core-3nweb-client-lib 0.40.1 → 0.41.0

package/build/lib-common/mid-sigs-NaCl-Ed.js

@@ -1,560 +0,0 @@
-"use strict";
-/*
- Copyright (C) 2015 - 2017, 2025 3NSoft Inc.
- 
- This program is free software: you can redistribute it and/or modify it under
- the terms of the GNU General Public License as published by the Free Software
- Foundation, either version 3 of the License, or (at your option) any later
- version.
- 
- This program is distributed in the hope that it will be useful, but
- WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
- See the GNU General Public License for more details.
- 
- You should have received a copy of the GNU General Public License along with
- this program. If not, see <http://www.gnu.org/licenses/>.
-*/
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.user = exports.relyingParty = exports.idProvider = exports.exceptionType = exports.KEY_USE = void 0;
-exports.makeMalformedCertsException = makeMalformedCertsException;
-/**
- * This library handles signing and verification of signatures, used
- * in MailerId.
- */
-const ecma_nacl_1 = require("ecma-nacl");
-const jwkeys_1 = require("./jwkeys");
-const buffer_utils_1 = require("./buffer-utils");
-/**
- * This enumerates MailerId's different use-roles of keys, involved in
- * establishing a trust.
- */
-exports.KEY_USE = {
-    /**
-     * This is a MailerId trust root.
-     * It signs certificate for itself, and it signs certificates for provider
-     * keys, which have shorter life span, than the root.
-     * Root may revoke itself, and may revoke provider key.
-     */
-    ROOT: "mid-root",
-    /**
-     * This is a provider key, which is used to certify users' signing keys.
-     */
-    PROVIDER: "mid-provider",
-    /**
-     * With this key, MailerId user signs assertions and mail keys.
-     */
-    SIGN: "mid-sign",
-};
-Object.freeze(exports.KEY_USE);
-exports.exceptionType = 'mailerid';
-function makeAlgMismatchException(msg) {
-    return {
-        runtimeException: true,
-        type: 'mailerid',
-        msg,
-        algMismatch: true
-    };
-}
-function makeTimeMismatchException(msg) {
-    return {
-        runtimeException: true,
-        type: 'mailerid',
-        msg,
-        timeMismatch: true
-    };
-}
-function makeCertsMismatchException(msg) {
-    return {
-        runtimeException: true,
-        type: 'mailerid',
-        msg,
-        certsMismatch: true
-    };
-}
-function makeMalformedCertsException(msg, cause) {
-    return {
-        runtimeException: true,
-        type: 'mailerid',
-        msg,
-        certMalformed: true,
-        cause
-    };
-}
-function makeSigVerifException(msg) {
-    return {
-        runtimeException: true,
-        type: 'mailerid',
-        msg,
-        sigVerificationFails: true
-    };
-}
-function genSignKeyPair(use, kidLen, random, arrFactory) {
-    const pair = ecma_nacl_1.signing.generate_keypair(random(32), arrFactory);
-    const pkey = {
-        use: use,
-        alg: ecma_nacl_1.signing.JWK_ALG_NAME,
-        kid: buffer_utils_1.base64.pack(random(kidLen)),
-        k: buffer_utils_1.base64.pack(pair.pkey)
-    };
-    const skey = {
-        use: pkey.use,
-        alg: pkey.alg,
-        kid: pkey.kid,
-        k: pair.skey
-    };
-    return { pkey: pkey, skey: skey };
-}
-function makeCert(pkey, principalAddr, issuer, issuedAt, expiresAt, signKey, arrFactory) {
-    if (signKey.alg !== ecma_nacl_1.signing.JWK_ALG_NAME) {
-        throw makeAlgMismatchException(`Given signing key is used with unknown algorithm ${signKey.alg}`);
-    }
-    const cert = {
-        cert: {
-            publicKey: pkey,
-            principal: { address: principalAddr }
-        },
-        issuer: issuer,
-        issuedAt: issuedAt,
-        expiresAt: expiresAt
-    };
-    const certBytes = buffer_utils_1.utf8.pack(JSON.stringify(cert));
-    const sigBytes = ecma_nacl_1.signing.signature(certBytes, signKey.k, arrFactory);
-    return {
-        alg: signKey.alg,
-        kid: signKey.kid,
-        sig: buffer_utils_1.base64.pack(sigBytes),
-        load: buffer_utils_1.base64.pack(certBytes)
-    };
-}
-var idProvider;
-(function (idProvider) {
-    idProvider.KID_BYTES_LENGTH = 9;
-    idProvider.MAX_USER_CERT_VALIDITY = 24 * 60 * 60;
-    function makeSelfSignedCert(address, validityPeriod, sjkey, arrFactory) {
-        const skey = (0, jwkeys_1.keyFromJson)(sjkey, exports.KEY_USE.ROOT, ecma_nacl_1.signing.JWK_ALG_NAME, ecma_nacl_1.signing.SECRET_KEY_LENGTH);
-        const pkey = {
-            use: sjkey.use,
-            alg: sjkey.alg,
-            kid: sjkey.kid,
-            k: buffer_utils_1.base64.pack(ecma_nacl_1.signing.extract_pkey(skey.k))
-        };
-        const now = Math.floor(Date.now() / 1000);
-        return makeCert(pkey, address, address, now, now + validityPeriod, skey, arrFactory);
-    }
-    idProvider.makeSelfSignedCert = makeSelfSignedCert;
-    /**
-     * One should keep MailerId root key offline, as this key is used only to
-     * sign provider keys, which have to work online.
