@learncard/sss-key-manager 0.1.24 → 0.2.1

package/src/__fixtures__/nitro-attestation/manifest.json

@@ -0,0 +1,60 @@
+{
+    "cases": {
+        "bad-signature": {
+            "accept": false,
+            "reason": "signature"
+        },
+        "debug-zero-pcrs": {
+            "accept": false,
+            "reason": "debug PCRs"
+        },
+        "legacy-user-data": {
+            "accept": true,
+            "previousKeyIds": []
+        },
+        "nonce-mismatch": {
+            "accept": false,
+            "nonceHex": "0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+            "reason": "nonce"
+        },
+        "stale-timestamp": {
+            "accept": false,
+            "reason": "freshness"
+        },
+        "tampered-previous-key-ids": {
+            "accept": false,
+            "reason": "signature"
+        },
+        "truncated-chain": {
+            "accept": false,
+            "reason": "missing intermediate"
+        },
+        "valid": {
+            "accept": true
+        },
+        "wrong-pcr0": {
+            "accept": false,
+            "reason": "pcr"
+        },
+        "wrong-root": {
+            "accept": false,
+            "reason": "root pin"
+        }
+    },
+    "description": "Public fake CA, never trust in production. Freeze verifier clock to nowMs. Certificates valid 2020-2050. userDataBase64 was generated once by crypto::generate_escrow_key_pair; regeneration reuses it. keyId/previousKeyIds (P9.1) are fixture-only labels bound into the canonical-CBOR user_data wrapper, distinct from userDataBase64 (the escrow SPKI itself, still extracted identically from either user_data format).",
+    "keyId": "fixture-key",
+    "maxAgeMs": 300000,
+    "nonceHex": "0909090909090909090909090909090909090909090909090909090909090909",
+    "nowMs": 1790294401000,
+    "pcrs": {
+        "0": "010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101",
+        "1": "020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202",
+        "2": "030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303"
+    },
+    "previousKeyIds": ["fixture-previous-key"],
+    "publicKeyBase64": null,
+    "rootSha256": "d71ae13f792676894bf8549178ea45acc360b1935e628f678d9e2f3befae9dfe",
+    "testOnly": true,
+    "timestamp": 1790294400000,
+    "userDataBase64": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEnX5GwyaaFpFYdl7m9ft+aF3MG6GanWFe7rvTqEGNoojfQtaaRXWNmYbC9affj2Twoy2RlWkOTGFETJQC5/f93w=="
+}

package/src/__fixtures__/nitro-attestation/nonce-mismatch.cbor.b64

@@ -0,0 +1 @@
+hEShATgioFkKBalpbW9kdWxlX2lkeBxsZWFybmNhcmQtZmFrZS1uc20tVEVTVC1PTkxZZmRpZ2VzdGZTSEEzODRpdGltZXN0YW1wGwAAAaDV3JwAZHBjcnOwAFgwAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAVgwAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAlgwAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDA1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABFgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABVgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABlgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACFgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACVgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAClgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADFgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADVgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADlgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAa2NlcnRpZmljYXRlWQHrMIIB5zCCAW6gAwIBAgIBAzAKBggqhkjOPQQDAzAxMS8wLQYDVQQDDCZMZWFybkNhcmQgVEVTVCBPTkxZIE5pdHJvIEludGVybWVkaWF0ZTAgFw0yMDAxMDEwMDAwMDBaGA8yMDUwMDEwMTAwMDAwMFowKTEnMCUGA1UEAwweTGVhcm5DYXJkIFRFU1QgT05MWSBOaXRybyBMZWFmMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEdQabXARWaQiOuZ0QS62W7zyoYWXFX0SRGecTMHxr6Sy0WYLodow0Zh9kA2z/PJMEbTFczp0cEKI5ARnMoqH/3jQce8MenSb96Us9FiinYg35Z0F1QXY1fkOGfA65UyXZo2AwXjAdBgNVHQ4EFgQUt2vMI6fK0TeuRX9Gj/Ci4qt4UxswHwYDVR0jBBgwFoAU9rnIupQhj3sUlPlGC7/i+CjpXWEwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCBsAwCgYIKoZIzj0EAwMDZwAwZAIxAP6kP6OfQ8hfRNIBKHqYLzulqDhpHF/ELggbaekIp3y8g8+cS2iDFGJHU7Nwxgo9cAIvbkcqbnWXD4KVfvm2Fu74C0k52WHIeFHWo3gWoZl4xUoJNcbAwl/K7dUzroJ5eYpoY2FidW5kbGWCWQHGMIIBwjCCAUigAwIBAgIBATAKBggqhkjOPQQDAzApMScwJQYDVQQDDB5MZWFybkNhcmQgVEVTVCBPTkxZIE5pdHJvIFJvb3QwIBcNMjAwMTAxMDAwMDAwWhgPMjA1MDAxMDEwMDAwMDBaMCkxJzAlBgNVBAMMHkxlYXJuQ2FyZCBURVNUIE9OTFkgTml0cm8gUm9vdDB2MBAGByqGSM49AgEGBSuBBAAiA2IABBck9uTlAFdttlkj3wkMkhPJrXNJONf0FdJ5LLG8snfdW2PcZRQBGONRWfeZRqriSz+YkAODjFMLLnsBgWoBqER90QsPa2AG4OjfOPIlmTHBqdjVRJ2zVK76DOKqU5xinaNCMEAwHQYDVR0OBBYEFH5W2DvY+F7QW1n4UyVGh7YW3YnbMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMDA2gAMGUCMQC3icReCK/AVxSDJpCGMMq06g5DlbIYg1Tg9Ad+cZvYD0yr0ZuomoKL4B8JI0GBGiUCMFkQ4nGjuxzQu9jc7gb3O2UEhxivT2I2/8/PNwOH2sbZ/YY5Za+AsWQ2vgbabHJxY1kB8jCCAe4wggF0oAMCAQICAQIwCgYIKoZIzj0EAwMwKTEnMCUGA1UEAwweTGVhcm5DYXJkIFRFU1QgT05MWSBOaXRybyBSb290MCAXDTIwMDEwMTAwMDAwMFoYDzIwNTAwMTAxMDAwMDAwWjAxMS8wLQYDVQQDDCZMZWFybkNhcmQgVEVTVCBPTkxZIE5pdHJvIEludGVybWVkaWF0ZTB2MBAGByqGSM49AgEGBSuBBAAiA2IABGS45j1AmR2mOP/f8437hRypn8X88Gri0F3ukeQ6vAG6vgPWXpMm5DJWySsP5xqe1y4xuoSSSl/ECo5g/go+ppuXWg2YmGwFmFAw18mi39YtH2zYd/lY03T+gqvBRHIVlqNmMGQwHQYDVR0OBBYEFPa5yLqUIY97FJT5Rgu/4vgo6V1hMB8GA1UdIwQYMBaAFH5W2DvY+F7QW1n4UyVGh7YW3YnbMBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMDA2gAMGUCMQDWVUT93T7YGS5rcopboRgTcmJqOTd9j1WNnm3bSAaU8iKmgQYr+bh4VP6mA0BSREYCMB9MkGP7KwnI4P1vdBlOmGQ5FgSacsqJavHR/e38iEi/DqaemC/sZVXODSpn6ImgRGpwdWJsaWNfa2V59ml1c2VyX2RhdGFYg6MAWFswWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASdfkbDJpoWkVh2Xub1+35oXcwboZqdYV7uu9OoQY2iiN9C1ppFdY2ZhsL1p9+PZPCjLZGVaQ5MYURMlALn9/3fAWtmaXh0dXJlLWtleQKBdGZpeHR1cmUtcHJldmlvdXMta2V5ZW5vbmNlWCAJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCVhg+mTWJjdzf8nTM2L5oHpV431U8iAA0BKgTMK4nDXUNb2XAUrtR1sUMhYfhN2zFRWXdGjVcKvoQHBSl+VGlyS2tAvwpM77dC1VagmQzfONA83TTIId6j8NBpL+knXYzpVS

