burnledger 0.8.1 → 0.9.0

package/dist/esm/customer-keys.js

@@ -17,7 +17,8 @@
  * expectation in tests/customer-key-parity.test.ts comes from a corpus the Go
  * generator writes by calling core itself.
  */
-import { canonicalJson } from "./verify.js";
+import { canonicalJson, formatTimestamp } from "./verify.js";
+import { VerificationError } from "./errors.js";
 /**
  * Mirrors core.CustomerKeyIDPrefix. It distinguishes a customer's key id from
  * an issuer key id, which are otherwise the same shape and would be confusable
@@ -30,7 +31,11 @@ export const CUSTOMER_KEY_ID_PREFIX = "cust_k_";
  * reimplementation that omits it computes a different id for every group.
  */
 const PAYLOAD_TYPE_CUSTOMER_KEY_GROUP = "burnledger.customer_key_group.v1";
-export const PAYLOAD_TYPE_KEY_ROTATION_REQUEST = "burnledger.key_rotation_request.v1";
+/**
+ * Mirrors core.PayloadTypeKeyRotationRequest. v2 carries not_after, which bounds
+ * the request itself; a protocol-12 enclave refuses v1.
+ */
+export const PAYLOAD_TYPE_KEY_ROTATION_REQUEST = "burnledger.key_rotation_request.v2";
 /** Mirrors core.MaxCustomerKeyGroupMembers. */
 export const MAX_CUSTOMER_KEY_GROUP_MEMBERS = 16;
 const ED25519_PUBLIC_KEY_SIZE = 32;
@@ -67,6 +72,13 @@ export async function validateKeyGroup(crypto, group) {
         if (member.length !== ED25519_PUBLIC_KEY_SIZE) {
             throw new InvalidKeyGroupError(`every member must be a ${ED25519_PUBLIC_KEY_SIZE}-byte Ed25519 key`);
         }
+        if (!isNotSmallOrder(member)) {
+            // A small-order key is held by nobody: with the identity point as the
+            // public key, R = identity and S = 0 verify over ANY message, so it
+            // would pass proof of possession and count toward a threshold for free.
+            throw new InvalidKeyGroupError("every member must be an Ed25519 public key on the curve and not of small order " +
+                "(small-order and off-curve keys are refused)");
+        }
         const fingerprint = await memberFingerprint(crypto, member);
         if (seen.has(fingerprint)) {
             // A repeated member would let one holder satisfy a threshold meant to
@@ -100,6 +112,16 @@ export async function customerKeyId(crypto, group) {
     };
     return CUSTOMER_KEY_ID_PREFIX + toHex(await crypto.sha256(canonicalJson(document)));
 }
+/**
+ * A request's `not_after` as Go signs it (core.KeyTimeFormat): UTC, whole
+ * seconds, the fraction truncated as Go's Format truncates it.
+ */
+export function keyTime(value) {
+    if (!(value instanceof Date) || Number.isNaN(value.getTime())) {
+        throw new Error("not_after is required");
+    }
+    return value.toISOString().slice(0, 19) + "Z";
+}
 /**
  * The canonical bytes the OUTGOING group's members sign to authorise a rotation.
  *
@@ -115,16 +137,314 @@ export function buildKeyRotationRequestPayload(request) {
     if (!request.prevKeyId || !request.nextKeyId) {
         throw new Error("a rotation request names both the key being replaced and its replacement");
     }
+    if (!(request.notAfter instanceof Date) || Number.isNaN(request.notAfter.getTime())) {
+        throw new Error("not_after is required");
+    }
     if (request.prevKeyId === request.nextKeyId) {
         // A self-rotation is a cycle in the chain the enclave walks, and it walks
         // without a visited set.
         throw new Error("a rotation request cannot name the same key as both predecessor and successor");
     }
     return canonicalJson({
-        asserted_team_id: request.assertedTeamId,
+        asserted_team_id: canonicalUuid(request.assertedTeamId, "assertedTeamId"),
         next_key_id: request.nextKeyId,
+        not_after: keyTime(request.notAfter),
         payload_type: PAYLOAD_TYPE_KEY_ROTATION_REQUEST,
         prev_key_id: request.prevKeyId,
     });
 }
+// Ed25519 arithmetic for one question only: is a member key a curve point
+// outside the small-order subgroup? It mirrors the decoding Go's
+// filippo.io/edwards25519 performs in core.CustomerKeyGroup.Validate, so both
+// sides refuse exactly the same keys: bit 255 of y is ignored and y is reduced
+// mod p (non-canonical encodings are accepted), a y with no matching x is
+// refused, and the sign bit selects the negative root even when x = 0.
+const FIELD_P = 2n ** 255n - 19n;
+const fieldMod = (a) => ((a % FIELD_P) + FIELD_P) % FIELD_P;
+function fieldPow(base, exp) {
+    let result = 1n;
+    let b = fieldMod(base);
+    for (let e = exp; e > 0n; e >>= 1n) {
+        if (e & 1n)
+            result = (result * b) % FIELD_P;
+        b = (b * b) % FIELD_P;
+    }
+    return result;
+}
+const fieldInv = (a) => fieldPow(a, FIELD_P - 2n);
+const CURVE_D = fieldMod(-121665n * fieldInv(121666n));
+const SQRT_MINUS_ONE = fieldPow(2n, (FIELD_P - 1n) / 4n);
+function decodePoint(bytes) {
+    // validateKeyGroup has already required exactly 32 bytes.
