1id 0.8.0 → 0.9.0

package/README.md

@@ -7,7 +7,7 @@ Hardware-anchored identity SDK for AI agents — [1id.com](https://1id.com)
 
 ## What is 1id.com?
 
-An identity registrar for AI agents. Like a passport office, but for software.
+An identity registrar for AI agents. Like a birth certificate registry, but for software.
 
 - **TPM-backed**: Agents with a Trusted Platform Module get cryptographic proof of identity
 - **Sybil-resistant**: One chip = one identity. No farming.

package/dist/attestation.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Protocol-agnostic attestation primitive for the 1id.com Node.js SDK.
+ *
+ * Two modes of operation:
+ *
+ * 1. **Email attestation (RFC-compliant)**:
+ *    ```ts
+ *    const proof = await prepareAttestation({
+ *      emailHeaders: { From: "agent@mailpal.com", To: "bob@example.com",
+ *                      Subject: "Hello", Date: "...", "Message-ID": "<abc@mailpal.com>" },
+ *      body: Buffer.from("Message body"),
+ *    });
+ *    ```
+ *    The nonce is computed per draft-drake-email-hardware-attestation-00
+ *    Section 5.3 using DKIM relaxed header canonicalization and a
+ *    header+body+timestamp binding.
+ *
+ * 2. **Simple content attestation**:
+ *    ```ts
+ *    const proof = await prepareAttestation({ content: Buffer.from("raw bytes") });
+ *    ```
+ *    The nonce is base64url(SHA-256(content)). Suitable for non-email protocols.
+ *
+ * RFC: draft-drake-email-hardware-attestation-00 Section 5.
+ * Nonce algorithm: Section 5.3 (message-binding via issuer-signed nonce).
+ */
+export interface AttestationProof {
+    sd_jwt: string | null;
+    sd_jwt_disclosures: Record<string, string>;
+    contact_token: string | null;
+    contact_address: string | null;
+    tpm_signature_b64: string | null;
+    content_digest: string | null;
+}
+export interface PrepareAttestationOptions {
+    content?: Buffer;
+    contentDigest?: string;
+    emailHeaders?: Record<string, string>;
+    body?: Buffer;
+    disclosedClaims?: string[];
+    includeContactToken?: boolean;
+    includeSdJwt?: boolean;
+    apiBaseUrl?: string;
+}
+export declare function canonicalise_header_value_using_dkim_relaxed(raw_value: string): string;
+export declare function canonicalise_header_name_using_dkim_relaxed(raw_name: string): string;
+export declare function canonicalise_headers_for_message_binding(email_headers: Record<string, string>, hardware_trust_proof_header_value_placeholder?: string): Buffer;
+export declare function canonicalise_body_using_dkim_simple(body_bytes: Buffer): Buffer;
+export declare function compute_rfc_message_binding_nonce(email_headers: Record<string, string>, body_bytes: Buffer, proposed_iat_unix_timestamp: number): string;
+export interface DirectAttestationProof {
+    hardware_attestation_header_value: string;
+    content_digest: string;
+}
+export declare function canonicalise_headers_for_direct_attestation(email_headers: Record<string, string>, hardware_attestation_header_value_without_chain?: string): Buffer;
+export declare function compute_attestation_digest_for_direct_mode(email_headers: Record<string, string>, body_bytes: Buffer, attestation_timestamp_unix: number, hardware_attestation_header_value_without_chain?: string): Buffer;
+export declare function build_cms_signed_data_for_direct_attestation(signature_bytes: Buffer, certificate_chain_pem: string, signature_algorithm_rfc_name: string): Buffer;
+export declare function prepare_direct_hardware_attestation(email_headers: Record<string, string>, body: Buffer, agent_identity_urn?: string): Promise<DirectAttestationProof>;
+export declare function prepareAttestation(options?: PrepareAttestationOptions): Promise<AttestationProof>;
+//# sourceMappingURL=attestation.d.ts.map

package/dist/attestation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestation.d.ts","sourceRoot":"","sources":["../src/attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAaH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,4CAA4C,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAKtF;AAED,wBAAgB,2CAA2C,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEpF;AAED,wBAAgB,wCAAwC,CACtD,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACrC,6CAA6C,GAAE,MAAW,GACzD,MAAM,CAoCR;AAED,wBAAgB,mCAAmC,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAU9E;AAED,wBAAgB,iCAAiC,CAC/C,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACrC,UAAU,EAAE,MAAM,EAClB,2BAA2B,EAAE,MAAM,GAClC,MAAM,CAcR;AAUD,MAAM,WAAW,sBAAsB;IACrC,iCAAiC,EAAE,MAAM,CAAC;IAC1C,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,2CAA2C,CACzD,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACrC,+CAA+C,GAAE,MAAW,GAC3D,MAAM,CAoCR;AAED,wBAAgB,0CAA0C,CACxD,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACrC,UAAU,EAAE,MAAM,EAClB,0BAA0B,EAAE,MAAM,EAClC,+CAA+C,GAAE,MAAW,GAC3D,MAAM,CAcR;AAkHD,wBAAgB,4CAA4C,CAC1D,eAAe,EAAE,MAAM,EACvB,qBAAqB,EAAE,MAAM,EAC7B,4BAA4B,EAAE,MAAM,GACnC,MAAM,CAgDR;AAED,wBAAsB,mCAAmC,CACvD,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACrC,IAAI,EAAE,MAAM,EACZ,kBAAkB,CAAC,EAAE,MAAM,GAC1B,OAAO,CAAC,sBAAsB,CAAC,CAoGjC;AAED,wBAAsB,kBAAkB,CACtC,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,gBAAgB,CAAC,CA8F3B"}

package/dist/attestation.js

@@ -0,0 +1,489 @@
+/**
+ * Protocol-agnostic attestation primitive for the 1id.com Node.js SDK.
+ *
+ * Two modes of operation:
+ *
+ * 1. **Email attestation (RFC-compliant)**:
+ *    ```ts
+ *    const proof = await prepareAttestation({
+ *      emailHeaders: { From: "agent@mailpal.com", To: "bob@example.com",
+ *                      Subject: "Hello", Date: "...", "Message-ID": "<abc@mailpal.com>" },
+ *      body: Buffer.from("Message body"),
+ *    });
+ *    ```
+ *    The nonce is computed per draft-drake-email-hardware-attestation-00
+ *    Section 5.3 using DKIM relaxed header canonicalization and a
+ *    header+body+timestamp binding.
+ *
+ * 2. **Simple content attestation**:
+ *    ```ts
+ *    const proof = await prepareAttestation({ content: Buffer.from("raw bytes") });
+ *    ```
+ *    The nonce is base64url(SHA-256(content)). Suitable for non-email protocols.
+ *
+ * RFC: draft-drake-email-hardware-attestation-00 Section 5.
+ * Nonce algorithm: Section 5.3 (message-binding via issuer-signed nonce).
