;iBACxB,CAAmC,CAAC;YACvC,CAAC;YACD,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC;QAClC,CAAC;QACD,OAAO;YACL,KAAK,EAAE,IAAI;YACX,OAAO,EAAE,UAAU;YACnB,MAAM,EAAE,SAAS;YACjB,WAAW,EAAE;gBACX,GAAG,QAAQ;gBACX,UAAU,EAAE,eAAe,CAAC,EAAE,EAAE;gBAChC,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,oBAAoB;aAC1E;YACD,qBAAqB,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACd,CAAC;IACtC,CAAC;IAED,yBAAyB,CAAC,GAAW;QACnC,OAAO,gBAAgB,CAAC,GAAG,EAAE;YAC3B,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;YACpE,CAAC;YACD,MAAM,gBAAgB,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;YACzF,MAAM,eAAe,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;YAC5C,OAAO;gBACL,WAAW,EAAE,eAAe;gBAC5B,gBAAgB,EAAE,gBAAgB;gBAClC,UAAU,EAAE,MAAM,CAAC,GAAG;gBACtB,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC;gBACpC,KAAK,EAAE,MAAM,CAAC,GAAG;gBACjB,SAAS,EAAE,MAAM,CAAC,GAAG;gBACrB,cAAc,EAAE,MAAM,CAAC,GAAG;gBAC1B,SAAS,EAAE,MAAM;aACW,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,6BAA6B,CAAC,QAAwB;QAC1D,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;YACxB,MAAM,oBAAoB,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;YACjE,IAAI,QAAQ,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;gBACjD,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC,CAAC;YAClH,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YAC9B,MAAM,0BAA0B,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;YACzE,IAAI,QAAQ,CAAC,gBAAgB,KAAK,0BAA0B,EAAE,CAAC;gBAC7D,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC,CAAC;YACpH,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,MAAqC;QAC7D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,OAAO,gBAAgB,CAAC,GAAG,EAAE;YAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG,MAAM,CAAC,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACzD,MAAM,MAAM,GAAG,MAAM,CAAC,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;YAC5C,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;YAC3C,IAAI,SAAS,GAAG,GAAG,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,6CAA6C,SAAS,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YAC3F,CAAC;YACD,IAAI,QAAQ,GAAG,GAAG,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CAAC,sCAAsC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YACnF,CAAC;YACD,MAAM,SAAS,GAA8B,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC;YAChG,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;YAC5D,CAAC;YACD,OAAO;gBACL,KAAK,EAAE,IAAI;gBACX,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,MAAM;gBACd,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,YAAY;gBAC3C,SAAS,EAAE,SAAS;gBACpB,QAAQ,EAAE,QAAQ;gBAClB,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,oBAAoB;gBAChD,SAAS,EAAE,SAAS;gBACpB,cAAc,EAAE;oBACd,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;iBACrF;aACF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,aAAa,CAAC,IAAwB,EAAE,UAAgC;QACtE,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;YACnC,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,GAAG,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,YAAY,CAAC,MAAe;QAC1B,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,MAA6B,CAAC;QAChE,IAAI,YAAY,CAAC,QAAQ,CAAC,qBAAqB,CAAC;YAAE,OAAO,0BAA0B,CAAC;QACpF,IAAI,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,cAAc,CAAC;QAC5D,IAAI,YAAY,CAAC,QAAQ,CAAC,eAAe,CAAC;YAAE,OAAO,oBAAoB,CAAC;QACxE,IAAI,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,OAAO,kBAAkB,CAAC;QACpE,IAAI,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,OAAO,kBAAkB,CAAC;QACpE,IAAI,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,cAAc,CAAC;QAC5D,IAAI,YAAY,CAAC,QAAQ,CAAC,+BAA+B,CAAC;YAAE,OAAO,uBAAuB,CAAC;QAC3F,IAAI,YAAY,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAAE,OAAO,gBAAgB,CAAC;QACrE,OAAO,qBAAqB,CAAC;IAC/B,CAAC;CACF"}