+    const top = bytes[31] ?? 0;
+    let y = 0n;
+    for (let i = 31; i >= 0; i--) {
+        y = (y << 8n) | BigInt(i === 31 ? top & 0x7f : (bytes[i] ?? 0));
+    }
+    y = fieldMod(y);
+    const u = fieldMod(y * y - 1n);
+    const v = fieldMod(CURVE_D * y * y + 1n);
+    let x = fieldMod(u * fieldPow(v, 3n) * fieldPow(u * fieldPow(v, 7n), (FIELD_P - 5n) / 8n));
+    const vx2 = fieldMod(v * x * x);
+    if (vx2 === fieldMod(-u)) {
+        x = fieldMod(x * SQRT_MINUS_ONE);
+    }
+    else if (vx2 !== u) {
+        return null;
+    }
+    if (Number(x & 1n) !== top >> 7)
+        x = fieldMod(-x);
+    return [x, y];
+}
+// The complete twisted-Edwards addition law (a = -1); its denominators are
+// never zero because d is not a square.
+function addPoints(p, q) {
+    const t = fieldMod(CURVE_D * p[0] * q[0] * p[1] * q[1]);
+    return [
+        fieldMod((p[0] * q[1] + p[1] * q[0]) * fieldInv(1n + t)),
+        fieldMod((p[1] * q[1] + p[0] * q[0]) * fieldInv(fieldMod(1n - t))),
+    ];
+}
+/**
+ * Whether key decodes to a curve point that is not of small order (8·P ≠ identity).
+ * Not a prime-order check: a mixed-order key passes, as it does in Go.
+ */
+function isNotSmallOrder(key) {
+    let point = decodePoint(key);
+    if (point === null)
+        return false;
+    for (let i = 0; i < 3; i++)
+        point = addPoints(point, point);
+    return !(point[0] === 0n && point[1] === 1n);
+}
+/** Mirrors core.PayloadTypeKeyEnrollmentRequest. */
+export const PAYLOAD_TYPE_KEY_ENROLLMENT_REQUEST = "burnledger.key_enrollment_request.v1";
+/** Mirrors core.PayloadTypeSystemRegistrationRequest. */
+export const PAYLOAD_TYPE_SYSTEM_REGISTRATION_REQUEST = "burnledger.system_registration_request.v1";
+const UUID_RE = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+const NIL_UUID = "00000000-0000-0000-0000-000000000000";
+/**
+ * A UUID in the one form Go prints it (uuid.UUID.String()): lowercase and
+ * hyphenated. The enclave rebuilds every customer-signed payload from the
+ * uuid.UUID it parsed, so a team id signed as the caller happened to type it —
+ * uppercase, say — would be different bytes, and the refusal would be a 401 with
+ * nothing in it to say why.
+ */
+function canonicalUuid(value, field) {
+    if (typeof value !== "string" || !UUID_RE.test(value)) {
+        throw new Error(`${field} must be a UUID, got ${JSON.stringify(value)}`);
+    }
+    return value.toLowerCase();
+}
+function requireSha256(value, field) {
+    if (!(value instanceof Uint8Array) || value.length !== 32) {
+        throw new Error(`${field} must be a 32-byte SHA-256 digest`);
+    }
+    return toHex(value);
+}
+/**
+ * The canonical bytes EVERY member of a group signs to enrol it for a team.
+ *
+ * Port of core.BuildKeyEnrollmentRequestPayload. Without these signatures
+ * whoever relays the request could enrol public keys it does not hold — the
+ * customer's included — so the enclave demands one from each member, not a
+ * threshold: the statement it signs vouches for every key. `notAfter` is the
+ * latest the resulting authorization may end, and when the request itself stops
+ * being usable: the enclave cannot recognize a replay, so this is what keeps a
+ * relayed copy from renewing the window.
+ */
+export function buildKeyEnrollmentRequestPayload(request) {
+    if (!request.customerKeyId)
+        throw new Error("customer_key_id is required");
+    return canonicalJson({
+        asserted_team_id: canonicalUuid(request.assertedTeamId, "assertedTeamId"),
+        customer_key_id: request.customerKeyId,
+        not_after: keyTime(request.notAfter),
+        payload_type: PAYLOAD_TYPE_KEY_ENROLLMENT_REQUEST,
+    });
+}
+/**
+ * The canonical bytes an enrolled group signs, at its threshold, to register one
+ * system under it.
+ *
+ * Port of core.BuildSystemRegistrationRequestPayload. Both digests are over bytes
+ * the CUSTOMER holds: `configDigest` is SHA-256 of the exact config bytes
+ * submitted when the system was created (the plaintext that was sealed), and
+ * `queryTemplateSha256` is SHA-256 of the template exactly as it will be sent —
+ * raw, not normalized. The enclave recomputes both from what it decrypted and
+ * was given, so a relay that substitutes either changes the bytes and the
+ * signatures fail.
+ */
+export function buildSystemRegistrationRequestPayload(request) {
+    if (!request.customerKeyId)
+        throw new Error("customer_key_id is required");
+    const systemId = canonicalUuid(request.systemId, "systemId");
+    if (systemId === NIL_UUID)
+        throw new Error("system_id is required");
+    return canonicalJson({
+        asserted_team_id: canonicalUuid(request.assertedTeamId, "assertedTeamId"),
+        config_digest: requireSha256(request.configDigest, "configDigest"),
+        connector_type: request.connectorType,
+        customer_key_id: request.customerKeyId,
+        payload_type: PAYLOAD_TYPE_SYSTEM_REGISTRATION_REQUEST,
+        query_template_sha256: requireSha256(request.queryTemplateSha256, "queryTemplateSha256"),
+        system_id: systemId,
+    });
+}
+// --- The documents the ENCLAVE signs -----------------------------------------
+//
+// Ports of core.VerifyKeyEnrollment, core.VerifyTeamAuthorization and
+// core.VerifySystemRegistration. Each takes the key rather than finding one, as
+// Go's do: a document that names the key vouching for it proves only that its
+// author holds that key. The key to pass is the signing key of an enclave you
+// attested against your pinned PCR0 (EnclaveIdentity.signingKey) -- the client's
+// enrol, rotate and register calls use exactly that. Each reads the document as
+// the API returns it, because the signed bytes are rebuilt from the wire
+// strings (whole-second UTC timestamps, lowercase UUIDs), and throws
+// VerificationError on anything that does not verify.
