feature/jwks validator

.gitignore

@@ -21,6 +21,7 @@ logs
 **/*.tgz
 *.zip
 *.tgz
+.npmrc
 
 smoke/package.json
 smoke/pnpm-lock.yaml

README.md

@@ -202,7 +202,7 @@ pnpm run test -t 'test name pattern' path/to/test/file
 For example, to run a specific test for the CRDT module, in just one project:
 
 ```bash
-FP_DEBUG=Loader pnpm run test --project file -t 'codec implict iv' crdt
+FP_DEBUG='Loader,CRDTClock' pnpm run test --project file -t 'codec implict iv' crdt
 ```
 
 For testing React components, you can use:

cli/package.json

@@ -39,7 +39,7 @@
     "url": "https://github.com/fireproof-storage/fireproof/issues"
   },
   "dependencies": {
-    "@adviser/cement": "^0.4.25",
+    "@adviser/cement": "^0.4.26",
     "@fireproof/core-runtime": "workspace:0.0.0",
     "@fireproof/core-types-base": "workspace:0.0.0",
     "@fireproof/vendor": "workspace:0.0.0",

cloud/3rd-party/package.json

@@ -39,7 +39,7 @@
     "url": "https://github.com/fireproof-storage/fireproof/issues"
   },
   "dependencies": {
-    "@adviser/cement": "^0.4.25",
+    "@adviser/cement": "^0.4.26",
     "react-dom": "^19.1.1",
     "use-fireproof": "workspace:0.0.0"
   },

cloud/backend/base/package.json

@@ -36,7 +36,7 @@
     "url": "https://github.com/fireproof-storage/fireproof/issues"
   },
   "dependencies": {
-    "@adviser/cement": "^0.4.25",
+    "@adviser/cement": "^0.4.26",
     "@cloudflare/workers-types": "^4.20250810.0",
     "@fireproof/cloud-base": "workspace:0.0.0",
     "@fireproof/core-base": "workspace:0.0.0",

cloud/backend/base/test-helper.ts

@@ -240,7 +240,7 @@ export async function mockJWK(sthis: SuperThis, claim: Partial<TokenForParam> =
     token: keys.strings.privateKey,
   });
 
-  const id = claim.id ?? sthis.nextId().str;
+  const id = claim.jti ?? sthis.nextId().str;
   const claims: ps.TokenForParam = {
     userId: `hello-${id}`,
     email: `hello-${id}@test.de`,

cloud/backend/cf-d1/package.json

@@ -39,7 +39,7 @@
     "url": "https://github.com/fireproof-storage/fireproof/issues"
   },
   "dependencies": {
-    "@adviser/cement": "^0.4.25",
+    "@adviser/cement": "^0.4.26",
     "@cloudflare/workers-types": "^4.20250810.0",
     "@fireproof/cloud-backend-base": "workspace:0.0.0",
     "@fireproof/cloud-base": "workspace:0.0.0",

cloud/backend/node/package.json

@@ -36,7 +36,7 @@
     "url": "https://github.com/fireproof-storage/fireproof/issues"
   },
   "dependencies": {
-    "@adviser/cement": "^0.4.25",
+    "@adviser/cement": "^0.4.26",
     "@fireproof/cloud-backend-base": "workspace:0.0.0",
     "@fireproof/cloud-base": "workspace:0.0.0",
     "@fireproof/core-base": "workspace:0.0.0",

cloud/base/package.json

@@ -38,7 +38,7 @@
     "react": ">=18.0.0"
   },
   "dependencies": {
-    "@adviser/cement": "^0.4.25",
+    "@adviser/cement": "^0.4.26",
     "@fireproof/core-blockstore": "workspace:0.0.0",
     "@fireproof/core-runtime": "workspace:0.0.0",
     "@fireproof/core-types-base": "workspace:0.0.0",

cloud/todo-app/package.json

@@ -41,7 +41,7 @@
     "react": ">=18.0.0"
   },
   "dependencies": {
-    "@adviser/cement": "^0.4.25",
+    "@adviser/cement": "^0.4.26",
     "@fireproof/vendor": "workspace:0.0.0",
     "@types/react": "^19.1.8",
     "react-dom": "^19.1.0",

core/base/crdt-clock.ts

@@ -26,7 +26,7 @@ export class CRDTClockImpl {
 
   readonly zoomers = new Map<string, VoidFn>();
   readonly watchers = new Map<string, (updates: DocUpdate<DocTypes>[]) => void>();
-  readonly emptyWatchers = new Map<string, VoidFn>();
+  readonly noPayloadWatchers = new Map<string, VoidFn>();
 
   readonly blockstore: BaseBlockstore; // ready blockstore
 
@@ -46,7 +46,10 @@ export class CRDTClockImpl {
   constructor(blockstore: BaseBlockstore) {
     this.sthis = blockstore.sthis;
     this.blockstore = blockstore;
-    this.logger = ensureLogger(blockstore.sthis, "CRDTClock");
+    this.logger = ensureLogger(blockstore.sthis, `CRDTClock`)
+      .With()
+      .Str("dbName", blockstore.crdtParent?.ledgerParent?.name || "unnamed")
+      .Logger();
     this.applyHeadQueue = applyHeadQueue(this.int_applyHead.bind(this), this.logger);
   }
 