package/index.d.ts

@@ -1,8 +1,9 @@
 export { ensureRuntimeContext, type RuntimeContext } from "./runtime-context.js";
 export { ClerkClaimSchema, ClerkEmailTemplateClaimSchema, type ClerkClaim } from "./clerk-claim.js";
 export { ensureSuperThis, ensureLogger, runtimeFn, hashObjectSync, sts } from "@fireproof/core-runtime";
-export type { DashAuthType, ReqCertFromCsr, ResCertFromCsr, VerifiedClaimsResult, VerifiedAuthResult, VerifiedResult, WithAuth, FPApiParameters, FPApiToken, } from "@fireproof/core-types-protocols-dashboard";
-export type { SuperThis, FPDeviceIDSession, DocTypes, JWKPrivate, DeviceIdKeyBagItem, DeviceIdResult, } from "@fireproof/core-types-base";
+export type { DashAuthType, ReqCertFromCsr, ResCertFromCsr, VerifiedClaimsResult, VerifiedAuthResult, WithAuth, FPApiParameters, FPApiToken, } from "./types/wire.js";
+export type { VerifiedResult } from "@fireproof/core-types-protocols-dashboard";
+export type { SuperThis, FPDeviceIDSession, DocTypes, JWKPrivate, JWKPublic, DeviceIdKeyBagItem, DeviceIdResult, } from "@fireproof/core-types-base";
 export type { DeviceIdCAIf } from "@fireproof/core-types-device-id";
-export { JWKPrivateSchema } from "@fireproof/core-types-base";
+export { JWKPrivateSchema, JWKPublicSchema } from "./types/wire.js";
 export { ClerkApiToken, clerkDashApi, DashboardApiImpl } from "@fireproof/core-protocols-dashboard";

package/index.js

@@ -1,6 +1,6 @@
 export { ensureRuntimeContext } from "./runtime-context.js";
 export { ClerkClaimSchema, ClerkEmailTemplateClaimSchema } from "./clerk-claim.js";
 export { ensureSuperThis, ensureLogger, runtimeFn, hashObjectSync, sts } from "@fireproof/core-runtime";
-export { JWKPrivateSchema } from "@fireproof/core-types-base";
+export { JWKPrivateSchema, JWKPublicSchema } from "./types/wire.js";
 export { ClerkApiToken, clerkDashApi, DashboardApiImpl } from "@fireproof/core-protocols-dashboard";
 //# sourceMappingURL=index.js.map

package/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../jsr/index.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,oBAAoB,EAAuB,MAAM,sBAAsB,CAAC;AACjF,OAAO,EAAE,gBAAgB,EAAE,6BAA6B,EAAmB,MAAM,kBAAkB,CAAC;AAGpG,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,yBAAyB,CAAC;AA2BxG,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAG9D,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../jsr/index.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,oBAAoB,EAAuB,MAAM,sBAAsB,CAAC;AACjF,OAAO,EAAE,gBAAgB,EAAE,6BAA6B,EAAmB,MAAM,kBAAkB,CAAC;AAGpG,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,yBAAyB,CAAC;AAgCxG,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAGpE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC"}

package/node.d.ts

@@ -5,7 +5,8 @@ export { getKeyBag } from "@fireproof/core-keybag";
 export { DeviceIdKey } from "./device-id/key.js";
 export { DeviceIdSignMsg } from "./device-id/sign.js";
 export { DeviceIdCSR } from "./device-id/csr.js";
-export { DeviceIdCA } from "@fireproof/core-device-id";
+export { DeviceIdVerifyMsg } from "./device-id/verify.js";
+export { DeviceIdCA } from "./device-id/ca.js";
 export { deviceIdRegisterEvento, isResDeviceIdRegister } from "@fireproof/core-cli";
 export type { ReqDeviceIdRegister } from "@fireproof/core-cli";
 export declare function createDeviceIdGetToken(sthis: SuperThis, opts: {

package/node.js

@@ -6,7 +6,8 @@ export { getKeyBag } from "@fireproof/core-keybag";
 export { DeviceIdKey } from "./device-id/key.js";
 export { DeviceIdSignMsg } from "./device-id/sign.js";
 export { DeviceIdCSR } from "./device-id/csr.js";
-export { DeviceIdCA } from "@fireproof/core-device-id";
+export { DeviceIdVerifyMsg } from "./device-id/verify.js";
+export { DeviceIdCA } from "./device-id/ca.js";
 export { deviceIdRegisterEvento, isResDeviceIdRegister } from "@fireproof/core-cli";
 export async function createDeviceIdGetToken(sthis, opts) {
     const kb = await getKeyBag(sthis);

