@learncard/sss-key-manager 0.2.1 → 0.2.2

package/dist/sss-key-manager.cjs.development.js

@@ -574,7 +574,7 @@ var require_types_cjs_development = __commonJS({
       _function: /* @__PURE__ */ __name(() => _function, "_function"),
       any: /* @__PURE__ */ __name(() => any, "any"),
       array: /* @__PURE__ */ __name(() => array, "array"),
-      base64: /* @__PURE__ */ __name(() => base642, "base64"),
+      base64: /* @__PURE__ */ __name(() => base6422, "base64"),
       base64url: /* @__PURE__ */ __name(() => base64url2, "base64url"),
       bigint: /* @__PURE__ */ __name(() => bigint2, "bigint"),
       boolean: /* @__PURE__ */ __name(() => boolean2, "boolean"),
@@ -615,7 +615,7 @@ var require_types_cjs_development = __commonJS({
       gt: /* @__PURE__ */ __name(() => _gt, "gt"),
       gte: /* @__PURE__ */ __name(() => _gte, "gte"),
       guid: /* @__PURE__ */ __name(() => guid2, "guid"),
-      hash: /* @__PURE__ */ __name(() => hash, "hash"),
+      hash: /* @__PURE__ */ __name(() => hash2, "hash"),
       hex: /* @__PURE__ */ __name(() => hex22, "hex"),
       hostname: /* @__PURE__ */ __name(() => hostname2, "hostname"),
       httpUrl: /* @__PURE__ */ __name(() => httpUrl, "httpUrl"),
@@ -664,7 +664,7 @@ var require_types_cjs_development = __commonJS({
       nullable: /* @__PURE__ */ __name(() => nullable, "nullable"),
       nullish: /* @__PURE__ */ __name(() => nullish2, "nullish"),
       number: /* @__PURE__ */ __name(() => number2, "number"),
-      object: /* @__PURE__ */ __name(() => object, "object"),
+      object: /* @__PURE__ */ __name(() => object2, "object"),
       optional: /* @__PURE__ */ __name(() => optional, "optional"),
       overwrite: /* @__PURE__ */ __name(() => _overwrite, "overwrite"),
       parse: /* @__PURE__ */ __name(() => parse2, "parse"),
@@ -1003,7 +1003,7 @@ var require_types_cjs_development = __commonJS({
       util: /* @__PURE__ */ __name(() => util_exports, "util"),
       version: /* @__PURE__ */ __name(() => version, "version")
     });
-    var _a;
+    var _a2;
     var NEVER = /* @__PURE__ */ Object.freeze({
       status: "aborted"
     });
@@ -1026,9 +1026,9 @@ var require_types_cjs_development = __commonJS({
         inst._zod.traits.add(name);
         initializer3(inst, def);
         const proto = _.prototype;
-        const keys = Object.keys(proto);
-        for (let i = 0; i < keys.length; i++) {
-          const k = keys[i];
+        const keys2 = Object.keys(proto);
+        for (let i = 0; i < keys2.length; i++) {
+          const k = keys2[i];
           if (!(k in inst)) {
             inst[k] = proto[k].bind(inst);
           }
@@ -1095,7 +1095,7 @@ var require_types_cjs_development = __commonJS({
         this.name = "ZodEncodeError";
       }
     };
-    (_a = globalThis).__zod_globalConfig ?? (_a.__zod_globalConfig = {});
+    (_a2 = globalThis).__zod_globalConfig ?? (_a2.__zod_globalConfig = {});
     var globalConfig = globalThis.__zod_globalConfig;
     function config(newConfig) {
       if (newConfig)
@@ -1250,9 +1250,9 @@ var require_types_cjs_development = __commonJS({
     __name(floatSafeRemainder, "floatSafeRemainder");
     __name2(floatSafeRemainder, "floatSafeRemainder");
     var EVALUATING = /* @__PURE__ */ Symbol("evaluating");
-    function defineLazy(object2, key, getter) {
+    function defineLazy(object22, key, getter) {
       let value = void 0;
-      Object.defineProperty(object2, key, {
+      Object.defineProperty(object22, key, {
         get() {
           if (value === EVALUATING) {
             return void 0;
@@ -1264,7 +1264,7 @@ var require_types_cjs_development = __commonJS({
           return value;
         },
         set(v) {
-          Object.defineProperty(object2, key, {
+          Object.defineProperty(object22, key, {
             value: v
             // configurable: true,
           });
@@ -1312,12 +1312,12 @@ var require_types_cjs_development = __commonJS({
     __name(getElementAtPath, "getElementAtPath");
     __name2(getElementAtPath, "getElementAtPath");
     function promiseAllObject(promisesObj) {
-      const keys = Object.keys(promisesObj);
-      const promises = keys.map((key) => promisesObj[key]);
+      const keys2 = Object.keys(promisesObj);
+      const promises = keys2.map((key) => promisesObj[key]);
       return Promise.all(promises).then((results) => {
         const resolvedObj = {};
-        for (let i = 0; i < keys.length; i++) {
-          resolvedObj[keys[i]] = results[i];
+        for (let i = 0; i < keys2.length; i++) {
+          resolvedObj[keys2[i]] = results[i];
         }
         return resolvedObj;
       });
@@ -1857,18 +1857,18 @@ var require_types_cjs_development = __commonJS({
     __name2(cleanEnum, "cleanEnum");
     function base64ToUint8Array(base643) {
       const binaryString = atob(base643);
-      const bytes2 = new Uint8Array(binaryString.length);
+      const bytes3 = new Uint8Array(binaryString.length);
       for (let i = 0; i < binaryString.length; i++) {
-        bytes2[i] = binaryString.charCodeAt(i);
+        bytes3[i] = binaryString.charCodeAt(i);
       }
-      return bytes2;
+      return bytes3;
     }
     __name(base64ToUint8Array, "base64ToUint8Array");
     __name2(base64ToUint8Array, "base64ToUint8Array");
-    function uint8ArrayToBase64(bytes2) {
+    function uint8ArrayToBase64(bytes3) {
       let binaryString = "";
-      for (let i = 0; i < bytes2.length; i++) {
-        binaryString += String.fromCharCode(bytes2[i]);
+      for (let i = 0; i < bytes3.length; i++) {
+        binaryString += String.fromCharCode(bytes3[i]);
       }
       return btoa(binaryString);
     }
@@ -1881,8 +1881,8 @@ var require_types_cjs_development = __commonJS({
     }
     __name(base64urlToUint8Array, "base64urlToUint8Array");
     __name2(base64urlToUint8Array, "base64urlToUint8Array");
-    function uint8ArrayToBase64url(bytes2) {
-      return uint8ArrayToBase64(bytes2).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+    function uint8ArrayToBase64url(bytes3) {
+      return uint8ArrayToBase64(bytes3).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
     }
     __name(uint8ArrayToBase64url, "uint8ArrayToBase64url");
     __name2(uint8ArrayToBase64url, "uint8ArrayToBase64url");
@@ -1891,16 +1891,16 @@ var require_types_cjs_development = __commonJS({
       if (cleanHex.length % 2 !== 0) {
         throw new Error("Invalid hex string length");
       }
-      const bytes2 = new Uint8Array(cleanHex.length / 2);
+      const bytes3 = new Uint8Array(cleanHex.length / 2);
       for (let i = 0; i < cleanHex.length; i += 2) {
-        bytes2[i / 2] = Number.parseInt(cleanHex.slice(i, i + 2), 16);
+        bytes3[i / 2] = Number.parseInt(cleanHex.slice(i, i + 2), 16);
       }
-      return bytes2;
+      return bytes3;
     }
     __name(hexToUint8Array, "hexToUint8Array");
     __name2(hexToUint8Array, "hexToUint8Array");
-    function uint8ArrayToHex(bytes2) {
-      return Array.from(bytes2).map((b) => b.toString(16).padStart(2, "0")).join("");
+    function uint8ArrayToHex(bytes3) {
+      return Array.from(bytes3).map((b) => b.toString(16).padStart(2, "0")).join("");
     }
     __name(uint8ArrayToHex, "uint8ArrayToHex");
     __name2(uint8ArrayToHex, "uint8ArrayToHex");
@@ -2149,7 +2149,7 @@ var require_types_cjs_development = __commonJS({
     var safeDecodeAsync = /* @__PURE__ */ _safeDecodeAsync($ZodRealError);
     var regexes_exports = {};
     __export2(regexes_exports, {
-      base64: /* @__PURE__ */ __name(() => base64, "base64"),
+      base64: /* @__PURE__ */ __name(() => base642, "base64"),
       base64url: /* @__PURE__ */ __name(() => base64url, "base64url"),
       bigint: /* @__PURE__ */ __name(() => bigint, "bigint"),
       boolean: /* @__PURE__ */ __name(() => boolean, "boolean"),
@@ -2172,7 +2172,7 @@ var require_types_cjs_development = __commonJS({
       html5Email: /* @__PURE__ */ __name(() => html5Email, "html5Email"),
       httpProtocol: /* @__PURE__ */ __name(() => httpProtocol, "httpProtocol"),
       idnEmail: /* @__PURE__ */ __name(() => idnEmail, "idnEmail"),
-      integer: /* @__PURE__ */ __name(() => integer, "integer"),
+      integer: /* @__PURE__ */ __name(() => integer3, "integer"),
       ipv4: /* @__PURE__ */ __name(() => ipv4, "ipv4"),
       ipv6: /* @__PURE__ */ __name(() => ipv6, "ipv6"),
       ksuid: /* @__PURE__ */ __name(() => ksuid, "ksuid"),
@@ -2246,7 +2246,7 @@ var require_types_cjs_development = __commonJS({
     }, "mac");
     var cidrv4 = /^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$/;
     var cidrv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::|([0-9a-fA-F]{1,4})?::([0-9a-fA-F]{1,4}:?){0,6})\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/;
-    var base64 = /^$|^(?:[0-9a-zA-Z+/]{4})*(?:(?:[0-9a-zA-Z+/]{2}==)|(?:[0-9a-zA-Z+/]{3}=))?$/;
+    var base642 = /^$|^(?:[0-9a-zA-Z+/]{4})*(?:(?:[0-9a-zA-Z+/]{2}==)|(?:[0-9a-zA-Z+/]{3}=))?$/;
     var base64url = /^[A-Za-z0-9_-]*$/;
     var hostname = /^(?=.{1,253}\.?$)[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[-0-9a-zA-Z]{0,61}[0-9a-zA-Z])?)*\.?$/;
     var domain = /^([a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$/;
@@ -2283,7 +2283,7 @@ var require_types_cjs_development = __commonJS({
       return new RegExp(`^${regex}$`);
     }, "string");
     var bigint = /^-?\d+n?$/;
-    var integer = /^-?\d+$/;
+    var integer3 = /^-?\d+$/;
     var number = /^-?\d+(?:\.\d+)?$/;
     var boolean = /^(?:true|false)$/i;
     var _null = /^null$/i;
@@ -2417,7 +2417,7 @@ var require_types_cjs_development = __commonJS({
         bag.minimum = minimum;
         bag.maximum = maximum;
         if (isInt)
-          bag.pattern = integer;
+          bag.pattern = integer3;
       });
       inst._zod.check = (payload) => {
         const input = payload.value;
@@ -3257,7 +3257,7 @@ var require_types_cjs_development = __commonJS({
     __name(isValidBase64, "isValidBase64");
     __name2(isValidBase64, "isValidBase64");
     var $ZodBase64 = /* @__PURE__ */ $constructor("$ZodBase64", (inst, def) => {
-      def.pattern ?? (def.pattern = base64);
+      def.pattern ?? (def.pattern = base642);
       $ZodStringFormat.init(inst, def);
       inst._zod.bag.contentEncoding = "base64";
       inst._zod.check = (payload) => {
@@ -3603,8 +3603,8 @@ var require_types_cjs_development = __commonJS({
     __name(handlePropertyResult, "handlePropertyResult");
     __name2(handlePropertyResult, "handlePropertyResult");
     function normalizeDef(def) {
-      const keys = Object.keys(def.shape);
-      for (const k of keys) {
+      const keys2 = Object.keys(def.shape);
+      for (const k of keys2) {
         if (!def.shape?.[k]?._zod?.traits?.has("$ZodType")) {
           throw new Error(`Invalid element at key "${k}": expected a Zod schema`);
         }
@@ -3612,9 +3612,9 @@ var require_types_cjs_development = __commonJS({
       const okeys = optionalKeys(def.shape);
       return {
         ...def,
-        keys,
-        keySet: new Set(keys),
-        numKeys: keys.length,
+        keys: keys2,
+        keySet: new Set(keys2),
+        numKeys: keys2.length,
         optionalKeys: new Set(okeys)
       };
     }
@@ -8376,8 +8376,8 @@ var require_types_cjs_development = __commonJS({
     }
     __name(ko_default, "ko_default");
     __name2(ko_default, "default");
-    var capitalizeFirstCharacter = /* @__PURE__ */ __name2((text) => {
-      return text.charAt(0).toUpperCase() + text.slice(1);
+    var capitalizeFirstCharacter = /* @__PURE__ */ __name2((text2) => {
+      return text2.charAt(0).toUpperCase() + text2.slice(1);
     }, "capitalizeFirstCharacter");
     function getUnitTypeFromNumber(number4) {
       const abs = Math.abs(number4);
@@ -11109,7 +11109,7 @@ var require_types_cjs_development = __commonJS({
     }
     __name(yo_default, "yo_default");
     __name2(yo_default, "default");
-    var _a2;
+    var _a22;
     var $output = /* @__PURE__ */ Symbol("ZodOutput");
     var $input = /* @__PURE__ */ Symbol("ZodInput");
     var $ZodRegistry = class {
@@ -11163,7 +11163,7 @@ var require_types_cjs_development = __commonJS({
     }
     __name(registry, "registry");
     __name2(registry, "registry");
-    (_a2 = globalThis).__zod_globalRegistry ?? (_a2.__zod_globalRegistry = registry());
+    (_a22 = globalThis).__zod_globalRegistry ?? (_a22.__zod_globalRegistry = registry());
     var globalRegistry = globalThis.__zod_globalRegistry;
     // @__NO_SIDE_EFFECTS__
     function _string(Class2, params) {
@@ -13497,7 +13497,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       _function: /* @__PURE__ */ __name(() => _function, "_function"),
       any: /* @__PURE__ */ __name(() => any, "any"),
       array: /* @__PURE__ */ __name(() => array, "array"),
-      base64: /* @__PURE__ */ __name(() => base642, "base64"),
+      base64: /* @__PURE__ */ __name(() => base6422, "base64"),
       base64url: /* @__PURE__ */ __name(() => base64url2, "base64url"),
       bigint: /* @__PURE__ */ __name(() => bigint2, "bigint"),
       boolean: /* @__PURE__ */ __name(() => boolean2, "boolean"),
@@ -13522,7 +13522,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       float64: /* @__PURE__ */ __name(() => float64, "float64"),
       function: /* @__PURE__ */ __name(() => _function, "function"),
       guid: /* @__PURE__ */ __name(() => guid2, "guid"),
-      hash: /* @__PURE__ */ __name(() => hash, "hash"),
+      hash: /* @__PURE__ */ __name(() => hash2, "hash"),
       hex: /* @__PURE__ */ __name(() => hex22, "hex"),
       hostname: /* @__PURE__ */ __name(() => hostname2, "hostname"),
       httpUrl: /* @__PURE__ */ __name(() => httpUrl, "httpUrl"),
@@ -13554,7 +13554,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       nullable: /* @__PURE__ */ __name(() => nullable, "nullable"),
       nullish: /* @__PURE__ */ __name(() => nullish2, "nullish"),
       number: /* @__PURE__ */ __name(() => number2, "number"),
-      object: /* @__PURE__ */ __name(() => object, "object"),
+      object: /* @__PURE__ */ __name(() => object2, "object"),
       optional: /* @__PURE__ */ __name(() => optional, "optional"),
       partialRecord: /* @__PURE__ */ __name(() => partialRecord, "partialRecord"),
       pipe: /* @__PURE__ */ __name(() => pipe, "pipe"),
@@ -14155,11 +14155,11 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       $ZodBase64.init(inst, def);
       ZodStringFormat.init(inst, def);
     });
-    function base642(params) {
+    function base6422(params) {
       return /* @__PURE__ */ _base64(ZodBase64, params);
     }
-    __name(base642, "base642");
-    __name2(base642, "base64");
+    __name(base6422, "base642");
+    __name2(base6422, "base64");
     var ZodBase64URL = /* @__PURE__ */ $constructor("ZodBase64URL", (inst, def) => {
       $ZodBase64URL.init(inst, def);
       ZodStringFormat.init(inst, def);
@@ -14206,7 +14206,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
     }
     __name(hex22, "hex2");
     __name2(hex22, "hex");
-    function hash(alg, params) {
+    function hash2(alg, params) {
       const enc = params?.enc ?? "hex";
       const format = `${alg}_${enc}`;
       const regex = regexes_exports[format];
@@ -14214,8 +14214,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
         throw new Error(`Unrecognized hash format: ${format}`);
       return /* @__PURE__ */ _stringFormat(ZodCustomStringFormat, format, regex, params);
     }
-    __name(hash, "hash");
-    __name2(hash, "hash");
+    __name(hash2, "hash");
+    __name2(hash2, "hash");
     var ZodNumber = /* @__PURE__ */ $constructor("ZodNumber", (inst, def) => {
       $ZodNumber.init(inst, def);
       ZodType.init(inst, def);
@@ -14527,7 +14527,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
         }
       });
     });
-    function object(shape, params) {
+    function object2(shape, params) {
       const def = {
         type: "object",
         shape: shape ?? {},
@@ -14535,8 +14535,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       };
       return new ZodObject(def);
     }
-    __name(object, "object");
-    __name2(object, "object");
+    __name(object2, "object");
+    __name2(object2, "object");
     function strictObject(shape, params) {
       return new ZodObject({
         type: "object",
@@ -14731,11 +14731,11 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       inst._zod.processJSONSchema = (ctx, json2, params) => enumProcessor(inst, ctx, json2, params);
       inst.enum = def.entries;
       inst.options = Object.values(def.entries);
-      const keys = new Set(Object.keys(def.entries));
+      const keys2 = new Set(Object.keys(def.entries));
       inst.extract = (values, params) => {
         const newEntries = {};
         for (const value of values) {
-          if (keys.has(value)) {
+          if (keys2.has(value)) {
             newEntries[value] = def.entries[value];
           } else
             throw new Error(`Key ${value} not found in enum`);
@@ -14750,7 +14750,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       inst.exclude = (values, params) => {
         const newEntries = { ...def.entries };
         for (const value of values) {
-          if (keys.has(value)) {
+          if (keys2.has(value)) {
             delete newEntries[value];
           } else
             throw new Error(`Key ${value} not found in enum`);
@@ -15886,7 +15886,18 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       verificationMethod: external_exports.string(),
       jws: external_exports.string().optional()
     }).catchall(external_exports.any()).superRefine((proof, ctx) => {
-      if (proof.created === void 0 && (proof.type !== "DataIntegrityProof" || proof.cryptosuite !== "ecdsa-rdfc-2019")) {
+      if (proof.created === void 0 && // These standardized Data Integrity suites make created optional.