package/src/__fixtures__/nitro-attestation/root.pem

@@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE-----
+MIIBwjCCAUigAwIBAgIBATAKBggqhkjOPQQDAzApMScwJQYDVQQDDB5MZWFybkNh
+cmQgVEVTVCBPTkxZIE5pdHJvIFJvb3QwIBcNMjAwMTAxMDAwMDAwWhgPMjA1MDAx
+MDEwMDAwMDBaMCkxJzAlBgNVBAMMHkxlYXJuQ2FyZCBURVNUIE9OTFkgTml0cm8g
+Um9vdDB2MBAGByqGSM49AgEGBSuBBAAiA2IABBck9uTlAFdttlkj3wkMkhPJrXNJ
+ONf0FdJ5LLG8snfdW2PcZRQBGONRWfeZRqriSz+YkAODjFMLLnsBgWoBqER90QsP
+a2AG4OjfOPIlmTHBqdjVRJ2zVK76DOKqU5xinaNCMEAwHQYDVR0OBBYEFH5W2DvY
++F7QW1n4UyVGh7YW3YnbMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEG
+MAoGCCqGSM49BAMDA2gAMGUCMQC3icReCK/AVxSDJpCGMMq06g5DlbIYg1Tg9Ad+
+cZvYD0yr0ZuomoKL4B8JI0GBGiUCMFkQ4nGjuxzQu9jc7gb3O2UEhxivT2I2/8/P
+NwOH2sbZ/YY5Za+AsWQ2vgbabHJxYw==
+-----END CERTIFICATE-----

package/src/__fixtures__/nitro-attestation/stale-timestamp.cbor.b64

@@ -0,0 +1 @@
+hEShATgioFkKBalpbW9kdWxlX2lkeBxsZWFybmNhcmQtZmFrZS1uc20tVEVTVC1PTkxZZmRpZ2VzdGZTSEEzODRpdGltZXN0YW1wGwAAAaDV03RAZHBjcnOwAFgwAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAVgwAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAlgwAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDA1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABFgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABVgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABlgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACFgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACVgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAClgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADFgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADVgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADlgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAa2NlcnRpZmljYXRlWQHrMIIB5zCCAW6gAwIBAgIBAzAKBggqhkjOPQQDAzAxMS8wLQYDVQQDDCZMZWFybkNhcmQgVEVTVCBPTkxZIE5pdHJvIEludGVybWVkaWF0ZTAgFw0yMDAxMDEwMDAwMDBaGA8yMDUwMDEwMTAwMDAwMFowKTEnMCUGA1UEAwweTGVhcm5DYXJkIFRFU1QgT05MWSBOaXRybyBMZWFmMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEdQabXARWaQiOuZ0QS62W7zyoYWXFX0SRGecTMHxr6Sy0WYLodow0Zh9kA2z/PJMEbTFczp0cEKI5ARnMoqH/3jQce8MenSb96Us9FiinYg35Z0F1QXY1fkOGfA65UyXZo2AwXjAdBgNVHQ4EFgQUt2vMI6fK0TeuRX9Gj/Ci4qt4UxswHwYDVR0jBBgwFoAU9rnIupQhj3sUlPlGC7/i+CjpXWEwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCBsAwCgYIKoZIzj0EAwMDZwAwZAIxAP6kP6OfQ8hfRNIBKHqYLzulqDhpHF/ELggbaekIp3y8g8+cS2iDFGJHU7Nwxgo9cAIvbkcqbnWXD4KVfvm2Fu74C0k52WHIeFHWo3gWoZl4xUoJNcbAwl/K7dUzroJ5eYpoY2FidW5kbGWCWQHGMIIBwjCCAUigAwIBAgIBATAKBggqhkjOPQQDAzApMScwJQYDVQQDDB5MZWFybkNhcmQgVEVTVCBPTkxZIE5pdHJvIFJvb3QwIBcNMjAwMTAxMDAwMDAwWhgPMjA1MDAxMDEwMDAwMDBaMCkxJzAlBgNVBAMMHkxlYXJuQ2FyZCBURVNUIE9OTFkgTml0cm8gUm9vdDB2MBAGByqGSM49AgEGBSuBBAAiA2IABBck9uTlAFdttlkj3wkMkhPJrXNJONf0FdJ5LLG8snfdW2PcZRQBGONRWfeZRqriSz+YkAODjFMLLnsBgWoBqER90QsPa2AG4OjfOPIlmTHBqdjVRJ2zVK76DOKqU5xinaNCMEAwHQYDVR0OBBYEFH5W2DvY+F7QW1n4UyVGh7YW3YnbMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMDA2gAMGUCMQC3icReCK/AVxSDJpCGMMq06g5DlbIYg1Tg9Ad+cZvYD0yr0ZuomoKL4B8JI0GBGiUCMFkQ4nGjuxzQu9jc7gb3O2UEhxivT2I2/8/PNwOH2sbZ/YY5Za+AsWQ2vgbabHJxY1kB8jCCAe4wggF0oAMCAQICAQIwCgYIKoZIzj0EAwMwKTEnMCUGA1UEAwweTGVhcm5DYXJkIFRFU1QgT05MWSBOaXRybyBSb290MCAXDTIwMDEwMTAwMDAwMFoYDzIwNTAwMTAxMDAwMDAwWjAxMS8wLQYDVQQDDCZMZWFybkNhcmQgVEVTVCBPTkxZIE5pdHJvIEludGVybWVkaWF0ZTB2MBAGByqGSM49AgEGBSuBBAAiA2IABGS45j1AmR2mOP/f8437hRypn8X88Gri0F3ukeQ6vAG6vgPWXpMm5DJWySsP5xqe1y4xuoSSSl/ECo5g/go+ppuXWg2YmGwFmFAw18mi39YtH2zYd/lY03T+gqvBRHIVlqNmMGQwHQYDVR0OBBYEFPa5yLqUIY97FJT5Rgu/4vgo6V1hMB8GA1UdIwQYMBaAFH5W2DvY+F7QW1n4UyVGh7YW3YnbMBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMDA2gAMGUCMQDWVUT93T7YGS5rcopboRgTcmJqOTd9j1WNnm3bSAaU8iKmgQYr+bh4VP6mA0BSREYCMB9MkGP7KwnI4P1vdBlOmGQ5FgSacsqJavHR/e38iEi/DqaemC/sZVXODSpn6ImgRGpwdWJsaWNfa2V59ml1c2VyX2RhdGFYg6MAWFswWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASdfkbDJpoWkVh2Xub1+35oXcwboZqdYV7uu9OoQY2iiN9C1ppFdY2ZhsL1p9+PZPCjLZGVaQ5MYURMlALn9/3fAWtmaXh0dXJlLWtleQKBdGZpeHR1cmUtcHJldmlvdXMta2V5ZW5vbmNlWCAJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCVhgUJxwm8doTkSFkGNunxxkpA1eYM+293d34HCJGUGHo3IJ5DhiXutU6jmiNNcNzpC15A5/MTdFiX9zX4YTXPkOjyoFpMAghMb9azjnCWCJtvg3xhxNLwLDaXUMziKbL2cP

