@invisible-labs/sdk 0.6.0-devnet.4 → 0.6.0-devnet.5

package/dist/chunk-5NNEO7IK.js

@@ -1,1150 +0,0 @@
-import { failSessionClosed, createSessionHandle, getSessionState, closeSessionState } from './chunk-V5HXJRBW.js';
-import { verifyAttestation, assertAttestResponse } from './chunk-DIA6U2CV.js';
-import { TransportError, AttestationError } from './chunk-GHBQF3A7.js';
-import { generateKeyPair, sharedKey } from '@stablelib/x25519';
-import { ChaCha20Poly1305 } from '@stablelib/chacha20poly1305';
-import { hash, SHA256 } from '@stablelib/sha256';
-import { HMAC } from '@stablelib/hmac';
-import { Ajv2020 } from 'ajv/dist/2020.js';
-
-// src/core/exponentialBackoff.ts
-function createExponentialBackoff(options) {
-  if (!Number.isFinite(options.initialDelayMs) || options.initialDelayMs <= 0) {
-    throw new Error("initialDelayMs must be a positive finite number");
-  }
-  if (!Number.isFinite(options.maxDelayMs) || options.maxDelayMs < options.initialDelayMs) {
-    throw new Error("maxDelayMs must be finite and >= initialDelayMs");
-  }
-  if (options.multiplier !== void 0 && (!Number.isFinite(options.multiplier) || options.multiplier < 1)) {
-    throw new Error("multiplier must be finite and >= 1");
-  }
-  if (options.jitterRatio !== void 0 && (!Number.isFinite(options.jitterRatio) || options.jitterRatio < 0 || options.jitterRatio > 1)) {
-    throw new Error("jitterRatio must be between 0 and 1");
-  }
-  const initialDelayMs = options.initialDelayMs;
-  const maxDelayMs = options.maxDelayMs;
-  const multiplier = options.multiplier ?? 2;
-  const jitterRatio = options.jitterRatio ?? 0;
-  const random = options.random ?? Math.random;
-  let attempt = 0;
-  return {
-    nextDelayMs() {
-      const baseDelayMs = Math.min(maxDelayMs, initialDelayMs * multiplier ** attempt);
-      attempt += 1;
-      if (jitterRatio === 0) return Math.round(baseDelayMs);
-      const lowerBound = baseDelayMs * (1 - jitterRatio);
-      const upperBound = baseDelayMs * (1 + jitterRatio);
-      const boundedRandom = Math.min(Math.max(random(), 0), 1);
-      return Math.min(
-        maxDelayMs,
-        Math.round(lowerBound + (upperBound - lowerBound) * boundedRandom)
-      );
-    },
-    reset() {
-      attempt = 0;
-    }
-  };
-}
-
-// src/transport/stateController.ts
-function createStateController(initial) {
-  let state = initial;
-  const listeners = /* @__PURE__ */ new Set();
-  return {
-    get: () => state,
-    set(next) {
-      if (next === state) return;
-      state = next;
-      for (const listener of listeners) listener(next);
-    },
-    onChange(listener) {
-      listeners.add(listener);
-      return () => listeners.delete(listener);
-    }
-  };
-}
-
-// src/transport/noiseWebSocketTransport.ts
-var DEFAULT_CONNECT_TIMEOUT_MS = 3e4;
-function defaultWebSocketFactory(url) {
-  const ctor = globalThis.WebSocket;
-  if (!ctor) {
-    throw new TransportError(
-      "WS_HANDSHAKE_FAILED",
-      "no global WebSocket available; pass options.webSocketFactory"
-    );
-  }
-  return new ctor(url);
-}
-function toUint8Array(data) {
-  if (data instanceof Uint8Array) return data;
-  if (data instanceof ArrayBuffer) return new Uint8Array(data);
-  if (ArrayBuffer.isView(data)) {
-    return new Uint8Array(data.buffer, data.byteOffset, data.byteLength);
-  }
-  if (typeof data === "string") return new TextEncoder().encode(data);
-  throw new TransportError("NOISE_FRAME_TOO_LARGE", "unsupported inbound frame type");
-}
-function noiseWebSocketTransport(options) {
-  const factory = options.webSocketFactory ?? defaultWebSocketFactory;
-  const connectTimeoutMs = options.connectTimeoutMs ?? DEFAULT_CONNECT_TIMEOUT_MS;
-  const sc = createStateController("idle");
-  const messageListeners = /* @__PURE__ */ new Set();
-  let socket = null;
-  function teardown() {
-    if (sc.get() === "closed") return;
-    sc.set("closing");
-    const ws = socket;
-    socket = null;
-    if (ws) {
-      ws.onopen = null;
-      ws.onerror = null;
-      ws.onmessage = null;
-      ws.onclose = null;
-      try {
-        ws.close();
-      } catch {
-      }
-    }
-    sc.set("closed");
-  }
-  return {
-    state: () => sc.get(),
-    onStateChange: (listener) => sc.onChange(listener),
-    onMessage(listener) {
-      messageListeners.add(listener);
-      return () => messageListeners.delete(listener);
-    },
-    connect(signal) {
-      if (sc.get() === "open") return Promise.resolve();
-      if (signal?.aborted) {
-        return Promise.reject(
-          new TransportError("CONNECTION_LOST", "connect aborted before it started")
-        );
-      }