+      // Keep the prior requirement for legacy and unknown proof suites.
+      // https://www.w3.org/TR/vc-di-eddsa/#proof-configuration-eddsa-jcs-2022
+      // https://www.w3.org/TR/vc-di-bbs/#proof-configuration
+      (proof.type !== "DataIntegrityProof" || ![
+        "ecdsa-rdfc-2019",
+        "ecdsa-jcs-2019",
+        "ecdsa-sd-2023",
+        "eddsa-rdfc-2022",
+        "eddsa-jcs-2022",
+        "bbs-2023"
+      ].includes(proof.cryptosuite))) {
         ctx.addIssue({
           code: "custom",
           path: ["created"],
@@ -18525,12 +18536,12 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       }
       return table;
     })();
-    var encodeBase64Url = /* @__PURE__ */ __name2((bytes2) => {
+    var encodeBase64Url = /* @__PURE__ */ __name2((bytes3) => {
       let output = "";
-      for (let index = 0; index < bytes2.length; index += 3) {
-        const first = bytes2[index];
-        const second = bytes2[index + 1];
-        const third = bytes2[index + 2];
+      for (let index = 0; index < bytes3.length; index += 3) {
+        const first = bytes3[index];
+        const second = bytes3[index + 1];
+        const third = bytes3[index + 2];
         output += BASE64URL_ALPHABET[first >> 2];
         output += BASE64URL_ALPHABET[(first & 3) << 4 | (second ?? 0) >> 4];
         if (second === void 0) break;
@@ -18571,8 +18582,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
     }, "isCanonicalBase64Url");
     var decodedBase64UrlByteLength = /* @__PURE__ */ __name2((value) => decodeBase64Url(value)?.length ?? null, "decodedBase64UrlByteLength");
     var utf8ByteLength = /* @__PURE__ */ __name2((value) => new TextEncoder().encode(value).length, "utf8ByteLength");
-    var canonicalBase64Url = /* @__PURE__ */ __name2((bytes2) => external_exports.string().refine((value) => isCanonicalBase64Url(value, bytes2), {
-      message: `must be canonical base64url for exactly ${bytes2} bytes`
+    var canonicalBase64Url = /* @__PURE__ */ __name2((bytes3) => external_exports.string().refine((value) => isCanonicalBase64Url(value, bytes3), {
+      message: `must be canonical base64url for exactly ${bytes3} bytes`
     }), "canonicalBase64Url");
     var ShareLinkIdValidator = canonicalBase64Url(SHARE_LINK_ID_BYTES);
     var ShareContentKeyValidator = canonicalBase64Url(SHARE_CONTENT_KEY_BYTES);
@@ -19025,9 +19036,11 @@ __export(index_exports, {
   ESCROW_ALGORITHM: () => ESCROW_ALGORITHM,
   ESCROW_BLOB_INFO: () => ESCROW_BLOB_INFO,
   ESCROW_CLIENT_KEY_ID: () => ESCROW_CLIENT_KEY_ID,
+  ESCROW_ENROLLMENT_INTENT_DOMAIN: () => ESCROW_ENROLLMENT_INTENT_DOMAIN,
   ESCROW_ENVELOPE_VERSION: () => ESCROW_ENVELOPE_VERSION,
   ESCROW_PIN_MAX_ATTEMPTS: () => ESCROW_PIN_MAX_ATTEMPTS,
   ESCROW_RELEASE_INFO: () => ESCROW_RELEASE_INFO,
+  EscrowEvidenceError: () => EscrowEvidenceError,
   EscrowHoldRestartThrottledError: () => EscrowHoldRestartThrottledError,
   EscrowPinLockedError: () => EscrowPinLockedError,
   EscrowPinMismatchError: () => EscrowPinMismatchError,
@@ -19055,6 +19068,7 @@ __export(index_exports, {
   constantTimeEqualHex: () => constantTimeEqualHex,
   countWords: () => countWords,
   createAdaptiveStorage: () => createAdaptiveStorage,
+  createEscrowEnrollmentIntent: () => createEscrowEnrollmentIntent,
   createPasskeyCredential: () => createPasskeyCredential,
   createQrLoginSession: () => createQrLoginSession,
   createSSSKeyManager: () => createSSSKeyManager,
@@ -19068,6 +19082,7 @@ __export(index_exports, {
   deriveKeyFromPasskey: () => deriveKeyFromPasskey,
   deriveKeyFromPassword: () => deriveKeyFromPassword,
   derivePinProof: () => derivePinProof,
+  encodeEscrowEnrollmentIntent: () => encodeEscrowEnrollmentIntent,
   encryptEmailRelayPayload: () => encryptEmailRelayPayload,
   encryptEscrowBlob: () => encryptEscrowBlob,
   encryptShareForTransfer: () => encryptShareForTransfer,
@@ -19080,6 +19095,7 @@ __export(index_exports, {
   generatePinSalt: () => generatePinSalt,
   generateRecoveryPhrase: () => generateRecoveryPhrase,
   getDeviceShare: () => getDeviceShare,
+  getEscrowBlobIdentity: () => getEscrowBlobIdentity,
   getQrLoginSessionInfo: () => getQrLoginSessionInfo,
   getShareVersion: () => getShareVersion,
   hasDeviceShare: () => hasDeviceShare,
@@ -19101,9 +19117,11 @@ __export(index_exports, {
   reconstructFromShares: () => reconstructFromShares,
   reconstructPrivateKey: () => reconstructPrivateKey,
   recoveryPhraseToShare: () => recoveryPhraseToShare,
+  resolveEscrowEnrollmentAction: () => resolveEscrowEnrollmentAction,
   sealEscrowRelease: () => sealEscrowRelease,
   setPublicComputerMode: () => setPublicComputerMode,
   shareToRecoveryPhrase: () => shareToRecoveryPhrase,
+  signEscrowEnrollmentIntent: () => signEscrowEnrollmentIntent,
   splitAndVerify: () => splitAndVerify,
   splitPrivateKey: () => splitPrivateKey,
   storeDeviceShare: () => storeDeviceShare,
@@ -19111,8 +19129,11 @@ __export(index_exports, {
   validatePin: () => validatePin,
   validateRecoveryPhrase: () => validateRecoveryPhrase,
   verifyEnclaveAttestation: () => verifyEnclaveAttestation,
+  verifyEscrowAuthorityState: () => verifyEscrowAuthorityState,
+  verifyEscrowEnrollmentCommit: () => verifyEscrowEnrollmentCommit,
   verifyNitroAttestationDocument: () => verifyNitroAttestationDocument,
-  verifyStoredShares: () => verifyStoredShares
+  verifyStoredShares: () => verifyStoredShares,
+  violatesCarryContactRule: () => violatesCarryContactRule
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -19273,37 +19294,37 @@ var DEFAULT_KDF_PARAMS = {
   parallelism: ARGON2_PARALLELISM
 };
 function bufferToBase64(buf) {
-  const bytes2 = new Uint8Array(buf);
+  const bytes3 = new Uint8Array(buf);
   let binary = "";
-  for (let i = 0; i < bytes2.byteLength; i++) {
-    binary += String.fromCharCode(bytes2[i]);
+  for (let i = 0; i < bytes3.byteLength; i++) {
+    binary += String.fromCharCode(bytes3[i]);
   }
   return btoa(binary);
 }
 __name(bufferToBase64, "bufferToBase64");
 function base64ToBuffer(b64) {
   const binary = atob(b64);
-  const bytes2 = new Uint8Array(binary.length);
+  const bytes3 = new Uint8Array(binary.length);
   for (let i = 0; i < binary.length; i++) {
-    bytes2[i] = binary.charCodeAt(i);
+    bytes3[i] = binary.charCodeAt(i);
   }
-  return bytes2;
+  return bytes3;
 }
 __name(base64ToBuffer, "base64ToBuffer");
 function hexToBytes(hex2) {
-  const bytes2 = new Uint8Array(hex2.length / 2);
+  const bytes3 = new Uint8Array(hex2.length / 2);
   for (let i = 0; i < hex2.length; i += 2) {
-    bytes2[i / 2] = parseInt(hex2.slice(i, i + 2), 16);
+    bytes3[i / 2] = parseInt(hex2.slice(i, i + 2), 16);
   }
-  return bytes2;
+  return bytes3;
 }
 __name(hexToBytes, "hexToBytes");
-function bytesToHex(bytes2) {
-  return Array.from(bytes2).map((b) => b.toString(16).padStart(2, "0")).join("");
+function bytesToHex(bytes3) {
+  return Array.from(bytes3).map((b) => b.toString(16).padStart(2, "0")).join("");
 }
 __name(bytesToHex, "bytesToHex");
 async function deriveKeyFromPassword(password, salt, params = DEFAULT_KDF_PARAMS) {
-  const hash = await (0, import_hash_wasm.argon2id)({
+  const hash2 = await (0, import_hash_wasm.argon2id)({
     password,
     salt,
     iterations: params.timeCost,
@@ -19312,7 +19333,7 @@ async function deriveKeyFromPassword(password, salt, params = DEFAULT_KDF_PARAMS
     hashLength: ARGON2_HASH_LENGTH,
     outputType: "binary"
   });
-  return Uint8Array.from(hash);
+  return Uint8Array.from(hash2);
 }
 __name(deriveKeyFromPassword, "deriveKeyFromPassword");
 async function encryptWithPassword(plaintext, password) {
@@ -19466,21 +19487,21 @@ async function getOrCreateMasterKey() {
 }
 __name(getOrCreateMasterKey, "getOrCreateMasterKey");
 function bufferToBase642(buf) {
-  const bytes2 = new Uint8Array(buf);
+  const bytes3 = new Uint8Array(buf);
   let binary = "";
-  for (let i = 0; i < bytes2.byteLength; i++) {
-    binary += String.fromCharCode(bytes2[i]);
+  for (let i = 0; i < bytes3.byteLength; i++) {
+    binary += String.fromCharCode(bytes3[i]);
   }
   return btoa(binary);
 }
 __name(bufferToBase642, "bufferToBase64");
 function base64ToBuffer2(b64) {
   const binary = atob(b64);
-  const bytes2 = new Uint8Array(binary.length);
+  const bytes3 = new Uint8Array(binary.length);
   for (let i = 0; i < binary.length; i++) {
-    bytes2[i] = binary.charCodeAt(i);
+    bytes3[i] = binary.charCodeAt(i);
   }
-  return bytes2.buffer;
+  return bytes3.buffer;
 }
 __name(base64ToBuffer2, "base64ToBuffer");
 async function encryptShare(share, id) {
@@ -19888,21 +19909,21 @@ async function getWordlist() {
   return wordlistPromise;
 }
 __name(getWordlist, "getWordlist");
-function bytesToBits(bytes2) {
-  return Array.from(bytes2).map((b) => b.toString(2).padStart(8, "0")).join("");
+function bytesToBits(bytes3) {
+  return Array.from(bytes3).map((b) => b.toString(2).padStart(8, "0")).join("");
 }
 __name(bytesToBits, "bytesToBits");
 function bitsToBytes(bits) {
-  const bytes2 = new Uint8Array(Math.ceil(bits.length / 8));
-  for (let i = 0; i < bytes2.length; i++) {
-    bytes2[i] = parseInt(bits.slice(i * 8, (i + 1) * 8).padEnd(8, "0"), 2);
+  const bytes3 = new Uint8Array(Math.ceil(bits.length / 8));
+  for (let i = 0; i < bytes3.length; i++) {
+    bytes3[i] = parseInt(bits.slice(i * 8, (i + 1) * 8).padEnd(8, "0"), 2);
   }
-  return bytes2;
+  return bytes3;
 }
 __name(bitsToBytes, "bitsToBytes");
 async function computeChecksum(data) {
-  const hash = await crypto.subtle.digest("SHA-256", data);
-  const hashBits = bytesToBits(new Uint8Array(hash));
+  const hash2 = await crypto.subtle.digest("SHA-256", data);
+  const hashBits = bytesToBits(new Uint8Array(hash2));
   const checksumLength = Math.floor(data.length / 4);
   return hashBits.slice(0, checksumLength);
 }
@@ -19935,12 +19956,12 @@ async function recoveryPhraseToShare(phrase) {
     bits += index.toString(2).padStart(11, "0");
   }
   let dataByteCount = 0;
-  for (let bytes2 = 1; bytes2 <= 64; bytes2++) {
-    const checksumBits2 = Math.floor(bytes2 / 4);
-    const totalBits = bytes2 * 8 + checksumBits2;
+  for (let bytes3 = 1; bytes3 <= 64; bytes3++) {
+    const checksumBits2 = Math.floor(bytes3 / 4);
+    const totalBits = bytes3 * 8 + checksumBits2;
     const wordsNeeded = Math.ceil(totalBits / 11);
     if (wordsNeeded === words.length) {
-      dataByteCount = bytes2;
+      dataByteCount = bytes3;
     } else if (wordsNeeded > words.length) {
       break;
     }
@@ -20234,9 +20255,9 @@ __name(createSSSKeyManager, "createSSSKeyManager");
 var EMAIL_RELAY_ENVELOPE_VERSION = 1;
 var EMAIL_RELAY_ALGORITHM = "P-256-HKDF-SHA256-AES-256-GCM";
 var encodeUtf8 = /* @__PURE__ */ __name((value) => {
-  const bytes2 = new TextEncoder().encode(value);
-  const copy = new Uint8Array(new ArrayBuffer(bytes2.byteLength));
-  copy.set(bytes2);
+  const bytes3 = new TextEncoder().encode(value);
+  const copy = new Uint8Array(new ArrayBuffer(bytes3.byteLength));
+  copy.set(bytes3);
   return copy;
 }, "encodeUtf8");
 var EMAIL_RELAY_INFO = encodeUtf8("learncard-email-relay-v1");
@@ -20255,7 +20276,7 @@ var parseBranding = /* @__PURE__ */ __name((value) => {
   if (value === void 0) return void 0;
   if (!isRecord(value)) throw new Error("Invalid email relay branding");
   const branding = {};
-  const keys = [
+  const keys2 = [
     "brandName",
     "logoUrl",
     "logoAlt",
@@ -20267,7 +20288,7 @@ var parseBranding = /* @__PURE__ */ __name((value) => {
     "fromDomain",
     "copyrightHolder"
   ];
-  for (const key of keys) {
+  for (const key of keys2) {
     const field = value[key];
     if (field === void 0) continue;
     if (typeof field !== "string" || field.length > 2048) {
@@ -20320,7 +20341,7 @@ var parseEmailRelayPlaintext = /* @__PURE__ */ __name((value) => {
     branding: parseBranding(value.branding)
   };
 }, "parseEmailRelayPlaintext");
-var getAad = /* @__PURE__ */ __name((envelope) => encodeUtf8(`${envelope.version}|${envelope.algorithm}|${envelope.keyId}`), "getAad");
+var getAad = /* @__PURE__ */ __name((envelope2) => encodeUtf8(`${envelope2.version}|${envelope2.algorithm}|${envelope2.keyId}`), "getAad");
 var deriveAesKey = /* @__PURE__ */ __name(async (sharedSecret, salt, usage) => {
   const keyMaterial = await crypto.subtle.importKey("raw", sharedSecret, "HKDF", false, [
     "deriveKey"
@@ -20392,7 +20413,7 @@ var encryptEmailRelayPayload = /* @__PURE__ */ __name(async (input, publicKeyBas
   };
 }, "encryptEmailRelayPayload");
 var decryptEmailRelayPayload = /* @__PURE__ */ __name(async (value, privateKeyBase64) => {
-  const envelope = parseEmailRelayEnvelope(value);
+  const envelope2 = parseEmailRelayEnvelope(value);
   const privateKey = await crypto.subtle.importKey(
     "pkcs8",
     base64ToBuffer(privateKeyBase64.trim()).buffer,
@@ -20402,7 +20423,7 @@ var decryptEmailRelayPayload = /* @__PURE__ */ __name(async (value, privateKeyBa
   );
   const ephemeralPublicKey = await crypto.subtle.importKey(
     "raw",
-    base64ToBuffer(envelope.ephemeralPublicKey).buffer,
+    base64ToBuffer(envelope2.ephemeralPublicKey).buffer,
     { name: "ECDH", namedCurve: "P-256" },
     false,
     []
@@ -20412,13 +20433,13 @@ var decryptEmailRelayPayload = /* @__PURE__ */ __name(async (value, privateKeyBa
     privateKey,
     256
   );
-  const salt = base64ToBuffer(envelope.salt);
-  const iv = base64ToBuffer(envelope.iv);
+  const salt = base64ToBuffer(envelope2.salt);
+  const iv = base64ToBuffer(envelope2.iv);
   const aesKey = await deriveAesKey(sharedSecret, salt, "decrypt");
   const decrypted = await crypto.subtle.decrypt(
-    { name: "AES-GCM", iv, additionalData: getAad(envelope) },
+    { name: "AES-GCM", iv, additionalData: getAad(envelope2) },
     aesKey,