+// v2 from wire protocol 12, and v2 is the only version a protocol-12 enclave
+// issues or honors: a v1 document could have been minted by an earlier image
+// without the customer's signature.
+const PAYLOAD_TYPE_KEY_ENROLLMENT = "burnledger.key_enrollment.v2";
+const PAYLOAD_TYPE_TEAM_AUTHORIZATION = "burnledger.team_authorization.v2";
+const PAYLOAD_TYPE_SYSTEM_REGISTRATION = "burnledger.system_registration.v2";
+function docObject(value, what) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw new VerificationError(`${what} is not an object`);
+    }
+    return value;
+}
+function docString(doc, what, field) {
+    const value = doc[field];
+    if (typeof value !== "string")
+        throw new VerificationError(`${what}.${field} is not a string`);
+    return value;
+}
+function docKeyId(doc, what) {
+    const value = docString(doc, what, "customer_key_id");
+    if (value === "")
+        throw new VerificationError(`${what}.customer_key_id is empty`);
+    return value;
+}
+function docUuid(doc, what, field) {
+    const value = docString(doc, what, field);
+    if (!UUID_RE.test(value))
+        throw new VerificationError(`${what}.${field} is not a UUID`);
+    return value.toLowerCase();
+}
+/** Go encodes [N]byte as an array of numbers. */
+function docBytes(doc, what, field, length) {
+    const value = doc[field];
+    if (!Array.isArray(value) ||
+        value.length !== length ||
+        !value.every((b) => Number.isInteger(b) && b >= 0 && b <= 255)) {
+        throw new VerificationError(`${what}.${field} is not ${length} bytes`);
+    }
+    return new Uint8Array(value);
+}
+/** Go encodes []byte as padded standard base64. */
+function base64Bytes(value, what) {
+    if (typeof value !== "string" || value.length % 4 !== 0 || !/^[A-Za-z0-9+/]*={0,2}$/.test(value)) {
+        throw new VerificationError(`${what} is not base64`);
+    }
+    const bin = atob(value);
+    const out = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++)
+        out[i] = bin.charCodeAt(i);
+    return out;
+}
+async function requireEnclaveSignature(crypto, enclaveKey, payload, signature, what) {
+    if (!(enclaveKey instanceof Uint8Array) || enclaveKey.length !== ED25519_PUBLIC_KEY_SIZE) {
+        throw new TypeError(`enclaveKey must be a ${ED25519_PUBLIC_KEY_SIZE}-byte Ed25519 public key`);
+    }
+    if (!(await crypto.ed25519Verify(enclaveKey, payload, signature))) {
+        const keyId = "dp_k_" + toHex(await crypto.sha256(enclaveKey));
+        throw new VerificationError(`the ${what} is not signed by enclave key ${keyId}. Do not use it: a relay that ` +
+            "forged or altered one would produce exactly this.");
+    }
+}
+/**
+ * Verify the enclave's signature on a key enrolment statement (the `enrollment`
+ * object ENROLL_KEY and ROTATE_KEY return). Also refuses a statement whose
+ * `customer_key_id` is not the id its own group derives, as Go's payload
+ * builder does -- so a statement that verifies names exactly its members and
+ * threshold, and comparing its key id with yours compares those too.
+ */
+export async function verifyKeyEnrollmentStatement(crypto, statement, enclaveKey) {
+    const what = "enrollment";
+    const doc = docObject(statement, what);
+    const rawGroup = docObject(doc.group, `${what}.group`);
+    if (!Array.isArray(rawGroup.members))
+        throw new VerificationError(`${what}.group.members is not an array`);
+    const group = {
+        threshold: rawGroup.threshold,
+        members: rawGroup.members.map((m, i) => base64Bytes(m, `${what}.group.members[${i}]`)),
+    };
+    let derived;
+    try {
+        derived = await customerKeyId(crypto, group);
+    }
+    catch (err) {
+        if (err instanceof InvalidKeyGroupError)
+            throw new VerificationError(`${what}.group: ${err.message}`);
+        throw err;
+    }
+    const keyId = docKeyId(doc, what);
+    if (keyId !== derived) {
+        throw new VerificationError(`${what}.customer_key_id ${keyId} is not the id its own group derives (${derived})`);
+    }
+    const payload = canonicalJson({
+        asserted_team_id: docUuid(doc, what, "asserted_team_id"),
+        customer_key_id: keyId,
+        enclave_pcr0: docString(doc, what, "enclave_pcr0"),
+        enrolled_at: formatTimestamp(doc.enrolled_at, `${what}.enrolled_at`),
+        member_key_ids: await memberFingerprints(crypto, group),
+        payload_type: PAYLOAD_TYPE_KEY_ENROLLMENT,
+        threshold: group.threshold,
+    });
+    await requireEnclaveSignature(crypto, enclaveKey, payload, docBytes(doc, what, "signature", 64), "enrollment statement");
+}
+/**
+ * Verify the enclave's signature on a team authorization (the `authorization`
+ * object ENROLL_KEY and ROTATE_KEY return). The signature only: whether it is
+ * in force now is a separate question, as in Go.