-     * @param address is an address of an issuer
-     * @param validityPeriod validity period of a generated self-signed
-     * certificate in milliseconds
-     * @param random
-     * @param arrFactory optional array factory
-     * @return Generated root key and a self-signed certificate for respective
-     * public key.
-     */
-    function generateRootKey(address, validityPeriod, random, arrFactory) {
-        if (validityPeriod < 1) {
-            throw new Error(`Illegal validity period: ${validityPeriod}`);
-        }
-        const rootPair = genSignKeyPair(exports.KEY_USE.ROOT, idProvider.KID_BYTES_LENGTH, random, arrFactory);
-        const now = Math.floor(Date.now() / 1000);
-        const rootCert = makeCert(rootPair.pkey, address, address, now, now + validityPeriod, rootPair.skey, arrFactory);
-        return { cert: rootCert, skey: (0, jwkeys_1.keyToJson)(rootPair.skey) };
-    }
-    idProvider.generateRootKey = generateRootKey;
-    /**
-     * @param address is an address of an issuer
-     * @param validityPeriod validity period of a generated self-signed
-     * certificate in seconds
-     * @param rootJKey root key in json format
-     * @param random
-     * @param arrFactory optional array factory
-     * @return Generated provider's key and a certificate for a respective
-     * public key.
-     */
-    function generateProviderKey(address, validityPeriod, rootJKey, random, arrFactory) {
-        if (validityPeriod < 1) {
-            throw new Error(`Illegal validity period: ${validityPeriod}`);
-        }
-        const rootKey = (0, jwkeys_1.keyFromJson)(rootJKey, exports.KEY_USE.ROOT, ecma_nacl_1.signing.JWK_ALG_NAME, ecma_nacl_1.signing.SECRET_KEY_LENGTH);
-        const provPair = genSignKeyPair(exports.KEY_USE.PROVIDER, idProvider.KID_BYTES_LENGTH, random, arrFactory);
-        const now = Math.floor(Date.now() / 1000);
-        const rootCert = makeCert(provPair.pkey, address, address, now, now + validityPeriod, rootKey, arrFactory);
-        return { cert: rootCert, skey: (0, jwkeys_1.keyToJson)(provPair.skey) };
-    }
-    idProvider.generateProviderKey = generateProviderKey;
-    /**
-     * @param issuer is a domain of certificate issuer, at which issuer's public
-     * key can be found to check the signature
-     * @param validityPeriod is a default validity period in seconds, for
-     * which certifier shall be making certificates
-     * @param signJKey is a certificates signing key
-     * @param arrFactory is an optional array factory
-     * @return MailerId certificates generator, which shall be used on identity
-     * provider's side
-     */
-    function makeIdProviderCertifier(issuer, validityPeriod, signJKey, arrFactory) {
-        if (!issuer) {
-            throw new Error(`Given issuer is illegal: ${issuer}`);
-        }
-        if ((validityPeriod < 1) || (validityPeriod > idProvider.MAX_USER_CERT_VALIDITY)) {
-            throw new Error(`Given certificate validity is illegal: ${validityPeriod}`);
-        }
-        let signKey = (0, jwkeys_1.keyFromJson)(signJKey, exports.KEY_USE.PROVIDER, ecma_nacl_1.signing.JWK_ALG_NAME, ecma_nacl_1.signing.SECRET_KEY_LENGTH);
-        signJKey = undefined;
-        if (!arrFactory) {
-            arrFactory = ecma_nacl_1.arrays.makeFactory();
-        }
-        return {
-            certify: (publicKey, address, validFor) => {
-                if (!signKey) {
-                    throw new Error(`Certifier is already destroyed.`);
