@learncard/sss-key-manager 0.2.0 → 0.2.2

package/README.md

@@ -63,6 +63,19 @@ protected write.
 
 ## Security Model
 
+### Nitro attestation trust policy
+
+Nitro enrollment verifies a nonce-bound COSE ES384 document, the certificate chain against a
+pinned root DER SHA-256 (AWS Nitro Root G1 by default), and one complete PCR0/1/2 tuple.
+Configure `pinnedMeasurements: [{ pcr0, pcr1, pcr2, imageSha384? }]` with 48-byte hex PCRs.
+Legacy `{ imageSha384 }` entries remain type-compatible but **never match**; they cannot authorize
+enrollment. `rootCertificateSha256` is an explicit trust-anchor override (test roots must never be
+used in production). `maxAgeMs` defaults to 300000; future timestamps allow at most 60 seconds skew.
+The escrow P-256 SPKI comes only from signed `user_data`, not the NSM `public_key` used for KMS.
+`verifyEnclaveAttestation(attestation, policy, nonce)` requires the expected 32-byte nonce in Nitro
+mode. The strategy sends a fresh hex nonce on each attestation GET; software mode ignores the nonce
+and continues to require a pinned public key.
+
 - **Device Share**: Encrypted with non-extractable AES-GCM key stored in IndexedDB
 - **Auth Share**: Server-side envelope encryption (DEK + KMS-encrypted DEK)
 - **Recovery Share**: Password-based uses Argon2id KDF with secure parameters

package/dist/escrow-attestation.d.ts

@@ -1,8 +1,5 @@
 import type { EscrowAttestationPolicy } from './types';
+import type { VerifiedEnclaveIdentity } from './escrow-authority.types';
 /** Parse untrusted attestation data and enforce an explicit enclave trust policy. */
-export declare const verifyEnclaveAttestation: (attestation: unknown, policy: EscrowAttestationPolicy) => Promise<{
-    publicKey: string;
-    keyId: string;
-    mode: "software" | "nitro";
-}>;
+export declare const verifyEnclaveAttestation: (attestation: unknown, policy: EscrowAttestationPolicy, nonce?: Uint8Array) => Promise<VerifiedEnclaveIdentity>;
 //# sourceMappingURL=escrow-attestation.d.ts.map

package/dist/escrow-attestation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"escrow-attestation.d.ts","sourceRoot":"","sources":["../src/escrow-attestation.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAC;AAiBvD,qFAAqF;AACrF,eAAO,MAAM,wBAAwB,GACjC,aAAa,OAAO,EACpB,QAAQ,uBAAuB,KAChC,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAA;CAAE,CAyC1E,CAAC"}
+{"version":3,"file":"escrow-attestation.d.ts","sourceRoot":"","sources":["../src/escrow-attestation.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAC;AACvD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAkBxE,qFAAqF;AACrF,eAAO,MAAM,wBAAwB,GACjC,aAAa,OAAO,EACpB,QAAQ,uBAAuB,EAC/B,QAAQ,UAAU,KACnB,OAAO,CAAC,uBAAuB,CAoGjC,CAAC"}