+ */
+import { createHash } from "crypto";
+import { get_token } from "./auth.js";
+import { load_credentials } from "./credentials.js";
+import { AuthenticationError, NotEnrolledError } from "./exceptions.js";
+const _HTTP_TIMEOUT_MILLISECONDS = 15_000;
+const _MINIMUM_HEADERS_FOR_RFC_MESSAGE_BINDING = [
+    "from", "to", "subject", "date", "message-id",
+];
+export function canonicalise_header_value_using_dkim_relaxed(raw_value) {
+    let unfolded = raw_value.replace(/\r\n[ ]/g, " ").replace(/\r\n\t/g, " ");
+    unfolded = unfolded.replace(/\n[ ]/g, " ").replace(/\n\t/g, " ");
+    const compressed = unfolded.replace(/[ \t]+/g, " ");
+    return compressed.trim();
+}
+export function canonicalise_header_name_using_dkim_relaxed(raw_name) {
+    return raw_name.trim().toLowerCase();
+}
+export function canonicalise_headers_for_message_binding(email_headers, hardware_trust_proof_header_value_placeholder = "") {
+    const lowered_headers = {};
+    for (const [k, v] of Object.entries(email_headers)) {
+        lowered_headers[k.trim().toLowerCase()] = v;
+    }
+    for (const required_header_name of _MINIMUM_HEADERS_FOR_RFC_MESSAGE_BINDING) {
+        if (!(required_header_name in lowered_headers)) {
+            throw new Error(`Missing required email header '${required_header_name}' for RFC message-binding nonce. ` +
+                `Required headers: ${_MINIMUM_HEADERS_FOR_RFC_MESSAGE_BINDING.join(", ")}`);
+        }
+    }
+    const canonicalised_header_lines = [];
+    for (const required_header_name of _MINIMUM_HEADERS_FOR_RFC_MESSAGE_BINDING) {
+        const canon_name = canonicalise_header_name_using_dkim_relaxed(required_header_name);
+        const canon_value = canonicalise_header_value_using_dkim_relaxed(lowered_headers[required_header_name]);
+        canonicalised_header_lines.push(`${canon_name}:${canon_value}\r\n`);
+    }
+    for (const extra_header_name of Object.keys(lowered_headers).sort()) {
+        if (_MINIMUM_HEADERS_FOR_RFC_MESSAGE_BINDING.includes(extra_header_name)) {
+            continue;
+        }
+        if (extra_header_name === "hardware-trust-proof") {
+            continue;
+        }
+        const canon_name = canonicalise_header_name_using_dkim_relaxed(extra_header_name);
+        const canon_value = canonicalise_header_value_using_dkim_relaxed(lowered_headers[extra_header_name]);
+        canonicalised_header_lines.push(`${canon_name}:${canon_value}\r\n`);
+    }
+    canonicalised_header_lines.push(`hardware-trust-proof:${hardware_trust_proof_header_value_placeholder}`);
+    return Buffer.from(canonicalised_header_lines.join(""), "utf-8");
+}
+export function canonicalise_body_using_dkim_simple(body_bytes) {
+    if (body_bytes.length === 0) {
+        return Buffer.from("\r\n");
+    }
+    let result = body_bytes;
+    while (result.length >= 4 && result.subarray(-4).equals(Buffer.from("\r\n\r\n"))) {
+        result = result.subarray(0, -2);
+    }
+    if (!result.subarray(-2).equals(Buffer.from("\r\n"))) {
+        result = Buffer.concat([result, Buffer.from("\r\n")]);
+    }
+    return result;
+}
+export function compute_rfc_message_binding_nonce(email_headers, body_bytes, proposed_iat_unix_timestamp) {
+    const canonicalised_header_bytes = canonicalise_headers_for_message_binding(email_headers);
+    const h_hash = createHash("sha256").update(canonicalised_header_bytes).digest();
+    const canonicalised_body = canonicalise_body_using_dkim_simple(body_bytes);
+    const bh_raw = createHash("sha256").update(canonicalised_body).digest();
+    const ts_bytes = Buffer.alloc(8);
+    ts_bytes.writeBigUInt64BE(BigInt(proposed_iat_unix_timestamp));
+    const message_binding = Buffer.concat([h_hash, bh_raw, ts_bytes]);
+    const nonce_raw = createHash("sha256").update(message_binding).digest();
+    return nonce_raw.toString("base64url");
+}
+const _TRUST_TIER_TO_RFC_TYP_PARAMETER = {
+    "sovereign": "TPM",
+    "portable": "PIV",
+    "enclave": "ENC",
+    "virtual": "VRT",
+    "declared": "SFT",
+};
+export function canonicalise_headers_for_direct_attestation(email_headers, hardware_attestation_header_value_without_chain = "") {
+    const lowered_headers = {};
+    for (const [k, v] of Object.entries(email_headers)) {
+        lowered_headers[k.trim().toLowerCase()] = v;
+    }
+    for (const required_header_name of _MINIMUM_HEADERS_FOR_RFC_MESSAGE_BINDING) {
+        if (!(required_header_name in lowered_headers)) {
+            throw new Error(`Missing required email header '${required_header_name}' for Mode 1 attestation. ` +
+                `Required headers: ${_MINIMUM_HEADERS_FOR_RFC_MESSAGE_BINDING.join(", ")}`);
+        }
+    }
+    const canonicalised_header_lines = [];
+    for (const required_header_name of _MINIMUM_HEADERS_FOR_RFC_MESSAGE_BINDING) {
+        const canon_name = canonicalise_header_name_using_dkim_relaxed(required_header_name);
+        const canon_value = canonicalise_header_value_using_dkim_relaxed(lowered_headers[required_header_name]);
+        canonicalised_header_lines.push(`${canon_name}:${canon_value}\r\n`);
+    }
+    for (const extra_header_name of Object.keys(lowered_headers).sort()) {
+        if (_MINIMUM_HEADERS_FOR_RFC_MESSAGE_BINDING.includes(extra_header_name)) {
+            continue;
+        }
+        if (extra_header_name === "hardware-attestation" || extra_header_name === "hardware-trust-proof") {
+            continue;
+        }
+        const canon_name = canonicalise_header_name_using_dkim_relaxed(extra_header_name);
+        const canon_value = canonicalise_header_value_using_dkim_relaxed(lowered_headers[extra_header_name]);
+        canonicalised_header_lines.push(`${canon_name}:${canon_value}\r\n`);
+    }
+    canonicalised_header_lines.push(`hardware-attestation:${hardware_attestation_header_value_without_chain}`);
+    return Buffer.from(canonicalised_header_lines.join(""), "utf-8");
+}
+export function compute_attestation_digest_for_direct_mode(email_headers, body_bytes, attestation_timestamp_unix, hardware_attestation_header_value_without_chain = "") {
+    const canonicalised_header_bytes = canonicalise_headers_for_direct_attestation(email_headers, hardware_attestation_header_value_without_chain);
+    const h_hash = createHash("sha256").update(canonicalised_header_bytes).digest();
+    const canonicalised_body = canonicalise_body_using_dkim_simple(body_bytes);
+    const bh_raw = createHash("sha256").update(canonicalised_body).digest();
+    const ts_bytes = Buffer.alloc(8);
