@learncard/sss-key-manager 0.2.0 → 0.2.1

package/dist/sss-key-manager.esm.js

@@ -6,7 +6,11 @@ var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 var __commonJS = (cb, mod) => function __require() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e) {
+    throw mod = 0, e;
+  }
 };
 var __copyProps = (to, from, except, desc) => {
   if (from && typeof from === "object" || typeof from === "function") {
@@ -73,6 +77,12 @@ var require_types_cjs_development = __commonJS({
       AppEventResponseValidator: /* @__PURE__ */ __name(() => AppEventResponseValidator, "AppEventResponseValidator"),
       AppEventValidator: /* @__PURE__ */ __name(() => AppEventValidator, "AppEventValidator"),
       AppListingStatusValidator: /* @__PURE__ */ __name(() => AppListingStatusValidator, "AppListingStatusValidator"),
+      AppManifestDiffValidator: /* @__PURE__ */ __name(() => AppManifestDiffValidator, "AppManifestDiffValidator"),
+      AppManifestTemplateChangeValidator: /* @__PURE__ */ __name(() => AppManifestTemplateChangeValidator, "AppManifestTemplateChangeValidator"),
+      AppManifestTemplateRefValidator: /* @__PURE__ */ __name(() => AppManifestTemplateRefValidator, "AppManifestTemplateRefValidator"),
+      AppManifestValidator: /* @__PURE__ */ __name(() => AppManifestValidator, "AppManifestValidator"),
+      AppManifestVersionStatusValidator: /* @__PURE__ */ __name(() => AppManifestVersionStatusValidator, "AppManifestVersionStatusValidator"),
+      AppManifestVersionValidator: /* @__PURE__ */ __name(() => AppManifestVersionValidator, "AppManifestVersionValidator"),
       AppStoreListingCreateValidator: /* @__PURE__ */ __name(() => AppStoreListingCreateValidator, "AppStoreListingCreateValidator"),
       AppStoreListingSubmitterValidator: /* @__PURE__ */ __name(() => AppStoreListingSubmitterValidator, "AppStoreListingSubmitterValidator"),
       AppStoreListingUpdateValidator: /* @__PURE__ */ __name(() => AppStoreListingUpdateValidator, "AppStoreListingUpdateValidator"),
@@ -94,6 +104,8 @@ var require_types_cjs_development = __commonJS({
       BoostRecipientValidator: /* @__PURE__ */ __name(() => BoostRecipientValidator, "BoostRecipientValidator"),
       BoostRecipientWithChildrenValidator: /* @__PURE__ */ __name(() => BoostRecipientWithChildrenValidator, "BoostRecipientWithChildrenValidator"),
       BoostValidator: /* @__PURE__ */ __name(() => BoostValidator, "BoostValidator"),
+      CapturedConsentRecordValidator: /* @__PURE__ */ __name(() => CapturedConsentRecordValidator, "CapturedConsentRecordValidator"),
+      CapturedTemplateRecordValidator: /* @__PURE__ */ __name(() => CapturedTemplateRecordValidator, "CapturedTemplateRecordValidator"),
       CheckCredentialEventValidator: /* @__PURE__ */ __name(() => CheckCredentialEventValidator, "CheckCredentialEventValidator"),
       CheckIssuanceStatusEventValidator: /* @__PURE__ */ __name(() => CheckIssuanceStatusEventValidator, "CheckIssuanceStatusEventValidator"),
       ClaimHookQueryValidator: /* @__PURE__ */ __name(() => ClaimHookQueryValidator, "ClaimHookQueryValidator"),
@@ -115,6 +127,7 @@ var require_types_cjs_development = __commonJS({
       ConsentFlowDataForDidQueryValidator: /* @__PURE__ */ __name(() => ConsentFlowDataForDidQueryValidator, "ConsentFlowDataForDidQueryValidator"),
       ConsentFlowDataQueryValidator: /* @__PURE__ */ __name(() => ConsentFlowDataQueryValidator, "ConsentFlowDataQueryValidator"),
       ConsentFlowGuardianApprovalValidator: /* @__PURE__ */ __name(() => ConsentFlowGuardianApprovalValidator, "ConsentFlowGuardianApprovalValidator"),
+      ConsentFlowReferralValidator: /* @__PURE__ */ __name(() => ConsentFlowReferralValidator, "ConsentFlowReferralValidator"),
       ConsentFlowTermValidator: /* @__PURE__ */ __name(() => ConsentFlowTermValidator, "ConsentFlowTermValidator"),
       ConsentFlowTermsQueryValidator: /* @__PURE__ */ __name(() => ConsentFlowTermsQueryValidator, "ConsentFlowTermsQueryValidator"),
       ConsentFlowTermsStatusValidator: /* @__PURE__ */ __name(() => ConsentFlowTermsStatusValidator, "ConsentFlowTermsStatusValidator"),
@@ -122,6 +135,10 @@ var require_types_cjs_development = __commonJS({
       ConsentFlowTransactionActionValidator: /* @__PURE__ */ __name(() => ConsentFlowTransactionActionValidator, "ConsentFlowTransactionActionValidator"),
       ConsentFlowTransactionValidator: /* @__PURE__ */ __name(() => ConsentFlowTransactionValidator, "ConsentFlowTransactionValidator"),
       ConsentFlowTransactionsQueryValidator: /* @__PURE__ */ __name(() => ConsentFlowTransactionsQueryValidator, "ConsentFlowTransactionsQueryValidator"),
+      ConsentFlowWebhookMetadataValidator: /* @__PURE__ */ __name(() => ConsentFlowWebhookMetadataValidator, "ConsentFlowWebhookMetadataValidator"),
+      ConsentRequestPersonalFieldValidator: /* @__PURE__ */ __name(() => ConsentRequestPersonalFieldValidator, "ConsentRequestPersonalFieldValidator"),
+      ConsentRequestValidator: /* @__PURE__ */ __name(() => ConsentRequestValidator, "ConsentRequestValidator"),
+      ConsentRequestWalletCategoryValidator: /* @__PURE__ */ __name(() => ConsentRequestWalletCategoryValidator, "ConsentRequestWalletCategoryValidator"),
       ContactMethodCreateValidator: /* @__PURE__ */ __name(() => ContactMethodCreateValidator, "ContactMethodCreateValidator"),
       ContactMethodQueryValidator: /* @__PURE__ */ __name(() => ContactMethodQueryValidator, "ContactMethodQueryValidator"),
       ContactMethodValidator: /* @__PURE__ */ __name(() => ContactMethodValidator, "ContactMethodValidator"),
@@ -129,6 +146,7 @@ var require_types_cjs_development = __commonJS({
       ContactMethodVerificationValidator: /* @__PURE__ */ __name(() => ContactMethodVerificationValidator, "ContactMethodVerificationValidator"),
       ContextValidator: /* @__PURE__ */ __name(() => ContextValidator, "ContextValidator"),
       ContractCredentialValidator: /* @__PURE__ */ __name(() => ContractCredentialValidator, "ContractCredentialValidator"),
+      ContractRequestFieldsValidator: /* @__PURE__ */ __name(() => ContractRequestFieldsValidator, "ContractRequestFieldsValidator"),
       CountSkillsInputValidator: /* @__PURE__ */ __name(() => CountSkillsInputValidator, "CountSkillsInputValidator"),
       CountSkillsResultValidator: /* @__PURE__ */ __name(() => CountSkillsResultValidator, "CountSkillsResultValidator"),
       CreateContactMethodSessionResponseValidator: /* @__PURE__ */ __name(() => CreateContactMethodSessionResponseValidator, "CreateContactMethodSessionResponseValidator"),
@@ -164,6 +182,8 @@ var require_types_cjs_development = __commonJS({
       CriteriaValidator: /* @__PURE__ */ __name(() => CriteriaValidator, "CriteriaValidator"),
       DEFAULT_BITSTRING_STATUS_LIST_SIZE: /* @__PURE__ */ __name(() => DEFAULT_BITSTRING_STATUS_LIST_SIZE, "DEFAULT_BITSTRING_STATUS_LIST_SIZE"),
       DeleteFrameworkInputValidator: /* @__PURE__ */ __name(() => DeleteFrameworkInputValidator, "DeleteFrameworkInputValidator"),
+      DeleteShareLinkAttachmentChunksInputValidator: /* @__PURE__ */ __name(() => DeleteShareLinkAttachmentChunksInputValidator, "DeleteShareLinkAttachmentChunksInputValidator"),
+      DeleteShareLinkAttachmentChunksOutputValidator: /* @__PURE__ */ __name(() => DeleteShareLinkAttachmentChunksOutputValidator, "DeleteShareLinkAttachmentChunksOutputValidator"),
       DeleteSkillInputValidator: /* @__PURE__ */ __name(() => DeleteSkillInputValidator, "DeleteSkillInputValidator"),
       DidDocumentValidator: /* @__PURE__ */ __name(() => DidDocumentValidator, "DidDocumentValidator"),
       EMPTY_IN_APP_MESSAGES_FLAG: /* @__PURE__ */ __name(() => EMPTY_IN_APP_MESSAGES_FLAG, "EMPTY_IN_APP_MESSAGES_FLAG"),
@@ -186,6 +206,7 @@ var require_types_cjs_development = __commonJS({
       GetCredentialRefreshHistoryResultValidator: /* @__PURE__ */ __name(() => GetCredentialRefreshHistoryResultValidator, "GetCredentialRefreshHistoryResultValidator"),
       GetFullSkillTreeInputValidator: /* @__PURE__ */ __name(() => GetFullSkillTreeInputValidator, "GetFullSkillTreeInputValidator"),
       GetFullSkillTreeResultValidator: /* @__PURE__ */ __name(() => GetFullSkillTreeResultValidator, "GetFullSkillTreeResultValidator"),
+      GetShareLinkAttachmentChunkInputValidator: /* @__PURE__ */ __name(() => GetShareLinkAttachmentChunkInputValidator, "GetShareLinkAttachmentChunkInputValidator"),
       GetSkillPathInputValidator: /* @__PURE__ */ __name(() => GetSkillPathInputValidator, "GetSkillPathInputValidator"),
       GetSkillPathResultValidator: /* @__PURE__ */ __name(() => GetSkillPathResultValidator, "GetSkillPathResultValidator"),
       GetTemplateRecipientsEventValidator: /* @__PURE__ */ __name(() => GetTemplateRecipientsEventValidator, "GetTemplateRecipientsEventValidator"),
@@ -203,6 +224,12 @@ var require_types_cjs_development = __commonJS({
       InboxCredentialRefreshReceiptValidator: /* @__PURE__ */ __name(() => InboxCredentialRefreshReceiptValidator, "InboxCredentialRefreshReceiptValidator"),
       InboxCredentialValidator: /* @__PURE__ */ __name(() => InboxCredentialValidator, "InboxCredentialValidator"),
       IncrementCounterEventValidator: /* @__PURE__ */ __name(() => IncrementCounterEventValidator, "IncrementCounterEventValidator"),
+      InlineAlignmentValidator: /* @__PURE__ */ __name(() => InlineAlignmentValidator, "InlineAlignmentValidator"),
+      InlineCredentialTemplateValidator: /* @__PURE__ */ __name(() => InlineCredentialTemplateValidator, "InlineCredentialTemplateValidator"),
+      InlineEvidenceValidator: /* @__PURE__ */ __name(() => InlineEvidenceValidator, "InlineEvidenceValidator"),
+      InlineSendCredentialEventValidator: /* @__PURE__ */ __name(() => InlineSendCredentialEventValidator, "InlineSendCredentialEventValidator"),
+      InlineWalletCategoryValidator: /* @__PURE__ */ __name(() => InlineWalletCategoryValidator, "InlineWalletCategoryValidator"),
+      InlineWalletSkillTagValidator: /* @__PURE__ */ __name(() => InlineWalletSkillTagValidator, "InlineWalletSkillTagValidator"),
       InstalledAppValidator: /* @__PURE__ */ __name(() => InstalledAppValidator, "InstalledAppValidator"),
       IssueInboxCredentialBatchItemResultValidator: /* @__PURE__ */ __name(() => IssueInboxCredentialBatchItemResultValidator, "IssueInboxCredentialBatchItemResultValidator"),
       IssueInboxCredentialBatchItemValidator: /* @__PURE__ */ __name(() => IssueInboxCredentialBatchItemValidator, "IssueInboxCredentialBatchItemValidator"),
@@ -255,6 +282,7 @@ var require_types_cjs_development = __commonJS({
       LCNVisibleProfileValidator: /* @__PURE__ */ __name(() => LCNVisibleProfileValidator, "LCNVisibleProfileValidator"),
