@learncard/sss-key-manager 0.2.1 → 0.2.2

package/dist/sss-strategy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sss-strategy.d.ts","sourceRoot":"","sources":["../src/sss-strategy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EACR,wBAAwB,EAaxB,uBAAuB,EAI1B,MAAM,SAAS,CAAC;AAqBjB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAyC/D,MAAM,WAAW,mBAAmB;IAChC,gBAAgB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,cAAc,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACxD,cAAc,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAClD,cAAc,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,iBAAiB,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,eAAe,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC5D;AAED,MAAM,WAAW,iBAAiB;IAC9B,0EAA0E;IAC1E,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,uBAAuB,CAAA;KAAE,CAAC;IAEpE,oEAAoE;IACpE,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC;IAEvC,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;IAElB,uDAAuD;IACvD,OAAO,CAAC,EAAE,mBAAmB,CAAC;IAE9B;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IAEjC,4EAA4E;IAC5E,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B,8EAA8E;IAC9E,aAAa,CAAC,EAAE,kBAAkB,CAAC;IAEnC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB;AA0BD,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAiBhD,gFAAgF;AAChF,qBAAa,kBAAmB,SAAQ,KAAK;aACb,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM;CAI7C;AAgLD;;;GAGG;AACH,qBAAa,oCAAqC,SAAQ,KAAK;gBAC/C,OAAO,EAAE,MAAM;CAI9B;AA+ED,2EAA2E;AAC3E,eAAO,MAAM,+BAA+B,IAAI,CAAC;AAEjD,eAAO,MAAM,oCAAoC,GAC7C,WAAW,MAAM,EACjB,uBAAgD,KACjD,MAAM,EAoBR,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,IAAI,CAAC;AAEpC,eAAO,MAAM,yBAAyB,GAAI,YAAY,MAAM,EAAE,cAAc,MAAM,KAAG,MACT,CAAC;AAE7E;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,GACjC,OAAO,MAAM,KACd;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;CAY9C,CAAC;AAqDF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAI,CAAC,EAAE,WAAW,MAAM,OAAO,CAAC,CAAC,CAAC,KAAG,OAAO,CAAC,CAAC,CAI1E,CAAC;AAOF,uFAAuF;AACvF,eAAO,MAAM,uBAAuB,QAAiB,CAAC;AAGtD,MAAM,WAAW,qBAAqB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,GACnC,SAAS,mBAAmB,EAC5B,YAAY,MAAM,KACnB,OAAO,CAAC,qBAAqB,EAAE,CA0BjC,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,2BAA2B,GACpC,SAAS,mBAAmB,EAC5B,YAAY,MAAM,KACnB,OAAO,CAAC,IAAI,CAAsD,CAAC;AAEtE,0FAA0F;AAC1F,eAAO,MAAM,2BAA2B,GACpC,SAAS,mBAAmB,EAC5B,YAAY,qBAAqB,EAAE,EACnC,YAAY,MAAM,KACnB,OAAO,CAAC,IAAI,CAGd,CAAC;AAEF,iFAAiF;AACjF,eAAO,MAAM,wBAAwB,GACjC,SAAS,mBAAmB,EAC5B,WAAW,qBAAqB,EAChC,YAAY,MAAM,KACnB,OAAO,CAAC,IAAI,CAUd,CAAC;AAEF,+FAA+F;AAC/F,eAAO,MAAM,2BAA2B,GACpC,SAAS,mBAAmB,EAC5B,OAAO,MAAM,EACb,YAAY,MAAM,KACnB,OAAO,CAAC,IAAI,CAOd,CAAC;AAEF,UAAU,oBAAoB;IAC1B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,GACtC,SAAS,mBAAmB,EAC5B,WAAW,MAAM,GAAG,SAAS,EAC7B,cAAc,MAAM,OAAO,CAAC,oBAAoB,CAAC,EACjD,aAAa,MAAM,EACnB,mBAAmB,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,EACnD,mBAAkB,MAAM,IAAe,EACvC,aAAa,CAAC,QAAQ,EAAE,oBAAoB,KAAK,IAAI,EACrD,kBAAkB,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,KAC9D,OAAO,CAAC;IAAE,QAAQ,EAAE,oBAAoB,CAAC;IAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAwGvE,CAAC;AAgJF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,wBAAwB,CA8mErF;AAED,YAAY,EAAE,wBAAwB,EAAE,CAAC"}