+ */
+export async function verifyTeamAuthorization(crypto, certificate, enclaveKey) {
+    const what = "authorization";
+    const doc = docObject(certificate, what);
+    const notBefore = formatTimestamp(doc.not_before, `${what}.not_before`);
+    const notAfter = formatTimestamp(doc.not_after, `${what}.not_after`);
+    // Go compares at full precision; the whole-second strings disagree with it
+    // only for a window shorter than a second, which no enclave issues.
+    if (notAfter <= notBefore)
+        throw new VerificationError(`${what}.not_after is not after not_before`);
+    // prev_key_id is omitempty in Go: absent on a first enrolment, and absent
+    // from the signed payload too.
+    const prevKeyId = doc.prev_key_id == null ? "" : docString(doc, what, "prev_key_id");
+    const payload = canonicalJson({
+        asserted_team_id: docUuid(doc, what, "asserted_team_id"),
+        customer_key_id: docKeyId(doc, what),
+        not_after: notAfter,
+        not_before: notBefore,
+        payload_type: PAYLOAD_TYPE_TEAM_AUTHORIZATION,
+        ...(prevKeyId === "" ? {} : { prev_key_id: prevKeyId }),
+    });
+    await requireEnclaveSignature(crypto, enclaveKey, payload, docBytes(doc, what, "signature", 64), "team authorization");
+}
+/** Verify the enclave's signature on a system registration (the
+ * `registration` object REGISTER_SYSTEM returns). */
+export async function verifySystemRegistration(crypto, certificate, enclaveKey) {
+    const what = "registration";
+    const doc = docObject(certificate, what);
+    const payload = canonicalJson({
+        config_digest: toHex(docBytes(doc, what, "config_digest", 32)),
+        connector_type: docString(doc, what, "connector_type"),
+        customer_key_id: docKeyId(doc, what),
+        payload_type: PAYLOAD_TYPE_SYSTEM_REGISTRATION,
+        query_template_hash: toHex(docBytes(doc, what, "query_template_hash", 32)),
+        registered_at: formatTimestamp(doc.registered_at, `${what}.registered_at`),
+        system_id: docUuid(doc, what, "system_id"),
+    });
+    await requireEnclaveSignature(crypto, enclaveKey, payload, docBytes(doc, what, "signature", 64), "system registration");
+}
 //# sourceMappingURL=customer-keys.js.map

package/dist/esm/customer-keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"customer-keys.js","sourceRoot":"","sources":["../../src/customer-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAG5C;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,SAAS,CAAC;AAEhD;;;;GAIG;AACH,MAAM,+BAA+B,GAAG,kCAAkC,CAAC;AAE3E,MAAM,CAAC,MAAM,iCAAiC,GAAG,oCAAoC,CAAC;AAEtF,+CAA+C;AAC/C,MAAM,CAAC,MAAM,8BAA8B,GAAG,EAAE,CAAC;AAEjD,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAEnC,2EAA2E;AAC3E,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAaD,SAAS,KAAK,CAAC,KAAiB;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAiB,EACjB,SAAqB;IAErB,OAAO,KAAK,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAiB,EACjB,KAAuB;IAEvB,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,oBAAoB,CAAC,gDAAgD,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,8BAA8B,EAAE,CAAC;QAC1D,MAAM,IAAI,oBAAoB,CAC5B,yCAAyC,8BAA8B,YAAY;YACjF,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAChC,CAAC;IACJ,CAAC;IACD,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC;QAClC,KAAK,CAAC,SAAS,GAAG,CAAC;QACnB,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EACtC,CAAC;QACD,MAAM,IAAI,oBAAoB,CAC5B,aAAa,KAAK,CAAC,SAAS,6BAA6B,KAAK,CAAC,OAAO,CAAC,MAAM,UAAU,CACxF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,MAAM,KAAK,uBAAuB,EAAE,CAAC;YAC9C,MAAM,IAAI,oBAAoB,CAC5B,0BAA0B,uBAAuB,mBAAmB,CACrE,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5D,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC1B,sEAAsE;YACtE,qDAAqD;YACrD,MAAM,IAAI,oBAAoB,CAAC,qCAAqC,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAiB,EACjB,KAAuB;IAEvB,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,GAAG,CAAC,IAAI,CAAC,MAAM,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAiB,EACjB,KAAuB;IAEvB,MAAM,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG;QACf,cAAc,EAAE,MAAM,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC;QACvD,YAAY,EAAE,+BAA+B;QAC7C,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;IACF,OAAO,sBAAsB,GAAG,KAAK,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACtF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,8BAA8B,CAAC,OAI9C;IACC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;QAC5C,0EAA0E;QAC1E,yBAAyB;QACzB,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;IACJ,CAAC;IACD,OAAO,aAAa,CAAC;QACnB,gBAAgB,EAAE,OAAO,CAAC,cAAc;QACxC,WAAW,EAAE,OAAO,CAAC,SAAS;QAC9B,YAAY,EAAE,iCAAiC;QAC/C,WAAW,EAAE,OAAO,CAAC,SAAS;KAC/B,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"customer-keys.js","sourceRoot":"","sources":["../../src/customer-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,SAAS,CAAC;AAEhD;;;;GAIG;AACH,MAAM,+BAA+B,GAAG,kCAAkC,CAAC;AAE3E;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,oCAAoC,CAAC;AAEtF,+CAA+C;AAC/C,MAAM,CAAC,MAAM,8BAA8B,GAAG,EAAE,CAAC;AAEjD,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAEnC,2