       LaunchTypeValidator: /* @__PURE__ */ __name(() => LaunchTypeValidator, "LaunchTypeValidator"),
       LearnCardRefreshAuthorizationValidator: /* @__PURE__ */ __name(() => LearnCardRefreshAuthorizationValidator, "LearnCardRefreshAuthorizationValidator"),
+      LegacySendCredentialEventValidator: /* @__PURE__ */ __name(() => LegacySendCredentialEventValidator, "LegacySendCredentialEventValidator"),
       LinkProviderFrameworkInputValidator: /* @__PURE__ */ __name(() => LinkProviderFrameworkInputValidator, "LinkProviderFrameworkInputValidator"),
       ListShareLinksInputValidator: /* @__PURE__ */ __name(() => ListShareLinksInputValidator, "ListShareLinksInputValidator"),
       MAX_ENDORSEMENTS: /* @__PURE__ */ __name(() => MAX_ENDORSEMENTS, "MAX_ENDORSEMENTS"),
@@ -266,6 +294,7 @@ var require_types_cjs_development = __commonJS({
       MAX_VP_MEMBERS: /* @__PURE__ */ __name(() => MAX_VP_MEMBERS, "MAX_VP_MEMBERS"),
       ManagedCredentialRefreshReceiptValidator: /* @__PURE__ */ __name(() => ManagedCredentialRefreshReceiptValidator, "ManagedCredentialRefreshReceiptValidator"),
       ManagedCredentialRefreshServiceValidator: /* @__PURE__ */ __name(() => ManagedCredentialRefreshServiceValidator, "ManagedCredentialRefreshServiceValidator"),
+      NormalizedConsentScopesValidator: /* @__PURE__ */ __name(() => NormalizedConsentScopesValidator, "NormalizedConsentScopesValidator"),
       PaginatedAppStoreListingsValidator: /* @__PURE__ */ __name(() => PaginatedAppStoreListingsValidator, "PaginatedAppStoreListingsValidator"),
       PaginatedBoostRecipientsValidator: /* @__PURE__ */ __name(() => PaginatedBoostRecipientsValidator, "PaginatedBoostRecipientsValidator"),
       PaginatedBoostRecipientsWithChildrenValidator: /* @__PURE__ */ __name(() => PaginatedBoostRecipientsWithChildrenValidator, "PaginatedBoostRecipientsWithChildrenValidator"),
@@ -292,6 +321,8 @@ var require_types_cjs_development = __commonJS({
       PaginatedVisibleLCNProfilesValidator: /* @__PURE__ */ __name(() => PaginatedVisibleLCNProfilesValidator, "PaginatedVisibleLCNProfilesValidator"),
       PaginationOptionsValidator: /* @__PURE__ */ __name(() => PaginationOptionsValidator, "PaginationOptionsValidator"),
       PaginationResponseValidator: /* @__PURE__ */ __name(() => PaginationResponseValidator, "PaginationResponseValidator"),
+      PendingListingUpdateStatusValidator: /* @__PURE__ */ __name(() => PendingListingUpdateStatusValidator, "PendingListingUpdateStatusValidator"),
+      PendingListingUpdateValidator: /* @__PURE__ */ __name(() => PendingListingUpdateValidator, "PendingListingUpdateValidator"),
       PrepareRefreshableSendInputValidator: /* @__PURE__ */ __name(() => PrepareRefreshableSendInputValidator, "PrepareRefreshableSendInputValidator"),
       PrepareRefreshableSendResultValidator: /* @__PURE__ */ __name(() => PrepareRefreshableSendResultValidator, "PrepareRefreshableSendResultValidator"),
       ProfileValidator: /* @__PURE__ */ __name(() => ProfileValidator, "ProfileValidator"),
@@ -304,6 +335,9 @@ var require_types_cjs_development = __commonJS({
       PublishCredentialRefreshResultValidator: /* @__PURE__ */ __name(() => PublishCredentialRefreshResultValidator, "PublishCredentialRefreshResultValidator"),
       PublishIssuerSignedRefreshValidator: /* @__PURE__ */ __name(() => PublishIssuerSignedRefreshValidator, "PublishIssuerSignedRefreshValidator"),
       PublishSigningAuthorityRefreshValidator: /* @__PURE__ */ __name(() => PublishSigningAuthorityRefreshValidator, "PublishSigningAuthorityRefreshValidator"),
+      PutShareLinkAttachmentChunkInputValidator: /* @__PURE__ */ __name(() => PutShareLinkAttachmentChunkInputValidator, "PutShareLinkAttachmentChunkInputValidator"),
+      PutShareLinkAttachmentChunkOutputValidator: /* @__PURE__ */ __name(() => PutShareLinkAttachmentChunkOutputValidator, "PutShareLinkAttachmentChunkOutputValidator"),
+      RawInlineCredentialTemplateValidator: /* @__PURE__ */ __name(() => RawInlineCredentialTemplateValidator, "RawInlineCredentialTemplateValidator"),
       RefreshServiceValidator: /* @__PURE__ */ __name(() => RefreshServiceValidator, "RefreshServiceValidator"),
       RegExpValidator: /* @__PURE__ */ __name(() => RegExpValidator, "RegExpValidator"),
       RelatedValidator: /* @__PURE__ */ __name(() => RelatedValidator, "RelatedValidator"),
@@ -330,6 +364,7 @@ var require_types_cjs_development = __commonJS({
       SendBoostResponseValidator: /* @__PURE__ */ __name(() => SendBoostResponseValidator, "SendBoostResponseValidator"),
       SendBoostTemplateValidator: /* @__PURE__ */ __name(() => SendBoostTemplateValidator, "SendBoostTemplateValidator"),
       SendBrandingOptionsValidator: /* @__PURE__ */ __name(() => SendBrandingOptionsValidator, "SendBrandingOptionsValidator"),
+      SendContractRequestValidator: /* @__PURE__ */ __name(() => SendContractRequestValidator, "SendContractRequestValidator"),
       SendCredentialEventValidator: /* @__PURE__ */ __name(() => SendCredentialEventValidator, "SendCredentialEventValidator"),
       SendInboxResponseValidator: /* @__PURE__ */ __name(() => SendInboxResponseValidator, "SendInboxResponseValidator"),
       SendInputValidator: /* @__PURE__ */ __name(() => SendInputValidator, "SendInputValidator"),
@@ -345,6 +380,9 @@ var require_types_cjs_development = __commonJS({
       ShareEndorsementEntryValidator: /* @__PURE__ */ __name(() => ShareEndorsementEntryValidator, "ShareEndorsementEntryValidator"),
       ShareEnvelopeValidator: /* @__PURE__ */ __name(() => ShareEnvelopeValidator, "ShareEnvelopeValidator"),
       ShareIvValidator: /* @__PURE__ */ __name(() => ShareIvValidator, "ShareIvValidator"),
+      ShareLinkAttachmentChunkEnvelopeValidator: /* @__PURE__ */ __name(() => ShareLinkAttachmentChunkEnvelopeValidator, "ShareLinkAttachmentChunkEnvelopeValidator"),
+      ShareLinkAttachmentChunkOutputValidator: /* @__PURE__ */ __name(() => ShareLinkAttachmentChunkOutputValidator, "ShareLinkAttachmentChunkOutputValidator"),
+      ShareLinkAttachmentValidator: /* @__PURE__ */ __name(() => ShareLinkAttachmentValidator, "ShareLinkAttachmentValidator"),
       ShareLinkIdInputValidator: /* @__PURE__ */ __name(() => ShareLinkIdInputValidator, "ShareLinkIdInputValidator"),
       ShareLinkIdValidator: /* @__PURE__ */ __name(() => ShareLinkIdValidator, "ShareLinkIdValidator"),
       ShareLinkOperationKeyInputValidator: /* @__PURE__ */ __name(() => ShareLinkOperationKeyInputValidator, "ShareLinkOperationKeyInputValidator"),
@@ -365,6 +403,7 @@ var require_types_cjs_development = __commonJS({
       ShareRecoverySelectionValidator: /* @__PURE__ */ __name(() => ShareRecoverySelectionValidator, "ShareRecoverySelectionValidator"),
       ShareSelectionEntryValidator: /* @__PURE__ */ __name(() => ShareSelectionEntryValidator, "ShareSelectionEntryValidator"),
       ShareSharerValidator: /* @__PURE__ */ __name(() => ShareSharerValidator, "ShareSharerValidator"),
+      SimpleInlineCredentialTemplateValidator: /* @__PURE__ */ __name(() => SimpleInlineCredentialTemplateValidator, "SimpleInlineCredentialTemplateValidator"),
       SkillDeletionStrategyValidator: /* @__PURE__ */ __name(() => SkillDeletionStrategyValidator, "SkillDeletionStrategyValidator"),
       SkillFrameworkAdminInputValidator: /* @__PURE__ */ __name(() => SkillFrameworkAdminInputValidator, "SkillFrameworkAdminInputValidator"),
       SkillFrameworkAdminsValidator: /* @__PURE__ */ __name(() => SkillFrameworkAdminsValidator, "SkillFrameworkAdminsValidator"),
@@ -395,9 +434,12 @@ var require_types_cjs_development = __commonJS({
       UnsignedClrCredentialValidator: /* @__PURE__ */ __name(() => UnsignedClrCredentialValidator, "UnsignedClrCredentialValidator"),
       UnsignedVCValidator: /* @__PURE__ */ __name(() => UnsignedVCValidator, "UnsignedVCValidator"),
       UnsignedVPValidator: /* @__PURE__ */ __name(() => UnsignedVPValidator, "UnsignedVPValidator"),
+      UnsupportedSignInOperationError: /* @__PURE__ */ __name(() => UnsupportedSignInOperationError, "UnsupportedSignInOperationError"),
       UpdateFrameworkInputValidator: /* @__PURE__ */ __name(() => UpdateFrameworkInputValidator, "UpdateFrameworkInputValidator"),
       UpdateShareLinkInputValidator: /* @__PURE__ */ __name(() => UpdateShareLinkInputValidator, "UpdateShareLinkInputValidator"),
       UpdateSkillInputValidator: /* @__PURE__ */ __name(() => UpdateSkillInputValidator, "UpdateSkillInputValidator"),
+      UpsertConsentContractEventValidator: /* @__PURE__ */ __name(() => UpsertConsentContractEventValidator, "UpsertConsentContractEventValidator"),
+      UpsertConsentContractResponseValidator: /* @__PURE__ */ __name(() => UpsertConsentContractResponseValidator, "UpsertConsentContractResponseValidator"),
       VC2EvidenceValidator: /* @__PURE__ */ __name(() => VC2EvidenceValidator, "VC2EvidenceValidator"),
       VCValidator: /* @__PURE__ */ __name(() => VCValidator, "VCValidator"),
       VPValidator: /* @__PURE__ */ __name(() => VPValidator, "VPValidator"),
@@ -543,14 +585,14 @@ var require_types_cjs_development = __commonJS({
       cuid2: /* @__PURE__ */ __name(() => cuid22, "cuid2"),
       custom: /* @__PURE__ */ __name(() => custom, "custom"),
       date: /* @__PURE__ */ __name(() => date3, "date"),
-      decode: /* @__PURE__ */ __name(() => decode2, "decode"),
+      decode: /* @__PURE__ */ __name(() => decode22, "decode"),
       decodeAsync: /* @__PURE__ */ __name(() => decodeAsync2, "decodeAsync"),
       describe: /* @__PURE__ */ __name(() => describe2, "describe"),
       discriminatedUnion: /* @__PURE__ */ __name(() => discriminatedUnion, "discriminatedUnion"),
       e164: /* @__PURE__ */ __name(() => e1642, "e164"),
       email: /* @__PURE__ */ __name(() => email2, "email"),
       emoji: /* @__PURE__ */ __name(() => emoji2, "emoji"),
-      encode: /* @__PURE__ */ __name(() => encode2, "encode"),
+      encode: /* @__PURE__ */ __name(() => encode22, "encode"),
       encodeAsync: /* @__PURE__ */ __name(() => encodeAsync2, "encodeAsync"),
       endsWith: /* @__PURE__ */ __name(() => _endsWith, "endsWith"),
       enum: /* @__PURE__ */ __name(() => _enum2, "enum"),
@@ -568,7 +610,7 @@ var require_types_cjs_development = __commonJS({
       gte: /* @__PURE__ */ __name(() => _gte, "gte"),
       guid: /* @__PURE__ */ __name(() => guid2, "guid"),
       hash: /* @__PURE__ */ __name(() => hash, "hash"),
-      hex: /* @__PURE__ */ __name(() => hex2, "hex"),
+      hex: /* @__PURE__ */ __name(() => hex22, "hex"),
       hostname: /* @__PURE__ */ __name(() => hostname2, "hostname"),
       httpUrl: /* @__PURE__ */ __name(() => httpUrl, "httpUrl"),