+{"version":3,"file":"sss-strategy.d.ts","sourceRoot":"","sources":["../src/sss-strategy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EACR,wBAAwB,EAaxB,uBAAuB,EAI1B,MAAM,SAAS,CAAC;AAmCjB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAyC/D,MAAM,WAAW,mBAAmB;IAChC,gBAAgB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,cAAc,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACxD,cAAc,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAClD,cAAc,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,iBAAiB,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,eAAe,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC5D;AAED,MAAM,WAAW,iBAAiB;IAC9B,0EAA0E;IAC1E,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,uBAAuB,CAAA;KAAE,CAAC;IAEpE,oEAAoE;IACpE,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC;IAEvC,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;IAElB,uDAAuD;IACvD,OAAO,CAAC,EAAE,mBAAmB,CAAC;IAE9B;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IAEjC,4EAA4E;IAC5E,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B,8EAA8E;IAC9E,aAAa,CAAC,EAAE,kBAAkB,CAAC;IAEnC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB;AA0BD,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAiBhD,gFAAgF;AAChF,qBAAa,kBAAmB,SAAQ,KAAK;aACb,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM;CAI7C;AAiLD;;;GAGG;AACH,qBAAa,oCAAqC,SAAQ,KAAK;gBAC/C,OAAO,EAAE,MAAM;CAI9B;AA+ED,2EAA2E;AAC3E,eAAO,MAAM,+BAA+B,IAAI,CAAC;AAEjD,eAAO,MAAM,oCAAoC,GAC7C,WAAW,MAAM,EACjB,uBAAgD,KACjD,MAAM,EAoBR,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,IAAI,CAAC;AAEpC,eAAO,MAAM,yBAAyB,GAAI,YAAY,MAAM,EAAE,cAAc,MAAM,KAAG,MACT,CAAC;AAE7E;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,GACjC,OAAO,MAAM,KACd;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;CAY9C,CAAC;AAqDF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAI,CAAC,EAAE,WAAW,MAAM,OAAO,CAAC,CAAC,CAAC,KAAG,OAAO,CAAC,CAAC,CAI1E,CAAC;AAOF,uFAAuF;AACvF,eAAO,MAAM,uBAAuB,QAAiB,CAAC;AAGtD,MAAM,WAAW,qBAAqB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,GACnC,SAAS,mBAAmB,EAC5B,YAAY,MAAM,KACnB,OAAO,CAAC,qBAAqB,EAAE,CA0BjC,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,2BAA2B,GACpC,SAAS,mBAAmB,EAC5B,YAAY,MAAM,KACnB,OAAO,CAAC,IAAI,CAAsD,CAAC;AAEtE,0FAA0F;AAC1F,eAAO,MAAM,2BAA2B,GACpC,SAAS,mBAAmB,EAC5B,YAAY,qBAAqB,EAAE,EACnC,YAAY,MAAM,KACnB,OAAO,CAAC,IAAI,CAGd,CAAC;AAEF,iFAAiF;AACjF,eAAO,MAAM,wBAAwB,GACjC,SAAS,mBAAmB,EAC5B,WAAW,qBAAqB,EAChC,YAAY,MAAM,KACnB,OAAO,CAAC,IAAI,CAUd,CAAC;AAEF,+FAA+F;AAC/F,eAAO,MAAM,2BAA2B,GACpC,SAAS,mBAAmB,EAC5B,OAAO,MAAM,EACb,YAAY,MAAM,KACnB,OAAO,CAAC,IAAI,CAOd,CAAC;AAEF,UAAU,oBAAoB;IAC1B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,GACtC,SAAS,mBAAmB,EAC5B,WAAW,MAAM,GAAG,SAAS,EAC7B,cAAc,MAAM,OAAO,CAAC,oBAAoB,CAAC,EACjD,aAAa,MAAM,EACnB,mBAAmB,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,EACnD,mBAAkB,MAAM,IAAe,EACvC,aAAa,CAAC,QAAQ,EAAE,oBAAoB,KAAK,IAAI,EACrD,kBAAkB,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,KAC9D,OAAO,CAAC;IAAE,QAAQ,EAAE,oBAAoB,CAAC;IAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAwGvE,CAAC;AAgJF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,wBAAwB,CAwhFrF;AAED,YAAY,EAAE,wBAAwB,EAAE,CAAC"}