+    ts_bytes.writeBigUInt64BE(BigInt(attestation_timestamp_unix));
+    const attestation_input = Buffer.concat([h_hash, bh_raw, ts_bytes]);
+    return createHash("sha256").update(attestation_input).digest();
+}
+function der_encode_length(length_value) {
+    if (length_value < 0x80) {
+        return Buffer.from([length_value]);
+    }
+    if (length_value < 0x100) {
+        return Buffer.from([0x81, length_value]);
+    }
+    if (length_value < 0x10000) {
+        return Buffer.from([0x82, (length_value >> 8) & 0xFF, length_value & 0xFF]);
+    }
+    return Buffer.from([0x83, (length_value >> 16) & 0xFF, (length_value >> 8) & 0xFF, length_value & 0xFF]);
+}
+function der_encode_tlv(tag_byte, content_bytes) {
+    return Buffer.concat([Buffer.from([tag_byte]), der_encode_length(content_bytes.length), content_bytes]);
+}
+function der_encode_integer(integer_value) {
+    if (integer_value === 0n) {
+        return der_encode_tlv(0x02, Buffer.from([0x00]));
+    }
+    const hex = integer_value.toString(16);
+    const padded_hex = hex.length % 2 ? "0" + hex : hex;
+    let byte_buffer = Buffer.from(padded_hex, "hex");
+    if (byte_buffer[0] >= 0x80) {
+        byte_buffer = Buffer.concat([Buffer.from([0x00]), byte_buffer]);
+    }
+    return der_encode_tlv(0x02, byte_buffer);
+}
+function der_encode_oid(oid_dotted_string) {
+    const components = oid_dotted_string.split(".").map(Number);
+    const encoded_body = [40 * components[0] + components[1]];
+    for (let i = 2; i < components.length; i++) {
+        const component = components[i];
+        if (component < 0x80) {
+            encoded_body.push(component);
+        }
+        else {
+            const base128_digits = [];
+            let remaining = component;
+            while (remaining > 0) {
+                base128_digits.push(remaining & 0x7F);
+                remaining >>= 7;
+            }
+            base128_digits.reverse();
+            for (let j = 0; j < base128_digits.length; j++) {
+                encoded_body.push(j < base128_digits.length - 1 ? base128_digits[j] | 0x80 : base128_digits[j]);
+            }
+        }
+    }
+    return der_encode_tlv(0x06, Buffer.from(encoded_body));
+}
+const _OID_SIGNED_DATA = "1.2.840.113549.1.7.2";
+const _OID_DATA = "1.2.840.113549.1.7.1";
+const _OID_SHA256 = "2.16.840.1.101.3.4.2.1";
+const _OID_SHA256_WITH_RSA = "1.2.840.113549.1.1.11";
+const _OID_ECDSA_WITH_SHA256 = "1.2.840.10045.4.3.2";
+const _RFC_ALG_TO_SIGNATURE_OID = {
+    "RS256": _OID_SHA256_WITH_RSA,
+    "ES256": _OID_ECDSA_WITH_SHA256,
+};
+function parse_pem_certificates_to_der(certificate_chain_pem) {
+    const certificate_der_list = [];
+    for (const pem_block of certificate_chain_pem.split("-----END CERTIFICATE-----")) {
+        const trimmed = pem_block.trim();
+        if (trimmed && trimmed.includes("-----BEGIN CERTIFICATE-----")) {
+            const b64 = trimmed.replace("-----BEGIN CERTIFICATE-----", "").replace(/\s/g, "");
+            certificate_der_list.push(Buffer.from(b64, "base64"));
+        }
+    }
+    return certificate_der_list;
+}
+function extract_issuer_and_serial_from_der(cert_der) {
+    let pos = 0;
+    const read_tag_length = (offset) => {
+        const tag = cert_der[offset];
+        offset++;
+        let length = cert_der[offset];
+        offset++;
+        if (length > 127) {
+            const num_bytes = length & 0x7F;
+            length = 0;
+            for (let i = 0; i < num_bytes; i++) {
+                length = (length << 8) | cert_der[offset];
+                offset++;
+            }
+        }
+        return { tag, length, value_offset: offset };
+    };
+    const outer = read_tag_length(pos);
+    const tbs = read_tag_length(outer.value_offset);
+    let tbs_pos = tbs.value_offset;
+    const first_elem = read_tag_length(tbs_pos);
+    if (first_elem.tag === 0xA0) {
+        tbs_pos = first_elem.value_offset + first_elem.length;
+    }
+    const serial = read_tag_length(tbs_pos);
+    const serial_bytes = cert_der.subarray(serial.value_offset, serial.value_offset + serial.length);
+    let serial_number = 0n;
+    for (const byte_value of serial_bytes) {
+        serial_number = (serial_number << 8n) | BigInt(byte_value);
+    }
+    tbs_pos = serial.value_offset + serial.length;
+    const sig_alg = read_tag_length(tbs_pos);
+    tbs_pos = sig_alg.value_offset + sig_alg.length;
+    const issuer = read_tag_length(tbs_pos);
+    const issuer_der = cert_der.subarray(tbs_pos, issuer.value_offset + issuer.length);
+    return { issuer_der, serial_number };
+}
+export function build_cms_signed_data_for_direct_attestation(signature_bytes, certificate_chain_pem, signature_algorithm_rfc_name) {
+    const certificate_der_list = parse_pem_certificates_to_der(certificate_chain_pem);
+    if (certificate_der_list.length === 0) {
+        throw new Error("Certificate chain PEM contains no parseable certificates");
+    }
+    const signature_oid_string = _RFC_ALG_TO_SIGNATURE_OID[signature_algorithm_rfc_name];
+    if (!signature_oid_string) {
+        throw new Error(`Unsupported signature algorithm: ${signature_algorithm_rfc_name}`);
+    }
+    const sha256_algorithm_identifier = der_encode_tlv(0x30, Buffer.concat([der_encode_oid(_OID_SHA256), der_encode_tlv(0x05, Buffer.alloc(0))]));
+    const digest_algorithms_set = der_encode_tlv(0x31, sha256_algorithm_identifier);
+    const encap_content_info = der_encode_tlv(0x30, der_encode_oid(_OID_DATA));
+    const all_certs_content = Buffer.concat(certificate_der_list);
+    const certificates_implicit_set = der_encode_tlv(0xA0, all_certs_content);
+    const { issuer_der, serial_number } = extract_issuer_and_serial_from_der(certificate_der_list[0]);
+    const issuer_and_serial_number = der_encode_tlv(0x30, Buffer.concat([issuer_der, der_encode_integer(serial_number)]));
+    const signature_algorithm_identifier = der_encode_tlv(0x30, der_encode_oid(signature_oid_string));
+    const signature_octet_string = der_encode_tlv(0x04, signature_bytes);
+    const signer_info = der_encode_tlv(0x30, Buffer.concat([
+        der_encode_integer(1n),
+        issuer_and_serial_number,
+        sha256_algorithm_identifier,
+        signature_algorithm_identifier,
+        signature_octet_string,
+    ]));
+    const signer_infos_set = der_encode_tlv(0x31, signer_info);
+    const signed_data = der_encode_tlv(0x30, Buffer.concat([
+        der_encode_integer(1n),
+        digest_algorithms_set,
+        encap_content_info,