-      sc.set("connecting");
-      return new Promise((resolve, reject) => {
-        let settled = false;
-        const ws = factory(options.wsUrl);
-        socket = ws;
-        ws.binaryType = "arraybuffer";
-        const cleanupConnect = () => {
-          clearTimeout(timer);
-          signal?.removeEventListener("abort", onAbort);
-        };
-        const fail = (error) => {
-          if (settled) return;
-          settled = true;
-          cleanupConnect();
-          teardown();
-          reject(error);
-        };
-        const onAbort = () => fail(new TransportError("CONNECTION_LOST", "connect aborted"));
-        const timer = setTimeout(
-          () => fail(
-            new TransportError(
-              "WS_HANDSHAKE_FAILED",
-              `connect timed out after ${connectTimeoutMs}ms`
-            )
-          ),
-          connectTimeoutMs
-        );
-        signal?.addEventListener("abort", onAbort, { once: true });
-        ws.onopen = () => {
-          if (settled) return;
-          settled = true;
-          cleanupConnect();
-          ws.onmessage = (event) => {
-            const frame = toUint8Array(event.data);
-            for (const listener of messageListeners) listener(frame);
-          };
-          ws.onclose = () => teardown();
-          ws.onerror = () => teardown();
-          sc.set("open");
-          resolve();
-        };
-        ws.onerror = () => fail(new TransportError("WS_HANDSHAKE_FAILED", "socket error during connect"));
-        ws.onclose = () => fail(new TransportError("CONNECTION_LOST", "socket closed during connect"));
-      });
-    },
-    send(frame) {
-      const ws = socket;
-      if (sc.get() !== "open" || !ws) {
-        throw new TransportError("CONNECTION_LOST", "cannot send on a non-open transport");
-      }
-      ws.send(frame);
-    },
-    close() {
-      teardown();
-    }
-  };
-}
-var PROTOCOL_NAME = "Noise_XX_25519_ChaChaPoly_SHA256";
-function noiseNonce(n) {
-  const buf = new Uint8Array(12);
-  const view = new DataView(buf.buffer);
-  view.setUint32(4, n & 4294967295, true);
-  view.setUint32(8, Math.floor(n / 4294967296) & 4294967295, true);
-  return buf;
-}
-function hkdf2(ck, ikm) {
-  const mac1 = new HMAC(SHA256, ck);
-  mac1.update(ikm);
-  const temp = mac1.digest();
-  const mac2 = new HMAC(SHA256, temp);
-  mac2.update(new Uint8Array([1]));
-  const out1 = mac2.digest();
-  const mac3 = new HMAC(SHA256, temp);
-  mac3.update(out1);
-  mac3.update(new Uint8Array([2]));
-  const out2 = mac3.digest();
-  return [out1, out2];
-}
-function createSymState() {
-  const proto = new TextEncoder().encode(PROTOCOL_NAME);
-  const h0 = new Uint8Array(32);
-  h0.set(proto);
-  const ck0 = new Uint8Array(32);
-  ck0.set(h0);
-  const ss = {
-    h: h0,
-    ck: ck0,
-    k: null,
-    n: 0,
-    mixHash(data) {
-      const combined = new Uint8Array(this.h.length + data.length);
-      combined.set(this.h);
-      combined.set(data, this.h.length);
-      this.h = hash(combined);
-    },
-    mixKey(ikm) {
-      const [newCk, newK] = hkdf2(this.ck, ikm);
-      this.ck = newCk;
-      this.k = newK;
-      this.n = 0;
-    },
-    encryptAndHash(plaintext) {
-      if (!this.k) {
-        this.mixHash(plaintext);
-        return new Uint8Array(plaintext);
-      }
-      const aead = new ChaCha20Poly1305(this.k);
-      const ct = aead.seal(noiseNonce(this.n), plaintext, this.h);
-      this.n++;
-      this.mixHash(ct);
-      return ct;
-    },
-    decryptAndHash(ciphertext) {
-      if (!this.k) {
-        this.mixHash(ciphertext);
-        return new Uint8Array(ciphertext);
-      }
-      const aead = new ChaCha20Poly1305(this.k);
-      const pt = aead.open(noiseNonce(this.n), ciphertext, this.h);
-      if (!pt) throw new Error("Noise: AEAD decryption failed");
-      this.n++;
-      this.mixHash(ciphertext);
-      return pt;
-    },
-    split() {
-      const [k1, k2] = hkdf2(this.ck, new Uint8Array(0));
-      return [k1, k2];
-    }
-  };
-  ss.mixHash(new Uint8Array(0));
-  return ss;
-}
-function createNoiseTransport(sendKey, recvKey) {
-  let sendN = 0;
-  let recvN = 0;
-  return {
-    encrypt(plaintext) {
-      const aead = new ChaCha20Poly1305(sendKey);
-      const ct = aead.seal(noiseNonce(sendN), plaintext, void 0);
-      sendN++;
-      return ct;
-    },
-    decrypt(ciphertext) {
-      const aead = new ChaCha20Poly1305(recvKey);
-      const pt = aead.open(noiseNonce(recvN), ciphertext, void 0);
-      if (!pt) throw new Error("Noise: transport decryption failed");
-      recvN++;
-      return pt;
-    }
-  };
-}
-function createNoiseXXInitiator() {