package/dist/types.d.ts

@@ -53,9 +53,18 @@ export interface EscrowHoldStatus {
     releaseAfter: string;
     cancelledAt?: string;
     completedAt?: string;
+    /** Only present for an authority-mode hold-policy hold; `confirmed` only appears alongside it. */
+    requiresConfirmation?: boolean;
+    confirmed?: boolean;
+    /** Opaque enclave-signed `SignedHoldRecord`; present only in authority
+     * (nitro) mode. Callers must verify it with `verifyEscrowHoldRecord`
+     * before trusting any field inside it — see escrow-authority.ts. */
+    holdRecord?: import('./escrow-authority').EscrowHoldRecordLike;
 }
 /** Persist these secrets securely until completion; a null token means an existing hold. */
 export type EscrowRecoveryStart = EscrowHoldStatus & {
+    /** Persist with the secrets, never rebuild from server status. Required for Nitro resume. */
+    expectations?: import('@learncard/types').EscrowRecoveryExpectations;
     resumeToken: string | null;
     clientEphemeralPrivateKey: string;
     pinSalt?: string;
@@ -103,11 +112,14 @@ export type RecoveryMethod = PasskeyRecoveryMethod | BackupFileRecoveryMethod |
 export type RecoveryInput = {
     method: 'escrow-pin';
     pin: string;
+    expectedDid?: string;
 } | {
     method: 'escrow';
     holdId: string;
     resumeToken: string;
     clientEphemeralPrivateKey: string;
+    /** Original start bindings loaded with the private key, required for Nitro. */
+    expectations?: import('@learncard/types').EscrowRecoveryExpectations;
 } | {
     method: 'passkey';
     credentialId: string;
@@ -227,7 +239,10 @@ export interface SSSKeyManagerConfig {
  * The SSS key derivation strategy — a KeyDerivationStrategy narrowed
  * with SSS-specific recovery input/output types.
  */
-export type SSSKeyDerivationStrategy = KeyDerivationStrategy<RecoveryInput, RecoverySetupInput, RecoverySetupResult, RecoveryConfirmationInput>;
+export type SSSKeyDerivationStrategy = KeyDerivationStrategy<RecoveryInput, RecoverySetupInput, RecoverySetupResult, RecoveryConfirmationInput> & {
+    /** Last receipt/snapshot-verified ciphertext for this session, never a freshness oracle. */
+    getVerifiedEscrowEnvelope?(): import('./escrow-crypto').EscrowEnvelope | null;
+};
 /** @deprecated Use KeyDerivationStrategy instead. Kept for legacy SSSKeyManager class. */
 export interface KeyDerivationProvider {