@@ -80,7 +83,15 @@ export class CRDTClockImpl {
     if (!updates.length) {
       return;
     }
-    this.emptyWatchers.forEach((fn) => fn());
+    this.logger
+      .Debug()
+      .Int("updatesCount", updates.length)
+      .Int("watchersCount", this.watchers.size)
+      .Int("noPayloadWatchersCount", this.noPayloadWatchers.size)
+      .Msg("NOTIFY_WATCHERS: Triggering subscriptions");
+    // Always notify both types of watchers - subscription systems need notifications
+    // regardless of whether there are document updates
+    this.noPayloadWatchers.forEach((fn) => fn());
     this.watchers.forEach((fn) => fn(updates || []));
   }
 
@@ -94,9 +105,9 @@ export class CRDTClockImpl {
 
   onTock(fn: VoidFn): UnReg {
     const key = this.sthis.timeOrderedNextId().str;
-    this.emptyWatchers.set(key, fn);
+    this.noPayloadWatchers.set(key, fn);
     return () => {
-      this.emptyWatchers.delete(key);
+      this.noPayloadWatchers.delete(key);
     };
   }
 
@@ -114,7 +125,18 @@ export class CRDTClockImpl {
     // }
 
     const noLoader = !localUpdates;
-
+    const needsManualNotification = !localUpdates && (this.watchers.size > 0 || this.noPayloadWatchers.size > 0);
+
+    this.logger
+      .Debug()
+      .Bool("localUpdates", localUpdates)
+      .Int("watchersCount", this.watchers.size)
+      .Int("noPayloadWatchersCount", this.noPayloadWatchers.size)
+      .Bool("needsManualNotification", needsManualNotification)
+      .Int("headLength", newHead.length)
+      .Int("prevHeadLength", prevHead.length)
+      .Int("currentHeadLength", this.head.length)
+      .Msg("INT_APPLY_HEAD: Entry point");
     // console.log("int_applyHead", this.applyHeadQueue.size(), this.head, newHead, prevHead, localUpdates);
     const ogHead = sortClockHead(this.head);
     newHead = sortClockHead(newHead);
@@ -156,6 +178,31 @@ export class CRDTClockImpl {
       this.transaction = undefined;
     }
     this.setHead(advancedHead);
+
+    if (needsManualNotification) {
+      const changes = await clockChangesSince<DocTypes>(this.blockstore, advancedHead, prevHead, {}, this.logger);
+      const triggerReason =
+        this.watchers.size > 0 && this.noPayloadWatchers.size > 0
+          ? "both"
+          : this.watchers.size > 0
+            ? "watchers"
+            : "noPayloadWatchers";
+      this.logger
+        .Debug()
+        .Int("changesCount", changes.result.length)
+        .Str("triggerReason", triggerReason)
+        .Int("watchersCount", this.watchers.size)
+        .Int("noPayloadWatchersCount", this.noPayloadWatchers.size)
+        .Msg("MANUAL_NOTIFICATION: Checking for changes");
+      if (changes.result.length > 0) {
+        this.logger.Debug().Msg("MANUAL_NOTIFICATION: Calling notifyWatchers with changes");
+        this.notifyWatchers(changes.result);
+        this.noPayloadWatchers.forEach((fn) => fn());
+      } else {
+        this.logger.Debug().Msg("MANUAL_NOTIFICATION: Calling noPayloadWatchers directly");
+        this.noPayloadWatchers.forEach((fn) => fn());
+      }
+    }
   }
 }
 