+        certificates_implicit_set,
+        signer_infos_set,
+    ]));
+    return der_encode_tlv(0x30, Buffer.concat([
+        der_encode_oid(_OID_SIGNED_DATA),
+        der_encode_tlv(0xA0, signed_data),
+    ]));
+}
+export async function prepare_direct_hardware_attestation(email_headers, body, agent_identity_urn) {
+    const creds = load_credentials();
+    const trust_tier = creds.trust_tier ?? "declared";
+    const typ_parameter = _TRUST_TIER_TO_RFC_TYP_PARAMETER[trust_tier] ?? "SFT";
+    if (!creds.identity_certificate_chain_pem) {
+        throw new NotEnrolledError("Mode 1 (Direct Hardware Attestation) requires a certificate chain. " +
+            "Re-enroll to obtain an identity certificate.");
+    }
+    if (!agent_identity_urn) {
+        agent_identity_urn = creds.agent_identity_urn ?? undefined;
+    }
+    const attestation_timestamp = Math.floor(Date.now() / 1000);
+    const canonicalised_body = canonicalise_body_using_dkim_simple(body);
+    const bh_raw = createHash("sha256").update(canonicalised_body).digest();
+    const bh_base64url = bh_raw.toString("base64url");
+    const lowered_headers = {};
+    for (const [k, v] of Object.entries(email_headers)) {
+        lowered_headers[k.trim().toLowerCase()] = v;
+    }
+    let signed_header_names = _MINIMUM_HEADERS_FOR_RFC_MESSAGE_BINDING.join(":");
+    const extra_header_names = Object.keys(lowered_headers).filter(h => !_MINIMUM_HEADERS_FOR_RFC_MESSAGE_BINDING.includes(h) &&
+        h !== "hardware-attestation" && h !== "hardware-trust-proof").sort();
+    if (extra_header_names.length > 0) {
+        signed_header_names += ":" + extra_header_names.join(":");
+    }
+    let algorithm_for_header;
+    if (trust_tier === "sovereign" || trust_tier === "virtual" || creds.key_algorithm === "tpm-ak") {
+        algorithm_for_header = "RS256";
+    }
+    else if (trust_tier === "portable" || trust_tier === "enclave" || creds.hsm_key_reference === "piv-slot-9a") {
+        algorithm_for_header = "ES256";
+    }
+    else if (creds.private_key_pem) {
+        const { determine_signing_algorithm_name } = await import("./verify.js");
+        algorithm_for_header = determine_signing_algorithm_name(creds);
+    }
+    else {
+        throw new NotEnrolledError("No signing key available for Mode 1 attestation.");
+    }
+    let header_template_without_chain = (`v=1; typ=${typ_parameter}; alg=${algorithm_for_header}; ` +
+        `h=${signed_header_names}; bh=${bh_base64url}; ts=${attestation_timestamp}; ` +
+        `chain=`);
+    if (agent_identity_urn) {
+        header_template_without_chain += `; aid=${agent_identity_urn}`;
+    }
+    const attestation_digest = compute_attestation_digest_for_direct_mode(email_headers, body, attestation_timestamp, header_template_without_chain);
+    let signature_bytes;
+    if (trust_tier === "sovereign" || trust_tier === "virtual" || creds.key_algorithm === "tpm-ak") {
+        const { sign_challenge_with_tpm } = await import("./helper.js");
+        const result = await sign_challenge_with_tpm(attestation_digest.toString("base64"), creds.hsm_key_reference ?? "");
+        signature_bytes = Buffer.from(result["signature_b64"] ?? "", "base64");
+    }
+    else if (trust_tier === "portable" || creds.hsm_key_reference === "piv-slot-9a") {
+        const { sign_challenge_with_piv } = await import("./helper.js");
+        const result = await sign_challenge_with_piv(attestation_digest.toString("base64"));
+        signature_bytes = Buffer.from(result["signature_b64"] ?? "", "base64");
+    }
+    else if (trust_tier === "enclave") {
+        const { sign_challenge_with_enclave } = await import("./helper.js");
+        const result = await sign_challenge_with_enclave(attestation_digest.toString("base64"));
+        signature_bytes = Buffer.from(result["signature_b64"] ?? "", "base64");
+    }
+    else if (creds.private_key_pem) {
+        const { sign_challenge_with_private_key } = await import("./keys.js");
+        signature_bytes = sign_challenge_with_private_key(creds.private_key_pem, attestation_digest);
+    }
+    else {
+        throw new NotEnrolledError("No signing key available.");
+    }
+    const cms_der_bytes = build_cms_signed_data_for_direct_attestation(signature_bytes, creds.identity_certificate_chain_pem, algorithm_for_header);
+    const chain_base64 = cms_der_bytes.toString("base64");
+    let final_header_value = (`v=1; typ=${typ_parameter}; alg=${algorithm_for_header}; ` +
+        `h=${signed_header_names}; bh=${bh_base64url}; ts=${attestation_timestamp}; ` +
+        `chain=${chain_base64}`);
+    if (agent_identity_urn) {
+        final_header_value += `; aid=${agent_identity_urn}`;
+    }
+    const body_digest_hex = createHash("sha256").update(body).digest("hex");
+    return {
+        hardware_attestation_header_value: final_header_value,
+        content_digest: `sha256:${body_digest_hex}`,
+    };
+}
+export async function prepareAttestation(options = {}) {
+    const { content, contentDigest, emailHeaders, body, disclosedClaims = ["trust_tier"], includeContactToken = true, includeSdJwt = true, apiBaseUrl, } = options;
+    const rfc_email_mode_is_active = emailHeaders != null;
+    const simple_content_mode_is_active = content != null || contentDigest != null;
+    if (rfc_email_mode_is_active && simple_content_mode_is_active) {
+        throw new Error("Cannot mix emailHeaders/body with content/contentDigest. " +
+            "Use emailHeaders+body for RFC email attestation, OR content/contentDigest for simple mode.");
+    }
+    if (rfc_email_mode_is_active && body == null) {
+        throw new Error("body is required when emailHeaders is provided.");
+    }
+    if (content != null && contentDigest != null) {
+        throw new Error("Provide content OR contentDigest, not both.");
+    }
+    let effective_content_digest = null;
+    if (content != null) {
+        const digest_hex = createHash("sha256").update(content).digest("hex");
+        effective_content_digest = `sha256:${digest_hex}`;
+    }
+    else if (contentDigest != null) {
+        effective_content_digest = contentDigest;
+    }
+    else if (rfc_email_mode_is_active && body != null) {
+        const body_digest_hex = createHash("sha256").update(body).digest("hex");
+        effective_content_digest = `sha256:${body_digest_hex}`;
+    }
+    const creds = load_credentials();
+    const effective_api_base_url = apiBaseUrl ?? creds.api_base_url ?? "https://1id.com";
+    const token = await get_token();
