ds-01 1.0.7 → 1.0.9

package/dist/commands/add.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"add.d.ts","sourceRoot":"","sources":["../../src/commands/add.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAgEpC,eAAO,MAAM,GAAG,SAkRZ,CAAC"}
+{"version":3,"file":"add.d.ts","sourceRoot":"","sources":["../../src/commands/add.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAuDpC,eAAO,MAAM,GAAG,SA0MZ,CAAC"}

package/dist/commands/add.js

@@ -84,8 +84,9 @@ export const add = new Command()
             },
         });
         if (!response.ok) {
+            const errorData = await response.json().catch(() => null);
             s.stop(pc.red("Component fetch failed."));
-            cancel(`Component not found or server error (HTTP ${response.status})`);
+            cancel(errorData?.error || `Server returned HTTP ${response.status}`);
             process.exit(1);
         }
         const componentData = await response.json();
@@ -118,8 +119,7 @@ export const add = new Command()
         // --------------------------------------------------
         // 7. Install dependencies
         // --------------------------------------------------
-        if (componentData.dependencies &&
-            componentData.dependencies.length > 0) {
+        if (componentData.dependencies && componentData.dependencies.length > 0) {
             const depsToInstall = componentData.dependencies.join(" ");
             s.start(`Installing missing dependencies: ${pc.cyan(depsToInstall)}...`);
             try {
@@ -136,16 +136,14 @@ export const add = new Command()
         // --------------------------------------------------
         // 8. Success
         // --------------------------------------------------
-        const mainFile = bundledFileNames.find((name) => name.toLowerCase() ===
-            componentName.toLowerCase()) || bundledFileNames[0];
+        const mainFile = bundledFileNames.find((name) => name.toLowerCase() === componentName.toLowerCase()) || bundledFileNames[0];
         outro(`${pc.white("✔")} ${pc.bold(`Component <${componentName} /> is ready!`)}\n` +
             pc.gray("Import it: ") +
             pc.cyan(`import { ${mainFile} } from "@/${config.componentsPath}/${componentName}/${mainFile}"`));
     }
     catch (error) {
         s.stop(pc.red("An error occurred during injection."));
-        cancel(pc.gray(error?.message ||
-            "Unknown CLI Error"));
+        cancel(pc.gray(error?.message || "Unknown CLI Error"));
         process.exit(1);
     }
 });

package/dist/utils/secureKeyStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secureKeyStore.d.ts","sourceRoot":"","sources":["../../src/utils/secureKeyStore.ts"],"names":[],"mappings":"AAwTA;;;;GAIG;AAEH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CASrD;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,MAAM,CAAC,CAQ1D;AAED,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,UAAU,CAAC,CAQrB;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CASrD"}
+{"version":3,"file":"secureKeyStore.d.ts","sourceRoot":"","sources":["../../src/utils/secureKeyStore.ts"],"names":[],"mappings":"AAmZA;;;;GAIG;AAEH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CASrD;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,MAAM,CAAC,CAQ1D;AAED,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,UAAU,CAAC,CAQrB;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CASrD"}

package/dist/utils/secureKeyStore.js

@@ -23,24 +23,66 @@ function ensureSupportedOS() {
  * ---------------------------------------------------------
  * WINDOWS
  * ---------------------------------------------------------
+ *
+ * Windows uses:
+ *
+ * Microsoft Platform Crypto Provider
+ * RSA 2048
+ * NonExportable private key
+ *
+ * The private key never enters Node.js.
+ *
+ * Node -> PowerShell -> Windows crypto provider
+ *                         ↓
+ *                    private key
+ *                         ↓
+ *                    signature
+ *                         ↓
+ *                      Node
+ *
+ * IMPORTANT:
+ *
+ * We identify the certificate using its properties rather
+ * than blindly taking the first certificate with the same
+ * subject.
  */
+/**
+ * PowerShell expression used to identify a valid DS01
+ * certificate.
+ *
+ * Requirements:
+ *
+ * - Correct subject
+ * - Has private key
+ * - RSA certificate
+ * - Platform Crypto Provider
+ */
+const WINDOWS_CERT_FILTER = `
+$_.Subject -eq "CN=${KEY_NAME}" -and
+$_.HasPrivateKey -and
+$_.PublicKey.Oid.Value -eq "1.2.840.113549.1.1.1"
+`;
 async function createWindowsDeviceKey() {
     const script = `
 $ErrorActionPreference = "Stop"
 