       includes: /* @__PURE__ */ __name(() => _includes, "includes"),
@@ -595,7 +637,7 @@ var require_types_cjs_development = __commonJS({
       lt: /* @__PURE__ */ __name(() => _lt, "lt"),
       lte: /* @__PURE__ */ __name(() => _lte, "lte"),
       mac: /* @__PURE__ */ __name(() => mac2, "mac"),
-      map: /* @__PURE__ */ __name(() => map, "map"),
+      map: /* @__PURE__ */ __name(() => map2, "map"),
       maxLength: /* @__PURE__ */ __name(() => _maxLength, "maxLength"),
       maxSize: /* @__PURE__ */ __name(() => _maxSize, "maxSize"),
       meta: /* @__PURE__ */ __name(() => meta2, "meta"),
@@ -920,10 +962,10 @@ var require_types_cjs_development = __commonJS({
       config: /* @__PURE__ */ __name(() => config, "config"),
       createStandardJSONSchemaMethod: /* @__PURE__ */ __name(() => createStandardJSONSchemaMethod, "createStandardJSONSchemaMethod"),
       createToJSONSchemaMethod: /* @__PURE__ */ __name(() => createToJSONSchemaMethod, "createToJSONSchemaMethod"),
-      decode: /* @__PURE__ */ __name(() => decode, "decode"),
+      decode: /* @__PURE__ */ __name(() => decode2, "decode"),
       decodeAsync: /* @__PURE__ */ __name(() => decodeAsync, "decodeAsync"),
       describe: /* @__PURE__ */ __name(() => describe, "describe"),
-      encode: /* @__PURE__ */ __name(() => encode, "encode"),
+      encode: /* @__PURE__ */ __name(() => encode2, "encode"),
       encodeAsync: /* @__PURE__ */ __name(() => encodeAsync, "encodeAsync"),
       extractDefs: /* @__PURE__ */ __name(() => extractDefs, "extractDefs"),
       finalize: /* @__PURE__ */ __name(() => finalize, "finalize"),
@@ -1809,18 +1851,18 @@ var require_types_cjs_development = __commonJS({
     __name2(cleanEnum, "cleanEnum");
     function base64ToUint8Array(base643) {
       const binaryString = atob(base643);
-      const bytes = new Uint8Array(binaryString.length);
+      const bytes2 = new Uint8Array(binaryString.length);
       for (let i = 0; i < binaryString.length; i++) {
-        bytes[i] = binaryString.charCodeAt(i);
+        bytes2[i] = binaryString.charCodeAt(i);
       }
-      return bytes;
+      return bytes2;
     }
     __name(base64ToUint8Array, "base64ToUint8Array");
     __name2(base64ToUint8Array, "base64ToUint8Array");
-    function uint8ArrayToBase64(bytes) {
+    function uint8ArrayToBase64(bytes2) {
       let binaryString = "";
-      for (let i = 0; i < bytes.length; i++) {
-        binaryString += String.fromCharCode(bytes[i]);
+      for (let i = 0; i < bytes2.length; i++) {
+        binaryString += String.fromCharCode(bytes2[i]);
       }
       return btoa(binaryString);
     }
@@ -1833,8 +1875,8 @@ var require_types_cjs_development = __commonJS({
     }
     __name(base64urlToUint8Array, "base64urlToUint8Array");
     __name2(base64urlToUint8Array, "base64urlToUint8Array");
-    function uint8ArrayToBase64url(bytes) {
-      return uint8ArrayToBase64(bytes).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+    function uint8ArrayToBase64url(bytes2) {
+      return uint8ArrayToBase64(bytes2).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
     }
     __name(uint8ArrayToBase64url, "uint8ArrayToBase64url");
     __name2(uint8ArrayToBase64url, "uint8ArrayToBase64url");
@@ -1843,16 +1885,16 @@ var require_types_cjs_development = __commonJS({
       if (cleanHex.length % 2 !== 0) {
         throw new Error("Invalid hex string length");
       }
-      const bytes = new Uint8Array(cleanHex.length / 2);
+      const bytes2 = new Uint8Array(cleanHex.length / 2);
       for (let i = 0; i < cleanHex.length; i += 2) {
-        bytes[i / 2] = Number.parseInt(cleanHex.slice(i, i + 2), 16);
+        bytes2[i / 2] = Number.parseInt(cleanHex.slice(i, i + 2), 16);
       }
-      return bytes;
+      return bytes2;
     }
     __name(hexToUint8Array, "hexToUint8Array");
     __name2(hexToUint8Array, "hexToUint8Array");
-    function uint8ArrayToHex(bytes) {
-      return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+    function uint8ArrayToHex(bytes2) {
+      return Array.from(bytes2).map((b) => b.toString(16).padStart(2, "0")).join("");
     }
     __name(uint8ArrayToHex, "uint8ArrayToHex");
     __name2(uint8ArrayToHex, "uint8ArrayToHex");
@@ -2067,11 +2109,11 @@ var require_types_cjs_development = __commonJS({
       const ctx = _ctx ? { ..._ctx, direction: "backward" } : { direction: "backward" };
       return _parse(_Err)(schema, value, ctx);
     }, "_encode");
-    var encode = /* @__PURE__ */ _encode($ZodRealError);
+    var encode2 = /* @__PURE__ */ _encode($ZodRealError);
     var _decode = /* @__PURE__ */ __name2((_Err) => (schema, value, _ctx) => {
       return _parse(_Err)(schema, value, _ctx);
     }, "_decode");
-    var decode = /* @__PURE__ */ _decode($ZodRealError);
+    var decode2 = /* @__PURE__ */ _decode($ZodRealError);
     var _encodeAsync = /* @__PURE__ */ __name2((_Err) => async (schema, value, _ctx) => {
       const ctx = _ctx ? { ..._ctx, direction: "backward" } : { direction: "backward" };
       return _parseAsync(_Err)(schema, value, ctx);
@@ -2119,7 +2161,7 @@ var require_types_cjs_development = __commonJS({
       emoji: /* @__PURE__ */ __name(() => emoji, "emoji"),
       extendedDuration: /* @__PURE__ */ __name(() => extendedDuration, "extendedDuration"),
       guid: /* @__PURE__ */ __name(() => guid, "guid"),
-      hex: /* @__PURE__ */ __name(() => hex, "hex"),
+      hex: /* @__PURE__ */ __name(() => hex2, "hex"),
       hostname: /* @__PURE__ */ __name(() => hostname, "hostname"),
       html5Email: /* @__PURE__ */ __name(() => html5Email, "html5Email"),
       httpProtocol: /* @__PURE__ */ __name(() => httpProtocol, "httpProtocol"),
@@ -2242,7 +2284,7 @@ var require_types_cjs_development = __commonJS({
     var _undefined = /^undefined$/i;
     var lowercase = /^[^A-Z]*$/;
     var uppercase = /^[^a-z]*$/;
-    var hex = /^[0-9a-fA-F]*$/;
+    var hex2 = /^[0-9a-fA-F]*$/;
     function fixedBase64(bodyLength, padding) {
       return new RegExp(`^[A-Za-z0-9+/]{${bodyLength}}${padding}$`);
     }
@@ -3946,19 +3988,19 @@ var require_types_cjs_development = __commonJS({
       });
       const disc = cached(() => {
         const opts = def.options;
-        const map2 = /* @__PURE__ */ new Map();
+        const map22 = /* @__PURE__ */ new Map();
         for (const o of opts) {
           const values = o._zod.propValues?.[def.discriminator];
           if (!values || values.size === 0)
             throw new Error(`Invalid discriminated union option at index "${def.options.indexOf(o)}"`);
           for (const v of values) {
-            if (map2.has(v)) {
+            if (map22.has(v)) {
               throw new Error(`Duplicate discriminator value "${String(v)}"`);
             }
-            map2.set(v, o);
+            map22.set(v, o);
           }
         }
-        return map2;
+        return map22;
       });
       inst._zod.parse = (payload, ctx) => {
         const input = payload.value;
@@ -13475,7 +13517,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       function: /* @__PURE__ */ __name(() => _function, "function"),
       guid: /* @__PURE__ */ __name(() => guid2, "guid"),
       hash: /* @__PURE__ */ __name(() => hash, "hash"),
-      hex: /* @__PURE__ */ __name(() => hex2, "hex"),
+      hex: /* @__PURE__ */ __name(() => hex22, "hex"),
       hostname: /* @__PURE__ */ __name(() => hostname2, "hostname"),
       httpUrl: /* @__PURE__ */ __name(() => httpUrl, "httpUrl"),
       instanceof: /* @__PURE__ */ __name(() => _instanceof, "instanceof"),
@@ -13495,7 +13537,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       looseObject: /* @__PURE__ */ __name(() => looseObject, "looseObject"),
       looseRecord: /* @__PURE__ */ __name(() => looseRecord, "looseRecord"),
       mac: /* @__PURE__ */ __name(() => mac2, "mac"),
-      map: /* @__PURE__ */ __name(() => map, "map"),
+      map: /* @__PURE__ */ __name(() => map2, "map"),
       meta: /* @__PURE__ */ __name(() => meta2, "meta"),
       nan: /* @__PURE__ */ __name(() => nan, "nan"),
       nanoid: /* @__PURE__ */ __name(() => nanoid2, "nanoid"),
@@ -13663,8 +13705,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
     var parseAsync2 = /* @__PURE__ */ _parseAsync(ZodRealError);
     var safeParse2 = /* @__PURE__ */ _safeParse(ZodRealError);
     var safeParseAsync2 = /* @__PURE__ */ _safeParseAsync(ZodRealError);
-    var encode2 = /* @__PURE__ */ _encode(ZodRealError);
-    var decode2 = /* @__PURE__ */ _decode(ZodRealError);
+    var encode22 = /* @__PURE__ */ _encode(ZodRealError);
+    var decode22 = /* @__PURE__ */ _decode(ZodRealError);
     var encodeAsync2 = /* @__PURE__ */ _encodeAsync(ZodRealError);
     var decodeAsync2 = /* @__PURE__ */ _decodeAsync(ZodRealError);
     var safeEncode2 = /* @__PURE__ */ _safeEncode(ZodRealError);
@@ -13727,8 +13769,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       inst.parseAsync = async (data, params) => parseAsync2(inst, data, params, { callee: inst.parseAsync });
       inst.safeParseAsync = async (data, params) => safeParseAsync2(inst, data, params);
       inst.spa = inst.safeParseAsync;
-      inst.encode = (data, params) => encode2(inst, data, params);
-      inst.decode = (data, params) => decode2(inst, data, params);
+      inst.encode = (data, params) => encode22(inst, data, params);
+      inst.decode = (data, params) => decode22(inst, data, params);
       inst.encodeAsync = async (data, params) => encodeAsync2(inst, data, params);
       inst.decodeAsync = async (data, params) => decodeAsync2(inst, data, params);
       inst.safeEncode = (data, params) => safeEncode2(inst, data, params);
@@ -14153,11 +14195,11 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
     }
     __name(hostname2, "hostname2");
     __name2(hostname2, "hostname");
-    function hex2(_params) {
+    function hex22(_params) {
       return /* @__PURE__ */ _stringFormat(ZodCustomStringFormat, "hex", regexes_exports.hex, _params);
     }
-    __name(hex2, "hex2");
-    __name2(hex2, "hex");
+    __name(hex22, "hex2");
+    __name2(hex22, "hex");
     function hash(alg, params) {
       const enc = params?.enc ?? "hex";
       const format = `${alg}_${enc}`;
@@ -14649,7 +14691,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       inst.max = (...args) => inst.check(/* @__PURE__ */ _maxSize(...args));
       inst.size = (...args) => inst.check(/* @__PURE__ */ _size(...args));
     });
-    function map(keyType, valueType, params) {
+    function map2(keyType, valueType, params) {
       return new ZodMap({
         type: "map",
         keyType,
@@ -14657,8 +14699,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