+    const auth_headers = {
+        "Authorization": `Bearer ${token.access_token}`,
+        "Content-Type": "application/json",
+    };
+    const proof = {
+        sd_jwt: null,
+        sd_jwt_disclosures: {},
+        contact_token: null,
+        contact_address: null,
+        tpm_signature_b64: null,
+        content_digest: effective_content_digest,
+    };
+    if (includeSdJwt) {
+        const proposed_iat = Math.floor(Date.now() / 1000);
+        let nonce_value;
+        if (rfc_email_mode_is_active && body != null) {
+            nonce_value = compute_rfc_message_binding_nonce(emailHeaders, body, proposed_iat);
+        }
+        else {
+            const message_hash = effective_content_digest?.includes(":")
+                ? effective_content_digest.split(":")[1]
+                : (effective_content_digest ?? "");
+            nonce_value = Buffer.from(message_hash, "hex").toString("base64url");
+        }
+        const sd_jwt_result = await _fetch_sd_jwt_proof_for_message(effective_api_base_url, auth_headers, nonce_value, proposed_iat, disclosedClaims);
+        proof.sd_jwt = sd_jwt_result.sd_jwt;
+        proof.sd_jwt_disclosures = sd_jwt_result.disclosures;
+    }
+    if (includeContactToken) {
+        const contact_result = await _fetch_contact_token(effective_api_base_url, auth_headers);
+        proof.contact_token = contact_result.token;
+        proof.contact_address = contact_result.contact_address;
+    }
+    return proof;
+}
+async function _fetch_sd_jwt_proof_for_message(api_base_url, auth_headers, precomputed_nonce, proposed_iat, disclosed_claims) {
+    const url = `${api_base_url}/api/v1/proof/sd-jwt/message`;
+    const response = await fetch(url, {
+        method: "POST",
+        headers: auth_headers,
+        body: JSON.stringify({
+            nonce: precomputed_nonce,
+            proposed_iat,
+            disclosed_claims,
+        }),
+        signal: AbortSignal.timeout(_HTTP_TIMEOUT_MILLISECONDS),
+    });
+    if (response.status === 401) {
+        throw new AuthenticationError("Bearer token rejected by SD-JWT endpoint.");
+    }
+    if (!response.ok) {
+        console.error(`SD-JWT request failed (HTTP ${response.status}): ${(await response.text()).slice(0, 300)} -- Hardware-Trust-Proof header will be MISSING`);
+        return { sd_jwt: null, disclosures: {} };
+    }
+    let data = await response.json();
+    if ("data" in data) {
+        data = data.data;
+    }
+    return {
+        sd_jwt: data.sd_jwt ?? null,
+        disclosures: data.disclosures ?? {},
+    };
+}
+async function _fetch_contact_token(api_base_url, auth_headers) {
+    const url = `${api_base_url}/api/v1/contact-token`;
+    try {
+        const response = await fetch(url, {
+            method: "GET",
+            headers: auth_headers,
+            signal: AbortSignal.timeout(_HTTP_TIMEOUT_MILLISECONDS),
+        });
+        if (!response.ok) {
+            console.warn(`Contact token request failed (HTTP ${response.status})`);
+            return { token: null, contact_address: null };
+        }
+        const data = (await response.json()).data ?? {};
+        return {
+            token: data.token ?? null,
+            contact_address: data.contact_address ?? null,
+        };
+    }
+    catch {
+        return { token: null, contact_address: null };
+    }
+}
+//# sourceMappingURL=attestation.js.map

package/dist/attestation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestation.js","sourceRoot":"","sources":["../src/attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAgB,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEtF,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAE1C,MAAM,wCAAwC,GAAG;IAC/C,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY;CAC9C,CAAC;AAsBF,MAAM,UAAU,4CAA4C,CAAC,SAAiB;IAC5E,IAAI,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC1E,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACpD,OAAO,UAAU,CAAC,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,2CAA2C,CAAC,QAAgB;IAC1E,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,wCAAwC,CACtD,aAAqC,EACrC,gDAAwD,EAAE;IAE1D,MAAM,eAAe,GAA2B,EAAE,CAAC;IACnD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QACnD,eAAe,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,MAAM,oBAAoB,IAAI,wCAAwC,EAAE,CAAC;QAC5E,IAAI,CAAC,CAAC,oBAAoB,IAAI,eAAe,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,kCAAkC,oBAAoB,mCAAmC;gBACzF,qBAAqB,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,0BAA0B,GAAa,EAAE,CAAC;IAEhD,KAAK,MAAM,oBAAoB,IAAI,wCAAwC,EAAE,CAAC;QAC5E,MAAM,UAAU,GAAG,2CAA2C,CAAC,oBAAoB,CAAC,CAAC;QACrF,MAAM,WAAW,GAAG,4CAA4C,CAAC,eAAe,CAAC,oBAAoB,CAAC,CAAC,CAAC;QACxG,0BAA0B,CAAC,IAAI,CAAC,GAAG,UAAU,IAAI,WAAW,MAAM,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,MAAM,iBAAiB,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACpE,IAAI,wCAAwC,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QACvF,IAAI,iBAAiB,KAAK,sBAAsB,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QAC/D,MAAM,UAAU,GAAG,2CAA2C,CAAC,iBAAiB,CAAC,CAAC;QAClF,MAAM,WAAW,GAAG,4CAA4C,CAAC,eAAe,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACrG,0BAA0B,CAAC,IAAI,CAAC,GAAG,UAAU,IAAI,WAAW,MAAM,CAAC,CAAC;IACtE,CAAC;IAED,0BAA0B,CAAC,IAAI,CAC7B,wBAAwB,6CAA6C,EAAE,CACxE,CAAC;IAEF,OAAO,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,UAAkB;IACpE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAAC,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAAC,CAAC;IAC5D,IAAI,MAAM,GAAG,UAAU,CAAC;IACxB,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACjF,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACrD,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,aAAqC,EACrC,UAAkB,EAClB,2BAAmC;IAEnC,MAAM,0BAA0B,GAAG,wCAAwC,CAAC,aAAa,CAAC,CAAC;IAC3F,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC,MAAM,EAAE,CAAC;IAEhF,MAAM,kBAAkB,GAAG,mCAAmC,CAAC,UAAU,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,MAAM,EAAE,CAAC;IAExE,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjC,QAAQ,CAAC,gBAAgB,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC,CAAC;IAE/D,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IAClE,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,EAAE,CAAC;IAExE,OAAO,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,gCAAgC,GAA2B;IAC/D,WAAW,EAAE,KAAK;IAClB,UAAU,EAAE,KAAK;IACjB,SAAS,EAAE,KAAK;IAChB,SAAS,EAAE,KAAK;IAChB,UAAU,EAAE,KAAK;CAClB,CAAC;AAOF,MAAM,UAAU,2CAA2C,CACzD,aAAqC,EACrC,kDAA0D,EAAE;IAE5D,MAAM,eAAe,GAA2B,EAAE,CAAC;IACnD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