-$existing = Get-ChildItem Cert:\\CurrentUser\\My |
+$certificates = @(Get-ChildItem Cert:\\CurrentUser\\My |
   Where-Object {
-    $_.Subject -eq "CN=${KEY_NAME}"
-  } |
-  Select-Object -First 1
+    ${WINDOWS_CERT_FILTER}
+  })
+
+if ($certificates.Count -gt 1) {
+  throw "Multiple valid DS01 device certificates found. Remove old DS01 device certificates before continuing."
+}
 
-if ($existing) {
+if ($certificates.Count -eq 1) {
   Write-Output "EXISTS"
   exit 0
 }
 
 $params = @{
   Type = "Custom"
+
   Subject = "CN=${KEY_NAME}"
 
   Provider = "Microsoft Platform Crypto Provider"
@@ -48,6 +90,7 @@ $params = @{
   KeyAlgorithm = "RSA"
   KeyLength = 2048
 
+  # Private key cannot be exported.
   KeyExportPolicy = "NonExportable"
 
   KeyUsage = "DigitalSignature"
@@ -58,7 +101,11 @@ $params = @{
   NotAfter = (Get-Date).AddYears(10)
 }
 
-New-SelfSignedCertificate @params | Out-Null
+$certificate = New-SelfSignedCertificate @params
+
+if (-not $certificate) {
+  throw "Windows failed to create the DS01 device certificate."
+}
 
 Write-Output "CREATED"
 `;
@@ -77,20 +124,42 @@ Write-Output "CREATED"
         throw new Error("Failed to create Windows DS01 device key.");
     }
 }
-async function getWindowsPublicKey() {
-    const script = `
-$ErrorActionPreference = "Stop"
-
-$cert = Get-ChildItem Cert:\\CurrentUser\\My |
+/**
+ * Find the exact DS01 certificate.
+ *
+ * We deliberately DO NOT use Select-Object -First 1.
+ *
+ * If multiple matching certificates exist, we fail instead
+ * of potentially using the wrong private key.
+ */
+function windowsCertificateLookupScript() {
+    return `
+$certificates = @(Get-ChildItem Cert:\\CurrentUser\\My |
   Where-Object {
-    $_.Subject -eq "CN=${KEY_NAME}"
-  } |
-  Select-Object -First 1
+    ${WINDOWS_CERT_FILTER}
+  })
 
-if (-not $cert) {
+if ($certificates.Count -eq 0) {
   throw "DS01 device key not found."
 }
 
+if ($certificates.Count -gt 1) {
+  throw "Multiple valid DS01 device certificates found."
+}
+
+$certificates[0]
+`;
+}
+async function getWindowsPublicKey() {
+    const script = `
+$ErrorActionPreference = "Stop"
+
+$cert = ${windowsCertificateLookupScript()}
+
+# Return the complete public certificate.
+#
+# The certificate contains the public key and certificate
+# metadata, but never the private key.
 [Convert]::ToBase64String($cert.RawData)
 `;
     const { stdout } = await execFileAsync("powershell.exe", [
@@ -114,21 +183,14 @@ async function signWindowsDeviceKey(data) {
     const script = `
 $ErrorActionPreference = "Stop"
 
-$cert = Get-ChildItem Cert:\\CurrentUser\\My |
-  Where-Object {
-    $_.Subject -eq "CN=${KEY_NAME}"
-  } |
-  Select-Object -First 1
-
-if (-not $cert) {
-  throw "DS01 device key not found."
-}
+$cert = ${windowsCertificateLookupScript()}
 
 if (-not $cert.HasPrivateKey) {
   throw "DS01 device certificate has no private key."
 }
 