-                }
-                if (publicKey.use !== exports.KEY_USE.SIGN) {
-                    throw new Error(`Given public key has use ${publicKey.use} and cannot be used for signing.`);
-                }
-                if ('number' === typeof validFor) {
-                    if (validFor > validityPeriod) {
-                        validFor = validityPeriod;
-                    }
-                    else if (validFor < 0) {
-                        new Error(`Given certificate validity is illegal: ${validFor}`);
-                    }
-                }
-                else {
-                    validFor = validityPeriod;
-                }
-                const now = Math.floor(Date.now() / 1000);
-                return makeCert(publicKey, address, issuer, now, now + validFor, signKey, arrFactory);
-            },
-            destroy: () => {
-                if (!signKey) {
-                    return;
-                }
-                ecma_nacl_1.arrays.wipe(signKey.k);
-                signKey = undefined;
-                arrFactory.wipeRecycled();
-                arrFactory = undefined;
-            }
-        };
-    }
-    idProvider.makeIdProviderCertifier = makeIdProviderCertifier;
-})(idProvider || (exports.idProvider = idProvider = {}));
-Object.freeze(idProvider);
-var relyingParty;
-(function (relyingParty) {
-    const minValidityPeriodForCert = 20 * 60;
-    function verifyCertAndGetPubKey(signedCert, use, validAt, arrFactory, issuer, issuerPKey) {
-        const cert = (0, jwkeys_1.getKeyCert)(signedCert);
-        if ((validAt < (cert.issuedAt - minValidityPeriodForCert))
-            || (cert.expiresAt <= validAt)) {
-            throw makeTimeMismatchException(`Certificate is not valid at a given moment ${validAt}, cause it is issued at ${cert.issuedAt}, and expires at ${cert.expiresAt}`);
-        }
-        if (issuer) {
-            if (!issuerPKey) {
-                throw new Error(`No issuer key given.`);
-            }
-            if ((cert.issuer !== issuer) ||
-                (signedCert.kid !== issuerPKey.kid)) {
-                throw makeCertsMismatchException(`Certificate is not signed by issuer key.`);
-            }
-        }
-        let pkey;
-        let sig;
-        let load;
-        try {
-            pkey = (0, jwkeys_1.keyFromJson)(cert.cert.publicKey, use, ecma_nacl_1.signing.JWK_ALG_NAME, ecma_nacl_1.signing.PUBLIC_KEY_LENGTH);
-            sig = buffer_utils_1.base64.open(signedCert.sig);
-            load = buffer_utils_1.base64.open(signedCert.load);
-        }
-        catch (err) {
-            throw makeMalformedCertsException(`Cannot read certificate`, err);
-        }
-        const pk = (issuer ? issuerPKey.k : pkey.k);
-        const certOK = ecma_nacl_1.signing.verify(sig, load, pk, arrFactory);
-        if (!certOK) {
-            throw makeSigVerifException(`Certificate ${use} failed validation.`);
-        }
-        return { pkey: pkey, address: cert.cert.principal.address };
-    }
-    /**
-     * @param certs is a chain of certificate to be verified.
-     * @param rootAddr is MailerId service's domain.
-     * @param validAt is an epoch time moment (in second), at which user
-     * certificate must be valid. Provider certificate must be valid at
-     * creation of user's certificate. Root certificate must be valid at
-     * creation of provider's certificate.
-     * @return user's MailerId signing key with user's address.
