@learncard/sss-key-manager 0.2.0 → 0.2.1

package/dist/sss-key-manager.cjs.development.js

@@ -7,7 +7,11 @@ var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 var __commonJS = (cb, mod) => function __require() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e) {
+    throw mod = 0, e;
+  }
 };
 var __export = (target, all) => {
   for (var name in all)
@@ -79,6 +83,12 @@ var require_types_cjs_development = __commonJS({
       AppEventResponseValidator: /* @__PURE__ */ __name(() => AppEventResponseValidator, "AppEventResponseValidator"),
       AppEventValidator: /* @__PURE__ */ __name(() => AppEventValidator, "AppEventValidator"),
       AppListingStatusValidator: /* @__PURE__ */ __name(() => AppListingStatusValidator, "AppListingStatusValidator"),
+      AppManifestDiffValidator: /* @__PURE__ */ __name(() => AppManifestDiffValidator, "AppManifestDiffValidator"),
+      AppManifestTemplateChangeValidator: /* @__PURE__ */ __name(() => AppManifestTemplateChangeValidator, "AppManifestTemplateChangeValidator"),
+      AppManifestTemplateRefValidator: /* @__PURE__ */ __name(() => AppManifestTemplateRefValidator, "AppManifestTemplateRefValidator"),
+      AppManifestValidator: /* @__PURE__ */ __name(() => AppManifestValidator, "AppManifestValidator"),
+      AppManifestVersionStatusValidator: /* @__PURE__ */ __name(() => AppManifestVersionStatusValidator, "AppManifestVersionStatusValidator"),
+      AppManifestVersionValidator: /* @__PURE__ */ __name(() => AppManifestVersionValidator, "AppManifestVersionValidator"),
       AppStoreListingCreateValidator: /* @__PURE__ */ __name(() => AppStoreListingCreateValidator, "AppStoreListingCreateValidator"),
       AppStoreListingSubmitterValidator: /* @__PURE__ */ __name(() => AppStoreListingSubmitterValidator, "AppStoreListingSubmitterValidator"),
       AppStoreListingUpdateValidator: /* @__PURE__ */ __name(() => AppStoreListingUpdateValidator, "AppStoreListingUpdateValidator"),
@@ -100,6 +110,8 @@ var require_types_cjs_development = __commonJS({
       BoostRecipientValidator: /* @__PURE__ */ __name(() => BoostRecipientValidator, "BoostRecipientValidator"),
       BoostRecipientWithChildrenValidator: /* @__PURE__ */ __name(() => BoostRecipientWithChildrenValidator, "BoostRecipientWithChildrenValidator"),
       BoostValidator: /* @__PURE__ */ __name(() => BoostValidator, "BoostValidator"),
+      CapturedConsentRecordValidator: /* @__PURE__ */ __name(() => CapturedConsentRecordValidator, "CapturedConsentRecordValidator"),
+      CapturedTemplateRecordValidator: /* @__PURE__ */ __name(() => CapturedTemplateRecordValidator, "CapturedTemplateRecordValidator"),
       CheckCredentialEventValidator: /* @__PURE__ */ __name(() => CheckCredentialEventValidator, "CheckCredentialEventValidator"),
       CheckIssuanceStatusEventValidator: /* @__PURE__ */ __name(() => CheckIssuanceStatusEventValidator, "CheckIssuanceStatusEventValidator"),
       ClaimHookQueryValidator: /* @__PURE__ */ __name(() => ClaimHookQueryValidator, "ClaimHookQueryValidator"),
@@ -121,6 +133,7 @@ var require_types_cjs_development = __commonJS({
       ConsentFlowDataForDidQueryValidator: /* @__PURE__ */ __name(() => ConsentFlowDataForDidQueryValidator, "ConsentFlowDataForDidQueryValidator"),
       ConsentFlowDataQueryValidator: /* @__PURE__ */ __name(() => ConsentFlowDataQueryValidator, "ConsentFlowDataQueryValidator"),
       ConsentFlowGuardianApprovalValidator: /* @__PURE__ */ __name(() => ConsentFlowGuardianApprovalValidator, "ConsentFlowGuardianApprovalValidator"),
+      ConsentFlowReferralValidator: /* @__PURE__ */ __name(() => ConsentFlowReferralValidator, "ConsentFlowReferralValidator"),
       ConsentFlowTermValidator: /* @__PURE__ */ __name(() => ConsentFlowTermValidator, "ConsentFlowTermValidator"),
       ConsentFlowTermsQueryValidator: /* @__PURE__ */ __name(() => ConsentFlowTermsQueryValidator, "ConsentFlowTermsQueryValidator"),
       ConsentFlowTermsStatusValidator: /* @__PURE__ */ __name(() => ConsentFlowTermsStatusValidator, "ConsentFlowTermsStatusValidator"),
@@ -128,6 +141,10 @@ var require_types_cjs_development = __commonJS({
       ConsentFlowTransactionActionValidator: /* @__PURE__ */ __name(() => ConsentFlowTransactionActionValidator, "ConsentFlowTransactionActionValidator"),
       ConsentFlowTransactionValidator: /* @__PURE__ */ __name(() => ConsentFlowTransactionValidator, "ConsentFlowTransactionValidator"),
       ConsentFlowTransactionsQueryValidator: /* @__PURE__ */ __name(() => ConsentFlowTransactionsQueryValidator, "ConsentFlowTransactionsQueryValidator"),
+      ConsentFlowWebhookMetadataValidator: /* @__PURE__ */ __name(() => ConsentFlowWebhookMetadataValidator, "ConsentFlowWebhookMetadataValidator"),
+      ConsentRequestPersonalFieldValidator: /* @__PURE__ */ __name(() => ConsentRequestPersonalFieldValidator, "ConsentRequestPersonalFieldValidator"),
+      ConsentRequestValidator: /* @__PURE__ */ __name(() => ConsentRequestValidator, "ConsentRequestValidator"),
+      ConsentRequestWalletCategoryValidator: /* @__PURE__ */ __name(() => ConsentRequestWalletCategoryValidator, "ConsentRequestWalletCategoryValidator"),
       ContactMethodCreateValidator: /* @__PURE__ */ __name(() => ContactMethodCreateValidator, "ContactMethodCreateValidator"),
       ContactMethodQueryValidator: /* @__PURE__ */ __name(() => ContactMethodQueryValidator, "ContactMethodQueryValidator"),
       ContactMethodValidator: /* @__PURE__ */ __name(() => ContactMethodValidator, "ContactMethodValidator"),
@@ -135,6 +152,7 @@ var require_types_cjs_development = __commonJS({
       ContactMethodVerificationValidator: /* @__PURE__ */ __name(() => ContactMethodVerificationValidator, "ContactMethodVerificationValidator"),
       ContextValidator: /* @__PURE__ */ __name(() => ContextValidator, "ContextValidator"),
       ContractCredentialValidator: /* @__PURE__ */ __name(() => ContractCredentialValidator, "ContractCredentialValidator"),
+      ContractRequestFieldsValidator: /* @__PURE__ */ __name(() => ContractRequestFieldsValidator, "ContractRequestFieldsValidator"),
       CountSkillsInputValidator: /* @__PURE__ */ __name(() => CountSkillsInputValidator, "CountSkillsInputValidator"),
       CountSkillsResultValidator: /* @__PURE__ */ __name(() => CountSkillsResultValidator, "CountSkillsResultValidator"),
       CreateContactMethodSessionResponseValidator: /* @__PURE__ */ __name(() => CreateContactMethodSessionResponseValidator, "CreateContactMethodSessionResponseValidator"),
@@ -170,6 +188,8 @@ var require_types_cjs_development = __commonJS({
       CriteriaValidator: /* @__PURE__ */ __name(() => CriteriaValidator, "CriteriaValidator"),
       DEFAULT_BITSTRING_STATUS_LIST_SIZE: /* @__PURE__ */ __name(() => DEFAULT_BITSTRING_STATUS_LIST_SIZE, "DEFAULT_BITSTRING_STATUS_LIST_SIZE"),
       DeleteFrameworkInputValidator: /* @__PURE__ */ __name(() => DeleteFrameworkInputValidator, "DeleteFrameworkInputValidator"),
+      DeleteShareLinkAttachmentChunksInputValidator: /* @__PURE__ */ __name(() => DeleteShareLinkAttachmentChunksInputValidator, "DeleteShareLinkAttachmentChunksInputValidator"),
+      DeleteShareLinkAttachmentChunksOutputValidator: /* @__PURE__ */ __name(() => DeleteShareLinkAttachmentChunksOutputValidator, "DeleteShareLinkAttachmentChunksOutputValidator"),
       DeleteSkillInputValidator: /* @__PURE__ */ __name(() => DeleteSkillInputValidator, "DeleteSkillInputValidator"),
       DidDocumentValidator: /* @__PURE__ */ __name(() => DidDocumentValidator, "DidDocumentValidator"),
       EMPTY_IN_APP_MESSAGES_FLAG: /* @__PURE__ */ __name(() => EMPTY_IN_APP_MESSAGES_FLAG, "EMPTY_IN_APP_MESSAGES_FLAG"),
@@ -192,6 +212,7 @@ var require_types_cjs_development = __commonJS({
       GetCredentialRefreshHistoryResultValidator: /* @__PURE__ */ __name(() => GetCredentialRefreshHistoryResultValidator, "GetCredentialRefreshHistoryResultValidator"),
       GetFullSkillTreeInputValidator: /* @__PURE__ */ __name(() => GetFullSkillTreeInputValidator, "GetFullSkillTreeInputValidator"),
       GetFullSkillTreeResultValidator: /* @__PURE__ */ __name(() => GetFullSkillTreeResultValidator, "GetFullSkillTreeResultValidator"),
+      GetShareLinkAttachmentChunkInputValidator: /* @__PURE__ */ __name(() => GetShareLinkAttachmentChunkInputValidator, "GetShareLinkAttachmentChunkInputValidator"),
       GetSkillPathInputValidator: /* @__PURE__ */ __name(() => GetSkillPathInputValidator, "GetSkillPathInputValidator"),
       GetSkillPathResultValidator: /* @__PURE__ */ __name(() => GetSkillPathResultValidator, "GetSkillPathResultValidator"),
       GetTemplateRecipientsEventValidator: /* @__PURE__ */ __name(() => GetTemplateRecipientsEventValidator, "GetTemplateRecipientsEventValidator"),
@@ -209,6 +230,12 @@ var require_types_cjs_development = __commonJS({
       InboxCredentialRefreshReceiptValidator: /* @__PURE__ */ __name(() => InboxCredentialRefreshReceiptValidator, "InboxCredentialRefreshReceiptValidator"),
       InboxCredentialValidator: /* @__PURE__ */ __name(() => InboxCredentialValidator, "InboxCredentialValidator"),
       IncrementCounterEventValidator: /* @__PURE__ */ __name(() => IncrementCounterEventValidator, "IncrementCounterEventValidator"),
+      InlineAlignmentValidator: /* @__PURE__ */ __name(() => InlineAlignmentValidator, "InlineAlignmentValidator"),
+      InlineCredentialTemplateValidator: /* @__PURE__ */ __name(() => InlineCredentialTemplateValidator, "InlineCredentialTemplateValidator"),
+      InlineEvidenceValidator: /* @__PURE__ */ __name(() => InlineEvidenceValidator, "InlineEvidenceValidator"),
+      InlineSendCredentialEventValidator: /* @__PURE__ */ __name(() => InlineSendCredentialEventValidator, "InlineSendCredentialEventValidator"),
+      InlineWalletCategoryValidator: /* @__PURE__ */ __name(() => InlineWalletCategoryValidator, "InlineWalletCategoryValidator"),
+      InlineWalletSkillTagValidator: /* @__PURE__ */ __name(() => InlineWalletSkillTagValidator, "InlineWalletSkillTagValidator"),
       InstalledAppValidator: /* @__PURE__ */ __name(() => InstalledAppValidator, "InstalledAppValidator"),
       IssueInboxCredentialBatchItemResultValidator: /* @__PURE__ */ __name(() => IssueInboxCredentialBatchItemResultValidator, "IssueInboxCredentialBatchItemResultValidator"),
       IssueInboxCredentialBatchItemValidator: /* @__PURE__ */ __name(() => IssueInboxCredentialBatchItemValidator, "IssueInboxCredentialBatchItemValidator"),
@@ -261,6 +288,7 @@ var require_types_cjs_development = __commonJS({
       LCNVisibleProfileValidator: /* @__PURE__ */ __name(() => LCNVisibleProfileValidator, "LCNVisibleProfileValidator"),
       LaunchTypeValidator: /* @__PURE__ */ __name(() => LaunchTypeValidator, "LaunchTypeValidator"),
       LearnCardRefreshAuthorizationValidator: /* @__PURE__ */ __name(() => LearnCardRefreshAuthorizationValidator, "LearnCardRefreshAuthorizationValidator"),
+      LegacySendCredentialEventValidator: /* @__PURE__ */ __name(() => LegacySendCredentialEventValidator, "LegacySendCredentialEventValidator"),
       LinkProviderFrameworkInputValidator: /* @__PURE__ */ __name(() => LinkProviderFrameworkInputValidator, "LinkProviderFrameworkInputValidator"),
       ListShareLinksInputValidator: /* @__PURE__ */ __name(() => ListShareLinksInputValidator, "ListShareLinksInputValidator"),
       MAX_ENDORSEMENTS: /* @__PURE__ */ __name(() => MAX_ENDORSEMENTS, "MAX_ENDORSEMENTS"),
@@ -272,6 +300,7 @@ var require_types_cjs_development = __commonJS({
       MAX_VP_MEMBERS: /* @__PURE__ */ __name(() => MAX_VP_MEMBERS, "MAX_VP_MEMBERS"),
       ManagedCredentialRefreshReceiptValidator: /* @__PURE__ */ __name(() => ManagedCredentialRefreshReceiptValidator, "ManagedCredentialRefreshReceiptValidator"),
       ManagedCredentialRefreshServiceValidator: /* @__PURE__ */ __name(() => ManagedCredentialRefreshServiceValidator, "ManagedCredentialRefreshServiceValidator"),
+      NormalizedConsentScopesValidator: /* @__PURE__ */ __name(() => NormalizedConsentScopesValidator, "NormalizedConsentScopesValidator"),
       PaginatedAppStoreListingsValidator: /* @__PURE__ */ __name(() => PaginatedAppStoreListingsValidator, "PaginatedAppStoreListingsValidator"),
       PaginatedBoostRecipientsValidator: /* @__PURE__ */ __name(() => PaginatedBoostRecipientsValidator, "PaginatedBoostRecipientsValidator"),
       PaginatedBoostRecipientsWithChildrenValidator: /* @__PURE__ */ __name(() => PaginatedBoostRecipientsWithChildrenValidator, "PaginatedBoostRecipientsWithChildrenValidator"),
@@ -298,6 +327,8 @@ var require_types_cjs_development = __commonJS({
       PaginatedVisibleLCNProfilesValidator: /* @__PURE__ */ __name(() => PaginatedVisibleLCNProfilesValidator, "PaginatedVisibleLCNProfilesValidator"),
       PaginationOptionsValidator: /* @__PURE__ */ __name(() => PaginationOptionsValidator, "PaginationOptionsValidator"),
       PaginationResponseValidator: /* @__PURE__ */ __name(() => PaginationResponseValidator, "PaginationResponseValidator"),
+      PendingListingUpdateStatusValidator: /* @__PURE__ */ __name(() => PendingListingUpdateStatusValidator, "PendingListingUpdateStatusValidator"),
+      PendingListingUpdateValidator: /* @__PURE__ */ __name(() => PendingListingUpdateValidator, "PendingListingUpdateValidator"),
       PrepareRefreshableSendInputValidator: /* @__PURE__ */ __name(() => PrepareRefreshableSendInputValidator, "PrepareRefreshableSendInputValidator"),
       PrepareRefreshableSendResultValidator: /* @__PURE__ */ __name(() => PrepareRefreshableSendResultValidator, "PrepareRefreshableSendResultValidator"),
       ProfileValidator: /* @__PURE__ */ __name(() => ProfileValidator, "ProfileValidator"),
@@ -310,6 +341,9 @@ var require_types_cjs_development = __commonJS({
       PublishCredentialRefreshResultValidator: /* @__PURE__ */ __name(() => PublishCredentialRefreshResultValidator, "PublishCredentialRefreshResultValidator"),
       PublishIssuerSignedRefreshValidator: /* @__PURE__ */ __name(() => PublishIssuerSignedRefreshValidator, "PublishIssuerSignedRefreshValidator"),
       PublishSigningAuthorityRefreshValidator: /* @__PURE__ */ __name(() => PublishSigningAuthorityRefreshValidator, "PublishSigningAuthorityRefreshValidator"),
+      PutShareLinkAttachmentChunkInputValidator: /* @__PURE__ */ __name(() => PutShareLinkAttachmentChunkInputValidator, "PutShareLinkAttachmentChunkInputValidator"),
+      PutShareLinkAttachmentChunkOutputValidator: /* @__PURE__ */ __name(() => PutShareLinkAttachmentChunkOutputValidator, "PutShareLinkAttachmentChunkOutputValidator"),
+      RawInlineCredentialTemplateValidator: /* @__PURE__ */ __name(() => RawInlineCredentialTemplateValidator, "RawInlineCredentialTemplateValidator"),
       RefreshServiceValidator: /* @__PURE__ */ __name(() => RefreshServiceValidator, "RefreshServiceValidator"),
       RegExpValidator: /* @__PURE__ */ __name(() => RegExpValidator, "RegExpValidator"),
       RelatedValidator: /* @__PURE__ */ __name(() => RelatedValidator, "RelatedValidator"),
@@ -336,6 +370,7 @@ var require_types_cjs_development = __commonJS({
       SendBoostResponseValidator: /* @__PURE__ */ __name(() => SendBoostResponseValidator, "SendBoostResponseValidator"),
       SendBoostTemplateValidator: /* @__PURE__ */ __name(() => SendBoostTemplateValidator, "SendBoostTemplateValidator"),
       SendBrandingOptionsValidator: /* @__PURE__ */ __name(() => SendBrandingOptionsValidator, "SendBrandingOptionsValidator"),
+      SendContractRequestValidator: /* @__PURE__ */ __name(() => SendContractRequestValidator, "SendContractRequestValidator"),
       SendCredentialEventValidator: /* @__PURE__ */ __name(() => SendCredentialEventValidator, "SendCredentialEventValidator"),
       SendInboxResponseValidator: /* @__PURE__ */ __name(() => SendInboxResponseValidator, "SendInboxResponseValidator"),
       SendInputValidator: /* @__PURE__ */ __name(() => SendInputValidator, "SendInputValidator"),
@@ -351,6 +386,9 @@ var require_types_cjs_development = __commonJS({
       ShareEndorsementEntryValidator: /* @__PURE__ */ __name(() => ShareEndorsementEntryValidator, "ShareEndorsementEntryValidator"),
       ShareEnvelopeValidator: /* @__PURE__ */ __name(() => ShareEnvelopeValidator, "ShareEnvelopeValidator"),
       ShareIvValidator: /* @__PURE__ */ __name(() => ShareIvValidator, "ShareIvValidator"),
+      ShareLinkAttachmentChunkEnvelopeValidator: /* @__PURE__ */ __name(() => ShareLinkAttachmentChunkEnvelopeValidator, "ShareLinkAttachmentChunkEnvelopeValidator"),
+      ShareLinkAttachmentChunkOutputValidator: /* @__PURE__ */ __name(() => ShareLinkAttachmentChunkOutputValidator, "ShareLinkAttachmentChunkOutputValidator"),
+      ShareLinkAttachmentValidator: /* @__PURE__ */ __name(() => ShareLinkAttachmentValidator, "ShareLinkAttachmentValidator"),
       ShareLinkIdInputValidator: /* @__PURE__ */ __name(() => ShareLinkIdInputValidator, "ShareLinkIdInputValidator"),
       ShareLinkIdValidator: /* @__PURE__ */ __name(() => ShareLinkIdValidator, "ShareLinkIdValidator"),
       ShareLinkOperationKeyInputValidator: /* @__PURE__ */ __name(() => ShareLinkOperationKeyInputValidator, "ShareLinkOperationKeyInputValidator"),
@@ -371,6 +409,7 @@ var require_types_cjs_development = __commonJS({
       ShareRecoverySelectionValidator: /* @__PURE__ */ __name(() => ShareRecoverySelectionValidator, "ShareRecoverySelectionValidator"),
       ShareSelectionEntryValidator: /* @__PURE__ */ __name(() => ShareSelectionEntryValidator, "ShareSelectionEntryValidator"),
       ShareSharerValidator: /* @__PURE__ */ __name(() => ShareSharerValidator, "ShareSharerValidator"),
+      SimpleInlineCredentialTemplateValidator: /* @__PURE__ */ __name(() => SimpleInlineCredentialTemplateValidator, "SimpleInlineCredentialTemplateValidator"),
       SkillDeletionStrategyValidator: /* @__PURE__ */ __name(() => SkillDeletionStrategyValidator, "SkillDeletionStrategyValidator"),
       SkillFrameworkAdminInputValidator: /* @__PURE__ */ __name(() => SkillFrameworkAdminInputValidator, "SkillFrameworkAdminInputValidator"),
       SkillFrameworkAdminsValidator: /* @__PURE__ */ __name(() => SkillFrameworkAdminsValidator, "SkillFrameworkAdminsValidator"),
@@ -401,9 +440,12 @@ var require_types_cjs_development = __commonJS({
       UnsignedClrCredentialValidator: /* @__PURE__ */ __name(() => UnsignedClrCredentialValidator, "UnsignedClrCredentialValidator"),
       UnsignedVCValidator: /* @__PURE__ */ __name(() => UnsignedVCValidator, "UnsignedVCValidator"),
       UnsignedVPValidator: /* @__PURE__ */ __name(() => UnsignedVPValidator, "UnsignedVPValidator"),
+      UnsupportedSignInOperationError: /* @__PURE__ */ __name(() => UnsupportedSignInOperationError, "UnsupportedSignInOperationError"),
       UpdateFrameworkInputValidator: /* @__PURE__ */ __name(() => UpdateFrameworkInputValidator, "UpdateFrameworkInputValidator"),
       UpdateShareLinkInputValidator: /* @__PURE__ */ __name(() => UpdateShareLinkInputValidator, "UpdateShareLinkInputValidator"),
       UpdateSkillInputValidator: /* @__PURE__ */ __name(() => UpdateSkillInputValidator, "UpdateSkillInputValidator"),
+      UpsertConsentContractEventValidator: /* @__PURE__ */ __name(() => UpsertConsentContractEventValidator, "UpsertConsentContractEventValidator"),
+      UpsertConsentContractResponseValidator: /* @__PURE__ */ __name(() => UpsertConsentContractResponseValidator, "UpsertConsentContractResponseValidator"),
       VC2EvidenceValidator: /* @__PURE__ */ __name(() => VC2EvidenceValidator, "VC2EvidenceValidator"),
       VCValidator: /* @__PURE__ */ __name(() => VCValidator, "VCValidator"),
       VPValidator: /* @__PURE__ */ __name(() => VPValidator, "VPValidator"),
@@ -549,14 +591,14 @@ var require_types_cjs_development = __commonJS({
       cuid2: /* @__PURE__ */ __name(() => cuid22, "cuid2"),
       custom: /* @__PURE__ */ __name(() => custom, "custom"),
       date: /* @__PURE__ */ __name(() => date3, "date"),
-      decode: /* @__PURE__ */ __name(() => decode2, "decode"),
+      decode: /* @__PURE__ */ __name(() => decode22, "decode"),
       decodeAsync: /* @__PURE__ */ __name(() => decodeAsync2, "decodeAsync"),
       describe: /* @__PURE__ */ __name(() => describe2, "describe"),
       discriminatedUnion: /* @__PURE__ */ __name(() => discriminatedUnion, "discriminatedUnion"),
       e164: /* @__PURE__ */ __name(() => e1642, "e164"),
       email: /* @__PURE__ */ __name(() => email2, "email"),
       emoji: /* @__PURE__ */ __name(() => emoji2, "emoji"),
-      encode: /* @__PURE__ */ __name(() => encode2, "encode"),
+      encode: /* @__PURE__ */ __name(() => encode22, "encode"),
       encodeAsync: /* @__PURE__ */ __name(() => encodeAsync2, "encodeAsync"),
       endsWith: /* @__PURE__ */ __name(() => _endsWith, "endsWith"),
       enum: /* @__PURE__ */ __name(() => _enum2, "enum"),
@@ -574,7 +616,7 @@ var require_types_cjs_development = __commonJS({
       gte: /* @__PURE__ */ __name(() => _gte, "gte"),
       guid: /* @__PURE__ */ __name(() => guid2, "guid"),
       hash: /* @__PURE__ */ __name(() => hash, "hash"),
-      hex: /* @__PURE__ */ __name(() => hex2, "hex"),
+      hex: /* @__PURE__ */ __name(() => hex22, "hex"),
       hostname: /* @__PURE__ */ __name(() => hostname2, "hostname"),
       httpUrl: /* @__PURE__ */ __name(() => httpUrl, "httpUrl"),
       includes: /* @__PURE__ */ __name(() => _includes, "includes"),
@@ -601,7 +643,7 @@ var require_types_cjs_development = __commonJS({
       lt: /* @__PURE__ */ __name(() => _lt, "lt"),
       lte: /* @__PURE__ */ __name(() => _lte, "lte"),
       mac: /* @__PURE__ */ __name(() => mac2, "mac"),
-      map: /* @__PURE__ */ __name(() => map, "map"),
+      map: /* @__PURE__ */ __name(() => map2, "map"),
       maxLength: /* @__PURE__ */ __name(() => _maxLength, "maxLength"),
       maxSize: /* @__PURE__ */ __name(() => _maxSize, "maxSize"),
       meta: /* @__PURE__ */ __name(() => meta2, "meta"),
@@ -926,10 +968,10 @@ var require_types_cjs_development = __commonJS({
       config: /* @__PURE__ */ __name(() => config, "config"),
       createStandardJSONSchemaMethod: /* @__PURE__ */ __name(() => createStandardJSONSchemaMethod, "createStandardJSONSchemaMethod"),
       createToJSONSchemaMethod: /* @__PURE__ */ __name(() => createToJSONSchemaMethod, "createToJSONSchemaMethod"),
-      decode: /* @__PURE__ */ __name(() => decode, "decode"),
+      decode: /* @__PURE__ */ __name(() => decode2, "decode"),
       decodeAsync: /* @__PURE__ */ __name(() => decodeAsync, "decodeAsync"),
       describe: /* @__PURE__ */ __name(() => describe, "describe"),
-      encode: /* @__PURE__ */ __name(() => encode, "encode"),
+      encode: /* @__PURE__ */ __name(() => encode2, "encode"),
       encodeAsync: /* @__PURE__ */ __name(() => encodeAsync, "encodeAsync"),
       extractDefs: /* @__PURE__ */ __name(() => extractDefs, "extractDefs"),
       finalize: /* @__PURE__ */ __name(() => finalize, "finalize"),
@@ -1815,18 +1857,18 @@ var require_types_cjs_development = __commonJS({
     __name2(cleanEnum, "cleanEnum");
     function base64ToUint8Array(base643) {
       const binaryString = atob(base643);
-      const bytes = new Uint8Array(binaryString.length);