package/dist/escrow-authority.d.ts

@@ -0,0 +1,112 @@
+import type { HistoricalEscrowEvidence } from './escrow-authority.types';
+import type { EscrowAttestationPolicy } from './types';
+import type { EscrowBlobPlaintext, EscrowEnvelope } from './escrow-crypto';
+import type { EscrowEnrollmentIntent, SignedEscrowEnrollmentIntent } from './escrow-enrollment-intent.types';
+import type { EscrowAuthorityRecord, EscrowAuthorityState, VerifiedEnclaveIdentity, VerifiedEscrowMutation } from './escrow-authority.types';
+/** Derive historical receipt pins from the same complete PCR tuples used for
+ * Nitro attestation. Legacy image-only pins and malformed tuples authorize nothing. */
+export declare const escrowAuthorityMeasurements: (policy: EscrowAttestationPolicy) => Promise<string[]>;
+/** Check challenge, scope and signed state; never trust the unsigned duplicate. */
+export declare const verifyEscrowAuthorityState: (response: unknown, nonce: string, tenant: string, did: string, identity: VerifiedEnclaveIdentity) => Promise<EscrowAuthorityState>;
+/** Accept only the committed output of this exact owner intent, including reseals. */
+export declare const verifyEscrowEnrollmentCommit: (response: unknown, intent: EscrowEnrollmentIntent, identity: VerifiedEnclaveIdentity) => Promise<VerifiedEscrowMutation>;
+/** Opaque wire shape of `SignedHoldRecord` (wire.rs `HoldRecord` / policy.rs
+ * `SignedHoldRecord`) — exactly the fields `hold_hash` commits to, plus the
+ * embedded enclave signature over the hold's own creation. */
+export interface EscrowHoldRecordLike {
+    hold: {
+        holdId: string;
+        did: string;
+        shareVersion: number;
+        blobHash: string;
+        enrollmentEpoch: number;
+        releasePolicy: 'hold' | 'pin';
+        clientEphemeralPublicKey: string;
+        createdLo: number;
+        createdHi: number;
+        policyVersion: number;
+        signature: string;
+    };
+    holdDurationMs: number;
+    ledgerSeq: number;
+}
+export interface VerifiedEscrowHold {
+    receipt: EscrowAuthorityRecord;
+    authorityGeneration: string;
+    holdDigest: string;
+}
+/** Verify the enclave committed to creating THIS exact hold before trusting
+ * a `SignedHoldRecord` returned by lca-api: recipient key, DID, blob
+ * identity and hold id all come from the caller's own expectations (never
+ * from the record alone), and the embedded signature is checked against the
+ * attested ledger key exactly like `verifyEscrowEnrollmentCommit`. Returns
+ * the record's own `authorityGeneration` so a later confirmation/warning
+ * receipt for the SAME hold can be pinned to it.
+ * `historical` explicitly permits an older signed measurement only if it is
+ * allowlisted, verifies with the current attested ledger key and an attested
+ * current/previous key ID, and matches the retained authority generation.
+ * Never use historical verification for newly produced confirmation evidence. */
+export declare const verifyEscrowHoldRecord: (record: EscrowHoldRecordLike, expected: {
+    tenant: string;
+    did: string;
+    clientEphemeralPublicKey: string;
+    blobHash: string;
+    holdId: string;
+}, identity: VerifiedEnclaveIdentity, historical?: HistoricalEscrowEvidence) => Promise<VerifiedEscrowHold>;
+/** Verify a confirm-hold / send-release-warning result commits to THIS exact
+ * hold (the one `verifyEscrowHoldRecord` already verified). A fresh
+ * `commit`'s `requestDigest` is a secret-keyed, PIN-style hash the client
+ * cannot recompute by design (publishing an unkeyed digest here would be an
+ * offline oracle — see escrow-enclave-app's ledger "Operation commitments"),
+ * so a fresh commit is checked on tenant/generation/DID binding, epoch and
+ * blob identity only. The idempotent retry **snapshot** instead embeds
+ * `signedHoldDigest` directly in its (unkeyed) payload, so a snapshot
+ * additionally recomputes and compares the hold digest — exactly binding a
+ * retry to the hold the client itself started, not a different one. A caller
+ * receiving a commit MUST also obtain and verify this snapshot before claiming
+ * hold-specific confirmation (as createSSSStrategy does). */
+export declare const verifyEscrowHoldConfirmation: (receipt: unknown, record: EscrowHoldRecordLike, expected: {
+    tenant: string;
+    did: string;
+    authorityGeneration: string;
+}, identity: VerifiedEnclaveIdentity) => Promise<EscrowAuthorityRecord>;
+export type EscrowEnrollmentActionInput = 'automatic' | 'set' | 'clear' | 'disable';
+/** Pure action resolution, shared between intent-building (here) and blob
+ * plaintext construction (sss-strategy.ts's `enrollEscrow`), so both always
+ * agree on enroll/replace/carry/disable from the same inputs instead of
+ * maintaining two copies of this decision. P9.1 (attack C) / P2-d:
+ * `bindsRecoveryContact` is the single source of truth for whether
+ * `recoveryEmail`/`recoveryLanguage` may appear in EITHER the signed intent
+ * or the target blob plaintext — Rust rejects a Carry target blob whose
+ * plaintext already carries either field (the enclave fills them in from
+ * the source blob instead), so this must be computed identically in both
+ * places or a carry can be built with a blob the enclave will refuse. */
+export declare const resolveEscrowEnrollmentAction: (current: Pick<EscrowAuthorityState, "status" | "hasPin">, input: EscrowEnrollmentActionInput) => {
+    action: EscrowEnrollmentIntent["action"];
+    pinAction: EscrowEnrollmentIntent["pinAction"];
+    bindsRecoveryContact: boolean;
+};
+/** P2-d cross-language contract: mirrors the enclave's Carry contact-field
+ * rejection rule (`apply_enrollment_intent` in authority.rs) — true means
+ * the enclave would refuse this target blob. The enclave always fills
+ * recoveryEmail/recoveryLanguage in from the source blob on carry, so a
+ * target that already claims either field is refused. Shared by
+ * `escrow-carry-contact-contract-v1.json`'s TS and Rust tests, and by any
+ * caller (e.g. a test fake) that wants to fail the same way the real
+ * enclave does instead of accepting a shape it would reject. */
+export declare const violatesCarryContactRule: (action: EscrowEnrollmentIntent["action"], target: Pick<EscrowBlobPlaintext, "recoveryEmail" | "recoveryLanguage"> | null) => boolean;
+/** Owner-only mutation selection. Recovery itself never calls this helper.
+ * P9.1 (attack C): `recoveryEmail`/`recoveryLanguage` are always supplied by the
+ * caller (the device's authenticated account email + app locale) but are only
+ * bound into the intent for enroll/replace; disable/carry null them out here
+ * regardless of input, since the enclave carries the prior value forward. */
+export declare const createEscrowEnrollmentIntent: (input: {
+    state: EscrowAuthorityState;
+    target: EscrowEnvelope | null;
+    shareVersion: number;
+    privateKey: string;
+    pinAction: EscrowEnrollmentActionInput;
+    recoveryEmail: string;
+    recoveryLanguage: string;
+}) => Promise<SignedEscrowEnrollmentIntent>;
+//# sourceMappingURL=escrow-authority.d.ts.map