-  const staticKeyPair = generateKeyPair();
-  const ephKeyPair = generateKeyPair();
-  const ss = createSymState();
-  let remoteEphPub = null;
-  let remoteStaticPub = null;
-  return {
-    get remoteStaticPublicKey() {
-      return remoteStaticPub;
-    },
-    writeMessage1() {
-      ss.mixHash(ephKeyPair.publicKey);
-      return new Uint8Array(ephKeyPair.publicKey);
-    },
-    readMessage2(msg) {
-      if (msg.length < 96) {
-        throw new Error(`noise msg2: expected >=96 bytes, got ${msg.length}`);
-      }
-      remoteEphPub = msg.slice(0, 32);
-      ss.mixHash(remoteEphPub);
-      const dhEE = sharedKey(ephKeyPair.secretKey, remoteEphPub);
-      ss.mixKey(dhEE);
-      remoteStaticPub = ss.decryptAndHash(msg.slice(32, 80));
-      const dhES = sharedKey(ephKeyPair.secretKey, remoteStaticPub);
-      ss.mixKey(dhES);
-      if (msg.length > 80) {
-        ss.decryptAndHash(msg.slice(80));
-      }
-    },
-    writeMessage3() {
-      if (!remoteEphPub) {
-        throw new Error("noise msg3: must call readMessage2 first");
-      }
-      const encS = ss.encryptAndHash(staticKeyPair.publicKey);
-      const dhSE = sharedKey(staticKeyPair.secretKey, remoteEphPub);
-      ss.mixKey(dhSE);
-      const encPayload = ss.encryptAndHash(new Uint8Array(0));
-      const message = new Uint8Array(encS.length + encPayload.length);
-      message.set(encS);
-      message.set(encPayload, encS.length);
-      const [sendKey, recvKey] = ss.split();
-      return { message, transport: createNoiseTransport(sendKey, recvKey) };
-    }
-  };
-}
-
-// src/session/secureChannel.ts
-var ATTEST_REQUEST_PREFIX = new TextEncoder().encode("invisible-attest-v1\0");
-var DEFAULT_CHANNEL_TIMEOUT_MS = 3e4;
-async function establishSecureChannel(options) {
-  const { transport, endpoint, nonce } = options;
-  const timeoutMs = options.timeoutMs ?? DEFAULT_CHANNEL_TIMEOUT_MS;
-  if (transport.state() !== "open") {
-    throw new TransportError("CONNECTION_LOST", "secure channel requires an open transport");
-  }
-  const inbound = createFrameReader(transport);
-  try {
-    const initiator = createNoiseXXInitiator();
-    transport.send(initiator.writeMessage1());
-    const msg2 = await inbound.next(timeoutMs);
-    try {
-      initiator.readMessage2(msg2);
-    } catch (cause) {
-      throw new TransportError("NOISE_HANDSHAKE_FAILED", `readMessage2 failed: ${String(cause)}`, {
-        cause
-      });
-    }
-    const remoteStaticPublicKey = initiator.remoteStaticPublicKey;
-    if (!remoteStaticPublicKey) {
-      throw new TransportError(
-        "NOISE_HANDSHAKE_FAILED",
-        "missing responder static pubkey after readMessage2"
-      );
-    }
-    let pending;
-    try {
-      const result = initiator.writeMessage3();
-      transport.send(result.message);
-      pending = result.transport;
-    } catch (cause) {
-      throw new TransportError("NOISE_HANDSHAKE_FAILED", `writeMessage3 failed: ${String(cause)}`, {
-        cause
-      });
-    }
-    const nonceHex = bytesToHex(nonce);
-    transport.send(pending.encrypt(encodeAttestationRequest(nonceHex)));
-    const responseFrame = await inbound.next(timeoutMs);
-    let response;
-    try {
-      response = decodeAttestationResponse(pending.decrypt(responseFrame));
-    } catch (cause) {
-      if (cause instanceof AttestationError) throw cause;
-      throw new AttestationError(
-        "NOT_ATTESTED",
-        `failed to decode attestation response: ${String(cause)}`,
-        { cause }
-      );
-    }
-    const policy = toAttestationPolicy(endpoint);
-    const attestation = await verifyAttestation({
-      response,
-      expectedNonce: nonce,
-      expectedNoiseStaticPub: remoteStaticPublicKey,
-      policy,
-      timeoutMs
-    });
-    inbound.detach();
-    return promoteChannel({ transport, cipher: pending, attestation, remoteStaticPublicKey });
-  } catch (err) {
-    inbound.detach();
-    throw err;
-  }
-}
-function toAttestationPolicy(endpoint) {
-  const pin = endpoint.releasePin;
-  const loopback = isLoopbackUrl(endpoint.wsUrl);
-  const allowLocalAttestation = endpoint.allowLocalAttestation === true && loopback && endpoint.requiredMode !== "prod";
-  const policy = {
-    ...pin.intelRootFingerprint ? { intelRootFingerprint: pin.intelRootFingerprint } : {},
-    // "auto" leaves the mode unconstrained; "prod"/"dev" are passed through.
-    ...endpoint.requiredMode !== "auto" ? { requiredMode: endpoint.requiredMode } : {},
-    // Keep the release pin active in prod and auto mode. Dev local attestations
-    // ignore the MRTD pin inside the verifier.