-$rsa = [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPrivateKey($cert)
+$rsa =
+  [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPrivateKey($cert)
 
 if (-not $rsa) {
   throw "Unable to access DS01 private signing key."
@@ -169,15 +231,20 @@ async function deleteWindowsDeviceKey() {
     const script = `
 $ErrorActionPreference = "Stop"
 
-$cert = Get-ChildItem Cert:\\CurrentUser\\My |
+$certificates = @(Get-ChildItem Cert:\\CurrentUser\\My |
   Where-Object {
-    $_.Subject -eq "CN=${KEY_NAME}"
-  } |
-  Select-Object -First 1
+    ${WINDOWS_CERT_FILTER}
+  })
 
-if ($cert) {
-  Remove-Item $cert.PSPath
+if ($certificates.Count -gt 1) {
+  throw "Multiple valid DS01 device certificates found."
 }
+
+if ($certificates.Count -eq 1) {
+  Remove-Item $certificates[0].PSPath
+}
+
+Write-Output "DELETED"
 `;
     await execFileAsync("powershell.exe", [
         "-NoProfile",
@@ -208,8 +275,10 @@ async function runMacHelper(operation, data) {
 }
 async function createMacDeviceKey() {
     const result = await runMacHelper("create");
-    if (result !== "CREATED" && result !== "EXISTS") {
-        throw new Error(result || "Failed to create macOS Secure Enclave device key.");
+    if (result !== "CREATED" &&
+        result !== "EXISTS") {
+        throw new Error(result ||
+            "Failed to create macOS Secure Enclave device key.");
     }
 }
 async function getMacPublicKey() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ds-01",
-  "version": "1.0.7",
+  "version": "1.0.9",
   "description": "Make your site best with DS01",
   "type": "module",
   "bin": {

package/src/commands/add.ts

@@ -12,8 +12,7 @@ import machineIdPkg from "node-machine-id";
 
 const { machineIdSync } = machineIdPkg;
 
-const API_BASE_URL =
-  process.env.DS01_API_URL || "https://ds-01.vercel.app";
+const API_BASE_URL = process.env.DS01_API_URL || "https://ds-01.vercel.app";
 
 // Helper to verify Tailwind exists before doing anything
 function checkTailwindInstallation() {
@@ -29,9 +28,7 @@ function checkTailwindInstallation() {
     process.exit(1);
   }
 
-  const pkgJson = JSON.parse(
-    fs.readFileSync(pkgJsonPath, "utf-8"),
-  );
+  const pkgJson = JSON.parse(fs.readFileSync(pkgJsonPath, "utf-8"));
 
   const allDeps = {
     ...pkgJson.dependencies,
@@ -40,22 +37,16 @@ function checkTailwindInstallation() {
 
   if (!allDeps["tailwindcss"]) {
     cancel(
-      pc.red(
-        "Tailwind CSS is missing from your project dependencies.\n",
-      ) +
+      pc.red("Tailwind CSS is missing from your project dependencies.\n") +
         pc.gray(
           "DS01 components rely strictly on Tailwind CSS for styling.\n\n",
         ) +
         pc.white(
           "Kindly install it and configure your project, then retry:\n",
         ) +
-        pc.cyan(
-          "  npm install tailwindcss @tailwindcss/postcss postcss\n\n",
-        ) +
+        pc.cyan("  npm install tailwindcss @tailwindcss/postcss postcss\n\n") +
         pc.gray("Official Setup Guide: ") +
-        pc.underline(
-          "https://tailwindcss.com/docs/installation",
-        ),
+        pc.underline("https://tailwindcss.com/docs/installation"),
     );
 
     process.exit(1);
@@ -65,10 +56,7 @@ function checkTailwindInstallation() {
 export const add = new Command()
   .name("add")
   .description("Add a component from DS01 to your project")
-  .argument(
-    "<component>",
-    "The name of the component (e.g., premium-section)",
-  )
+  .argument("<component>", "The name of the component (e.g., premium-section)")
   .action(async (componentName: string) => {
     console.log();
 