EAA2E;AAC3E,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAaD,SAAS,KAAK,CAAC,KAAiB;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAiB,EACjB,SAAqB;IAErB,OAAO,KAAK,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAiB,EACjB,KAAuB;IAEvB,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,oBAAoB,CAAC,gDAAgD,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,8BAA8B,EAAE,CAAC;QAC1D,MAAM,IAAI,oBAAoB,CAC5B,yCAAyC,8BAA8B,YAAY;YACjF,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAChC,CAAC;IACJ,CAAC;IACD,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC;QAClC,KAAK,CAAC,SAAS,GAAG,CAAC;QACnB,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EACtC,CAAC;QACD,MAAM,IAAI,oBAAoB,CAC5B,aAAa,KAAK,CAAC,SAAS,6BAA6B,KAAK,CAAC,OAAO,CAAC,MAAM,UAAU,CACxF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,MAAM,KAAK,uBAAuB,EAAE,CAAC;YAC9C,MAAM,IAAI,oBAAoB,CAC5B,0BAA0B,uBAAuB,mBAAmB,CACrE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,sEAAsE;YACtE,oEAAoE;YACpE,wEAAwE;YACxE,MAAM,IAAI,oBAAoB,CAC5B,iFAAiF;gBAC/E,8CAA8C,CACjD,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5D,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC1B,sEAAsE;YACtE,qDAAqD;YACrD,MAAM,IAAI,oBAAoB,CAAC,qCAAqC,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAiB,EACjB,KAAuB;IAEvB,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,GAAG,CAAC,IAAI,CAAC,MAAM,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAiB,EACjB,KAAuB;IAEvB,MAAM,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG;QACf,cAAc,EAAE,MAAM,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC;QACvD,YAAY,EAAE,+BAA+B;QAC7C,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;IACF,OAAO,sBAAsB,GAAG,KAAK,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACtF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,KAAW;IACjC,IAAI,CAAC,CAAC,KAAK,YAAY,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC;AAChD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,8BAA8B,CAAC,OAU9C;IACC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,YAAY,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QACpF,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;QAC5C,0EAA0E;QAC1E,yBAAyB;QACzB,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;IACJ,CAAC;IACD,OAAO,aAAa,CAAC;QACnB,gBAAgB,EAAE,aAAa,CAAC,OAAO,CAAC,cAAc,EAAE,gBAAgB,CAAC;QACzE,WAAW,EAAE,OAAO,CAAC,SAAS;QAC9B,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;QACpC,YAAY,EAAE,iCAAiC;QAC/C,WAAW,EAAE,OAAO,CAAC,SAAS;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,0EAA0E;AAC1E,iEAAiE;AACjE,8EAA8E;AAC9E,+EAA+E;AAC/E,0EAA0E;AAC1E,uEAAuE;AACvE,MAAM,OAAO,GAAG,EAAE,IAAI,IAAI,GAAG,GAAG,CAAC;AACjC,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,OAAO,CAAC,GAAG,OAAO,CAAC;AAC5E,SAAS,QAAQ,CAAC,IAAY,EAAE,GAAW;IACzC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IACvB,KAAK,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC;QACnC,IAAI,CAAC,GAAG,EAAE;YAAE,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC;QAC5C,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC;IACxB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,GAAG,EAAE,CAAC,CAAC;AAClE,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AACvD,MAAM,cAAc,GAAG,QAAQ,CAAC,EAAE,EAAE,CAAC,OAAO,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;AAEzD,SAAS,WAAW,CAAC,KAAiB;IACpC,0DAA0D;IAC1D,MAAM,GAAG,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAChB,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/B,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;IACzC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC3F,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,IAAI,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,CAAC,GAAG,QAAQ,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC;IACnC,CAAC;SAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,GAAG,IAAI,CAAC;QAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAChB,CAAC;AAED,2EAA2E;AAC3E,wCAAwC;AACxC,SAAS,SAAS,CAAC,CAAmB,EAAE,CAAmB;IACzD,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,OAAO;QACL,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACxD,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;KACnE,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,GAAe;IACtC,IAAI,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;QAAE,KAAK,GAAG,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC5D,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,oDAAoD;AACpD,MAAM,CAAC,MAAM,mCAAmC,GAAG,sCAAsC,CAAC;AAC1F,yDAAyD;AACzD,MAAM,CAAC,MAAM,wCAAwC,GAAG,2CAA2C,CAAC;AAEpG,MAAM,OAAO,GAAG,+EAA+E,CAAC;AAChG,MAAM,QAAQ,GAAG,sCAAsC,CAAC;AAExD;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,KAAa,EAAE,KAAa;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,wBAAwB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,aAAa,CAAC,KAAiB,EAAE,KAAa;IACrD,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,mCAAmC,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC;AACtB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gCAAgC,CAAC,OAIhD;IACC,IAAI,CAAC,OAAO,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC3E,OAAO,aAAa,CAAC;QACnB,gBAAgB,EAAE,aAAa,CAAC,OAAO,CAAC,cAAc,EAAE