-    base64ToBuffer(envelope.ciphertext)
+    base64ToBuffer(envelope2.ciphertext)
   );
   const parsed = JSON.parse(new TextDecoder().decode(decrypted));
   return parseEmailRelayPlaintext(parsed);
@@ -20430,10 +20451,11 @@ var ESCROW_ALGORITHM = "P-256-HKDF-SHA256-AES-256-GCM";
 var ESCROW_BLOB_INFO = "learncard-escrow-blob-v1";
 var ESCROW_RELEASE_INFO = "learncard-escrow-release-v1";
 var ESCROW_CLIENT_KEY_ID = "client";
+var RECOVERY_LANGUAGES = ["en", "es", "fr", "ar"];
 var encodeUtf82 = /* @__PURE__ */ __name((value) => {
-  const bytes2 = new TextEncoder().encode(value);
-  const copy = new Uint8Array(new ArrayBuffer(bytes2.byteLength));
-  copy.set(bytes2);
+  const bytes3 = new TextEncoder().encode(value);
+  const copy = new Uint8Array(new ArrayBuffer(bytes3.byteLength));
+  copy.set(bytes3);
   return copy;
 }, "encodeUtf8");
 var isRecord2 = /* @__PURE__ */ __name((value) => typeof value === "object" && value !== null && !Array.isArray(value), "isRecord");
@@ -20469,6 +20491,22 @@ var parseEscrowBlobPlaintext = /* @__PURE__ */ __name((value) => {
   if (typeof value.shareVersion !== "number" || !Number.isInteger(value.shareVersion) || value.shareVersion <= 0) {
     throw new Error("Invalid escrow shareVersion");
   }
+  if (value.recoveryEmail !== void 0 !== (value.recoveryLanguage !== void 0)) {
+    throw new Error("Invalid escrow recoveryEmail");
+  }
+  let recoveryContact = {};
+  if (value.recoveryEmail !== void 0) {
+    const email = requireString2(value, "recoveryEmail", { min: 3, max: 254 }).trim().toLowerCase();
+    const at = email.split("@");
+    if (!/^[\x21-\x7e]+$/.test(email) || at.length !== 2 || at[0].length === 0 || at[1].length === 0 || !at[1].includes(".") || at[1].startsWith(".") || at[1].endsWith(".")) {
+      throw new Error("Invalid escrow recoveryEmail");
+    }
+    const language = requireString2(value, "recoveryLanguage", { min: 2, max: 2 });
+    if (!RECOVERY_LANGUAGES.includes(language)) {
+      throw new Error("Invalid escrow recoveryLanguage");
+    }
+    recoveryContact = { recoveryEmail: email, recoveryLanguage: language };
+  }
   return {
     version: ESCROW_ENVELOPE_VERSION,
     recoveryShare: requireString2(value, "recoveryShare", {
@@ -20484,7 +20522,8 @@ var parseEscrowBlobPlaintext = /* @__PURE__ */ __name((value) => {
         max: 64,
         pattern: /^[0-9a-f]{64}$/i
       }).toLowerCase()
-    } : {}
+    } : {},
+    ...recoveryContact
   };
 }, "parseEscrowBlobPlaintext");
 var parseEscrowReleasePlaintext = /* @__PURE__ */ __name((value) => {
@@ -20495,7 +20534,7 @@ var parseEscrowReleasePlaintext = /* @__PURE__ */ __name((value) => {
     holdId: requireString2(value, "holdId", { max: 128, pattern: /^[A-Za-z0-9._-]+$/ })
   };
 }, "parseEscrowReleasePlaintext");
-var getAad2 = /* @__PURE__ */ __name((envelope) => encodeUtf82(`${envelope.version}|${envelope.algorithm}|${envelope.keyId}`), "getAad");
+var getAad2 = /* @__PURE__ */ __name((envelope2) => encodeUtf82(`${envelope2.version}|${envelope2.algorithm}|${envelope2.keyId}`), "getAad");
 var deriveAesKey2 = /* @__PURE__ */ __name(async (sharedSecret, salt, usage, info) => {
   const keyMaterial = await crypto.subtle.importKey("raw", sharedSecret, "HKDF", false, [
     "deriveKey"
@@ -20566,7 +20605,7 @@ var encryptToRecipient = /* @__PURE__ */ __name(async (plaintextJson, spki, keyI
   };
 }, "encryptToRecipient");
 var decryptFromEnvelope = /* @__PURE__ */ __name(async (value, pkcs8, info) => {
-  const envelope = parseEscrowEnvelope(value);
+  const envelope2 = parseEscrowEnvelope(value);
   const privateKey = await crypto.subtle.importKey(
     "pkcs8",
     base64ToBuffer(pkcs8.trim()),
@@ -20576,7 +20615,7 @@ var decryptFromEnvelope = /* @__PURE__ */ __name(async (value, pkcs8, info) => {
   );
   const ephemeralPublicKey = await crypto.subtle.importKey(
     "raw",
-    base64ToBuffer(envelope.ephemeralPublicKey),
+    base64ToBuffer(envelope2.ephemeralPublicKey),
     { name: "ECDH", namedCurve: "P-256" },
     false,
     []
@@ -20586,13 +20625,13 @@ var decryptFromEnvelope = /* @__PURE__ */ __name(async (value, pkcs8, info) => {
     privateKey,
     256
   );
-  const salt = base64ToBuffer(envelope.salt);
-  const iv = base64ToBuffer(envelope.iv);
+  const salt = base64ToBuffer(envelope2.salt);
+  const iv = base64ToBuffer(envelope2.iv);
   const aesKey = await deriveAesKey2(sharedSecret, salt, "decrypt", info);
   const decrypted = await crypto.subtle.decrypt(
-    { name: "AES-GCM", iv, additionalData: getAad2(envelope) },
+    { name: "AES-GCM", iv, additionalData: getAad2(envelope2) },
     aesKey,
-    base64ToBuffer(envelope.ciphertext)
+    base64ToBuffer(envelope2.ciphertext)
   );
   const parsed = JSON.parse(new TextDecoder().decode(decrypted));
   return parsed;
@@ -20606,8 +20645,8 @@ var encryptEscrowBlob = /* @__PURE__ */ __name(async (input, enclavePublicKeySpk
     ESCROW_BLOB_INFO
   );
 }, "encryptEscrowBlob");
-var decryptEscrowBlob = /* @__PURE__ */ __name(async (envelope, enclavePrivateKeyPkcs8B64) => parseEscrowBlobPlaintext(
-  await decryptFromEnvelope(envelope, enclavePrivateKeyPkcs8B64, ESCROW_BLOB_INFO)
+var decryptEscrowBlob = /* @__PURE__ */ __name(async (envelope2, enclavePrivateKeyPkcs8B64) => parseEscrowBlobPlaintext(
+  await decryptFromEnvelope(envelope2, enclavePrivateKeyPkcs8B64, ESCROW_BLOB_INFO)
 ), "decryptEscrowBlob");
 var sealEscrowRelease = /* @__PURE__ */ __name(async (input, clientEphemeralPublicKeySpkiB64) => {
   const plaintext = parseEscrowReleasePlaintext({ ...input, version: ESCROW_ENVELOPE_VERSION });
@@ -20618,10 +20657,626 @@ var sealEscrowRelease = /* @__PURE__ */ __name(async (input, clientEphemeralPubl
     ESCROW_RELEASE_INFO
   );
 }, "sealEscrowRelease");
-var openEscrowRelease = /* @__PURE__ */ __name(async (envelope, clientEphemeralPrivateKeyPkcs8B64) => parseEscrowReleasePlaintext(
-  await decryptFromEnvelope(envelope, clientEphemeralPrivateKeyPkcs8B64, ESCROW_RELEASE_INFO)
+var openEscrowRelease = /* @__PURE__ */ __name(async (envelope2, clientEphemeralPrivateKeyPkcs8B64) => parseEscrowReleasePlaintext(
+  await decryptFromEnvelope(envelope2, clientEphemeralPrivateKeyPkcs8B64, ESCROW_RELEASE_INFO)
 ), "openEscrowRelease");
 
+// ../../node_modules/@noble/ed25519/index.js
+var ed25519_CURVE = {
+  p: 0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffedn,
+  n: 0x1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3edn,
+  h: 8n,
+  a: 0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffecn,
+  d: 0x52036cee2b6ffe738cc740797779e89800700a4d4141d8ab75eb4dca135978a3n,
+  Gx: 0x216936d3cd6e53fec0a4e231fdd6dc5c692cc7609525a7b2c9562d608f25d51an,
+  Gy: 0x6666666666666666666666666666666666666666666666666666666666666658n
+};
+var { p: P, n: N, Gx, Gy, a: _a, d: _d } = ed25519_CURVE;
+var h = 8n;
+var L = 32;
+var L2 = 64;
+var err = /* @__PURE__ */ __name((m = "") => {
+  throw new Error(m);
+}, "err");
+var isBig = /* @__PURE__ */ __name((n) => typeof n === "bigint", "isBig");
+var isStr = /* @__PURE__ */ __name((s) => typeof s === "string", "isStr");
+var isBytes = /* @__PURE__ */ __name((a) => a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array", "isBytes");
+var abytes = /* @__PURE__ */ __name((a, l) => !isBytes(a) || typeof l === "number" && l > 0 && a.length !== l ? err("Uint8Array expected") : a, "abytes");
+var u8n = /* @__PURE__ */ __name((len) => new Uint8Array(len), "u8n");
+var u8fr = /* @__PURE__ */ __name((buf) => Uint8Array.from(buf), "u8fr");
+var padh = /* @__PURE__ */ __name((n, pad) => n.toString(16).padStart(pad, "0"), "padh");
+var bytesToHex3 = /* @__PURE__ */ __name((b) => Array.from(abytes(b)).map((e) => padh(e, 2)).join(""), "bytesToHex");
+var C = { _0: 48, _9: 57, A: 65, F: 70, a: 97, f: 102 };
+var _ch = /* @__PURE__ */ __name((ch) => {
+  if (ch >= C._0 && ch <= C._9)
+    return ch - C._0;
+  if (ch >= C.A && ch <= C.F)
+    return ch - (C.A - 10);
+  if (ch >= C.a && ch <= C.f)
+    return ch - (C.a - 10);
+  return;
+}, "_ch");
+var hexToBytes3 = /* @__PURE__ */ __name((hex2) => {
+  const e = "hex invalid";
+  if (!isStr(hex2))
+    return err(e);
+  const hl = hex2.length;
+  const al = hl / 2;
+  if (hl % 2)
+    return err(e);
+  const array = u8n(al);
+  for (let ai = 0, hi = 0; ai < al; ai++, hi += 2) {
+    const n1 = _ch(hex2.charCodeAt(hi));
+    const n2 = _ch(hex2.charCodeAt(hi + 1));
+    if (n1 === void 0 || n2 === void 0)
+      return err(e);
+    array[ai] = n1 * 16 + n2;
+  }
+  return array;
+}, "hexToBytes");
+var toU8 = /* @__PURE__ */ __name((a, len) => abytes(isStr(a) ? hexToBytes3(a) : u8fr(abytes(a)), len), "toU8");
+var cr = /* @__PURE__ */ __name(() => globalThis?.crypto, "cr");
+var subtle = /* @__PURE__ */ __name(() => cr()?.subtle ?? err("crypto.subtle must be defined"), "subtle");
+var concatBytes = /* @__PURE__ */ __name((...arrs) => {
+  const r = u8n(arrs.reduce((sum, a) => sum + abytes(a).length, 0));
+  let pad = 0;
+  arrs.forEach((a) => {
+    r.set(a, pad);
+    pad += a.length;
+  });
+  return r;
+}, "concatBytes");
+var randomBytes = /* @__PURE__ */ __name((len = L) => {
+  const c = cr();
+  return c.getRandomValues(u8n(len));
+}, "randomBytes");
+var big = BigInt;
+var arange = /* @__PURE__ */ __name((n, min, max, msg = "bad number: out of range") => isBig(n) && min <= n && n < max ? n : err(msg), "arange");
+var M = /* @__PURE__ */ __name((a, b = P) => {
+  const r = a % b;
+  return r >= 0n ? r : b + r;
+}, "M");
+var modN = /* @__PURE__ */ __name((a) => M(a, N), "modN");
+var invert = /* @__PURE__ */ __name((num, md) => {
+  if (num === 0n || md <= 0n)
+    err("no inverse n=" + num + " mod=" + md);
+  let a = M(num, md), b = md, x = 0n, y = 1n, u = 1n, v = 0n;
+  while (a !== 0n) {
+    const q = b / a, r = b % a;
+    const m = x - u * q, n = y - v * q;
+    b = a, a = r, x = u, y = v, u = m, v = n;
+  }
+  return b === 1n ? M(x, md) : err("no inverse");
+}, "invert");
+var apoint = /* @__PURE__ */ __name((p) => p instanceof Point ? p : err("Point expected"), "apoint");
+var B256 = 2n ** 256n;
+var Point = class _Point {
+  static {
+    __name(this, "Point");
+  }
+  static BASE;
+  static ZERO;
+  ex;
+  ey;
+  ez;
+  et;
+  constructor(ex, ey, ez, et) {
+    const max = B256;
+    this.ex = arange(ex, 0n, max);
+    this.ey = arange(ey, 0n, max);
+    this.ez = arange(ez, 1n, max);
+    this.et = arange(et, 0n, max);
+    Object.freeze(this);
+  }
+  static fromAffine(p) {
+    return new _Point(p.x, p.y, 1n, M(p.x * p.y));
+  }
+  /** RFC8032 5.1.3: Uint8Array to Point. */
+  static fromBytes(hex2, zip215 = false) {
+    const d = _d;
+    const normed = u8fr(abytes(hex2, L));
+    const lastByte = hex2[31];
+    normed[31] = lastByte & ~128;
+    const y = bytesToNumLE(normed);
+    const max = zip215 ? B256 : P;
+    arange(y, 0n, max);
+    const y2 = M(y * y);
+    const u = M(y2 - 1n);
+    const v = M(d * y2 + 1n);
+    let { isValid, value: x } = uvRatio(u, v);
+    if (!isValid)
+      err("bad point: y not sqrt");
+    const isXOdd = (x & 1n) === 1n;
+    const isLastByteOdd = (lastByte & 128) !== 0;
+    if (!zip215 && x === 0n && isLastByteOdd)
+      err("bad point: x==0, isLastByteOdd");
+    if (isLastByteOdd !== isXOdd)
+      x = M(-x);
+    return new _Point(x, y, 1n, M(x * y));
+  }
+  /** Checks if the point is valid and on-curve. */
+  assertValidity() {
+    const a = _a;
+    const d = _d;
+    const p = this;
+    if (p.is0())
+      throw new Error("bad point: ZERO");
+    const { ex: X, ey: Y, ez: Z, et: T } = p;
+    const X2 = M(X * X);
+    const Y2 = M(Y * Y);
+    const Z2 = M(Z * Z);
+    const Z4 = M(Z2 * Z2);
+    const aX2 = M(X2 * a);
+    const left = M(Z2 * M(aX2 + Y2));
+    const right = M(Z4 + M(d * M(X2 * Y2)));
+    if (left !== right)
+      throw new Error("bad point: equation left != right (1)");
+    const XY = M(X * Y);
+    const ZT = M(Z * T);
+    if (XY !== ZT)
+      throw new Error("bad point: equation left != right (2)");
+    return this;
+  }
+  /** Equality check: compare points P&Q. */
+  equals(other) {
+    const { ex: X1, ey: Y1, ez: Z1 } = this;
+    const { ex: X2, ey: Y2, ez: Z2 } = apoint(other);
+    const X1Z2 = M(X1 * Z2);
+    const X2Z1 = M(X2 * Z1);
+    const Y1Z2 = M(Y1 * Z2);
+    const Y2Z1 = M(Y2 * Z1);
+    return X1Z2 === X2Z1 && Y1Z2 === Y2Z1;
+  }
+  is0() {
+    return this.equals(I);
+  }
+  /** Flip point over y coordinate. */
+  negate() {
+    return new _Point(M(-this.ex), this.ey, this.ez, M(-this.et));
+  }
+  /** Point doubling. Complete formula. Cost: `4M + 4S + 1*a + 6add + 1*2`. */
+  double() {
+    const { ex: X1, ey: Y1, ez: Z1 } = this;
+    const a = _a;
+    const A = M(X1 * X1);
+    const B = M(Y1 * Y1);
+    const C2 = M(2n * M(Z1 * Z1));
+    const D = M(a * A);
+    const x1y1 = X1 + Y1;
+    const E = M(M(x1y1 * x1y1) - A - B);
+    const G2 = D + B;
+    const F = G2 - C2;
+    const H = D - B;
+    const X3 = M(E * F);
+    const Y3 = M(G2 * H);
+    const T3 = M(E * H);
+    const Z3 = M(F * G2);
+    return new _Point(X3, Y3, Z3, T3);
+  }
+  /** Point addition. Complete formula. Cost: `8M + 1*k + 8add + 1*2`. */
+  add(other) {
+    const { ex: X1, ey: Y1, ez: Z1, et: T1 } = this;
+    const { ex: X2, ey: Y2, ez: Z2, et: T2 } = apoint(other);
+    const a = _a;
+    const d = _d;
+    const A = M(X1 * X2);
+    const B = M(Y1 * Y2);
+    const C2 = M(T1 * d * T2);
+    const D = M(Z1 * Z2);
+    const E = M((X1 + Y1) * (X2 + Y2) - A - B);
+    const F = M(D - C2);
+    const G2 = M(D + C2);
+    const H = M(B - a * A);
+    const X3 = M(E * F);
+    const Y3 = M(G2 * H);
+    const T3 = M(E * H);
+    const Z3 = M(F * G2);
+    return new _Point(X3, Y3, Z3, T3);
+  }
+  /**
+   * Point-by-scalar multiplication. Scalar must be in range 1 <= n < CURVE.n.