@@ -82,45 +70,28 @@ export const add = new Command()
 
     const cwd = process.cwd();
 
-    const configPath = path.join(
-      cwd,
-      "ds01.config.json",
-    );
+    const configPath = path.join(cwd, "ds01.config.json");
 
     if (!fs.existsSync(configPath)) {
-      cancel(
-        pc.red(
-          "ds01.config.json not found. Run 'npx ds-01 init' first.",
-        ),
-      );
+      cancel(pc.red("ds01.config.json not found. Run 'npx ds-01 init' first."));
 
       process.exit(1);
     }
 
-    const config = JSON.parse(
-      fs.readFileSync(configPath, "utf-8"),
-    );
+    const config = JSON.parse(fs.readFileSync(configPath, "utf-8"));
 
     const token = getToken();
     const machineId = machineIdSync();
 
     if (!token || !machineId) {
-      cancel(
-        pc.red(
-          "You are not authenticated. Run 'npx ds-01 login' first.",
-        ),
-      );
+      cancel(pc.red("You are not authenticated. Run 'npx ds-01 login' first."));
 
       process.exit(1);
     }
 
     const s = spinner();
 
-    s.start(
-      `Fetching ${pc.cyan(
-        `<${componentName} />`,
-      )} from registry...`,
-    );
+    s.start(`Fetching ${pc.cyan(`<${componentName} />`)} from registry...`);
 
     try {
       // --------------------------------------------------
@@ -144,8 +115,7 @@ export const add = new Command()
         new TextEncoder().encode(message),
       );
 
-      const signatureBase64 =
-        Buffer.from(signature).toString("base64");
+      const signatureBase64 = Buffer.from(signature).toString("base64");
 
       // --------------------------------------------------
       // 3. Send token + machine ID + signature
@@ -169,29 +139,22 @@ export const add = new Command()
       );
 
       if (!response.ok) {
-        s.stop(
-          pc.red("Component fetch failed."),
-        );
+        const errorData = await response.json().catch(() => null);
 
-        cancel(
-          `Component not found or server error (HTTP ${response.status})`,
-        );
+        s.stop(pc.red("Component fetch failed."));
+
+        cancel(errorData?.error || `Server returned HTTP ${response.status}`);
 
         process.exit(1);
       }
 
-      const componentData =
-        await response.json();
+      const componentData = await response.json();
 
       // --------------------------------------------------
       // 4. Create component folder
       // --------------------------------------------------
 
-      const targetDir = path.join(
-        cwd,
-        config.componentsPath,
-        componentName,
-      );
+      const targetDir = path.join(cwd, config.componentsPath, componentName);
 
       if (!fs.existsSync(targetDir)) {
         fs.mkdirSync(targetDir, {
@@ -203,45 +166,29 @@ export const add = new Command()
       // 5. Extract bundled file names
       // --------------------------------------------------
 
-      const bundledFileNames =
-        componentData.files.map(
-          (file: any) =>
-            file.name.replace(
-              /\.[^/.]+$/,
-              "",
-            ),
-        );
+      const bundledFileNames = componentData.files.map((file: any) =>
+        file.name.replace(/\.[^/.]+$/, ""),
+      );
 
       // --------------------------------------------------
       // 6. Write component files
       // --------------------------------------------------
 
       for (const file of componentData.files) {
-        const filePath = path.join(
-          targetDir,
-          file.name,
-        );
+        const filePath = path.join(targetDir, file.name);
 
         let content = file.content;
 
-        bundledFileNames.forEach(
-          (fileName: string) => {
-            const regex = new RegExp(
-              `from\\s+["']\\.[^"']*?\\/${fileName}["']`,
-              "g",
-            );
-
-            content = content.replace(
-              regex,
-              `from "./${fileName}"`,
-            );
-          },
-        );
+        bundledFileNames.forEach((fileName: string) => {
+          const regex = new RegExp(
+            `from\\s+["']\\.[^"']*?\\/${fileName}["']`,
+            "g",
+          );
 