+      const bytes2 = new Uint8Array(binaryString.length);
       for (let i = 0; i < binaryString.length; i++) {
-        bytes[i] = binaryString.charCodeAt(i);
+        bytes2[i] = binaryString.charCodeAt(i);
       }
-      return bytes;
+      return bytes2;
     }
     __name(base64ToUint8Array, "base64ToUint8Array");
     __name2(base64ToUint8Array, "base64ToUint8Array");
-    function uint8ArrayToBase64(bytes) {
+    function uint8ArrayToBase64(bytes2) {
       let binaryString = "";
-      for (let i = 0; i < bytes.length; i++) {
-        binaryString += String.fromCharCode(bytes[i]);
+      for (let i = 0; i < bytes2.length; i++) {
+        binaryString += String.fromCharCode(bytes2[i]);
       }
       return btoa(binaryString);
     }
@@ -1839,8 +1881,8 @@ var require_types_cjs_development = __commonJS({
     }
     __name(base64urlToUint8Array, "base64urlToUint8Array");
     __name2(base64urlToUint8Array, "base64urlToUint8Array");
-    function uint8ArrayToBase64url(bytes) {
-      return uint8ArrayToBase64(bytes).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+    function uint8ArrayToBase64url(bytes2) {
+      return uint8ArrayToBase64(bytes2).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
     }
     __name(uint8ArrayToBase64url, "uint8ArrayToBase64url");
     __name2(uint8ArrayToBase64url, "uint8ArrayToBase64url");
@@ -1849,16 +1891,16 @@ var require_types_cjs_development = __commonJS({
       if (cleanHex.length % 2 !== 0) {
         throw new Error("Invalid hex string length");
       }
-      const bytes = new Uint8Array(cleanHex.length / 2);
+      const bytes2 = new Uint8Array(cleanHex.length / 2);
       for (let i = 0; i < cleanHex.length; i += 2) {
-        bytes[i / 2] = Number.parseInt(cleanHex.slice(i, i + 2), 16);
+        bytes2[i / 2] = Number.parseInt(cleanHex.slice(i, i + 2), 16);
       }
-      return bytes;
+      return bytes2;
     }
     __name(hexToUint8Array, "hexToUint8Array");
     __name2(hexToUint8Array, "hexToUint8Array");
-    function uint8ArrayToHex(bytes) {
-      return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+    function uint8ArrayToHex(bytes2) {
+      return Array.from(bytes2).map((b) => b.toString(16).padStart(2, "0")).join("");
     }
     __name(uint8ArrayToHex, "uint8ArrayToHex");
     __name2(uint8ArrayToHex, "uint8ArrayToHex");
@@ -2073,11 +2115,11 @@ var require_types_cjs_development = __commonJS({
       const ctx = _ctx ? { ..._ctx, direction: "backward" } : { direction: "backward" };
       return _parse(_Err)(schema, value, ctx);
     }, "_encode");
-    var encode = /* @__PURE__ */ _encode($ZodRealError);
+    var encode2 = /* @__PURE__ */ _encode($ZodRealError);
     var _decode = /* @__PURE__ */ __name2((_Err) => (schema, value, _ctx) => {
       return _parse(_Err)(schema, value, _ctx);
     }, "_decode");
-    var decode = /* @__PURE__ */ _decode($ZodRealError);
+    var decode2 = /* @__PURE__ */ _decode($ZodRealError);
     var _encodeAsync = /* @__PURE__ */ __name2((_Err) => async (schema, value, _ctx) => {
       const ctx = _ctx ? { ..._ctx, direction: "backward" } : { direction: "backward" };
       return _parseAsync(_Err)(schema, value, ctx);
@@ -2125,7 +2167,7 @@ var require_types_cjs_development = __commonJS({
       emoji: /* @__PURE__ */ __name(() => emoji, "emoji"),
       extendedDuration: /* @__PURE__ */ __name(() => extendedDuration, "extendedDuration"),
       guid: /* @__PURE__ */ __name(() => guid, "guid"),
-      hex: /* @__PURE__ */ __name(() => hex, "hex"),
+      hex: /* @__PURE__ */ __name(() => hex2, "hex"),
       hostname: /* @__PURE__ */ __name(() => hostname, "hostname"),
       html5Email: /* @__PURE__ */ __name(() => html5Email, "html5Email"),
       httpProtocol: /* @__PURE__ */ __name(() => httpProtocol, "httpProtocol"),
@@ -2248,7 +2290,7 @@ var require_types_cjs_development = __commonJS({
     var _undefined = /^undefined$/i;
     var lowercase = /^[^A-Z]*$/;
     var uppercase = /^[^a-z]*$/;
-    var hex = /^[0-9a-fA-F]*$/;
+    var hex2 = /^[0-9a-fA-F]*$/;
     function fixedBase64(bodyLength, padding) {
       return new RegExp(`^[A-Za-z0-9+/]{${bodyLength}}${padding}$`);
     }
@@ -3952,19 +3994,19 @@ var require_types_cjs_development = __commonJS({
       });
       const disc = cached(() => {
         const opts = def.options;
-        const map2 = /* @__PURE__ */ new Map();
+        const map22 = /* @__PURE__ */ new Map();
         for (const o of opts) {
           const values = o._zod.propValues?.[def.discriminator];
           if (!values || values.size === 0)
             throw new Error(`Invalid discriminated union option at index "${def.options.indexOf(o)}"`);
           for (const v of values) {
-            if (map2.has(v)) {
+            if (map22.has(v)) {
               throw new Error(`Duplicate discriminator value "${String(v)}"`);
             }
-            map2.set(v, o);
+            map22.set(v, o);
           }
         }
-        return map2;
+        return map22;
       });
       inst._zod.parse = (payload, ctx) => {
         const input = payload.value;
@@ -13481,7 +13523,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       function: /* @__PURE__ */ __name(() => _function, "function"),
       guid: /* @__PURE__ */ __name(() => guid2, "guid"),
       hash: /* @__PURE__ */ __name(() => hash, "hash"),
-      hex: /* @__PURE__ */ __name(() => hex2, "hex"),
+      hex: /* @__PURE__ */ __name(() => hex22, "hex"),
       hostname: /* @__PURE__ */ __name(() => hostname2, "hostname"),
       httpUrl: /* @__PURE__ */ __name(() => httpUrl, "httpUrl"),
       instanceof: /* @__PURE__ */ __name(() => _instanceof, "instanceof"),
@@ -13501,7 +13543,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       looseObject: /* @__PURE__ */ __name(() => looseObject, "looseObject"),
       looseRecord: /* @__PURE__ */ __name(() => looseRecord, "looseRecord"),
       mac: /* @__PURE__ */ __name(() => mac2, "mac"),
-      map: /* @__PURE__ */ __name(() => map, "map"),
+      map: /* @__PURE__ */ __name(() => map2, "map"),
       meta: /* @__PURE__ */ __name(() => meta2, "meta"),
       nan: /* @__PURE__ */ __name(() => nan, "nan"),
       nanoid: /* @__PURE__ */ __name(() => nanoid2, "nanoid"),
@@ -13669,8 +13711,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
     var parseAsync2 = /* @__PURE__ */ _parseAsync(ZodRealError);
     var safeParse2 = /* @__PURE__ */ _safeParse(ZodRealError);
     var safeParseAsync2 = /* @__PURE__ */ _safeParseAsync(ZodRealError);
-    var encode2 = /* @__PURE__ */ _encode(ZodRealError);
-    var decode2 = /* @__PURE__ */ _decode(ZodRealError);
+    var encode22 = /* @__PURE__ */ _encode(ZodRealError);
+    var decode22 = /* @__PURE__ */ _decode(ZodRealError);
     var encodeAsync2 = /* @__PURE__ */ _encodeAsync(ZodRealError);
     var decodeAsync2 = /* @__PURE__ */ _decodeAsync(ZodRealError);
     var safeEncode2 = /* @__PURE__ */ _safeEncode(ZodRealError);
@@ -13733,8 +13775,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       inst.parseAsync = async (data, params) => parseAsync2(inst, data, params, { callee: inst.parseAsync });
       inst.safeParseAsync = async (data, params) => safeParseAsync2(inst, data, params);
       inst.spa = inst.safeParseAsync;
-      inst.encode = (data, params) => encode2(inst, data, params);
-      inst.decode = (data, params) => decode2(inst, data, params);
+      inst.encode = (data, params) => encode22(inst, data, params);
+      inst.decode = (data, params) => decode22(inst, data, params);
       inst.encodeAsync = async (data, params) => encodeAsync2(inst, data, params);
       inst.decodeAsync = async (data, params) => decodeAsync2(inst, data, params);
       inst.safeEncode = (data, params) => safeEncode2(inst, data, params);
@@ -14159,11 +14201,11 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
     }
     __name(hostname2, "hostname2");
     __name2(hostname2, "hostname");
-    function hex2(_params) {
+    function hex22(_params) {
       return /* @__PURE__ */ _stringFormat(ZodCustomStringFormat, "hex", regexes_exports.hex, _params);
     }
-    __name(hex2, "hex2");
-    __name2(hex2, "hex");
+    __name(hex22, "hex2");
+    __name2(hex22, "hex");
     function hash(alg, params) {
       const enc = params?.enc ?? "hex";
       const format = `${alg}_${enc}`;
@@ -14655,7 +14697,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       inst.max = (...args) => inst.check(/* @__PURE__ */ _maxSize(...args));
       inst.size = (...args) => inst.check(/* @__PURE__ */ _size(...args));
     });
-    function map(keyType, valueType, params) {
+    function map2(keyType, valueType, params) {
       return new ZodMap({
         type: "map",
         keyType,
@@ -14663,8 +14705,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
         ...util_exports.normalizeParams(params)
       });
     }
-    __name(map, "map");
-    __name2(map, "map");
+    __name(map2, "map");
+    __name2(map2, "map");
     var ZodSet = /* @__PURE__ */ $constructor("ZodSet", (inst, def) => {
       $ZodSet.init(inst, def);
       ZodType.init(inst, def);
@@ -15164,9 +15206,9 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       invalid_value: "invalid_value",
       custom: "custom"
     };
-    function setErrorMap(map2) {
+    function setErrorMap(map22) {
       config({
-        customError: map2
+        customError: map22
       });
     }
     __name(setErrorMap, "setErrorMap");
@@ -16124,7 +16166,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       "replacedBy"
     ]).or(external_exports.string());
     var AssociationValidator = external_exports.object({
-      type: external_exports.string().array().nonempty(),
+      // Accept compacted scalars while retaining the existing permissive array contract.
+      type: external_exports.string().min(1).or(external_exports.string().array().nonempty()),
       associationType: AssociationTypeValidator,
       sourceId: external_exports.string().optional(),
       targetId: external_exports.string()
@@ -16947,11 +16990,48 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       updatedAt: external_exports.string(),
       expiresAt: external_exports.string().optional(),
       autoBoosts: external_exports.string().array().optional(),
-      writers: external_exports.array(LCNProfileValidator).optional()
+      writers: external_exports.array(LCNProfileValidator).optional(),
+      recipients: external_exports.array(LCNPublicProfileValidator.extend({ did: external_exports.string() })).optional(),
+      audienceVersion: external_exports.number().int().nonnegative().optional()
     });
-    var ConsentFlowContractRequestStatusValidator = external_exports.enum(["pending", "accepted", "denied"]).nullable();
+    var ConsentFlowContractRequestStatusValidator = external_exports.enum(["pending", "accepted", "denied", "cancelled"]).nullable();
     var ConsentFlowContractRequestReadStatusValidator = external_exports.enum(["unseen", "seen"]).nullable();
-    var ConsentFlowContractRequestForProfileValidator = external_exports.object({
+    var ConsentFlowReferralValidator = external_exports.object({
+      requestId: external_exports.string(),
+      requestedBy: external_exports.string(),
+      externalReferenceId: external_exports.string().max(256).optional()
+    });
+    var ContractRequestFieldsValidator = ConsentFlowReferralValidator.partial().extend({
+      requestedAt: external_exports.string().optional(),
+      message: external_exports.string().max(500).optional()
+    });
+    var SendContractRequestValidator = external_exports.object({
+      contractUri: external_exports.string(),
+      targetProfileId: external_exports.string(),
+      externalReferenceId: external_exports.string().trim().min(1).max(256).optional(),
+      message: external_exports.string().trim().max(500).optional()
+    });
+    var ConsentFlowWebhookMetadataValidator = external_exports.object({
+      eventId: external_exports.string(),
+      deliveryKey: external_exports.string(),
+      event: external_exports.enum([
+        "request_sent",
+        "request_accepted",
+        "request_denied",
+        "request_cancelled",
+        "consent_created",
+        "consent_updated",
+        "consent_withdrawn",
+        "credentials_synced"
+      ]),
+      contractUri: external_exports.string(),
+      termsUri: external_exports.string().optional(),
+      requestId: external_exports.string().optional(),
+      requestedBy: external_exports.string().optional(),
+      externalReferenceId: external_exports.string().optional(),
+      recipientRole: external_exports.enum(["owner", "recipient", "requester", "target"])
+    });
+    var ConsentFlowContractRequestForProfileValidator = ContractRequestFieldsValidator.extend({
       profile: LCNProfileValidator,
       status: ConsentFlowContractRequestStatusValidator,
       readStatus: ConsentFlowContractRequestReadStatusValidator.optional()
@@ -16997,6 +17077,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
         expiresAt: external_exports.string().optional(),
         oneTime: external_exports.boolean().optional(),
         terms: ConsentFlowTermsValidator,
+        referral: ConsentFlowReferralValidator.optional(),
         contract: ConsentFlowContractDetailsValidator,
         uri: external_exports.string(),
         consenter: LCNProfileValidator,
@@ -17092,6 +17173,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       oneTime: external_exports.boolean().optional(),
       terms: ConsentFlowTermsValidator.optional(),
       guardianApproval: ConsentFlowGuardianApprovalValidator.optional(),
+      referral: ConsentFlowReferralValidator.optional(),
       id: external_exports.string(),
       action: ConsentFlowTransactionActionValidator,
       date: external_exports.string(),
@@ -17102,6 +17184,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       status: ConsentFlowTermsStatusValidator,
       contract: ConsentFlowContractDetailsValidator,
       terms: ConsentFlowTermsValidator,
+      referral: ConsentFlowReferralValidator.optional(),
       transactions: ConsentFlowTransactionValidator.array()
     });
     var HolderExportMetadataValidator = external_exports.object({
@@ -17838,7 +17921,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       displayName: external_exports.string(),
       email: external_exports.string().optional()
     });
-    var AppStoreListingValidator = external_exports.object({
+    var AppStoreListingFieldsValidator = external_exports.object({
       listing_id: external_exports.string(),
       slug: external_exports.string().optional(),
       display_name: external_exports.string(),
@@ -17864,15 +17947,33 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       submitter: AppStoreListingSubmitterValidator.optional(),
       contact_email: external_exports.string().email().optional()
     });
+    var PendingListingUpdateStatusValidator = external_exports.enum(["DRAFT", "PENDING_REVIEW"]);
+    var PendingListingUpdateValidator = external_exports.object({
+      status: PendingListingUpdateStatusValidator,
+      submitted_at: external_exports.string().optional(),
+      changes: AppStoreListingFieldsValidator.omit({
+        listing_id: true,
+        app_listing_status: true,
+        promotion_level: true,
+        submitted_at: true,
+        submitter: true
+      }).partial(),
+      manifest_version: external_exports.number().int().min(1).optional()
+    });
+    var AppStoreListingValidator = AppStoreListingFieldsValidator.extend({
+      pending_update: PendingListingUpdateValidator.optional()
+    });
     var AppStoreListingCreateValidator = AppStoreListingValidator.omit({
       listing_id: true,
       app_listing_status: true,
-      promotion_level: true
+      promotion_level: true,
+      pending_update: true
     });
     var AppStoreListingUpdateValidator = AppStoreListingValidator.partial().omit({
       listing_id: true,
       app_listing_status: true,
-      promotion_level: true
+      promotion_level: true,
+      pending_update: true
     });
     var InstalledAppValidator = AppStoreListingValidator.extend({
       installed_at: external_exports.string()
@@ -17887,12 +17988,87 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       templateAlias: external_exports.string().min(1).max(50).regex(/^[a-z0-9-]+$/),
       boostUri: external_exports.string()
     });
-    var SendCredentialEventValidator = external_exports.object({
+    var InlineWalletCategoryValidator = external_exports.enum([
+      "Achievement",
+      "Skill",
+      "ID",
+      "Learning History",
+      "Work History",
+      "Social Badges",
+      "Membership",
+      "Accomplishment",
+      "Experiences",
+      "Accommodation",
+      "Family"
+    ]);
+    var InlineAlignmentValidator = external_exports.object({
+      name: external_exports.string(),
+      url: external_exports.string(),
+      framework: external_exports.string().optional(),
+      code: external_exports.string().optional()
+    }).passthrough();
+    var InlineEvidenceValidator = external_exports.object({
+      id: external_exports.string().optional(),
+      name: external_exports.string().optional(),
+      narrative: external_exports.string().optional()
+    }).passthrough();
+    var InlineWalletSkillTagValidator = external_exports.object({
+      frameworkId: external_exports.string(),
+      id: external_exports.string(),
+      proficiencyLevel: external_exports.string().optional()
+    }).passthrough();
+    var SimpleInlineCredentialTemplateValidator = external_exports.object({
+      rawCredential: external_exports.undefined().optional(),
+      name: external_exports.string(),
+      description: external_exports.string().optional(),
+      image: external_exports.string().optional(),
+      issuerName: external_exports.string().optional(),
+      achievementType: external_exports.string().optional(),
+      category: InlineWalletCategoryValidator.optional(),
+      criteria: external_exports.object({
+        narrative: external_exports.string().optional(),
+        url: external_exports.string().optional()
+      }).passthrough().optional(),
+      alignments: external_exports.array(InlineAlignmentValidator).optional(),
+      tags: external_exports.array(external_exports.string()).optional(),
+      activity: external_exports.object({
+        startDate: external_exports.string().optional(),
+        endDate: external_exports.string().optional()
+      }).passthrough().optional(),
+      credits: external_exports.object({
+        earned: external_exports.union([external_exports.number(), external_exports.string()]).optional(),
+        available: external_exports.union([external_exports.number(), external_exports.string()]).optional()
+      }).passthrough().optional(),
+      validUntil: external_exports.string().optional(),
+      evidence: external_exports.array(InlineEvidenceValidator).optional(),
+      walletSkills: external_exports.array(InlineWalletSkillTagValidator).optional()
+    }).passthrough();
+    var RawInlineCredentialTemplateValidator = external_exports.object({
+      rawCredential: external_exports.record(external_exports.string(), external_exports.unknown()),
+      category: InlineWalletCategoryValidator.optional(),
+      walletSkills: external_exports.array(InlineWalletSkillTagValidator).optional()
+    }).passthrough();
+    var InlineCredentialTemplateValidator = external_exports.union([
+      RawInlineCredentialTemplateValidator,
+      SimpleInlineCredentialTemplateValidator
+    ]);
+    var LegacySendCredentialEventValidator = external_exports.object({
       type: external_exports.literal("send-credential"),
       templateAlias: external_exports.string(),
       templateData: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
       preventDuplicateClaim: external_exports.boolean().optional()
     });
+    var InlineSendCredentialEventValidator = external_exports.object({
+      type: external_exports.literal("send-credential"),
+      alias: external_exports.string(),
+      template: InlineCredentialTemplateValidator,
+      templateData: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
+      preventDuplicateClaim: external_exports.boolean().optional()
+    });
+    var SendCredentialEventValidator = external_exports.union([
+      LegacySendCredentialEventValidator,
+      InlineSendCredentialEventValidator
+    ]);
     var CheckCredentialEventValidator = external_exports.object({
       type: external_exports.literal("check-credential"),
       templateAlias: external_exports.string().optional(),
@@ -17987,7 +18163,119 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       type: external_exports.literal("get-counters"),
       keys: external_exports.array(counterKeyValidator).min(1).max(50).optional()
     });
-    var AppEventValidator = external_exports.discriminatedUnion("type", [
+    var ConsentRequestWalletCategoryValidator = external_exports.enum([
+      "Achievement",
+      "Skill",
+      "ID",
+      "Learning History",
+      "Work History",
+      "Social Badges",
+      "Membership",
+      "Accomplishment",
+      "Experiences",
+      "Accommodation",
+      "Family"
+    ]);
+    var ConsentRequestPersonalFieldValidator = external_exports.enum([
+      "name",
+      "email",
+      "phone",
+      "birthDate",
+      "country",
+      "avatar"
+    ]);
+    var ConsentRequestValidator = external_exports.object({
+      read: external_exports.object({
+        credentialCategories: external_exports.array(ConsentRequestWalletCategoryValidator).optional(),
+        personalFields: external_exports.array(ConsentRequestPersonalFieldValidator).optional()
+      }).optional(),
+      write: external_exports.object({
+        credentialCategories: external_exports.array(ConsentRequestWalletCategoryValidator).optional()
+      }).optional(),
+      reason: external_exports.string().optional()
+    });
+    var NormalizedConsentScopesValidator = external_exports.object({
+      read: external_exports.object({
+        credentialCategories: external_exports.array(ConsentRequestWalletCategoryValidator).default([]),
+        personalFields: external_exports.array(ConsentRequestPersonalFieldValidator).default([])
+      }),
+      write: external_exports.object({
+        credentialCategories: external_exports.array(ConsentRequestWalletCategoryValidator).default([])
+      })
+    });
+    var CapturedTemplateRecordValidator = external_exports.object({
+      alias: external_exports.string(),
+      template: InlineCredentialTemplateValidator,
+      version: external_exports.number().int().min(1),
+      lastUsedAt: external_exports.string()
+    }).passthrough();
+    var CapturedConsentRecordValidator = external_exports.object({
+      scopes: NormalizedConsentScopesValidator,
+      reason: external_exports.string().optional(),
+      lastUsedAt: external_exports.string()
+    }).passthrough();
+    var AppManifestValidator = external_exports.object({
+      manifestVersion: external_exports.literal(1),
+      appUrl: external_exports.string(),