-    expectedMrtd: pin.mrtd,
-    ...pin.binaryHash ? { expectedBinaryHash: pin.binaryHash } : {},
-    ...pin.runtimeProfile ? { expectedRuntimeProfile: pin.runtimeProfile } : {},
-    allowMissingDcapCollateral: pin.allowMissingDcapCollateral === true,
-    allowLocalAttestation
-  };
-  if (pin.azureMaa) {
-    policy.azureMaa = {
-      expectedIssuer: pin.azureMaa.issuer,
-      expectedJwksUrl: pin.azureMaa.jwksUrl,
-      expectedPolicyHash: pin.azureMaa.policyHash
-    };
-  }
-  return policy;
-}
-function promoteChannel(params) {
-  const { transport, cipher, attestation, remoteStaticPublicKey } = params;
-  const handlers = /* @__PURE__ */ new Set();
-  const fatalHandlers = /* @__PURE__ */ new Set();
-  let attestationWaiter = null;
-  let closed = false;
-  const unsubscribeRaw = transport.onMessage((frame) => {
-    if (closed) return;
-    let plaintext;
-    try {
-      plaintext = cipher.decrypt(frame);
-    } catch (cause) {
-      const error = new TransportError(
-        "NOISE_HANDSHAKE_FAILED",
-        `secure channel decrypt failed: ${String(cause)}`,
-        { cause }
-      );
-      fail(error);
-      return;
-    }
-    if (attestationWaiter !== null) {
-      const decoded = decodeAttestationControlFrame(plaintext);
-      if (decoded.kind === "response") {
-        const waiter = attestationWaiter;
-        attestationWaiter = null;
-        clearTimeout(waiter.timer);
-        waiter.resolve(decoded.response);
-        return;
-      }
-      if (decoded.kind === "invalid") {
-        const waiter = attestationWaiter;
-        attestationWaiter = null;
-        clearTimeout(waiter.timer);
-        waiter.reject(decoded.error);
-        return;
-      }
-    }
-    for (const handler of handlers) handler(plaintext);
-  });
-  const unsubscribeState = transport.onStateChange((state) => {
-    if (closed) return;
-    if (state === "closing" || state === "closed") {
-      fail(new TransportError("CONNECTION_LOST", "secure channel transport closed"));
-    }
-  });
-  function close() {
-    if (closed) return;
-    closed = true;
-    handlers.clear();
-    fatalHandlers.clear();
-    if (attestationWaiter !== null) {
-      const waiter = attestationWaiter;
-      attestationWaiter = null;
-      clearTimeout(waiter.timer);
-      waiter.reject(new TransportError("CONNECTION_LOST", "secure channel is closed"));
-    }
-    unsubscribeRaw();
-    unsubscribeState();
-  }
-  function fail(error) {
-    if (closed) return;
-    const notifyHandlers = [...fatalHandlers];
-    for (const handler of notifyHandlers) handler(error);
-    if (!closed) {
-      close();
-      transport.close();
-    }
-  }
-  return {
-    attestation,
-    remoteStaticPublicKey,
-    requestAttestation(nonceHex, timeoutMs) {
-      if (closed) {
-        return Promise.reject(new TransportError("CONNECTION_LOST", "secure channel is closed"));
-      }
-      if (attestationWaiter !== null) {
-        return Promise.reject(
-          new AttestationError("NOT_ATTESTED", "re-attestation is already in flight")
-        );
-      }
-      return new Promise((resolve, reject) => {
-        const timer = setTimeout(() => {
-          if (attestationWaiter === null) return;
-          attestationWaiter = null;
-          reject(
-            new AttestationError("NOT_ATTESTED", `re-attestation timed out after ${timeoutMs}ms`)
-          );
-        }, timeoutMs);
-        attestationWaiter = { resolve, reject, timer };
-        try {
-          transport.send(cipher.encrypt(encodeAttestationRequest(nonceHex)));
-        } catch (cause) {
-          if (attestationWaiter === null) return;
-          attestationWaiter = null;
-          clearTimeout(timer);
-          reject(cause instanceof Error ? cause : new Error(String(cause)));
-        }
-      });
-    },
-    send(plaintext) {
-      if (closed) {
-        throw new TransportError("CONNECTION_LOST", "secure channel is closed");
-      }
-      transport.send(cipher.encrypt(plaintext));
-    },
-    onMessage(handler) {
-      handlers.add(handler);
-      return () => handlers.delete(handler);
-    },
-    onFatal(handler) {
-      fatalHandlers.add(handler);
-      return () => fatalHandlers.delete(handler);
-    },
-    close
-  };
-}
-function createFrameReader(transport) {
-  const queue = [];
-  let waiter = null;
-  let detached = false;
-  const unsubscribeMessage = transport.onMessage((frame) => {
-    if (detached) return;
-    if (waiter) {
-      const w = waiter;
-      waiter = null;
-      w.resolve(frame);
-    } else {
-      queue.push(frame);
-    }
-  });
-  const unsubscribeState = transport.onStateChange((state) => {
-    if (detached) return;
-    if (state === "closing" || state === "closed") {
-      const w = waiter;
-      waiter = null;
-      w?.reject(
-        new TransportError("CONNECTION_LOST", "transport closed during handshake/attestation")
-      );
-    }
-  });
-  function detach() {
-    if (detached) return;
-    detached = true;
-    unsubscribeMessage();
-    unsubscribeState();
-    queue.length = 0;
-  }
-  return {
-    next(timeoutMs) {
-      if (detached) {
-        return Promise.reject(new TransportError("CONNECTION_LOST", "frame reader detached"));
-      }
-      const queued = queue.shift();
-      if (queued) return Promise.resolve(queued);
-      return new Promise((resolve, reject) => {
-        const timer = setTimeout(() => {