         ...util_exports.normalizeParams(params)
       });
     }
-    __name(map, "map");
-    __name2(map, "map");
+    __name(map2, "map");
+    __name2(map2, "map");
     var ZodSet = /* @__PURE__ */ $constructor("ZodSet", (inst, def) => {
       $ZodSet.init(inst, def);
       ZodType.init(inst, def);
@@ -15158,9 +15200,9 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       invalid_value: "invalid_value",
       custom: "custom"
     };
-    function setErrorMap(map2) {
+    function setErrorMap(map22) {
       config({
-        customError: map2
+        customError: map22
       });
     }
     __name(setErrorMap, "setErrorMap");
@@ -16118,7 +16160,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       "replacedBy"
     ]).or(external_exports.string());
     var AssociationValidator = external_exports.object({
-      type: external_exports.string().array().nonempty(),
+      // Accept compacted scalars while retaining the existing permissive array contract.
+      type: external_exports.string().min(1).or(external_exports.string().array().nonempty()),
       associationType: AssociationTypeValidator,
       sourceId: external_exports.string().optional(),
       targetId: external_exports.string()
@@ -16941,11 +16984,48 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       updatedAt: external_exports.string(),
       expiresAt: external_exports.string().optional(),
       autoBoosts: external_exports.string().array().optional(),
-      writers: external_exports.array(LCNProfileValidator).optional()
+      writers: external_exports.array(LCNProfileValidator).optional(),
+      recipients: external_exports.array(LCNPublicProfileValidator.extend({ did: external_exports.string() })).optional(),
+      audienceVersion: external_exports.number().int().nonnegative().optional()
     });
-    var ConsentFlowContractRequestStatusValidator = external_exports.enum(["pending", "accepted", "denied"]).nullable();
+    var ConsentFlowContractRequestStatusValidator = external_exports.enum(["pending", "accepted", "denied", "cancelled"]).nullable();
     var ConsentFlowContractRequestReadStatusValidator = external_exports.enum(["unseen", "seen"]).nullable();
-    var ConsentFlowContractRequestForProfileValidator = external_exports.object({
+    var ConsentFlowReferralValidator = external_exports.object({
+      requestId: external_exports.string(),
+      requestedBy: external_exports.string(),
+      externalReferenceId: external_exports.string().max(256).optional()
+    });
+    var ContractRequestFieldsValidator = ConsentFlowReferralValidator.partial().extend({
+      requestedAt: external_exports.string().optional(),
+      message: external_exports.string().max(500).optional()
+    });
+    var SendContractRequestValidator = external_exports.object({
+      contractUri: external_exports.string(),
+      targetProfileId: external_exports.string(),
+      externalReferenceId: external_exports.string().trim().min(1).max(256).optional(),
+      message: external_exports.string().trim().max(500).optional()
+    });
+    var ConsentFlowWebhookMetadataValidator = external_exports.object({
+      eventId: external_exports.string(),
+      deliveryKey: external_exports.string(),
+      event: external_exports.enum([
+        "request_sent",
+        "request_accepted",
+        "request_denied",
+        "request_cancelled",
+        "consent_created",
+        "consent_updated",
+        "consent_withdrawn",
+        "credentials_synced"
+      ]),
+      contractUri: external_exports.string(),
+      termsUri: external_exports.string().optional(),
+      requestId: external_exports.string().optional(),
+      requestedBy: external_exports.string().optional(),
+      externalReferenceId: external_exports.string().optional(),
+      recipientRole: external_exports.enum(["owner", "recipient", "requester", "target"])
+    });
+    var ConsentFlowContractRequestForProfileValidator = ContractRequestFieldsValidator.extend({
       profile: LCNProfileValidator,
       status: ConsentFlowContractRequestStatusValidator,
       readStatus: ConsentFlowContractRequestReadStatusValidator.optional()
@@ -16991,6 +17071,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
         expiresAt: external_exports.string().optional(),
         oneTime: external_exports.boolean().optional(),
         terms: ConsentFlowTermsValidator,
+        referral: ConsentFlowReferralValidator.optional(),
         contract: ConsentFlowContractDetailsValidator,
         uri: external_exports.string(),
         consenter: LCNProfileValidator,
@@ -17086,6 +17167,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       oneTime: external_exports.boolean().optional(),
       terms: ConsentFlowTermsValidator.optional(),
       guardianApproval: ConsentFlowGuardianApprovalValidator.optional(),
+      referral: ConsentFlowReferralValidator.optional(),
       id: external_exports.string(),
       action: ConsentFlowTransactionActionValidator,
       date: external_exports.string(),
@@ -17096,6 +17178,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       status: ConsentFlowTermsStatusValidator,
       contract: ConsentFlowContractDetailsValidator,
       terms: ConsentFlowTermsValidator,
+      referral: ConsentFlowReferralValidator.optional(),
       transactions: ConsentFlowTransactionValidator.array()
     });
     var HolderExportMetadataValidator = external_exports.object({
@@ -17832,7 +17915,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       displayName: external_exports.string(),
       email: external_exports.string().optional()
     });
-    var AppStoreListingValidator = external_exports.object({
+    var AppStoreListingFieldsValidator = external_exports.object({
       listing_id: external_exports.string(),
       slug: external_exports.string().optional(),
       display_name: external_exports.string(),
@@ -17858,15 +17941,33 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       submitter: AppStoreListingSubmitterValidator.optional(),
       contact_email: external_exports.string().email().optional()
     });
+    var PendingListingUpdateStatusValidator = external_exports.enum(["DRAFT", "PENDING_REVIEW"]);
+    var PendingListingUpdateValidator = external_exports.object({
+      status: PendingListingUpdateStatusValidator,
+      submitted_at: external_exports.string().optional(),
+      changes: AppStoreListingFieldsValidator.omit({
+        listing_id: true,
+        app_listing_status: true,
+        promotion_level: true,
+        submitted_at: true,
+        submitter: true
+      }).partial(),
+      manifest_version: external_exports.number().int().min(1).optional()
+    });
+    var AppStoreListingValidator = AppStoreListingFieldsValidator.extend({
+      pending_update: PendingListingUpdateValidator.optional()
+    });
     var AppStoreListingCreateValidator = AppStoreListingValidator.omit({
       listing_id: true,
       app_listing_status: true,
-      promotion_level: true
+      promotion_level: true,
+      pending_update: true
     });
     var AppStoreListingUpdateValidator = AppStoreListingValidator.partial().omit({
       listing_id: true,
       app_listing_status: true,
-      promotion_level: true
+      promotion_level: true,
+      pending_update: true
     });
     var InstalledAppValidator = AppStoreListingValidator.extend({
       installed_at: external_exports.string()
@@ -17881,12 +17982,87 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       templateAlias: external_exports.string().min(1).max(50).regex(/^[a-z0-9-]+$/),
       boostUri: external_exports.string()
     });
-    var SendCredentialEventValidator = external_exports.object({
+    var InlineWalletCategoryValidator = external_exports.enum([
+      "Achievement",
+      "Skill",
+      "ID",
+      "Learning History",
+      "Work History",
+      "Social Badges",
+      "Membership",
+      "Accomplishment",
+      "Experiences",
+      "Accommodation",
+      "Family"
+    ]);
+    var InlineAlignmentValidator = external_exports.object({
+      name: external_exports.string(),
+      url: external_exports.string(),
+      framework: external_exports.string().optional(),
+      code: external_exports.string().optional()
+    }).passthrough();
+    var InlineEvidenceValidator = external_exports.object({
+      id: external_exports.string().optional(),
+      name: external_exports.string().optional(),
+      narrative: external_exports.string().optional()
+    }).passthrough();
+    var InlineWalletSkillTagValidator = external_exports.object({
+      frameworkId: external_exports.string(),
+      id: external_exports.string(),
+      proficiencyLevel: external_exports.string().optional()
+    }).passthrough();
+    var SimpleInlineCredentialTemplateValidator = external_exports.object({
+      rawCredential: external_exports.undefined().optional(),
+      name: external_exports.string(),
+      description: external_exports.string().optional(),
+      image: external_exports.string().optional(),
+      issuerName: external_exports.string().optional(),
+      achievementType: external_exports.string().optional(),
+      category: InlineWalletCategoryValidator.optional(),
+      criteria: external_exports.object({
+        narrative: external_exports.string().optional(),
+        url: external_exports.string().optional()
+      }).passthrough().optional(),
+      alignments: external_exports.array(InlineAlignmentValidator).optional(),
+      tags: external_exports.array(external_exports.string()).optional(),
+      activity: external_exports.object({
+        startDate: external_exports.string().optional(),
+        endDate: external_exports.string().optional()
+      }).passthrough().optional(),
+      credits: external_exports.object({
+        earned: external_exports.union([external_exports.number(), external_exports.string()]).optional(),
+        available: external_exports.union([external_exports.number(), external_exports.string()]).optional()
+      }).passthrough().optional(),
+      validUntil: external_exports.string().optional(),
+      evidence: external_exports.array(InlineEvidenceValidator).optional(),
+      walletSkills: external_exports.array(InlineWalletSkillTagValidator).optional()
+    }).passthrough();
+    var RawInlineCredentialTemplateValidator = external_exports.object({
+      rawCredential: external_exports.record(external_exports.string(), external_exports.unknown()),
+      category: InlineWalletCategoryValidator.optional(),
+      walletSkills: external_exports.array(InlineWalletSkillTagValidator).optional()
+    }).passthrough();
+    var InlineCredentialTemplateValidator = external_exports.union([