package/src/__fixtures__/nitro-attestation/tampered-previous-key-ids.cbor.b64

@@ -0,0 +1 @@
+hEShATgioFkKBalpbW9kdWxlX2lkeBxsZWFybmNhcmQtZmFrZS1uc20tVEVTVC1PTkxZZmRpZ2VzdGZTSEEzODRpdGltZXN0YW1wGwAAAaDV3JwAZHBjcnOwAFgwAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAVgwAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAlgwAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDA1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABFgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABVgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABlgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACFgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACVgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAClgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADFgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADVgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADlgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAa2NlcnRpZmljYXRlWQHrMIIB5zCCAW6gAwIBAgIBAzAKBggqhkjOPQQDAzAxMS8wLQYDVQQDDCZMZWFybkNhcmQgVEVTVCBPTkxZIE5pdHJvIEludGVybWVkaWF0ZTAgFw0yMDAxMDEwMDAwMDBaGA8yMDUwMDEwMTAwMDAwMFowKTEnMCUGA1UEAwweTGVhcm5DYXJkIFRFU1QgT05MWSBOaXRybyBMZWFmMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEdQabXARWaQiOuZ0QS62W7zyoYWXFX0SRGecTMHxr6Sy0WYLodow0Zh9kA2z/PJMEbTFczp0cEKI5ARnMoqH/3jQce8MenSb96Us9FiinYg35Z0F1QXY1fkOGfA65UyXZo2AwXjAdBgNVHQ4EFgQUt2vMI6fK0TeuRX9Gj/Ci4qt4UxswHwYDVR0jBBgwFoAU9rnIupQhj3sUlPlGC7/i+CjpXWEwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCBsAwCgYIKoZIzj0EAwMDZwAwZAIxAP6kP6OfQ8hfRNIBKHqYLzulqDhpHF/ELggbaekIp3y8g8+cS2iDFGJHU7Nwxgo9cAIvbkcqbnWXD4KVfvm2Fu74C0k52WHIeFHWo3gWoZl4xUoJNcbAwl/K7dUzroJ5eYpoY2FidW5kbGWCWQHGMIIBwjCCAUigAwIBAgIBATAKBggqhkjOPQQDAzApMScwJQYDVQQDDB5MZWFybkNhcmQgVEVTVCBPTkxZIE5pdHJvIFJvb3QwIBcNMjAwMTAxMDAwMDAwWhgPMjA1MDAxMDEwMDAwMDBaMCkxJzAlBgNVBAMMHkxlYXJuQ2FyZCBURVNUIE9OTFkgTml0cm8gUm9vdDB2MBAGByqGSM49AgEGBSuBBAAiA2IABBck9uTlAFdttlkj3wkMkhPJrXNJONf0FdJ5LLG8snfdW2PcZRQBGONRWfeZRqriSz+YkAODjFMLLnsBgWoBqER90QsPa2AG4OjfOPIlmTHBqdjVRJ2zVK76DOKqU5xinaNCMEAwHQYDVR0OBBYEFH5W2DvY+F7QW1n4UyVGh7YW3YnbMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMDA2gAMGUCMQC3icReCK/AVxSDJpCGMMq06g5DlbIYg1Tg9Ad+cZvYD0yr0ZuomoKL4B8JI0GBGiUCMFkQ4nGjuxzQu9jc7gb3O2UEhxivT2I2/8/PNwOH2sbZ/YY5Za+AsWQ2vgbabHJxY1kB8jCCAe4wggF0oAMCAQICAQIwCgYIKoZIzj0EAwMwKTEnMCUGA1UEAwweTGVhcm5DYXJkIFRFU1QgT05MWSBOaXRybyBSb290MCAXDTIwMDEwMTAwMDAwMFoYDzIwNTAwMTAxMDAwMDAwWjAxMS8wLQYDVQQDDCZMZWFybkNhcmQgVEVTVCBPTkxZIE5pdHJvIEludGVybWVkaWF0ZTB2MBAGByqGSM49AgEGBSuBBAAiA2IABGS45j1AmR2mOP/f8437hRypn8X88Gri0F3ukeQ6vAG6vgPWXpMm5DJWySsP5xqe1y4xuoSSSl/ECo5g/go+ppuXWg2YmGwFmFAw18mi39YtH2zYd/lY03T+gqvBRHIVlqNmMGQwHQYDVR0OBBYEFPa5yLqUIY97FJT5Rgu/4vgo6V1hMB8GA1UdIwQYMBaAFH5W2DvY+F7QW1n4UyVGh7YW3YnbMBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMDA2gAMGUCMQDWVUT93T7YGS5rcopboRgTcmJqOTd9j1WNnm3bSAaU8iKmgQYr+bh4VP6mA0BSREYCMB9MkGP7KwnI4P1vdBlOmGQ5FgSacsqJavHR/e38iEi/DqaemC/sZVXODSpn6ImgRGpwdWJsaWNfa2V59ml1c2VyX2RhdGFYg6MAWFswWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASdfkbDJpoWkVh2Xub1+35oXcwboZqdYV7uu9OoQY2iiN9C1ppFdY2ZhsL1p9+PZPCjLZGVaQ5MYURMlALn9/3fAWtmaXh0dXJlLWtleQKBdGZpeHR1cmUtcHJldmlvdXMta2V4ZW5vbmNlWCAJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCVhg+mTWJjdzf8nTM2L5oHpV431U8iAA0BKgTMK4nDXUNb2XAUrtR1sUMhYfhN2zFRWXdGjVcKvoQHBSl+VGlyS2tAvwpM77dC1VagmQzfONA83TTIId6j8NBpL+knXYzpVS