package/node.js.map

@@ -1 +1 @@
-{"version":3,"file":"node.js","sourceRoot":"","sources":["../jsr/node.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAG/C,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAMtD,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAGnD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAIvD,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAiBpF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAgB,EAChB,IAAoE;IAEpE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,kBAAkB,IAAI,uDAAuD,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACzE,IAAI,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QACpB,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC;IACtB,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,EAAG,CAAC,kBAAkB,CAAC;IACxD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IAC5E,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,OAAO,IAAI,CACT,KAAK,IAAmC,EAAE;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAC7B;YACE,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG,EAAE,WAAW;YAChB,QAAQ,EAAE,MAAM,OAAO,CAAC,EAAE,EAAE,CAAC,WAAW,EAAE;YAC1C,GAAG,EAAE,EAAE,GAAG;YACV,GAAG,EAAE,GAAG,GAAG,GAAG;YACd,GAAG,EAAE,GAAG,GAAG,CAAC;YACZ,GAAG,EAAE,GAAG;YACR,GAAG,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG;SACI,EAC7B,OAAO,CACR,CAAC;QACF,OAAO,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,CAAC,EACD,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CACpC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"node.js","sourceRoot":"","sources":["../jsr/node.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAG/C,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAMtD,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAKnD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAI/C,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAiBpF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAgB,EAChB,IAAoE;IAEpE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,kBAAkB,IAAI,uDAAuD,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACzE,IAAI,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QACpB,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC;IACtB,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,EAAG,CAAC,kBAAkB,CAAC;IACxD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IAC5E,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,OAAO,IAAI,CACT,KAAK,IAAmC,EAAE;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAC7B;YACE,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG,EAAE,WAAW;YAChB,QAAQ,EAAE,MAAM,OAAO,CAAC,EAAE,EAAE,CAAC,WAAW,EAAE;YAC1C,GAAG,EAAE,EAAE,GAAG;YACV,GAAG,EAAE,GAAG,GAAG,GAAG;YACd,GAAG,EAAE,GAAG,GAAG,CAAC;YACZ,GAAG,EAAE,GAAG;YACR,GAAG,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG;SACI,EAC7B,OAAO,CACR,CAAC;QACF,OAAO,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,CAAC,EACD,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CACpC,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibes.diy/identity",
-  "version": "2.6.3",
+  "version": "2.6.4",
   "type": "module",
   "main": "./index.js",
   "exports": {