-          if (waiter) {
-            waiter = null;
-            reject(
-              new TransportError(
-                "NOISE_HANDSHAKE_FAILED",
-                `timed out waiting for a handshake frame after ${timeoutMs}ms`
-              )
-            );
-          }
-        }, timeoutMs);
-        waiter = {
-          resolve: (f) => {
-            clearTimeout(timer);
-            resolve(f);
-          },
-          reject: (e) => {
-            clearTimeout(timer);
-            reject(e);
-          }
-        };
-      });
-    },
-    detach
-  };
-}
-function decodeAttestationControlFrame(plaintext) {
-  const text = new TextDecoder().decode(plaintext);
-  let body;
-  try {
-    body = JSON.parse(text);
-  } catch {
-    return { kind: "app" };
-  }
-  try {
-    assertAttestResponse(body);
-    return { kind: "response", response: body };
-  } catch (cause) {
-    if (looksLikeAttestationResponse(body)) {
-      return {
-        kind: "invalid",
-        error: cause instanceof AttestationError ? cause : new AttestationError("NOT_ATTESTED", String(cause), { cause })
-      };
-    }
-    return { kind: "app" };
-  }
-}
-function looksLikeAttestationResponse(value) {
-  if (typeof value !== "object" || value === null) return false;
-  const body = value;
-  return "quote" in body || "nonce" in body || "pubkey" in body || "binary_hash" in body || "local_attestation" in body || "maa_token" in body || "tpm_quote" in body || "hcl_keys_json" in body;
-}
-function encodeAttestationRequest(nonceHex) {
-  const nonce = new TextEncoder().encode(nonceHex);
-  const out = new Uint8Array(ATTEST_REQUEST_PREFIX.length + nonce.length);
-  out.set(ATTEST_REQUEST_PREFIX);
-  out.set(nonce, ATTEST_REQUEST_PREFIX.length);
-  return out;
-}
-function decodeAttestationResponse(plaintext) {
-  const text = new TextDecoder().decode(plaintext);
-  let body;
-  try {
-    body = JSON.parse(text);
-  } catch (cause) {
-    throw new AttestationError(
-      "NOT_ATTESTED",
-      `attestation response is not valid JSON: ${String(cause)}`,
-      { cause }
-    );
-  }
-  assertAttestResponse(body);
-  return body;
-}
-function isLoopbackUrl(value) {
-  try {
-    return isLoopbackHostname(new URL(value).hostname);
-  } catch {
-    return false;
-  }
-}
-function isLoopbackHostname(hostname) {
-  const normalized = hostname.toLowerCase();
-  if (normalized === "localhost" || normalized === "::1" || normalized === "[::1]") {
-    return true;
-  }
-  if (isLoopbackIpv4(normalized)) {
-    return true;
-  }
-  if (!normalized.startsWith("[::ffff:") || !normalized.endsWith("]")) {
-    return false;
-  }
-  const mapped = normalized.slice("[::ffff:".length, -1);
-  if (isLoopbackIpv4(mapped)) {
-    return true;
-  }
-  const parts = mapped.split(":");
-  if (parts.length !== 2) {
-    return false;
-  }
-  const high = Number.parseInt(parts[0] ?? "", 16);
-  const low = Number.parseInt(parts[1] ?? "", 16);
-  if (!Number.isInteger(high) || !Number.isInteger(low) || high < 0 || high > 65535 || low < 0 || low > 65535) {
-    return false;
-  }
-  return (high << 16 | low) >>> 24 === 127;
-}
-function isLoopbackIpv4(hostname) {
-  const parts = hostname.split(".");
-  return parts.length === 4 && parts.every((part) => /^\d+$/.test(part)) && Number(parts[0]) === 127 && parts.every((part) => Number(part) >= 0 && Number(part) <= 255);
-}
-function bytesToHex(b) {
-  let s = "";
-  for (let i = 0; i < b.length; i++) s += b[i].toString(16).padStart(2, "0");
-  return s;
-}
-
-// src/transport/handshake.ts
-async function establishAttestedChannel(params) {
-  const { transport, endpoint, nonce, timeoutMs } = params;
-  const channel = await establishSecureChannel({ transport, endpoint, nonce, timeoutMs });
-  const handshake = {
-    noiseStaticPublicKey: channel.remoteStaticPublicKey,
-    channel
-  };
-  const attestation = {
-    mrtd: channel.attestation.mrtd,
-    mode: channel.attestation.mode,
-    binaryHash: channel.attestation.binaryHash,
-    runtimeProfile: channel.attestation.runtimeProfile,
-    pubkeyHex: channel.attestation.pubkeyHex,
-    localAttestation: channel.attestation.localAttestation,
-    rtmr0: channel.attestation.rtmr0,
-    rtmr1: channel.attestation.rtmr1,
-    rtmr2: channel.attestation.rtmr2,
-    rtmr3: channel.attestation.rtmr3,
-    verifiedAtMs: Date.now()
-  };
-  void toAttestationPolicy(endpoint);
-  return { channel, handshake, attestation };
-}
-
-// src/schemas/payoutPolicy.schema.json
-var payoutPolicy_schema_default = {
-  $schema: "https://json-schema.org/draft/2020-12/schema",
-  $id: "https://invisible.exchange/schemas/sdk/payoutPolicy.schema.json",
-  title: "PayoutPolicy",
-  description: "Where and how a contract's output is delivered. V0 normal-user requests accept exactly one destination. Validated locally before submission (spec sections 4.3.1 and 10.1).",
-  type: "object",
-  additionalProperties: false,
-  required: ["destinations"],
-  properties: {
-    destinations: {
-      type: "array",
-      minItems: 1,
-      description: "V0 normal-user requests accept exactly one destination. Multi-address receive is not supported yet.",
-      items: { $ref: "#/$defs/payoutDestination" }
-    },
-    totalDeadlineMs: {
-      type: "integer",
-      minimum: 0,
-      description: "Payout-window selector in milliseconds: 0 for instant, or a currently supported scheduled window duration."