package/src/__fixtures__/nitro-attestation/truncated-chain.cbor.b64

@@ -0,0 +1 @@
+hEShATgioFkIEKlpbW9kdWxlX2lkeBxsZWFybmNhcmQtZmFrZS1uc20tVEVTVC1PTkxZZmRpZ2VzdGZTSEEzODRpdGltZXN0YW1wGwAAAaDV3JwAZHBjcnOwAFgwAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAVgwAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAlgwAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDA1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABFgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABVgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABlgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACFgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACVgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAClgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADFgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADVgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADlgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAa2NlcnRpZmljYXRlWQHrMIIB5zCCAW6gAwIBAgIBAzAKBggqhkjOPQQDAzAxMS8wLQYDVQQDDCZMZWFybkNhcmQgVEVTVCBPTkxZIE5pdHJvIEludGVybWVkaWF0ZTAgFw0yMDAxMDEwMDAwMDBaGA8yMDUwMDEwMTAwMDAwMFowKTEnMCUGA1UEAwweTGVhcm5DYXJkIFRFU1QgT05MWSBOaXRybyBMZWFmMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEdQabXARWaQiOuZ0QS62W7zyoYWXFX0SRGecTMHxr6Sy0WYLodow0Zh9kA2z/PJMEbTFczp0cEKI5ARnMoqH/3jQce8MenSb96Us9FiinYg35Z0F1QXY1fkOGfA65UyXZo2AwXjAdBgNVHQ4EFgQUt2vMI6fK0TeuRX9Gj/Ci4qt4UxswHwYDVR0jBBgwFoAU9rnIupQhj3sUlPlGC7/i+CjpXWEwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCBsAwCgYIKoZIzj0EAwMDZwAwZAIxAP6kP6OfQ8hfRNIBKHqYLzulqDhpHF/ELggbaekIp3y8g8+cS2iDFGJHU7Nwxgo9cAIvbkcqbnWXD4KVfvm2Fu74C0k52WHIeFHWo3gWoZl4xUoJNcbAwl/K7dUzroJ5eYpoY2FidW5kbGWBWQHGMIIBwjCCAUigAwIBAgIBATAKBggqhkjOPQQDAzApMScwJQYDVQQDDB5MZWFybkNhcmQgVEVTVCBPTkxZIE5pdHJvIFJvb3QwIBcNMjAwMTAxMDAwMDAwWhgPMjA1MDAxMDEwMDAwMDBaMCkxJzAlBgNVBAMMHkxlYXJuQ2FyZCBURVNUIE9OTFkgTml0cm8gUm9vdDB2MBAGByqGSM49AgEGBSuBBAAiA2IABBck9uTlAFdttlkj3wkMkhPJrXNJONf0FdJ5LLG8snfdW2PcZRQBGONRWfeZRqriSz+YkAODjFMLLnsBgWoBqER90QsPa2AG4OjfOPIlmTHBqdjVRJ2zVK76DOKqU5xinaNCMEAwHQYDVR0OBBYEFH5W2DvY+F7QW1n4UyVGh7YW3YnbMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMDA2gAMGUCMQC3icReCK/AVxSDJpCGMMq06g5DlbIYg1Tg9Ad+cZvYD0yr0ZuomoKL4B8JI0GBGiUCMFkQ4nGjuxzQu9jc7gb3O2UEhxivT2I2/8/PNwOH2sbZ/YY5Za+AsWQ2vgbabHJxY2pwdWJsaWNfa2V59ml1c2VyX2RhdGFYg6MAWFswWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASdfkbDJpoWkVh2Xub1+35oXcwboZqdYV7uu9OoQY2iiN9C1ppFdY2ZhsL1p9+PZPCjLZGVaQ5MYURMlALn9/3fAWtmaXh0dXJlLWtleQKBdGZpeHR1cmUtcHJldmlvdXMta2V5ZW5vbmNlWCAJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCVhg0PSPR8DYb+KiEaIsFE6SHvGYPS56liqy4pZ+Uzs+WSjNImqTT4xLY4xokR4b4dxYvWmHK4xKxhBv1WNNg628VZrcnCYTkuU31tfNLQsThG6Kfrz7siuhI2yUo2xPcYDW

package/src/__fixtures__/nitro-attestation/valid.cbor.b64

@@ -0,0 +1 @@
+hEShATgioFkKBalpbW9kdWxlX2lkeBxsZWFybmNhcmQtZmFrZS1uc20tVEVTVC1PTkxZZmRpZ2VzdGZTSEEzODRpdGltZXN0YW1wGwAAAaDV3JwAZHBjcnOwAFgwAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAVgwAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAlgwAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDA1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABFgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABVgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABlgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACFgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACVgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAClgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADFgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADVgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADlgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAa2NlcnRpZmljYXRlWQHrMIIB5zCCAW6gAwIBAgIBAzAKBggqhkjOPQQDAzAxMS8wLQYDVQQDDCZMZWFybkNhcmQgVEVTVCBPTkxZIE5pdHJvIEludGVybWVkaWF0ZTAgFw0yMDAxMDEwMDAwMDBaGA8yMDUwMDEwMTAwMDAwMFowKTEnMCUGA1UEAwweTGVhcm5DYXJkIFRFU1QgT05MWSBOaXRybyBMZWFmMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEdQabXARWaQiOuZ0QS62W7zyoYWXFX0SRGecTMHxr6Sy0WYLodow0Zh9kA2z/PJMEbTFczp0cEKI5ARnMoqH/3jQce8MenSb96Us9FiinYg35Z0F1QXY1fkOGfA65UyXZo2AwXjAdBgNVHQ4EFgQUt2vMI6fK0TeuRX9Gj/Ci4qt4UxswHwYDVR0jBBgwFoAU9rnIupQhj3sUlPlGC7/i+CjpXWEwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCBsAwCgYIKoZIzj0EAwMDZwAwZAIxAP6kP6OfQ8hfRNIBKHqYLzulqDhpHF/ELggbaekIp3y8g8+cS2iDFGJHU7Nwxgo9cAIvbkcqbnWXD4KVfvm2Fu74C0k52WHIeFHWo3gWoZl4xUoJNcbAwl/K7dUzroJ5eYpoY2FidW5kbGWCWQHGMIIBwjCCAUigAwIBAgIBATAKBggqhkjOPQQDAzApMScwJQYDVQQDDB5MZWFybkNhcmQgVEVTVCBPTkxZIE5pdHJvIFJvb3QwIBcNMjAwMTAxMDAwMDAwWhgPMjA1MDAxMDEwMDAwMDBaMCkxJzAlBgNVBAMMHkxlYXJuQ2FyZCBURVNUIE9OTFkgTml0cm8gUm9vdDB2MBAGByqGSM49AgEGBSuBBAAiA2IABBck9uTlAFdttlkj3wkMkhPJrXNJONf0FdJ5LLG8snfdW2PcZRQBGONRWfeZRqriSz+YkAODjFMLLnsBgWoBqER90QsPa2AG4OjfOPIlmTHBqdjVRJ2zVK76DOKqU5xinaNCMEAwHQYDVR0OBBYEFH5W2DvY+F7QW1n4UyVGh7YW3YnbMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMDA2gAMGUCMQC3icReCK/AVxSDJpCGMMq06g5DlbIYg1Tg9Ad+cZvYD0yr0ZuomoKL4B8JI0GBGiUCMFkQ4nGjuxzQu9jc7gb3O2UEhxivT2I2/8/PNwOH2sbZ/YY5Za+AsWQ2vgbabHJxY1kB8jCCAe4wggF0oAMCAQICAQIwCgYIKoZIzj0EAwMwKTEnMCUGA1UEAwweTGVhcm5DYXJkIFRFU1QgT05MWSBOaXRybyBSb290MCAXDTIwMDEwMTAwMDAwMFoYDzIwNTAwMTAxMDAwMDAwWjAxMS8wLQYDVQQDDCZMZWFybkNhcmQgVEVTVCBPTkxZIE5pdHJvIEludGVybWVkaWF0ZTB2MBAGByqGSM49AgEGBSuBBAAiA2IABGS45j1AmR2mOP/f8437hRypn8X88Gri0F3ukeQ6vAG6vgPWXpMm5DJWySsP5xqe1y4xuoSSSl/ECo5g/go+ppuXWg2YmGwFmFAw18mi39YtH2zYd/lY03T+gqvBRHIVlqNmMGQwHQYDVR0OBBYEFPa5yLqUIY97FJT5Rgu/4vgo6V1hMB8GA1UdIwQYMBaAFH5W2DvY+F7QW1n4UyVGh7YW3YnbMBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMDA2gAMGUCMQDWVUT93T7YGS5rcopboRgTcmJqOTd9j1WNnm3bSAaU8iKmgQYr+bh4VP6mA0BSREYCMB9MkGP7KwnI4P1vdBlOmGQ5FgSacsqJavHR/e38iEi/DqaemC/sZVXODSpn6ImgRGpwdWJsaWNfa2V59ml1c2VyX2RhdGFYg6MAWFswWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASdfkbDJpoWkVh2Xub1+35oXcwboZqdYV7uu9OoQY2iiN9C1ppFdY2ZhsL1p9+PZPCjLZGVaQ5MYURMlALn9/3fAWtmaXh0dXJlLWtleQKBdGZpeHR1cmUtcHJldmlvdXMta2V5ZW5vbmNlWCAJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCVhg+mTWJjdzf8nTM2L5oHpV431U8iAA0BKgTMK4nDXUNb2XAUrtR1sUMhYfhN2zFRWXdGjVcKvoQHBSl+VGlyS2tAvwpM77dC1VagmQzfONA83TTIId6j8NBpL+knXYzpVS