+   * Uses {@link wNAF} for base point.
+   * Uses fake point to mitigate side-channel leakage.
+   * @param n scalar by which point is multiplied
+   * @param safe safe mode guards against timing attacks; unsafe mode is faster
+   */
+  multiply(n, safe = true) {
+    if (!safe && (n === 0n || this.is0()))
+      return I;
+    arange(n, 1n, N);
+    if (n === 1n)
+      return this;
+    if (this.equals(G))
+      return wNAF(n).p;
+    let p = I;
+    let f = G;
+    for (let d = this; n > 0n; d = d.double(), n >>= 1n) {
+      if (n & 1n)
+        p = p.add(d);
+      else if (safe)
+        f = f.add(d);
+    }
+    return p;
+  }
+  /** Convert point to 2d xy affine point. (X, Y, Z) ∋ (x=X/Z, y=Y/Z) */
+  toAffine() {
+    const { ex: x, ey: y, ez: z } = this;
+    if (this.equals(I))
+      return { x: 0n, y: 1n };
+    const iz = invert(z, P);
+    if (M(z * iz) !== 1n)
+      err("invalid inverse");
+    return { x: M(x * iz), y: M(y * iz) };
+  }
+  toBytes() {
+    const { x, y } = this.assertValidity().toAffine();
+    const b = numTo32bLE(y);
+    b[31] |= x & 1n ? 128 : 0;
+    return b;
+  }
+  toHex() {
+    return bytesToHex3(this.toBytes());
+  }
+  // encode to hex string
+  clearCofactor() {
+    return this.multiply(big(h), false);
+  }
+  isSmallOrder() {
+    return this.clearCofactor().is0();
+  }
+  isTorsionFree() {
+    let p = this.multiply(N / 2n, false).double();
+    if (N % 2n)
+      p = p.add(this);
+    return p.is0();
+  }
+  static fromHex(hex2, zip215) {
+    return _Point.fromBytes(toU8(hex2), zip215);
+  }
+  get x() {
+    return this.toAffine().x;
+  }
+  get y() {
+    return this.toAffine().y;
+  }
+  toRawBytes() {
+    return this.toBytes();
+  }
+};
+var G = new Point(Gx, Gy, 1n, M(Gx * Gy));
+var I = new Point(0n, 1n, 1n, 0n);
+Point.BASE = G;
+Point.ZERO = I;
+var numTo32bLE = /* @__PURE__ */ __name((num) => hexToBytes3(padh(arange(num, 0n, B256), L2)).reverse(), "numTo32bLE");
+var bytesToNumLE = /* @__PURE__ */ __name((b) => big("0x" + bytesToHex3(u8fr(abytes(b)).reverse())), "bytesToNumLE");
+var pow2 = /* @__PURE__ */ __name((x, power) => {
+  let r = x;
+  while (power-- > 0n) {
+    r *= r;
+    r %= P;
+  }
+  return r;
+}, "pow2");
+var pow_2_252_3 = /* @__PURE__ */ __name((x) => {
+  const x2 = x * x % P;
+  const b2 = x2 * x % P;
+  const b4 = pow2(b2, 2n) * b2 % P;
+  const b5 = pow2(b4, 1n) * x % P;
+  const b10 = pow2(b5, 5n) * b5 % P;
+  const b20 = pow2(b10, 10n) * b10 % P;
+  const b40 = pow2(b20, 20n) * b20 % P;
+  const b80 = pow2(b40, 40n) * b40 % P;
+  const b160 = pow2(b80, 80n) * b80 % P;
+  const b240 = pow2(b160, 80n) * b80 % P;
+  const b250 = pow2(b240, 10n) * b10 % P;
+  const pow_p_5_8 = pow2(b250, 2n) * x % P;
+  return { pow_p_5_8, b2 };
+}, "pow_2_252_3");
+var RM1 = 0x2b8324804fc1df0b2b4d00993dfbd7a72f431806ad2fe478c4ee1b274a0ea0b0n;
+var uvRatio = /* @__PURE__ */ __name((u, v) => {
+  const v3 = M(v * v * v);
+  const v7 = M(v3 * v3 * v);
+  const pow = pow_2_252_3(u * v7).pow_p_5_8;
+  let x = M(u * v3 * pow);
+  const vx2 = M(v * x * x);
+  const root1 = x;
+  const root2 = M(x * RM1);
+  const useRoot1 = vx2 === u;
+  const useRoot2 = vx2 === M(-u);
+  const noRoot = vx2 === M(-u * RM1);
+  if (useRoot1)
+    x = root1;
+  if (useRoot2 || noRoot)
+    x = root2;
+  if ((M(x) & 1n) === 1n)
+    x = M(-x);
+  return { isValid: useRoot1 || useRoot2, value: x };
+}, "uvRatio");
+var modL_LE = /* @__PURE__ */ __name((hash2) => modN(bytesToNumLE(hash2)), "modL_LE");
+var sha512a = /* @__PURE__ */ __name((...m) => etc.sha512Async(...m), "sha512a");
+var hash2extK = /* @__PURE__ */ __name((hashed) => {
+  const head = hashed.slice(0, L);
+  head[0] &= 248;
+  head[31] &= 127;
+  head[31] |= 64;
+  const prefix = hashed.slice(L, L2);
+  const scalar = modL_LE(head);
+  const point = G.multiply(scalar);
+  const pointBytes = point.toBytes();
+  return { head, prefix, scalar, point, pointBytes };
+}, "hash2extK");
+var getExtendedPublicKeyAsync = /* @__PURE__ */ __name((priv) => sha512a(toU8(priv, L)).then(hash2extK), "getExtendedPublicKeyAsync");
+var getPublicKeyAsync = /* @__PURE__ */ __name((priv) => getExtendedPublicKeyAsync(priv).then((p) => p.pointBytes), "getPublicKeyAsync");
+var hashFinishA = /* @__PURE__ */ __name((res) => sha512a(res.hashable).then(res.finish), "hashFinishA");
+var _sign = /* @__PURE__ */ __name((e, rBytes, msg) => {
+  const { pointBytes: P2, scalar: s } = e;
+  const r = modL_LE(rBytes);
+  const R = G.multiply(r).toBytes();
+  const hashable = concatBytes(R, P2, msg);
+  const finish = /* @__PURE__ */ __name((hashed) => {
+    const S = modN(r + modL_LE(hashed) * s);
+    return abytes(concatBytes(R, numTo32bLE(S)), L2);
+  }, "finish");
+  return { hashable, finish };
+}, "_sign");
+var signAsync = /* @__PURE__ */ __name(async (msg, privKey) => {
+  const m = toU8(msg);
+  const e = await getExtendedPublicKeyAsync(privKey);
+  const rBytes = await sha512a(e.prefix, m);
+  return hashFinishA(_sign(e, rBytes, m));
+}, "signAsync");
+var etc = {
+  sha512Async: /* @__PURE__ */ __name(async (...messages) => {
+    const s = subtle();
+    const m = concatBytes(...messages);
+    return u8n(await s.digest("SHA-512", m.buffer));
+  }, "sha512Async"),
+  sha512Sync: void 0,
+  bytesToHex: bytesToHex3,
+  hexToBytes: hexToBytes3,
+  concatBytes,
+  mod: M,
+  invert,
+  randomBytes
+};
+var W = 8;
+var scalarBits = 256;
+var pwindows = Math.ceil(scalarBits / W) + 1;
+var pwindowSize = 2 ** (W - 1);
+var precompute = /* @__PURE__ */ __name(() => {
+  const points = [];
+  let p = G;
+  let b = p;
+  for (let w = 0; w < pwindows; w++) {
+    b = p;
+    points.push(b);
+    for (let i = 1; i < pwindowSize; i++) {
+      b = b.add(p);
+      points.push(b);
+    }
+    p = b.double();
+  }
+  return points;
+}, "precompute");
+var Gpows = void 0;
+var ctneg = /* @__PURE__ */ __name((cnd, p) => {
+  const n = p.negate();
+  return cnd ? n : p;
+}, "ctneg");
+var wNAF = /* @__PURE__ */ __name((n) => {
+  const comp = Gpows || (Gpows = precompute());
+  let p = I;
+  let f = G;
+  const pow_2_w = 2 ** W;
+  const maxNum = pow_2_w;
+  const mask = big(pow_2_w - 1);
+  const shiftBy = big(W);
+  for (let w = 0; w < pwindows; w++) {
+    let wbits = Number(n & mask);
+    n >>= shiftBy;
+    if (wbits > pwindowSize) {
+      wbits -= maxNum;
+      n += 1n;
+    }
+    const off = w * pwindowSize;
+    const offF = off;
+    const offP = off + Math.abs(wbits) - 1;
+    const isEven = w % 2 !== 0;
+    const isNeg = wbits < 0;
+    if (wbits === 0) {
+      f = f.add(ctneg(isEven, comp[offF]));
+    } else {
+      p = p.add(ctneg(isNeg, comp[offP]));
+    }
+  }
+  return { p, f };
+}, "wNAF");
+
+// src/escrow-enrollment-intent.ts
+var ESCROW_ENROLLMENT_INTENT_DOMAIN = "learncard-escrow-enrollment-intent-v2\0";
+var BASE58 = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+var FIELDS = [
+  "version",
+  "tenant",
+  "did",
+  "authorityGeneration",
+  "expectedEnrollmentVersion",
+  "action",
+  "sourceBlobIdentity",
+  "targetBlobIdentity",
+  "pinAction",
+  "shareVersion",
+  "enrollmentEpoch",
+  "requestId",
+  "allowRewrap",
+  "recoveryEmail",
+  "recoveryLanguage"
+];
+var ACTIONS = ["enroll", "replace", "disable", "carry"];
+var PIN_ACTIONS = ["set", "change", "clear", "keep"];
+var RECOVERY_LANGUAGES2 = ["en", "es", "fr", "ar"];
+var requireIntent = /* @__PURE__ */ __name((condition) => {
+  if (!condition) throw new Error("Invalid escrow enrollment intent");
+}, "requireIntent");
+var matches = /* @__PURE__ */ __name((value, pattern) => typeof value === "string" && pattern.exec(value)?.[0] === value, "matches");
+var utf8 = /* @__PURE__ */ __name((value) => new TextEncoder().encode(value), "utf8");
+var integer = /* @__PURE__ */ __name((value, width) => {
+  requireIntent(
+    Number.isSafeInteger(value) && value >= 0 && (width === 8 || value <= 4294967295)
+  );
+  const bytes3 = new Uint8Array(width);
+  const view = new DataView(bytes3.buffer);
+  if (width === 4) view.setUint32(0, value, false);
+  else view.setBigUint64(0, BigInt(value), false);
+  return bytes3;
+}, "integer");
+var join = /* @__PURE__ */ __name((fields) => {
+  const result = new Uint8Array(fields.reduce((length, field) => length + field.length, 0));
+  let offset = 0;
+  for (const field of fields) {
+    result.set(field, offset);
+    offset += field.length;
+  }
+  return result;
+}, "join");
+var hashBytes = /* @__PURE__ */ __name((value) => {
+  if (value === null) return new Uint8Array();
+  requireIntent(matches(value, /^[0-9a-f]{64}$/));
+  return new Uint8Array(hexToBytes(value));
+}, "hashBytes");
+var didPublicKey = /* @__PURE__ */ __name((did) => {
+  requireIntent(typeof did === "string" && did.startsWith("did:key:z") && did.length === 56);
+  let value = 0n;
+  for (const char of did.slice(9)) {
+    const digit = BASE58.indexOf(char);
+    requireIntent(digit >= 0);
+    value = value * 58n + BigInt(digit);
+  }
+  const bytes3 = new Uint8Array(34);
+  for (let i = 33; i >= 0; i--) {
+    bytes3[i] = Number(value & 255n);
+    value >>= 8n;
+  }
+  requireIntent(value === 0n && bytes3[0] === 237 && bytes3[1] === 1);
+  const key = bytes3.slice(2);
+  try {
+    requireIntent(!Point.fromHex(key, false).isSmallOrder());
+  } catch {
+    throw new Error("Invalid escrow enrollment intent");
+  }
+  return key;
+}, "didPublicKey");
+var encodeEscrowEnrollmentIntent = /* @__PURE__ */ __name((intent) => {
+  requireIntent(typeof intent === "object" && intent !== null && !Array.isArray(intent));
+  requireIntent(
+    Object.keys(intent).length === FIELDS.length && FIELDS.every((field) => Object.prototype.hasOwnProperty.call(intent, field))
+  );
+  requireIntent(intent.version === 2 && typeof intent.allowRewrap === "boolean");
+  requireIntent(matches(intent.tenant, /^[A-Za-z0-9_-]{1,128}$/));
+  requireIntent(matches(intent.authorityGeneration, /^[A-Za-z0-9_-]{1,128}$/));
+  requireIntent(matches(intent.requestId, /^[A-Za-z0-9._-]{1,112}$/));
+  didPublicKey(intent.did);
+  const action = ACTIONS.indexOf(intent.action);
+  const pin = PIN_ACTIONS.indexOf(intent.pinAction);
+  requireIntent(action >= 0 && pin >= 0 && intent.shareVersion > 0 && intent.enrollmentEpoch > 0);
+  const source = hashBytes(intent.sourceBlobIdentity);
+  const target = hashBytes(intent.targetBlobIdentity);
+  if (intent.action === "enroll") requireIntent(source.length === 0 && target.length === 32);
+  else if (intent.action === "disable")
+    requireIntent(
+      source.length === 32 && target.length === 0 && intent.pinAction === "keep" && !intent.allowRewrap
+    );
+  else
+    requireIntent(
+      source.length === 32 && target.length === 32 && intent.sourceBlobIdentity !== intent.targetBlobIdentity
+    );
+  if (intent.action === "carry") requireIntent(intent.pinAction === "keep");
+  if (intent.recoveryEmail === null) {
+    requireIntent(
+      intent.recoveryLanguage === null && (intent.action === "disable" || intent.action === "carry")
+    );
+  } else {
+    requireIntent(intent.action === "enroll" || intent.action === "replace");
+    requireIntent(
+      matches(intent.recoveryEmail, /^[\x21-\x7e]{3,254}$/) && intent.recoveryEmail === intent.recoveryEmail.trim().toLowerCase()
+    );
+    const at = intent.recoveryEmail.split("@");
+    requireIntent(
+      at.length === 2 && at[0].length > 0 && at[1].length > 0 && at[1].includes(".") && !at[1].startsWith(".") && !at[1].endsWith(".")