-     */
-    function verifyChainAndGetUserKey(certs, rootAddr, validAt, arrFactory) {
-        // root certificate must be valid when provider's certificate was issued
-        let rootValidityMoment;
-        try {
-            rootValidityMoment = (0, jwkeys_1.getKeyCert)(certs.prov).issuedAt;
-        }
-        catch (err) {
-            throw makeMalformedCertsException(`Provider's certificate is malformed`, err);
-        }
-        // check root and get the key
-        const root = verifyCertAndGetPubKey(certs.root, exports.KEY_USE.ROOT, rootValidityMoment, arrFactory);
-        if (rootAddr !== root.address) {
-            throw makeCertsMismatchException(`Root certificate address ${root.address} doesn't match expected address ${rootAddr}`);
-        }
-        // provider's certificate must be valid when user's certificate was issued
-        let provValidityMoment;
-        try {
-            provValidityMoment = (0, jwkeys_1.getKeyCert)(certs.user).issuedAt;
-        }
-        catch (err) {
-            throw makeMalformedCertsException(`User's certificate is malformed`, err);
-        }
-        // check provider and get the key
-        const provider = verifyCertAndGetPubKey(certs.prov, exports.KEY_USE.PROVIDER, provValidityMoment, arrFactory, root.address, root.pkey);
-        // check that provider cert comes from the same issuer as root
-        if (root.address !== provider.address) {
-            throw makeCertsMismatchException(`Provider's certificate address ${provider.address} doesn't match expected address ${root.address}.`);
-        }
-        // check user certificate and get the key
-        return verifyCertAndGetPubKey(certs.user, exports.KEY_USE.SIGN, validAt, arrFactory, provider.address, provider.pkey);
-    }
-    relyingParty.verifyChainAndGetUserKey = verifyChainAndGetUserKey;
-    function verifyAssertion(midAssertion, certChain, rootAddr, validAt, arrFactory) {
-        const userInfo = verifyChainAndGetUserKey(certChain, rootAddr, validAt, arrFactory);
-        let loadBytes;
-        let sigBytes;
-        let assertion;
-        try {
-            loadBytes = buffer_utils_1.base64.open(midAssertion.load);
-            sigBytes = buffer_utils_1.base64.open(midAssertion.sig);
-            assertion = JSON.parse(buffer_utils_1.utf8.open(loadBytes));
-        }
-        catch (err) {
-            throw makeMalformedCertsException(`Cannot read assertion`, err);
-        }
-        if (!ecma_nacl_1.signing.verify(sigBytes, loadBytes, userInfo.pkey.k, arrFactory)) {
-            throw makeSigVerifException(`Assertion fails verification.`);
-        }
-        if (assertion.user !== userInfo.address) {
-            throw makeMalformedCertsException(`Assertion is for one user, while chain is for another.`);
-        }
-        if (!assertion.sessionId) {
-            throw makeMalformedCertsException(`Assertion doesn't have session id.`);
-        }
-        // Note that assertion can be valid before issue time, to counter
-        // some mis-synchronization of clocks.
-        // It can be some fixed value, like minimum validity period of certs.
-        if (Math.abs(validAt - assertion.issuedAt) >
-            (assertion.expiresAt - assertion.issuedAt)) {
-            throw makeTimeMismatchException(`Assertion is not valid at ${validAt}, being issued at ${assertion.expiresAt} and expiring at ${assertion.expiresAt}.`);
-        }
-        return {
-            sessionId: assertion.sessionId,
-            relyingPartyDomain: assertion.rpDomain,
-            user: userInfo.address
-        };
-    }
-    relyingParty.verifyAssertion = verifyAssertion;
-    /**
-     * This function does verification of a single certificate with known
-     * signing key.
-     * If your task requires verification starting with principal's MailerId,
-     * use verifyPubKey function that also accepts and checks MailerId
-     * certificates chain.
-     * @param keyCert is a certificate that should be checked
-     * @param principalAddress is an expected principal's address in a given
-     * certificate. Exception is thrown, if certificate does not match this
-     * expectation.
-     * @param signingKey is a public key, with which given certificate is
-     * validated cryptographically. Exception is thrown, if crypto-verification
-     * fails.
-     * @param validAt is an epoch time moment (in second), for which verification
-     * should be done.
-     * @param arrFactory is an optional array factory.
-     * @return a key from a given certificate.