package/src/__fixtures__/nitro-attestation/wrong-pcr0.cbor.b64

@@ -0,0 +1 @@
+hEShATgioFkKBalpbW9kdWxlX2lkeBxsZWFybmNhcmQtZmFrZS1uc20tVEVTVC1PTkxZZmRpZ2VzdGZTSEEzODRpdGltZXN0YW1wGwAAAaDV3JwAZHBjcnOwAFgwCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAVgwAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAlgwAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDA1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABFgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABVgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABlgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACFgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACVgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAClgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADFgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADVgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADlgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAa2NlcnRpZmljYXRlWQHrMIIB5zCCAW6gAwIBAgIBAzAKBggqhkjOPQQDAzAxMS8wLQYDVQQDDCZMZWFybkNhcmQgVEVTVCBPTkxZIE5pdHJvIEludGVybWVkaWF0ZTAgFw0yMDAxMDEwMDAwMDBaGA8yMDUwMDEwMTAwMDAwMFowKTEnMCUGA1UEAwweTGVhcm5DYXJkIFRFU1QgT05MWSBOaXRybyBMZWFmMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEdQabXARWaQiOuZ0QS62W7zyoYWXFX0SRGecTMHxr6Sy0WYLodow0Zh9kA2z/PJMEbTFczp0cEKI5ARnMoqH/3jQce8MenSb96Us9FiinYg35Z0F1QXY1fkOGfA65UyXZo2AwXjAdBgNVHQ4EFgQUt2vMI6fK0TeuRX9Gj/Ci4qt4UxswHwYDVR0jBBgwFoAU9rnIupQhj3sUlPlGC7/i+CjpXWEwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCBsAwCgYIKoZIzj0EAwMDZwAwZAIxAP6kP6OfQ8hfRNIBKHqYLzulqDhpHF/ELggbaekIp3y8g8+cS2iDFGJHU7Nwxgo9cAIvbkcqbnWXD4KVfvm2Fu74C0k52WHIeFHWo3gWoZl4xUoJNcbAwl/K7dUzroJ5eYpoY2FidW5kbGWCWQHGMIIBwjCCAUigAwIBAgIBATAKBggqhkjOPQQDAzApMScwJQYDVQQDDB5MZWFybkNhcmQgVEVTVCBPTkxZIE5pdHJvIFJvb3QwIBcNMjAwMTAxMDAwMDAwWhgPMjA1MDAxMDEwMDAwMDBaMCkxJzAlBgNVBAMMHkxlYXJuQ2FyZCBURVNUIE9OTFkgTml0cm8gUm9vdDB2MBAGByqGSM49AgEGBSuBBAAiA2IABBck9uTlAFdttlkj3wkMkhPJrXNJONf0FdJ5LLG8snfdW2PcZRQBGONRWfeZRqriSz+YkAODjFMLLnsBgWoBqER90QsPa2AG4OjfOPIlmTHBqdjVRJ2zVK76DOKqU5xinaNCMEAwHQYDVR0OBBYEFH5W2DvY+F7QW1n4UyVGh7YW3YnbMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMDA2gAMGUCMQC3icReCK/AVxSDJpCGMMq06g5DlbIYg1Tg9Ad+cZvYD0yr0ZuomoKL4B8JI0GBGiUCMFkQ4nGjuxzQu9jc7gb3O2UEhxivT2I2/8/PNwOH2sbZ/YY5Za+AsWQ2vgbabHJxY1kB8jCCAe4wggF0oAMCAQICAQIwCgYIKoZIzj0EAwMwKTEnMCUGA1UEAwweTGVhcm5DYXJkIFRFU1QgT05MWSBOaXRybyBSb290MCAXDTIwMDEwMTAwMDAwMFoYDzIwNTAwMTAxMDAwMDAwWjAxMS8wLQYDVQQDDCZMZWFybkNhcmQgVEVTVCBPTkxZIE5pdHJvIEludGVybWVkaWF0ZTB2MBAGByqGSM49AgEGBSuBBAAiA2IABGS45j1AmR2mOP/f8437hRypn8X88Gri0F3ukeQ6vAG6vgPWXpMm5DJWySsP5xqe1y4xuoSSSl/ECo5g/go+ppuXWg2YmGwFmFAw18mi39YtH2zYd/lY03T+gqvBRHIVlqNmMGQwHQYDVR0OBBYEFPa5yLqUIY97FJT5Rgu/4vgo6V1hMB8GA1UdIwQYMBaAFH5W2DvY+F7QW1n4UyVGh7YW3YnbMBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMDA2gAMGUCMQDWVUT93T7YGS5rcopboRgTcmJqOTd9j1WNnm3bSAaU8iKmgQYr+bh4VP6mA0BSREYCMB9MkGP7KwnI4P1vdBlOmGQ5FgSacsqJavHR/e38iEi/DqaemC/sZVXODSpn6ImgRGpwdWJsaWNfa2V59ml1c2VyX2RhdGFYg6MAWFswWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASdfkbDJpoWkVh2Xub1+35oXcwboZqdYV7uu9OoQY2iiN9C1ppFdY2ZhsL1p9+PZPCjLZGVaQ5MYURMlALn9/3fAWtmaXh0dXJlLWtleQKBdGZpeHR1cmUtcHJldmlvdXMta2V5ZW5vbmNlWCAJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCVhgARS+35VntRGV3gL+wb/ujP6AR2T3i3MVSqF2UkwtDSfMDTkAoIY+VLu79Zk2Y579fzbjL8houukhehmXd5Xp6WiXowHjEJdlo/RZwRswHtB9YppGB9gxv3J64fMWTOAp