package/dist/escrow-authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"escrow-authority.d.ts","sourceRoot":"","sources":["../src/escrow-authority.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAC;AAMvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAC3E,OAAO,KAAK,EACR,sBAAsB,EACtB,4BAA4B,EAC/B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EACR,qBAAqB,EACrB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACzB,MAAM,0BAA0B,CAAC;AAwElC;uFACuF;AACvF,eAAO,MAAM,2BAA2B,GACpC,QAAQ,uBAAuB,KAChC,OAAO,CAAC,MAAM,EAAE,CAclB,CAAC;AA2IF,mFAAmF;AACnF,eAAO,MAAM,0BAA0B,GACnC,UAAU,OAAO,EACjB,OAAO,MAAM,EACb,QAAQ,MAAM,EACd,KAAK,MAAM,EACX,UAAU,uBAAuB,KAClC,OAAO,CAAC,oBAAoB,CAgB9B,CAAC;AAEF,sFAAsF;AACtF,eAAO,MAAM,4BAA4B,GACrC,UAAU,OAAO,EACjB,QAAQ,sBAAsB,EAC9B,UAAU,uBAAuB,KAClC,OAAO,CAAC,sBAAsB,CA0ChC,CAAC;AAEF;;8DAE8D;AAC9D,MAAM,WAAW,oBAAoB;IACjC,IAAI,EAAE;QACF,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAC;QACjB,eAAe,EAAE,MAAM,CAAC;QACxB,aAAa,EAAE,MAAM,GAAG,KAAK,CAAC;QAC9B,wBAAwB,EAAE,MAAM,CAAC;QACjC,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,EAAE,MAAM,CAAC;QACtB,SAAS,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IAC/B,OAAO,EAAE,qBAAqB,CAAC;IAC/B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;CACtB;AAiCD;;;;;;;;;;iFAUiF;AACjF,eAAO,MAAM,sBAAsB,GAC/B,QAAQ,oBAAoB,EAC5B,UAAU;IACN,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,wBAAwB,EAAE,MAAM,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAClB,EACD,UAAU,uBAAuB,EACjC,aAAa,wBAAwB,KACtC,OAAO,CAAC,kBAAkB,CA+B5B,CAAC;AAEF;;;;;;;;;;;6DAW6D;AAC7D,eAAO,MAAM,4BAA4B,GACrC,SAAS,OAAO,EAChB,QAAQ,oBAAoB,EAC5B,UAAU;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAA;CAAE,EACtE,UAAU,uBAAuB,KAClC,OAAO,CAAC,qBAAqB,CAoC/B,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG,WAAW,GAAG,KAAK,GAAG,OAAO,GAAG,SAAS,CAAC;AAEpF;;;;;;;;;yEASyE;AACzE,eAAO,MAAM,6BAA6B,GACtC,SAAS,IAAI,CAAC,oBAAoB,EAAE,QAAQ,GAAG,QAAQ,CAAC,EACxD,OAAO,2BAA2B,KACnC;IACC,MAAM,EAAE,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IACzC,SAAS,EAAE,sBAAsB,CAAC,WAAW,CAAC,CAAC;IAC/C,oBAAoB,EAAE,OAAO,CAAC;CAsBjC,CAAC;AAEF;;;;;;;gEAOgE;AAChE,eAAO,MAAM,wBAAwB,GACjC,QAAQ,sBAAsB,CAAC,QAAQ,CAAC,EACxC,QAAQ,IAAI,CAAC,mBAAmB,EAAE,eAAe,GAAG,kBAAkB,CAAC,GAAG,IAAI,KAC/E,OACwF,CAAC;AAE5F;;;;6EAI6E;AAC7E,eAAO,MAAM,4BAA4B,GAAU,OAAO;IACtD,KAAK,EAAE,oBAAoB,CAAC;IAC5B,MAAM,EAAE,cAAc,GAAG,IAAI,CAAC;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,2BAA2B,CAAC;IACvC,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;CAC5B,KAAG,OAAO,CAAC,4BAA4B,CAoCvC,CAAC"}

package/dist/escrow-authority.types.d.ts

@@ -0,0 +1,51 @@
+import type { EscrowEnvelope } from './escrow-crypto';
+/** Unverifiable or substituted recovery evidence; callers must not continue recovery. */
+export declare class EscrowEvidenceError extends Error {
+    constructor();
+}
+/** Opt-in for previously issued hold evidence only. Measurements are SHA-256
+ * hashes of complete configured PCR0/1/2 tuples, never server-supplied values.
+ * The original authority generation and current attested ledger key remain pinned.
+ * Fresh receipts must omit this option and match the current measurement exactly. */
+export interface HistoricalEscrowEvidence {
+    historical: true;
+    allowedMeasurements: readonly string[];
+    authorityGeneration: string;
+}
+/** Only construct from verified, nonce-bound NSM evidence (never wrapper JSON). */
+export interface VerifiedEnclaveIdentity {
+    publicKey: string;
+    keyId: string;
+    previousKeyIds: string[];
+    mode: 'software' | 'nitro';
+    authority?: {
+        ledgerPublicKey: string;
+        measurement: string;
+    };
+}
+export interface EscrowAuthorityRecord {
+    version: 1;
+    kind: 'proposal' | 'commit' | 'snapshot';
+    keyId: string;
+    measurement: number[];
+    payload: string;
+    signature: string;
+}
+export interface EscrowAuthorityState {
+    tenant: string;
+    authorityGeneration: string;
+    did: string;
+    enrollmentVersion: number;
+    enrollmentEpoch: number;
+    status: 'empty' | 'active' | 'disabled';
+    envelope: EscrowEnvelope | null;
+    shareVersion: number | null;
+    hasPin: boolean;
+    pinGeneration: number;
+    attemptsUsed: number;
+}
+export interface VerifiedEscrowMutation {
+    envelope: EscrowEnvelope | null;
+    receipt: EscrowAuthorityRecord;
+}
+//# sourceMappingURL=escrow-authority.types.d.ts.map