-    },
-    batchExclusionId: {
-      type: "string",
-      description: "Not supported in V0 normal-user requests. Reserved for V1 campaign-scoped batch exclusion; never a stable actor identity."
-    }
-  },
-  $defs: {
-    payoutDestination: {
-      title: "PayoutDestination",
-      type: "object",
-      additionalProperties: false,
-      required: ["address", "sharePercent"],
-      properties: {
-        address: {
-          type: "string",
-          description: "Base58 Solana account address."
-        },
-        sharePercent: {
-          type: "number",
-          minimum: 0,
-          maximum: 100,
-          description: "Share of the payout. Sums to 100 across destinations."
-        },
-        minDelayMs: {
-          type: "integer",
-          minimum: 0,
-          description: "Not supported in V0 normal-user requests; the SDK rejects this field because the current runtime does not honor per-destination delay bounds."
-        },
-        maxDelayMs: {
-          type: "integer",
-          minimum: 0,
-          description: "Not supported in V0 normal-user requests; the SDK rejects this field because the current runtime does not honor per-destination delay bounds."
-        },
-        minLamports: { type: "integer", minimum: 0 }
-      }
-    }
-  }
-};
-
-// src/schemas/coordinatorPoolConfig.schema.json
-var coordinatorPoolConfig_schema_default = {
-  $schema: "https://json-schema.org/draft/2020-12/schema",
-  $id: "https://invisible.exchange/schemas/sdk/coordinatorPoolConfig.schema.json",
-  title: "CoordinatorPoolConfig",
-  description: "The coordinator endpoint pool a session connects through (spec section 6.1). No hostname is baked in; callers supply endpoints (or opt into a preset).",
-  type: "object",
-  additionalProperties: false,
-  required: ["endpoints"],
-  properties: {
-    endpoints: {
-      type: "array",
-      minItems: 1,
-      items: { $ref: "#/$defs/coordinatorEndpoint" }
-    },
-    reattestEveryMs: { type: "integer", minimum: 1 },
-    failoverDebounceMs: { type: "integer", minimum: 0 },
-    maxReconnectAttempts: { type: "integer", minimum: 0 },
-    noiseTransportTimeoutMs: { type: "integer", minimum: 1 },
-    preferLeader: { type: "boolean" },
-    allowedRoles: {
-      type: "array",
-      items: { enum: ["leader", "watcher"] }
-    }
-  },
-  $defs: {
-    coordinatorEndpoint: {
-      title: "CoordinatorEndpoint",
-      type: "object",
-      additionalProperties: false,
-      required: ["wsUrl", "expectedHostname", "releasePin", "requiredMode"],
-      allOf: [
-        {
-          if: {
-            properties: {
-              releasePin: {
-                type: "object",
-                required: ["allowMissingDcapCollateral"],
-                properties: {
-                  allowMissingDcapCollateral: { const: true }
-                }
-              }
-            },
-            required: ["releasePin"]
-          },
-          then: {
-            properties: {
-              requiredMode: { const: "dev" }
-            }
-          }
-        }
-      ],
-      properties: {
-        wsUrl: { type: "string", description: "wss://<host>/ws-noise" },
-        expectedHostname: {
-          type: "string",
-          description: "Must match the SNI / TLS certificate host."
-        },
-        releasePin: { $ref: "#/$defs/releasePin" },
-        requiredMode: { enum: ["prod", "dev", "auto"] },
-        allowLocalAttestation: {
-          type: "boolean",
-          description: "Explicit local-dev fallback opt-in. Honored only for loopback non-prod endpoints."
-        },
-        roleHint: { enum: ["leader", "watcher"] },
-        weight: { type: "number", minimum: 0 }
-      }
-    },
-    releasePin: {
-      title: "CoordinatorReleasePin",
-      type: "object",
-      additionalProperties: false,
-      required: ["mrtd"],
-      properties: {
-        mrtd: { type: "string", description: "Hex MRTD release pin." },
-        binaryHash: {
-          type: "string",
-          pattern: "^[0-9a-fA-F]{64}$",
-          description: "Optional SHA-256 hash of the approved coordinator binary; required for production Azure attestation."
-        },
-        runtimeProfile: {
-          enum: ["prod-hardened", "prod-devnet-simplified"],
-          description: "Optional compile-time coordinator runtime profile; production simplified deployments must pin it."
-        },
-        intelRootFingerprint: {
-          type: "string",
-          description: "Hex SHA-256 of the Intel root cert."
-        },
-        allowMissingDcapCollateral: {
-          type: "boolean",
-          description: "Temporary non-prod legacy escape hatch for coordinators that do not yet emit Intel DCAP collateral."