package/src/__fixtures__/nitro-attestation/wrong-root.cbor.b64

@@ -0,0 +1 @@
+hEShATgioFkKCKlpbW9kdWxlX2lkeBxsZWFybmNhcmQtZmFrZS1uc20tVEVTVC1PTkxZZmRpZ2VzdGZTSEEzODRpdGltZXN0YW1wGwAAAaDV3JwAZHBjcnOwAFgwAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAVgwAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAlgwAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDA1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABFgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABVgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABlgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACFgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACVgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAClgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADFgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADVgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADlgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAa2NlcnRpZmljYXRlWQHtMIIB6TCCAW6gAwIBAgIBAzAKBggqhkjOPQQDAzAxMS8wLQYDVQQDDCZMZWFybkNhcmQgVEVTVCBPTkxZIE5pdHJvIEludGVybWVkaWF0ZTAgFw0yMDAxMDEwMDAwMDBaGA8yMDUwMDEwMTAwMDAwMFowKTEnMCUGA1UEAwweTGVhcm5DYXJkIFRFU1QgT05MWSBOaXRybyBMZWFmMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEBJ8TDzJLbNZ/uJqLrFm/zHS2TDLfb97e39EHwkfZ0xwE2/StOUKaKKyOhAEGIbKMILPR7zPUQdJ6Taz5qbU4ABER6YiycYopBTKrFnZS4z/Lhw+PAxoOllGUfNwrwjkGo2AwXjAdBgNVHQ4EFgQUVn+9f0Oa7MWFDZZPT8BZ3REubDswHwYDVR0jBBgwFoAUzY+QmTTCSOlx0H3DFcYcxnRR62cwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCBsAwCgYIKoZIzj0EAwMDaQAwZgIxALb+USDVCdSilLcxV9cqnNpGVKDTezY/mh9WGNy1xkyB73x35GplnmdYvRqKfBrXEgIxAKrAxvebS390zZrIBUUuifW0b0xafxuMdMrAKEv9ZYUj77dTwHxx5ZREbZ9oMCXRQGhjYWJ1bmRsZYJZAccwggHDMIIBSKADAgECAgEBMAoGCCqGSM49BAMDMCkxJzAlBgNVBAMMHkxlYXJuQ2FyZCBURVNUIE9OTFkgTml0cm8gUm9vdDAgFw0yMDAxMDEwMDAwMDBaGA8yMDUwMDEwMTAwMDAwMFowKTEnMCUGA1UEAwweTGVhcm5DYXJkIFRFU1QgT05MWSBOaXRybyBSb290MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEe6EoC9fLj1w7BvlRr8NdgbOiODxslwtNshNYa4w/J1xq7yla+GQGzE5U+3fYVu4en1PhMCAKKE7JRF40Xoy5PWr9oqIYaiM9t/eh2zEigBtl5au7Rud96/m8556swayco0IwQDAdBgNVHQ4EFgQU9OLCHJG1VjDguCiHUMX4iunyE2EwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwCgYIKoZIzj0EAwMDaQAwZgIxANWY4PSaYRRwNx1U+W52KEZ1eyrtgo1WPUkeKCJ7EXyhZqftF9cQMeoIqi/OVbR3OAIxAMexIUP95FFx6HGZ4hC5ITW0kDDChAx06Za+Kl2XE7MZP/PrIj+bvE5Z5Hjlguwyp1kB8jCCAe4wggF0oAMCAQICAQIwCgYIKoZIzj0EAwMwKTEnMCUGA1UEAwweTGVhcm5DYXJkIFRFU1QgT05MWSBOaXRybyBSb290MCAXDTIwMDEwMTAwMDAwMFoYDzIwNTAwMTAxMDAwMDAwWjAxMS8wLQYDVQQDDCZMZWFybkNhcmQgVEVTVCBPTkxZIE5pdHJvIEludGVybWVkaWF0ZTB2MBAGByqGSM49AgEGBSuBBAAiA2IABIG3U3QGqwIou+Ea2HBCgmck0mjouJVHxryvXtX1BjelcxGfynbpzNgeC6a24/3GJa1ModVWez/r9Xbz4Zdgh8MW/GBG03kcClvfqA/rQStbiWL7TuY2HVMxfnIrMqO1OqNmMGQwHQYDVR0OBBYEFM2PkJk0wkjpcdB9wxXGHMZ0UetnMB8GA1UdIwQYMBaAFPTiwhyRtVYw4Lgoh1DF+Irp8hNhMBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMDA2gAMGUCMQDmDS76TFJxb4PJTY0+VOcfVHBTEv315YWmvUxkdh0DDKbSRp4ycO9wq+qlzSs1hpgCMAmXov+6OE3B53xDLEE91MqDA4/9eiH++zpA21LMaqO/Y38ndJd1H8u80HzquF44impwdWJsaWNfa2V59ml1c2VyX2RhdGFYg6MAWFswWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASdfkbDJpoWkVh2Xub1+35oXcwboZqdYV7uu9OoQY2iiN9C1ppFdY2ZhsL1p9+PZPCjLZGVaQ5MYURMlALn9/3fAWtmaXh0dXJlLWtleQKBdGZpeHR1cmUtcHJldmlvdXMta2V5ZW5vbmNlWCAJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCVhg7Uxjxl0oj51tI1I0PaYniKfmjtA1QL9mWMwEDBXtSsUOAkE/vLo9bIWkAngUbht+chS1XzPsCaRzWSNQ65RckLIAFkqF75vywIL/u85pTKulJtrxPSbVGVEj7Pz39fgu