     readonly name: string;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,EACH,gBAAgB,EAChB,KAAK,gBAAgB,EACrB,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,uBAAuB,EAC5B,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,eAAe,GACvB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EACR,YAAY,EACZ,gBAAgB,EAChB,qBAAqB,EACrB,kBAAkB,EAClB,kBAAkB,EACrB,MAAM,kBAAkB,CAAC;AAM1B,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,OAAO,CAAC;AAElD,MAAM,WAAW,aAAa;IAC1B,IAAI,EAAE,iBAAiB,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,mBAAmB;IAChC,IAAI,EAAE,gBAAgB,CAAC;IACvB,EAAE,EAAE,MAAM,CAAC;CACd;AAMD,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,UAAU,GAAG,UAAU,CAAC;AAE9D,eAAO,MAAM,cAAc,EAAE,SAAS,aAAa,EAA+C,CAAC;AAMnG;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEtF,oEAAoE;AACpE,MAAM,MAAM,uBAAuB,GAC7B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,gBAAgB,EAAE,MAAM,EAAE,CAAA;CAAE,GAChD;IACI,IAAI,EAAE,OAAO,CAAC;IACd,+EAA+E;IAC/E,kBAAkB,EAAE,CACd;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAClE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CACzE,EAAE,CAAC;IACJ,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAER,0DAA0D;AAC1D,MAAM,WAAW,gBAAgB;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,GAAG,KAAK,CAAC;IAC9B,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,WAAW,GAAG,SAAS,CAAC;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,4FAA4F;AAC5F,MAAM,MAAM,mBAAmB,GAAG,gBAAgB,GAAG;IACjD,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,yBAAyB,EAAE,MAAM,CAAC;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,uDAAuD;AACvD,qBAAa,yBAA0B,SAAQ,KAAK;;CAKnD;AAED,uFAAuF;AACvF,qBAAa,sBAAuB,SAAQ,KAAK;aACjB,iBAAiB,EAAE,MAAM;gBAAzB,iBAAiB,EAAE,MAAM;CAIxD;AAED,yFAAyF;AACzF,qBAAa,uBAAwB,SAAQ,KAAK;;CAKjD;AAED,iEAAiE;AACjE,qBAAa,+BAAgC,SAAQ,KAAK;aAC1B,UAAU,CAAC,EAAE,MAAM;gBAAnB,UAAU,CAAC,EAAE,MAAM,YAAA;CAIlD;AAED,4EAA4E;AAC5E,qBAAa,oBAAqB,SAAQ,KAAK;;CAK9C;AAED,MAAM,WAAW,qBAAqB;IAClC,IAAI,EAAE,SAAS,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,wBAAwB;IACrC,IAAI,EAAE,QAAQ,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,4BAA4B;IACzC,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAClB;AAED,kFAAkF;AAClF,MAAM,MAAM,cAAc,GACtB,qBAAqB,GAAG,wBAAwB,GAAG,4BAA4B,CAAC;AAEpF;;GAEG;AACH,MAAM,MAAM,aAAa,GACnB;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,yBAAyB,EAAE,MAAM,CAAA;CAAE,GAC5F;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9C;;GAEG;AACH,MAAM,MAAM,kBAAkB,GACxB;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GACpB;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzC;;GAEG;AACH,MAAM,MAAM,mBAAmB,GACzB;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC3C;IACI,MAAM,EAAE,QAAQ,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,uFAAuF;IACvF,oBAAoB,EAAE,MAAM,EAAE,EAAE,CAAC;CACpC,GACD;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,UAAU,EAAE,UAAU,CAAA;CAAE,GAC5C;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,CAAC;AAE1B,uEAAuE;AACvE,MAAM,MAAM,yBAAyB,GAC/B;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,cAAc,EAAE,MAAM,EAAE,CAAA;CAAE,GAC9C;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAMxC,MAAM,WAAW,cAAc;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,EAAE,EAAE,MAAM,CAAC;CACd;AAMD,MAAM,WAAW,aAAa;IAC1B,aAAa,EAAE,aAAa,CAAC;IAC7B,aAAa,EAAE,mBAAmB,EAAE,CAAC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,WAAW,EAAE,UAAU,GAAG,KAAK,CAAC;IAChC,SAAS,CAAC,EAAE,oBAAoB,CAAC;IACjC,aAAa,EAAE,aAAa,CAAC;IAC7B,eAAe,EAAE,kBAAkB,EAAE,CAAC;IACtC,oBAAoB,EAAE,OAAO,CAAC;IAC9B,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