+    );
+    requireIntent(
+      intent.recoveryLanguage !== null && RECOVERY_LANGUAGES2.includes(intent.recoveryLanguage)
+    );
+  }
+  const fields = [
+    integer(intent.version, 4),
+    utf8(intent.tenant),
+    utf8(intent.did),
+    utf8(intent.authorityGeneration),
+    integer(intent.expectedEnrollmentVersion, 8),
+    Uint8Array.of(action),
+    source,
+    target,
+    Uint8Array.of(pin),
+    integer(intent.shareVersion, 4),
+    integer(intent.enrollmentEpoch, 8),
+    utf8(intent.requestId),
+    Uint8Array.of(Number(intent.allowRewrap)),
+    intent.recoveryEmail === null ? new Uint8Array() : utf8(intent.recoveryEmail),
+    intent.recoveryLanguage === null ? new Uint8Array() : utf8(intent.recoveryLanguage)
+  ];
+  return join([
+    utf8(ESCROW_ENROLLMENT_INTENT_DOMAIN),
+    ...fields.flatMap((field) => [integer(field.length, 4), field])
+  ]);
+}, "encodeEscrowEnrollmentIntent");
+var signEscrowEnrollmentIntent = /* @__PURE__ */ __name(async (intent, privateKey) => {
+  encodeEscrowEnrollmentIntent(intent);
+  const snapshot = { ...intent };
+  const message = encodeEscrowEnrollmentIntent(snapshot);
+  requireIntent(matches(privateKey, /^[0-9a-f]{64}$/i));
+  const seed = hexToBytes(privateKey);
+  try {
+    const publicKey = await getPublicKeyAsync(seed);
+    const expected = didPublicKey(snapshot.did);
+    requireIntent(publicKey.every((byte, index) => byte === expected[index]));
+    const signature = await signAsync(message, seed);
+    return { intent: snapshot, signature: bufferToBase64(new Uint8Array(signature).buffer) };
+  } finally {
+    seed.fill(0);
+  }
+}, "signEscrowEnrollmentIntent");
+var getEscrowBlobIdentity = /* @__PURE__ */ __name(async (input) => {
+  const envelope2 = parseEscrowEnvelope(input);
+  const decode2 = /* @__PURE__ */ __name((value) => {
+    const bytes3 = new Uint8Array(base64ToBuffer(value));
+    requireIntent(bufferToBase64(bytes3.buffer) === value);
+    return bytes3;
+  }, "decode");
+  const point = decode2(envelope2.ephemeralPublicKey);
+  const salt = decode2(envelope2.salt);
+  const iv = decode2(envelope2.iv);
+  const ciphertext = decode2(envelope2.ciphertext);
+  requireIntent(
+    point.length === 65 && point[0] === 4 && salt.length === 32 && iv.length === 12 && ciphertext.length >= 16
+  );
+  await crypto.subtle.importKey("raw", point, { name: "ECDH", namedCurve: "P-256" }, false, []);
+  const fields = [
+    Uint8Array.of(1),
+    utf8(envelope2.algorithm),
+    utf8(envelope2.keyId),
+    point.slice(1, 33),
+    salt,
+    iv,
+    ciphertext
+  ];
+  const message = join([
+    utf8("learncard-escrow-blob-id-v1\0"),
+    ...fields.flatMap((field) => [integer(field.length, 8), field])
+  ]);
+  return bytesToHex(new Uint8Array(await crypto.subtle.digest("SHA-256", message)));
+}, "getEscrowBlobIdentity");
+
 // src/escrow-nitro-attestation.ts
 var import_reflect_metadata = require("reflect-metadata");
 
@@ -20819,11 +21474,11 @@ var slice = useBuffer ? (
    * @param {number} end
    */
   // Buffer.slice() returns a view, not a copy, so we need special handling
-  (bytes2, start, end) => {
-    if (isBuffer(bytes2)) {
-      return new Uint8Array(bytes2.subarray(start, end));
+  (bytes3, start, end) => {
+    if (isBuffer(bytes3)) {
+      return new Uint8Array(bytes3.subarray(start, end));
     }
-    return bytes2.slice(start, end);
+    return bytes3.slice(start, end);
   }
 ) : (
   // eslint-disable-line operator-linebreak
@@ -20832,8 +21487,8 @@ var slice = useBuffer ? (
    * @param {number} start
    * @param {number} end
    */
-  (bytes2, start, end) => {
-    return bytes2.slice(start, end);
+  (bytes3, start, end) => {
+    return bytes3.slice(start, end);
   }
 );
 var concat = useBuffer ? (
@@ -20982,12 +21637,12 @@ var Bl = class {
   /**
    * @param {ByteView|number[]} bytes
    */
-  push(bytes2) {
+  push(bytes3) {
     let topChunk = this.chunks[this.chunks.length - 1];
-    const newMax = this.cursor + bytes2.length;
+    const newMax = this.cursor + bytes3.length;
     if (newMax <= this.maxCursor + 1) {
       const chunkPos = topChunk.length - (this.maxCursor - this.cursor) - 1;
-      topChunk.set(bytes2, chunkPos);
+      topChunk.set(bytes3, chunkPos);
     } else {
       if (topChunk) {
         const chunkPos = topChunk.length - (this.maxCursor - this.cursor) - 1;
@@ -20996,20 +21651,20 @@ var Bl = class {
           this.maxCursor = this.cursor - 1;
         }
       }
-      if (bytes2.length < 64 && bytes2.length < this.chunkSize) {
+      if (bytes3.length < 64 && bytes3.length < this.chunkSize) {
         topChunk = alloc(this.chunkSize);
         this.chunks.push(topChunk);
         this.maxCursor += topChunk.length;
         if (this._initReuseChunk === null) {
           this._initReuseChunk = topChunk;
         }
-        topChunk.set(bytes2, 0);
+        topChunk.set(bytes3, 0);
       } else {
-        this.chunks.push(bytes2);
-        this.maxCursor += bytes2.length;
+        this.chunks.push(bytes3);
+        this.maxCursor += bytes3.length;
       }
     }
-    this.cursor += bytes2.length;
+    this.cursor += bytes3.length;
   }
   /**
    * @param {boolean} [reset]
@@ -21062,12 +21717,12 @@ var U8Bl = class {
   /**
    * @param {ByteView|number[]} bytes
    */
-  push(bytes2) {
-    if (this.cursor + bytes2.length > this.dest.length) {
+  push(bytes3) {
+    if (this.cursor + bytes3.length > this.dest.length) {
       throw new Error("write out of bounds, destination buffer is too small");
     }
-    this.dest.set(bytes2, this.cursor);
-    this.cursor += bytes2.length;
+    this.dest.set(bytes3, this.cursor);
+    this.cursor += bytes3.length;
   }
   /**
    * @param {boolean} [reset]
@@ -21321,14 +21976,14 @@ function tokenBytes(token) {
 }
 __name(tokenBytes, "tokenBytes");
 function encodeBytes(writer, token) {
-  const bytes2 = tokenBytes(token);
-  encodeUintValue(writer, token.type.majorEncoded, bytes2.length);
-  writer.push(bytes2);
+  const bytes3 = tokenBytes(token);
+  encodeUintValue(writer, token.type.majorEncoded, bytes3.length);
+  writer.push(bytes3);
 }
 __name(encodeBytes, "encodeBytes");
 encodeBytes.encodedSize = /* @__PURE__ */ __name(function encodedSize4(token) {
-  const bytes2 = tokenBytes(token);
-  return encodeUintValue.encodedSize(bytes2.length) + bytes2.length;
+  const bytes3 = tokenBytes(token);
+  return encodeUintValue.encodedSize(bytes3.length) + bytes3.length;
 }, "encodedSize");
 encodeBytes.compareTokens = /* @__PURE__ */ __name(function compareTokens3(tok1, tok2) {
   return compareBytes(tokenBytes(tok1), tokenBytes(tok2));
@@ -21341,20 +21996,20 @@ __name(compareBytes, "compareBytes");
 // ../../node_modules/cborg/lib/3string.js
 var textDecoder = new TextDecoder();
 var ASCII_THRESHOLD = 32;
-function toStr(bytes2, start, end) {
+function toStr(bytes3, start, end) {
   const len = end - start;
   if (len < ASCII_THRESHOLD) {
     let str = "";
     for (let i = start; i < end; i++) {
-      const c = bytes2[i];
+      const c = bytes3[i];
       if (c & 128) {
-        return textDecoder.decode(bytes2.subarray(start, end));
+        return textDecoder.decode(bytes3.subarray(start, end));
       }
       str += String.fromCharCode(c);
     }
     return str;
   }
-  return textDecoder.decode(bytes2.subarray(start, end));
+  return textDecoder.decode(bytes3.subarray(start, end));
 }
 __name(toStr, "toStr");
 function toToken2(data, pos, prefix, length, options) {
@@ -21534,7 +22189,7 @@ function decodeBreak(_data, _pos, _minor, options) {
   return new Token(Type.break, void 0, 1);
 }
 __name(decodeBreak, "decodeBreak");
-function createToken(value, bytes2, options) {
+function createToken(value, bytes3, options) {
   if (options) {
     if (options.allowNaN === false && Number.isNaN(value)) {
       throw new Error(`${decodeErrPrefix} NaN values are not supported`);
@@ -21543,7 +22198,7 @@ function createToken(value, bytes2, options) {
       throw new Error(`${decodeErrPrefix} Infinity values are not supported`);
     }
   }
-  return new Token(Type.float, value, bytes2);
+  return new Token(Type.float, value, bytes3);
 }
 __name(createToken, "createToken");
 function decodeFloat16(data, pos, _minor, options) {
@@ -21741,13 +22396,13 @@ function majorSevenBytes(token, options) {
   if (cached !== void 0) {
     return cached;
   }
-  const bytes2 = encodeMajorSevenBytes(token, float64);
+  const bytes3 = encodeMajorSevenBytes(token, float64);
   if (float64) {
-    tokenEx._keyBytesFloat64 = bytes2;
+    tokenEx._keyBytesFloat64 = bytes3;
   } else {
-    tokenEx._keyBytes = bytes2;
+    tokenEx._keyBytes = bytes3;
   }
-  return bytes2;
+  return bytes3;
 }
 __name(majorSevenBytes, "majorSevenBytes");
 encodeFloat.compareTokens = /* @__PURE__ */ __name(function compareTokens4(tok1, tok2, options) {
@@ -22123,15 +22778,15 @@ var typeEncoders = {
    */
   Object(obj, typ, options, refStack) {
     const isMap = typ !== "Object";
-    const keys = isMap ? obj.keys() : Object.keys(obj);
-    const maxLength = isMap ? obj.size : keys.length;
+    const keys2 = isMap ? obj.keys() : Object.keys(obj);
+    const maxLength = isMap ? obj.size : keys2.length;
     let entries;
     if (maxLength) {
       entries = new Array(maxLength);
       refStack = Ref.createCheck(refStack, obj);
       const skipUndefined = !isMap && options.ignoreUndefinedProperties;
       let i = 0;
-      for (const key of keys) {
+      for (const key of keys2) {
         const value = isMap ? obj.get(key) : obj[key];
         if (skipUndefined && value === void 0) {
           continue;
@@ -22282,8 +22937,8 @@ function canDirectEncode(options) {
 __name(canDirectEncode, "canDirectEncode");
 function directEncodeMap(writer, data, typ, options, refStack) {
   const isMap = typ === "Map";
-  const keys = isMap ? data.keys() : Object.keys(data);
-  const maxLength = isMap ? data.size : keys.length;
+  const keys2 = isMap ? data.keys() : Object.keys(data);
+  const maxLength = isMap ? data.size : keys2.length;
   if (!maxLength) {
     writer.pushByte(MAJOR_MAP);
     return;
@@ -22292,7 +22947,7 @@ function directEncodeMap(writer, data, typ, options, refStack) {
   const skipUndefined = !isMap && options.ignoreUndefinedProperties;
   const entries = new Array(maxLength);
   let length = 0;
-  for (const key of keys) {
+  for (const key of keys2) {
     const value = isMap ? data.get(key) : data[key];
     if (skipUndefined && value === void 0) {
       continue;
@@ -22351,9 +23006,9 @@ function directEncode(writer, data, options, refStack) {
       }
       return;
     case "string": {
-      const bytes2 = fromString(data);
-      directEncodeUintValue(writer, MAJOR_STRING, bytes2.length);
-      writer.push(bytes2);
+      const bytes3 = fromString(data);
+      directEncodeUintValue(writer, MAJOR_STRING, bytes3.length);
+      writer.push(bytes3);
       return;
     }
     case "Uint8Array":
@@ -22716,15 +23371,15 @@ var AWS_ROOT_SHA256 = "641a0321a3e244efe456463195d606317ed7cdcc3c1756e09893f3c68
 var fail = /* @__PURE__ */ __name((reason) => {
   throw new NitroAttestationError(reason);
 }, "fail");
-var hex = /* @__PURE__ */ __name((bytes2) => Array.from(bytes2, (byte) => byte.toString(16).padStart(2, "0")).join(""), "hex");
+var hex = /* @__PURE__ */ __name((bytes3) => Array.from(bytes3, (byte) => byte.toString(16).padStart(2, "0")).join(""), "hex");
 var bytes = /* @__PURE__ */ __name((value, reason) => value instanceof Uint8Array && value.length > 0 ? value : fail(reason), "bytes");
 var map = /* @__PURE__ */ __name((value, reason) => value instanceof Map ? value : fail(reason), "map");
-var decodeCbor = /* @__PURE__ */ __name((value) => {
+var decodeCbor = /* @__PURE__ */ __name((value, { allowIndefinite = false } = {}) => {
   try {
     return decode(value, {
       useMaps: true,
       rejectDuplicateMapKeys: true,
-      allowIndefinite: false,
+      allowIndefinite,
       allowUndefined: false,
       allowNaN: false,
       allowInfinity: false,
@@ -22782,7 +23437,7 @@ var verifyNitroAttestationDocument = /* @__PURE__ */ __name(async (documentB64,
   const payloadBytes = bytes(payloadValue, "cose");
   const signature = bytes(signatureValue, "signature");
   if (signature.length !== 96) fail("signature");
-  const payload = map(decodeCbor(payloadBytes), "cbor");
+  const payload = map(decodeCbor(payloadBytes, { allowIndefinite: true }), "cbor");
   const moduleId = payload.get("module_id");
   const timestamp = payload.get("timestamp");
   if (typeof moduleId !== "string" || !moduleId || payload.get("digest") !== "SHA384")
@@ -22872,13 +23527,36 @@ var verifyNitroAttestationDocument = /* @__PURE__ */ __name(async (documentB64,
   } catch {
     return fail("user-data");
   }
+  const rawLedgerKey = payload.get("public_key");
+  let ledgerPublicKey;
+  let measurementHash;
+  if (rawLedgerKey !== void 0 && rawLedgerKey !== null) {
+    const ledger = new Uint8Array(bytes(rawLedgerKey, "user-data"));
+    if (ledger.length !== 65 || ledger[0] !== 4) fail("user-data");
+    try {
+      await crypto.subtle.importKey(
+        "raw",
+        ledger,
+        { name: "ECDSA", namedCurve: "P-256" },
+        false,
+        ["verify"]
+      );
+    } catch {
+      return fail("user-data");
+    }
+    const tuple = new Uint8Array(144);
+    for (let i = 0; i < 3; i++) tuple.set(bytes(rawPcrs.get(i), "pcr"), i * 48);
+    measurementHash = hex(new Uint8Array(await crypto.subtle.digest("SHA-256", tuple)));
+    ledgerPublicKey = bufferToBase64(ledger.buffer);
+  }
   return {
     escrowPublicKeySpkiB64: bufferToBase64(new Uint8Array(spki).buffer),
     keyId: newFormat?.keyId,
     previousKeyIds: newFormat?.previousKeyIds ?? [],
     pcrs,
     timestamp,
-    moduleId
+    moduleId,
+    ...ledgerPublicKey ? { ledgerPublicKey, measurementHash } : {}
   };
 }, "verifyNitroAttestationDocument");
 
@@ -22932,7 +23610,13 @@ var verifyEnclaveAttestation = /* @__PURE__ */ __name(async (attestation, policy
       publicKey: verified.escrowPublicKeySpkiB64,
       keyId: attestation.keyId,
       previousKeyIds: verified.previousKeyIds,
-      mode: "nitro"
+      mode: "nitro",
+      ...verified.keyId && verified.ledgerPublicKey && verified.measurementHash ? {
+        authority: {
+          ledgerPublicKey: verified.ledgerPublicKey,
+          measurement: verified.measurementHash
+        }
+      } : {}
     };
   }
   const publicKey = normalizePublicKey(attestation.publicKey);
@@ -22954,6 +23638,393 @@ var verifyEnclaveAttestation = /* @__PURE__ */ __name(async (attestation, policy
   };
 }, "verifyEnclaveAttestation");
 
+// src/escrow-authority.types.ts
+var EscrowEvidenceError = class extends Error {