package/dist/escrow-authority.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"escrow-authority.types.d.ts","sourceRoot":"","sources":["../src/escrow-authority.types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,yFAAyF;AACzF,qBAAa,mBAAoB,SAAQ,KAAK;;CAK7C;AAED;;;qFAGqF;AACrF,MAAM,WAAW,wBAAwB;IACrC,UAAU,EAAE,IAAI,CAAC;IACjB,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,mBAAmB,EAAE,MAAM,CAAC;CAC/B;AAED,mFAAmF;AACnF,MAAM,WAAW,uBAAuB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC;IAC3B,SAAS,CAAC,EAAE;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;CAChE;AAED,MAAM,WAAW,qBAAqB;IAClC,OAAO,EAAE,CAAC,CAAC;IACX,IAAI,EAAE,UAAU,GAAG,QAAQ,GAAG,UAAU,CAAC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB,EAAE,MAAM,CAAC;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,OAAO,GAAG,QAAQ,GAAG,UAAU,CAAC;IACxC,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAC;IAChC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACnC,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAC;IAChC,OAAO,EAAE,qBAAqB,CAAC;CAClC"}

package/dist/escrow-crypto.d.ts

@@ -18,13 +18,21 @@ export interface EscrowEnvelope {
     iv: string;
     ciphertext: string;
 }
-/** Recovery share bound to an identity and a positive share version. */
+/** P9.1 (attack C): the app's compiled template languages. Keep in lockstep with
+ * apps/learn-card-app/src/i18n's SUPPORTED_LANGUAGES and the Rust RECOVERY_LANGUAGES. */
+export declare const RECOVERY_LANGUAGES: readonly ["en", "es", "fr", "ar"];
+/** Recovery share bound to an identity and a positive share version.
+ * `recoveryEmail`/`recoveryLanguage`: bound by the user's own device at
+ * enrollment, never by lca-api. Always both-present or both-absent; changing
+ * the address requires a fresh `replace` enrollment, not an edit. */
 export interface EscrowBlobPlaintext {
     version: typeof ESCROW_ENVELOPE_VERSION;
     recoveryShare: string;
     did: string;
     shareVersion: number;
     pinVerifier?: string;
+    recoveryEmail?: string;
+    recoveryLanguage?: string;
 }
 /** Released recovery share additionally bound to its recovery hold. */
 export interface EscrowReleasePlaintext extends EscrowBlobPlaintext {