+      RawInlineCredentialTemplateValidator,
+      SimpleInlineCredentialTemplateValidator
+    ]);
+    var LegacySendCredentialEventValidator = external_exports.object({
       type: external_exports.literal("send-credential"),
       templateAlias: external_exports.string(),
       templateData: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
       preventDuplicateClaim: external_exports.boolean().optional()
     });
+    var InlineSendCredentialEventValidator = external_exports.object({
+      type: external_exports.literal("send-credential"),
+      alias: external_exports.string(),
+      template: InlineCredentialTemplateValidator,
+      templateData: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
+      preventDuplicateClaim: external_exports.boolean().optional()
+    });
+    var SendCredentialEventValidator = external_exports.union([
+      LegacySendCredentialEventValidator,
+      InlineSendCredentialEventValidator
+    ]);
     var CheckCredentialEventValidator = external_exports.object({
       type: external_exports.literal("check-credential"),
       templateAlias: external_exports.string().optional(),
@@ -17981,7 +18157,119 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       type: external_exports.literal("get-counters"),
       keys: external_exports.array(counterKeyValidator).min(1).max(50).optional()
     });
-    var AppEventValidator = external_exports.discriminatedUnion("type", [
+    var ConsentRequestWalletCategoryValidator = external_exports.enum([
+      "Achievement",
+      "Skill",
+      "ID",
+      "Learning History",
+      "Work History",
+      "Social Badges",
+      "Membership",
+      "Accomplishment",
+      "Experiences",
+      "Accommodation",
+      "Family"
+    ]);
+    var ConsentRequestPersonalFieldValidator = external_exports.enum([
+      "name",
+      "email",
+      "phone",
+      "birthDate",
+      "country",
+      "avatar"
+    ]);
+    var ConsentRequestValidator = external_exports.object({
+      read: external_exports.object({
+        credentialCategories: external_exports.array(ConsentRequestWalletCategoryValidator).optional(),
+        personalFields: external_exports.array(ConsentRequestPersonalFieldValidator).optional()
+      }).optional(),
+      write: external_exports.object({
+        credentialCategories: external_exports.array(ConsentRequestWalletCategoryValidator).optional()
+      }).optional(),
+      reason: external_exports.string().optional()
+    });
+    var NormalizedConsentScopesValidator = external_exports.object({
+      read: external_exports.object({
+        credentialCategories: external_exports.array(ConsentRequestWalletCategoryValidator).default([]),
+        personalFields: external_exports.array(ConsentRequestPersonalFieldValidator).default([])
+      }),
+      write: external_exports.object({
+        credentialCategories: external_exports.array(ConsentRequestWalletCategoryValidator).default([])
+      })
+    });
+    var CapturedTemplateRecordValidator = external_exports.object({
+      alias: external_exports.string(),
+      template: InlineCredentialTemplateValidator,
+      version: external_exports.number().int().min(1),
+      lastUsedAt: external_exports.string()
+    }).passthrough();
+    var CapturedConsentRecordValidator = external_exports.object({
+      scopes: NormalizedConsentScopesValidator,
+      reason: external_exports.string().optional(),
+      lastUsedAt: external_exports.string()
+    }).passthrough();
+    var AppManifestValidator = external_exports.object({
+      manifestVersion: external_exports.literal(1),
+      appUrl: external_exports.string(),
+      appKey: external_exports.string().max(200).optional(),
+      suggestedName: external_exports.string().optional(),
+      suggestedIconUrl: external_exports.string().optional(),
+      permissions: external_exports.array(external_exports.string()).default([]),
+      templates: external_exports.array(CapturedTemplateRecordValidator).default([]),
+      consentRequests: external_exports.array(CapturedConsentRecordValidator).default([]),
+      usedConsentContract: external_exports.boolean().optional(),
+      featuresLaunched: external_exports.array(external_exports.string()).default([]),
+      counterKeys: external_exports.array(external_exports.string()).default([]),
+      usedLearnerContext: external_exports.boolean(),
+      usedNotifications: external_exports.boolean(),
+      firstCapturedAt: external_exports.string(),
+      lastUpdatedAt: external_exports.string()
+    }).passthrough();
+    var AppManifestVersionStatusValidator = external_exports.enum(["draft", "active", "superseded"]);
+    var AppManifestVersionValidator = external_exports.object({
+      id: external_exports.string(),
+      version: external_exports.number().int().min(1),
+      manifestHash: external_exports.string(),
+      manifest: AppManifestValidator,
+      status: AppManifestVersionStatusValidator,
+      createdAt: external_exports.string(),
+      activatedAt: external_exports.string().optional()
+    });
+    var AppManifestStringDiffValidator = external_exports.object({
+      added: external_exports.array(external_exports.string()),
+      removed: external_exports.array(external_exports.string()),
+      changed: external_exports.array(external_exports.string())
+    });
+    var AppManifestTemplateRefValidator = external_exports.object({
+      alias: external_exports.string(),
+      version: external_exports.number().int().min(1)
+    });
+    var AppManifestTemplateChangeValidator = external_exports.object({
+      alias: external_exports.string(),
+      fromVersion: external_exports.number().int().min(1),
+      toVersion: external_exports.number().int().min(1)
+    });
+    var AppManifestDiffValidator = external_exports.object({
+      permissions: AppManifestStringDiffValidator,
+      templates: external_exports.object({
+        added: external_exports.array(AppManifestTemplateRefValidator),
+        removed: external_exports.array(AppManifestTemplateRefValidator),
+        changed: external_exports.array(AppManifestTemplateChangeValidator)
+      }),
+      consentScopes: AppManifestStringDiffValidator,
+      featurePaths: AppManifestStringDiffValidator,
+      counterKeys: AppManifestStringDiffValidator,
+      requiresReview: external_exports.boolean()
+    });
+    var UpsertConsentContractEventValidator = external_exports.object({
+      type: external_exports.literal("upsert-consent-contract"),
+      scopes: ConsentRequestValidator
+    });
+    var UpsertConsentContractResponseValidator = external_exports.object({
+      contractUri: external_exports.string(),
+      created: external_exports.boolean()
+    });
+    var AppEventValidator = external_exports.union([
       SendCredentialEventValidator,
       CheckCredentialEventValidator,
       CheckIssuanceStatusEventValidator,
@@ -17991,7 +18279,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       SendNotificationEventValidator,
       IncrementCounterEventValidator,
       GetCounterEventValidator,
-      GetCountersEventValidator
+      GetCountersEventValidator,
+      UpsertConsentContractEventValidator
     ]);
     var AppEventInputValidator = external_exports.object({
       listingId: external_exports.string(),
@@ -18070,6 +18359,20 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
         __name2(this, "AuthSessionError");
       }
     };
+    var UnsupportedSignInOperationError = class extends Error {
+      static {
+        __name(this, "UnsupportedSignInOperationError");
+      }
+      constructor(operation, providerType) {
+        super(`${operation} is not supported by ${providerType}`);
+        this.operation = operation;
+        this.providerType = providerType;
+        this.name = "UnsupportedSignInOperationError";
+      }
+      static {
+        __name2(this, "UnsupportedSignInOperationError");
+      }
+    };
     var ESCROW_PIN_LOCKED_MESSAGE2 = "Too many incorrect PIN attempts. You can still recover by waiting.";
     var ESCROW_PIN_UNAVAILABLE_MESSAGE2 = "PIN recovery is not available for this account.";
     var ESCROW_PIN_MISMATCH_PATTERN2 = /^Incorrect PIN\. (\d+) attempts left\.$/;
@@ -18216,12 +18519,12 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       }
       return table;
     })();
-    var encodeBase64Url = /* @__PURE__ */ __name2((bytes) => {
+    var encodeBase64Url = /* @__PURE__ */ __name2((bytes2) => {
       let output = "";
-      for (let index = 0; index < bytes.length; index += 3) {
-        const first = bytes[index];
-        const second = bytes[index + 1];
-        const third = bytes[index + 2];
+      for (let index = 0; index < bytes2.length; index += 3) {
+        const first = bytes2[index];
+        const second = bytes2[index + 1];
+        const third = bytes2[index + 2];
         output += BASE64URL_ALPHABET[first >> 2];
         output += BASE64URL_ALPHABET[(first & 3) << 4 | (second ?? 0) >> 4];
         if (second === void 0) break;
@@ -18262,8 +18565,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
     }, "isCanonicalBase64Url");
     var decodedBase64UrlByteLength = /* @__PURE__ */ __name2((value) => decodeBase64Url(value)?.length ?? null, "decodedBase64UrlByteLength");
     var utf8ByteLength = /* @__PURE__ */ __name2((value) => new TextEncoder().encode(value).length, "utf8ByteLength");
-    var canonicalBase64Url = /* @__PURE__ */ __name2((bytes) => external_exports.string().refine((value) => isCanonicalBase64Url(value, bytes), {
-      message: `must be canonical base64url for exactly ${bytes} bytes`
+    var canonicalBase64Url = /* @__PURE__ */ __name2((bytes2) => external_exports.string().refine((value) => isCanonicalBase64Url(value, bytes2), {
+      message: `must be canonical base64url for exactly ${bytes2} bytes`
     }), "canonicalBase64Url");
     var ShareLinkIdValidator = canonicalBase64Url(SHARE_LINK_ID_BYTES);
     var ShareContentKeyValidator = canonicalBase64Url(SHARE_CONTENT_KEY_BYTES);
@@ -18499,6 +18802,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       version: safeVersion,
       contentVersion: safeVersion,
       status: ShareLinkStatusValidator,
+      attachmentId: external_exports.string().uuid().nullable().optional(),
+      attachmentChunkCount: external_exports.number().int().min(1).max(16).nullable().optional(),
       contentState: ShareContentStateValidator,
       createdAt: external_exports.iso.datetime(),
       updatedAt: external_exports.iso.datetime(),
@@ -18522,6 +18827,43 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       contentUrl: external_exports.string().optional()