+      appKey: external_exports.string().max(200).optional(),
+      suggestedName: external_exports.string().optional(),
+      suggestedIconUrl: external_exports.string().optional(),
+      permissions: external_exports.array(external_exports.string()).default([]),
+      templates: external_exports.array(CapturedTemplateRecordValidator).default([]),
+      consentRequests: external_exports.array(CapturedConsentRecordValidator).default([]),
+      usedConsentContract: external_exports.boolean().optional(),
+      featuresLaunched: external_exports.array(external_exports.string()).default([]),
+      counterKeys: external_exports.array(external_exports.string()).default([]),
+      usedLearnerContext: external_exports.boolean(),
+      usedNotifications: external_exports.boolean(),
+      firstCapturedAt: external_exports.string(),
+      lastUpdatedAt: external_exports.string()
+    }).passthrough();
+    var AppManifestVersionStatusValidator = external_exports.enum(["draft", "active", "superseded"]);
+    var AppManifestVersionValidator = external_exports.object({
+      id: external_exports.string(),
+      version: external_exports.number().int().min(1),
+      manifestHash: external_exports.string(),
+      manifest: AppManifestValidator,
+      status: AppManifestVersionStatusValidator,
+      createdAt: external_exports.string(),
+      activatedAt: external_exports.string().optional()
+    });
+    var AppManifestStringDiffValidator = external_exports.object({
+      added: external_exports.array(external_exports.string()),
+      removed: external_exports.array(external_exports.string()),
+      changed: external_exports.array(external_exports.string())
+    });
+    var AppManifestTemplateRefValidator = external_exports.object({
+      alias: external_exports.string(),
+      version: external_exports.number().int().min(1)
+    });
+    var AppManifestTemplateChangeValidator = external_exports.object({
+      alias: external_exports.string(),
+      fromVersion: external_exports.number().int().min(1),
+      toVersion: external_exports.number().int().min(1)
+    });
+    var AppManifestDiffValidator = external_exports.object({
+      permissions: AppManifestStringDiffValidator,
+      templates: external_exports.object({
+        added: external_exports.array(AppManifestTemplateRefValidator),
+        removed: external_exports.array(AppManifestTemplateRefValidator),
+        changed: external_exports.array(AppManifestTemplateChangeValidator)
+      }),
+      consentScopes: AppManifestStringDiffValidator,
+      featurePaths: AppManifestStringDiffValidator,
+      counterKeys: AppManifestStringDiffValidator,
+      requiresReview: external_exports.boolean()
+    });
+    var UpsertConsentContractEventValidator = external_exports.object({
+      type: external_exports.literal("upsert-consent-contract"),
+      scopes: ConsentRequestValidator
+    });
+    var UpsertConsentContractResponseValidator = external_exports.object({
+      contractUri: external_exports.string(),
+      created: external_exports.boolean()
+    });
+    var AppEventValidator = external_exports.union([
       SendCredentialEventValidator,
       CheckCredentialEventValidator,
       CheckIssuanceStatusEventValidator,
@@ -17997,7 +18285,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       SendNotificationEventValidator,
       IncrementCounterEventValidator,
       GetCounterEventValidator,
-      GetCountersEventValidator
+      GetCountersEventValidator,
+      UpsertConsentContractEventValidator
     ]);
     var AppEventInputValidator = external_exports.object({
       listingId: external_exports.string(),
@@ -18076,6 +18365,20 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
         __name2(this, "AuthSessionError");
       }
     };
+    var UnsupportedSignInOperationError = class extends Error {
+      static {
+        __name(this, "UnsupportedSignInOperationError");
+      }
+      constructor(operation, providerType) {
+        super(`${operation} is not supported by ${providerType}`);
+        this.operation = operation;
+        this.providerType = providerType;
+        this.name = "UnsupportedSignInOperationError";
+      }
+      static {
+        __name2(this, "UnsupportedSignInOperationError");
+      }
+    };
     var ESCROW_PIN_LOCKED_MESSAGE2 = "Too many incorrect PIN attempts. You can still recover by waiting.";
     var ESCROW_PIN_UNAVAILABLE_MESSAGE2 = "PIN recovery is not available for this account.";
     var ESCROW_PIN_MISMATCH_PATTERN2 = /^Incorrect PIN\. (\d+) attempts left\.$/;
@@ -18222,12 +18525,12 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       }
       return table;
     })();
-    var encodeBase64Url = /* @__PURE__ */ __name2((bytes) => {
+    var encodeBase64Url = /* @__PURE__ */ __name2((bytes2) => {
       let output = "";
-      for (let index = 0; index < bytes.length; index += 3) {
-        const first = bytes[index];
-        const second = bytes[index + 1];
-        const third = bytes[index + 2];
+      for (let index = 0; index < bytes2.length; index += 3) {
+        const first = bytes2[index];
+        const second = bytes2[index + 1];
+        const third = bytes2[index + 2];
         output += BASE64URL_ALPHABET[first >> 2];
         output += BASE64URL_ALPHABET[(first & 3) << 4 | (second ?? 0) >> 4];
         if (second === void 0) break;
@@ -18268,8 +18571,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
     }, "isCanonicalBase64Url");
     var decodedBase64UrlByteLength = /* @__PURE__ */ __name2((value) => decodeBase64Url(value)?.length ?? null, "decodedBase64UrlByteLength");
     var utf8ByteLength = /* @__PURE__ */ __name2((value) => new TextEncoder().encode(value).length, "utf8ByteLength");
-    var canonicalBase64Url = /* @__PURE__ */ __name2((bytes) => external_exports.string().refine((value) => isCanonicalBase64Url(value, bytes), {
-      message: `must be canonical base64url for exactly ${bytes} bytes`
+    var canonicalBase64Url = /* @__PURE__ */ __name2((bytes2) => external_exports.string().refine((value) => isCanonicalBase64Url(value, bytes2), {
+      message: `must be canonical base64url for exactly ${bytes2} bytes`
     }), "canonicalBase64Url");
     var ShareLinkIdValidator = canonicalBase64Url(SHARE_LINK_ID_BYTES);
     var ShareContentKeyValidator = canonicalBase64Url(SHARE_CONTENT_KEY_BYTES);
@@ -18505,6 +18808,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       version: safeVersion,
       contentVersion: safeVersion,
       status: ShareLinkStatusValidator,
+      attachmentId: external_exports.string().uuid().nullable().optional(),
+      attachmentChunkCount: external_exports.number().int().min(1).max(16).nullable().optional(),
       contentState: ShareContentStateValidator,
       createdAt: external_exports.iso.datetime(),
       updatedAt: external_exports.iso.datetime(),
@@ -18528,6 +18833,43 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       contentUrl: external_exports.string().optional()
     });
     var clientRequestId = external_exports.string().uuid();
+    var ShareLinkAttachmentValidator = external_exports.object({
+      id: external_exports.string().uuid(),
+      chunkCount: external_exports.number().int().min(1).max(16)
+    }).strict();
+    var attachmentChunkKey = {
+      id: ShareLinkIdValidator,
+      contentVersion: safeVersion,
+      attachmentId: external_exports.string().uuid(),
+      chunkIndex: external_exports.number().int().min(0).max(15)
+    };
+    var ShareLinkAttachmentChunkEnvelopeValidator = ShareEnvelopeValidator.refine(
+      (value) => (decodedBase64UrlByteLength(value.ct) ?? Infinity) <= 256 * 1024 + SHARE_TAG_BYTES
+    );
+    var PutShareLinkAttachmentChunkInputValidator = external_exports.object({
+      ...attachmentChunkKey,
+      chunkCount: external_exports.number().int().min(1).max(16),
+      envelope: ShareLinkAttachmentChunkEnvelopeValidator,
+      ownerEncryptedRecovery: ShareOwnerRecoveryValidator
+    }).strict().refine((value) => value.chunkIndex < value.chunkCount);
+    var GetShareLinkAttachmentChunkInputValidator = external_exports.object({
+      ...attachmentChunkKey,
+      passcode: external_exports.string().min(4).max(64).optional(),
+      accessToken: external_exports.string().min(1).max(2048).optional()
+    }).strict();
+    var ShareLinkAttachmentChunkOutputValidator = external_exports.object({
+      ...attachmentChunkKey,
+      envelope: ShareLinkAttachmentChunkEnvelopeValidator,
+      accessToken: external_exports.string().min(1).max(2048).optional()
+    }).strict();
+    var DeleteShareLinkAttachmentChunksInputValidator = external_exports.object({
+      id: ShareLinkIdValidator,
+      contentVersion: safeVersion,
+      attachmentId: external_exports.string().uuid(),
+      chunkCount: external_exports.number().int().min(1).max(16)
+    }).strict();
+    var PutShareLinkAttachmentChunkOutputValidator = external_exports.object({ ok: external_exports.literal(true) }).strict();
+    var DeleteShareLinkAttachmentChunksOutputValidator = external_exports.object({ ok: external_exports.boolean() }).strict();
     var CreateShareLinkInputValidator = external_exports.object({
       id: ShareLinkIdValidator,
       clientRequestId,
@@ -18539,7 +18881,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       selectedCount: external_exports.number().int().min(1).max(MAX_SELECTED_CREDENTIALS),
       contentVersion: external_exports.literal(1),
       envelope: ShareEnvelopeValidator,
-      ownerEncryptedRecovery: ShareOwnerRecoveryValidator
+      ownerEncryptedRecovery: ShareOwnerRecoveryValidator,
+      attachment: ShareLinkAttachmentValidator.optional()
     }).strict();
     var UpdateShareLinkInputValidator = external_exports.object({
       id: ShareLinkIdValidator,
@@ -18554,7 +18897,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       contentVersion: safeVersion.optional(),
       selectedCount: external_exports.number().int().min(1).max(MAX_SELECTED_CREDENTIALS).optional(),
       envelope: ShareEnvelopeValidator.optional(),
-      ownerEncryptedRecovery: ShareOwnerRecoveryValidator.optional()
+      ownerEncryptedRecovery: ShareOwnerRecoveryValidator.optional(),
+      attachment: ShareLinkAttachmentValidator.optional()
     }).strict().superRefine((value, ctx) => {
       const provided = [
         value.contentVersion,
@@ -18568,6 +18912,9 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
           message: "content replacement requires contentVersion, selectedCount, envelope and ownerEncryptedRecovery together"
         });
       }
+      if (value.attachment !== void 0 && provided !== 4) {
+        ctx.addIssue({ code: "custom", message: "attachment requires a content replacement" });
+      }
     });
     var ShareLinkIdInputValidator = external_exports.object({ id: ShareLinkIdValidator }).strict();
     var ShareLinkOperationKeyInputValidator = external_exports.object({ id: ShareLinkIdValidator, operationId: external_exports.string().uuid() }).strict();
@@ -18688,6 +19035,7 @@ __export(index_exports, {
   EscrowPinUnavailableError: () => EscrowPinUnavailableError,
   EscrowRequestError: () => EscrowRequestError,
   IdentityRecoverySessionConsumedError: () => IdentityRecoverySessionConsumedError,
+  NitroAttestationError: () => NitroAttestationError,
   PIN_MAX_LENGTH: () => PIN_MAX_LENGTH,
   PIN_MIN_LENGTH: () => PIN_MIN_LENGTH,
   SSSApiClient: () => SSSApiClient,
@@ -18763,6 +19111,7 @@ __export(index_exports, {
   validatePin: () => validatePin,
   validateRecoveryPhrase: () => validateRecoveryPhrase,
   verifyEnclaveAttestation: () => verifyEnclaveAttestation,
+  verifyNitroAttestationDocument: () => verifyNitroAttestationDocument,
   verifyStoredShares: () => verifyStoredShares
 });
 module.exports = __toCommonJS(index_exports);
@@ -18924,33 +19273,33 @@ var DEFAULT_KDF_PARAMS = {
   parallelism: ARGON2_PARALLELISM
 };
 function bufferToBase64(buf) {
-  const bytes = new Uint8Array(buf);
+  const bytes2 = new Uint8Array(buf);
   let binary = "";
-  for (let i = 0; i < bytes.byteLength; i++) {
-    binary += String.fromCharCode(bytes[i]);
+  for (let i = 0; i < bytes2.byteLength; i++) {
+    binary += String.fromCharCode(bytes2[i]);
   }
   return btoa(binary);
 }
 __name(bufferToBase64, "bufferToBase64");
 function base64ToBuffer(b64) {
   const binary = atob(b64);
-  const bytes = new Uint8Array(binary.length);
+  const bytes2 = new Uint8Array(binary.length);
   for (let i = 0; i < binary.length; i++) {
-    bytes[i] = binary.charCodeAt(i);
+    bytes2[i] = binary.charCodeAt(i);
   }
-  return bytes;
+  return bytes2;
 }
 __name(base64ToBuffer, "base64ToBuffer");
-function hexToBytes(hex) {
-  const bytes = new Uint8Array(hex.length / 2);
-  for (let i = 0; i < hex.length; i += 2) {
-    bytes[i / 2] = parseInt(hex.slice(i, i + 2), 16);
+function hexToBytes(hex2) {
+  const bytes2 = new Uint8Array(hex2.length / 2);
+  for (let i = 0; i < hex2.length; i += 2) {
+    bytes2[i / 2] = parseInt(hex2.slice(i, i + 2), 16);
   }
-  return bytes;
+  return bytes2;
 }
 __name(hexToBytes, "hexToBytes");
-function bytesToHex(bytes) {
-  return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+function bytesToHex(bytes2) {
+  return Array.from(bytes2).map((b) => b.toString(16).padStart(2, "0")).join("");
 }
 __name(bytesToHex, "bytesToHex");
 async function deriveKeyFromPassword(password, salt, params = DEFAULT_KDF_PARAMS) {
@@ -19117,21 +19466,21 @@ async function getOrCreateMasterKey() {
 }
 __name(getOrCreateMasterKey, "getOrCreateMasterKey");
 function bufferToBase642(buf) {
-  const bytes = new Uint8Array(buf);
+  const bytes2 = new Uint8Array(buf);
   let binary = "";
-  for (let i = 0; i < bytes.byteLength; i++) {
-    binary += String.fromCharCode(bytes[i]);
+  for (let i = 0; i < bytes2.byteLength; i++) {
+    binary += String.fromCharCode(bytes2[i]);
   }
   return btoa(binary);
 }
 __name(bufferToBase642, "bufferToBase64");
 function base64ToBuffer2(b64) {
   const binary = atob(b64);
-  const bytes = new Uint8Array(binary.length);
+  const bytes2 = new Uint8Array(binary.length);
   for (let i = 0; i < binary.length; i++) {
-    bytes[i] = binary.charCodeAt(i);
+    bytes2[i] = binary.charCodeAt(i);
   }
-  return bytes.buffer;
+  return bytes2.buffer;
 }
 __name(base64ToBuffer2, "base64ToBuffer");
 async function encryptShare(share, id) {
@@ -19539,16 +19888,16 @@ async function getWordlist() {
   return wordlistPromise;
 }
 __name(getWordlist, "getWordlist");
-function bytesToBits(bytes) {
-  return Array.from(bytes).map((b) => b.toString(2).padStart(8, "0")).join("");
+function bytesToBits(bytes2) {
+  return Array.from(bytes2).map((b) => b.toString(2).padStart(8, "0")).join("");
 }
 __name(bytesToBits, "bytesToBits");
 function bitsToBytes(bits) {
-  const bytes = new Uint8Array(Math.ceil(bits.length / 8));
-  for (let i = 0; i < bytes.length; i++) {
-    bytes[i] = parseInt(bits.slice(i * 8, (i + 1) * 8).padEnd(8, "0"), 2);
+  const bytes2 = new Uint8Array(Math.ceil(bits.length / 8));
+  for (let i = 0; i < bytes2.length; i++) {
+    bytes2[i] = parseInt(bits.slice(i * 8, (i + 1) * 8).padEnd(8, "0"), 2);
   }
-  return bytes;
+  return bytes2;
 }
 __name(bitsToBytes, "bitsToBytes");
 async function computeChecksum(data) {
@@ -19586,12 +19935,12 @@ async function recoveryPhraseToShare(phrase) {
     bits += index.toString(2).padStart(11, "0");
   }
   let dataByteCount = 0;
-  for (let bytes = 1; bytes <= 64; bytes++) {
-    const checksumBits2 = Math.floor(bytes / 4);
-    const totalBits = bytes * 8 + checksumBits2;
+  for (let bytes2 = 1; bytes2 <= 64; bytes2++) {
+    const checksumBits2 = Math.floor(bytes2 / 4);
+    const totalBits = bytes2 * 8 + checksumBits2;
     const wordsNeeded = Math.ceil(totalBits / 11);
     if (wordsNeeded === words.length) {
-      dataByteCount = bytes;
+      dataByteCount = bytes2;
     } else if (wordsNeeded > words.length) {
       break;
     }
@@ -19885,9 +20234,9 @@ __name(createSSSKeyManager, "createSSSKeyManager");
 var EMAIL_RELAY_ENVELOPE_VERSION = 1;
 var EMAIL_RELAY_ALGORITHM = "P-256-HKDF-SHA256-AES-256-GCM";
 var encodeUtf8 = /* @__PURE__ */ __name((value) => {
-  const bytes = new TextEncoder().encode(value);
-  const copy = new Uint8Array(new ArrayBuffer(bytes.byteLength));
-  copy.set(bytes);
+  const bytes2 = new TextEncoder().encode(value);
+  const copy = new Uint8Array(new ArrayBuffer(bytes2.byteLength));
+  copy.set(bytes2);
   return copy;
 }, "encodeUtf8");
 var EMAIL_RELAY_INFO = encodeUtf8("learncard-email-relay-v1");
@@ -20082,9 +20431,9 @@ var ESCROW_BLOB_INFO = "learncard-escrow-blob-v1";
 var ESCROW_RELEASE_INFO = "learncard-escrow-release-v1";
 var ESCROW_CLIENT_KEY_ID = "client";
 var encodeUtf82 = /* @__PURE__ */ __name((value) => {
-  const bytes = new TextEncoder().encode(value);
-  const copy = new Uint8Array(new ArrayBuffer(bytes.byteLength));
-  copy.set(bytes);
+  const bytes2 = new TextEncoder().encode(value);
+  const copy = new Uint8Array(new ArrayBuffer(bytes2.byteLength));
+  copy.set(bytes2);
   return copy;
 }, "encodeUtf8");
 var isRecord2 = /* @__PURE__ */ __name((value) => typeof value === "object" && value !== null && !Array.isArray(value), "isRecord");
@@ -20273,196 +20622,2494 @@ var openEscrowRelease = /* @__PURE__ */ __name(async (envelope, clientEphemeralP
   await decryptFromEnvelope(envelope, clientEphemeralPrivateKeyPkcs8B64, ESCROW_RELEASE_INFO)
 ), "openEscrowRelease");
 
-// src/escrow-attestation.ts
-var isRecord3 = /* @__PURE__ */ __name((value) => typeof value === "object" && value !== null && !Array.isArray(value), "isRecord");
-var normalizePublicKey = /* @__PURE__ */ __name((value) => {
-  const trimmed = value.trim();
-  if (!trimmed || trimmed.length > 512 || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(trimmed)) {
-    throw new Error("Invalid escrow attestation public key");
+// src/escrow-nitro-attestation.ts
+var import_reflect_metadata = require("reflect-metadata");
+
+// ../../node_modules/cborg/lib/is.js
+var objectTypeNames = [
+  "Object",
+  // for Object.create(null) and other non-plain objects
+  "RegExp",
+  "Date",
+  "Error",
+  "Map",
+  "Set",
+  "WeakMap",
+  "WeakSet",
+  "ArrayBuffer",
+  "SharedArrayBuffer",
+  "DataView",
+  "Promise",
+  "URL",
+  "HTMLElement",
+  "Int8Array",
+  "Uint8ClampedArray",
+  "Int16Array",
+  "Uint16Array",
+  "Int32Array",
+  "Uint32Array",
+  "Float32Array",
+  "Float64Array",
+  "BigInt64Array",
+  "BigUint64Array",
+  "Tagged"
+];
+function is(value) {
+  if (value === null) {
+    return "null";
   }
-  return bufferToBase64(base64ToBuffer(trimmed).buffer);
-}, "normalizePublicKey");
-var verifyEnclaveAttestation = /* @__PURE__ */ __name(async (attestation, policy) => {
-  const fields = ["mode", "keyId", "publicKey", "measurements", "document", "issuedAt"];
-  if (!isRecord3(attestation) || Object.keys(attestation).some((key) => !fields.includes(key)) || attestation.mode !== "software" && attestation.mode !== "nitro" || typeof attestation.keyId !== "string" || !/^[A-Za-z0-9._-]{1,128}$/.test(attestation.keyId) || typeof attestation.publicKey !== "string" || !isRecord3(attestation.measurements) || Object.entries(attestation.measurements).some(
-    ([key, value]) => !["imageSha384", "pcr0", "pcr1", "pcr2"].includes(key) || typeof value !== "string" || !value || value.length > 1024
-  ) || typeof attestation.document !== "string" || !attestation.document || attestation.document.length > 65536 || typeof attestation.issuedAt !== "string" || !Number.isFinite(Date.parse(attestation.issuedAt))) {
-    throw new Error("Invalid escrow attestation");
+  if (value === void 0) {
+    return "undefined";
   }
-  const publicKey = normalizePublicKey(attestation.publicKey);
-  await crypto.subtle.importKey(
-    "spki",
-    base64ToBuffer(publicKey),
-    { name: "ECDH", namedCurve: "P-256" },
-    false,
-    []
-  );
-  if (policy.mode === "nitro") {
-    throw new Error("Nitro attestation verification is not implemented yet");
+  if (value === true || value === false) {
+    return "boolean";
   }
-  if (attestation.mode !== policy.mode) throw new Error("Escrow attestation mode mismatch");
-  if (!policy.pinnedPublicKeys.some((pin) => normalizePublicKey(pin) === publicKey)) {
-    throw new Error("Escrow attestation public key is not trusted");
+  const typeOf = typeof value;
+  if (typeOf === "string" || typeOf === "number" || typeOf === "bigint" || typeOf === "symbol") {
+    return typeOf;
   }
-  return { publicKey, keyId: attestation.keyId, mode: attestation.mode };
-}, "verifyEnclaveAttestation");
-
-// src/types.ts
-var import_types = __toESM(require_dist());
-var EscrowPinUnavailableError = class extends Error {
-  static {
-    __name(this, "EscrowPinUnavailableError");
+  if (typeOf === "function") {
+    return "Function";
   }
-  constructor() {
-    super("PIN recovery is not available for this account.");
-    this.name = "EscrowPinUnavailableError";
+  if (Array.isArray(value)) {
+    return "Array";
   }
-};
-var EscrowPinMismatchError = class extends Error {
-  constructor(attemptsRemaining) {
-    super("Incorrect PIN.");
-    this.attemptsRemaining = attemptsRemaining;
-    this.name = "EscrowPinMismatchError";
+  if (value instanceof Uint8Array) {
+    return "Uint8Array";
   }
-  static {
-    __name(this, "EscrowPinMismatchError");
+  if (value.constructor === Object) {
+    return "Object";
   }
-};
-var EscrowPinThrottledError = class extends Error {
+  const objectType = getObjectType(value);
+  if (objectType) {
+    return objectType;
+  }
+  return "Object";
+}
+__name(is, "is");
+function getObjectType(value) {
+  const objectTypeName = Object.prototype.toString.call(value).slice(8, -1);
+  if (objectTypeNames.includes(objectTypeName)) {
+    return objectTypeName;
+  }
+  return void 0;
+}
+__name(getObjectType, "getObjectType");
+
+// ../../node_modules/cborg/lib/token.js
+var Type = class {
   static {
-    __name(this, "EscrowPinThrottledError");
+    __name(this, "Type");
   }
-  constructor() {
-    super("Too many tries right now. Wait a minute and try again.");
-    this.name = "EscrowPinThrottledError";
+  /**
+   * @param {number} major
+   * @param {string} name
+   * @param {boolean} terminal
+   */
+  constructor(major, name, terminal) {
+    this.major = major;
+    this.majorEncoded = major << 5;
+    this.name = name;
+    this.terminal = terminal;
   }
-};
-var EscrowHoldRestartThrottledError = class extends Error {
-  constructor(retryAfter) {
-    super("A recovery request was started recently. Please wait before restarting.");
-    this.retryAfter = retryAfter;
-    this.name = "EscrowHoldRestartThrottledError";
+  toString() {
+    return `Type[${this.major}].${this.name}`;
   }
-  static {
-    __name(this, "EscrowHoldRestartThrottledError");
+  /**
+   * @param {Type} typ
+   * @returns {number}
+   */
+  compare(typ) {
+    return this.major < typ.major ? -1 : this.major > typ.major ? 1 : 0;
+  }
+  /**
+   * Check equality between two Type instances. Safe to use across different
+   * copies of the Type class (e.g., when bundlers duplicate the module).