package/dist/escrow-crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"escrow-crypto.d.ts","sourceRoot":"","sources":["../src/escrow-crypto.ts"],"names":[],"mappings":"AAQA,4CAA4C;AAC5C,eAAO,MAAM,uBAAuB,EAAG,CAAU,CAAC;AAClD,oDAAoD;AACpD,eAAO,MAAM,gBAAgB,EAAG,+BAAwC,CAAC;AACzE,oDAAoD;AACpD,eAAO,MAAM,gBAAgB,6BAA6B,CAAC;AAC3D,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,gCAAgC,CAAC;AACjE,4DAA4D;AAC5D,eAAO,MAAM,oBAAoB,EAAG,QAAiB,CAAC;AAEtD,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC3B,OAAO,EAAE,OAAO,uBAAuB,CAAC;IACxC,SAAS,EAAE,OAAO,gBAAgB,CAAC;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,kBAAkB,EAAE,MAAM,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;CACtB;AAED,wEAAwE;AACxE,MAAM,WAAW,mBAAmB;IAChC,OAAO,EAAE,OAAO,uBAAuB,CAAC;IACxC,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,uEAAuE;AACvE,MAAM,WAAW,sBAAuB,SAAQ,mBAAmB;IAC/D,MAAM,EAAE,MAAM,CAAC;CAClB;AA+BD,wFAAwF;AACxF,eAAO,MAAM,mBAAmB,GAAI,OAAO,OAAO,KAAG,cAkBpD,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,wBAAwB,GAAI,OAAO,OAAO,KAAG,mBA+BzD,CAAC;AAEF,kFAAkF;AAClF,eAAO,MAAM,2BAA2B,GAAI,OAAO,OAAO,KAAG,sBAQ5D,CAAC;AA0BF,8EAA8E;AAC9E,eAAO,MAAM,qBAAqB,QAAa,OAAO,CAAC;IACnD,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACtB,CAUA,CAAC;AA8FF,8EAA8E;AAC9E,eAAO,MAAM,iBAAiB,GAC1B,OAAO,IAAI,CAAC,mBAAmB,EAAE,SAAS,CAAC,EAC3C,yBAAyB,MAAM,EAC/B,OAAO,MAAM,KACd,OAAO,CAAC,cAAc,CASxB,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,iBAAiB,GAC1B,UAAU,OAAO,EACjB,2BAA2B,MAAM,KAClC,OAAO,CAAC,mBAAmB,CAGzB,CAAC;AAEN,wFAAwF;AACxF,eAAO,MAAM,iBAAiB,GAC1B,OAAO,IAAI,CAAC,sBAAsB,EAAE,SAAS,CAAC,EAC9C,iCAAiC,MAAM,KACxC,OAAO,CAAC,cAAc,CASxB,CAAC;AAEF,8FAA8F;AAC9F,eAAO,MAAM,iBAAiB,GAC1B,UAAU,OAAO,EACjB,mCAAmC,MAAM,KAC1C,OAAO,CAAC,sBAAsB,CAG5B,CAAC"}
+{"version":3,"file":"escrow-crypto.d.ts","sourceRoot":"","sources":["../src/escrow-crypto.ts"],"names":[],"mappings":"AAQA,4CAA4C;AAC5C,eAAO,MAAM,uBAAuB,EAAG,CAAU,CAAC;AAClD,oDAAoD;AACpD,eAAO,MAAM,gBAAgB,EAAG,+BAAwC,CAAC;AACzE,oDAAoD;AACpD,eAAO,MAAM,gBAAgB,6BAA6B,CAAC;AAC3D,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,gCAAgC,CAAC;AACjE,4DAA4D;AAC5D,eAAO,MAAM,oBAAoB,EAAG,QAAiB,CAAC;AAEtD,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC3B,OAAO,EAAE,OAAO,uBAAuB,CAAC;IACxC,SAAS,EAAE,OAAO,gBAAgB,CAAC;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,kBAAkB,EAAE,MAAM,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;CACtB;AAED;yFACyF;AACzF,eAAO,MAAM,kBAAkB,mCAAoC,CAAC;AAEpE;;;qEAGqE;AACrE,MAAM,WAAW,mBAAmB;IAChC,OAAO,EAAE,OAAO,uBAAuB,CAAC;IACxC,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,uEAAuE;AACvE,MAAM,WAAW,sBAAuB,SAAQ,mBAAmB;IAC/D,MAAM,EAAE,MAAM,CAAC;CAClB;AA+BD,wFAAwF;AACxF,eAAO,MAAM,mBAAmB,GAAI,OAAO,OAAO,KAAG,cAkBpD,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,wBAAwB,GAAI,OAAO,OAAO,KAAG,mBA4DzD,CAAC;AAEF,kFAAkF;AAClF,eAAO,MAAM,2BAA2B,GAAI,OAAO,OAAO,KAAG,sBAQ5D,CAAC;AA0BF,8EAA8E;AAC9E,eAAO,MAAM,qBAAqB,QAAa,OAAO,CAAC;IACnD,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACtB,CAUA,CAAC;AA8FF,8EAA8E;AAC9E,eAAO,MAAM,iBAAiB,GAC1B,OAAO,IAAI,CAAC,mBAAmB,EAAE,SAAS,CAAC,EAC3C,yBAAyB,MAAM,EAC/B,OAAO,MAAM,KACd,OAAO,CAAC,cAAc,CASxB,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,iBAAiB,GAC1B,UAAU,OAAO,EACjB,2BAA2B,MAAM,KAClC,OAAO,CAAC,mBAAmB,CAGzB,CAAC;AAEN,wFAAwF;AACxF,eAAO,MAAM,iBAAiB,GAC1B,OAAO,IAAI,CAAC,sBAAsB,EAAE,SAAS,CAAC,EAC9C,iCAAiC,MAAM,KACxC,OAAO,CAAC,cAAc,CASxB,CAAC;AAEF,8FAA8F;AAC9F,eAAO,MAAM,iBAAiB,GAC1B,UAAU,OAAO,EACjB,mCAAmC,MAAM,KAC1C,OAAO,CAAC,sBAAsB,CAG5B,CAAC"}

package/dist/escrow-enrollment-intent.d.ts

@@ -0,0 +1,13 @@
+import type { EscrowEnvelope } from './escrow-crypto';
+import type { EscrowEnrollmentIntent, SignedEscrowEnrollmentIntent } from './escrow-enrollment-intent.types';
+export declare const ESCROW_ENROLLMENT_INTENT_DOMAIN = "learncard-escrow-enrollment-intent-v2\0";
+/** Produce the exact Rust-verified V1 message, never JSON or a prehashed signature. */
+export declare const encodeEscrowEnrollmentIntent: (intent: EscrowEnrollmentIntent) => Uint8Array<ArrayBuffer>;
+/** Sign with the account's 32-byte Ed25519 seed. Never needed for recovery itself.
+ * The caller must obtain generation/current version from an attested authority
+ * response and construct the exact operation it intends; signing is not consent UI.
+ */
+export declare const signEscrowEnrollmentIntent: (intent: EscrowEnrollmentIntent, privateKey: string) => Promise<SignedEscrowEnrollmentIntent>;
+/** Canonical blob identity matches Rust, including Q/-Q ECDH equivalence. */
+export declare const getEscrowBlobIdentity: (input: EscrowEnvelope) => Promise<string>;
+//# sourceMappingURL=escrow-enrollment-intent.d.ts.map