,oBAAoB,CAAC,EAAE,IAAI,CAAC;IAC5B,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACvB,OAAO,EAAE,CAAC,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mFAAmF;IACnF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE;QACZ,UAAU,EAAE,MAAM,CAAC;QACnB,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE;YACP,SAAS,EAAE,UAAU,CAAC;YACtB,QAAQ,EAAE,MAAM,CAAC;YACjB,UAAU,EAAE,MAAM,CAAC;YACnB,WAAW,EAAE,MAAM,CAAC;SACvB,CAAC;KACL,CAAC;CACL;AAMD,MAAM,WAAW,mBAAmB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,YAAY,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAMD;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GAAG,qBAAqB,CACxD,aAAa,EACb,kBAAkB,EAClB,mBAAmB,EACnB,yBAAyB,CAC5B,CAAC;AAMF,0FAA0F;AAC1F,MAAM,WAAW,qBAAqB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3B,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,aAAa,IAAI,OAAO,CAAC;IACzB,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,UAAU,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,OAAO,CAAC,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,0FAA0F;AAC1F,MAAM,WAAW,wBAAyB,SAAQ,qBAAqB;IACnE,iBAAiB,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,kBAAkB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACpD,OAAO,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACjD,gBAAgB,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3C,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CACvD"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,EACH,gBAAgB,EAChB,KAAK,gBAAgB,EACrB,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,uBAAuB,EAC5B,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,eAAe,GACvB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EACR,YAAY,EACZ,gBAAgB,EAChB,qBAAqB,EACrB,kBAAkB,EAClB,kBAAkB,EACrB,MAAM,kBAAkB,CAAC;AAM1B,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,OAAO,CAAC;AAElD,MAAM,WAAW,aAAa;IAC1B,IAAI,EAAE,iBAAiB,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,mBAAmB;IAChC,IAAI,EAAE,gBAAgB,CAAC;IACvB,EAAE,EAAE,MAAM,CAAC;CACd;AAMD,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,UAAU,GAAG,UAAU,CAAC;AAE9D,eAAO,MAAM,cAAc,EAAE,SAAS,aAAa,EAA+C,CAAC;AAMnG;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEtF,oEAAoE;AACpE,MAAM,MAAM,uBAAuB,GAC7B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,gBAAgB,EAAE,MAAM,EAAE,CAAA;CAAE,GAChD;IACI,IAAI,EAAE,OAAO,CAAC;IACd,+EAA+E;IAC/E,kBAAkB,EAAE,CACd;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAClE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CACzE,EAAE,CAAC;IACJ,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAER,0DAA0D;AAC1D,MAAM,WAAW,gBAAgB;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,GAAG,KAAK,CAAC;IAC9B,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,WAAW,GAAG,SAAS,CAAC;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kGAAkG;IAClG,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;wEAEoE;IACpE,UAAU,CAAC,EAAE,OAAO,oBAAoB,EAAE,oBAAoB,CAAC;CAClE;AAED,4FAA4F;AAC5F,MAAM,MAAM,mBAAmB,GAAG,gBAAgB,GAAG;IACjD,6FAA6F;IAC7F,YAAY,CAAC,EAAE,OAAO,kBAAkB,EAAE,0BAA0B,CAAC;IACrE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,yBAAyB,EAAE,MAAM,CAAC;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,uDAAuD;AACvD,qBAAa,yBAA0B,SAAQ,KAAK;;CAKnD;AAED,uFAAuF;AACvF,qBAAa,sBAAuB,SAAQ,KAAK;aACjB,iBAAiB,EAAE,MAAM;gBAAzB,iBAAiB,EAAE,MAAM;CAIxD;AAED,yFAAyF;AACzF,qBAAa,uBAAwB,SAAQ,KAAK;;CAKjD;AAED,iEAAiE;AACjE,qBAAa,+BAAgC,SAAQ,KAAK;aAC1B,UAAU,CAAC,EAAE,MAAM;gBAAnB,UAAU,CAAC,EAAE,MAAM,YAAA;CAIlD;AAED,4EAA4E;AAC5E,qBAAa,oBAAqB,SAAQ,KAAK;;CAK9C;AAED,MAAM,WAAW,qBAAqB;IAClC,IAAI,EAAE,SAAS,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,wBAAwB;IACrC,IAAI,EAAE,QAAQ,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,4BAA4B;IACzC,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAClB;AAED,kFAAkF;AAClF,MAAM,MAAM,cAAc,GACtB,qBAAqB,GAAG,wBAAwB,GAAG,4BAA4B,CAAC;AAEpF;;GAEG;AACH,MAAM,MAAM,aAAa,GACnB;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3D;IACI,MAAM,EAAE,QAAQ,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,yBAAyB,EAAE,MAAM,CAAC;IAClC,+EAA+E;IAC/E,YAAY,CAAC,EAAE,OAAO,kBAAkB,EAAE,0BAA0B,CAAC;CACxE,GACD;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9C;;GAEG;AACH,MAAM,MAAM,kBAAkB,GACxB;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GACpB;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzC;;GAEG;AACH,MAAM,MAAM,mBAAmB,GACzB;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC3C;IACI,MAAM,EAAE,QAAQ,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,uFAAuF;IACvF,oBAAoB,EAAE,MAAM,EAAE,EAAE,CAAC;CACpC,GACD;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,UAAU,EAAE,UAAU,CAAA;CAAE,GAC5C;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,CAAC;AAE1B,uEAAuE;AACvE,MAAM,MAAM,yBAAyB,GAC/B;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,cAAc,EAAE,MAAM,EAAE,CAAA;CAAE,GAC9C;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAMxC,MAAM,WAAW,cAAc;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,EAAE,EAAE,MAAM,CAAC;CACd;AAMD,MAAM,WAAW,aAAa;IAC1B,aAAa,EAAE,aAAa,CAAC;IAC7B,aAAa,EAAE,mBAAmB,EAAE,CAAC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,WAAW,EAAE,UAAU,GAAG,KAAK,CAAC;IAChC,SAAS,CAAC,EAAE,oBAAoB,CAAC;IACjC,aAAa,EAAE,aAAa,CAAC;IAC7B,eAAe,EAAE,kBAAkB,EAAE,CAAC;IACtC,oBAAoB,EAAE,OAAO,CAAC;IAC9B,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,oBAAoB,CAAC,EAAE,IAAI,CAAC;IAC5B,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACvB,OAAO,EAAE,CAAC,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mFAAmF;IACnF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE;QACZ,UAAU,EAAE,MAAM,CAAC;QACnB,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE;YACP,SAAS,EAAE,UAAU,CAAC;YACtB,QAAQ,EAAE,MAAM,CAAC;YACjB,UAAU,EAAE,MAAM,CAAC;YACnB,WAAW,EAAE,MAAM,CAAC;SACvB,CAAC;KACL,CAAC;CACL;AAMD,MAAM,WAAW,mBAAmB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,YAAY,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAMD;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GAAG,qBAAqB,CACxD,aAAa,EACb,kBAAkB,EAClB,mBAAmB,EACnB,yBAAyB,CAC5B,GAAG;IACA,4FAA4F;IAC5F,yBAAyB,CAAC,IAAI,OAAO,iBAAiB,EAAE,cAAc,GAAG,IAAI,CAAC;CACjF,CAAC;AAMF,0FAA0F;AAC1F,MAAM,WAAW,qBAAqB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3B,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