QACnD,eAAe,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,MAAM,oBAAoB,IAAI,wCAAwC,EAAE,CAAC;QAC5E,IAAI,CAAC,CAAC,oBAAoB,IAAI,eAAe,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,kCAAkC,oBAAoB,4BAA4B;gBAClF,qBAAqB,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,0BAA0B,GAAa,EAAE,CAAC;IAEhD,KAAK,MAAM,oBAAoB,IAAI,wCAAwC,EAAE,CAAC;QAC5E,MAAM,UAAU,GAAG,2CAA2C,CAAC,oBAAoB,CAAC,CAAC;QACrF,MAAM,WAAW,GAAG,4CAA4C,CAAC,eAAe,CAAC,oBAAoB,CAAE,CAAC,CAAC;QACzG,0BAA0B,CAAC,IAAI,CAAC,GAAG,UAAU,IAAI,WAAW,MAAM,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,MAAM,iBAAiB,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACpE,IAAI,wCAAwC,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QACvF,IAAI,iBAAiB,KAAK,sBAAsB,IAAI,iBAAiB,KAAK,sBAAsB,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QAC/G,MAAM,UAAU,GAAG,2CAA2C,CAAC,iBAAiB,CAAC,CAAC;QAClF,MAAM,WAAW,GAAG,4CAA4C,CAAC,eAAe,CAAC,iBAAiB,CAAE,CAAC,CAAC;QACtG,0BAA0B,CAAC,IAAI,CAAC,GAAG,UAAU,IAAI,WAAW,MAAM,CAAC,CAAC;IACtE,CAAC;IAED,0BAA0B,CAAC,IAAI,CAC7B,wBAAwB,+CAA+C,EAAE,CAC1E,CAAC;IAEF,OAAO,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,0CAA0C,CACxD,aAAqC,EACrC,UAAkB,EAClB,0BAAkC,EAClC,kDAA0D,EAAE;IAE5D,MAAM,0BAA0B,GAAG,2CAA2C,CAC5E,aAAa,EAAE,+CAA+C,CAC/D,CAAC;IACF,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC,MAAM,EAAE,CAAC;IAEhF,MAAM,kBAAkB,GAAG,mCAAmC,CAAC,UAAU,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,MAAM,EAAE,CAAC;IAExE,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjC,QAAQ,CAAC,gBAAgB,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC,CAAC;IAE9D,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IACpE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,MAAM,EAAE,CAAC;AACjE,CAAC;AAED,SAAS,iBAAiB,CAAC,YAAoB;IAC7C,IAAI,YAAY,GAAG,IAAI,EAAE,CAAC;QAAC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;IAAC,CAAC;IAChE,IAAI,YAAY,GAAG,KAAK,EAAE,CAAC;QAAC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;IAAC,CAAC;IACvE,IAAI,YAAY,GAAG,OAAO,EAAE,CAAC;QAAC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC;IAAC,CAAC;IAC5G,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,YAAY,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC;AAC3G,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB,EAAE,aAAqB;IAC7D,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,iBAAiB,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC;AAC1G,CAAC;AAED,SAAS,kBAAkB,CAAC,aAAqB;IAC/C,IAAI,aAAa,KAAK,EAAE,EAAE,CAAC;QAAC,OAAO,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAC/E,MAAM,GAAG,GAAG,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACpD,IAAI,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACjD,IAAI,WAAW,CAAC,CAAC,CAAE,IAAI,IAAI,EAAE,CAAC;QAC5B,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,cAAc,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,cAAc,CAAC,iBAAyB;IAC/C,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAa,CAAC,EAAE,GAAG,UAAU,CAAC,CAAC,CAAE,GAAG,UAAU,CAAC,CAAC,CAAE,CAAC,CAAC;IACtE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAE,CAAC;QACjC,IAAI,SAAS,GAAG,IAAI,EAAE,CAAC;YACrB,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,MAAM,cAAc,GAAa,EAAE,CAAC;YACpC,IAAI,SAAS,GAAG,SAAS,CAAC;YAC1B,OAAO,SAAS,GAAG,CAAC,EAAE,CAAC;gBACrB,cAAc,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;gBACtC,SAAS,KAAK,CAAC,CAAC;YAClB,CAAC;YACD,cAAc,CAAC,OAAO,EAAE,CAAC;YACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC/C,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAE,CAAC,CAAC;YACpG,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AAChD,MAAM,SAAS,GAAG,sBAAsB,CAAC;AACzC,MAAM,WAAW,GAAG,wBAAwB,CAAC;AAC7C,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AACrD,MAAM,sBAAsB,GAAG,qBAAqB,CAAC;AAErD,MAAM,yBAAyB,GAA2B;IACxD,OAAO,EAAE,oBAAoB;IAC7B,OAAO,EAAE,sBAAsB;CAChC,CAAC;AAEF,SAAS,6BAA6B,CAAC,qBAA6B;IAClE,MAAM,oBAAoB,GAAa,EAAE,CAAC;IAC1C,KAAK,MAAM,SAAS,IAAI,qBAAqB,CAAC,KAAK,CAAC,2BAA2B,CAAC,EAAE,CAAC;QACjF,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EAAE,CAAC;YAC/D,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,6BAA6B,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAClF,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IACD,OAAO,oBAAoB,CAAC;AAC9B,CAAC;AAED,SAAS,kCAAkC,CAAC,QAAgB;IAC1D,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,MAAM,eAAe,GAAG,CAAC,MAAc,EAAyD,EAAE;QAChG,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAE,CAAC;QAC9B,MAAM,EAAE,CAAC;QACT,IAAI,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAE,CAAC;QAC/B,MAAM,EAAE,CAAC;QACT,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,GAAG,IAAI,CAAC;YAChC,MAAM,GAAG,CAAC,CAAC;YACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;gBACnC,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAE,CAAC;gBAC3C,MAAM,EAAE,CAAC;YACX,CAAC;QACH,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;IAC/C,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAChD,IAAI,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC;IAE/B,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,UAAU,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QAC5B,OAAO,GAAG,UAAU,CAAC,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC;IACxD,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACjG,IAAI,aAAa,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,UAAU,IAAI,YAAY,EAAE,CAAC;QACtC,aAAa,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,GAAG,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC;IAE9C,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACzC,OAAO,GAAG,OAAO,CAAC,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;IAEhD,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAEnF,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,4CAA4C,CAC1D,eAAuB,EACvB,qBAA6B,EAC7B,4BAAoC;IAEpC,MAAM,oBAAoB,GAAG,6BAA6B,CAAC,qBAAqB,CAAC,CAAC;IAClF,IAAI,oBAAoB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,oBAAoB,GAAG,yBAAyB,CAAC,4BAA4B,CAAC,CAAC;IACrF,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,oCAAoC,4BAA4B,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,MAAM,2BAA2B,GAAG,cAAc,CAAC,IAAI,EACrD,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEvF,MAAM,qBAAqB,GAAG,cAAc,CAAC,IAAI,EAAE,2BAA2B,CAAC,CAAC;IAChF,MAAM,kBAAkB,GAAG,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC;IAC3E,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC9D,MAAM,yBAAyB,GAAG,cAAc,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAE1E,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,kCAAkC,CAAC,oBAAoB,CAAC,CAAC,CAAE,CAAC,CAAC;IACnG,MAAM,wBAAwB,GAAG,cAAc,CAAC,IAAI,EAClD,