package/src/api-client.test.ts

@@ -0,0 +1,122 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import { SSSApiClient } from './api-client';
+
+import type { AuthProvider } from './types';
+
+const SENTINEL_TOKEN = 'SENTINEL_TOKEN_XYZ';
+const DID_CHALLENGE_ERROR = 'This operation requires the DID-challenge flow; use createSSSStrategy';
+
+const createMockAuthProvider = (): AuthProvider => ({
+    getIdToken: vi.fn().mockResolvedValue(SENTINEL_TOKEN),
+    getCurrentUser: vi.fn().mockResolvedValue({
+        id: 'user-123',
+        email: 'sentinel-user@example.com',
+        providerType: 'firebase' as const,
+    }),
+    getProviderType: vi.fn().mockReturnValue('firebase' as const),
+    signOut: vi.fn().mockResolvedValue(undefined),
+});
+
+describe('SSSApiClient', () => {
+    let client: SSSApiClient;
+    let calls: { url: string; init?: RequestInit }[];
+
+    beforeEach(() => {
+        calls = [];
+
+        vi.spyOn(globalThis, 'fetch').mockImplementation(async (url, init) => {
+            calls.push({ url: url.toString(), init });
+            return new Response(
+                JSON.stringify({
+                    authShare: null,
+                    primaryDid: null,
+                    securityLevel: 'basic',
+                    recoveryMethods: [],
+                    keyProvider: 'sss',
+                    shareVersion: 1,
+                    sssActivationState: 'active',
+                    recoverySessionToken: 'recovery-session-token',
+                    rebindSessionToken: 'rebind-session-token',
+                    recoveryMethodsRequireConfirmation: [],
+                }),
+                { status: 200 }
+            );
+        });
+
+        client = new SSSApiClient({
+            serverUrl: 'http://test-server:5100/api',
+            authProvider: createMockAuthProvider(),
+        });
+    });
+
+    afterEach(() => {
+        vi.restoreAllMocks();
+    });
+
+    it('uses X-Auth-Token rather than Authorization for provider-authenticated reads', async () => {
+        await client.getAuthShare();
+
+        const headers = calls[0]!.init?.headers as Record<string, string>;
+        expect(headers['X-Auth-Token']).toBe(SENTINEL_TOKEN);
+        expect(headers.Authorization).toBeUndefined();
+        expect(calls[0]!.url).not.toContain(SENTINEL_TOKEN);
+    });
+
+    it('keeps recovery read credentials out of the URL', async () => {
+        await client.getRecoveryShare('passkey', 'credential-1');
+
+        const headers = calls[0]!.init?.headers as Record<string, string>;
+        expect(headers['X-Auth-Token']).toBe(SENTINEL_TOKEN);
+        expect(calls[0]!.url).not.toContain(SENTINEL_TOKEN);
+        expect(calls[0]!.url).not.toMatch(/[?&](token|share)=/i);
+    });
+
+    it('retains the valid unauthenticated identity-recovery helpers', async () => {
+        await client.startIdentityRecovery('recovery@example.com');
+        await client.verifyIdentityRecovery('recovery@example.com', '123456');
+        await client.useIdentityRecoverySession('recovery-session-token', 'phrase');
+
+        expect(calls.map(call => call.url)).toEqual([
+            'http://test-server:5100/api/keys/recovery-session/start',
+            'http://test-server:5100/api/keys/recovery-session/verify',
+            'http://test-server:5100/api/keys/recovery-session/recover',
+        ]);
+    });
+
+    it('retains identity rebind because it supplies both DID proof and the auth token', async () => {
+        await client.completeIdentityRecoveryRebind({
+            recoverySessionToken: 'rebind-session-token',
+            newAuthToken: SENTINEL_TOKEN,
+            providerType: 'firebase',
+            primaryDid: 'did:key:zTest',
+            authShare: { encryptedData: 'encrypted-share', encryptedDek: '', iv: '' },
+            didAuthVp: 'did-auth-vp',
+        });
+
+        const headers = calls[0]!.init?.headers as Record<string, string>;
+        expect(headers.Authorization).toBe('Bearer did-auth-vp');
+        expect(headers['X-Auth-Token']).toBe(SENTINEL_TOKEN);
+    });
+
+    it.each([
+        [
+            'storeAuthShare',
+            () =>
+                client.storeAuthShare({
+                    authShare: { encryptedData: 'share', encryptedDek: '', iv: '' },
+                    primaryDid: 'did:key:zTest',
+                }),
+        ],
+        ['addRecoveryMethod', () => client.addRecoveryMethod({ type: 'phrase' })],
+        ['markMigrated', () => client.markMigrated()],
+        ['activate', () => client.activate()],
+        ['sendEmailBackupShare', () => client.sendEmailBackupShare('email-share')],
+        ['addRecoveryEmail', () => client.addRecoveryEmail('recovery@example.com')],
+        ['verifyRecoveryEmail', () => client.verifyRecoveryEmail('123456')],
+        ['deleteUserKey', () => client.deleteUserKey()],
+    ])('%s fails closed instead of calling a route without DID proof', async (_name, call) => {
+        await expect(call()).rejects.toThrow(DID_CHALLENGE_ERROR);
+        expect(calls).toHaveLength(0);
+    });
+});

package/src/api-client.ts

@@ -5,12 +5,21 @@
 import type {
     AuthProvider,
     AuthProviderType,
-    ContactMethod,
     ServerEncryptedShare,
     RecoveryMethodInfo,
     EncryptedShare,
     SecurityLevel,
+    SssActivationState,
+    IdentityRecoverySession,
 } from './types';
+import type { EmailRelayBranding } from './email-relay-crypto';
+
+const DID_CHALLENGE_REQUIRED_ERROR =
+    'This operation requires the DID-challenge flow; use createSSSStrategy';
+
+const throwDidChallengeRequired = (): never => {
+    throw new Error(DID_CHALLENGE_REQUIRED_ERROR);
+};
 
 export interface GetAuthShareResponse {
     authShare: ServerEncryptedShare | null;
@@ -18,13 +27,16 @@ export interface GetAuthShareResponse {
     securityLevel: SecurityLevel;
     recoveryMethods: RecoveryMethodInfo[];
     keyProvider: 'web3auth' | 'sss';
+    shareVersion: number;
     maskedRecoveryEmail?: string | null;
+    sssActivationState: SssActivationState;
 }
 
 export interface StoreAuthShareInput {
     authShare: ServerEncryptedShare;
     primaryDid: string;
     securityLevel?: SecurityLevel;
+    sssActivationState?: 'provisional';
 }
 
 export interface StoreRecoveryShareInput {
@@ -34,11 +46,23 @@ export interface StoreRecoveryShareInput {
     shareVersion?: number;
 }
 
+export interface RecoverySessionMaterial {
+    authShare: ServerEncryptedShare;
+    encryptedShare?: EncryptedShare;
+    primaryDid: string;
+    shareVersion: number;
+    rebindSessionToken: string;
+}
+
 export interface ApiClientConfig {
     serverUrl: string;
     authProvider: AuthProvider;
+    escrowRelayPublicKey?: string;
+    escrowRelayKeyId?: string;
+    emailBranding?: EmailRelayBranding;
 }
 
+/** @deprecated Use `createSSSStrategy`, which implements the hardened DID-challenge flow. */
 export class SSSApiClient {
     private serverUrl: string;
     private authProvider: AuthProvider;
@@ -52,23 +76,10 @@ export class SSSApiClient {
         const token = await this.authProvider.getIdToken();
         return {
             'Content-Type': 'application/json',
-            Authorization: `Bearer ${token}`,
+            'X-Auth-Token': token,
         };
     }
 
-    private async getContactMethodFromUser(): Promise<ContactMethod | null> {
-        const user = await this.authProvider.getCurrentUser();
-        if (!user) return null;
-
-        if (user.email) {
-            return { type: 'email' as const, value: user.email.toLowerCase() };
-        }
-        if (user.phone) {
-            return { type: 'phone' as const, value: user.phone };
-        }
-        return null;
-    }
-
     async getAuthShare(): Promise<GetAuthShareResponse | null> {
         const headers = await this.getAuthHeaders();
         const providerType = this.authProvider.getProviderType();
@@ -89,54 +100,28 @@ export class SSSApiClient {
         return response.json();
     }
 
-    async storeAuthShare(input: StoreAuthShareInput): Promise<void> {
-        const headers = await this.getAuthHeaders();
-        const providerType = this.authProvider.getProviderType();
-
-        const response = await fetch(`${this.serverUrl}/keys/auth-share`, {
-            method: 'PUT',
-            headers,
-            body: JSON.stringify({
-                ...input,
-                providerType,
-            }),
-        });
-
-        if (!response.ok) {
-            throw new Error(`Failed to store auth share: ${response.statusText}`);
-        }
+    /** @deprecated Requires DID-challenge authorization. Use `createSSSStrategy`. */
+    async storeAuthShare(_input: StoreAuthShareInput): Promise<void> {
+        throwDidChallengeRequired();
     }
 
-    async addRecoveryMethod(input: StoreRecoveryShareInput): Promise<void> {
-        const headers = await this.getAuthHeaders();
-        const providerType = this.authProvider.getProviderType();
-
-        const response = await fetch(`${this.serverUrl}/keys/recovery`, {
-            method: 'POST',
-            headers,
-            body: JSON.stringify({
-                ...input,
-                providerType,
-            }),
-        });
-
-        if (!response.ok) {
-            throw new Error(`Failed to add recovery method: ${response.statusText}`);
-        }
+    /** @deprecated Requires DID-challenge authorization. Use `createSSSStrategy`. */
+    async addRecoveryMethod(_input: StoreRecoveryShareInput): Promise<void> {
+        throwDidChallengeRequired();
     }
 
     async getRecoveryShare(
         type: 'passkey' | 'backup' | 'phrase' | 'email',
         credentialId?: string
     ): Promise<{ encryptedShare?: EncryptedShare; shareVersion?: number } | null> {
+        // P0-4: authToken travels via the X-Auth-Token header — never as a
+        // query param, which would land in proxy/ALB access logs. A
+        // dedicated header (not Authorization) avoids colliding with
+        // clients that send a DID-Auth VP as Authorization for this route.
         const token = await this.authProvider.getIdToken();
         const providerType = this.authProvider.getProviderType();
 