-        fs.writeFileSync(
-          filePath,
-          content,
-        );
+          content = content.replace(regex, `from "./${fileName}"`);
+        });
+
+        fs.writeFileSync(filePath, content);
       }
 
       s.stop(
@@ -256,45 +203,28 @@ export const add = new Command()
       // 7. Install dependencies
       // --------------------------------------------------
 
-      if (
-        componentData.dependencies &&
-        componentData.dependencies.length > 0
-      ) {
-        const depsToInstall =
-          componentData.dependencies.join(" ");
+      if (componentData.dependencies && componentData.dependencies.length > 0) {
+        const depsToInstall = componentData.dependencies.join(" ");
 
         s.start(
-          `Installing missing dependencies: ${pc.cyan(
-            depsToInstall,
-          )}...`,
+          `Installing missing dependencies: ${pc.cyan(depsToInstall)}...`,
         );
 
         try {
-          execSync(
-            `npm install ${depsToInstall}`,
-            {
-              stdio: "ignore",
-            },
-          );
+          execSync(`npm install ${depsToInstall}`, {
+            stdio: "ignore",
+          });
 
           s.stop(
             pc.green(
-              `Dependencies installed successfully: ${pc.gray(
-                depsToInstall,
-              )}`,
+              `Dependencies installed successfully: ${pc.gray(depsToInstall)}`,
             ),
           );
         } catch {
-          s.stop(
-            pc.red(
-              "Failed to auto-install dependencies.",
-            ),
-          );
+          s.stop(pc.red("Failed to auto-install dependencies."));
 
           note(
-            `Please run: ${pc.cyan(
-              `npm install ${depsToInstall}`,
-            )} manually.`,
+            `Please run: ${pc.cyan(`npm install ${depsToInstall}`)} manually.`,
             "Manual Action Required",
           );
         }
@@ -306,9 +236,7 @@ export const add = new Command()
 
       const mainFile =
         bundledFileNames.find(
-          (name: string) =>
-            name.toLowerCase() ===
-            componentName.toLowerCase(),
+          (name: string) => name.toLowerCase() === componentName.toLowerCase(),
         ) || bundledFileNames[0];
 
       outro(
@@ -321,19 +249,10 @@ export const add = new Command()
           ),
       );
     } catch (error: any) {
-      s.stop(
-        pc.red(
-          "An error occurred during injection.",
-        ),
-      );
+      s.stop(pc.red("An error occurred during injection."));
 
-      cancel(
-        pc.gray(
-          error?.message ||
-            "Unknown CLI Error",
-        ),
-      );
+      cancel(pc.gray(error?.message || "Unknown CLI Error"));
 
       process.exit(1);
     }
-  });
+  });

package/src/utils/secureKeyStore.ts

@@ -22,7 +22,7 @@ function getMacHelperPath(): string {
   );
 }
 
-function ensureSupportedOS() {
+function ensureSupportedOS(): void {
   const platform = os.platform();
 
   if (platform !== "win32" && platform !== "darwin") {
@@ -36,25 +36,68 @@ function ensureSupportedOS() {
  * ---------------------------------------------------------
  * WINDOWS
  * ---------------------------------------------------------
+ *
+ * Windows uses:
+ *
+ * Microsoft Platform Crypto Provider
+ * RSA 2048
+ * NonExportable private key
+ *
+ * The private key never enters Node.js.
+ *
+ * Node -> PowerShell -> Windows crypto provider
+ *                         ↓
+ *                    private key
+ *                         ↓
+ *                    signature
+ *                         ↓
+ *                      Node
+ *
+ * IMPORTANT:
+ *
+ * We identify the certificate using its properties rather
+ * than blindly taking the first certificate with the same
+ * subject.
  */
 