package/dist/escrow-enrollment-intent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"escrow-enrollment-intent.d.ts","sourceRoot":"","sources":["../src/escrow-enrollment-intent.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,KAAK,EACR,sBAAsB,EACtB,4BAA4B,EAC/B,MAAM,kCAAkC,CAAC;AAI1C,eAAO,MAAM,+BAA+B,4CAA4C,CAAC;AAkFzF,uFAAuF;AACvF,eAAO,MAAM,4BAA4B,GACrC,QAAQ,sBAAsB,KAC/B,UAAU,CAAC,WAAW,CA8ExB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,0BAA0B,GACnC,QAAQ,sBAAsB,EAC9B,YAAY,MAAM,KACnB,OAAO,CAAC,4BAA4B,CAgBtC,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,qBAAqB,GAAU,OAAO,cAAc,KAAG,OAAO,CAAC,MAAM,CAiCjF,CAAC"}

package/dist/escrow-enrollment-intent.types.d.ts

@@ -0,0 +1,28 @@
+/** V2 owner authorization, distinct from authentication and from recovery. */
+export interface EscrowEnrollmentIntent {
+    version: 2;
+    tenant: string;
+    did: string;
+    authorityGeneration: string;
+    expectedEnrollmentVersion: number;
+    action: 'enroll' | 'replace' | 'disable' | 'carry';
+    sourceBlobIdentity: string | null;
+    targetBlobIdentity: string | null;
+    pinAction: 'set' | 'change' | 'clear' | 'keep';
+    shareVersion: number;
+    enrollmentEpoch: number;
+    requestId: string;
+    allowRewrap: boolean;
+    /** P9.1 (attack C): required (and must match the blob) on enroll/replace;
+     *  must be null on disable/carry (the enclave carries the prior value forward).
+     *  Changing the address requires a fresh signed `replace` intent, not an edit. */
+    recoveryEmail: string | null;
+    /** One of the app's compiled template languages (currently en/es/fr/ar). */
+    recoveryLanguage: string | null;
+}
+/** Signature is canonical padded standard base64 of raw Ed25519 R || S. */
+export interface SignedEscrowEnrollmentIntent {
+    intent: EscrowEnrollmentIntent;
+    signature: string;
+}
+//# sourceMappingURL=escrow-enrollment-intent.types.d.ts.map

package/dist/escrow-enrollment-intent.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"escrow-enrollment-intent.types.d.ts","sourceRoot":"","sources":["../src/escrow-enrollment-intent.types.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,MAAM,WAAW,sBAAsB;IACnC,OAAO,EAAE,CAAC,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,mBAAmB,EAAE,MAAM,CAAC;IAC5B,yBAAyB,EAAE,MAAM,CAAC;IAClC,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;IACnD,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,SAAS,EAAE,KAAK,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;IAC/C,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;IACrB;;sFAEkF;IAClF,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,4EAA4E;IAC5E,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,2EAA2E;AAC3E,MAAM,WAAW,4BAA4B;IACzC,MAAM,EAAE,sBAAsB,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;CACrB"}

package/dist/escrow-nitro-attestation.d.ts

@@ -0,0 +1,34 @@
+import 'reflect-metadata';
+import type { EscrowAttestationPolicy } from './types';
+export type NitroAttestationReason = 'cbor' | 'cose' | 'alg' | 'chain' | 'root' | 'signature' | 'pcr' | 'debug' | 'nonce' | 'freshness' | 'user-data';
+/** A fail-closed attestation failure with a stable, non-sensitive reason. */
+export declare class NitroAttestationError extends Error {
+    readonly reason: NitroAttestationReason;
+    constructor(reason: NitroAttestationReason);
+}
+type NitroPolicy = Extract<EscrowAttestationPolicy, {
+    mode: 'nitro';
+}>;
+/** Verify signed NSM evidence before trusting its P-256 escrow key (not public_key/KMS key). */
+export declare const verifyNitroAttestationDocument: (documentB64: string, { expectedNonce, policy, now, }: {
+    expectedNonce: Uint8Array;
+    policy: NitroPolicy;
+    now?: number;
+}) => Promise<{
+    escrowPublicKeySpkiB64: string;
+    /** P9.1: the enclave's own current keyId, bound inside this same signed
+     * document. `undefined` for the legacy user_data format, which never
+     * carried a keyId — callers must not silently trust a plaintext keyId in
+     * that case any more than they did before this field existed. */
+    keyId: string | undefined;
+    /** P9.1: retired keyIds the enclave still accepts for decrypt only, bound
+     * inside this same signed document. Empty for the legacy user_data format. */
+    previousKeyIds: string[];
+    pcrs: Record<number, string>;
+    timestamp: number;
+    moduleId: string;
+    ledgerPublicKey?: string;
+    measurementHash?: string;
+}>;
+export {};
+//# sourceMappingURL=escrow-nitro-attestation.d.ts.map