-        },
-        azureMaa: { $ref: "#/$defs/azureMaaPin" }
-      }
-    },
-    azureMaaPin: {
-      title: "AzureMaaPin",
-      type: "object",
-      additionalProperties: false,
-      required: ["issuer", "jwksUrl", "policyHash"],
-      properties: {
-        issuer: { type: "string" },
-        jwksUrl: { type: "string" },
-        policyHash: { type: "string" }
-      }
-    }
-  }
-};
-
-// src/schemas/lpPositionView.schema.json
-var lpPositionView_schema_default = {
-  $schema: "https://json-schema.org/draft/2020-12/schema",
-  $id: "https://invisible.exchange/schemas/sdk/lpPositionView.schema.json",
-  title: "LpPositionView",
-  description: "The actor-safe LP position projection (spec section 4.4.1). Earned fees are per-position, never aggregated globally.",
-  type: "object",
-  additionalProperties: false,
-  required: [
-    "id",
-    "status",
-    "targetShardCount",
-    "authPublicKey",
-    "refillPublicKey",
-    "withdrawalCommitment",
-    "committedLamports",
-    "earnedLamports",
-    "refillThreshold",
-    "shards",
-    "createdAt"
-  ],
-  properties: {
-    id: { type: "string", description: "lp_position_id" },
-    status: { enum: ["dkg_pending", "active", "withdrawing", "closed"] },
-    targetShardCount: { type: "integer", minimum: 0, maximum: 300 },
-    authPublicKey: {
-      type: "string",
-      description: "Derived from the LP Position Code; signs LP commands."
-    },
-    refillPublicKey: { type: "string", description: "Ed25519, 32 bytes." },
-    withdrawalCommitment: {
-      type: "string",
-      description: "SHA256(withdrawal_secret)."
-    },
-    committedLamports: { type: "integer", minimum: 0 },
-    earnedLamports: { type: "integer", minimum: 0 },
-    refillThreshold: { type: "integer", minimum: 0 },
-    shards: {
-      type: "array",
-      description: "LpInventoryShard[] from the protocol package; opaque to the SDK skeleton.",
-      items: { type: "object" }
-    },
-    createdAt: { type: "integer", minimum: 0 }
-  }
-};
-
-// src/schemas/storageEnvelope.schema.json
-var storageEnvelope_schema_default = {
-  $schema: "https://json-schema.org/draft/2020-12/schema",
-  $id: "https://invisible.exchange/schemas/sdk/storageEnvelope.schema.json",
-  title: "StorageEnvelope",
-  description: "Optional wrapped form for callers or future encrypted storage adapters (spec section 7). Current browser and extension adapters persist caller-supplied bytes; callers decide whether those bytes are plaintext, wrapped, or encrypted.",
-  type: "object",
-  additionalProperties: false,
-  required: ["namespace", "key", "alg", "ciphertext", "createdAtMs"],
-  properties: {
-    namespace: {
-      type: "string",
-      minLength: 1
-    },
-    key: {
-      type: "string",
-      minLength: 1
-    },
-    alg: {
-      enum: ["AES-GCM", "none"],
-      description: "Wrapping algorithm. `none` means the caller supplied bytes without an envelope-level transform."
-    },
-    ciphertext: {
-      type: "string",
-      description: "Base64url-encoded wrapped bytes, encrypted bytes, or caller-supplied plaintext bytes when alg is `none`."
-    },
-    iv: {
-      type: "string",
-      description: "Base64url-encoded AES-GCM nonce; required when alg is AES-GCM."
-    },
-    createdAtMs: {
-      type: "integer",
-      minimum: 0
-    }
-  },
-  allOf: [
-    {
-      if: {
-        properties: { alg: { const: "AES-GCM" } },
-        required: ["alg"]
-      },
-      then: {
-        properties: { iv: { type: "string" } },
-        required: ["iv"]
-      }
-    }
-  ]
-};
-
-// src/validation/ajv.ts
-var ajv = new Ajv2020({ allErrors: true, strict: true });
-var validatePayoutPolicyShape = ajv.compile(payoutPolicy_schema_default);
-var validateCoordinatorPoolConfigShape = ajv.compile(coordinatorPoolConfig_schema_default);
-ajv.compile(lpPositionView_schema_default);
-ajv.compile(storageEnvelope_schema_default);
-function formatAjvErrors(errors) {
-  if (!errors || errors.length === 0) return "schema validation failed";
-  return errors.map((e) => `${e.instancePath || "(root)"} ${e.message ?? "is invalid"}`.trim()).join("; ");
-}
-
-// src/attestation/reattest.ts
-var DEFAULT_REATTEST_TIMEOUT_MS = 3e4;
-async function reattest(state, endpoint, timeoutMs = DEFAULT_REATTEST_TIMEOUT_MS) {
-  const { channel, remoteStaticPublicKey } = state;
-  if (channel === null || remoteStaticPublicKey === null) {
-    throw new TransportError("CONNECTION_LOST", "re-attestation requires a live attested channel");
-  }
-  const nonce = crypto.getRandomValues(new Uint8Array(32));
-  const response = await channel.requestAttestation(toHex(nonce), timeoutMs);
-  const metadata = await verifyAttestation({
-    response,
-    expectedNonce: nonce,
-    expectedNoiseStaticPub: remoteStaticPublicKey,
-    policy: toAttestationPolicy(endpoint),
-    timeoutMs
-  });
-  return {
-    mrtd: metadata.mrtd,
-    mode: metadata.mode,
-    binaryHash: metadata.binaryHash,