,gBAAgB,CAAC;QACzE,eAAe,EAAE,OAAO,CAAC,aAAa;QACtC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;QACpC,YAAY,EAAE,mCAAmC;KAClD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qCAAqC,CAAC,OAOrD;IACC,IAAI,CAAC,OAAO,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC7D,IAAI,QAAQ,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACpE,OAAO,aAAa,CAAC;QACnB,gBAAgB,EAAE,aAAa,CAAC,OAAO,CAAC,cAAc,EAAE,gBAAgB,CAAC;QACzE,aAAa,EAAE,aAAa,CAAC,OAAO,CAAC,YAAY,EAAE,cAAc,CAAC;QAClE,cAAc,EAAE,OAAO,CAAC,aAAa;QACrC,eAAe,EAAE,OAAO,CAAC,aAAa;QACtC,YAAY,EAAE,wCAAwC;QACtD,qBAAqB,EAAE,aAAa,CAAC,OAAO,CAAC,mBAAmB,EAAE,qBAAqB,CAAC;QACxF,SAAS,EAAE,QAAQ;KACpB,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,EAAE;AACF,sEAAsE;AACtE,gFAAgF;AAChF,8EAA8E;AAC9E,8EAA8E;AAC9E,iFAAiF;AACjF,gFAAgF;AAChF,yEAAyE;AACzE,qEAAqE;AACrE,sDAAsD;AAEtD,6EAA6E;AAC7E,6EAA6E;AAC7E,oCAAoC;AACpC,MAAM,2BAA2B,GAAG,8BAA8B,CAAC;AACnE,MAAM,+BAA+B,GAAG,kCAAkC,CAAC;AAC3E,MAAM,gCAAgC,GAAG,mCAAmC,CAAC;AAI7E,SAAS,SAAS,CAAC,KAAc,EAAE,IAAY;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,iBAAiB,CAAC,GAAG,IAAI,mBAAmB,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,KAAY,CAAC;AACtB,CAAC;AAED,SAAS,SAAS,CAAC,GAAQ,EAAE,IAAY,EAAE,KAAa;IACtD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,iBAAiB,CAAC,GAAG,IAAI,IAAI,KAAK,kBAAkB,CAAC,CAAC;IAC/F,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,GAAQ,EAAE,IAAY;IACtC,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC;IACtD,IAAI,KAAK,KAAK,EAAE;QAAE,MAAM,IAAI,iBAAiB,CAAC,GAAG,IAAI,2BAA2B,CAAC,CAAC;IAClF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,OAAO,CAAC,GAAQ,EAAE,IAAY,EAAE,KAAa;IACpD,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,GAAG,IAAI,IAAI,KAAK,gBAAgB,CAAC,CAAC;IACxF,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC;AAC7B,CAAC;AAED,iDAAiD;AACjD,SAAS,QAAQ,CAAC,GAAQ,EAAE,IAAY,EAAE,KAAa,EAAE,MAAc;IACrE,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,KAAK,CAAC,MAAM,KAAK,MAAM;QACvB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,EAC9D,CAAC;QACD,MAAM,IAAI,iBAAiB,CAAC,GAAG,IAAI,IAAI,KAAK,WAAW,MAAM,QAAQ,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,KAAiB,CAAC,CAAC;AAC3C,CAAC;AAED,mDAAmD;AACnD,SAAS,WAAW,CAAC,KAAc,EAAE,IAAY;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACjG,MAAM,IAAI,iBAAiB,CAAC,GAAG,IAAI,gBAAgB,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IACxB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,MAAiB,EACjB,UAAsB,EACtB,OAAmB,EACnB,SAAqB,EACrB,IAAY;IAEZ,IAAI,CAAC,CAAC,UAAU,YAAY,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,uBAAuB,EAAE,CAAC;QACzF,MAAM,IAAI,SAAS,CAAC,wBAAwB,uBAAuB,0BAA0B,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;QAClE,MAAM,KAAK,GAAG,OAAO,GAAG,KAAK,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAC/D,MAAM,IAAI,iBAAiB,CACzB,OAAO,IAAI,iCAAiC,KAAK,gCAAgC;YAC/E,mDAAmD,CACtD,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,MAAiB,EACjB,SAAkB,EAClB,UAAsB;IAEtB,MAAM,IAAI,GAAG,YAAY,CAAC;IAC1B,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,IAAI,QAAQ,CAAC,CAAC;IACvD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,GAAG,IAAI,gCAAgC,CAAC,CAAC;IAC3G,MAAM,KAAK,GAAqB;QAC9B,SAAS,EAAE,QAAQ,CAAC,SAAmB;QACvC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,GAAG,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC;KACvF,CAAC;IACF,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,oBAAoB;YAAE,MAAM,IAAI,iBAAiB,CAAC,GAAG,IAAI,WAAW,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACtG,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAClC,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACtB,MAAM,IAAI,iBAAiB,CAAC,GAAG,IAAI,oBAAoB,KAAK,yCAAyC,OAAO,GAAG,CAAC,CAAC;IACnH,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAAC;QAC5B,gBAAgB,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,kBAAkB,CAAC;QACxD,eAAe,EAAE,KAAK;QACtB,YAAY,EAAE,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,cAAc,CAAC;QAClD,WAAW,EAAE,eAAe,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,IAAI,cAAc,CAAC;QACpE,cAAc,EAAE,MAAM,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC;QACvD,YAAY,EAAE,2BAA2B;QACzC,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAC;IACH,MAAM,uBAAuB,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE,sBAAsB,CAAC,CAAC;AAC3H,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAiB,EACjB,WAAoB,EACpB,UAAsB;IAEtB,MAAM,IAAI,GAAG,eAAe,CAAC;IAC7B,MAAM,GAAG,GAAG,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,IAAI,aAAa,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,IAAI,YAAY,CAAC,CAAC;IACrE,2EAA2E;IAC3E,oEAAoE;IACpE,IAAI,QAAQ,IAAI,SAAS;QAAE,MAAM,IAAI,iBAAiB,CAAC,GAAG,IAAI,oCAAoC,CAAC,CAAC;IACpG,0EAA0E;IAC1E,+BAA+B;IAC/B,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;IACrF,MAAM,OAAO,GAAG,aAAa,CAAC;QAC5B,gBAAgB,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,kBAAkB,CAAC;QACxD,eAAe,EAAE,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;QACpC,SAAS,EAAE,QAAQ;QACnB,UAAU,EAAE,SAAS;QACrB,YAAY,EAAE,+BAA+B;QAC7C,GAAG,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;KACxD,CAAC,CAAC;IACH,MAAM,uBAAuB,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE,oBAAoB,CAAC,CAAC;AACzH,CAAC;AAED;qDACqD;AACrD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAiB,EACjB,WAAoB,EACpB,UAAsB;IAEtB,MAAM,IAAI,GAAG,cAAc,CAAC;IAC5B,MAAM,GAAG,GAAG,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,aAAa,CAAC;QAC5B,aAAa,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;QAC9D,cAAc,EAAE,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,gBAAgB,CAAC;QACtD,eAAe,EAAE,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;QACpC,YAAY,EAAE,gCAAgC;QAC9C,mBAAmB,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,qBAAqB,EAAE,EAAE,CAAC,CAAC;QAC1E,aAAa,EAAE,eAAe,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,IAAI,gBAAgB,CAAC;QAC1E,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,WAAW,CAAC;KAC3C,CAAC,CAAC;IACH,MAAM,uBAAuB,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE,qBAAqB,CAAC,CAAC;AAC1H,CAAC"}

package/dist/esm/enclave-registration.d.ts

@@ -0,0 +1,153 @@
+/**
+ * The customer's side of ADR-025: verify the enclave, enrol a key group, rotate
+ * it, register a system under it.
+ *
+ * Request-building and response-checking for the BurnLedger client's methods of
+ * the same names, kept in a Node-only module the client imports lazily — the
+ * client is also the browser entry's, and these need node:crypto. Nothing here
+ * holds a private key: every signature comes from a {@link KeyGroupSigner} (see
+ * key-group.ts for why, and for what losing a key costs).
+ *
+ * WHAT THE CHECKS ON EACH RESPONSE ARE FOR. The API relays every byte, so the
+ * documents it returns are only worth what the client checks, and it checks two
+ * things. First, that the enclave signed them — under the signing key of an
+ * enclave the caller attested against its own pinned PCR0. Without that, a relay
+ * could hand the customer a forged enrolment and they would believe themselves
+ * registered when nothing was. The key set at /.well-known/burnledger-keys is not
+ * the anchor for this: the same API serves it, so a relay that forged a document
+ * could publish the forging key beside it. Second, that they are about what the
+ * caller asked for. ADR-025 §2 names the load-bearing comparison: the enrolment
+ * statement must name the key group the customer generated. A relay that enrolled
+ * its own group instead would hand back a genuine, enclave-signed statement
+ * naming a key the customer does not hold; this comparison is where that stops
+ * being invisible. The enrolment and the authorization must also be for the team
+ * the customer named, and the authorization must end exactly at the `not_after`
+ * the customer signed and not start in the future: a relay that replayed an
+ * older genuine answer, or another team's, would otherwise have the caller
+ * believe a fresh window exists. The registration must name this key, this
+ * system, this config digest and this connector, or it registered something
+ * else.
+ */
+import { type CustomerKeyGroup } from "./customer-keys.js";
+import { type EnclaveIdentity, type SealOptions } from "./enclave-seal.js";
+import { type KeyGroupSigner } from "./key-group.js";
+import { type KeyEnrollmentResult, type System, type SystemRegistrationCertificate } from "./models.js";
+type Raw = Record<string, unknown>;
+/** How to check the enclave: the PCR0 you pinned out of band, and optionally
+ * your own challenge (otherwise 32 bytes are drawn from the OS CSPRNG). */
+export interface EnclavePinOptions extends SealOptions {
+    nonce?: Uint8Array;
+}
+/** What `createRegisteredSystem` did, in order. */
+export interface RegisteredSystem {
+    /** The system, created with its config sealed so the API never read it. */
+    readonly system: System;
+    /** The enclave's registration of that system under your key group. */
+    readonly registration: SystemRegistrationCertificate;
+}
+/**
+ * The challenge and the query string that carries it. A nonce the checked party
+ * chose — including one the API suggested — proves nothing about when the
+ * document was produced, so it is drawn here unless the caller brings its own.
+ */
+export declare function attestationParams(nonce?: Uint8Array): {
+    nonce: Uint8Array;
+    params: Record<string, string>;
+};
+/**
+ * Verify the document the API returned against this caller's own challenge. The
+ * `nonce` the API echoes beside the document is ignored: nothing signs it. The
+ * check is against the nonce inside the document, under AWS's signature.
+ */
+export declare function identityFromResponse(data: unknown, options: SealOptions & {
+    nonce: Uint8Array;
+}): Promise<EnclaveIdentity>;
+/**
+ * The ENROLL_KEY request, the key id it enrols and the `not_after` it signs.
+ * EVERY member signs.
+ */
+export declare function enrollBody(opts: {
+    teamId: string;
+    group: CustomerKeyGroup;
+    signers: readonly KeyGroupSigner[];
+    notAfter?: Date;
+}): Promise<{
+    body: Raw;
+    keyId: string;
+    notAfter: string;
+}>;
+/**
+ * The ROTATE_KEY request. Both groups sign the same key_rotation_request.v2: the
+ * OUTGOING group at its threshold, to spend its authority, and EVERY incoming
+ * member, to prove it holds its key.