package/dist/escrow-nitro-attestation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"escrow-nitro-attestation.d.ts","sourceRoot":"","sources":["../src/escrow-nitro-attestation.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAS1B,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAC;AAEvD,MAAM,MAAM,sBAAsB,GAC5B,MAAM,GACN,MAAM,GACN,KAAK,GACL,OAAO,GACP,MAAM,GACN,WAAW,GACX,KAAK,GACL,OAAO,GACP,OAAO,GACP,WAAW,GACX,WAAW,CAAC;AAElB,6EAA6E;AAC7E,qBAAa,qBAAsB,SAAQ,KAAK;aAChB,MAAM,EAAE,sBAAsB;gBAA9B,MAAM,EAAE,sBAAsB;CAI7D;AAGD,KAAK,WAAW,GAAG,OAAO,CAAC,uBAAuB,EAAE;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC;AAiFvE,gGAAgG;AAChG,eAAO,MAAM,8BAA8B,GACvC,aAAa,MAAM,EACnB,iCAIG;IACC,aAAa,EAAE,UAAU,CAAC;IAC1B,MAAM,EAAE,WAAW,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;CAChB,KACF,OAAO,CAAC;IACP,sBAAsB,EAAE,MAAM,CAAC;IAC/B;;;qEAGiE;IACjE,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B;kFAC8E;IAC9E,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC5B,CA+KA,CAAC"}