,aAAa,IAAI,OAAO,CAAC;IACzB,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,UAAU,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,OAAO,CAAC,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,0FAA0F;AAC1F,MAAM,WAAW,wBAAyB,SAAQ,qBAAqB;IACnE,iBAAiB,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,kBAAkB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACpD,OAAO,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACjD,gBAAgB,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3C,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CACvD"}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@learncard/sss-key-manager",
-    "version": "0.2.1",
+    "version": "0.2.2",
     "description": "Shamir Secret Sharing key manager for LearnCard - replaces Web3Auth SFA",
     "main": "./dist/index.js",
     "module": "./dist/sss-key-manager.esm.js",
@@ -39,7 +39,7 @@
         "vitest": "4.1.11"
     },
     "dependencies": {
-        "@learncard/types": "5.23.0",
+        "@learncard/types": "5.23.1",
         "@noble/ed25519": "^2.0.0",
         "@peculiar/x509": "^2.1.0",
         "@scure/bip39": "^1.2.1",

package/src/__fixtures__/escrow-authority-v1.json

@@ -0,0 +1,96 @@
+{
+    "attestation": {
+        "document": "hEShATgioFkKPKlpbW9kdWxlX2lkeBxsZWFybmNhcmQtZmFrZS1uc20tVEVTVC1PTkxZZmRpZ2VzdGZTSEEzODRpdGltZXN0YW1wGwAAAaDV3JwAZHBjcnOwAFgwAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAVgwAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAlgwAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDA1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABFgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABVgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABlgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACFgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACVgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAClgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADFgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADVgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADlgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD1gwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAa2NlcnRpZmljYXRlWQHrMIIB5zCCAW6gAwIBAgIBAzAKBggqhkjOPQQDAzAxMS8wLQYDVQQDDCZMZWFybkNhcmQgVEVTVCBPTkxZIE5pdHJvIEludGVybWVkaWF0ZTAgFw0yMDAxMDEwMDAwMDBaGA8yMDUwMDEwMTAwMDAwMFowKTEnMCUGA1UEAwweTGVhcm5DYXJkIFRFU1QgT05MWSBOaXRybyBMZWFmMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEdQabXARWaQiOuZ0QS62W7zyoYWXFX0SRGecTMHxr6Sy0WYLodow0Zh9kA2z/PJMEbTFczp0cEKI5ARnMoqH/3jQce8MenSb96Us9FiinYg35Z0F1QXY1fkOGfA65UyXZo2AwXjAdBgNVHQ4EFgQUt2vMI6fK0TeuRX9Gj/Ci4qt4UxswHwYDVR0jBBgwFoAU9rnIupQhj3sUlPlGC7/i+CjpXWEwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCBsAwCgYIKoZIzj0EAwMDZwAwZAIxAP6kP6OfQ8hfRNIBKHqYLzulqDhpHF/ELggbaekIp3y8g8+cS2iDFGJHU7Nwxgo9cAIvbkcqbnWXD4KVfvm2Fu74C0k52WHIeFHWo3gWoZl4xUoJNcbAwl/K7dUzroJ5eYpoY2FidW5kbGWCWQHGMIIBwjCCAUigAwIBAgIBATAKBggqhkjOPQQDAzApMScwJQYDVQQDDB5MZWFybkNhcmQgVEVTVCBPTkxZIE5pdHJvIFJvb3QwIBcNMjAwMTAxMDAwMDAwWhgPMjA1MDAxMDEwMDAwMDBaMCkxJzAlBgNVBAMMHkxlYXJuQ2FyZCBURVNUIE9OTFkgTml0cm8gUm9vdDB2MBAGByqGSM