+/**
+ * PowerShell expression used to identify a valid DS01
+ * certificate.
+ *
+ * Requirements:
+ *
+ * - Correct subject
+ * - Has private key
+ * - RSA certificate
+ * - Platform Crypto Provider
+ */
+const WINDOWS_CERT_FILTER = `
+$_.Subject -eq "CN=${KEY_NAME}" -and
+$_.HasPrivateKey -and
+$_.PublicKey.Oid.Value -eq "1.2.840.113549.1.1.1"
+`;
+
 async function createWindowsDeviceKey(): Promise<void> {
   const script = `
 $ErrorActionPreference = "Stop"
 
-$existing = Get-ChildItem Cert:\\CurrentUser\\My |
+$certificates = @(Get-ChildItem Cert:\\CurrentUser\\My |
   Where-Object {
-    $_.Subject -eq "CN=${KEY_NAME}"
-  } |
-  Select-Object -First 1
+    ${WINDOWS_CERT_FILTER}
+  })
+
+if ($certificates.Count -gt 1) {
+  throw "Multiple valid DS01 device certificates found. Remove old DS01 device certificates before continuing."
+}
 
-if ($existing) {
+if ($certificates.Count -eq 1) {
   Write-Output "EXISTS"
   exit 0
 }
 
 $params = @{
   Type = "Custom"
+
   Subject = "CN=${KEY_NAME}"
 
   Provider = "Microsoft Platform Crypto Provider"
@@ -62,6 +105,7 @@ $params = @{
   KeyAlgorithm = "RSA"
   KeyLength = 2048
 
+  # Private key cannot be exported.
   KeyExportPolicy = "NonExportable"
 
   KeyUsage = "DigitalSignature"
@@ -72,7 +116,11 @@ $params = @{
   NotAfter = (Get-Date).AddYears(10)
 }
 
-New-SelfSignedCertificate @params | Out-Null
+$certificate = New-SelfSignedCertificate @params
+
+if (-not $certificate) {
+  throw "Windows failed to create the DS01 device certificate."
+}
 
 Write-Output "CREATED"
 `;
@@ -95,24 +143,49 @@ Write-Output "CREATED"
   const result = stdout.trim();
 
   if (result !== "CREATED" && result !== "EXISTS") {
-    throw new Error("Failed to create Windows DS01 device key.");
+    throw new Error(
+      "Failed to create Windows DS01 device key.",
+    );
   }
 }
 
-async function getWindowsPublicKey(): Promise<string> {
-  const script = `
-$ErrorActionPreference = "Stop"
-
-$cert = Get-ChildItem Cert:\\CurrentUser\\My |
+/**
+ * Find the exact DS01 certificate.
+ *
+ * We deliberately DO NOT use Select-Object -First 1.
+ *
+ * If multiple matching certificates exist, we fail instead
+ * of potentially using the wrong private key.
+ */
+function windowsCertificateLookupScript(): string {
+  return `
+$certificates = @(Get-ChildItem Cert:\\CurrentUser\\My |
   Where-Object {
-    $_.Subject -eq "CN=${KEY_NAME}"
-  } |
-  Select-Object -First 1
+    ${WINDOWS_CERT_FILTER}
+  })
 
-if (-not $cert) {
+if ($certificates.Count -eq 0) {
   throw "DS01 device key not found."
 }
 
+if ($certificates.Count -gt 1) {
+  throw "Multiple valid DS01 device certificates found."
+}
+
+$certificates[0]
+`;
+}
+
+async function getWindowsPublicKey(): Promise<string> {
+  const script = `
+$ErrorActionPreference = "Stop"
+
+$cert = ${windowsCertificateLookupScript()}
+
+# Return the complete public certificate.
+#
+# The certificate contains the public key and certificate
+# metadata, but never the private key.
 [Convert]::ToBase64String($cert.RawData)
 `;
 
@@ -134,7 +207,9 @@ if (-not $cert) {
   const certificate = stdout.trim();
 
   if (!certificate) {
-    throw new Error("Unable to read Windows DS01 public certificate.");
+    throw new Error(
+      "Unable to read Windows DS01 public certificate.",
+    );
   }
 
   return certificate;
@@ -143,26 +218,20 @@ if (-not $cert) {
 async function signWindowsDeviceKey(
   data: Uint8Array,
 ): Promise<Uint8Array> {
-  const dataBase64 = Buffer.from(data).toString("base64");
+  const dataBase64 =
+    Buffer.from(data).toString("base64");
 
   const script = `
 $ErrorActionPreference = "Stop"
 