core/base/crdt.ts

@@ -106,6 +106,14 @@ export class CRDTImpl implements CRDT {
         const crdtMeta = meta as CRDTMeta;
         if (!crdtMeta.head) throw this.logger.Error().Msg("missing head").AsError();
         // console.log("applyMeta-pre", crdtMeta.head, this.clock.head);
+        this.logger
+          .Debug()
+          .Str("newHead", crdtMeta.head.map((h) => h.toString()).join(","))
+          .Int("subscribers", this.clock.watchers.size + this.clock.noPayloadWatchers.size)
+          .Int("headLength", crdtMeta.head.length)
+          .Int("currentHeadLength", this.clock.head.length)
+          .Str("dbName", this.opts.name || "unnamed")
+          .Msg("APPLY_META: Calling applyHead for REMOTE sync");
         await this.clock.applyHead(crdtMeta.head, []);
         // console.log("applyMeta-post", crdtMeta.head, this.clock.head);
       },
@@ -184,6 +192,15 @@ export class CRDTImpl implements CRDT {
       });
       return { head };
     });
+    this.logger
+      .Debug()
+      .Str("newHead", done.meta.head.map((h) => h.toString()).join(","))
+      .Int("subscribers", this.clock.watchers.size + this.clock.noPayloadWatchers.size)
+      .Int("headLength", done.meta.head.length)
+      .Int("prevHeadLength", prevHead.length)
+      .Int("currentHeadLength", this.clock.head.length)
+      .Str("dbName", this.opts.name || "unnamed")
+      .Msg("BULK: Calling applyHead for LOCAL write");
     await this.clock.applyHead(done.meta.head, prevHead, updates);
     return done.meta;
   }

core/base/package.json

@@ -36,7 +36,7 @@
     "url": "https://github.com/fireproof-storage/fireproof/issues"
   },
   "dependencies": {
-    "@adviser/cement": "^0.4.25",
+    "@adviser/cement": "^0.4.26",
     "@fireproof/core-blockstore": "workspace:0.0.0",
     "@fireproof/core-keybag": "workspace:0.0.0",
     "@fireproof/core-runtime": "workspace:0.0.0",

core/blockstore/package.json

@@ -36,7 +36,7 @@
     "url": "https://github.com/fireproof-storage/fireproof/issues"
   },
   "dependencies": {
-    "@adviser/cement": "^0.4.25",
+    "@adviser/cement": "^0.4.26",
     "@fireproof/core-gateways-base": "workspace:0.0.0",
     "@fireproof/core-gateways-cloud": "workspace:0.0.0",
     "@fireproof/core-gateways-file": "workspace:0.0.0",

core/core/package.json

@@ -39,7 +39,7 @@
     "react": ">=18.0.0"
   },
   "dependencies": {
-    "@adviser/cement": "^0.4.25",
+    "@adviser/cement": "^0.4.26",
     "@fireproof/core-base": "workspace:0.0.0",
     "@fireproof/core-types-base": "workspace:0.0.0",
     "@fireproof/vendor": "workspace:0.0.0",

core/device-id/certor.ts

@@ -0,0 +1,63 @@
+import { toSortedObject } from "@adviser/cement/utils";
+import { Base64EndeCoder } from "@fireproof/core-types-base";
+import { decodeJwt } from "jose";
+import { base58btc } from "multiformats/bases/base58";
+import { sha1 } from "multiformats/hashes/sha1";
+import { sha256 } from "multiformats/hashes/sha2";
+import { CertificatePayload, CertificatePayloadSchema } from "@fireproof/core-types-base/fp-ca-cert-payload.zod.js";
+
+export class Certor {
+  readonly #cert: CertificatePayload;
+  readonly base64: Base64EndeCoder;
+  #strCert?: string;
+  #uint8Cert?: Uint8Array;
+
+  static fromString(base64: Base64EndeCoder, cert: string) {
+    const certObj = CertificatePayloadSchema.parse(JSON.parse(base64.decode(cert)));
+    return new Certor(base64, certObj);
+  }
+
+  static fromJWT(base64: Base64EndeCoder, jwtString: string) {
+    // const header = decodeProtectedHeader(jwtString);
+    const payload = decodeJwt(jwtString);
+    const certObj = CertificatePayloadSchema.parse(payload);
+    return new Certor(base64, certObj);
+  }
+
+  constructor(base64: Base64EndeCoder, cert: CertificatePayload) {
+    this.#cert = cert;
+    this.base64 = base64;
+  }
+
+  asCert(): CertificatePayload {
+    return this.#cert;
+  }
+
+  parseCertificateSubject(s: string): Record<string, string> {
+    const parts: Record<string, string> = {};
+    s.split(",").forEach((part) => {
+      const [key, value] = part.trim().split("=");
+      if (key && value) {
+        parts[key] = value;
+      }
+    });
+    return parts;
+  }
+
+  async asSHA1() {
+    this.#uint8Cert ||= this.base64.decodeUint8(this.asBase64());
+    const val = await sha1.digest(this.#uint8Cert);
+    return base58btc.encode(val.bytes);
+  }
+
+  async asSHA256() {
+    this.#uint8Cert ||= this.base64.decodeUint8(this.asBase64());
+    const val = await sha256.digest(this.#uint8Cert);
+    return base58btc.encode(val.bytes);
+  }
+
+  asBase64() {
+    this.#strCert ||= this.base64.encode(JSON.stringify(toSortedObject(this.#cert)));
+    return this.#strCert;
+  }
+}