package/dist/index.d.ts

@@ -13,9 +13,19 @@ export { EMAIL_RELAY_ALGORITHM, EMAIL_RELAY_ENVELOPE_VERSION, encryptEmailRelayP
 export type { EmailRelayBranding, EmailRelayEnvelope, EmailRelayPlaintext, } from './email-relay-crypto';
 export { ESCROW_ENVELOPE_VERSION, ESCROW_ALGORITHM, ESCROW_BLOB_INFO, ESCROW_RELEASE_INFO, ESCROW_CLIENT_KEY_ID, parseEscrowEnvelope, parseEscrowBlobPlaintext, parseEscrowReleasePlaintext, generateEscrowKeyPair, encryptEscrowBlob, decryptEscrowBlob, sealEscrowRelease, openEscrowRelease, } from './escrow-crypto';
 export type { EscrowEnvelope, EscrowBlobPlaintext, EscrowReleasePlaintext } from './escrow-crypto';
+export { encodeEscrowEnrollmentIntent, signEscrowEnrollmentIntent, getEscrowBlobIdentity, ESCROW_ENROLLMENT_INTENT_DOMAIN, } from './escrow-enrollment-intent';
+export type { EscrowEnrollmentIntent, SignedEscrowEnrollmentIntent, } from './escrow-enrollment-intent.types';
 export { verifyEnclaveAttestation } from './escrow-attestation';
+export { EscrowEvidenceError } from './escrow-authority.types';
+export type { HistoricalEscrowEvidence } from './escrow-authority.types';
+export type { EscrowRecoveryExpectations } from '@learncard/types';
+export { verifyEscrowAuthorityState, verifyEscrowEnrollmentCommit, createEscrowEnrollmentIntent, resolveEscrowEnrollmentAction, violatesCarryContactRule, } from './escrow-authority';
+export type { EscrowEnrollmentActionInput } from './escrow-authority';
+export type { VerifiedEnclaveIdentity, EscrowAuthorityRecord, EscrowAuthorityState, VerifiedEscrowMutation, } from './escrow-authority.types';
+export { verifyNitroAttestationDocument, NitroAttestationError } from './escrow-nitro-attestation';
+export type { NitroAttestationReason } from './escrow-nitro-attestation';
 export type { EscrowAttestationPolicy, EscrowHoldStatus, EscrowRecoveryStart } from './types';
-export type { EscrowEnrollmentOptions, EscrowEnrollmentState, EscrowPinStatus } from './types';
+export type { EscrowEnrollmentOptions, EscrowEnrollmentState, EscrowBlobStaleReason, EscrowPinStatus, } from './types';
 export { EscrowPinMismatchError, EscrowPinLockedError, EscrowPinThrottledError, EscrowHoldRestartThrottledError, EscrowPinUnavailableError, } from './types';
 export { PIN_MIN_LENGTH, PIN_MAX_LENGTH, ESCROW_PIN_MAX_ATTEMPTS, normalizePin, validatePin, generatePinSalt, derivePinProof, constantTimeEqualHex, } from './escrow-pin';
 export { createPasskeyCredential, deriveKeyFromPasskey, encryptShareWithPasskey, decryptShareWithPasskey, isWebAuthnSupported, isPRFSupported, } from './passkey';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,EACH,eAAe,EACf,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,aAAa,GAChB,MAAM,OAAO,CAAC;AAEf,OAAO,EACH,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,GACxB,MAAM,WAAW,CAAC;AAEnB,YAAY,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAElD,OAAO,EACH,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,yBAAyB,EACzB,UAAU,EACV,UAAU,EACV,cAAc,EACd,cAAc,EACd,kBAAkB,GACrB,MAAM,UAAU,CAAC;AAElB,OAAO,EACH,qBAAqB,EACrB,4BAA4B,EAC5B,wBAAwB,EACxB,wBAAwB,EACxB,kCAAkC,EAClC,uBAAuB,EACvB,wBAAwB,GAC3B,MAAM,sBAAsB,CAAC;AAE9B,YAAY,EACR,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,GACtB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACH,uBAAuB,EACvB,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,EACxB,2BAA2B,EAC3B,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,GACpB,MAAM,iBAAiB,CAAC;AAEzB,YAAY,EAAE,cAAc,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACnG,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,YAAY,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAC9F,YAAY,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/F,OAAO,EACH,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,EACvB,+BAA+B,EAC/B,yBAAyB,GAC5B,MAAM,SAAS,CAAC;AACjB,OAAO,EACH,cAAc,EACd,cAAc,EACd,uBAAuB,EACvB,YAAY,EACZ,WAAW,EACX,eAAe,EACf,cAAc,EACd,oBAAoB,GACvB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACH,uBAAuB,EACvB,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,cAAc,GACjB,MAAM,WAAW,CAAC;AAEnB,YAAY,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAE1E,OAAO,EACH,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACtB,UAAU,EACV,mCAAmC,GACtC,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,OAAO,EACH,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,sBAAsB,EACtB,iBAAiB,EACjB,uBAAuB,GAC1B,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACR,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,GACpB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACH,iBAAiB,EACjB,oCAAoC,EACpC,kBAAkB,GACrB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAE7E,OAAO,EACH,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,GAC3B,MAAM,aAAa,CAAC;AAErB,YAAY,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAE3E,OAAO,EACH,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,GAC5B,MAAM,YAAY,CAAC;AAEpB,YAAY,EACR,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,SAAS,EACT,UAAU,EACV,mBAAmB,GACtB,MAAM,YAAY,CAAC;AAMpB,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAE3C,YAAY,EACR,mBAAmB,EACnB,wBAAwB,EACxB,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,EACxB,eAAe,EACf,YAAY,EACZ,QAAQ,EACR,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,yBAAyB,EACzB,qBAAqB,EACrB,wBAAwB,EACxB,4BAA4B,EAC5B,aAAa,EACb,UAAU,EACV,cAAc,EACd,oBAAoB,EACpB,aAAa,EACb,mBAAmB,GACtB,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,EACH,eAAe,EACf,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,aAAa,GAChB,MAAM,OAAO,CAAC;AAEf,OAAO,EACH,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,GACxB,MAAM,WAAW,CAAC;AAEnB,YAAY,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAElD,OAAO,EACH,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,yBAAyB,EACzB,UAAU,EACV,UAAU,EACV,cAAc,EACd,cAAc,EACd,kBAAkB,GACrB,MAAM,UAAU,CAAC;AAElB,OAAO,EACH,qBAAqB,EACrB,4BAA4B,EAC5B,wBAAwB,EACxB,wBAAwB,EACxB,kCAAkC,EAClC,uBAAuB,EACvB,wBAAwB,GAC3B,MAAM,sBAAsB,CAAC;AAE9B,YAAY,EACR,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,GACtB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACH,uBAAuB,EACvB,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,EACxB,2BAA2B,EAC3B,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,GACpB,MAAM,iBAAiB,CAAC;AAEzB,YAAY,EAAE,cAAc,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACnG,OAAO,EACH,4BAA4B,EAC5B,0BAA0B,EAC1B,qBAAqB,EACrB,+BAA+B,GAClC,MAAM,4BAA4B,CAAC;AACpC,YAAY,EACR,sBAAsB,EACtB,4BAA4B,GAC/B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,YAAY,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACzE,YAAY,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EACH,0BAA0B,EAC1B,4BAA4B,EAC5B,4BAA4B,EAC5B,6BAA6B,EAC7B,wBAAwB,GAC3B,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACtE,YAAY,EACR,uBAAuB,EACvB,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,GACzB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,8BAA8B,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnG,YAAY,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACzE,YAAY,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAC9F,YAAY,EACR,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,GAClB,MAAM,SAAS,CAAC;AACjB,OAAO,EACH,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,EACvB,+BAA+B,EAC/B,yBAAyB,GAC5B,MAAM,SAAS,CAAC;AACjB,OAAO,EACH,cAAc,EACd,cAAc,EACd,uBAAuB,EACvB,YAAY,EACZ,WAAW,EACX,eAAe,EACf,cAAc,EACd,oBAAoB,GACvB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACH,uBAAuB,EACvB,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,cAAc,GACjB,MAAM,WAAW,CAAC;AAEnB,YAAY,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAE1E,OAAO,EACH,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACtB,UAAU,EACV,mCAAmC,GACtC,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,OAAO,EACH,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,sBAAsB,EACtB,iBAAiB,EACjB,uBAAuB,GAC1B,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACR,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,GACpB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACH,iBAAiB,EACjB,oCAAoC,EACpC,kBAAkB,GACrB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAE7E,OAAO,EACH,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,GAC3B,MAAM,aAAa,CAAC;AAErB,YAAY,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAE3E,OAAO,EACH,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,GAC5B,MAAM,YAAY,CAAC;AAEpB,YAAY,EACR,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,SAAS,EACT,UAAU,EACV,mBAAmB,GACtB,MAAM,YAAY,CAAC;AAMpB,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAE3C,YAAY,EACR,mBAAmB,EACnB,wBAAwB,EACxB,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,EACxB,eAAe,EACf,YAAY,EACZ,QAAQ,EACR,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,yBAAyB,EACzB,qBAAqB,EACrB,wBAAwB,EACxB,4BAA4B,EAC5B,aAAa,EACb,UAAU,EACV,cAAc,EACd,oBAAoB,EACpB,aAAa,EACb,mBAAmB,GACtB,MAAM,SAAS,CAAC"}