-    runtimeProfile: metadata.runtimeProfile,
-    pubkeyHex: metadata.pubkeyHex,
-    localAttestation: metadata.localAttestation,
-    rtmr0: metadata.rtmr0,
-    rtmr1: metadata.rtmr1,
-    rtmr2: metadata.rtmr2,
-    rtmr3: metadata.rtmr3,
-    verifiedAtMs: Date.now()
-  };
-}
-function reattestSerialized(state, endpoint, timeoutMs = DEFAULT_REATTEST_TIMEOUT_MS) {
-  if (state.reattestPromise !== null) {
-    return state.reattestPromise;
-  }
-  const promise = Promise.resolve().then(() => reattest(state, endpoint, timeoutMs)).finally(() => {
-    if (state.reattestPromise === promise) {
-      state.reattestPromise = null;
-    }
-  });
-  state.reattestPromise = promise;
-  return promise;
-}
-function toHex(b) {
-  let s = "";
-  for (let i = 0; i < b.length; i++) s += b[i].toString(16).padStart(2, "0");
-  return s;
-}
-
-// src/session/createSession.ts
-var REATTEST_EVERY_MS = 9e5;
-async function createSessionInternal(options) {
-  const { coordinator } = options;
-  if (!validateCoordinatorPoolConfigShape(coordinator)) {
-    throw new Error(
-      `invalid coordinator pool config: ${formatAjvErrors(validateCoordinatorPoolConfigShape.errors)}`
-    );
-  }
-  const endpoint = coordinator.endpoints[0];
-  assertExpectedHostname(endpoint);
-  const timeoutMs = coordinator.noiseTransportTimeoutMs;
-  const transport = options.transport ?? noiseWebSocketTransport({ wsUrl: endpoint.wsUrl, connectTimeoutMs: timeoutMs });
-  await transport.connect(options.signal);
-  const nonce = crypto.getRandomValues(new Uint8Array(32));
-  let established;
-  try {
-    established = await abortableSessionEstablishment(
-      establishAttestedChannel({ transport, endpoint, nonce, timeoutMs }),
-      transport,
-      options.signal
-    );
-  } catch (err) {
-    transport.close();
-    throw err;
-  }
-  const state = {
-    attested: true,
-    transport,
-    pool: coordinator,
-    attestation: established.attestation,
-    channel: established.channel,
-    nonce,
-    remoteStaticPublicKey: established.handshake.noiseStaticPublicKey,
-    reattestTimer: null,
-    reattestPromise: null,
-    lastFatalError: null,
-    policyViolationHandlers: /* @__PURE__ */ new Set(),
-    close() {
-      closeSessionState(this);
-    }
-  };
-  established.channel.onFatal((error) => failSessionClosed(state, error));
-  scheduleReattest(state, endpoint);
-  return createSessionHandle(state);
-}
-function abortableSessionEstablishment(establishment, transport, signal) {
-  if (signal === void 0) return establishment;
-  if (signal.aborted) {
-    transport.close();
-    return Promise.reject(createSessionAbortError());
-  }
-  return new Promise((resolve, reject) => {
-    const onAbort = () => {
-      transport.close();
-      reject(createSessionAbortError());
-    };
-    signal.addEventListener("abort", onAbort, { once: true });
-    void establishment.then(resolve, reject).finally(() => {
-      signal.removeEventListener("abort", onAbort);
-    });
-  });
-}
-function createSessionAbortError() {
-  return new TransportError("CONNECTION_LOST", "session establishment aborted");
-}
-var createSession = createSessionInternal;
-function assertExpectedHostname(endpoint) {
-  let hostname;
-  try {
-    hostname = new URL(endpoint.wsUrl).hostname;
-  } catch (err) {
-    const error = new Error(`invalid coordinator wsUrl: ${endpoint.wsUrl}`);
-    error.cause = err;
-    throw error;
-  }
-  if (hostname.toLowerCase() !== endpoint.expectedHostname.toLowerCase()) {
-    throw new Error(
-      `coordinator endpoint hostname ${hostname} does not match expectedHostname ${endpoint.expectedHostname}`
-    );
-  }
-}
-function closeSession(session) {
-  getSessionState(session).close();
-}
-function scheduleReattest(state, endpoint) {
-  if (state.channel === null) return;
-  const reattestEveryMs = state.pool.reattestEveryMs ?? REATTEST_EVERY_MS;
-  const timer = setTimeout(() => {
-    void runReattest(state, endpoint);
-  }, reattestEveryMs);
-  if (typeof timer === "object" && timer !== null && "unref" in timer) {
-    timer.unref();
-  }
-  state.reattestTimer = timer;
-}
-async function runReattest(state, endpoint) {
-  state.reattestTimer = null;
-  if (state.channel === null || state.nonce === null || state.remoteStaticPublicKey === null) {
-    return;
-  }
-  try {
-    state.attestation = await reattestSerialized(
-      state,
-      endpoint,
-      state.pool.noiseTransportTimeoutMs
-    );
-    state.attested = true;
-    scheduleReattest(state, endpoint);
-  } catch (err) {
-    const error = err instanceof Error ? err : new Error(String(err));
-    failSessionClosed(state, error);
-  }
-}
-
-export { closeSession, createExponentialBackoff, createSession, createSessionInternal, createStateController, formatAjvErrors, isLoopbackUrl, noiseWebSocketTransport, reattestSerialized, validatePayoutPolicyShape };
-//# sourceMappingURL=chunk-5NNEO7IK.js.map
-//# sourceMappingURL=chunk-5NNEO7IK.js.map