package/types/wire.d.ts

@@ -0,0 +1,163 @@
+import { z } from "zod";
+import type { ClerkClaim } from "../clerk-claim.js";
+import type { JWKPublic } from "@fireproof/core-types-base";
+export declare const JWKPrivateSchema: z.ZodIntersection<z.ZodObject<{
+    kty: z.ZodEnum<{
+        EC: "EC";
+        OKP: "OKP";
+        RSA: "RSA";
+        oct: "oct";
+    }>;
+    use: z.ZodOptional<z.ZodEnum<{
+        enc: "enc";
+        sig: "sig";
+    }>>;
+    key_ops: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        decrypt: "decrypt";
+        deriveBits: "deriveBits";
+        deriveKey: "deriveKey";
+        encrypt: "encrypt";
+        sign: "sign";
+        unwrapKey: "unwrapKey";
+        verify: "verify";
+        wrapKey: "wrapKey";
+    }>>>;
+    alg: z.ZodOptional<z.ZodString>;
+    kid: z.ZodOptional<z.ZodString>;
+    x5u: z.ZodOptional<z.ZodString>;
+    x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    x5t: z.ZodOptional<z.ZodString>;
+    "x5t#S256": z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kty: z.ZodLiteral<"RSA">;
+    n: z.ZodString;
+    e: z.ZodString;
+    d: z.ZodString;
+    p: z.ZodString;
+    q: z.ZodString;
+    dp: z.ZodString;
+    dq: z.ZodString;
+    qi: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    kty: z.ZodLiteral<"EC">;
+    crv: z.ZodEnum<{
+        "P-256": "P-256";
+        "P-384": "P-384";
+        "P-521": "P-521";
+        secp256k1: "secp256k1";
+    }>;
+    x: z.ZodString;
+    y: z.ZodString;
+    d: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    kty: z.ZodLiteral<"oct">;
+    k: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    kty: z.ZodLiteral<"OKP">;
+    crv: z.ZodEnum<{
+        Ed25519: "Ed25519";
+        Ed448: "Ed448";
+        X25519: "X25519";
+        X448: "X448";
+    }>;
+    x: z.ZodString;
+    d: z.ZodString;
+}, z.core.$strip>], "kty">>;
+export declare const JWKPublicSchema: z.ZodIntersection<z.ZodObject<{
+    kty: z.ZodEnum<{
+        EC: "EC";
+        OKP: "OKP";
+        RSA: "RSA";
+        oct: "oct";
+    }>;
+    use: z.ZodOptional<z.ZodEnum<{
+        enc: "enc";
+        sig: "sig";
+    }>>;
+    key_ops: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        decrypt: "decrypt";
+        deriveBits: "deriveBits";
+        deriveKey: "deriveKey";
+        encrypt: "encrypt";
+        sign: "sign";
+        unwrapKey: "unwrapKey";
+        verify: "verify";
+        wrapKey: "wrapKey";
+    }>>>;
+    alg: z.ZodOptional<z.ZodString>;
+    kid: z.ZodOptional<z.ZodString>;
+    x5u: z.ZodOptional<z.ZodString>;
+    x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    x5t: z.ZodOptional<z.ZodString>;
+    "x5t#S256": z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kty: z.ZodLiteral<"RSA">;
+    n: z.ZodString;
+    e: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    kty: z.ZodLiteral<"EC">;
+    crv: z.ZodEnum<{
+        "P-256": "P-256";
+        "P-384": "P-384";
+        "P-521": "P-521";
+        secp256k1: "secp256k1";
+    }>;
+    x: z.ZodString;
+    y: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    kty: z.ZodLiteral<"oct">;
+    k: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    kty: z.ZodLiteral<"OKP">;
+    crv: z.ZodEnum<{
+        Ed25519: "Ed25519";
+        Ed448: "Ed448";
+        X25519: "X25519";
+        X448: "X448";
+    }>;
+    x: z.ZodString;
+}, z.core.$strip>], "kty">>;
+export interface DashAuthType {
+    readonly type: "ucan" | "clerk" | "device-id";
+    readonly token: string;
+}
+export interface WithAuth {
+    readonly auth: DashAuthType;
+}
+export interface ReqCertFromCsr {
+    readonly type: "reqCertFromCsr";
+    readonly auth: DashAuthType;
+    readonly csr: string;
+}
+export interface ResCertFromCsr {
+    readonly type: "resCertFromCsr";
+    readonly certificate: string;
+}
+export interface VerifiedClaimsResult {
+    readonly type: DashAuthType["type"];
+    readonly token: string;
+    readonly claims: unknown;
+}
+export interface ClerkVerifiedAuth {
+    readonly type: "clerk";
+    readonly claims: ClerkClaim;
+}
+export interface VerifiedAuthResult {
+    readonly type: "VerifiedAuthResult";
+    readonly inDashAuth: DashAuthType;
+    readonly verifiedAuth: ClerkVerifiedAuth;
+}
+export interface FPApiToken {
+    verify(token: string): Promise<import("@adviser/cement").Result<VerifiedClaimsResult>>;
+    decode(token: string): Promise<import("@adviser/cement").Result<VerifiedClaimsResult>>;
+}
+export interface FPApiParameters {
+    cloudPublicKeys: JWKPublic[];
+    clerkPublishableKey: string;
+    maxTenants: number;
+    maxAdminUsers: number;
+    maxMemberUsers: number;
+    maxInvites: number;
+    maxLedgers: number;
+    maxAppIdBindings: number;
+}