-        const params = new URLSearchParams({
-            type,
-            providerType,
-            authToken: token,
-        });
+        const params = new URLSearchParams({ type, providerType });
 
         if (credentialId) {
             params.append('credentialId', credentialId);
@@ -144,9 +129,7 @@ export class SSSApiClient {
 
         const response = await fetch(`${this.serverUrl}/keys/recovery?${params}`, {
             method: 'GET',
-            headers: {
-                'Content-Type': 'application/json',
-            },
+            headers: { 'Content-Type': 'application/json', 'X-Auth-Token': token },
         });
 
         if (!response.ok) {
@@ -159,99 +142,107 @@ export class SSSApiClient {
         return response.json();
     }
 
-    async markMigrated(): Promise<void> {
-        const headers = await this.getAuthHeaders();
-        const providerType = this.authProvider.getProviderType();
-
-        const response = await fetch(`${this.serverUrl}/keys/migrate`, {
+    async startIdentityRecovery(email: string): Promise<void> {
+        const response = await fetch(`${this.serverUrl}/keys/recovery-session/start`, {
             method: 'POST',
-            headers,
-            body: JSON.stringify({ providerType }),
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ email }),
         });
 
         if (!response.ok) {
-            throw new Error(`Failed to mark as migrated: ${response.statusText}`);
+            throw new Error(`Failed to send recovery code: ${response.statusText}`);
         }
     }
 
-    async sendEmailBackupShare(emailShare: string, overrideEmail?: string): Promise<void> {
-        const headers = await this.getAuthHeaders();
-        const providerType = this.authProvider.getProviderType();
-
-        let email = overrideEmail;
-
-        if (!email) {
-            const user = await this.authProvider.getCurrentUser();
-            email = user?.email;
-        }
-
-        if (!email) {
-            console.warn('Cannot send email backup share: no email address available');
-            return;
-        }
-
-        const response = await fetch(`${this.serverUrl}/keys/email-backup`, {
+    async verifyIdentityRecovery(email: string, code: string): Promise<IdentityRecoverySession> {
+        const response = await fetch(`${this.serverUrl}/keys/recovery-session/verify`, {
             method: 'POST',
-            headers,
-            body: JSON.stringify({
-                providerType,
-                emailShare,
-                email,
-            }),
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ email, code }),
         });
 
         if (!response.ok) {
-            // Non-fatal: log but don't throw — the user can still use the app
-            console.warn(`Failed to send email backup share: ${response.statusText}`);
+            throw new Error(`Failed to verify recovery code: ${response.statusText}`);
         }
-    }
 
-    async addRecoveryEmail(email: string): Promise<void> {
-        const token = await this.authProvider.getIdToken();
-        const providerType = this.authProvider.getProviderType();
+        return response.json();
+    }
 
-        const response = await fetch(`${this.serverUrl}/keys/recovery-email/add`, {
+    async useIdentityRecoverySession(
+        recoverySessionToken: string,
+        type: StoreRecoveryShareInput['type'],
+        credentialId?: string
+    ): Promise<RecoverySessionMaterial> {
+        const response = await fetch(`${this.serverUrl}/keys/recovery-session/recover`, {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({ authToken: token, providerType, email }),
+            body: JSON.stringify({ recoverySessionToken, type, credentialId }),
         });
 
         if (!response.ok) {
-            const data = await response.json().catch(() => ({}));
-            throw new Error(data?.message || `Failed to add recovery email: ${response.statusText}`);
+            throw new Error(`Failed to retrieve recovery data: ${response.statusText}`);
         }
-    }
 
-    async verifyRecoveryEmail(code: string): Promise<{ maskedEmail: string }> {
-        const token = await this.authProvider.getIdToken();
-        const providerType = this.authProvider.getProviderType();
+        return response.json();
+    }
 
-        const response = await fetch(`${this.serverUrl}/keys/recovery-email/verify`, {
+    async completeIdentityRecoveryRebind(input: {
+        recoverySessionToken: string;
+        newAuthToken: string;
+        providerType: AuthProviderType;
+        primaryDid: string;
+        authShare: ServerEncryptedShare;
+        didAuthVp: string;
+    }): Promise<{ shareVersion: number; recoveryMethodsRequireConfirmation: string[] }> {
+        const response = await fetch(`${this.serverUrl}/keys/recovery-session/rebind`, {
             method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({ authToken: token, providerType, code }),
+            headers: {
+                'Content-Type': 'application/json',
+                Authorization: `Bearer ${input.didAuthVp}`,
+                'X-Auth-Token': input.newAuthToken,
+            },
+            body: JSON.stringify({
+                recoverySessionToken: input.recoverySessionToken,
+                providerType: input.providerType,
+                primaryDid: input.primaryDid,
+                authShare: input.authShare,
+            }),
         });
 
         if (!response.ok) {
-            const data = await response.json().catch(() => ({}));
-            throw new Error(data?.message || `Failed to verify recovery email: ${response.statusText}`);
+            throw new Error(`Failed to bind the new sign-in: ${response.statusText}`);
         }
 
         return response.json();
     }
 
-    async deleteUserKey(): Promise<void> {
-        const headers = await this.getAuthHeaders();
-        const providerType = this.authProvider.getProviderType();
+    /** @deprecated Requires DID-challenge authorization. Use `createSSSStrategy`. */
+    async markMigrated(): Promise<void> {
+        throwDidChallengeRequired();
+    }
 
-        const response = await fetch(`${this.serverUrl}/keys`, {
-            method: 'DELETE',
-            headers,
-            body: JSON.stringify({ providerType }),
-        });
+    /** @deprecated Requires DID-challenge authorization. Use `createSSSStrategy`. */
+    async activate(): Promise<void> {
+        throwDidChallengeRequired();
+    }
 
-        if (!response.ok) {
-            throw new Error(`Failed to delete user key: ${response.statusText}`);
-        }
+    /** @deprecated Requires DID-challenge authorization. Use `createSSSStrategy`. */
+    async sendEmailBackupShare(_emailShare: string, _overrideEmail?: string): Promise<void> {
+        throwDidChallengeRequired();
+    }
+
+    /** @deprecated Requires DID-challenge authorization. Use `createSSSStrategy`. */
+    async addRecoveryEmail(_email: string): Promise<void> {
+        throwDidChallengeRequired();
+    }
+
+    /** @deprecated Requires DID-challenge authorization. Use `createSSSStrategy`. */
+    async verifyRecoveryEmail(_code: string): Promise<{ maskedEmail: string }> {
+        return throwDidChallengeRequired();
+    }
+
+    /** @deprecated Requires DID-challenge authorization. Use `createSSSStrategy`. */
+    async deleteUserKey(): Promise<void> {
+        throwDidChallengeRequired();
     }
 }