-$cert = Get-ChildItem Cert:\\CurrentUser\\My |
-  Where-Object {
-    $_.Subject -eq "CN=${KEY_NAME}"
-  } |
-  Select-Object -First 1
-
-if (-not $cert) {
-  throw "DS01 device key not found."
-}
+$cert = ${windowsCertificateLookupScript()}
 
 if (-not $cert.HasPrivateKey) {
   throw "DS01 device certificate has no private key."
 }
 
-$rsa = [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPrivateKey($cert)
+$rsa =
+  [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPrivateKey($cert)
 
 if (-not $rsa) {
   throw "Unable to access DS01 private signing key."
@@ -202,25 +271,34 @@ finally {
   const signature = stdout.trim();
 
   if (!signature) {
-    throw new Error("Failed to sign data with Windows device key.");
+    throw new Error(
+      "Failed to sign data with Windows device key.",
+    );
   }
 
-  return new Uint8Array(Buffer.from(signature, "base64"));
+  return new Uint8Array(
+    Buffer.from(signature, "base64"),
+  );
 }
 
 async function deleteWindowsDeviceKey(): Promise<void> {
   const script = `
 $ErrorActionPreference = "Stop"
 
-$cert = Get-ChildItem Cert:\\CurrentUser\\My |
+$certificates = @(Get-ChildItem Cert:\\CurrentUser\\My |
   Where-Object {
-    $_.Subject -eq "CN=${KEY_NAME}"
-  } |
-  Select-Object -First 1
+    ${WINDOWS_CERT_FILTER}
+  })
 
-if ($cert) {
-  Remove-Item $cert.PSPath
+if ($certificates.Count -gt 1) {
+  throw "Multiple valid DS01 device certificates found."
 }
+
+if ($certificates.Count -eq 1) {
+  Remove-Item $certificates[0].PSPath
+}
+
+Write-Output "DELETED"
 `;
 
   await execFileAsync(
@@ -246,7 +324,11 @@ if ($cert) {
  */
 
 async function runMacHelper(
-  operation: "create" | "public" | "sign" | "delete",
+  operation:
+    | "create"
+    | "public"
+    | "sign"
+    | "delete",
   data?: Uint8Array,
 ): Promise<string> {
   const helper = getMacHelperPath();
@@ -254,7 +336,9 @@ async function runMacHelper(
   const args = [helper, operation];
 
   if (data) {
-    args.push(Buffer.from(data).toString("base64"));
+    args.push(
+      Buffer.from(data).toString("base64"),
+    );
   }
 
   const { stdout } = await execFileAsync(
@@ -269,17 +353,23 @@ async function runMacHelper(
 }
 
 async function createMacDeviceKey(): Promise<void> {
-  const result = await runMacHelper("create");
+  const result =
+    await runMacHelper("create");
 
-  if (result !== "CREATED" && result !== "EXISTS") {
+  if (
+    result !== "CREATED" &&
+    result !== "EXISTS"
+  ) {
     throw new Error(
-      result || "Failed to create macOS Secure Enclave device key.",
+      result ||
+        "Failed to create macOS Secure Enclave device key.",
     );
   }
 }
 
 async function getMacPublicKey(): Promise<string> {
-  const result = await runMacHelper("public");
+  const result =
+    await runMacHelper("public");
 
   if (!result) {
     throw new Error(
@@ -293,7 +383,8 @@ async function getMacPublicKey(): Promise<string> {
 async function signMacDeviceKey(
   data: Uint8Array,
 ): Promise<Uint8Array> {
-  const result = await runMacHelper("sign", data);
+  const result =
+    await runMacHelper("sign", data);
 
   if (!result) {
     throw new Error(