-     */
-    function verifyKeyCert(keyCert, principalAddress, signingKey, validAt, arrFactory) {
-        let sigBytes;
-        let loadBytes;
-        try {
-            sigBytes = buffer_utils_1.base64.open(keyCert.sig);
-            loadBytes = buffer_utils_1.base64.open(keyCert.load);
-        }
-        catch (err) {
-            throw makeMalformedCertsException(`Cannot read certificate`, err);
-        }
-        if (!ecma_nacl_1.signing.verify(sigBytes, loadBytes, signingKey.k, arrFactory)) {
-            throw makeSigVerifException(`Key certificate fails verification.`);
-        }
-        let cert;
-        try {
-            cert = (0, jwkeys_1.getKeyCert)(keyCert);
-        }
-        catch (err) {
-            throw makeMalformedCertsException(`Cannot read certificate`, err);
-        }
-        if (cert.cert.principal.address !== principalAddress) {
-            throw makeCertsMismatchException(`Key certificate is for user ${cert.cert.principal.address}, while expected address is ${principalAddress}`);
-        }
-        if ((cert.expiresAt - cert.issuedAt) <= minValidityPeriodForCert) {
-            if (Math.abs(cert.issuedAt - validAt) > minValidityPeriodForCert) {
-                throw makeTimeMismatchException(`Certificate is not valid at ${validAt} being issued at ${cert.issuedAt} and applying minimum validity period window of ${minValidityPeriodForCert} seconds`);
-            }
-        }
-        else {
-            if ((validAt < (cert.issuedAt - minValidityPeriodForCert))
-                || (cert.expiresAt <= validAt)) {
-                throw makeTimeMismatchException(`Certificate is not valid at ${validAt} being issued at ${cert.issuedAt} and expiring at ${cert.expiresAt}`);
-            }
-        }
-        return cert.cert.publicKey;
-    }
-    relyingParty.verifyKeyCert = verifyKeyCert;
-    /**
-     * @param pubKeyCert certificate with a public key, that needs to be
-     * verified.
-     * @param principalAddress is an expected principal's address in both key
-     * certificate, and in MailerId certificate chain. Exception is thrown,
-     * if certificate does not match this expectation.
-     * @param certChain is MailerId certificate chain for named principal.
-     * @param rootAddr is MailerId root's domain.
-     * @param validAt is an epoch time moment (in second), for which key
-     * certificate verification should be done.
-     * @param arrFactory is an optional array factory.
-     * @return a key from a given certificate.
-     */
-    function verifyPubKey(pubKeyCert, principalAddress, certChain, rootAddr, validAt, arrFactory) {
-        // time moment, for which user's certificate chain must be valid
-        let chainValidityMoment;
-        try {
-            chainValidityMoment = (0, jwkeys_1.getKeyCert)(pubKeyCert).issuedAt;
-        }
-        catch (err) {
-            throw makeMalformedCertsException(`Cannot read certificate`, err);
-        }
-        const principalInfo = verifyChainAndGetUserKey(certChain, rootAddr, chainValidityMoment, arrFactory);
-        if (principalInfo.address !== principalAddress) {
-            throw makeCertsMismatchException(`MailerId certificate chain is for user ${principalInfo.address}, while expected address is ${principalAddress}`);
-        }
-        return verifyKeyCert(pubKeyCert, principalAddress, principalInfo.pkey, validAt, arrFactory);
-    }
-    relyingParty.verifyPubKey = verifyPubKey;
-})(relyingParty || (exports.relyingParty = relyingParty = {}));
-Object.freeze(relyingParty);
-function correlateSKeyWithItsCert(skey, cert) {
-    const pkey = (0, jwkeys_1.keyFromJson)(cert.cert.publicKey, skey.use, ecma_nacl_1.signing.JWK_ALG_NAME, ecma_nacl_1.signing.PUBLIC_KEY_LENGTH);
-    if (!((pkey.kid === skey.kid)
-        && (pkey.use === skey.use)
-        && (pkey.alg === skey.alg)
-        && (0, ecma_nacl_1.compareVectors)(ecma_nacl_1.signing.extract_pkey(skey.k), pkey.k))) {
-        throw new Error("Key does not correspond to certificate.");
-    }
-}
-var user;
-(function (user) {
-    user.KID_BYTES_LENGTH = 9;
-    user.MAX_SIG_VALIDITY = 30 * 60;
-    function generateSigningKeyPair(random, arrFactory) {
-        return genSignKeyPair(exports.KEY_USE.SIGN, user.KID_BYTES_LENGTH, random, arrFactory);
-    }
-    user.generateSigningKeyPair = generateSigningKeyPair;
-    /**
-     * @param signKey which will be used to sign assertions/keys. Note that
-     * this key shall be wiped, when signer is destroyed, as key is neither
-     * long-living, nor should be shared.