+  static {
+    __name(this, "EscrowEvidenceError");
+  }
+  constructor() {
+    super("Automatic recovery evidence could not be verified.");
+    this.name = "EscrowEvidenceError";
+  }
+};
+
+// src/escrow-authority.ts
+var fail2 = /* @__PURE__ */ __name(() => {
+  throw new EscrowEvidenceError();
+}, "fail");
+var requireEvidence = /* @__PURE__ */ __name((condition) => {
+  if (!condition) fail2();
+}, "requireEvidence");
+var object = /* @__PURE__ */ __name((value) => {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return fail2();
+  return value;
+}, "object");
+var keys = /* @__PURE__ */ __name((value, names) => {
+  requireEvidence(
+    Object.keys(value).length === names.length && names.every((name) => Object.prototype.hasOwnProperty.call(value, name))
+  );
+}, "keys");
+var integer2 = /* @__PURE__ */ __name((value, minimum = 0, maximum = Number.MAX_SAFE_INTEGER) => {
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < minimum || value > maximum)
+    return fail2();
+  return value;
+}, "integer");
+var text = /* @__PURE__ */ __name((value, maximum) => {
+  if (typeof value !== "string" || !value.length || value.length > maximum) return fail2();
+  return value;
+}, "text");
+var bytes2 = /* @__PURE__ */ __name((value, length) => {
+  if (!Array.isArray(value) || value.length !== length || !value.every(
+    (byte) => typeof byte === "number" && Number.isInteger(byte) && byte >= 0 && byte <= 255
+  ))
+    return fail2();
+  return Uint8Array.from(value);
+}, "bytes");
+var base64 = /* @__PURE__ */ __name((value, maximum) => {
+  const encoded = text(value, maximum);
+  try {
+    const decoded = new Uint8Array(base64ToBuffer(encoded));
+    requireEvidence(bufferToBase64(decoded.buffer) === encoded);
+    return decoded;
+  } catch {
+    return fail2();
+  }
+}, "base64");
+var frame = /* @__PURE__ */ __name((value) => {
+  const result = new Uint8Array(4 + value.length);
+  new DataView(result.buffer).setUint32(0, value.length, false);
+  result.set(value, 4);
+  return result;
+}, "frame");
+var join2 = /* @__PURE__ */ __name((...values) => {
+  const result = new Uint8Array(values.reduce((n, v) => n + v.length, 0));
+  let offset = 0;
+  for (const value of values) {
+    result.set(value, offset);
+    offset += value.length;
+  }
+  return result;
+}, "join");
+var hash = /* @__PURE__ */ __name(async (value) => bytesToHex(new Uint8Array(await crypto.subtle.digest("SHA-256", new Uint8Array(value)))), "hash");
+var utf82 = /* @__PURE__ */ __name((value) => new TextEncoder().encode(value), "utf8");
+var escrowAuthorityMeasurements = /* @__PURE__ */ __name(async (policy) => {
+  if (policy.mode !== "nitro") return [];
+  const hashes = [];
+  for (const pin of policy.pinnedMeasurements) {
+    const tuple = [pin.pcr0, pin.pcr1, pin.pcr2];
+    if (!tuple.every((pcr) => typeof pcr === "string" && /^[0-9a-f]{96}$/i.test(pcr))) continue;
+    if (pin.pcr0 === "00".repeat(48)) continue;
+    const encoded = tuple.join("");
+    const decoded = Uint8Array.from(
+      { length: 144 },
+      (_, i) => parseInt(encoded.slice(i * 2, i * 2 + 2), 16)
+    );
+    hashes.push(await hash(decoded));
+  }
+  return hashes;
+}, "escrowAuthorityMeasurements");
+var P256_ORDER = BigInt("0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551");
+var verifyRecord = /* @__PURE__ */ __name(async (input, kind, identity, historical) => {
+  requireEvidence(identity.mode === "nitro" && !!identity.authority);
+  const raw = object(input);
+  keys(raw, ["version", "kind", "keyId", "measurement", "payload", "signature"]);
+  requireEvidence(raw.version === 1 && raw.kind === kind);
+  const keyId = text(raw.keyId, 128);
+  requireEvidence(
+    historical ? [identity.keyId, ...identity.previousKeyIds].includes(keyId) : keyId === identity.keyId
+  );
+  const measurement = bytes2(raw.measurement, 32);
+  requireEvidence(
+    historical ? historical.allowedMeasurements.includes(bytesToHex(measurement)) : bytesToHex(measurement) === identity.authority?.measurement
+  );
+  const payloadB64 = text(raw.payload, kind === "snapshot" ? 49152 : 8192);
+  const signatureB64 = text(raw.signature, 88);
+  const payload = base64(payloadB64, kind === "snapshot" ? 49152 : 8192);
+  const signature = base64(signatureB64, 88);
+  const ledgerKey = base64(identity.authority?.ledgerPublicKey, 88);
+  requireEvidence(ledgerKey.length === 65 && ledgerKey[0] === 4);
+  requireEvidence(signature.length === 64);
+  const s = BigInt(`0x${bytesToHex(signature.slice(32))}`);
+  requireEvidence(s > 0n && s <= P256_ORDER / 2n);
+  const message = join2(
+    utf82("learncard-authority-signed-record-v1\0"),
+    Uint8Array.of(kind === "snapshot" ? 2 : 1),
+    frame(utf82(keyId)),
+    measurement,
+    frame(payload)
+  );
+  try {
+    const key = await crypto.subtle.importKey(
+      "raw",
+      ledgerKey,
+      { name: "ECDSA", namedCurve: "P-256" },
+      false,
+      ["verify"]
+    );
+    requireEvidence(
+      await crypto.subtle.verify({ name: "ECDSA", hash: "SHA-256" }, key, signature, message)
+    );
+    const decoded = JSON.parse(
+      new TextDecoder("utf-8", { fatal: true }).decode(payload)
+    );
+    const record = {
+      version: 1,
+      kind,
+      keyId,
+      measurement: Array.from(measurement),
+      payload: payloadB64,
+      signature: signatureB64
+    };
+    return { record, payload: decoded };
+  } catch {
+    return fail2();
+  }
+}, "verifyRecord");
+var envelope = /* @__PURE__ */ __name((value) => {
+  try {
+    const e = parseEscrowEnvelope(value);
+    return {
+      version: e.version,
+      algorithm: e.algorithm,
+      keyId: e.keyId,
+      ephemeralPublicKey: e.ephemeralPublicKey,
+      salt: e.salt,
+      iv: e.iv,
+      ciphertext: e.ciphertext
+    };
+  } catch {
+    return fail2();
+  }
+}, "envelope");
+var state = /* @__PURE__ */ __name((value) => {
+  const raw = object(value);
+  keys(raw, [
+    "tenant",
+    "authorityGeneration",
+    "did",
+    "enrollmentVersion",
+    "enrollmentEpoch",
+    "status",
+    "envelope",
+    "shareVersion",
+    "hasPin",
+    "pinGeneration",
+    "attemptsUsed"
+  ]);
+  if (raw.status !== "empty" && raw.status !== "active" && raw.status !== "disabled")
+    return fail2();
+  if (typeof raw.hasPin !== "boolean") return fail2();
+  const result = {
+    tenant: text(raw.tenant, 128),
+    authorityGeneration: text(raw.authorityGeneration, 128),
+    did: text(raw.did, 8192),
+    enrollmentVersion: integer2(raw.enrollmentVersion),
+    enrollmentEpoch: integer2(raw.enrollmentEpoch),
+    status: raw.status,
+    envelope: raw.envelope === null ? null : envelope(raw.envelope),
+    shareVersion: raw.shareVersion === null ? null : integer2(raw.shareVersion, 1, 4294967295),
+    hasPin: raw.hasPin,
+    pinGeneration: integer2(raw.pinGeneration),
+    attemptsUsed: integer2(raw.attemptsUsed, 0, 10)
+  };
+  requireEvidence(
+    result.pinGeneration <= result.enrollmentVersion && result.enrollmentEpoch <= result.enrollmentVersion && (!result.hasPin || result.pinGeneration > 0) && (result.hasPin || result.attemptsUsed === 0)
+  );
+  if (result.status === "empty")
+    requireEvidence(
+      result.enrollmentVersion === 0 && result.enrollmentEpoch === 0 && !result.envelope && result.shareVersion === null && !result.hasPin
+    );
+  else requireEvidence(result.enrollmentVersion > 0 && result.enrollmentEpoch > 0);
+  if (result.status === "active")
+    requireEvidence(!!result.envelope && result.shareVersion !== null);
+  else requireEvidence(result.envelope === null && result.shareVersion === null);
+  return result;
+}, "state");
+var verifyEscrowAuthorityState = /* @__PURE__ */ __name(async (response, nonce, tenant, did, identity) => {
+  requireEvidence(/^[0-9a-f]{64}$/.test(nonce) && nonce.length === 64);
+  const raw = object(response);
+  keys(raw, ["state", "proof"]);
+  const { payload } = await verifyRecord(raw.proof, "snapshot", identity);
+  if (!Array.isArray(payload) || payload.length !== 2 || payload[0] !== nonce) return fail2();
+  const signed = state(payload[1]);
+  requireEvidence(signed.tenant === tenant && signed.did === did);
+  requireEvidence(JSON.stringify(signed) === JSON.stringify(state(raw.state)));
+  if (signed.envelope) {
+    requireEvidence(
+      [identity.keyId, ...identity.previousKeyIds].includes(signed.envelope.keyId)
+    );
+    await getEscrowBlobIdentity(signed.envelope);
+  }
+  return signed;
+}, "verifyEscrowAuthorityState");
+var verifyEscrowEnrollmentCommit = /* @__PURE__ */ __name(async (response, intent, identity) => {
+  const raw = object(response);
+  const { record, payload } = await verifyRecord(raw.receipt, "commit", identity);
+  const data = object(payload);
+  keys(data, ["commit", "eventHash", "requestDigest", "resultBlobIdentity", "enrollmentEpoch"]);
+  const commit = object(data.commit);
+  keys(commit, ["schemaVersion", "binding", "executionId", "revisions", "transactionDigest"]);
+  const binding = object(commit.binding);
+  keys(binding, ["tenant", "generation", "didHash"]);
+  const revisions = object(commit.revisions);
+  keys(revisions, ["operation", "enrollment"]);
+  requireEvidence(
+    commit.schemaVersion === 1 && binding.tenant === intent.tenant && binding.generation === intent.authorityGeneration
+  );
+  requireEvidence(bytesToHex(bytes2(binding.didHash, 32)) === await hash(utf82(intent.did)));
+  requireEvidence(
+    integer2(revisions.enrollment, 1) === intent.expectedEnrollmentVersion + 1 && integer2(revisions.operation, 1) >= integer2(revisions.enrollment, 1)
+  );
+  bytes2(commit.executionId, 16);
+  bytes2(commit.transactionDigest, 32);
+  bytes2(data.eventHash, 32);
+  requireEvidence(integer2(data.enrollmentEpoch, 1) === intent.enrollmentEpoch);
+  requireEvidence(
+    bytesToHex(bytes2(data.requestDigest, 32)) === await hash(encodeEscrowEnrollmentIntent(intent))
+  );
+  if (intent.action === "disable") {
+    requireEvidence(
+      (raw.envelope === null || raw.envelope === void 0) && data.resultBlobIdentity === null
+    );
+    return { envelope: null, receipt: record };
+  }
+  const output = envelope(raw.envelope);
+  requireEvidence(
+    output.keyId === identity.keyId && bytesToHex(bytes2(data.resultBlobIdentity, 32)) === await getEscrowBlobIdentity(output)
+  );
+  return { envelope: output, receipt: record };
+}, "verifyEscrowEnrollmentCommit");
+var holdDigest = /* @__PURE__ */ __name(async (tenant, record) => {
+  const h2 = record.hold;
+  const didHash = await hash(utf82(h2.did));
+  return hash(
+    utf82(
+      JSON.stringify([
+        "learncard-hold-v1",
+        tenant,
+        h2.holdId,
+        didHash,
+        h2.shareVersion,
+        h2.blobHash,
+        h2.enrollmentEpoch,
+        h2.releasePolicy,
+        h2.clientEphemeralPublicKey,
+        h2.createdLo,
+        h2.createdHi,
+        record.holdDurationMs,
+        h2.policyVersion,
+        record.ledgerSeq
+      ])
+    )
+  );
+}, "holdDigest");
+var verifyEscrowHoldRecord = /* @__PURE__ */ __name(async (record, expected, identity, historical) => {
+  requireEvidence(
+    record.hold.holdId === expected.holdId && record.hold.did === expected.did && record.hold.clientEphemeralPublicKey === expected.clientEphemeralPublicKey && record.hold.blobHash === expected.blobHash
+  );
+  let signed;
+  try {
+    signed = JSON.parse(
+      new TextDecoder("utf-8", { fatal: true }).decode(base64(record.hold.signature, 8192))
+    );
+  } catch {
+    return fail2();
+  }
+  const { record: receipt, payload } = await verifyRecord(signed, "commit", identity, historical);
+  const data = object(payload);
+  keys(data, ["commit", "eventHash", "requestDigest", "resultBlobIdentity", "enrollmentEpoch"]);
+  const commit = object(data.commit);
+  keys(commit, ["schemaVersion", "binding", "executionId", "revisions", "transactionDigest"]);
+  const binding = object(commit.binding);
+  keys(binding, ["tenant", "generation", "didHash"]);
+  requireEvidence(commit.schemaVersion === 1 && binding.tenant === expected.tenant);
+  const authorityGeneration = text(binding.generation, 128);
+  if (historical) requireEvidence(authorityGeneration === historical.authorityGeneration);
+  requireEvidence(bytesToHex(bytes2(binding.didHash, 32)) === await hash(utf82(expected.did)));
+  requireEvidence(integer2(data.enrollmentEpoch, 1) === record.hold.enrollmentEpoch);
+  requireEvidence(bytesToHex(bytes2(data.resultBlobIdentity, 32)) === record.hold.blobHash);
+  const digest = await holdDigest(expected.tenant, record);
+  requireEvidence(bytesToHex(bytes2(data.requestDigest, 32)) === digest);
+  return { receipt, authorityGeneration, holdDigest: digest };
+}, "verifyEscrowHoldRecord");
+var verifyEscrowHoldConfirmation = /* @__PURE__ */ __name(async (receipt, record, expected, identity) => {
+  const raw = object(receipt);
+  const kind = raw.kind;
+  if (kind !== "commit" && kind !== "snapshot") return fail2();
+  const { record: verified, payload } = await verifyRecord(raw, kind, identity);
+  if (kind === "snapshot") {
+    if (!Array.isArray(payload) || payload.length !== 7) return fail2();
+    const [tag, holdId, digestBytes] = payload;
+    requireEvidence(
+      tag === "learncard-authority-hold-snapshot-v2" && holdId === record.hold.holdId && payload[6] === expected.authorityGeneration
+    );
+    requireEvidence(
+      bytesToHex(bytes2(digestBytes, 32)) === await holdDigest(expected.tenant, record)
+    );
+    requireEvidence(payload[3] === "pending");
+    integer2(payload[4], 1);
+    return verified;
+  }
+  const data = object(payload);
+  keys(data, ["commit", "eventHash", "requestDigest", "resultBlobIdentity", "enrollmentEpoch"]);
+  const commit = object(data.commit);
+  keys(commit, ["schemaVersion", "binding", "executionId", "revisions", "transactionDigest"]);
+  const binding = object(commit.binding);
+  keys(binding, ["tenant", "generation", "didHash"]);
+  requireEvidence(
+    commit.schemaVersion === 1 && binding.tenant === expected.tenant && binding.generation === expected.authorityGeneration
+  );
+  requireEvidence(bytesToHex(bytes2(binding.didHash, 32)) === await hash(utf82(expected.did)));
+  requireEvidence(integer2(data.enrollmentEpoch, 1) === record.hold.enrollmentEpoch);
+  requireEvidence(bytesToHex(bytes2(data.resultBlobIdentity, 32)) === record.hold.blobHash);
+  bytes2(data.requestDigest, 32);
+  return verified;
+}, "verifyEscrowHoldConfirmation");
+var resolveEscrowEnrollmentAction = /* @__PURE__ */ __name((current, input) => {
+  const disabling = input === "disable";
+  const pinAction = disabling ? "keep" : input === "set" ? current.hasPin ? "change" : "set" : input === "clear" ? current.hasPin ? "clear" : "keep" : "keep";