+   * (major, name) uniquely identifies a Type; terminal is implied by these.
+   * @param {Type} a
+   * @param {Type} b
+   * @returns {boolean}
+   */
+  static equals(a, b) {
+    return a === b || a.major === b.major && a.name === b.name;
   }
 };
-var EscrowPinLockedError = class extends Error {
+Type.uint = new Type(0, "uint", true);
+Type.negint = new Type(1, "negint", true);
+Type.bytes = new Type(2, "bytes", true);
+Type.string = new Type(3, "string", true);
+Type.array = new Type(4, "array", false);
+Type.map = new Type(5, "map", false);
+Type.tag = new Type(6, "tag", false);
+Type.float = new Type(7, "float", true);
+Type.false = new Type(7, "false", true);
+Type.true = new Type(7, "true", true);
+Type.null = new Type(7, "null", true);
+Type.undefined = new Type(7, "undefined", true);
+Type.break = new Type(7, "break", true);
+var Token = class {
   static {
-    __name(this, "EscrowPinLockedError");
+    __name(this, "Token");
   }
-  constructor() {
-    super("Too many incorrect PIN attempts. You can still recover by waiting.");
-    this.name = "EscrowPinLockedError";
+  /**
+   * @param {Type} type
+   * @param {any} [value]
+   * @param {number} [encodedLength]
+   */
+  constructor(type, value, encodedLength) {
+    this.type = type;
+    this.value = value;
+    this.encodedLength = encodedLength;
+    this.encodedBytes = void 0;
+    this.byteValue = void 0;
+  }
+  toString() {
+    return `Token[${this.type}].${this.value}`;
   }
 };
 
-// src/escrow-pin.ts
-var PIN_MIN_LENGTH = 6;
-var PIN_MAX_LENGTH = 12;
-var ESCROW_PIN_MAX_ATTEMPTS = 10;
-var TRIVIAL_PINS = /* @__PURE__ */ new Set([
-  "123456",
-  "654321",
-  "000000",
-  "111111",
-  "121212",
-  "112233",
-  "123123",
-  "696969",
-  "123321"
-]);
-var normalizePin = /* @__PURE__ */ __name((raw) => raw.trim().normalize("NFKD").replace(/\D/g, ""), "normalizePin");
-var validatePin = /* @__PURE__ */ __name((pin) => {
-  const normalized = normalizePin(pin);
-  if (normalized.length < PIN_MIN_LENGTH || normalized.length > PIN_MAX_LENGTH) {
-    return { ok: false, reason: "length" };
+// ../../node_modules/cborg/lib/byte-utils.js
+var useBuffer = globalThis.process && // @ts-ignore
+!globalThis.process.browser && // @ts-ignore
+globalThis.Buffer && // @ts-ignore
+typeof globalThis.Buffer.isBuffer === "function";
+var textEncoder = new TextEncoder();
+function isBuffer(buf) {
+  return useBuffer && globalThis.Buffer.isBuffer(buf);
+}
+__name(isBuffer, "isBuffer");
+function asU8A(buf) {
+  if (!(buf instanceof Uint8Array)) {
+    return Uint8Array.from(buf);
   }
-  if (/^(\d)\1+$/.test(normalized) || "0123456789".includes(normalized) || "9876543210".includes(normalized) || TRIVIAL_PINS.has(normalized)) {
-    return { ok: false, reason: "trivial" };
+  return isBuffer(buf) ? new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength) : buf;
+}
+__name(asU8A, "asU8A");
+var FROM_STRING_THRESHOLD_BUFFER = 24;
+var FROM_STRING_THRESHOLD_TEXTENCODER = 200;
+var fromString = useBuffer ? (
+  // eslint-disable-line operator-linebreak
+  /**
+   * @param {string} string
+   */
+  (string) => {
+    return string.length >= FROM_STRING_THRESHOLD_BUFFER ? (
+      // eslint-disable-line operator-linebreak
+      // @ts-ignore
+      globalThis.Buffer.from(string)
+    ) : utf8ToBytes(string);
   }
-  return { ok: true };
-}, "validatePin");
-var generatePinSalt = /* @__PURE__ */ __name(() => bufferToBase64(crypto.getRandomValues(new Uint8Array(16)).buffer), "generatePinSalt");
-var derivePinProof = /* @__PURE__ */ __name(async (pin, pinSaltBase64) => {
-  const salt = base64ToBuffer(pinSaltBase64);
-  if (salt.length !== 16) throw new Error("Invalid escrow PIN salt length");
-  const key = await deriveKeyFromPassword(normalizePin(pin), salt);
-  try {
-    return bytesToHex(key);
-  } finally {
-    key.fill(0);
+) : (
+  // eslint-disable-line operator-linebreak
+  /**
+   * @param {string} string
+   */
+  (string) => {
+    return string.length >= FROM_STRING_THRESHOLD_TEXTENCODER ? textEncoder.encode(string) : utf8ToBytes(string);
   }
-}, "derivePinProof");
-var constantTimeEqualHex = /* @__PURE__ */ __name((a, b) => {
-  if (a.length !== b.length || !/^(?:[0-9a-f]{2})+$/i.test(a) || !/^(?:[0-9a-f]{2})+$/i.test(b)) {
-    return false;
+);
+var fromArray = /* @__PURE__ */ __name((arr) => {
+  return Uint8Array.from(arr);
+}, "fromArray");
+var slice = useBuffer ? (
+  // eslint-disable-line operator-linebreak
+  /**
+   * @param {Uint8Array} bytes
+   * @param {number} start
+   * @param {number} end
+   */
+  // Buffer.slice() returns a view, not a copy, so we need special handling
+  (bytes2, start, end) => {
+    if (isBuffer(bytes2)) {
+      return new Uint8Array(bytes2.subarray(start, end));
+    }
+    return bytes2.slice(start, end);
   }
-  const aBytes = hexToBytes(a);
-  const bBytes = hexToBytes(b);
-  let difference = 0;
-  for (let i = 0; i < aBytes.length; i++) {
-    difference |= aBytes[i] ^ bBytes[i];
+) : (
+  // eslint-disable-line operator-linebreak
+  /**
+   * @param {Uint8Array} bytes
+   * @param {number} start
+   * @param {number} end
+   */
+  (bytes2, start, end) => {
+    return bytes2.slice(start, end);
   }
-  return difference === 0;
-}, "constantTimeEqualHex");
-
-// src/atomic-operations.ts
-var ShareVerificationError = class extends Error {
-  constructor(message, combination, expected, got) {
-    super(message);
-    this.combination = combination;
-    this.expected = expected;
-    this.got = got;
-    this.name = "ShareVerificationError";
+);
+var concat = useBuffer ? (
+  // eslint-disable-line operator-linebreak
+  /**
+   * @param {ByteView[]} chunks
+   * @param {number} length
+   * @returns {AllocatedByteView}
+   */
+  (chunks, length) => {
+    chunks = chunks.map((c) => c instanceof Uint8Array ? c : (
+      // eslint-disable-line operator-linebreak
+      // @ts-ignore
+      globalThis.Buffer.from(c)
+    ));
+    return (
+      /** @type {AllocatedByteView} */
+      asU8A(globalThis.Buffer.concat(chunks, length))
+    );
   }
-  static {
-    __name(this, "ShareVerificationError");
+) : (
+  // eslint-disable-line operator-linebreak
+  /**
+   * @param {ByteView[]} chunks
+   * @param {number} length
+   * @returns {AllocatedByteView}
+   */
+  (chunks, length) => {
+    const out = new Uint8Array(length);
+    let off = 0;
+    for (let b of chunks) {
+      if (off + b.length > out.length) {
+        b = b.subarray(0, out.length - off);
+      }
+      out.set(b, off);
+      off += b.length;
+    }
+    return out;
   }
-};
-var AtomicUpdateError = class extends Error {
-  constructor(message, phase, rolledBack, cause) {
-    super(message);
-    this.phase = phase;
-    this.rolledBack = rolledBack;
-    this.cause = cause;
-    this.name = "AtomicUpdateError";
+);
+var alloc = useBuffer ? (
+  // eslint-disable-line operator-linebreak
+  /**
+   * @param {number} size
+   * @returns {AllocatedByteView}
+   */
+  (size) => {
+    return globalThis.Buffer.allocUnsafe(size);
   }
-  static {
-    __name(this, "AtomicUpdateError");
+) : (
+  // eslint-disable-line operator-linebreak
+  /**
+   * @param {number} size
+   * @returns {AllocatedByteView}
+   */
+  (size) => {
+    return new Uint8Array(size);
   }
-};
-var ShareWriteRejectedError = class extends Error {
-  static {
-    __name(this, "ShareWriteRejectedError");
+);
+function compare(b1, b2) {
+  if (isBuffer(b1) && isBuffer(b2)) {
+    return b1.compare(b2);
   }
-  constructor(message) {
-    super(message);
-    this.name = "ShareWriteRejectedError";
+  for (let i = 0; i < b1.length; i++) {
+    if (b1[i] === b2[i]) {
+      continue;
+    }
+    return b1[i] < b2[i] ? -1 : 1;
   }
-};
-async function splitAndVerify(privateKey) {
-  const shares = await splitPrivateKey(privateKey);
-  const combinations = [
-    ["device+auth", shares.deviceShare, shares.authShare],
-    ["device+recovery", shares.deviceShare, shares.recoveryShare],
-    ["device+email", shares.deviceShare, shares.emailShare],
-    ["auth+recovery", shares.authShare, shares.recoveryShare],
-    ["auth+email", shares.authShare, shares.emailShare],
-    ["recovery+email", shares.recoveryShare, shares.emailShare]
-  ];
-  for (const [name, share1, share2] of combinations) {
-    const reconstructed = await reconstructFromShares([share1, share2]);
-    if (reconstructed !== privateKey) {
-      throw new ShareVerificationError(
-        `Share verification failed for ${name}: reconstruction mismatch`,
-        name,
-        privateKey,
-        reconstructed
-      );
+  return 0;
+}
+__name(compare, "compare");
+function utf8ToBytes(str) {
+  const out = [];
+  let p = 0;
+  for (let i = 0; i < str.length; i++) {
+    let c = str.charCodeAt(i);
+    if (c < 128) {
+      out[p++] = c;
+    } else if (c < 2048) {
+      out[p++] = c >> 6 | 192;
+      out[p++] = c & 63 | 128;
+    } else if ((c & 64512) === 55296 && i + 1 < str.length && (str.charCodeAt(i + 1) & 64512) === 56320) {
+      c = 65536 + ((c & 1023) << 10) + (str.charCodeAt(++i) & 1023);
+      out[p++] = c >> 18 | 240;
+      out[p++] = c >> 12 & 63 | 128;
+      out[p++] = c >> 6 & 63 | 128;
+      out[p++] = c & 63 | 128;
+    } else {
+      if (c >= 55296 && c <= 57343) {
+        c = 65533;
+      }
+      out[p++] = c >> 12 | 224;
+      out[p++] = c >> 6 & 63 | 128;
+      out[p++] = c & 63 | 128;
     }
   }
-  return {
+  return out;
+}
+__name(utf8ToBytes, "utf8ToBytes");
+
+// ../../node_modules/cborg/lib/bl.js
+var defaultChunkSize = 256;
+var Bl = class {
+  static {
+    __name(this, "Bl");
+  }
+  /**
+   * @param {number} [chunkSize]
+   */
+  constructor(chunkSize = defaultChunkSize) {
+    this.chunkSize = chunkSize;
+    this.cursor = 0;
+    this.maxCursor = -1;
+    this.chunks = [];
+    this._initReuseChunk = null;
+  }
+  reset() {
+    this.cursor = 0;
+    this.maxCursor = -1;
+    if (this.chunks.length) {
+      this.chunks = [];
+    }
+    if (this._initReuseChunk !== null) {
+      this.chunks.push(this._initReuseChunk);
+      this.maxCursor = this._initReuseChunk.length - 1;
+    }
+  }
+  /**
+   * @param {number} byte
+   */
+  pushByte(byte) {
+    let topChunk = this.chunks[this.chunks.length - 1];
+    if (this.cursor > this.maxCursor) {
+      topChunk = alloc(this.chunkSize);
+      this.chunks.push(topChunk);
+      this.maxCursor += topChunk.length;
+      if (this._initReuseChunk === null) {
+        this._initReuseChunk = topChunk;
+      }
+    }
+    const chunkPos = topChunk.length - (this.maxCursor - this.cursor) - 1;
+    topChunk[chunkPos] = byte;
+    this.cursor++;
+  }
+  /**
+   * @param {ByteView|number[]} bytes
+   */
+  push(bytes2) {
+    let topChunk = this.chunks[this.chunks.length - 1];
+    const newMax = this.cursor + bytes2.length;
+    if (newMax <= this.maxCursor + 1) {
+      const chunkPos = topChunk.length - (this.maxCursor - this.cursor) - 1;
+      topChunk.set(bytes2, chunkPos);
+    } else {
+      if (topChunk) {
+        const chunkPos = topChunk.length - (this.maxCursor - this.cursor) - 1;
+        if (chunkPos < topChunk.length) {
+          this.chunks[this.chunks.length - 1] = topChunk.subarray(0, chunkPos);
+          this.maxCursor = this.cursor - 1;
+        }
+      }
+      if (bytes2.length < 64 && bytes2.length < this.chunkSize) {
+        topChunk = alloc(this.chunkSize);
+        this.chunks.push(topChunk);
+        this.maxCursor += topChunk.length;
+        if (this._initReuseChunk === null) {
+          this._initReuseChunk = topChunk;
+        }
+        topChunk.set(bytes2, 0);
+      } else {
+        this.chunks.push(bytes2);
+        this.maxCursor += bytes2.length;
+      }
+    }
+    this.cursor += bytes2.length;
+  }
+  /**
+   * @param {boolean} [reset]
+   * @returns {AllocatedByteView}
+   */
+  toBytes(reset = false) {
+    let byts;
+    if (this.chunks.length === 1) {
+      const chunk = this.chunks[0];
+      if (reset && this.cursor > chunk.length / 2) {
+        byts = this.cursor === chunk.length ? chunk : chunk.subarray(0, this.cursor);
+        this._initReuseChunk = null;
+        this.chunks = [];
+      } else {
+        byts = slice(chunk, 0, this.cursor);
+      }
+    } else {
+      byts = concat(this.chunks, this.cursor);
+    }
+    if (reset) {
+      this.reset();
+    }
+    return byts;
+  }
+};
+var U8Bl = class {
+  static {
+    __name(this, "U8Bl");
+  }
+  /**
+   * @param {Uint8Array<T>} dest
+   */
+  constructor(dest) {
+    this.dest = dest;
+    this.cursor = 0;
+    this.chunks = [dest];
+  }
+  reset() {
+    this.cursor = 0;
+  }
+  /**
+   * @param {number} byte
+   */
+  pushByte(byte) {
+    if (this.cursor >= this.dest.length) {
+      throw new Error("write out of bounds, destination buffer is too small");
+    }
+    this.dest[this.cursor++] = byte;
+  }
+  /**
+   * @param {ByteView|number[]} bytes
+   */
+  push(bytes2) {
+    if (this.cursor + bytes2.length > this.dest.length) {
+      throw new Error("write out of bounds, destination buffer is too small");
+    }
+    this.dest.set(bytes2, this.cursor);
+    this.cursor += bytes2.length;
+  }
+  /**
+   * @param {boolean} [reset]
+   * @returns {Uint8Array<T>}
+   */
+  toBytes(reset = false) {
+    const byts = this.dest.subarray(0, this.cursor);
+    if (reset) {
+      this.reset();
+    }
+    return byts;
+  }
+};
+
+// ../../node_modules/cborg/lib/common.js
+var decodeErrPrefix = "CBOR decode error:";
+var encodeErrPrefix = "CBOR encode error:";
+var uintMinorPrefixBytes = [];
+uintMinorPrefixBytes[23] = 1;
+uintMinorPrefixBytes[24] = 2;
+uintMinorPrefixBytes[25] = 3;
+uintMinorPrefixBytes[26] = 5;
+uintMinorPrefixBytes[27] = 9;
+function assertEnoughData(data, pos, need) {
+  if (data.length - pos < need) {
+    throw new Error(`${decodeErrPrefix} not enough data for type`);
+  }
+}
+__name(assertEnoughData, "assertEnoughData");
+
+// ../../node_modules/cborg/lib/0uint.js
+var uintBoundaries = [24, 256, 65536, 4294967296, BigInt("18446744073709551616")];
+function readUint8(data, offset, options) {
+  assertEnoughData(data, offset, 1);
+  const value = data[offset];
+  if (options.strict === true && value < uintBoundaries[0]) {
+    throw new Error(`${decodeErrPrefix} integer encoded in more bytes than necessary (strict decode)`);
+  }
+  return value;
+}
+__name(readUint8, "readUint8");
+function readUint16(data, offset, options) {
+  assertEnoughData(data, offset, 2);
+  const value = data[offset] << 8 | data[offset + 1];
+  if (options.strict === true && value < uintBoundaries[1]) {
+    throw new Error(`${decodeErrPrefix} integer encoded in more bytes than necessary (strict decode)`);
+  }
+  return value;
+}
+__name(readUint16, "readUint16");
+function readUint32(data, offset, options) {
+  assertEnoughData(data, offset, 4);
+  const value = data[offset] * 16777216 + (data[offset + 1] << 16) + (data[offset + 2] << 8) + data[offset + 3];
+  if (options.strict === true && value < uintBoundaries[2]) {
+    throw new Error(`${decodeErrPrefix} integer encoded in more bytes than necessary (strict decode)`);
+  }
+  return value;
+}
+__name(readUint32, "readUint32");
+function readUint64(data, offset, options) {
+  assertEnoughData(data, offset, 8);
+  const hi = data[offset] * 16777216 + (data[offset + 1] << 16) + (data[offset + 2] << 8) + data[offset + 3];
+  const lo = data[offset + 4] * 16777216 + (data[offset + 5] << 16) + (data[offset + 6] << 8) + data[offset + 7];
+  const value = (BigInt(hi) << BigInt(32)) + BigInt(lo);
+  if (options.strict === true && value < uintBoundaries[3]) {
+    throw new Error(`${decodeErrPrefix} integer encoded in more bytes than necessary (strict decode)`);
+  }
+  if (value <= Number.MAX_SAFE_INTEGER) {
+    return Number(value);
+  }
+  if (options.allowBigInt === true) {
+    return value;
+  }
+  throw new Error(`${decodeErrPrefix} integers outside of the safe integer range are not supported`);
+}
+__name(readUint64, "readUint64");
+function decodeUint8(data, pos, _minor, options) {
+  return new Token(Type.uint, readUint8(data, pos + 1, options), 2);
+}
+__name(decodeUint8, "decodeUint8");
+function decodeUint16(data, pos, _minor, options) {
+  return new Token(Type.uint, readUint16(data, pos + 1, options), 3);
+}
+__name(decodeUint16, "decodeUint16");
+function decodeUint32(data, pos, _minor, options) {
+  return new Token(Type.uint, readUint32(data, pos + 1, options), 5);