-     * @param cert is user's certificate, signed by identity provider.
-     * @param provCert is provider's certificate, signed by respective mid root.
-     * @param assertionValidity is an assertion validity period in seconds
-     * @param arrFactory is an optional array factory
-     * @return signer for user of MailerId to generate assertions, and to sign
-     * keys.
-     */
-    function makeMailerIdSigner(signKey, userCert, provCert, assertionValidity = user.MAX_SIG_VALIDITY, arrFactory) {
-        const certificate = (0, jwkeys_1.getKeyCert)(userCert);
-        if (signKey.use !== exports.KEY_USE.SIGN) {
-            throw new Error(`Given key ${signKey.kid} has incorrect use: ${signKey.use}`);
-        }
-        correlateSKeyWithItsCert(signKey, certificate);
-        if (('number' !== typeof assertionValidity) || (assertionValidity < 1) ||
-            (assertionValidity > user.MAX_SIG_VALIDITY)) {
-            throw new Error(`Given assertion validity is illegal: ${assertionValidity}`);
-        }
-        if (!arrFactory) {
-            arrFactory = ecma_nacl_1.arrays.makeFactory();
-        }
-        const signer = {
-            address: certificate.cert.principal.address,
-            userCert: userCert,
-            providerCert: provCert,
-            issuer: certificate.issuer,
-            certExpiresAt: certificate.expiresAt,
-            validityPeriod: assertionValidity,
-            generateAssertionFor: (rpDomain, sessionId, validFor) => {
-                if (!signKey) {
-                    throw new Error("Signer is already destroyed.");
-                }
-                if ('number' === typeof validFor) {
-                    if (validFor > assertionValidity) {
-                        validFor = assertionValidity;
-                    }
-                    else if (validFor < 0) {
-                        new Error(`Given certificate validity is illegal: ${validFor}`);
-                    }
-                }
-                else {
-                    validFor = assertionValidity;
-                }
-                let now = Math.floor(Date.now() / 1000);
-                if (now <= certificate.issuedAt) {
-                    now = certificate.issuedAt + 1;
-                }
-                if (now >= certificate.expiresAt) {
-                    throw new Error(`Signing key has already expiried at ${certificate.expiresAt} and now is ${now}`);
-                }
-                const assertion = {
-                    rpDomain: rpDomain,
-                    sessionId: sessionId,
-                    user: certificate.cert.principal.address,
-                    issuedAt: now,
-                    expiresAt: now + validFor
-                };
-                const assertionBytes = buffer_utils_1.utf8.pack(JSON.stringify(assertion));
-                const sigBytes = ecma_nacl_1.signing.signature(assertionBytes, signKey.k, arrFactory);
-                return {
-                    alg: signKey.alg,
-                    kid: signKey.kid,
-                    sig: buffer_utils_1.base64.pack(sigBytes),
-                    load: buffer_utils_1.base64.pack(assertionBytes)
-                };
-            },
-            certifyPublicKey: (pkey, validFor) => {
-                if (!signKey) {
-                    throw new Error("Signer is already destroyed.");
-                }
-                if (validFor < 0) {
-                    new Error(`Given certificate validity is illegal: ${validFor}`);
-                }
-                const now = Math.floor(Date.now() / 1000);
-                if (now >= certificate.expiresAt) {
-                    throw new Error(`Signing key has already expiried at ${certificate.expiresAt} and now is ${now}`);
-                }
-                return makeCert(pkey, certificate.cert.principal.address, certificate.cert.principal.address, now, now + validFor, signKey, arrFactory);
-            },
-            destroy: () => {
-                if (!signKey) {
-                    return;
-                }
-                ecma_nacl_1.arrays.wipe(signKey.k);
-                signKey = undefined;
-                arrFactory.wipeRecycled();
-                arrFactory = undefined;
-            }
-        };
-        Object.freeze(signer);
-        return signer;
-    }
-    user.makeMailerIdSigner = makeMailerIdSigner;
-})(user || (exports.user = user = {}));
-Object.freeze(user);
-Object.freeze(exports);