MAAM,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,kBAAkB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IAElE,MAAM,8BAA8B,GAAG,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAClG,MAAM,sBAAsB,GAAG,cAAc,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IAErE,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;QACrD,kBAAkB,CAAC,EAAE,CAAC;QACtB,wBAAwB;QACxB,2BAA2B;QAC3B,8BAA8B;QAC9B,sBAAsB;KACvB,CAAC,CAAC,CAAC;IAEJ,MAAM,gBAAgB,GAAG,cAAc,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAE3D,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;QACrD,kBAAkB,CAAC,EAAE,CAAC;QACtB,qBAAqB;QACrB,kBAAkB;QAClB,yBAAyB;QACzB,gBAAgB;KACjB,CAAC,CAAC,CAAC;IAEJ,OAAO,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;QACxC,cAAc,CAAC,gBAAgB,CAAC;QAChC,cAAc,CAAC,IAAI,EAAE,WAAW,CAAC;KAClC,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,aAAqC,EACrC,IAAY,EACZ,kBAA2B;IAE3B,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,UAAU,CAAC;IAClD,MAAM,aAAa,GAAG,gCAAgC,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC;IAE5E,IAAI,CAAC,KAAK,CAAC,8BAA8B,EAAE,CAAC;QAC1C,MAAM,IAAI,gBAAgB,CACxB,qEAAqE;YACrE,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,kBAAkB,GAAG,KAAK,CAAC,kBAAkB,IAAI,SAAS,CAAC;IAC7D,CAAC;IAED,MAAM,qBAAqB,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAE5D,MAAM,kBAAkB,GAAG,mCAAmC,CAAC,IAAI,CAAC,CAAC;IACrE,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,MAAM,EAAE,CAAC;IACxE,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAElD,MAAM,eAAe,GAA2B,EAAE,CAAC;IACnD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QACnD,eAAe,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,mBAAmB,GAAG,wCAAwC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7E,MAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,CAC5D,CAAC,CAAC,EAAE,CAAC,CAAC,wCAAwC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACrD,CAAC,KAAK,sBAAsB,IAAI,CAAC,KAAK,sBAAsB,CAClE,CAAC,IAAI,EAAE,CAAC;IACT,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,mBAAmB,IAAI,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,oBAA4B,CAAC;IACjC,IAAI,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;QAC/F,oBAAoB,GAAG,OAAO,CAAC;IACjC,CAAC;SAAM,IAAI,UAAU,KAAK,UAAU,IAAI,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,iBAAiB,KAAK,aAAa,EAAE,CAAC;QAC9G,oBAAoB,GAAG,OAAO,CAAC;IACjC,CAAC;SAAM,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;QACjC,MAAM,EAAE,gCAAgC,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACzE,oBAAoB,GAAG,gCAAgC,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,gBAAgB,CAAC,kDAAkD,CAAC,CAAC;IACjF,CAAC;IAED,IAAI,6BAA6B,GAAG,CAClC,YAAY,aAAa,SAAS,oBAAoB,IAAI;QAC1D,KAAK,mBAAmB,QAAQ,YAAY,QAAQ,qBAAqB,IAAI;QAC7E,QAAQ,CACT,CAAC;IACF,IAAI,kBAAkB,EAAE,CAAC;QACvB,6BAA6B,IAAI,SAAS,kBAAkB,EAAE,CAAC;IACjE,CAAC;IAED,MAAM,kBAAkB,GAAG,0CAA0C,CACnE,aAAa,EAAE,IAAI,EAAE,qBAAqB,EAAE,6BAA6B,CAC1E,CAAC;IAEF,IAAI,eAAuB,CAAC;IAC5B,IAAI,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;QAC/F,MAAM,EAAE,uBAAuB,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;QACnH,eAAe,GAAG,MAAM,CAAC,IAAI,CAAE,MAAM,CAAC,eAAe,CAAY,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;IACrF,CAAC;SAAM,IAAI,UAAU,KAAK,UAAU,IAAI,KAAK,CAAC,iBAAiB,KAAK,aAAa,EAAE,CAAC;QAClF,MAAM,EAAE,uBAAuB,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QACpF,eAAe,GAAG,MAAM,CAAC,IAAI,CAAE,MAAM,CAAC,eAAe,CAAY,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;IACrF,CAAC;SAAM,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,EAAE,2BAA2B,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QACxF,eAAe,GAAG,MAAM,CAAC,IAAI,CAAE,MAAM,CAAC,eAAe,CAAY,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;IACrF,CAAC;SAAM,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;QACjC,MAAM,EAAE,+BAA+B,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QACtE,eAAe,GAAG,+BAA+B,CAAC,KAAK,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC;IAC/F,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,gBAAgB,CAAC,2BAA2B,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,aAAa,GAAG,4CAA4C,CAChE,eAAe,EAAE,KAAK,CAAC,8BAA8B,EAAE,oBAAoB,CAC5E,CAAC;IACF,MAAM,YAAY,GAAG,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAEtD,IAAI,kBAAkB,GAAG,CACvB,YAAY,aAAa,SAAS,oBAAoB,IAAI;QAC1D,KAAK,mBAAmB,QAAQ,YAAY,QAAQ,qBAAqB,IAAI;QAC7E,SAAS,YAAY,EAAE,CACxB,CAAC;IACF,IAAI,kBAAkB,EAAE,CAAC;QACvB,kBAAkB,IAAI,SAAS,kBAAkB,EAAE,CAAC;IACtD,CAAC;IAED,MAAM,eAAe,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAExE,OAAO;QACL,iCAAiC,EAAE,kBAAkB;QACrD,cAAc,EAAE,UAAU,eAAe,EAAE;KAC5C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,UAAqC,EAAE;IAEvC,MAAM,EACJ,OAAO,EACP,aAAa,EACb,YAAY,EACZ,IAAI,EACJ,eAAe,GAAG,CAAC,YAAY,CAAC,EAChC,mBAAmB,GAAG,IAAI,EAC1B,YAAY,GAAG,IAAI,EACnB,UAAU,GACX,GAAG,OAAO,CAAC;IAEZ,MAAM,wBAAwB,GAAG,YAAY,IAAI,IAAI,CAAC;IACtD,MAAM,6BAA6B,GAAG,OAAO,IAAI,IAAI,IAAI,aAAa,IAAI,IAAI,CAAC;IAE/E,IAAI,wBAAwB,IAAI,6BAA6B,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CACb,2DAA2D;YAC3D,4FAA4F,CAC7F,CAAC;IACJ,CAAC;IAED,IAAI,wBAAwB,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,OAAO,IAAI,IAAI,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAED,IAAI,wBAAwB,GAAkB,IAAI,CAAC;IACnD,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;QACpB,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,wBAAwB,GAAG,UAAU,UAAU,EAAE,CAAC;IACpD,CAAC;SAAM,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;QACjC,wBAAwB,GAAG,aAAa,CAAC;IAC3C,CAAC;SAAM,IAAI,wBAAwB,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QACpD,MAAM,eAAe,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxE,wBAAwB,GAAG,UAAU,eAAe,EAAE,CAAC;IACzD,CAAC;IAED,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,MAAM,sBAAsB,GAAG,UAAU,IAAI,KAAK,CAAC,YAAY,IAAI,iBAAiB,CAAC;IAErF,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;IAChC,MAAM,YAAY,GAA2B;QAC3C,eAAe,EAAE,UAAU,KAAK,CAAC,YAAY,EAAE;QAC/C,cAAc,EAAE,kBAAkB;KACnC,CAAC;IAEF,MAAM,KAAK,GAAqB;QAC9B,MAAM,EAAE,IAAI;QACZ,kBAAkB,EAAE,EAAE;QACtB,aAAa,EAAE,IAAI;QACnB,eAAe,EAAE,IAAI;QACrB,iBAAiB,EAAE,IAAI;QACvB,cAAc,EAAE,wBAAwB;KACzC,CAAC;IAEF,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACnD,IAAI,WAAmB,CAAC;QAExB,IAAI,wBAAwB,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;YAC7C,WAAW,GAAG,iCAAiC,CAC7C,YAAa,EACb,IAAI,EACJ,YAAY,CACb,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,YAAY,GAAG,wBAAwB,EAAE,QAAQ,CAAC,GAAG,CAAC;gBAC1D,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACxC,CAAC,CAAC,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC;YACrC,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,+BAA+B,CACzD,sBAAsB,