package/types/wire.js

@@ -0,0 +1,41 @@
+import { z } from "zod";
+const JWKCommon = z.object({
+    kty: z.enum(["RSA", "EC", "oct", "OKP"]),
+    use: z.enum(["sig", "enc"]).optional(),
+    key_ops: z.array(z.enum(["sign", "verify", "encrypt", "decrypt", "wrapKey", "unwrapKey", "deriveKey", "deriveBits"])).optional(),
+    alg: z.string().optional(),
+    kid: z.string().optional(),
+    x5u: z.string().url().optional(),
+    x5c: z.array(z.string()).optional(),
+    x5t: z.string().optional(),
+    "x5t#S256": z.string().optional(),
+});
+export const JWKPrivateSchema = JWKCommon.and(z.discriminatedUnion("kty", [
+    z.object({
+        kty: z.literal("RSA"),
+        n: z.string(),
+        e: z.string(),
+        d: z.string(),
+        p: z.string(),
+        q: z.string(),
+        dp: z.string(),
+        dq: z.string(),
+        qi: z.string(),
+    }),
+    z.object({
+        kty: z.literal("EC"),
+        crv: z.enum(["P-256", "P-384", "P-521", "secp256k1"]),
+        x: z.string(),
+        y: z.string(),
+        d: z.string(),
+    }),
+    z.object({ kty: z.literal("oct"), k: z.string() }),
+    z.object({ kty: z.literal("OKP"), crv: z.enum(["Ed25519", "Ed448", "X25519", "X448"]), x: z.string(), d: z.string() }),
+]));
+export const JWKPublicSchema = JWKCommon.and(z.discriminatedUnion("kty", [
+    z.object({ kty: z.literal("RSA"), n: z.string(), e: z.string() }),
+    z.object({ kty: z.literal("EC"), crv: z.enum(["P-256", "P-384", "P-521", "secp256k1"]), x: z.string(), y: z.string() }),
+    z.object({ kty: z.literal("oct"), k: z.string() }),
+    z.object({ kty: z.literal("OKP"), crv: z.enum(["Ed25519", "Ed448", "X25519", "X448"]), x: z.string() }),
+]));
+//# sourceMappingURL=wire.js.map

package/types/wire.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire.js","sourceRoot":"","sources":["../../jsr/types/wire.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IACzB,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACxC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChI,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAChC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,SAAS,CAAC,GAAG,CAC3C,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE;IAC1B,CAAC,CAAC,MAAM,CAAC;QACP,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;QACb,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;QACb,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;QACb,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;QACb,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;QACb,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;KACf,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACpB,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;QACrD,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;QACb,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;QACb,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;KACd,CAAC;IACF,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IAClD,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;CACvH,CAAC,CACH,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,SAAS,CAAC,GAAG,CAC1C,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE;IAC1B,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACjE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACvH,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IAClD,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;CACxG,CAAC,CACH,CAAC"}

package/types/wire.test.d.ts

@@ -0,0 +1 @@
+export {};

package/types/wire.test.js

@@ -0,0 +1,23 @@
+import { describe, it, expect } from "vitest";
+import { generateKeyPair, exportJWK } from "jose";
+import { JWKPrivateSchema, JWKPublicSchema } from "./wire.js";
+import { JWKPrivateSchema as UpstreamPrivate, JWKPublicSchema as UpstreamPublic } from "@fireproof/core-types-base";
+describe("JWK schema parity (owned vs @fireproof/core-types-base)", () => {
+    it("agrees with upstream on a real ES256 private + public JWK", async () => {
+        const { privateKey, publicKey } = await generateKeyPair("ES256", { extractable: true });
+        const priv = await exportJWK(privateKey);
+        const pub = await exportJWK(publicKey);
+        expect(JWKPrivateSchema.safeParse(priv).success).toBe(true);
+        expect(JWKPrivateSchema.safeParse(priv).success).toBe(UpstreamPrivate.safeParse(priv).success);
+        expect(JWKPublicSchema.safeParse(pub).success).toBe(true);
+        expect(JWKPublicSchema.safeParse(pub).success).toBe(UpstreamPublic.safeParse(pub).success);
+        expect(JWKPublicSchema.safeParse(priv).success).toBe(UpstreamPublic.safeParse(priv).success);
+    });
+    it("agrees with upstream on rejecting a malformed JWK (EC missing y)", () => {
+        const bad = { kty: "EC", crv: "P-256", x: "only-x" };
+        expect(JWKPublicSchema.safeParse(bad).success).toBe(false);
+        expect(JWKPublicSchema.safeParse(bad).success).toBe(UpstreamPublic.safeParse(bad).success);
+        expect(JWKPrivateSchema.safeParse(bad).success).toBe(UpstreamPrivate.safeParse(bad).success);
+    });
+});
+//# sourceMappingURL=wire.test.js.map

package/types/wire.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire.test.js","sourceRoot":"","sources":["../../jsr/types/wire.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC9D,OAAO,EAAE,gBAAgB,IAAI,eAAe,EAAE,eAAe,IAAI,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAKpH,QAAQ,CAAC,yDAAyD,EAAE,GAAG,EAAE;IACvE,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACxF,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC;QAEvC,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;QAE/F,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;QAG3F,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;IAC/F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,GAAG,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC;QACrD,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3D,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;QAC3F,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;IAC/F,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}