+}
+__name(decodeUint32, "decodeUint32");
+function decodeUint64(data, pos, _minor, options) {
+  return new Token(Type.uint, readUint64(data, pos + 1, options), 9);
+}
+__name(decodeUint64, "decodeUint64");
+function encodeUint(writer, token) {
+  return encodeUintValue(writer, 0, token.value);
+}
+__name(encodeUint, "encodeUint");
+function encodeUintValue(writer, major, uint) {
+  if (uint < uintBoundaries[0]) {
+    const nuint = Number(uint);
+    writer.pushByte(major | nuint);
+  } else if (uint < uintBoundaries[1]) {
+    const nuint = Number(uint);
+    writer.push([major | 24, nuint]);
+  } else if (uint < uintBoundaries[2]) {
+    const nuint = Number(uint);
+    writer.push([major | 25, nuint >>> 8, nuint & 255]);
+  } else if (uint < uintBoundaries[3]) {
+    const nuint = Number(uint);
+    writer.push([major | 26, nuint >>> 24 & 255, nuint >>> 16 & 255, nuint >>> 8 & 255, nuint & 255]);
+  } else {
+    const buint = BigInt(uint);
+    if (buint < uintBoundaries[4]) {
+      const set = [major | 27, 0, 0, 0, 0, 0, 0, 0];
+      let lo = Number(buint & BigInt(4294967295));
+      let hi = Number(buint >> BigInt(32) & BigInt(4294967295));
+      set[8] = lo & 255;
+      lo = lo >> 8;
+      set[7] = lo & 255;
+      lo = lo >> 8;
+      set[6] = lo & 255;
+      lo = lo >> 8;
+      set[5] = lo & 255;
+      set[4] = hi & 255;
+      hi = hi >> 8;
+      set[3] = hi & 255;
+      hi = hi >> 8;
+      set[2] = hi & 255;
+      hi = hi >> 8;
+      set[1] = hi & 255;
+      writer.push(set);
+    } else {
+      throw new Error(`${decodeErrPrefix} encountered BigInt larger than allowable range`);
+    }
+  }
+}
+__name(encodeUintValue, "encodeUintValue");
+encodeUint.encodedSize = /* @__PURE__ */ __name(function encodedSize(token) {
+  return encodeUintValue.encodedSize(token.value);
+}, "encodedSize");
+encodeUintValue.encodedSize = /* @__PURE__ */ __name(function encodedSize2(uint) {
+  if (uint < uintBoundaries[0]) {
+    return 1;
+  }
+  if (uint < uintBoundaries[1]) {
+    return 2;
+  }
+  if (uint < uintBoundaries[2]) {
+    return 3;
+  }
+  if (uint < uintBoundaries[3]) {
+    return 5;
+  }
+  return 9;
+}, "encodedSize");
+encodeUint.compareTokens = /* @__PURE__ */ __name(function compareTokens(tok1, tok2) {
+  return tok1.value < tok2.value ? -1 : tok1.value > tok2.value ? 1 : 0;
+}, "compareTokens");
+
+// ../../node_modules/cborg/lib/1negint.js
+function decodeNegint8(data, pos, _minor, options) {
+  return new Token(Type.negint, -1 - readUint8(data, pos + 1, options), 2);
+}
+__name(decodeNegint8, "decodeNegint8");
+function decodeNegint16(data, pos, _minor, options) {
+  return new Token(Type.negint, -1 - readUint16(data, pos + 1, options), 3);
+}
+__name(decodeNegint16, "decodeNegint16");
+function decodeNegint32(data, pos, _minor, options) {
+  return new Token(Type.negint, -1 - readUint32(data, pos + 1, options), 5);
+}
+__name(decodeNegint32, "decodeNegint32");
+var neg1b = BigInt(-1);
+var pos1b = BigInt(1);
+function decodeNegint64(data, pos, _minor, options) {
+  const int = readUint64(data, pos + 1, options);
+  if (typeof int !== "bigint") {
+    const value = -1 - int;
+    if (value >= Number.MIN_SAFE_INTEGER) {
+      return new Token(Type.negint, value, 9);
+    }
+  }
+  if (options.allowBigInt !== true) {
+    throw new Error(`${decodeErrPrefix} integers outside of the safe integer range are not supported`);
+  }
+  return new Token(Type.negint, neg1b - BigInt(int), 9);
+}
+__name(decodeNegint64, "decodeNegint64");
+function encodeNegint(writer, token) {
+  const negint = token.value;
+  const unsigned = typeof negint === "bigint" ? negint * neg1b - pos1b : negint * -1 - 1;
+  encodeUintValue(writer, token.type.majorEncoded, unsigned);
+}
+__name(encodeNegint, "encodeNegint");
+encodeNegint.encodedSize = /* @__PURE__ */ __name(function encodedSize3(token) {
+  const negint = token.value;
+  const unsigned = typeof negint === "bigint" ? negint * neg1b - pos1b : negint * -1 - 1;
+  if (unsigned < uintBoundaries[0]) {
+    return 1;
+  }
+  if (unsigned < uintBoundaries[1]) {
+    return 2;
+  }
+  if (unsigned < uintBoundaries[2]) {
+    return 3;
+  }
+  if (unsigned < uintBoundaries[3]) {
+    return 5;
+  }
+  return 9;
+}, "encodedSize");
+encodeNegint.compareTokens = /* @__PURE__ */ __name(function compareTokens2(tok1, tok2) {
+  return tok1.value < tok2.value ? 1 : tok1.value > tok2.value ? -1 : 0;
+}, "compareTokens");
+
+// ../../node_modules/cborg/lib/2bytes.js
+function toToken(data, pos, prefix, length) {
+  assertEnoughData(data, pos, prefix + length);
+  const buf = data.slice(pos + prefix, pos + prefix + length);
+  return new Token(Type.bytes, buf, prefix + length);
+}
+__name(toToken, "toToken");
+function decodeBytesCompact(data, pos, minor, _options) {
+  return toToken(data, pos, 1, minor);
+}
+__name(decodeBytesCompact, "decodeBytesCompact");
+function decodeBytes8(data, pos, _minor, options) {
+  return toToken(data, pos, 2, readUint8(data, pos + 1, options));
+}
+__name(decodeBytes8, "decodeBytes8");
+function decodeBytes16(data, pos, _minor, options) {
+  return toToken(data, pos, 3, readUint16(data, pos + 1, options));
+}
+__name(decodeBytes16, "decodeBytes16");
+function decodeBytes32(data, pos, _minor, options) {
+  return toToken(data, pos, 5, readUint32(data, pos + 1, options));
+}
+__name(decodeBytes32, "decodeBytes32");
+function decodeBytes64(data, pos, _minor, options) {
+  const l = readUint64(data, pos + 1, options);
+  if (typeof l === "bigint") {
+    throw new Error(`${decodeErrPrefix} 64-bit integer bytes lengths not supported`);
+  }
+  return toToken(data, pos, 9, l);
+}
+__name(decodeBytes64, "decodeBytes64");
+function tokenBytes(token) {
+  if (token.encodedBytes === void 0) {
+    token.encodedBytes = Type.equals(token.type, Type.string) ? fromString(token.value) : token.value;
+  }
+  return token.encodedBytes;
+}
+__name(tokenBytes, "tokenBytes");
+function encodeBytes(writer, token) {
+  const bytes2 = tokenBytes(token);
+  encodeUintValue(writer, token.type.majorEncoded, bytes2.length);
+  writer.push(bytes2);
+}
+__name(encodeBytes, "encodeBytes");
+encodeBytes.encodedSize = /* @__PURE__ */ __name(function encodedSize4(token) {
+  const bytes2 = tokenBytes(token);
+  return encodeUintValue.encodedSize(bytes2.length) + bytes2.length;
+}, "encodedSize");
+encodeBytes.compareTokens = /* @__PURE__ */ __name(function compareTokens3(tok1, tok2) {
+  return compareBytes(tokenBytes(tok1), tokenBytes(tok2));
+}, "compareTokens");
+function compareBytes(b1, b2) {
+  return b1.length < b2.length ? -1 : b1.length > b2.length ? 1 : compare(b1, b2);
+}
+__name(compareBytes, "compareBytes");
+
+// ../../node_modules/cborg/lib/3string.js
+var textDecoder = new TextDecoder();
+var ASCII_THRESHOLD = 32;
+function toStr(bytes2, start, end) {
+  const len = end - start;
+  if (len < ASCII_THRESHOLD) {
+    let str = "";
+    for (let i = start; i < end; i++) {
+      const c = bytes2[i];
+      if (c & 128) {
+        return textDecoder.decode(bytes2.subarray(start, end));
+      }
+      str += String.fromCharCode(c);
+    }
+    return str;
+  }
+  return textDecoder.decode(bytes2.subarray(start, end));
+}
+__name(toStr, "toStr");
+function toToken2(data, pos, prefix, length, options) {
+  const totLength = prefix + length;
+  assertEnoughData(data, pos, totLength);
+  const tok = new Token(Type.string, toStr(data, pos + prefix, pos + totLength), totLength);
+  if (options.retainStringBytes === true) {
+    tok.byteValue = data.slice(pos + prefix, pos + totLength);
+  }
+  return tok;
+}
+__name(toToken2, "toToken");
+function decodeStringCompact(data, pos, minor, options) {
+  return toToken2(data, pos, 1, minor, options);
+}
+__name(decodeStringCompact, "decodeStringCompact");
+function decodeString8(data, pos, _minor, options) {
+  return toToken2(data, pos, 2, readUint8(data, pos + 1, options), options);
+}
+__name(decodeString8, "decodeString8");
+function decodeString16(data, pos, _minor, options) {
+  return toToken2(data, pos, 3, readUint16(data, pos + 1, options), options);
+}
+__name(decodeString16, "decodeString16");
+function decodeString32(data, pos, _minor, options) {
+  return toToken2(data, pos, 5, readUint32(data, pos + 1, options), options);
+}
+__name(decodeString32, "decodeString32");
+function decodeString64(data, pos, _minor, options) {
+  const l = readUint64(data, pos + 1, options);
+  if (typeof l === "bigint") {
+    throw new Error(`${decodeErrPrefix} 64-bit integer string lengths not supported`);
+  }
+  return toToken2(data, pos, 9, l, options);
+}
+__name(decodeString64, "decodeString64");
+var encodeString = encodeBytes;
+
+// ../../node_modules/cborg/lib/4array.js
+function toToken3(_data, _pos, prefix, length) {
+  return new Token(Type.array, length, prefix);
+}
+__name(toToken3, "toToken");
+function decodeArrayCompact(data, pos, minor, _options) {
+  return toToken3(data, pos, 1, minor);
+}
+__name(decodeArrayCompact, "decodeArrayCompact");
+function decodeArray8(data, pos, _minor, options) {
+  return toToken3(data, pos, 2, readUint8(data, pos + 1, options));
+}
+__name(decodeArray8, "decodeArray8");
+function decodeArray16(data, pos, _minor, options) {
+  return toToken3(data, pos, 3, readUint16(data, pos + 1, options));
+}
+__name(decodeArray16, "decodeArray16");
+function decodeArray32(data, pos, _minor, options) {
+  return toToken3(data, pos, 5, readUint32(data, pos + 1, options));
+}
+__name(decodeArray32, "decodeArray32");
+function decodeArray64(data, pos, _minor, options) {
+  const l = readUint64(data, pos + 1, options);
+  if (typeof l === "bigint") {
+    throw new Error(`${decodeErrPrefix} 64-bit integer array lengths not supported`);
+  }
+  return toToken3(data, pos, 9, l);
+}
+__name(decodeArray64, "decodeArray64");
+function decodeArrayIndefinite(data, pos, _minor, options) {
+  if (options.allowIndefinite === false) {
+    throw new Error(`${decodeErrPrefix} indefinite length items not allowed`);
+  }
+  return toToken3(data, pos, 1, Infinity);
+}
+__name(decodeArrayIndefinite, "decodeArrayIndefinite");
+function encodeArray(writer, token) {
+  encodeUintValue(writer, Type.array.majorEncoded, token.value);
+}
+__name(encodeArray, "encodeArray");
+encodeArray.compareTokens = encodeUint.compareTokens;
+encodeArray.encodedSize = /* @__PURE__ */ __name(function encodedSize5(token) {
+  return encodeUintValue.encodedSize(token.value);
+}, "encodedSize");
+
+// ../../node_modules/cborg/lib/5map.js
+function toToken4(_data, _pos, prefix, length) {
+  return new Token(Type.map, length, prefix);
+}
+__name(toToken4, "toToken");
+function decodeMapCompact(data, pos, minor, _options) {
+  return toToken4(data, pos, 1, minor);
+}
+__name(decodeMapCompact, "decodeMapCompact");
+function decodeMap8(data, pos, _minor, options) {
+  return toToken4(data, pos, 2, readUint8(data, pos + 1, options));
+}
+__name(decodeMap8, "decodeMap8");
+function decodeMap16(data, pos, _minor, options) {
+  return toToken4(data, pos, 3, readUint16(data, pos + 1, options));
+}
+__name(decodeMap16, "decodeMap16");
+function decodeMap32(data, pos, _minor, options) {
+  return toToken4(data, pos, 5, readUint32(data, pos + 1, options));
+}
+__name(decodeMap32, "decodeMap32");
+function decodeMap64(data, pos, _minor, options) {
+  const l = readUint64(data, pos + 1, options);
+  if (typeof l === "bigint") {
+    throw new Error(`${decodeErrPrefix} 64-bit integer map lengths not supported`);
+  }
+  return toToken4(data, pos, 9, l);
+}
+__name(decodeMap64, "decodeMap64");
+function decodeMapIndefinite(data, pos, _minor, options) {
+  if (options.allowIndefinite === false) {
+    throw new Error(`${decodeErrPrefix} indefinite length items not allowed`);
+  }
+  return toToken4(data, pos, 1, Infinity);
+}
+__name(decodeMapIndefinite, "decodeMapIndefinite");
+function encodeMap(writer, token) {
+  encodeUintValue(writer, Type.map.majorEncoded, token.value);
+}
+__name(encodeMap, "encodeMap");
+encodeMap.compareTokens = encodeUint.compareTokens;
+encodeMap.encodedSize = /* @__PURE__ */ __name(function encodedSize6(token) {
+  return encodeUintValue.encodedSize(token.value);
+}, "encodedSize");
+
+// ../../node_modules/cborg/lib/6tag.js
+function decodeTagCompact(_data, _pos, minor, _options) {
+  return new Token(Type.tag, minor, 1);
+}
+__name(decodeTagCompact, "decodeTagCompact");
+function decodeTag8(data, pos, _minor, options) {
+  return new Token(Type.tag, readUint8(data, pos + 1, options), 2);
+}
+__name(decodeTag8, "decodeTag8");
+function decodeTag16(data, pos, _minor, options) {
+  return new Token(Type.tag, readUint16(data, pos + 1, options), 3);
+}
+__name(decodeTag16, "decodeTag16");
+function decodeTag32(data, pos, _minor, options) {
+  return new Token(Type.tag, readUint32(data, pos + 1, options), 5);
+}
+__name(decodeTag32, "decodeTag32");
+function decodeTag64(data, pos, _minor, options) {
+  return new Token(Type.tag, readUint64(data, pos + 1, options), 9);
+}
+__name(decodeTag64, "decodeTag64");
+function encodeTag(writer, token) {
+  encodeUintValue(writer, Type.tag.majorEncoded, token.value);
+}
+__name(encodeTag, "encodeTag");
+encodeTag.compareTokens = encodeUint.compareTokens;
+encodeTag.encodedSize = /* @__PURE__ */ __name(function encodedSize7(token) {
+  return encodeUintValue.encodedSize(token.value);
+}, "encodedSize");
+
+// ../../node_modules/cborg/lib/7float.js
+var MINOR_FALSE = 20;
+var MINOR_TRUE = 21;
+var MINOR_NULL = 22;
+var MINOR_UNDEFINED = 23;
+function decodeUndefined(_data, _pos, _minor, options) {
+  if (options.allowUndefined === false) {
+    throw new Error(`${decodeErrPrefix} undefined values are not supported`);
+  } else if (options.coerceUndefinedToNull === true) {
+    return new Token(Type.null, null, 1);
+  }
+  return new Token(Type.undefined, void 0, 1);
+}
+__name(decodeUndefined, "decodeUndefined");
+function decodeBreak(_data, _pos, _minor, options) {
+  if (options.allowIndefinite === false) {
+    throw new Error(`${decodeErrPrefix} indefinite length items not allowed`);
+  }
+  return new Token(Type.break, void 0, 1);
+}
+__name(decodeBreak, "decodeBreak");
+function createToken(value, bytes2, options) {
+  if (options) {
+    if (options.allowNaN === false && Number.isNaN(value)) {
+      throw new Error(`${decodeErrPrefix} NaN values are not supported`);
+    }
+    if (options.allowInfinity === false && (value === Infinity || value === -Infinity)) {
+      throw new Error(`${decodeErrPrefix} Infinity values are not supported`);
+    }
+  }
+  return new Token(Type.float, value, bytes2);
+}
+__name(createToken, "createToken");
+function decodeFloat16(data, pos, _minor, options) {
+  return createToken(readFloat16(data, pos + 1), 3, options);
+}
+__name(decodeFloat16, "decodeFloat16");
+function decodeFloat32(data, pos, _minor, options) {
+  return createToken(readFloat32(data, pos + 1), 5, options);
+}
+__name(decodeFloat32, "decodeFloat32");
+function decodeFloat64(data, pos, _minor, options) {
+  return createToken(readFloat64(data, pos + 1), 9, options);
+}
+__name(decodeFloat64, "decodeFloat64");
+function encodeFloat(writer, token, options) {
+  const float = token.value;
+  if (float === false) {
+    writer.pushByte(Type.float.majorEncoded | MINOR_FALSE);
+  } else if (float === true) {
+    writer.pushByte(Type.float.majorEncoded | MINOR_TRUE);
+  } else if (float === null) {
+    writer.pushByte(Type.float.majorEncoded | MINOR_NULL);
+  } else if (float === void 0) {
+    writer.pushByte(Type.float.majorEncoded | MINOR_UNDEFINED);
+  } else {
+    let decoded;
+    let success = false;
+    if (!options || options.float64 !== true) {
+      encodeFloat16(float);
+      decoded = readFloat16(ui8a, 1);
+      if (float === decoded || Number.isNaN(float)) {
+        ui8a[0] = 249;
+        writer.push(ui8a.slice(0, 3));
+        success = true;
+      } else {
+        encodeFloat32(float);
+        decoded = readFloat32(ui8a, 1);
+        if (float === decoded) {
+          ui8a[0] = 250;
+          writer.push(ui8a.slice(0, 5));
+          success = true;
+        }
+      }
+    }
+    if (!success) {
+      encodeFloat64(float);
+      decoded = readFloat64(ui8a, 1);
+      ui8a[0] = 251;
+      writer.push(ui8a.slice(0, 9));
+    }
+  }
+}
+__name(encodeFloat, "encodeFloat");
+encodeFloat.encodedSize = /* @__PURE__ */ __name(function encodedSize8(token, options) {