+  const action = disabling ? "disable" : current.status !== "active" ? "enroll" : current.hasPin && pinAction === "keep" ? "carry" : "replace";
+  return { action, pinAction, bindsRecoveryContact: action === "enroll" || action === "replace" };
+}, "resolveEscrowEnrollmentAction");
+var violatesCarryContactRule = /* @__PURE__ */ __name((action, target) => action === "carry" && !!target && (!!target.recoveryEmail || !!target.recoveryLanguage), "violatesCarryContactRule");
+var createEscrowEnrollmentIntent = /* @__PURE__ */ __name(async (input) => {
+  const current = state(input.state);
+  const target = input.target === null ? null : envelope(input.target);
+  const disabling = input.pinAction === "disable";
+  requireEvidence(
+    current.enrollmentVersion < Number.MAX_SAFE_INTEGER && (disabling || current.enrollmentEpoch < Number.MAX_SAFE_INTEGER)
+  );
+  if (disabling && current.status !== "active") return fail2();
+  if (current.status === "disabled" && current.hasPin && input.pinAction === "automatic")
+    return fail2();
+  const { action, pinAction, bindsRecoveryContact } = resolveEscrowEnrollmentAction(
+    current,
+    input.pinAction
+  );
+  requireEvidence(!disabling || input.target === null);
+  requireEvidence(disabling || input.target !== null);
+  if (action === "carry") requireEvidence(input.shareVersion > (current.shareVersion ?? 0));
+  const intent = {
+    version: 2,
+    tenant: current.tenant,
+    did: current.did,
+    authorityGeneration: current.authorityGeneration,
+    expectedEnrollmentVersion: current.enrollmentVersion,
+    action,
+    sourceBlobIdentity: current.envelope ? await getEscrowBlobIdentity(current.envelope) : null,
+    targetBlobIdentity: target ? await getEscrowBlobIdentity(target) : null,
+    pinAction,
+    shareVersion: disabling ? current.shareVersion : input.shareVersion,
+    enrollmentEpoch: current.enrollmentEpoch + (disabling ? 0 : 1),
+    requestId: crypto.randomUUID(),
+    allowRewrap: !disabling,
+    recoveryEmail: bindsRecoveryContact ? input.recoveryEmail : null,
+    recoveryLanguage: bindsRecoveryContact ? input.recoveryLanguage : null
+  };
+  return signEscrowEnrollmentIntent(intent, input.privateKey);
+}, "createEscrowEnrollmentIntent");
+
 // src/types.ts
 var import_types = __toESM(require_dist());
 var EscrowPinUnavailableError = class extends Error {
@@ -23698,6 +24769,10 @@ function createSSSStrategy(config) {
   const localWrites = /* @__PURE__ */ new Set();
   const guardedStorage = /* @__PURE__ */ __name(() => {
     const generation = storageGeneration;
+    const assertCurrent = /* @__PURE__ */ __name(() => {
+      if (generation !== storageGeneration)
+        throw new Error("This recovery request was cancelled.");
+    }, "assertCurrent");
     const write = /* @__PURE__ */ __name((operation) => {
       if (generation !== storageGeneration) {
         return Promise.reject(new Error("This recovery request was cancelled."));
@@ -23708,6 +24783,7 @@ function createSSSStrategy(config) {
     }, "write");
     const guarded = {
       ...storage,
+      assertCurrent,
       storeDeviceShare: /* @__PURE__ */ __name((share, id) => write(() => storage.storeDeviceShare(share, id)), "storeDeviceShare"),
       storeShareVersion: /* @__PURE__ */ __name((version, id) => write(() => storage.storeShareVersion(version, id)), "storeShareVersion"),
       clearAllShares: /* @__PURE__ */ __name((id) => write(() => storage.clearAllShares(id)), "clearAllShares"),
@@ -23725,6 +24801,7 @@ function createSSSStrategy(config) {
   let lastServerSnapshot = null;
   let escrowEnrollmentInFlight;
   let staleEscrowReenrollAttempted = false;
+  let verifiedEscrowEnvelope;
   let unenrolledRotation;
   const escrowRequest = /* @__PURE__ */ __name(async (path, init, pinAttempt = false) => {
     const response = await fetch(`${serverUrl}/keys/escrow${path}`, {
@@ -23783,16 +24860,89 @@ function createSSSStrategy(config) {
     );
     return verifyEnclaveAttestation(attestation, config.escrow.attestation, nonce);
   }, "fetchVerifiedEnclaveKey");
-  const enrollEscrow = /* @__PURE__ */ __name(async (token, providerType, privateKey, primaryDid, shares, shareVersion, signDidAuthVp, verifiedKey, pinMaterial, clearPin = false) => {
+  const fetchEscrowHoldStatus = /* @__PURE__ */ __name(async (params) => {
+    const query = new URLSearchParams(
+      "holdId" in params ? { holdId: params.holdId } : { providerType: params.providerType }
+    );
+    const secret = "holdId" in params ? params.resumeToken : params.token;
+    const result = await escrowRequest(`/status?${query}`, {
+      method: "GET",
+      headers: {
+        ...buildHeaders("", void 0, tenantId),
+        "X-Auth-Token": secret
+      }
+    });
+    return result.hold;
+  }, "fetchEscrowHoldStatus");
+  const recoveryExpectations = /* @__PURE__ */ __name((holdId, expected) => {
+    if (!expected || expected.holdId !== holdId || expected.tenant !== (tenantId ?? "learncard") || !expected.did || !expected.clientEphemeralPublicKey || !expected.blobHash || !expected.authorityGeneration || !expected.holdDigest || !expected.ledgerPublicKey || !expected.keyId)
+      throw new EscrowEvidenceError();
+    return { ...expected };
+  }, "recoveryExpectations");
+  const verifyPendingHold = /* @__PURE__ */ __name(async (status, expected, identity) => {
+    if (!config.escrow || identity.mode !== "nitro" || !identity.authority || identity.authority.ledgerPublicKey !== expected.ledgerPublicKey || ![identity.keyId, ...identity.previousKeyIds].includes(expected.keyId) || status.holdId !== expected.holdId || !status.holdRecord)
+      throw new EscrowEvidenceError();
+    const record = status.holdRecord;
+    const verified = await verifyEscrowHoldRecord(record, expected, identity, {
+      historical: true,
+      allowedMeasurements: await escrowAuthorityMeasurements(config.escrow.attestation),
+      authorityGeneration: expected.authorityGeneration
+    });
+    if (verified.holdDigest !== expected.holdDigest || verified.receipt.keyId !== expected.keyId)
+      throw new EscrowEvidenceError();
+    return record;
+  }, "verifyPendingHold");
+  const fetchAuthorityState = /* @__PURE__ */ __name(async (token, providerType, privateKey, did, signer, identity, assertCurrent) => {
+    assertCurrent();
+    if (identity.mode !== "nitro" || !identity.authority)
+      throw new Error("The enclave does not support verified enrollment.");
+    const nonce = Array.from(
+      crypto.getRandomValues(new Uint8Array(32)),
+      (byte) => byte.toString(16).padStart(2, "0")
+    ).join("");
+    const vp = await requestFreshDidAuthVp(serverUrl, privateKey, did, signer, tenantId);
+    assertCurrent();
+    const response = await escrowRequest("/authority-state", {
+      method: "POST",
+      headers: buildHeaders(token, vp, tenantId),
+      body: JSON.stringify({ authToken: token, providerType, nonce })
+    });
+    const result = await verifyEscrowAuthorityState(
+      response,
+      nonce,
+      tenantId ?? "learncard",
+      did,
+      identity
+    );
+    assertCurrent();
+    return result;
+  }, "fetchAuthorityState");
+  const enrollEscrow = /* @__PURE__ */ __name(async (token, providerType, privateKey, primaryDid, shares, shareVersion, signDidAuthVp, verifiedKey, pinMaterial, clearPin = false, assertCurrent = guardedStorage().assertCurrent, recoveryEmail = "", recoveryLanguage = "") => {
     if (!config.escrow?.enabled) throw new Error("Escrow enrollment is disabled");
     if (!signDidAuthVp) throw new Error("DID proof signing is required for escrow enrollment");
-    const { publicKey, keyId } = verifiedKey ?? await fetchVerifiedEnclaveKey();
-    const envelope = await encryptEscrowBlob(
+    const identity = verifiedKey ?? await fetchVerifiedEnclaveKey();
+    assertCurrent();
+    const { publicKey, keyId } = identity;
+    const authority = config.escrow.attestation.mode === "nitro" ? await fetchAuthorityState(
+      token,
+      providerType,
+      privateKey,
+      primaryDid,
+      signDidAuthVp,
+      identity,
+      assertCurrent
+    ) : void 0;
+    const bindsRecoveryContact = !authority || resolveEscrowEnrollmentAction(
+      authority,
+      pinMaterial ? "set" : clearPin ? "clear" : "automatic"
+    ).bindsRecoveryContact;
+    const envelope2 = await encryptEscrowBlob(
       {
         recoveryShare: shares.recoveryShare,
         did: primaryDid,
         shareVersion,
-        ...pinMaterial ? { pinVerifier: pinMaterial.pinVerifier } : {}
+        ...pinMaterial ? { pinVerifier: pinMaterial.pinVerifier } : {},
+        ...authority && recoveryEmail && bindsRecoveryContact ? { recoveryEmail, recoveryLanguage } : {}
       },
       publicKey,
       keyId
@@ -23804,36 +24954,60 @@ function createSSSStrategy(config) {
       signDidAuthVp,
       tenantId
     );
-    await escrowRequest("", {
+    const signedIntent = authority ? await createEscrowEnrollmentIntent({
+      state: authority,
+      target: envelope2,
+      shareVersion,
+      privateKey,
+      pinAction: pinMaterial ? "set" : clearPin ? "clear" : "automatic",
+      recoveryEmail,
+      recoveryLanguage
+    }) : void 0;
+    assertCurrent();
+    verifiedEscrowEnvelope = void 0;
+    const response = await escrowRequest("", {
       method: "POST",
       headers: buildHeaders(token, vp, tenantId),
       body: JSON.stringify({
         authToken: token,
         providerType,
-        envelope,
+        envelope: envelope2,
         shareVersion,
         enclaveKeyId: keyId,
         ...pinMaterial ? { pinSalt: pinMaterial.pinSalt } : {},
-        ...clearPin ? { clearPin: true } : {}
+        ...(signedIntent ? signedIntent.intent.pinAction === "clear" : clearPin) ? { clearPin: true } : {},
+        ...signedIntent ? { signedIntent, sourceEnvelope: authority?.envelope ?? null } : {}
       })
     });
+    if (signedIntent) {
+      const committed = await verifyEscrowEnrollmentCommit(
+        response,
+        signedIntent.intent,
+        identity
+      );
+      assertCurrent();
+      verifiedEscrowEnvelope = committed.envelope ?? void 0;
+    }
   }, "enrollEscrow");
   const tryEnrollEscrow = /* @__PURE__ */ __name(async (...args) => {
     if (!config.escrow?.enabled) return;
     try {
       await enrollEscrow(...args);
-    } catch (err) {
+    } catch (err2) {
       try {
-        if (config.onEscrowError) config.onEscrowError(err);
+        if (config.onEscrowError) config.onEscrowError(err2);
         else console.warn("SSS: escrow enrollment failed");
       } catch {
         console.warn("SSS: escrow error reporting failed");
       }
     }
   }, "tryEnrollEscrow");
-  const ensureEscrowEnrollmentUnguarded = /* @__PURE__ */ __name(async (self, params, storage2, forceRotate = false) => {
+  const ensureEscrowEnrollmentUnguarded = /* @__PURE__ */ __name(async (self, params, storage2, forceRotate = false, allowDisabledEnrollment = false) => {
+    let clearPinForEnrollment = forceRotate;
     if (!config.escrow?.enabled) return { enrolled: false, reason: "disabled" };
     const pin = params.options?.pin;
+    const recoveryEmail = params.options?.recoveryEmail ?? "";
+    const recoveryLanguage = params.options?.recoveryLanguage ?? "";
     if (pin !== void 0) {
       const validation = validatePin(pin);
       if (!validation.ok)
@@ -23842,12 +25016,35 @@ function createSSSStrategy(config) {
         );
     }
     const status = await self.fetchServerKeyStatus(params.token, params.providerType);
+    storage2.assertCurrent();
     if (status.escrowOptedOut) return { enrolled: false, reason: "opted-out" };
-    const currentlyEnrolled = status.shareVersion !== null && status.recoveryMethods.some(
+    let currentlyEnrolled = status.shareVersion !== null && status.recoveryMethods.some(
       (method) => method.type === "escrow" && method.shareVersion === status.shareVersion && (Boolean(method.confirmedAt) || "confirmationStatus" in method && method.confirmationStatus === "confirmed")
     );
-    const repairingStaleBlob = pin === void 0 && !forceRotate && currentlyEnrolled && !!status.escrowStale && !staleEscrowReenrollAttempted;
-    if (!forceRotate && pin === void 0 && currentlyEnrolled && !repairingStaleBlob)
+    let verifiedKey;
+    if (config.escrow.attestation.mode === "nitro") {
+      if (!status.primaryDid || !params.signDidAuthVp)
+        throw new Error("Owner proof signing is required for escrow enrollment.");
+      verifiedKey = await fetchVerifiedEnclaveKey();
+      const current = await fetchAuthorityState(
+        params.token,
+        params.providerType,
+        params.privateKey,
+        status.primaryDid,
+        params.signDidAuthVp,
+        verifiedKey,
+        storage2.assertCurrent
+      );
+      if (current.status === "disabled") {
+        verifiedEscrowEnvelope = void 0;
+        if (!allowDisabledEnrollment) return { enrolled: false, reason: "opted-out" };
+        clearPinForEnrollment ||= current.hasPin && pin === void 0;
+      }
+      currentlyEnrolled = currentlyEnrolled && current.status === "active" && current.shareVersion === status.shareVersion && current.envelope?.keyId === verifiedKey.keyId;
+      if (currentlyEnrolled) verifiedEscrowEnvelope = current.envelope ?? void 0;
+    }
+    const repairingStaleBlob = pin === void 0 && !clearPinForEnrollment && currentlyEnrolled && !!status.escrowStale && !staleEscrowReenrollAttempted;
+    if (!clearPinForEnrollment && pin === void 0 && currentlyEnrolled && !repairingStaleBlob)
       return { enrolled: true, changed: false };
     if (repairingStaleBlob) staleEscrowReenrollAttempted = true;
     if (!status.primaryDid) throw new Error("Cannot enroll escrow without a primary DID");
@@ -23855,7 +25052,7 @@ function createSSSStrategy(config) {
       throw new Error("DID proof signing is required for escrow enrollment");
     }
     try {
-      if (!forceRotate && pin === void 0 && unenrolledRotation && unenrolledRotation.shareVersion === status.shareVersion && unenrolledRotation.primaryDid === status.primaryDid) {
+      if (!clearPinForEnrollment && pin === void 0 && unenrolledRotation && unenrolledRotation.shareVersion === status.shareVersion && unenrolledRotation.primaryDid === status.primaryDid) {
         const retry = unenrolledRotation;
         await enrollEscrow(
           params.token,
@@ -23867,12 +25064,16 @@ function createSSSStrategy(config) {
           params.signDidAuthVp,
           void 0,
           void 0,
-          retry.clearPin
+          retry.clearPin,
+          storage2.assertCurrent,
+          recoveryEmail,