     });
     var clientRequestId = external_exports.string().uuid();
+    var ShareLinkAttachmentValidator = external_exports.object({
+      id: external_exports.string().uuid(),
+      chunkCount: external_exports.number().int().min(1).max(16)
+    }).strict();
+    var attachmentChunkKey = {
+      id: ShareLinkIdValidator,
+      contentVersion: safeVersion,
+      attachmentId: external_exports.string().uuid(),
+      chunkIndex: external_exports.number().int().min(0).max(15)
+    };
+    var ShareLinkAttachmentChunkEnvelopeValidator = ShareEnvelopeValidator.refine(
+      (value) => (decodedBase64UrlByteLength(value.ct) ?? Infinity) <= 256 * 1024 + SHARE_TAG_BYTES
+    );
+    var PutShareLinkAttachmentChunkInputValidator = external_exports.object({
+      ...attachmentChunkKey,
+      chunkCount: external_exports.number().int().min(1).max(16),
+      envelope: ShareLinkAttachmentChunkEnvelopeValidator,
+      ownerEncryptedRecovery: ShareOwnerRecoveryValidator
+    }).strict().refine((value) => value.chunkIndex < value.chunkCount);
+    var GetShareLinkAttachmentChunkInputValidator = external_exports.object({
+      ...attachmentChunkKey,
+      passcode: external_exports.string().min(4).max(64).optional(),
+      accessToken: external_exports.string().min(1).max(2048).optional()
+    }).strict();
+    var ShareLinkAttachmentChunkOutputValidator = external_exports.object({
+      ...attachmentChunkKey,
+      envelope: ShareLinkAttachmentChunkEnvelopeValidator,
+      accessToken: external_exports.string().min(1).max(2048).optional()
+    }).strict();
+    var DeleteShareLinkAttachmentChunksInputValidator = external_exports.object({
+      id: ShareLinkIdValidator,
+      contentVersion: safeVersion,
+      attachmentId: external_exports.string().uuid(),
+      chunkCount: external_exports.number().int().min(1).max(16)
+    }).strict();
+    var PutShareLinkAttachmentChunkOutputValidator = external_exports.object({ ok: external_exports.literal(true) }).strict();
+    var DeleteShareLinkAttachmentChunksOutputValidator = external_exports.object({ ok: external_exports.boolean() }).strict();
     var CreateShareLinkInputValidator = external_exports.object({
       id: ShareLinkIdValidator,
       clientRequestId,
@@ -18533,7 +18875,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       selectedCount: external_exports.number().int().min(1).max(MAX_SELECTED_CREDENTIALS),
       contentVersion: external_exports.literal(1),
       envelope: ShareEnvelopeValidator,
-      ownerEncryptedRecovery: ShareOwnerRecoveryValidator
+      ownerEncryptedRecovery: ShareOwnerRecoveryValidator,
+      attachment: ShareLinkAttachmentValidator.optional()
     }).strict();
     var UpdateShareLinkInputValidator = external_exports.object({
       id: ShareLinkIdValidator,
@@ -18548,7 +18891,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       contentVersion: safeVersion.optional(),
       selectedCount: external_exports.number().int().min(1).max(MAX_SELECTED_CREDENTIALS).optional(),
       envelope: ShareEnvelopeValidator.optional(),
-      ownerEncryptedRecovery: ShareOwnerRecoveryValidator.optional()
+      ownerEncryptedRecovery: ShareOwnerRecoveryValidator.optional(),
+      attachment: ShareLinkAttachmentValidator.optional()
     }).strict().superRefine((value, ctx) => {
       const provided = [
         value.contentVersion,
@@ -18562,6 +18906,9 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
           message: "content replacement requires contentVersion, selectedCount, envelope and ownerEncryptedRecovery together"
         });
       }
+      if (value.attachment !== void 0 && provided !== 4) {
+        ctx.addIssue({ code: "custom", message: "attachment requires a content replacement" });
+      }
     });
     var ShareLinkIdInputValidator = external_exports.object({ id: ShareLinkIdValidator }).strict();
     var ShareLinkOperationKeyInputValidator = external_exports.object({ id: ShareLinkIdValidator, operationId: external_exports.string().uuid() }).strict();
@@ -18818,33 +19165,33 @@ var DEFAULT_KDF_PARAMS = {
   parallelism: ARGON2_PARALLELISM
 };
 function bufferToBase64(buf) {
-  const bytes = new Uint8Array(buf);
+  const bytes2 = new Uint8Array(buf);
   let binary = "";
-  for (let i = 0; i < bytes.byteLength; i++) {
-    binary += String.fromCharCode(bytes[i]);
+  for (let i = 0; i < bytes2.byteLength; i++) {
+    binary += String.fromCharCode(bytes2[i]);
   }
   return btoa(binary);
 }
 __name(bufferToBase64, "bufferToBase64");
 function base64ToBuffer(b64) {
   const binary = atob(b64);
-  const bytes = new Uint8Array(binary.length);
+  const bytes2 = new Uint8Array(binary.length);
   for (let i = 0; i < binary.length; i++) {
-    bytes[i] = binary.charCodeAt(i);
+    bytes2[i] = binary.charCodeAt(i);
   }
-  return bytes;
+  return bytes2;
 }
 __name(base64ToBuffer, "base64ToBuffer");
-function hexToBytes(hex) {
-  const bytes = new Uint8Array(hex.length / 2);
-  for (let i = 0; i < hex.length; i += 2) {
-    bytes[i / 2] = parseInt(hex.slice(i, i + 2), 16);
+function hexToBytes(hex2) {
+  const bytes2 = new Uint8Array(hex2.length / 2);
+  for (let i = 0; i < hex2.length; i += 2) {
+    bytes2[i / 2] = parseInt(hex2.slice(i, i + 2), 16);
   }
-  return bytes;
+  return bytes2;
 }
 __name(hexToBytes, "hexToBytes");
-function bytesToHex(bytes) {
-  return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+function bytesToHex(bytes2) {
+  return Array.from(bytes2).map((b) => b.toString(16).padStart(2, "0")).join("");
 }
 __name(bytesToHex, "bytesToHex");
 async function deriveKeyFromPassword(password, salt, params = DEFAULT_KDF_PARAMS) {
@@ -19011,21 +19358,21 @@ async function getOrCreateMasterKey() {
 }
 __name(getOrCreateMasterKey, "getOrCreateMasterKey");
 function bufferToBase642(buf) {
-  const bytes = new Uint8Array(buf);
+  const bytes2 = new Uint8Array(buf);
   let binary = "";
-  for (let i = 0; i < bytes.byteLength; i++) {
-    binary += String.fromCharCode(bytes[i]);
+  for (let i = 0; i < bytes2.byteLength; i++) {
+    binary += String.fromCharCode(bytes2[i]);
   }
   return btoa(binary);
 }
 __name(bufferToBase642, "bufferToBase64");
 function base64ToBuffer2(b64) {
   const binary = atob(b64);
-  const bytes = new Uint8Array(binary.length);
+  const bytes2 = new Uint8Array(binary.length);
   for (let i = 0; i < binary.length; i++) {
-    bytes[i] = binary.charCodeAt(i);
+    bytes2[i] = binary.charCodeAt(i);
   }
-  return bytes.buffer;
+  return bytes2.buffer;
 }
 __name(base64ToBuffer2, "base64ToBuffer");
 async function encryptShare(share, id) {
@@ -19433,16 +19780,16 @@ async function getWordlist() {
   return wordlistPromise;
 }
 __name(getWordlist, "getWordlist");
-function bytesToBits(bytes) {
-  return Array.from(bytes).map((b) => b.toString(2).padStart(8, "0")).join("");
+function bytesToBits(bytes2) {
+  return Array.from(bytes2).map((b) => b.toString(2).padStart(8, "0")).join("");
 }
 __name(bytesToBits, "bytesToBits");
 function bitsToBytes(bits) {
-  const bytes = new Uint8Array(Math.ceil(bits.length / 8));
-  for (let i = 0; i < bytes.length; i++) {
-    bytes[i] = parseInt(bits.slice(i * 8, (i + 1) * 8).padEnd(8, "0"), 2);
+  const bytes2 = new Uint8Array(Math.ceil(bits.length / 8));
+  for (let i = 0; i < bytes2.length; i++) {
+    bytes2[i] = parseInt(bits.slice(i * 8, (i + 1) * 8).padEnd(8, "0"), 2);
   }
-  return bytes;
+  return bytes2;
 }
 __name(bitsToBytes, "bitsToBytes");
 async function computeChecksum(data) {
@@ -19480,12 +19827,12 @@ async function recoveryPhraseToShare(phrase) {
     bits += index.toString(2).padStart(11, "0");
   }
   let dataByteCount = 0;
-  for (let bytes = 1; bytes <= 64; bytes++) {
-    const checksumBits2 = Math.floor(bytes / 4);
-    const totalBits = bytes * 8 + checksumBits2;
+  for (let bytes2 = 1; bytes2 <= 64; bytes2++) {
+    const checksumBits2 = Math.floor(bytes2 / 4);
+    const totalBits = bytes2 * 8 + checksumBits2;
     const wordsNeeded = Math.ceil(totalBits / 11);
     if (wordsNeeded === words.length) {
-      dataByteCount = bytes;
+      dataByteCount = bytes2;
     } else if (wordsNeeded > words.length) {
       break;
     }
@@ -19779,9 +20126,9 @@ __name(createSSSKeyManager, "createSSSKeyManager");
 var EMAIL_RELAY_ENVELOPE_VERSION = 1;
 var EMAIL_RELAY_ALGORITHM = "P-256-HKDF-SHA256-AES-256-GCM";
 var encodeUtf8 = /* @__PURE__ */ __name((value) => {
-  const bytes = new TextEncoder().encode(value);
-  const copy = new Uint8Array(new ArrayBuffer(bytes.byteLength));
-  copy.set(bytes);
+  const bytes2 = new TextEncoder().encode(value);
+  const copy = new Uint8Array(new ArrayBuffer(bytes2.byteLength));
+  copy.set(bytes2);
   return copy;
 }, "encodeUtf8");
 var EMAIL_RELAY_INFO = encodeUtf8("learncard-email-relay-v1");
@@ -19976,9 +20323,9 @@ var ESCROW_BLOB_INFO = "learncard-escrow-blob-v1";
 var ESCROW_RELEASE_INFO = "learncard-escrow-release-v1";
 var ESCROW_CLIENT_KEY_ID = "client";
 var encodeUtf82 = /* @__PURE__ */ __name((value) => {
-  const bytes = new TextEncoder().encode(value);
-  const copy = new Uint8Array(new ArrayBuffer(bytes.byteLength));
-  copy.set(bytes);
+  const bytes2 = new TextEncoder().encode(value);
+  const copy = new Uint8Array(new ArrayBuffer(bytes2.byteLength));
+  copy.set(bytes2);
   return copy;
 }, "encodeUtf8");
 var isRecord2 = /* @__PURE__ */ __name((value) => typeof value === "object" && value !== null && !Array.isArray(value), "isRecord");
@@ -20167,6 +20514,195 @@ var openEscrowRelease = /* @__PURE__ */ __name(async (envelope, clientEphemeralP
   await decryptFromEnvelope(envelope, clientEphemeralPrivateKeyPkcs8B64, ESCROW_RELEASE_INFO)
 ), "openEscrowRelease");
 
+// src/escrow-nitro-attestation.ts
+import "reflect-metadata";
+import { decode, encode } from "cborg";
+import {
+  BasicConstraintsExtension,
+  KeyUsagesExtension,
+  KeyUsageFlags,
+  X509Certificate
+} from "@peculiar/x509";
+var NitroAttestationError = class extends Error {
+  constructor(reason) {
+    super(`Nitro attestation rejected: ${reason}`);
+    this.reason = reason;
+    this.name = "NitroAttestationError";
+  }
+  static {
+    __name(this, "NitroAttestationError");
+  }
+};
+var AWS_ROOT_SHA256 = "641a0321a3e244efe456463195d606317ed7cdcc3c1756e09893f3c68f79bb5b";
+var fail = /* @__PURE__ */ __name((reason) => {
+  throw new NitroAttestationError(reason);
+}, "fail");
+var hex = /* @__PURE__ */ __name((bytes2) => Array.from(bytes2, (byte) => byte.toString(16).padStart(2, "0")).join(""), "hex");
+var bytes = /* @__PURE__ */ __name((value, reason) => value instanceof Uint8Array && value.length > 0 ? value : fail(reason), "bytes");