+  const float = token.value;
+  if (float === false || float === true || float === null || float === void 0) {
+    return 1;
+  }
+  if (!options || options.float64 !== true) {
+    encodeFloat16(float);
+    let decoded = readFloat16(ui8a, 1);
+    if (float === decoded || Number.isNaN(float)) {
+      return 3;
+    }
+    encodeFloat32(float);
+    decoded = readFloat32(ui8a, 1);
+    if (float === decoded) {
+      return 5;
+    }
+  }
+  return 9;
+}, "encodedSize");
+var buffer = new ArrayBuffer(9);
+var dataView = new DataView(buffer, 1);
+var ui8a = new Uint8Array(buffer, 0);
+function encodeFloat16(inp) {
+  if (inp === Infinity) {
+    dataView.setUint16(0, 31744, false);
+  } else if (inp === -Infinity) {
+    dataView.setUint16(0, 64512, false);
+  } else if (Number.isNaN(inp)) {
+    dataView.setUint16(0, 32256, false);
+  } else {
+    dataView.setFloat32(0, inp);
+    const valu32 = dataView.getUint32(0);
+    const exponent = (valu32 & 2139095040) >> 23;
+    const mantissa = valu32 & 8388607;
+    if (exponent === 255) {
+      dataView.setUint16(0, 31744, false);
+    } else if (exponent === 0) {
+      dataView.setUint16(0, (valu32 & 2147483648) >> 16 | mantissa >> 13, false);
+    } else {
+      const logicalExponent = exponent - 127;
+      if (logicalExponent < -24) {
+        dataView.setUint16(0, 0);
+      } else if (logicalExponent < -14) {
+        dataView.setUint16(0, (valu32 & 2147483648) >> 16 | /* sign bit */
+        1 << 24 + logicalExponent, false);
+      } else {
+        dataView.setUint16(0, (valu32 & 2147483648) >> 16 | logicalExponent + 15 << 10 | mantissa >> 13, false);
+      }
+    }
+  }
+}
+__name(encodeFloat16, "encodeFloat16");
+function readFloat16(ui8a2, pos) {
+  if (ui8a2.length - pos < 2) {
+    throw new Error(`${decodeErrPrefix} not enough data for float16`);
+  }
+  const half = (ui8a2[pos] << 8) + ui8a2[pos + 1];
+  if (half === 31744) {
+    return Infinity;
+  }
+  if (half === 64512) {
+    return -Infinity;
+  }
+  if (half === 32256) {
+    return NaN;
+  }
+  const exp = half >> 10 & 31;
+  const mant = half & 1023;
+  let val;
+  if (exp === 0) {
+    val = mant * 2 ** -24;
+  } else if (exp !== 31) {
+    val = (mant + 1024) * 2 ** (exp - 25);
+  } else {
+    val = mant === 0 ? Infinity : NaN;
+  }
+  return half & 32768 ? -val : val;
+}
+__name(readFloat16, "readFloat16");
+function encodeFloat32(inp) {
+  dataView.setFloat32(0, inp, false);
+}
+__name(encodeFloat32, "encodeFloat32");
+function readFloat32(ui8a2, pos) {
+  if (ui8a2.length - pos < 4) {
+    throw new Error(`${decodeErrPrefix} not enough data for float32`);
+  }
+  const offset = (ui8a2.byteOffset || 0) + pos;
+  return new DataView(ui8a2.buffer, offset, 4).getFloat32(0, false);
+}
+__name(readFloat32, "readFloat32");
+function encodeFloat64(inp) {
+  dataView.setFloat64(0, inp, false);
+}
+__name(encodeFloat64, "encodeFloat64");
+function readFloat64(ui8a2, pos) {
+  if (ui8a2.length - pos < 8) {
+    throw new Error(`${decodeErrPrefix} not enough data for float64`);
+  }
+  const offset = (ui8a2.byteOffset || 0) + pos;
+  return new DataView(ui8a2.buffer, offset, 8).getFloat64(0, false);
+}
+__name(readFloat64, "readFloat64");
+function encodeMajorSevenBytes(token, float64) {
+  const float = token.value;
+  if (float === false) {
+    return Uint8Array.of(Type.float.majorEncoded | MINOR_FALSE);
+  }
+  if (float === true) {
+    return Uint8Array.of(Type.float.majorEncoded | MINOR_TRUE);
+  }
+  if (float === null) {
+    return Uint8Array.of(Type.float.majorEncoded | MINOR_NULL);
+  }
+  if (float === void 0) {
+    return Uint8Array.of(Type.float.majorEncoded | MINOR_UNDEFINED);
+  }
+  if (!float64) {
+    encodeFloat16(float);
+    if (float === readFloat16(ui8a, 1) || Number.isNaN(float)) {
+      ui8a[0] = 249;
+      return ui8a.slice(0, 3);
+    }
+    encodeFloat32(float);
+    if (float === readFloat32(ui8a, 1)) {
+      ui8a[0] = 250;
+      return ui8a.slice(0, 5);
+    }
+  }
+  encodeFloat64(float);
+  ui8a[0] = 251;
+  return ui8a.slice(0, 9);
+}
+__name(encodeMajorSevenBytes, "encodeMajorSevenBytes");
+function majorSevenBytes(token, options) {
+  const tokenEx = (
+    /** @type {TokenEx} */
+    token
+  );
+  const float64 = options?.float64 === true;
+  const cached = float64 ? tokenEx._keyBytesFloat64 : tokenEx._keyBytes;
+  if (cached !== void 0) {
+    return cached;
+  }
+  const bytes2 = encodeMajorSevenBytes(token, float64);
+  if (float64) {
+    tokenEx._keyBytesFloat64 = bytes2;
+  } else {
+    tokenEx._keyBytes = bytes2;
+  }
+  return bytes2;
+}
+__name(majorSevenBytes, "majorSevenBytes");
+encodeFloat.compareTokens = /* @__PURE__ */ __name(function compareTokens4(tok1, tok2, options) {
+  const b1 = majorSevenBytes(tok1, options);
+  const b2 = majorSevenBytes(tok2, options);
+  if (b1.length !== b2.length) {
+    return b1.length < b2.length ? -1 : 1;
+  }
+  return compare(b1, b2);
+}, "compareTokens");
+
+// ../../node_modules/cborg/lib/jump.js
+function invalidMinor(data, pos, minor) {
+  throw new Error(`${decodeErrPrefix} encountered invalid minor (${minor}) for major ${data[pos] >>> 5}`);
+}
+__name(invalidMinor, "invalidMinor");
+function errorer(msg) {
+  return () => {
+    throw new Error(`${decodeErrPrefix} ${msg}`);
+  };
+}
+__name(errorer, "errorer");
+var jump = [];
+for (let i = 0; i <= 23; i++) {
+  jump[i] = invalidMinor;
+}
+jump[24] = decodeUint8;
+jump[25] = decodeUint16;
+jump[26] = decodeUint32;
+jump[27] = decodeUint64;
+jump[28] = invalidMinor;
+jump[29] = invalidMinor;
+jump[30] = invalidMinor;
+jump[31] = invalidMinor;
+for (let i = 32; i <= 55; i++) {
+  jump[i] = invalidMinor;
+}
+jump[56] = decodeNegint8;
+jump[57] = decodeNegint16;
+jump[58] = decodeNegint32;
+jump[59] = decodeNegint64;
+jump[60] = invalidMinor;
+jump[61] = invalidMinor;
+jump[62] = invalidMinor;
+jump[63] = invalidMinor;
+for (let i = 64; i <= 87; i++) {
+  jump[i] = decodeBytesCompact;
+}
+jump[88] = decodeBytes8;
+jump[89] = decodeBytes16;
+jump[90] = decodeBytes32;
+jump[91] = decodeBytes64;
+jump[92] = invalidMinor;
+jump[93] = invalidMinor;
+jump[94] = invalidMinor;
+jump[95] = errorer("indefinite length bytes/strings are not supported");
+for (let i = 96; i <= 119; i++) {
+  jump[i] = decodeStringCompact;
+}
+jump[120] = decodeString8;
+jump[121] = decodeString16;
+jump[122] = decodeString32;
+jump[123] = decodeString64;
+jump[124] = invalidMinor;
+jump[125] = invalidMinor;
+jump[126] = invalidMinor;
+jump[127] = errorer("indefinite length bytes/strings are not supported");
+for (let i = 128; i <= 151; i++) {
+  jump[i] = decodeArrayCompact;
+}
+jump[152] = decodeArray8;
+jump[153] = decodeArray16;
+jump[154] = decodeArray32;
+jump[155] = decodeArray64;
+jump[156] = invalidMinor;
+jump[157] = invalidMinor;
+jump[158] = invalidMinor;
+jump[159] = decodeArrayIndefinite;
+for (let i = 160; i <= 183; i++) {
+  jump[i] = decodeMapCompact;
+}
+jump[184] = decodeMap8;
+jump[185] = decodeMap16;
+jump[186] = decodeMap32;
+jump[187] = decodeMap64;
+jump[188] = invalidMinor;
+jump[189] = invalidMinor;
+jump[190] = invalidMinor;
+jump[191] = decodeMapIndefinite;
+for (let i = 192; i <= 215; i++) {
+  jump[i] = decodeTagCompact;
+}
+jump[216] = decodeTag8;
+jump[217] = decodeTag16;
+jump[218] = decodeTag32;
+jump[219] = decodeTag64;
+jump[220] = invalidMinor;
+jump[221] = invalidMinor;
+jump[222] = invalidMinor;
+jump[223] = invalidMinor;
+for (let i = 224; i <= 243; i++) {
+  jump[i] = errorer("simple values are not supported");
+}
+jump[244] = invalidMinor;
+jump[245] = invalidMinor;
+jump[246] = invalidMinor;
+jump[247] = decodeUndefined;
+jump[248] = errorer("simple values are not supported");
+jump[249] = decodeFloat16;
+jump[250] = decodeFloat32;
+jump[251] = decodeFloat64;
+jump[252] = invalidMinor;
+jump[253] = invalidMinor;
+jump[254] = invalidMinor;
+jump[255] = decodeBreak;
+var quick = [];
+for (let i = 0; i < 24; i++) {
+  quick[i] = new Token(Type.uint, i, 1);
+}
+for (let i = -1; i >= -24; i--) {
+  quick[31 - i] = new Token(Type.negint, i, 1);
+}
+quick[64] = new Token(Type.bytes, new Uint8Array(0), 1);
+quick[96] = new Token(Type.string, "", 1);
+quick[128] = new Token(Type.array, 0, 1);
+quick[160] = new Token(Type.map, 0, 1);
+quick[244] = new Token(Type.false, false, 1);
+quick[245] = new Token(Type.true, true, 1);
+quick[246] = new Token(Type.null, null, 1);
+function quickEncodeToken(token) {
+  switch (token.type) {
+    case Type.false:
+      return fromArray([244]);
+    case Type.true:
+      return fromArray([245]);
+    case Type.null:
+      return fromArray([246]);
+    case Type.bytes:
+      if (!token.value.length) {
+        return fromArray([64]);
+      }
+      return;
+    case Type.string:
+      if (token.value === "") {
+        return fromArray([96]);
+      }
+      return;
+    case Type.array:
+      if (token.value === 0) {
+        return fromArray([128]);
+      }
+      return;
+    case Type.map:
+      if (token.value === 0) {
+        return fromArray([160]);
+      }
+      return;
+    case Type.uint:
+      if (token.value < 24) {
+        return fromArray([Number(token.value)]);
+      }
+      return;
+    case Type.negint:
+      if (token.value >= -24) {
+        return fromArray([31 - Number(token.value)]);
+      }
+  }
+}
+__name(quickEncodeToken, "quickEncodeToken");
+
+// ../../node_modules/cborg/lib/encode.js
+var defaultEncodeOptions = {
+  float64: false,
+  mapSorter,
+  quickEncodeToken
+};
+var rfc8949EncodeOptions = Object.freeze({
+  mapSorter: rfc8949MapSorter,
+  quickEncodeToken
+});
+function makeCborEncoders() {
+  const encoders = [];
+  encoders[Type.uint.major] = encodeUint;
+  encoders[Type.negint.major] = encodeNegint;
+  encoders[Type.bytes.major] = encodeBytes;
+  encoders[Type.string.major] = encodeString;
+  encoders[Type.array.major] = encodeArray;
+  encoders[Type.map.major] = encodeMap;
+  encoders[Type.tag.major] = encodeTag;
+  encoders[Type.float.major] = encodeFloat;
+  return encoders;
+}
+__name(makeCborEncoders, "makeCborEncoders");
+var cborEncoders = makeCborEncoders();
+var defaultWriter = new Bl();
+var Ref = class _Ref {
+  static {
+    __name(this, "Ref");
+  }
+  /**
+   * @param {object|any[]} obj
+   * @param {Reference|undefined} parent
+   */
+  constructor(obj, parent) {
+    this.obj = obj;
+    this.parent = parent;
+  }
+  /**
+   * @param {object|any[]} obj
+   * @returns {boolean}
+   */
+  includes(obj) {
+    let p = this;
+    do {
+      if (p.obj === obj) {
+        return true;
+      }
+    } while (p = p.parent);
+    return false;
+  }
+  /**
+   * @param {Reference|undefined} stack
+   * @param {object|any[]} obj
+   * @returns {Reference}
+   */
+  static createCheck(stack, obj) {
+    if (stack && stack.includes(obj)) {
+      throw new Error(`${encodeErrPrefix} object contains circular references`);
+    }
+    return new _Ref(obj, stack);
+  }
+};
+var simpleTokens = {
+  null: new Token(Type.null, null),
+  undefined: new Token(Type.undefined, void 0),
+  true: new Token(Type.true, true),
+  false: new Token(Type.false, false),
+  emptyArray: new Token(Type.array, 0),
+  emptyMap: new Token(Type.map, 0)
+};
+var typeEncoders = {
+  /**
+   * @param {any} obj
+   * @param {string} _typ
+   * @param {EncodeOptions} _options
+   * @param {Reference} [_refStack]
+   * @returns {TokenOrNestedTokens}
+   */
+  number(obj, _typ, _options, _refStack) {
+    if (!Number.isInteger(obj) || !Number.isSafeInteger(obj)) {
+      return new Token(Type.float, obj);
+    } else if (obj >= 0) {
+      return new Token(Type.uint, obj);
+    } else {
+      return new Token(Type.negint, obj);
+    }
+  },
+  /**
+   * @param {any} obj
+   * @param {string} _typ
+   * @param {EncodeOptions} _options
+   * @param {Reference} [_refStack]
+   * @returns {TokenOrNestedTokens}
+   */
+  bigint(obj, _typ, _options, _refStack) {
+    if (obj >= BigInt(0)) {
+      return new Token(Type.uint, obj);
+    } else {
+      return new Token(Type.negint, obj);
+    }
+  },
+  /**
+   * @param {any} obj
+   * @param {string} _typ
+   * @param {EncodeOptions} _options
+   * @param {Reference} [_refStack]
+   * @returns {TokenOrNestedTokens}
+   */
+  Uint8Array(obj, _typ, _options, _refStack) {
+    return new Token(Type.bytes, obj);
+  },
+  /**
+   * @param {any} obj
+   * @param {string} _typ
+   * @param {EncodeOptions} _options
+   * @param {Reference} [_refStack]
+   * @returns {TokenOrNestedTokens}
+   */
+  string(obj, _typ, _options, _refStack) {
+    return new Token(Type.string, obj);
+  },
+  /**
+   * @param {any} obj
+   * @param {string} _typ
+   * @param {EncodeOptions} _options
+   * @param {Reference} [_refStack]
+   * @returns {TokenOrNestedTokens}
+   */
+  boolean(obj, _typ, _options, _refStack) {
+    return obj ? simpleTokens.true : simpleTokens.false;
+  },
+  /**
+   * @param {any} _obj
+   * @param {string} _typ
+   * @param {EncodeOptions} _options
+   * @param {Reference} [_refStack]
+   * @returns {TokenOrNestedTokens}
+   */
+  null(_obj, _typ, _options, _refStack) {
+    return simpleTokens.null;
+  },
+  /**
+   * @param {any} _obj
+   * @param {string} _typ
+   * @param {EncodeOptions} _options
+   * @param {Reference} [_refStack]
+   * @returns {TokenOrNestedTokens}
+   */
+  undefined(_obj, _typ, _options, _refStack) {
+    return simpleTokens.undefined;
+  },
+  /**
+   * @param {any} obj
+   * @param {string} _typ
+   * @param {EncodeOptions} _options
+   * @param {Reference} [_refStack]
+   * @returns {TokenOrNestedTokens}
+   */
+  ArrayBuffer(obj, _typ, _options, _refStack) {
+    return new Token(Type.bytes, new Uint8Array(obj));
+  },
+  /**
+   * @param {any} obj
+   * @param {string} _typ
+   * @param {EncodeOptions} _options
+   * @param {Reference} [_refStack]
+   * @returns {TokenOrNestedTokens}
+   */
+  DataView(obj, _typ, _options, _refStack) {
+    return new Token(Type.bytes, new Uint8Array(obj.buffer, obj.byteOffset, obj.byteLength));
+  },
+  /**
+   * @param {any} obj
+   * @param {string} _typ
+   * @param {EncodeOptions} options
+   * @param {Reference} [refStack]
+   * @returns {TokenOrNestedTokens}
+   */
+  Array(obj, _typ, options, refStack) {
+    if (!obj.length) {
+      if (options.addBreakTokens === true) {
+        return [simpleTokens.emptyArray, new Token(Type.break)];
+      }
+      return simpleTokens.emptyArray;
+    }
+    refStack = Ref.createCheck(refStack, obj);
+    const entries = [];
+    let i = 0;
+    for (const e of obj) {
+      entries[i++] = objectToTokens(e, options, refStack);
+    }
+    if (options.addBreakTokens) {
+      return [new Token(Type.array, obj.length), entries, new Token(Type.break)];
+    }
+    return [new Token(Type.array, obj.length), entries];
+  },
+  /**
+   * @param {any} obj
+   * @param {string} typ
+   * @param {EncodeOptions} options
+   * @param {Reference} [refStack]
+   * @returns {TokenOrNestedTokens}
+   */
+  Object(obj, typ, options, refStack) {
+    const isMap = typ !== "Object";
+    const keys = isMap ? obj.keys() : Object.keys(obj);
+    const maxLength = isMap ? obj.size : keys.length;
+    let entries;
+    if (maxLength) {
+      entries = new Array(maxLength);
+      refStack = Ref.createCheck(refStack, obj);
+      const skipUndefined = !isMap && options.ignoreUndefinedProperties;
+      let i = 0;
+      for (const key of keys) {
+        const value = isMap ? obj.get(key) : obj[key];
+        if (skipUndefined && value === void 0) {
+          continue;
+        }
+        entries[i++] = [
+          objectToTokens(key, options, refStack),
+          objectToTokens(value, options, refStack)
+        ];
+      }
+      if (i < maxLength) {
+        entries.length = i;
+      }
+    }
+    if (!entries?.length) {
+      if (options.addBreakTokens === true) {
+        return [simpleTokens.emptyMap, new Token(Type.break)];
+      }
+      return simpleTokens.emptyMap;
+    }
+    sortMapEntries(entries, options);
+    if (options.addBreakTokens) {
+      return [new Token(Type.map, entries.length), entries, new Token(Type.break)];
+    }
+    return [new Token(Type.map, entries.length), entries];
+  },
+  /**
+   * Encode a `Tagged` wrapper as a CBOR tag header followed by the encoded
+   * form of the wrapped value. The value is recursively tokenised through
+   * `objectToTokens()` so any registered `typeEncoders` apply to it.