+          recoveryLanguage
         );
         unenrolledRotation = void 0;
         return { enrolled: true, changed: true, shareVersion: retry.shareVersion };
       }
-      const verifiedKey = await fetchVerifiedEnclaveKey();
+      verifiedKey ??= await fetchVerifiedEnclaveKey();
+      storage2.assertCurrent();
       const pinSalt = pin !== void 0 ? generatePinSalt() : void 0;
       const pinMaterial = pin !== void 0 && pinSalt !== void 0 ? { pinSalt, pinVerifier: await derivePinProof(pin, pinSalt) } : void 0;
       const storageId = activeStorageId;
@@ -23901,7 +25102,12 @@ function createSSSStrategy(config) {
         authShare: shares.authShare,
         primaryDid: status.primaryDid
       };
-      unenrolledRotation = pinMaterial ? void 0 : { shares, shareVersion, primaryDid: status.primaryDid, clearPin: forceRotate };
+      unenrolledRotation = pinMaterial ? void 0 : {
+        shares,
+        shareVersion,
+        primaryDid: status.primaryDid,
+        clearPin: clearPinForEnrollment
+      };
       await enrollEscrow(
         params.token,
         params.providerType,
@@ -23912,14 +25118,17 @@ function createSSSStrategy(config) {
         params.signDidAuthVp,
         verifiedKey,
         pinMaterial,
-        forceRotate
+        clearPinForEnrollment,
+        storage2.assertCurrent,
+        recoveryEmail,
+        recoveryLanguage
       );
       unenrolledRotation = void 0;
       return { enrolled: true, changed: true, shareVersion };
-    } catch (err) {
-      if (!repairingStaleBlob) throw err;
+    } catch (err2) {
+      if (!repairingStaleBlob || config.escrow.attestation.mode === "nitro") throw err2;
       try {
-        if (config.onEscrowError) config.onEscrowError(err);
+        if (config.onEscrowError) config.onEscrowError(err2);
         else console.warn("SSS: escrow enrollment failed");
       } catch {
         console.warn("SSS: escrow error reporting failed");
@@ -23958,6 +25167,7 @@ function createSSSStrategy(config) {
     },
     // --- User scoping ---
     setActiveUser(userId) {
+      verifiedEscrowEnvelope = void 0;
       if (activeStorageId !== `sss-device-share:${userId}`) storageGeneration++;
       activeStorageId = `sss-device-share:${userId}`;
       lastServerSnapshot = null;
@@ -24002,6 +25212,7 @@ function createSSSStrategy(config) {
         );
       }
       storageGeneration++;
+      verifiedEscrowEnvelope = void 0;
       await Promise.allSettled(localWrites);
       await clearPendingShareCandidates(storage, storageId);
       return storage.clearAllShares(storageId);
@@ -24300,8 +25511,58 @@ function createSSSStrategy(config) {
       return { state: enrolled ? "enrolled" : "not-enrolled", escrowPin: status.escrowPin };
     },
     async disableEscrowRecovery(params) {
+      const assertCurrent = guardedStorage().assertCurrent;
       const status = await this.fetchServerKeyStatus(params.token, params.providerType);
       if (!status.primaryDid) throw new Error("Cannot disable escrow without a primary DID");
+      if (config.escrow?.attestation.mode === "nitro") {
+        const identity = await fetchVerifiedEnclaveKey();
+        const current = await fetchAuthorityState(
+          params.token,
+          params.providerType,
+          params.privateKey,
+          status.primaryDid,
+          params.signDidAuthVp,
+          identity,
+          assertCurrent
+        );
+        if (current.status === "disabled") {
+          verifiedEscrowEnvelope = void 0;
+          return;
+        }
+        const signedIntent = await createEscrowEnrollmentIntent({
+          state: current,
+          target: null,
+          shareVersion: current.shareVersion ?? 0,
+          privateKey: params.privateKey,
+          pinAction: "disable",
+          // Disable always nulls these server-side regardless of input.
+          recoveryEmail: "",
+          recoveryLanguage: ""
+        });
+        const vp2 = await requestFreshDidAuthVp(
+          serverUrl,
+          params.privateKey,
+          status.primaryDid,
+          params.signDidAuthVp,
+          tenantId
+        );
+        assertCurrent();
+        const response = await escrowRequest("/disable", {
+          method: "POST",
+          headers: buildHeaders(params.token, vp2, tenantId),
+          body: JSON.stringify({
+            authToken: params.token,
+            providerType: params.providerType,
+            optOut: true,
+            signedIntent,
+            sourceEnvelope: current.envelope
+          })
+        });
+        await verifyEscrowEnrollmentCommit(response, signedIntent.intent, identity);
+        assertCurrent();
+        verifiedEscrowEnvelope = void 0;
+        return;
+      }
       const vp = await requestFreshDidAuthVp(
         serverUrl,
         params.privateKey,
@@ -24342,13 +25603,29 @@ function createSSSStrategy(config) {
             providerType: params.providerType
           })
         });
-        return ensureEscrowEnrollmentUnguarded(this, params, storage2);
+        return ensureEscrowEnrollmentUnguarded(this, params, storage2, false, true);
       });
     },
     async setEscrowPin({ pin, ...params }) {
       const storage2 = guardedStorage();
       const result = await withRotationLock(
-        () => ensureEscrowEnrollmentUnguarded(this, { ...params, options: { pin } }, storage2)
+        () => (
+          // P9.1: preserve the caller's recoveryEmail/recoveryLanguage — do
+          // not replace `params.options` wholesale, or nitro enroll/replace
+          // loses its required recovery contact.
+          ensureEscrowEnrollmentUnguarded(
+            this,
+            {
+              ...params,
+              options: {
+                pin,
+                recoveryEmail: params.options?.recoveryEmail,
+                recoveryLanguage: params.options?.recoveryLanguage
+              }
+            },
+            storage2
+          )
+        )
       );
       if (!result.enrolled || !result.changed) {
         throw new Error("Automatic recovery is not available for this account.");
@@ -24380,8 +25657,15 @@ function createSSSStrategy(config) {
         escrowEnrollmentInFlight = void 0;
       }
     },
+    getVerifiedEscrowEnvelope() {
+      return verifiedEscrowEnvelope ? { ...verifiedEscrowEnvelope } : null;
+    },
     /** Start or explicitly restart a hold with fresh client-bound resume secrets. */
     async startEscrowRecovery(params) {
+      const expectedDid = params.expectedDid;
+      const nitro = config.escrow?.attestation.mode === "nitro";
+      if (nitro && (!expectedDid || (params.tenantId ?? tenantId) !== tenantId))
+        throw new EscrowEvidenceError();
       const sessionProof = params.recoverySessionToken !== void 0;
       if (sessionProof ? params.token !== void 0 || params.providerType !== void 0 : !params.token || !params.providerType) {
         throw new Error("Provide exactly one identity proof");
@@ -24401,25 +25685,101 @@ function createSSSStrategy(config) {
         },
         params.options?.releasePolicy === "pin"
       );
-      return { ...result, clientEphemeralPrivateKey: pair.privateKey };
+      let expectations;
+      if (nitro && result.resumeToken !== null) {
+        const identity = await fetchVerifiedEnclaveKey();
+        if (identity.mode !== "nitro" || !identity.authority || !result.holdRecord || !expectedDid)
+          throw new EscrowEvidenceError();
+        const verified = await verifyEscrowHoldRecord(
+          result.holdRecord,
+          {
+            tenant: tenantId ?? "learncard",
+            did: expectedDid,
+            holdId: result.holdId,
+            clientEphemeralPublicKey: pair.publicKey,
+            blobHash: result.holdRecord.hold.blobHash
+          },
+          identity
+        );
+        expectations = {
+          tenant: tenantId ?? "learncard",
+          did: expectedDid,
+          holdId: result.holdId,
+          clientEphemeralPublicKey: pair.publicKey,
+          blobHash: result.holdRecord.hold.blobHash,
+          authorityGeneration: verified.authorityGeneration,
+          holdDigest: verified.holdDigest,
+          ledgerPublicKey: identity.authority.ledgerPublicKey,
+          keyId: verified.receipt.keyId
+        };
+      }
+      return { ...result, clientEphemeralPrivateKey: pair.privateKey, expectations };
     },
     /** Read hold status; secrets (auth or resume token) never travel in a URL. */
     async getEscrowRecoveryStatus(params) {
-      const query = new URLSearchParams(
-        "holdId" in params ? { holdId: params.holdId } : { providerType: params.providerType }
-      );
-      const secret = "holdId" in params ? params.resumeToken : params.token;
-      const result = await escrowRequest(
-        `/status?${query}`,
-        {
-          method: "GET",
-          headers: {
-            ...buildHeaders("", void 0, tenantId),
-            "X-Auth-Token": secret
-          }
+      const expected = config.escrow?.attestation.mode === "nitro" && "holdId" in params ? recoveryExpectations(params.holdId, params.expectations) : void 0;
+      const status = await fetchEscrowHoldStatus(params);
+      if (expected && status)
+        await verifyPendingHold(status, expected, await fetchVerifiedEnclaveKey());
+      return status;
+    },
+    /** Submit the confirmation code emailed by the enclave for an authority-mode hold. */
+    async confirmEscrowRecovery(params) {
+      let pending;
+      if (config.escrow?.attestation.mode === "nitro") {
+        const expected = recoveryExpectations(params.holdId, params.expectations);
+        if ((params.tenantId ?? tenantId) !== tenantId) throw new EscrowEvidenceError();
+        const identity = await fetchVerifiedEnclaveKey();
+        const status = await fetchEscrowHoldStatus({
+          holdId: params.holdId,
+          resumeToken: params.resumeToken
+        });
+        if (!status?.holdRecord) {
+          throw new EscrowEvidenceError();
         }
-      );
-      return result.hold;
+        const holdRecord = await verifyPendingHold(status, expected, identity);
+        pending = { identity, holdRecord, expected };
+      }
+      const confirm = /* @__PURE__ */ __name(() => escrowRequest("/confirm", {
+        method: "POST",
+        headers: buildHeaders("", void 0, params.tenantId ?? tenantId),
+        body: JSON.stringify({
+          holdId: params.holdId,
+          resumeToken: params.resumeToken,
+          code: params.code
+        })
+      }), "confirm");
+      const result = await confirm();
+      if (pending) {
+        if (!result.receipt) {
+          throw new EscrowEvidenceError();
+        }
+        const receipt = await verifyEscrowHoldConfirmation(
+          result.receipt,
+          pending.holdRecord,
+          pending.expected,
+          pending.identity
+        );
+        if (receipt.kind === "commit") {
+          const readback = await confirm();
+          const snapshot = await verifyEscrowHoldConfirmation(
+            readback.receipt,
+            pending.holdRecord,
+            pending.expected,
+            pending.identity
+          );
+          if (snapshot.kind !== "snapshot") throw new EscrowEvidenceError();
+        }
+      }
+      return { success: true };
+    },
+    /** Request a fresh confirmation code for a hold awaiting confirmation. */
+    async resendEscrowRecoveryCode(params) {
+      return escrowRequest("/resend", {
+        method: "POST",
+        headers: buildHeaders("", void 0, params.tenantId ?? tenantId),
+        body: JSON.stringify({ holdId: params.holdId, resumeToken: params.resumeToken })
+      });
     },
     /** Cancel a pending hold with a fresh DID-owner proof. */
     async cancelEscrowRecovery(params) {
@@ -24451,8 +25811,19 @@ function createSSSStrategy(config) {
         const start = input.method === "escrow-pin" ? await this.startEscrowRecovery({
           token,
           providerType,
+          expectedDid: input.expectedDid,
           options: { releasePolicy: "pin" }
         }) : input;
+        const expected = config.escrow?.attestation.mode === "nitro" ? recoveryExpectations(start.holdId, start.expectations) : void 0;
+        if (expected) {
+          if (!start.resumeToken) throw new EscrowEvidenceError();
+          const status = await fetchEscrowHoldStatus({
+            holdId: start.holdId,
+            resumeToken: start.resumeToken
+          });
+          if (!status) throw new EscrowEvidenceError();
+          await verifyPendingHold(status, expected, await fetchVerifiedEnclaveKey());
+        }
         let pinProof;
         if (input.method === "escrow-pin") {
           if (!("pinSalt" in start) || !start.pinSalt || !start.resumeToken)
@@ -24476,6 +25847,8 @@ function createSSSStrategy(config) {
           material.sealedShare,
           start.clientEphemeralPrivateKey
         );
+        if (expected && (plaintext.did !== expected.did || plaintext.holdId !== expected.holdId))
+          throw new EscrowEvidenceError();
         if (plaintext.holdId !== start.holdId || plaintext.did !== material.primaryDid || plaintext.shareVersion !== material.shareVersion) {
           throw new Error("Escrow recovery material does not match the request");
         }
@@ -24889,10 +26262,10 @@ function createSSSStrategy(config) {
         const pending = pendingPhraseConfirmation;
         if (!pending) throw new Error("Generate a new recovery phrase to continue");
         const phraseWords = pending.phrase.trim().toLowerCase().split(/\s+/);
-        const matches = input.challengeWords.length === pending.challengeWordIndices.length && pending.challengeWordIndices.every(
+        const matches2 = input.challengeWords.length === pending.challengeWordIndices.length && pending.challengeWordIndices.every(
           (wordIndex, answerIndex) => input.challengeWords[answerIndex]?.trim().toLowerCase() === phraseWords[wordIndex]
         );
-        if (!matches) {
+        if (!matches2) {
           throw new Error("Those words do not match. Check your phrase and try again.");
         }
       } else if (input.method === "backup") {
@@ -25278,6 +26651,7 @@ function createSSSStrategy(config) {
     },
     async cleanup() {
       storageGeneration++;
+      verifiedEscrowEnvelope = void 0;
       await Promise.allSettled(localWrites);
     }
   };
@@ -25498,3 +26872,8 @@ var notifyDevicesForQrSession = /* @__PURE__ */ __name(async (config, sessionId,
     return { sent: false, deviceCount: 0 };
   }
 }, "notifyDevicesForQrSession");
+/*! Bundled license information:
+
+@noble/ed25519/index.js:
+  (*! noble-ed25519 - MIT License (c) 2019 Paul Miller (paulmillr.com) *)
+*/