+var map = /* @__PURE__ */ __name((value, reason) => value instanceof Map ? value : fail(reason), "map");
+var decodeCbor = /* @__PURE__ */ __name((value) => {
+  try {
+    return decode(value, {
+      useMaps: true,
+      rejectDuplicateMapKeys: true,
+      allowIndefinite: false,
+      allowUndefined: false,
+      allowNaN: false,
+      allowInfinity: false,
+      allowBigInt: false
+    });
+  } catch {
+    return fail("cbor");
+  }
+}, "decodeCbor");
+var decodeUserData = /* @__PURE__ */ __name((userData) => {
+  let decoded;
+  try {
+    decoded = decode(userData, {
+      useMaps: true,
+      rejectDuplicateMapKeys: true,
+      allowIndefinite: false,
+      allowUndefined: false,
+      allowNaN: false,
+      allowInfinity: false,
+      allowBigInt: false
+    });
+  } catch {
+    return void 0;
+  }
+  if (!(decoded instanceof Map) || decoded.size !== 3) return void 0;
+  const spki = decoded.get(0);
+  const keyId = decoded.get(1);
+  const previousKeyIds = decoded.get(2);
+  const isKeyId = /* @__PURE__ */ __name((value) => typeof value === "string" && /^[A-Za-z0-9._-]{1,128}$/.test(value), "isKeyId");
+  if (!(spki instanceof Uint8Array) || spki.length === 0 || !isKeyId(keyId) || !Array.isArray(previousKeyIds) || previousKeyIds.length > 3 || !previousKeyIds.every(isKeyId)) {
+    return void 0;
+  }
+  return { spki, keyId, previousKeyIds };
+}, "decodeUserData");
+var verifyNitroAttestationDocument = /* @__PURE__ */ __name(async (documentB64, {
+  expectedNonce,
+  policy,
+  now = Date.now()
+}) => {
+  let document;
+  try {
+    if (!documentB64 || documentB64.length > 65536 || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(documentB64))
+      fail("cbor");
+    document = base64ToBuffer(documentB64);
+  } catch {
+    return fail("cbor");
+  }
+  const cose = decodeCbor(document[0] === 210 ? document.subarray(1) : document);
+  if (!Array.isArray(cose) || cose.length !== 4) fail("cose");
+  const [protectedValue, unprotectedValue, payloadValue, signatureValue] = cose;
+  const protectedBytes = bytes(protectedValue, "cose");
+  const protectedHeader = map(decodeCbor(protectedBytes), "alg");
+  if (protectedHeader.size !== 1 || protectedHeader.get(1) !== -35) fail("alg");
+  if (map(unprotectedValue, "cose").size !== 0) fail("cose");
+  const payloadBytes = bytes(payloadValue, "cose");
+  const signature = bytes(signatureValue, "signature");
+  if (signature.length !== 96) fail("signature");
+  const payload = map(decodeCbor(payloadBytes), "cbor");
+  const moduleId = payload.get("module_id");
+  const timestamp = payload.get("timestamp");
+  if (typeof moduleId !== "string" || !moduleId || payload.get("digest") !== "SHA384")
+    fail("cbor");
+  if (typeof timestamp !== "number" || !Number.isSafeInteger(timestamp) || timestamp < 0)
+    fail("freshness");
+  const leafDer = bytes(payload.get("certificate"), "chain");
+  const bundle = payload.get("cabundle");
+  if (!Array.isArray(bundle) || !bundle.length || bundle.length > 16) fail("chain");
+  const ders = bundle.map((value) => bytes(value, "chain"));
+  const rootHash = hex(
+    new Uint8Array(await crypto.subtle.digest("SHA-256", new Uint8Array(ders[0])))
+  );
+  if (rootHash !== (policy.rootCertificateSha256 ?? AWS_ROOT_SHA256).toLowerCase()) fail("root");
+  let leaf;
+  try {
+    const chain = [...ders, leafDer].map((der) => new X509Certificate(new Uint8Array(der)));
+    for (let i = 0; i < chain.length; i++) {
+      const cert = chain[i];
+      const issuer = chain[Math.max(0, i - 1)];
+      if (!Number.isFinite(now) || now < cert.notBefore.getTime() || now > cert.notAfter.getTime() || cert.issuer !== issuer.subject || !await cert.verify({ publicKey: issuer.publicKey, date: new Date(now) }, crypto))
+        fail("chain");
+      if (i < chain.length - 1) {
+        const constraints = cert.getExtension(BasicConstraintsExtension);
+        const usage = cert.getExtension(KeyUsagesExtension);
+        if (!constraints?.ca || constraints.pathLength !== void 0 && chain.length - i - 2 > constraints.pathLength || usage && !(usage.usages & KeyUsageFlags.keyCertSign))
+          fail("chain");
+      }
+    }
+    leaf = chain[chain.length - 1];
+  } catch {
+    return fail("chain");
+  }
+  try {
+    const key = await crypto.subtle.importKey(
+      "spki",
+      leaf.publicKey.rawData,
+      { name: "ECDSA", namedCurve: "P-384" },
+      false,
+      ["verify"]
+    );
+    const structure = encode(["Signature1", protectedBytes, new Uint8Array(), payloadBytes]);
+    if (!await crypto.subtle.verify(
+      { name: "ECDSA", hash: "SHA-384" },
+      key,
+      new Uint8Array(signature),
+      new Uint8Array(structure)
+    ))
+      fail("signature");
+  } catch {
+    return fail("signature");
+  }
+  const rawPcrs = map(payload.get("pcrs"), "pcr");
+  const pcrs = {};
+  for (const [index, value] of rawPcrs) {
+    if (typeof index !== "number" || !Number.isInteger(index) || index < 0 || index > 31)
+      fail("pcr");
+    const pcr = bytes(value, "pcr");
+    if (pcr.length !== 48) fail("pcr");
+    pcrs[index] = hex(pcr);
+  }
+  if (pcrs[0] === "00".repeat(48)) fail("debug");
+  if (!policy.pinnedMeasurements.some(
+    (pin) => typeof pin.pcr0 === "string" && typeof pin.pcr1 === "string" && typeof pin.pcr2 === "string" && pin.pcr0.toLowerCase() === pcrs[0] && pin.pcr1.toLowerCase() === pcrs[1] && pin.pcr2.toLowerCase() === pcrs[2]
+  ))
+    fail("pcr");
+  const nonce = bytes(payload.get("nonce"), "nonce");
+  if (!(expectedNonce instanceof Uint8Array) || expectedNonce.length !== 32 || nonce.length !== expectedNonce.length)
+    fail("nonce");
+  let difference = 0;
+  for (let i = 0; i < nonce.length; i++) difference |= nonce[i] ^ expectedNonce[i];
+  if (difference !== 0) fail("nonce");
+  const maxAge = policy.maxAgeMs ?? 3e5;
+  if (!Number.isFinite(maxAge) || maxAge < 0 || now - timestamp > maxAge || timestamp > now + 6e4)
+    fail("freshness");
+  const userData = bytes(payload.get("user_data"), "user-data");
+  const newFormat = decodeUserData(new Uint8Array(userData));
+  const spki = newFormat ? newFormat.spki : userData;
+  try {
+    await crypto.subtle.importKey(
+      "spki",
+      new Uint8Array(spki),
+      { name: "ECDH", namedCurve: "P-256" },
+      false,
+      []
+    );
+  } catch {
+    return fail("user-data");
+  }
+  return {
+    escrowPublicKeySpkiB64: bufferToBase64(new Uint8Array(spki).buffer),
+    keyId: newFormat?.keyId,
+    previousKeyIds: newFormat?.previousKeyIds ?? [],
+    pcrs,
+    timestamp,
+    moduleId
+  };
+}, "verifyNitroAttestationDocument");
+
 // src/escrow-attestation.ts
 var isRecord3 = /* @__PURE__ */ __name((value) => typeof value === "object" && value !== null && !Array.isArray(value), "isRecord");
 var normalizePublicKey = /* @__PURE__ */ __name((value) => {
@@ -20176,13 +20712,50 @@ var normalizePublicKey = /* @__PURE__ */ __name((value) => {
   }
   return bufferToBase64(base64ToBuffer(trimmed).buffer);
 }, "normalizePublicKey");
-var verifyEnclaveAttestation = /* @__PURE__ */ __name(async (attestation, policy) => {
-  const fields = ["mode", "keyId", "publicKey", "measurements", "document", "issuedAt"];
-  if (!isRecord3(attestation) || Object.keys(attestation).some((key) => !fields.includes(key)) || attestation.mode !== "software" && attestation.mode !== "nitro" || typeof attestation.keyId !== "string" || !/^[A-Za-z0-9._-]{1,128}$/.test(attestation.keyId) || typeof attestation.publicKey !== "string" || !isRecord3(attestation.measurements) || Object.entries(attestation.measurements).some(
+var verifyEnclaveAttestation = /* @__PURE__ */ __name(async (attestation, policy, nonce) => {
+  const isKeyId = /* @__PURE__ */ __name((value) => typeof value === "string" && /^[A-Za-z0-9._-]{1,128}$/.test(value), "isKeyId");
+  const fields = [
+    "mode",
+    "keyId",
+    "previousKeyIds",
+    "publicKey",
+    "measurements",
+    "document",
+    "issuedAt"
+  ];
+  if (!isRecord3(attestation) || Object.keys(attestation).some((key) => !fields.includes(key)) || attestation.mode !== "software" && attestation.mode !== "nitro" || !isKeyId(attestation.keyId) || attestation.previousKeyIds !== void 0 && (!Array.isArray(attestation.previousKeyIds) || attestation.previousKeyIds.length > 3 || !attestation.previousKeyIds.every(isKeyId)) || typeof attestation.publicKey !== "string" || !isRecord3(attestation.measurements) || Object.entries(attestation.measurements).some(
     ([key, value]) => !["imageSha384", "pcr0", "pcr1", "pcr2"].includes(key) || typeof value !== "string" || !value || value.length > 1024
   ) || typeof attestation.document !== "string" || !attestation.document || attestation.document.length > 65536 || typeof attestation.issuedAt !== "string" || !Number.isFinite(Date.parse(attestation.issuedAt))) {
     throw new Error("Invalid escrow attestation");
   }
+  const plaintextPreviousKeyIds = attestation.previousKeyIds ?? [];
+  if (attestation.mode !== policy.mode) throw new Error("Escrow attestation mode mismatch");
+  if (policy.mode === "nitro") {
+    if (!nonce) throw new NitroAttestationError("nonce");
+    const verified = await verifyNitroAttestationDocument(attestation.document, {
+      expectedNonce: nonce,
+      policy
+    });
+    try {
+      if (normalizePublicKey(attestation.publicKey) !== verified.escrowPublicKeySpkiB64) {
+        throw new NitroAttestationError("user-data");
+      }
+    } catch {
+      throw new NitroAttestationError("user-data");
+    }
+    if (verified.keyId !== void 0 && verified.keyId !== attestation.keyId) {
+      throw new NitroAttestationError("user-data");
+    }
+    if (plaintextPreviousKeyIds.length !== verified.previousKeyIds.length || !plaintextPreviousKeyIds.every((id, index) => id === verified.previousKeyIds[index])) {
+      throw new NitroAttestationError("user-data");
+    }
+    return {
+      publicKey: verified.escrowPublicKeySpkiB64,
+      keyId: attestation.keyId,
+      previousKeyIds: verified.previousKeyIds,
+      mode: "nitro"
+    };
+  }
   const publicKey = normalizePublicKey(attestation.publicKey);
   await crypto.subtle.importKey(
     "spki",
@@ -20191,14 +20764,15 @@ var verifyEnclaveAttestation = /* @__PURE__ */ __name(async (attestation, policy
     false,
     []
   );
-  if (policy.mode === "nitro") {
-    throw new Error("Nitro attestation verification is not implemented yet");
-  }
-  if (attestation.mode !== policy.mode) throw new Error("Escrow attestation mode mismatch");
   if (!policy.pinnedPublicKeys.some((pin) => normalizePublicKey(pin) === publicKey)) {
     throw new Error("Escrow attestation public key is not trusted");
   }