+   *
+   * @param {any} obj
+   * @param {string} _typ
+   * @param {EncodeOptions} options
+   * @param {Reference} [refStack]
+   * @returns {TokenOrNestedTokens}
+   */
+  Tagged(obj, _typ, options, refStack) {
+    return [
+      new Token(Type.tag, obj.tag),
+      objectToTokens(obj.value, options, refStack)
+    ];
+  }
+};
+typeEncoders.Map = typeEncoders.Object;
+typeEncoders.Buffer = typeEncoders.Uint8Array;
+for (const typ of "Uint8Clamped Uint16 Uint32 Int8 Int16 Int32 BigUint64 BigInt64 Float32 Float64".split(" ")) {
+  typeEncoders[`${typ}Array`] = typeEncoders.DataView;
+}
+function objectToTokens(obj, options = {}, refStack) {
+  const typ = is(obj);
+  const customTypeEncoder = options && options.typeEncoders && /** @type {OptionalTypeEncoder} */
+  options.typeEncoders[typ] || typeEncoders[typ];
+  if (typeof customTypeEncoder === "function") {
+    const tokens = customTypeEncoder(obj, typ, options, refStack);
+    if (tokens != null) {
+      return tokens;
+    }
+  }
+  const typeEncoder = typeEncoders[typ];
+  if (!typeEncoder) {
+    throw new Error(`${encodeErrPrefix} unsupported type: ${typ}`);
+  }
+  return typeEncoder(obj, typ, options, refStack);
+}
+__name(objectToTokens, "objectToTokens");
+function sortMapEntries(entries, options) {
+  const mapSorter2 = (
+    /** @type {(e1: TokenOrNestedTokens, e2: TokenOrNestedTokens, options?: EncodeOptions) => number} */
+    options.mapSorter
+  );
+  if (mapSorter2) {
+    entries.sort((e1, e2) => mapSorter2(e1, e2, options));
+  }
+}
+__name(sortMapEntries, "sortMapEntries");
+function mapSorter(e1, e2, options) {
+  const keyToken1 = Array.isArray(e1[0]) ? e1[0][0] : e1[0];
+  const keyToken2 = Array.isArray(e2[0]) ? e2[0][0] : e2[0];
+  if (keyToken1.type.major !== keyToken2.type.major) {
+    return keyToken1.type.compare(keyToken2.type);
+  }
+  const major = keyToken1.type.major;
+  const tcmp = cborEncoders[major].compareTokens(keyToken1, keyToken2, options);
+  if (tcmp === 0) {
+    console.warn("WARNING: complex key types used, CBOR key sorting guarantees are gone");
+  }
+  return tcmp;
+}
+__name(mapSorter, "mapSorter");
+function rfc8949MapSorter(e1, e2) {
+  if (e1[0] instanceof Token && e2[0] instanceof Token) {
+    const t1 = (
+      /** @type {TokenEx} */
+      e1[0]
+    );
+    const t2 = (
+      /** @type {TokenEx} */
+      e2[0]
+    );
+    if (!t1._keyBytes) {
+      t1._keyBytes = encodeRfc8949(t1.value);
+    }
+    if (!t2._keyBytes) {
+      t2._keyBytes = encodeRfc8949(t2.value);
+    }
+    return compare(t1._keyBytes, t2._keyBytes);
+  }
+  throw new Error("rfc8949MapSorter: complex key types are not supported yet");
+}
+__name(rfc8949MapSorter, "rfc8949MapSorter");
+function encodeRfc8949(data) {
+  return encodeCustom(data, cborEncoders, rfc8949EncodeOptions);
+}
+__name(encodeRfc8949, "encodeRfc8949");
+function tokensToEncoded(writer, tokens, encoders, options) {
+  if (Array.isArray(tokens)) {
+    for (const token of tokens) {
+      tokensToEncoded(writer, token, encoders, options);
+    }
+  } else {
+    encoders[tokens.type.major](writer, tokens, options);
+  }
+}
+__name(tokensToEncoded, "tokensToEncoded");
+var MAJOR_UINT = Type.uint.majorEncoded;
+var MAJOR_NEGINT = Type.negint.majorEncoded;
+var MAJOR_BYTES = Type.bytes.majorEncoded;
+var MAJOR_STRING = Type.string.majorEncoded;
+var MAJOR_ARRAY = Type.array.majorEncoded;
+var MAJOR_MAP = Type.map.majorEncoded;
+var SIMPLE_FALSE = Type.float.majorEncoded | MINOR_FALSE;
+var SIMPLE_TRUE = Type.float.majorEncoded | MINOR_TRUE;
+var SIMPLE_NULL = Type.float.majorEncoded | MINOR_NULL;
+var SIMPLE_UNDEFINED = Type.float.majorEncoded | MINOR_UNDEFINED;
+var neg1b2 = BigInt(-1);
+var pos1b2 = BigInt(1);
+function directEncodeUintValue(writer, major, uint) {
+  if (uint < 24) {
+    writer.pushByte(major | Number(uint));
+  } else {
+    encodeUintValue(writer, major, uint);
+  }
+}
+__name(directEncodeUintValue, "directEncodeUintValue");
+function canDirectEncode(options) {
+  return options.addBreakTokens !== true;
+}
+__name(canDirectEncode, "canDirectEncode");
+function directEncodeMap(writer, data, typ, options, refStack) {
+  const isMap = typ === "Map";
+  const keys = isMap ? data.keys() : Object.keys(data);
+  const maxLength = isMap ? data.size : keys.length;
+  if (!maxLength) {
+    writer.pushByte(MAJOR_MAP);
+    return;
+  }
+  refStack = Ref.createCheck(refStack, data);
+  const skipUndefined = !isMap && options.ignoreUndefinedProperties;
+  const entries = new Array(maxLength);
+  let length = 0;
+  for (const key of keys) {
+    const value = isMap ? data.get(key) : data[key];
+    if (skipUndefined && value === void 0) {
+      continue;
+    }
+    entries[length++] = [objectToTokens(key, options, refStack), value];
+  }
+  if (length === 0) {
+    writer.pushByte(MAJOR_MAP);
+    return;
+  }
+  if (length < maxLength) {
+    entries.length = length;
+  }
+  entries.sort((e1, e2) => mapSorter(e1, e2, options));
+  directEncodeUintValue(writer, MAJOR_MAP, length);
+  for (const [key, value] of entries) {
+    tokensToEncoded(writer, key, cborEncoders, options);
+    directEncode(writer, value, options, refStack);
+  }
+}
+__name(directEncodeMap, "directEncodeMap");
+function directEncode(writer, data, options, refStack) {
+  const typ = is(data);
+  const customEncoder = options.typeEncoders && options.typeEncoders[typ];
+  if (customEncoder) {
+    const tokens = customEncoder(data, typ, options, refStack);
+    if (tokens != null) {
+      tokensToEncoded(writer, tokens, cborEncoders, options);
+      return;
+    }
+  }
+  switch (typ) {
+    case "null":
+      writer.pushByte(SIMPLE_NULL);
+      return;
+    case "undefined":
+      writer.pushByte(SIMPLE_UNDEFINED);
+      return;
+    case "boolean":
+      writer.pushByte(data ? SIMPLE_TRUE : SIMPLE_FALSE);
+      return;
+    case "number":
+      if (!Number.isInteger(data) || !Number.isSafeInteger(data)) {
+        encodeFloat(writer, new Token(Type.float, data), options);
+      } else if (data >= 0) {
+        directEncodeUintValue(writer, MAJOR_UINT, data);
+      } else {
+        directEncodeUintValue(writer, MAJOR_NEGINT, data * -1 - 1);
+      }
+      return;
+    case "bigint":
+      if (data >= BigInt(0)) {
+        directEncodeUintValue(writer, MAJOR_UINT, data);
+      } else {
+        directEncodeUintValue(writer, MAJOR_NEGINT, data * neg1b2 - pos1b2);
+      }
+      return;
+    case "string": {
+      const bytes2 = fromString(data);
+      directEncodeUintValue(writer, MAJOR_STRING, bytes2.length);
+      writer.push(bytes2);
+      return;
+    }
+    case "Uint8Array":
+      directEncodeUintValue(writer, MAJOR_BYTES, data.length);
+      writer.push(data);
+      return;
+    case "Array":
+      if (!data.length) {
+        writer.pushByte(MAJOR_ARRAY);
+        return;
+      }
+      refStack = Ref.createCheck(refStack, data);
+      directEncodeUintValue(writer, MAJOR_ARRAY, data.length);
+      for (const elem of data) {
+        directEncode(writer, elem, options, refStack);
+      }
+      return;
+    case "Object":
+    case "Map":
+      if (options.mapSorter === mapSorter) {
+        directEncodeMap(writer, data, typ, options, refStack);
+      } else {
+        const tokens = typeEncoders.Object(data, typ, options, refStack);
+        tokensToEncoded(writer, tokens, cborEncoders, options);
+      }
+      return;
+    default: {
+      const typeEncoder = typeEncoders[typ];
+      if (!typeEncoder) {
+        throw new Error(`${encodeErrPrefix} unsupported type: ${typ}`);
+      }
+      const tokens = typeEncoder(data, typ, options, refStack);
+      tokensToEncoded(writer, tokens, cborEncoders, options);
+    }
+  }
+}
+__name(directEncode, "directEncode");
+function encodeCustom(data, encoders, options, destination) {
+  const hasDest = destination instanceof Uint8Array;
+  let writeTo = hasDest ? new U8Bl(destination) : defaultWriter;
+  const tokens = objectToTokens(data, options);
+  if (!Array.isArray(tokens) && options.quickEncodeToken) {
+    const quickBytes = options.quickEncodeToken(tokens);
+    if (quickBytes) {
+      if (hasDest) {
+        writeTo.push(quickBytes);
+        return writeTo.toBytes();
+      }
+      return quickBytes;
+    }
+    const encoder = encoders[tokens.type.major];
+    if (encoder.encodedSize) {
+      const size = encoder.encodedSize(tokens, options);
+      if (!hasDest) {
+        writeTo = new Bl(size);
+      }
+      encoder(writeTo, tokens, options);
+      if (writeTo.chunks.length !== 1) {
+        throw new Error(`Unexpected error: pre-calculated length for ${tokens} was wrong`);
+      }
+      return hasDest ? writeTo.toBytes() : asU8A(writeTo.chunks[0]);
+    }
+  }
+  writeTo.reset();
+  tokensToEncoded(writeTo, tokens, encoders, options);
+  return writeTo.toBytes(true);
+}
+__name(encodeCustom, "encodeCustom");
+function encode(data, options) {
+  options = Object.assign({}, defaultEncodeOptions, options);
+  if (canDirectEncode(options)) {
+    defaultWriter.reset();
+    directEncode(defaultWriter, data, options, void 0);
+    return defaultWriter.toBytes(true);
+  }
+  return encodeCustom(data, cborEncoders, options);
+}
+__name(encode, "encode");
+
+// ../../node_modules/cborg/lib/decode.js
+var defaultDecodeOptions = {
+  strict: false,
+  allowIndefinite: true,
+  allowUndefined: true,
+  allowBigInt: true
+};
+var Tokeniser = class {
+  static {
+    __name(this, "Tokeniser");
+  }
+  /**
+   * @param {Uint8Array} data
+   * @param {DecodeOptions} options
+   */
+  constructor(data, options = {}) {
+    this._pos = 0;
+    this.data = data;
+    this.options = options;
+  }
+  pos() {
+    return this._pos;
+  }
+  done() {
+    return this._pos >= this.data.length;
+  }
+  next() {
+    const byt = this.data[this._pos];
+    let token = quick[byt];
+    if (token === void 0) {
+      const decoder = jump[byt];
+      if (!decoder) {
+        throw new Error(`${decodeErrPrefix} no decoder for major type ${byt >>> 5} (byte 0x${byt.toString(16).padStart(2, "0")})`);
+      }
+      const minor = byt & 31;
+      token = decoder(this.data, this._pos, minor, this.options);
+    }
+    this._pos += token.encodedLength;
+    return token;
+  }
+};
+var DONE = /* @__PURE__ */ Symbol.for("DONE");
+var BREAK = /* @__PURE__ */ Symbol.for("BREAK");
+function tokenToArray(token, tokeniser, options) {
+  const arr = [];
+  for (let i = 0; i < token.value; i++) {
+    const value = tokensToObject(tokeniser, options);
+    if (value === BREAK) {
+      if (token.value === Infinity) {
+        break;
+      }
+      throw new Error(`${decodeErrPrefix} got unexpected break to lengthed array`);
+    }
+    if (value === DONE) {
+      throw new Error(`${decodeErrPrefix} found array but not enough entries (got ${i}, expected ${token.value})`);
+    }
+    arr[i] = value;
+  }
+  return arr;
+}
+__name(tokenToArray, "tokenToArray");
+function tokenToMap(token, tokeniser, options) {
+  const useMaps = options.useMaps === true;
+  const rejectDuplicateMapKeys = options.rejectDuplicateMapKeys === true;
+  const obj = useMaps ? void 0 : {};
+  const m = useMaps ? /* @__PURE__ */ new Map() : void 0;
+  for (let i = 0; i < token.value; i++) {
+    const key = tokensToObject(tokeniser, options);
+    if (key === BREAK) {
+      if (token.value === Infinity) {
+        break;
+      }
+      throw new Error(`${decodeErrPrefix} got unexpected break to lengthed map`);
+    }
+    if (key === DONE) {
+      throw new Error(`${decodeErrPrefix} found map but not enough entries (got ${i} [no key], expected ${token.value})`);
+    }
+    if (!useMaps && typeof key !== "string") {
+      throw new Error(`${decodeErrPrefix} non-string keys not supported (got ${typeof key})`);
+    }
+    if (rejectDuplicateMapKeys) {
+      if (useMaps && m.has(key) || !useMaps && Object.hasOwn(obj, key)) {
+        throw new Error(`${decodeErrPrefix} found repeat map key "${key}"`);
+      }
+    }
+    const value = tokensToObject(tokeniser, options);
+    if (value === DONE) {
+      throw new Error(`${decodeErrPrefix} found map but not enough entries (got ${i} [no value], expected ${token.value})`);
+    }
+    if (useMaps) {
+      m.set(key, value);
+    } else if (key === "__proto__") {
+      Object.defineProperty(obj, key, { value, configurable: true, enumerable: true, writable: true });
+    } else {
+      obj[key] = value;
+    }
+  }
+  return useMaps ? m : obj;
+}
+__name(tokenToMap, "tokenToMap");
+function* tokenToMapEntries(token, tokeniser, options) {
+  for (let i = 0; i < token.value; i++) {
+    const key = tokensToObject(tokeniser, options);
+    if (key === BREAK) {
+      if (token.value === Infinity) {
+        break;
+      }
+      throw new Error(`${decodeErrPrefix} got unexpected break to lengthed map`);
+    }
+    if (key === DONE) {
+      throw new Error(`${decodeErrPrefix} found map but not enough entries (got ${i} [no key], expected ${token.value})`);
+    }
+    const value = tokensToObject(tokeniser, options);
+    if (value === DONE) {
+      throw new Error(`${decodeErrPrefix} found map but not enough entries (got ${i} [no value], expected ${token.value})`);
+    }
+    yield [key, value];
+  }
+}
+__name(tokenToMapEntries, "tokenToMapEntries");
+function createTagDecodeControl(tokeniser, options) {
+  const decode2 = /* @__PURE__ */ __name(function() {
+    if (decode2._called) {
+      throw new Error(`${decodeErrPrefix} tag decode() may only be called once`);
+    }
+    decode2._called = true;
+    const value = tokensToObject(tokeniser, options);
+    if (value === DONE) {
+      throw new Error(`${decodeErrPrefix} tag content missing`);
+    }
+    if (value === BREAK) {
+      throw new Error(`${decodeErrPrefix} got unexpected break in tag content`);
+    }
+    return value;
+  }, "decode");
+  decode2.entries = function() {
+    if (decode2._called) {
+      throw new Error(`${decodeErrPrefix} tag decode() may only be called once`);
+    }
+    decode2._called = true;
+    const token = tokeniser.next();
+    if (!Type.equals(token.type, Type.map)) {
+      throw new Error(`${decodeErrPrefix} entries() requires map content, got ${token.type.name}`);
+    }
+    const entries = [];
+    for (const entry of tokenToMapEntries(token, tokeniser, options)) {
+      entries.push(entry);
+    }
+    return entries;
+  };
+  decode2._called = false;
+  return decode2;
+}
+__name(createTagDecodeControl, "createTagDecodeControl");
+function tokensToObject(tokeniser, options) {
+  if (tokeniser.done()) {
+    return DONE;
+  }
+  const token = tokeniser.next();
+  if (Type.equals(token.type, Type.break)) {
+    return BREAK;
+  }
+  if (token.type.terminal) {
+    return token.value;
+  }
+  if (Type.equals(token.type, Type.array)) {
+    return tokenToArray(token, tokeniser, options);
+  }
+  if (Type.equals(token.type, Type.map)) {
+    return tokenToMap(token, tokeniser, options);
+  }
+  if (Type.equals(token.type, Type.tag)) {
+    if (options.tags && typeof options.tags[token.value] === "function") {
+      const decodeControl = createTagDecodeControl(tokeniser, options);
+      const result = options.tags[token.value](decodeControl);
+      if (!decodeControl._called) {
+        throw new Error(`${decodeErrPrefix} tag decoder must call decode() or entries()`);
+      }
+      return result;
+    }
+    throw new Error(`${decodeErrPrefix} tag not supported (${token.value})`);
+  }
+  throw new Error("unsupported");
+}
+__name(tokensToObject, "tokensToObject");
+function decodeFirst(data, options) {
+  if (!(data instanceof Uint8Array)) {
+    throw new Error(`${decodeErrPrefix} data to decode must be a Uint8Array`);
+  }
+  options = Object.assign({}, defaultDecodeOptions, options);
+  const u8aData = asU8A(data);
+  const tokeniser = options.tokenizer || new Tokeniser(u8aData, options);
+  const decoded = tokensToObject(tokeniser, options);
+  if (decoded === DONE) {
+    throw new Error(`${decodeErrPrefix} did not find any content to decode`);
+  }
+  if (decoded === BREAK) {
+    throw new Error(`${decodeErrPrefix} got unexpected break`);
+  }
+  return [decoded, data.subarray(tokeniser.pos())];
+}
+__name(decodeFirst, "decodeFirst");
+function decode(data, options) {
+  const [decoded, remainder] = decodeFirst(data, options);
+  if (remainder.length > 0) {
+    throw new Error(`${decodeErrPrefix} too many terminals, data makes no sense`);
+  }
+  return decoded;
+}
+__name(decode, "decode");
+
+// ../../node_modules/cborg/lib/tagged.js
+var Tagged = class _Tagged {
+  static {
+    __name(this, "Tagged");
+  }
+  /**
+   * @param {number} tag - CBOR tag number, a non-negative integer
+   * @param {any} value - The value to be tagged; encoded recursively
+   */
+  constructor(tag, value) {
+    if (typeof tag !== "number" || !Number.isInteger(tag) || tag < 0) {
+      throw new TypeError("Tagged: tag must be a non-negative integer");
+    }
+    this.tag = tag;
+    this.value = value;
+  }
+  /**
+   * Build a tag decoder for use in `decode()`'s `tags` option that returns the
+   * decoded content wrapped in a `Tagged` instance, preserving the tag number
+   * for the caller to inspect.
+   *
+   * @param {number} tag - The CBOR tag number this decoder will be registered for
+   * @returns {TaggedTagDecoder}
+   *
+   * @example
+   * import { decode, Tagged } from 'cborg'
+   * const value = decode(bytes, { tags: { 16: Tagged.decoder(16) } })
+   * // value instanceof Tagged; value.tag === 16
+   */
+  static decoder(tag) {
+    return (decode2) => new _Tagged(tag, decode2());
+  }
+  /**
+   * Build a `tags` option for `decode()` that wraps each listed tag number in
+   * a `Tagged` instance, preserving those tags through decode without
+   * registering a dedicated decoder per tag.