EACtB,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,eAAe,CAChB,CAAC;QACF,KAAK,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC;QACpC,KAAK,CAAC,kBAAkB,GAAG,aAAa,CAAC,WAAW,CAAC;IACvD,CAAC;IAED,IAAI,mBAAmB,EAAE,CAAC;QACxB,MAAM,cAAc,GAAG,MAAM,oBAAoB,CAAC,sBAAsB,EAAE,YAAY,CAAC,CAAC;QACxF,KAAK,CAAC,aAAa,GAAG,cAAc,CAAC,KAAK,CAAC;QAC3C,KAAK,CAAC,eAAe,GAAG,cAAc,CAAC,eAAe,CAAC;IACzD,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,+BAA+B,CAC5C,YAAoB,EACpB,YAAoC,EACpC,iBAAyB,EACzB,YAAoB,EACpB,gBAA0B;IAE1B,MAAM,GAAG,GAAG,GAAG,YAAY,8BAA8B,CAAC;IAE1D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,YAAY;QACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,KAAK,EAAE,iBAAiB;YACxB,YAAY;YACZ,gBAAgB;SACjB,CAAC;QACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,0BAA0B,CAAC;KACxD,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,IAAI,mBAAmB,CAAC,2CAA2C,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,CAAC,KAAK,CACX,+BAA+B,QAAQ,CAAC,MAAM,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,iDAAiD,CAC3I,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IAC3C,CAAC;IAED,IAAI,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAyB,CAAC;IACxD,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IAAC,CAAC;IACzC,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;QAC3B,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE;KACpC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,YAAoB,EACpB,YAAoC;IAEpC,MAAM,GAAG,GAAG,GAAG,YAAY,uBAAuB,CAAC;IAEnD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,YAAY;YACrB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,0BAA0B,CAAC;SACxD,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,sCAAsC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YACvE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;QAChD,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAA0B,CAAA,CAAC,IAAI,IAAI,EAAE,CAAC;QACvE,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;YACzB,eAAe,EAAE,IAAI,CAAC,eAAe,IAAI,IAAI;SAC9C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IAChD,CAAC;AACH,CAAC"}

package/dist/client.d.ts

@@ -44,6 +44,14 @@ export declare class OneIDAPIClient {
      * serial, and returns a nonce challenge for signature verification.
      */
     enroll_begin_piv(attestation_cert_pem: string, attestation_chain_pem: string[], signing_key_public_pem: string, hsm_type?: string, operator_email?: string | null, requested_handle?: string | null): Promise<Record<string, unknown>>;
+    /**
+     * Begin enclave enrollment by submitting the Secure Enclave public key.
+     *
+     * Server validates the P-256 key format, generates a nonce challenge,
+     * and returns a session ID. The client signs the nonce with the Enclave
+     * key and submits it to enroll_activate().
+     */
+    enroll_begin_enclave(enclave_public_key_pem: string, operator_email?: string | null, requested_handle?: string | null, display_name?: string | null): Promise<Record<string, unknown>>;
     /**
      * Complete TPM/HSM-based enrollment by proving HSM possession.
      */

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AA6FH;;;;;GAKG;AACH,qBAAa,cAAc;IACzB,SAAgB,YAAY,EAAE,MAAM,CAAC;IACrC,SAAgB,oBAAoB,EAAE,MAAM,CAAC;gBAG3C,YAAY,GAAE,MAA6B,EAC3C,oBAAoB,GAAE,MAA0C;IAMlE;;OAEG;YACW,aAAa;IAyB3B;;OAEG;IACG,eAAe,CACnB,gBAAgB,EAAE,MAAM,EACxB,aAAa,EAAE,MAAM,EACrB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,EAC9B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,GAC/B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAWnC;;OAEG;IACG,YAAY,CAChB,kBAAkB,EAAE,MAAM,EAC1B,iBAAiB,EAAE,MAAM,EACzB,kBAAkB,GAAE,MAAW,EAC/B,iBAAiB,GAAE,MAAW,EAC9B,wBAAwB,CAAC,EAAE,MAAM,EAAE,EACnC,QAAQ,GAAE,MAAc,EACxB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,EAC9B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,GAC/B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAenC;;;;;;;OAOG;IACG,gBAAgB,CACpB,oBAAoB,EAAE,MAAM,EAC5B,qBAAqB,EAAE,MAAM,EAAE,EAC/B,sBAAsB,EAAE,MAAM,EAC9B,QAAQ,GAAE,MAAkB,EAC5B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,EAC9B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,GAC/B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAanC;;OAEG;IACG,eAAe,CACnB,qBAAqB,EAAE,MAAM,EAC7B,oBAAoB,EAAE,MAAM,GAC3B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAOnC;;OAEG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAItE;;;;OAIG;IACG,iCAAiC,CACrC,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAuEnC;;OAEG;IACG,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAItF;;;OAGG;IACG,0BAA0B,CAC9B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GACzC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAKpC"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AA6FH;;;;;GAKG;AACH,qBAAa,cAAc;IACzB,SAAgB,YAAY,EAAE,MAAM,CAAC;IACrC,SAAgB,oBAAoB,EAAE,MAAM,CAAC;gBAG3C,YAAY,GAAE,MAA6B,EAC3C,oBAAoB,GAAE,MAA0C;IAMlE;;OAEG;YACW,aAAa;IAyB3B;;OAEG;IACG,eAAe,CACnB,gBAAgB,EAAE,MAAM,EACxB,aAAa,EAAE,MAAM,EACrB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,EAC9B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,GAC/B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAWnC;;OAEG;IACG,YAAY,CAChB,kBAAkB,EAAE,MAAM,EAC1B,iBAAiB,EAAE,MAAM,EACzB,kBAAkB,GAAE,MAAW,EAC/B,iBAAiB,GAAE,MAAW,EAC9B,wBAAwB,CAAC,EAAE,MAAM,EAAE,EACnC,QAAQ,GAAE,MAAc,EACxB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,EAC9B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,GAC/B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAenC;;;;;;;OAOG;IACG,gBAAgB,CACpB,oBAAoB,EAAE,MAAM,EAC5B,qBAAqB,EAAE,MAAM,EAAE,EAC/B,sBAAsB,EAAE,MAAM,EAC9B,QAAQ,GAAE,MAAkB,EAC5B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,EAC9B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,GAC/B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAanC;;;;;;OAMG;IACG,oBAAoB,CACxB,sBAAsB,EAAE,MAAM,EAC9B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,EAC9B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,EAChC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,GAC3B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAWnC;;OAEG;IACG,eAAe,CACnB,qBAAqB,EAAE,MAAM,EAC7B,oBAAoB,EAAE,MAAM,GAC3B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAOnC;;OAEG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAItE;;;;OAIG;IACG,iCAAiC,CACrC,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAuEnC;;OAEG;IACG,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAItF;;;OAGG;IACG,0BAA0B,CAC9B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GACzC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAKpC"}