-  return { publicKey, keyId: attestation.keyId, mode: attestation.mode };
+  return {
+    publicKey,
+    keyId: attestation.keyId,
+    previousKeyIds: plaintextPreviousKeyIds,
+    mode: attestation.mode
+  };
 }, "verifyEnclaveAttestation");
 
 // src/types.ts
@@ -20971,6 +21545,7 @@ function createSSSStrategy(config) {
   let pendingIdentityRecovery;
   let lastServerSnapshot = null;
   let escrowEnrollmentInFlight;
+  let staleEscrowReenrollAttempted = false;
   let unenrolledRotation;
   const escrowRequest = /* @__PURE__ */ __name(async (path, init, pinAttempt = false) => {
     const response = await fetch(`${serverUrl}/keys/escrow${path}`, {
@@ -21018,11 +21593,16 @@ function createSSSStrategy(config) {
   }, "escrowRequest");
   const fetchVerifiedEnclaveKey = /* @__PURE__ */ __name(async () => {
     if (!config.escrow?.enabled) throw new Error("Escrow enrollment is disabled");
-    const { attestation } = await escrowRequest("/attestation", {
-      method: "GET",
-      headers: buildHeaders("", void 0, tenantId)
-    });
-    return verifyEnclaveAttestation(attestation, config.escrow.attestation);
+    const nonce = crypto.getRandomValues(new Uint8Array(32));
+    const nonceHex = Array.from(nonce, (byte) => byte.toString(16).padStart(2, "0")).join("");
+    const { attestation } = await escrowRequest(
+      `/attestation?nonce=${nonceHex}`,
+      {
+        method: "GET",
+        headers: buildHeaders("", void 0, tenantId)
+      }
+    );
+    return verifyEnclaveAttestation(attestation, config.escrow.attestation, nonce);
   }, "fetchVerifiedEnclaveKey");
   const enrollEscrow = /* @__PURE__ */ __name(async (token, providerType, privateKey, primaryDid, shares, shareVersion, signDidAuthVp, verifiedKey, pinMaterial, clearPin = false) => {
     if (!config.escrow?.enabled) throw new Error("Escrow enrollment is disabled");
@@ -21084,75 +21664,89 @@ function createSSSStrategy(config) {
     }
     const status = await self.fetchServerKeyStatus(params.token, params.providerType);
     if (status.escrowOptedOut) return { enrolled: false, reason: "opted-out" };
-    if (!forceRotate && pin === void 0 && status.shareVersion !== null && status.recoveryMethods.some(
+    const currentlyEnrolled = status.shareVersion !== null && status.recoveryMethods.some(
       (method) => method.type === "escrow" && method.shareVersion === status.shareVersion && (Boolean(method.confirmedAt) || "confirmationStatus" in method && method.confirmationStatus === "confirmed")
-    ))
+    );
+    const repairingStaleBlob = pin === void 0 && !forceRotate && currentlyEnrolled && !!status.escrowStale && !staleEscrowReenrollAttempted;
+    if (!forceRotate && pin === void 0 && currentlyEnrolled && !repairingStaleBlob)
       return { enrolled: true, changed: false };
+    if (repairingStaleBlob) staleEscrowReenrollAttempted = true;
     if (!status.primaryDid) throw new Error("Cannot enroll escrow without a primary DID");
     if (!params.signDidAuthVp) {
       throw new Error("DID proof signing is required for escrow enrollment");
     }
-    if (!forceRotate && pin === void 0 && unenrolledRotation && unenrolledRotation.shareVersion === status.shareVersion && unenrolledRotation.primaryDid === status.primaryDid) {
-      const retry = unenrolledRotation;
+    try {
+      if (!forceRotate && pin === void 0 && unenrolledRotation && unenrolledRotation.shareVersion === status.shareVersion && unenrolledRotation.primaryDid === status.primaryDid) {
+        const retry = unenrolledRotation;
+        await enrollEscrow(
+          params.token,
+          params.providerType,
+          params.privateKey,
+          retry.primaryDid,
+          retry.shares,
+          retry.shareVersion,
+          params.signDidAuthVp,
+          void 0,
+          void 0,
+          retry.clearPin
+        );
+        unenrolledRotation = void 0;
+        return { enrolled: true, changed: true, shareVersion: retry.shareVersion };
+      }
+      const verifiedKey = await fetchVerifiedEnclaveKey();
+      const pinSalt = pin !== void 0 ? generatePinSalt() : void 0;
+      const pinMaterial = pin !== void 0 && pinSalt !== void 0 ? { pinSalt, pinVerifier: await derivePinProof(pin, pinSalt) } : void 0;
+      const storageId = activeStorageId;
+      const primaryDid = status.primaryDid;
+      const { shares, shareVersion } = await withShareUpdateLock(
+        storage2,
+        storageId,
+        () => persistSharesWithoutLock(
+          params.privateKey,
+          serverUrl,
+          params.token,
+          params.providerType,
+          primaryDid,
+          storage2,
+          storageId,
+          void 0,
+          params.signDidAuthVp,
+          tenantId
+        )
+      );
+      lastEmailShare = shares.emailShare;
+      lastShareVersion = shareVersion;
+      lastServerSnapshot = {
+        currentVersion: shareVersion,
+        resolvedVersion: shareVersion,
+        authShare: shares.authShare,
+        primaryDid: status.primaryDid
+      };
+      unenrolledRotation = pinMaterial ? void 0 : { shares, shareVersion, primaryDid: status.primaryDid, clearPin: forceRotate };
       await enrollEscrow(
         params.token,
         params.providerType,
         params.privateKey,
-        retry.primaryDid,
-        retry.shares,
-        retry.shareVersion,
+        status.primaryDid,
+        shares,
+        shareVersion,
         params.signDidAuthVp,
-        void 0,
-        void 0,
-        retry.clearPin
+        verifiedKey,
+        pinMaterial,
+        forceRotate
       );
       unenrolledRotation = void 0;
-      return { enrolled: true, changed: true, shareVersion: retry.shareVersion };
+      return { enrolled: true, changed: true, shareVersion };
+    } catch (err) {
+      if (!repairingStaleBlob) throw err;
+      try {
+        if (config.onEscrowError) config.onEscrowError(err);
+        else console.warn("SSS: escrow enrollment failed");
+      } catch {
+        console.warn("SSS: escrow error reporting failed");
+      }
+      return { enrolled: true, changed: false };
     }
-    const verifiedKey = await fetchVerifiedEnclaveKey();
-    const pinSalt = pin !== void 0 ? generatePinSalt() : void 0;
-    const pinMaterial = pin !== void 0 && pinSalt !== void 0 ? { pinSalt, pinVerifier: await derivePinProof(pin, pinSalt) } : void 0;
-    const storageId = activeStorageId;
-    const primaryDid = status.primaryDid;
-    const { shares, shareVersion } = await withShareUpdateLock(
-      storage2,
-      storageId,
-      () => persistSharesWithoutLock(
-        params.privateKey,
-        serverUrl,
-        params.token,
-        params.providerType,
-        primaryDid,
-        storage2,
-        storageId,
-        void 0,
-        params.signDidAuthVp,
-        tenantId
-      )
-    );
-    lastEmailShare = shares.emailShare;
-    lastShareVersion = shareVersion;
-    lastServerSnapshot = {
-      currentVersion: shareVersion,
-      resolvedVersion: shareVersion,
-      authShare: shares.authShare,
-      primaryDid: status.primaryDid
-    };
-    unenrolledRotation = pinMaterial ? void 0 : { shares, shareVersion, primaryDid: status.primaryDid, clearPin: forceRotate };
-    await enrollEscrow(
-      params.token,
-      params.providerType,
-      params.privateKey,
-      status.primaryDid,
-      shares,
-      shareVersion,
-      params.signDidAuthVp,
-      verifiedKey,
-      pinMaterial,
-      forceRotate
-    );
-    unenrolledRotation = void 0;
-    return { enrolled: true, changed: true, shareVersion };
   }, "ensureEscrowEnrollmentUnguarded");
   const recordPromotion = /* @__PURE__ */ __name((primaryDid) => (snapshot) => {
     lastEmailShare = void 0;
@@ -21469,6 +22063,7 @@ function createSSSStrategy(config) {
         maskedRecoveryEmail: data.maskedRecoveryEmail ?? null,
         escrowOptedOut: data.escrowOptedOut === true,
         escrowPin: data.escrowPin,
+        escrowStale: data.escrowStale,
         sssActivationState: data.sssActivationState ?? "active"
       };
     },
@@ -21513,10 +22108,17 @@ function createSSSStrategy(config) {
       if (!config.escrow?.enabled) return { state: "disabled" };
       const status = await this.fetchServerKeyStatus(params.token, params.providerType);
       if (status.escrowOptedOut) return { state: "opted-out", escrowPin: status.escrowPin };
-      const state = status.shareVersion !== null && status.recoveryMethods.some(
-        (method) => method.type === "escrow" && method.shareVersion === status.shareVersion && (Boolean(method.confirmedAt) || "confirmationStatus" in method && method.confirmationStatus === "confirmed")
-      ) ? "enrolled" : "not-enrolled";
-      return { state, escrowPin: status.escrowPin };
+      const confirmedEscrow = status.recoveryMethods.filter(
+        (method) => method.type === "escrow" && (Boolean(method.confirmedAt) || "confirmationStatus" in method && method.confirmationStatus === "confirmed")
+      );
+      const enrolled = status.shareVersion !== null && confirmedEscrow.some((method) => method.shareVersion === status.shareVersion);
+      if (confirmedEscrow.length > 0 && (!enrolled || status.escrowStale))
+        return {
+          state: "stale",
+          escrowPin: status.escrowPin,
+          staleReason: status.escrowStale
+        };
+      return { state: enrolled ? "enrolled" : "not-enrolled", escrowPin: status.escrowPin };
     },
     async disableEscrowRecovery(params) {
       const status = await this.fetchServerKeyStatus(params.token, params.providerType);
@@ -21569,7 +22171,7 @@ function createSSSStrategy(config) {
       const result = await withRotationLock(
         () => ensureEscrowEnrollmentUnguarded(this, { ...params, options: { pin } }, storage2)
       );
-      if (!result.enrolled) {
+      if (!result.enrolled || !result.changed) {
         throw new Error("Automatic recovery is not available for this account.");
       }
     },
@@ -21578,7 +22180,7 @@ function createSSSStrategy(config) {
       const result = await withRotationLock(
         () => ensureEscrowEnrollmentUnguarded(this, params, storage2, true)
       );
-      if (!result.enrolled) {
+      if (!result.enrolled || !result.changed) {
         throw new Error("Automatic recovery is not available for this account.");
       }
     },
@@ -22737,6 +23339,7 @@ export {
   EscrowPinUnavailableError,
   EscrowRequestError,
   IdentityRecoverySessionConsumedError,
+  NitroAttestationError,
   PIN_MAX_LENGTH,
   PIN_MIN_LENGTH,
   SSSApiClient,
@@ -22812,5 +23415,6 @@ export {
   validatePin,
   validateRecoveryPhrase,
   verifyEnclaveAttestation,
+  verifyNitroAttestationDocument,
   verifyStoredShares
 };