+   *
+   * @param {...number} tagNumbers - One or more CBOR tag numbers to preserve
+   * @returns {{[tagNumber: number]: TaggedTagDecoder}}
+   *
+   * @example
+   * import { decode, Tagged } from 'cborg'
+   * const value = decode(bytes, { tags: Tagged.preserve(16, 96) })
+   */
+  static preserve(...tagNumbers) {
+    const tags = {};
+    for (const tag of tagNumbers) {
+      tags[tag] = _Tagged.decoder(tag);
+    }
+    return tags;
+  }
+};
+Object.defineProperty(Tagged.prototype, Symbol.toStringTag, {
+  value: "Tagged"
+});
+
+// src/escrow-nitro-attestation.ts
+var import_x509 = require("@peculiar/x509");
+var NitroAttestationError = class extends Error {
+  constructor(reason) {
+    super(`Nitro attestation rejected: ${reason}`);
+    this.reason = reason;
+    this.name = "NitroAttestationError";
+  }
+  static {
+    __name(this, "NitroAttestationError");
+  }
+};
+var AWS_ROOT_SHA256 = "641a0321a3e244efe456463195d606317ed7cdcc3c1756e09893f3c68f79bb5b";
+var fail = /* @__PURE__ */ __name((reason) => {
+  throw new NitroAttestationError(reason);
+}, "fail");
+var hex = /* @__PURE__ */ __name((bytes2) => Array.from(bytes2, (byte) => byte.toString(16).padStart(2, "0")).join(""), "hex");
+var bytes = /* @__PURE__ */ __name((value, reason) => value instanceof Uint8Array && value.length > 0 ? value : fail(reason), "bytes");
+var map = /* @__PURE__ */ __name((value, reason) => value instanceof Map ? value : fail(reason), "map");
+var decodeCbor = /* @__PURE__ */ __name((value) => {
+  try {
+    return decode(value, {
+      useMaps: true,
+      rejectDuplicateMapKeys: true,
+      allowIndefinite: false,
+      allowUndefined: false,
+      allowNaN: false,
+      allowInfinity: false,
+      allowBigInt: false
+    });
+  } catch {
+    return fail("cbor");
+  }
+}, "decodeCbor");
+var decodeUserData = /* @__PURE__ */ __name((userData) => {
+  let decoded;
+  try {
+    decoded = decode(userData, {
+      useMaps: true,
+      rejectDuplicateMapKeys: true,
+      allowIndefinite: false,
+      allowUndefined: false,
+      allowNaN: false,
+      allowInfinity: false,
+      allowBigInt: false
+    });
+  } catch {
+    return void 0;
+  }
+  if (!(decoded instanceof Map) || decoded.size !== 3) return void 0;
+  const spki = decoded.get(0);
+  const keyId = decoded.get(1);
+  const previousKeyIds = decoded.get(2);
+  const isKeyId = /* @__PURE__ */ __name((value) => typeof value === "string" && /^[A-Za-z0-9._-]{1,128}$/.test(value), "isKeyId");
+  if (!(spki instanceof Uint8Array) || spki.length === 0 || !isKeyId(keyId) || !Array.isArray(previousKeyIds) || previousKeyIds.length > 3 || !previousKeyIds.every(isKeyId)) {
+    return void 0;
+  }
+  return { spki, keyId, previousKeyIds };
+}, "decodeUserData");
+var verifyNitroAttestationDocument = /* @__PURE__ */ __name(async (documentB64, {
+  expectedNonce,
+  policy,
+  now = Date.now()
+}) => {
+  let document;
+  try {
+    if (!documentB64 || documentB64.length > 65536 || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(documentB64))
+      fail("cbor");
+    document = base64ToBuffer(documentB64);
+  } catch {
+    return fail("cbor");
+  }
+  const cose = decodeCbor(document[0] === 210 ? document.subarray(1) : document);
+  if (!Array.isArray(cose) || cose.length !== 4) fail("cose");
+  const [protectedValue, unprotectedValue, payloadValue, signatureValue] = cose;
+  const protectedBytes = bytes(protectedValue, "cose");
+  const protectedHeader = map(decodeCbor(protectedBytes), "alg");
+  if (protectedHeader.size !== 1 || protectedHeader.get(1) !== -35) fail("alg");
+  if (map(unprotectedValue, "cose").size !== 0) fail("cose");
+  const payloadBytes = bytes(payloadValue, "cose");
+  const signature = bytes(signatureValue, "signature");
+  if (signature.length !== 96) fail("signature");
+  const payload = map(decodeCbor(payloadBytes), "cbor");
+  const moduleId = payload.get("module_id");
+  const timestamp = payload.get("timestamp");
+  if (typeof moduleId !== "string" || !moduleId || payload.get("digest") !== "SHA384")
+    fail("cbor");
+  if (typeof timestamp !== "number" || !Number.isSafeInteger(timestamp) || timestamp < 0)
+    fail("freshness");
+  const leafDer = bytes(payload.get("certificate"), "chain");
+  const bundle = payload.get("cabundle");
+  if (!Array.isArray(bundle) || !bundle.length || bundle.length > 16) fail("chain");
+  const ders = bundle.map((value) => bytes(value, "chain"));
+  const rootHash = hex(
+    new Uint8Array(await crypto.subtle.digest("SHA-256", new Uint8Array(ders[0])))
+  );
+  if (rootHash !== (policy.rootCertificateSha256 ?? AWS_ROOT_SHA256).toLowerCase()) fail("root");
+  let leaf;
+  try {
+    const chain = [...ders, leafDer].map((der) => new import_x509.X509Certificate(new Uint8Array(der)));
+    for (let i = 0; i < chain.length; i++) {
+      const cert = chain[i];
+      const issuer = chain[Math.max(0, i - 1)];
+      if (!Number.isFinite(now) || now < cert.notBefore.getTime() || now > cert.notAfter.getTime() || cert.issuer !== issuer.subject || !await cert.verify({ publicKey: issuer.publicKey, date: new Date(now) }, crypto))
+        fail("chain");
+      if (i < chain.length - 1) {
+        const constraints = cert.getExtension(import_x509.BasicConstraintsExtension);
+        const usage = cert.getExtension(import_x509.KeyUsagesExtension);
+        if (!constraints?.ca || constraints.pathLength !== void 0 && chain.length - i - 2 > constraints.pathLength || usage && !(usage.usages & import_x509.KeyUsageFlags.keyCertSign))
+          fail("chain");
+      }
+    }
+    leaf = chain[chain.length - 1];
+  } catch {
+    return fail("chain");
+  }
+  try {
+    const key = await crypto.subtle.importKey(
+      "spki",
+      leaf.publicKey.rawData,
+      { name: "ECDSA", namedCurve: "P-384" },
+      false,
+      ["verify"]
+    );
+    const structure = encode(["Signature1", protectedBytes, new Uint8Array(), payloadBytes]);
+    if (!await crypto.subtle.verify(
+      { name: "ECDSA", hash: "SHA-384" },
+      key,
+      new Uint8Array(signature),
+      new Uint8Array(structure)
+    ))
+      fail("signature");
+  } catch {
+    return fail("signature");
+  }
+  const rawPcrs = map(payload.get("pcrs"), "pcr");
+  const pcrs = {};
+  for (const [index, value] of rawPcrs) {
+    if (typeof index !== "number" || !Number.isInteger(index) || index < 0 || index > 31)
+      fail("pcr");
+    const pcr = bytes(value, "pcr");
+    if (pcr.length !== 48) fail("pcr");
+    pcrs[index] = hex(pcr);
+  }
+  if (pcrs[0] === "00".repeat(48)) fail("debug");
+  if (!policy.pinnedMeasurements.some(
+    (pin) => typeof pin.pcr0 === "string" && typeof pin.pcr1 === "string" && typeof pin.pcr2 === "string" && pin.pcr0.toLowerCase() === pcrs[0] && pin.pcr1.toLowerCase() === pcrs[1] && pin.pcr2.toLowerCase() === pcrs[2]
+  ))
+    fail("pcr");
+  const nonce = bytes(payload.get("nonce"), "nonce");
+  if (!(expectedNonce instanceof Uint8Array) || expectedNonce.length !== 32 || nonce.length !== expectedNonce.length)
+    fail("nonce");
+  let difference = 0;
+  for (let i = 0; i < nonce.length; i++) difference |= nonce[i] ^ expectedNonce[i];
+  if (difference !== 0) fail("nonce");
+  const maxAge = policy.maxAgeMs ?? 3e5;
+  if (!Number.isFinite(maxAge) || maxAge < 0 || now - timestamp > maxAge || timestamp > now + 6e4)
+    fail("freshness");
+  const userData = bytes(payload.get("user_data"), "user-data");
+  const newFormat = decodeUserData(new Uint8Array(userData));
+  const spki = newFormat ? newFormat.spki : userData;
+  try {
+    await crypto.subtle.importKey(
+      "spki",
+      new Uint8Array(spki),
+      { name: "ECDH", namedCurve: "P-256" },
+      false,
+      []
+    );
+  } catch {
+    return fail("user-data");
+  }
+  return {
+    escrowPublicKeySpkiB64: bufferToBase64(new Uint8Array(spki).buffer),
+    keyId: newFormat?.keyId,
+    previousKeyIds: newFormat?.previousKeyIds ?? [],
+    pcrs,
+    timestamp,
+    moduleId
+  };
+}, "verifyNitroAttestationDocument");
+
+// src/escrow-attestation.ts
+var isRecord3 = /* @__PURE__ */ __name((value) => typeof value === "object" && value !== null && !Array.isArray(value), "isRecord");
+var normalizePublicKey = /* @__PURE__ */ __name((value) => {
+  const trimmed = value.trim();
+  if (!trimmed || trimmed.length > 512 || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(trimmed)) {
+    throw new Error("Invalid escrow attestation public key");
+  }
+  return bufferToBase64(base64ToBuffer(trimmed).buffer);
+}, "normalizePublicKey");
+var verifyEnclaveAttestation = /* @__PURE__ */ __name(async (attestation, policy, nonce) => {
+  const isKeyId = /* @__PURE__ */ __name((value) => typeof value === "string" && /^[A-Za-z0-9._-]{1,128}$/.test(value), "isKeyId");
+  const fields = [
+    "mode",
+    "keyId",
+    "previousKeyIds",
+    "publicKey",
+    "measurements",
+    "document",
+    "issuedAt"
+  ];
+  if (!isRecord3(attestation) || Object.keys(attestation).some((key) => !fields.includes(key)) || attestation.mode !== "software" && attestation.mode !== "nitro" || !isKeyId(attestation.keyId) || attestation.previousKeyIds !== void 0 && (!Array.isArray(attestation.previousKeyIds) || attestation.previousKeyIds.length > 3 || !attestation.previousKeyIds.every(isKeyId)) || typeof attestation.publicKey !== "string" || !isRecord3(attestation.measurements) || Object.entries(attestation.measurements).some(
+    ([key, value]) => !["imageSha384", "pcr0", "pcr1", "pcr2"].includes(key) || typeof value !== "string" || !value || value.length > 1024
+  ) || typeof attestation.document !== "string" || !attestation.document || attestation.document.length > 65536 || typeof attestation.issuedAt !== "string" || !Number.isFinite(Date.parse(attestation.issuedAt))) {
+    throw new Error("Invalid escrow attestation");
+  }
+  const plaintextPreviousKeyIds = attestation.previousKeyIds ?? [];
+  if (attestation.mode !== policy.mode) throw new Error("Escrow attestation mode mismatch");
+  if (policy.mode === "nitro") {
+    if (!nonce) throw new NitroAttestationError("nonce");
+    const verified = await verifyNitroAttestationDocument(attestation.document, {
+      expectedNonce: nonce,
+      policy
+    });
+    try {
+      if (normalizePublicKey(attestation.publicKey) !== verified.escrowPublicKeySpkiB64) {
+        throw new NitroAttestationError("user-data");
+      }
+    } catch {
+      throw new NitroAttestationError("user-data");
+    }
+    if (verified.keyId !== void 0 && verified.keyId !== attestation.keyId) {
+      throw new NitroAttestationError("user-data");
+    }
+    if (plaintextPreviousKeyIds.length !== verified.previousKeyIds.length || !plaintextPreviousKeyIds.every((id, index) => id === verified.previousKeyIds[index])) {
+      throw new NitroAttestationError("user-data");
+    }
+    return {
+      publicKey: verified.escrowPublicKeySpkiB64,
+      keyId: attestation.keyId,
+      previousKeyIds: verified.previousKeyIds,
+      mode: "nitro"
+    };
+  }
+  const publicKey = normalizePublicKey(attestation.publicKey);
+  await crypto.subtle.importKey(
+    "spki",
+    base64ToBuffer(publicKey),
+    { name: "ECDH", namedCurve: "P-256" },
+    false,
+    []
+  );
+  if (!policy.pinnedPublicKeys.some((pin) => normalizePublicKey(pin) === publicKey)) {
+    throw new Error("Escrow attestation public key is not trusted");
+  }
+  return {
+    publicKey,
+    keyId: attestation.keyId,
+    previousKeyIds: plaintextPreviousKeyIds,
+    mode: attestation.mode
+  };
+}, "verifyEnclaveAttestation");
+
+// src/types.ts
+var import_types = __toESM(require_dist());
+var EscrowPinUnavailableError = class extends Error {
+  static {
+    __name(this, "EscrowPinUnavailableError");
+  }
+  constructor() {
+    super("PIN recovery is not available for this account.");
+    this.name = "EscrowPinUnavailableError";
+  }
+};
+var EscrowPinMismatchError = class extends Error {
+  constructor(attemptsRemaining) {
+    super("Incorrect PIN.");
+    this.attemptsRemaining = attemptsRemaining;
+    this.name = "EscrowPinMismatchError";
+  }
+  static {
+    __name(this, "EscrowPinMismatchError");
+  }
+};
+var EscrowPinThrottledError = class extends Error {
+  static {
+    __name(this, "EscrowPinThrottledError");
+  }
+  constructor() {
+    super("Too many tries right now. Wait a minute and try again.");
+    this.name = "EscrowPinThrottledError";
+  }
+};
+var EscrowHoldRestartThrottledError = class extends Error {
+  constructor(retryAfter) {
+    super("A recovery request was started recently. Please wait before restarting.");
+    this.retryAfter = retryAfter;
+    this.name = "EscrowHoldRestartThrottledError";
+  }
+  static {
+    __name(this, "EscrowHoldRestartThrottledError");
+  }
+};
+var EscrowPinLockedError = class extends Error {
+  static {
+    __name(this, "EscrowPinLockedError");
+  }
+  constructor() {
+    super("Too many incorrect PIN attempts. You can still recover by waiting.");
+    this.name = "EscrowPinLockedError";
+  }
+};
+
+// src/escrow-pin.ts
+var PIN_MIN_LENGTH = 6;
+var PIN_MAX_LENGTH = 12;
+var ESCROW_PIN_MAX_ATTEMPTS = 10;
+var TRIVIAL_PINS = /* @__PURE__ */ new Set([
+  "123456",
+  "654321",
+  "000000",
+  "111111",
+  "121212",
+  "112233",
+  "123123",
+  "696969",
+  "123321"
+]);
+var normalizePin = /* @__PURE__ */ __name((raw) => raw.trim().normalize("NFKD").replace(/\D/g, ""), "normalizePin");
+var validatePin = /* @__PURE__ */ __name((pin) => {
+  const normalized = normalizePin(pin);
+  if (normalized.length < PIN_MIN_LENGTH || normalized.length > PIN_MAX_LENGTH) {
+    return { ok: false, reason: "length" };
+  }
+  if (/^(\d)\1+$/.test(normalized) || "0123456789".includes(normalized) || "9876543210".includes(normalized) || TRIVIAL_PINS.has(normalized)) {
+    return { ok: false, reason: "trivial" };
+  }
+  return { ok: true };
+}, "validatePin");
+var generatePinSalt = /* @__PURE__ */ __name(() => bufferToBase64(crypto.getRandomValues(new Uint8Array(16)).buffer), "generatePinSalt");
+var derivePinProof = /* @__PURE__ */ __name(async (pin, pinSaltBase64) => {
+  const salt = base64ToBuffer(pinSaltBase64);
+  if (salt.length !== 16) throw new Error("Invalid escrow PIN salt length");
+  const key = await deriveKeyFromPassword(normalizePin(pin), salt);
+  try {
+    return bytesToHex(key);
+  } finally {
+    key.fill(0);
+  }
+}, "derivePinProof");
+var constantTimeEqualHex = /* @__PURE__ */ __name((a, b) => {
+  if (a.length !== b.length || !/^(?:[0-9a-f]{2})+$/i.test(a) || !/^(?:[0-9a-f]{2})+$/i.test(b)) {
+    return false;
+  }
+  const aBytes = hexToBytes(a);
+  const bBytes = hexToBytes(b);
+  let difference = 0;
+  for (let i = 0; i < aBytes.length; i++) {
+    difference |= aBytes[i] ^ bBytes[i];
+  }
+  return difference === 0;
+}, "constantTimeEqualHex");
+
+// src/atomic-operations.ts
+var ShareVerificationError = class extends Error {
+  constructor(message, combination, expected, got) {
+    super(message);
+    this.combination = combination;
+    this.expected = expected;
+    this.got = got;
+    this.name = "ShareVerificationError";
+  }
+  static {
+    __name(this, "ShareVerificationError");
+  }
+};
+var AtomicUpdateError = class extends Error {
+  constructor(message, phase, rolledBack, cause) {
+    super(message);
+    this.phase = phase;
+    this.rolledBack = rolledBack;
+    this.cause = cause;
+    this.name = "AtomicUpdateError";
+  }
+  static {
+    __name(this, "AtomicUpdateError");
+  }
+};
+var ShareWriteRejectedError = class extends Error {
+  static {
+    __name(this, "ShareWriteRejectedError");
+  }
+  constructor(message) {
+    super(message);
+    this.name = "ShareWriteRejectedError";
+  }
+};
+async function splitAndVerify(privateKey) {
+  const shares = await splitPrivateKey(privateKey);
+  const combinations = [
+    ["device+auth", shares.deviceShare, shares.authShare],
+    ["device+recovery", shares.deviceShare, shares.recoveryShare],
+    ["device+email", shares.deviceShare, shares.emailShare],
+    ["auth+recovery", shares.authShare, shares.recoveryShare],
+    ["auth+email", shares.authShare, shares.emailShare],
+    ["recovery+email", shares.recoveryShare, shares.emailShare]
+  ];
+  for (const [name, share1, share2] of combinations) {
+    const reconstructed = await reconstructFromShares([share1, share2]);
+    if (reconstructed !== privateKey) {
+      throw new ShareVerificationError(
+        `Share verification failed for ${name}: reconstruction mismatch`,
+        name,
+        privateKey,
+        reconstructed
+      );
+    }
+  }
+  return {
     privateKey,
     shares,
     verified: true
@@ -21077,6 +23724,7 @@ function createSSSStrategy(config) {
   let pendingIdentityRecovery;
   let lastServerSnapshot = null;
   let escrowEnrollmentInFlight;
+  let staleEscrowReenrollAttempted = false;
   let unenrolledRotation;
   const escrowRequest = /* @__PURE__ */ __name(async (path, init, pinAttempt = false) => {
     const response = await fetch(`${serverUrl}/keys/escrow${path}`, {
@@ -21124,11 +23772,16 @@ function createSSSStrategy(config) {
   }, "escrowRequest");
   const fetchVerifiedEnclaveKey = /* @__PURE__ */ __name(async () => {
     if (!config.escrow?.enabled) throw new Error("Escrow enrollment is disabled");
-    const { attestation } = await escrowRequest("/attestation", {
-      method: "GET",
-      headers: buildHeaders("", void 0, tenantId)
-    });
-    return verifyEnclaveAttestation(attestation, config.escrow.attestation);
+    const nonce = crypto.getRandomValues(new Uint8Array(32));
+    const nonceHex = Array.from(nonce, (byte) => byte.toString(16).padStart(2, "0")).join("");
+    const { attestation } = await escrowRequest(
+      `/attestation?nonce=${nonceHex}`,
+      {
+        method: "GET",
+        headers: buildHeaders("", void 0, tenantId)
+      }
+    );
+    return verifyEnclaveAttestation(attestation, config.escrow.attestation, nonce);
   }, "fetchVerifiedEnclaveKey");
   const enrollEscrow = /* @__PURE__ */ __name(async (token, providerType, privateKey, primaryDid, shares, shareVersion, signDidAuthVp, verifiedKey, pinMaterial, clearPin = false) => {
     if (!config.escrow?.enabled) throw new Error("Escrow enrollment is disabled");
@@ -21190,75 +23843,89 @@ function createSSSStrategy(config) {
     }
     const status = await self.fetchServerKeyStatus(params.token, params.providerType);
     if (status.escrowOptedOut) return { enrolled: false, reason: "opted-out" };
-    if (!forceRotate && pin === void 0 && status.shareVersion !== null && status.recoveryMethods.some(
+    const currentlyEnrolled = status.shareVersion !== null && status.recoveryMethods.some(
       (method) => method.type === "escrow" && method.shareVersion === status.shareVersion && (Boolean(method.confirmedAt) || "confirmationStatus" in method && method.confirmationStatus === "confirmed")
-    ))
+    );
+    const repairingStaleBlob = pin === void 0 && !forceRotate && currentlyEnrolled && !!status.escrowStale && !staleEscrowReenrollAttempted;
+    if (!forceRotate && pin === void 0 && currentlyEnrolled && !repairingStaleBlob)
       return { enrolled: true, changed: false };
+    if (repairingStaleBlob) staleEscrowReenrollAttempted = true;
     if (!status.primaryDid) throw new Error("Cannot enroll escrow without a primary DID");
     if (!params.signDidAuthVp) {
       throw new Error("DID proof signing is required for escrow enrollment");
     }
-    if (!forceRotate && pin === void 0 && unenrolledRotation && unenrolledRotation.shareVersion === status.shareVersion && unenrolledRotation.primaryDid === status.primaryDid) {
-      const retry = unenrolledRotation;
+    try {
+      if (!forceRotate && pin === void 0 && unenrolledRotation && unenrolledRotation.shareVersion === status.shareVersion && unenrolledRotation.primaryDid === status.primaryDid) {
+        const retry = unenrolledRotation;
+        await enrollEscrow(
+          params.token,
+          params.providerType,
+          params.privateKey,
+          retry.primaryDid,
+          retry.shares,
+          retry.shareVersion,
+          params.signDidAuthVp,
+          void 0,
+          void 0,
+          retry.clearPin
+        );
+        unenrolledRotation = void 0;
+        return { enrolled: true, changed: true, shareVersion: retry.shareVersion };
+      }
+      const verifiedKey = await fetchVerifiedEnclaveKey();
+      const pinSalt = pin !== void 0 ? generatePinSalt() : void 0;
+      const pinMaterial = pin !== void 0 && pinSalt !== void 0 ? { pinSalt, pinVerifier: await derivePinProof(pin, pinSalt) } : void 0;
+      const storageId = activeStorageId;
+      const primaryDid = status.primaryDid;
+      const { shares, shareVersion } = await withShareUpdateLock(
+        storage2,
+        storageId,
+        () => persistSharesWithoutLock(
+          params.privateKey,
+          serverUrl,
+          params.token,
+          params.providerType,
+          primaryDid,
+          storage2,
+          storageId,
+          void 0,
+          params.signDidAuthVp,
+          tenantId
+        )
+      );
+      lastEmailShare = shares.emailShare;
+      lastShareVersion = shareVersion;
+      lastServerSnapshot = {
+        currentVersion: shareVersion,
+        resolvedVersion: shareVersion,
+        authShare: shares.authShare,
+        primaryDid: status.primaryDid
+      };
+      unenrolledRotation = pinMaterial ? void 0 : { shares, shareVersion, primaryDid: status.primaryDid, clearPin: forceRotate };
       await enrollEscrow(
         params.token,
         params.providerType,
         params.privateKey,
-        retry.primaryDid,
-        retry.shares,
-        retry.shareVersion,
+        status.primaryDid,
+        shares,
+        shareVersion,
         params.signDidAuthVp,
-        void 0,
-        void 0,
-        retry.clearPin
+        verifiedKey,
+        pinMaterial,
+        forceRotate
       );
       unenrolledRotation = void 0;
-      return { enrolled: true, changed: true, shareVersion: retry.shareVersion };
+      return { enrolled: true, changed: true, shareVersion };
+    } catch (err) {
+      if (!repairingStaleBlob) throw err;
+      try {
+        if (config.onEscrowError) config.onEscrowError(err);
+        else console.warn("SSS: escrow enrollment failed");
+      } catch {
+        console.warn("SSS: escrow error reporting failed");
+      }
+      return { enrolled: true, changed: false };
     }
-    const verifiedKey = await fetchVerifiedEnclaveKey();
-    const pinSalt = pin !== void 0 ? generatePinSalt() : void 0;
-    const pinMaterial = pin !== void 0 && pinSalt !== void 0 ? { pinSalt, pinVerifier: await derivePinProof(pin, pinSalt) } : void 0;
-    const storageId = activeStorageId;
-    const primaryDid = status.primaryDid;
-    const { shares, shareVersion } = await withShareUpdateLock(
-      storage2,
-      storageId,
-      () => persistSharesWithoutLock(
-        params.privateKey,
-        serverUrl,
-        params.token,
-        params.providerType,
-        primaryDid,
-        storage2,
-        storageId,
-        void 0,
-        params.signDidAuthVp,
-        tenantId
-      )
-    );
-    lastEmailShare = shares.emailShare;
-    lastShareVersion = shareVersion;
-    lastServerSnapshot = {
-      currentVersion: shareVersion,
-      resolvedVersion: shareVersion,
-      authShare: shares.authShare,
-      primaryDid: status.primaryDid
-    };
-    unenrolledRotation = pinMaterial ? void 0 : { shares, shareVersion, primaryDid: status.primaryDid, clearPin: forceRotate };
-    await enrollEscrow(
-      params.token,
-      params.providerType,
-      params.privateKey,
-      status.primaryDid,
-      shares,
-      shareVersion,
-      params.signDidAuthVp,
-      verifiedKey,
-      pinMaterial,
-      forceRotate
-    );
-    unenrolledRotation = void 0;
-    return { enrolled: true, changed: true, shareVersion };
   }, "ensureEscrowEnrollmentUnguarded");
   const recordPromotion = /* @__PURE__ */ __name((primaryDid) => (snapshot) => {
     lastEmailShare = void 0;
@@ -21575,6 +24242,7 @@ function createSSSStrategy(config) {
         maskedRecoveryEmail: data.maskedRecoveryEmail ?? null,
         escrowOptedOut: data.escrowOptedOut === true,
         escrowPin: data.escrowPin,
+        escrowStale: data.escrowStale,
         sssActivationState: data.sssActivationState ?? "active"
       };
     },
@@ -21619,10 +24287,17 @@ function createSSSStrategy(config) {
       if (!config.escrow?.enabled) return { state: "disabled" };
       const status = await this.fetchServerKeyStatus(params.token, params.providerType);
       if (status.escrowOptedOut) return { state: "opted-out", escrowPin: status.escrowPin };
-      const state = status.shareVersion !== null && status.recoveryMethods.some(
-        (method) => method.type === "escrow" && method.shareVersion === status.shareVersion && (Boolean(method.confirmedAt) || "confirmationStatus" in method && method.confirmationStatus === "confirmed")
-      ) ? "enrolled" : "not-enrolled";
-      return { state, escrowPin: status.escrowPin };
+      const confirmedEscrow = status.recoveryMethods.filter(
+        (method) => method.type === "escrow" && (Boolean(method.confirmedAt) || "confirmationStatus" in method && method.confirmationStatus === "confirmed")
+      );
+      const enrolled = status.shareVersion !== null && confirmedEscrow.some((method) => method.shareVersion === status.shareVersion);
+      if (confirmedEscrow.length > 0 && (!enrolled || status.escrowStale))
+        return {
+          state: "stale",
+          escrowPin: status.escrowPin,
+          staleReason: status.escrowStale
+        };
+      return { state: enrolled ? "enrolled" : "not-enrolled", escrowPin: status.escrowPin };
     },
     async disableEscrowRecovery(params) {
       const status = await this.fetchServerKeyStatus(params.token, params.providerType);
@@ -21675,7 +24350,7 @@ function createSSSStrategy(config) {
       const result = await withRotationLock(
         () => ensureEscrowEnrollmentUnguarded(this, { ...params, options: { pin } }, storage2)
       );
-      if (!result.enrolled) {
+      if (!result.enrolled || !result.changed) {
         throw new Error("Automatic recovery is not available for this account.");
       }
     },
@@ -21684,7 +24359,7 @@ function createSSSStrategy(config) {
       const result = await withRotationLock(
         () => ensureEscrowEnrollmentUnguarded(this, params, storage2, true)
       );
-      if (!result.enrolled) {
+      if (!result.enrolled || !result.changed) {
         throw new Error("Automatic recovery is not available for this account.");
       }
     },