+ */
+export declare function rotateBody(opts: {
+    teamId: string;
+    previousGroup: CustomerKeyGroup;
+    previousSigners: readonly KeyGroupSigner[];
+    nextGroup: CustomerKeyGroup;
+    nextSigners: readonly KeyGroupSigner[];
+    notAfter?: Date;
+}): Promise<{
+    body: Raw;
+    prevKeyId: string;
+    nextKeyId: string;
+    notAfter: string;
+}>;
+/**
+ * Verify both documents ENROLL_KEY and ROTATE_KEY return under the attested
+ * enclave's signing key, then refuse them unless they name the group this caller
+ * holds and the team it asked for, link to the predecessor it expects, end
+ * exactly at the `notAfter` (whole-second UTC) it signed, and do not start in
+ * the future. `teamId` is the team the request asserted; the SDK always asserts
+ * one, so there is no request this check has no team for.
+ *
+ * The end must be EXACT. A protocol-12 enclave ends the grant at the signed
+ * bound, to the second, so any other end answers some other request -- which is
+ * what a relay replaying an older genuine response, or dropping a renewal,
+ * hands back.
+ */
+export declare function checkEnrollment(data: unknown, opts: {
+    enclave: EnclaveIdentity;
+    keyId: string;
+    prevKeyId: string | undefined;
+    teamId: string;
+    notAfter: string;
+    /** The time to judge `not_before` against. Defaults to this machine's clock. */
+    now?: Date;
+}): Promise<KeyEnrollmentResult>;
+/** The exact bytes sealed, and therefore the bytes `config_digest` is over. */
+export declare function configBytes(config: Record<string, unknown>): Uint8Array;
+/**
+ * The REGISTER_SYSTEM request, its key id and the config digest it signs.
+ *
+ * `config` must be the EXACT bytes submitted when the system was created — the
+ * plaintext that was sealed, or the `connection_config` JSON text as sent. An
+ * object is refused: re-serializing it produces bytes that may differ by one
+ * space from what the enclave decrypts, and the refusal would be a 401 with no
+ * way to see why.
+ */
+export declare function registrationBody(opts: {
+    teamId: string;
+    group: CustomerKeyGroup;
+    signers: readonly KeyGroupSigner[];
+    systemId: string;
+    config: Uint8Array | string;
+    queryTemplate: string;
+    connectorType: string;
+}): Promise<{
+    body: Raw;
+    keyId: string;
+    configDigest: Uint8Array;
+}>;
+/** Verify the registration under the attested enclave's signing key, then
+ * refuse it unless it binds what this caller signed. */
+export declare function checkRegistration(data: unknown, opts: {
+    enclave: EnclaveIdentity;
+    keyId: string;
+    systemId: string;
+    configDigest: Uint8Array;
+    connectorType: string;
+}): Promise<SystemRegistrationCertificate>;
+export {};
+//# sourceMappingURL=enclave-registration.d.ts.map

package/dist/esm/enclave-registration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enclave-registration.d.ts","sourceRoot":"","sources":["../../src/enclave-registration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAIH,OAAO,EASL,KAAK,gBAAgB,EACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,WAAW,EACjB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAGL,KAAK,mBAAmB,EACxB,KAAK,MAAM,EACX,KAAK,6BAA6B,EACnC,MAAM,aAAa,CAAC;AAGrB,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEnC;2EAC2E;AAC3E,MAAM,WAAW,iBAAkB,SAAQ,WAAW;IACpD,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAED,mDAAmD;AACnD,MAAM,WAAW,gBAAgB;IAC/B,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,QAAQ,CAAC,YAAY,EAAE,6BAA6B,CAAC;CACtD;AAyBD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,CAAC,EAAE,UAAU,GAAG;IACrD,KAAK,EAAE,UAAU,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC,CAGA;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,WAAW,GAAG;IAAE,KAAK,EAAE,UAAU,CAAA;CAAE,GAC3C,OAAO,CAAC,eAAe,CAAC,CAM1B;AAYD;;;GAGG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,gBAAgB,CAAC;IACxB,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;IACnC,QAAQ,CAAC,EAAE,IAAI,CAAC;CACjB,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,GAAG,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAmB1D;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,gBAAgB,CAAC;IAChC,eAAe,EAAE,SAAS,cAAc,EAAE,CAAC;IAC3C,SAAS,EAAE,gBAAgB,CAAC;IAC5B,WAAW,EAAE,SAAS,cAAc,EAAE,CAAC;IACvC,QAAQ,CAAC,EAAE,IAAI,CAAC;CACjB,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,GAAG,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAmCjF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,OAAO,EACb,IAAI,EAAE;IACJ,OAAO,EAAE,eAAe,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,gFAAgF;IAChF,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GACA,OAAO,CAAC,mBAAmB,CAAC,CAuD9B;AAID,+EAA+E;AAC/E,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,CAEvE;AAED;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,gBAAgB,CAAC;IACxB,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,UAAU,GAAG,MAAM,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,GAAG,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,UAAU,CAAA;CAAE,CAAC,CA8BlE;AAED;wDACwD;AACxD,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,OAAO,EACb,IAAI,EAAE;IACJ,OAAO,EAAE,eAAe,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,UAAU,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;CACvB,GACA,OAAO,CAAC,6BAA6B,CAAC,CAuBxC"}