49AgEGBSuBBAAiA2IABBck9uTlAFdttlkj3wkMkhPJrXNJONf0FdJ5LLG8snfdW2PcZRQBGONRWfeZRqriSz+YkAODjFMLLnsBgWoBqER90QsPa2AG4OjfOPIlmTHBqdjVRJ2zVK76DOKqU5xinaNCMEAwHQYDVR0OBBYEFH5W2DvY+F7QW1n4UyVGh7YW3YnbMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMDA2gAMGUCMQC3icReCK/AVxSDJpCGMMq06g5DlbIYg1Tg9Ad+cZvYD0yr0ZuomoKL4B8JI0GBGiUCMFkQ4nGjuxzQu9jc7gb3O2UEhxivT2I2/8/PNwOH2sbZ/YY5Za+AsWQ2vgbabHJxY1kB8jCCAe4wggF0oAMCAQICAQIwCgYIKoZIzj0EAwMwKTEnMCUGA1UEAwweTGVhcm5DYXJkIFRFU1QgT05MWSBOaXRybyBSb290MCAXDTIwMDEwMTAwMDAwMFoYDzIwNTAwMTAxMDAwMDAwWjAxMS8wLQYDVQQDDCZMZWFybkNhcmQgVEVTVCBPTkxZIE5pdHJvIEludGVybWVkaWF0ZTB2MBAGByqGSM49AgEGBSuBBAAiA2IABGS45j1AmR2mOP/f8437hRypn8X88Gri0F3ukeQ6vAG6vgPWXpMm5DJWySsP5xqe1y4xuoSSSl/ECo5g/go+ppuXWg2YmGwFmFAw18mi39YtH2zYd/lY03T+gqvBRHIVlqNmMGQwHQYDVR0OBBYEFPa5yLqUIY97FJT5Rgu/4vgo6V1hMB8GA1UdIwQYMBaAFH5W2DvY+F7QW1n4UyVGh7YW3YnbMBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMDA2gAMGUCMQDWVUT93T7YGS5rcopboRgTcmJqOTd9j1WNnm3bSAaU8iKmgQYr+bh4VP6mA0BSREYCMB9MkGP7KwnI4P1vdBlOmGQ5FgSacsqJavHR/e38iEi/DqaemC/sZVXODSpn6ImgRGpwdWJsaWNfa2V5WEEEDJAdQjyDHKheJ8c8JjuhMnIbudeoTE8DgLKmdW/WATMciHAjTeyHhQTBdBRPpLFLZqZRaRYG2Bc+Vb0344FWnml1c2VyX2RhdGFYeKMAWFswWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASdfkbDJpoWkVh2Xub1+35oXcwboZqdYV7uu9OoQY2iiN9C1ppFdY2ZhsL1p9+PZPCjLZGVaQ5MYURMlALn9/3fAWp0ZXN0LWtleS4xAoFqdGVzdC1rZXkuMGVub25jZVggCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQlYYKOZ100/FJuT18UBAgslTfShpoFHl1Y/8IgHZbNz9S/S0Zk7YduKPTQZhyRUmlgZNsj3PgyMyRMM2dYhlW0cd2qhwuyIvKIbmlHyqDuEVV/O4dwpXs+Hzyw6tVO66DomPg==",
+        "issuedAt": "2026-09-25T00:00:00Z",
+        "keyId": "test-key.1",
+        "measurements": {},
+        "mode": "nitro",
+        "previousKeyIds": ["test-key.0"],
+        "publicKey": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEnX5GwyaaFpFYdl7m9ft+aF3MG6GanWFe7rvTqEGNoojfQtaaRXWNmYbC9affj2Twoy2RlWkOTGFETJQC5/f93w=="
+    },
+    "committed": {
+        "envelope": {
+            "algorithm": "P-256-HKDF-SHA256-AES-256-GCM",
+            "ciphertext": "S96eKmzfe/5DXEmEGqi7BDdt8uJH0OUIcAi3GpbZd6awzw6ESw13MQJbcJTjYSrBQs5HjY2vMQ4g0NKD5SV/e2IVINm8/4DMONdGA7QBQBBiyJMrkd8D1PG4n158julYSLYW23wV1nzDmBR4CV75PNrlPDFUHxhPsB3FNPOI0DgU6U4FWEa+bPnKzlreDf7gg//eHkXb1eFk03/mnTJbeg9UMbJumWVW/suUb8kFe2bM0aDDr4PTtnSeGIBbMN1Vyx60E4D3Kf8zj7JDyxMIAeq+1G4wiVmk0hmLQkZHJLJB2+7GFG9WYDlAURADyY8TfKjQj0mu3jprvmxB/0AYmXxwdD5xwFw8aPP7sfBVPQ==",
+            "ephemeralPublicKey": "BBG5nTX3CmOrXNjR8EYzX6uqe2IZR7f5OzIVliIhNOhsChy0+F5LRygXKE5omQ6APUnxKLTiqqm/BQvfsLqnclY=",
+            "iv": "rVGvjLFM1nwaey1f",
+            "keyId": "test-key.1",
+            "salt": "az337mLgh/FKQS5a8rgEhEf/IwRlXqETsri1auxtnCE=",
+            "version": 1
+        },
+        "receipt": {
+            "keyId": "test-key.1",
+            "kind": "commit",
+            "measurement": [
+                104, 246, 220, 65, 85, 5, 178, 132, 55, 240, 220, 184, 36, 221, 238, 197, 123, 192,
+                254, 252, 44, 2, 36, 71, 113, 41, 136, 81, 211, 167, 12, 127
+            ],
+            "payload": "eyJjb21taXQiOnsiYmluZGluZyI6eyJkaWRIYXNoIjpbNiw4OCwxMjgsMTQyLDEzMywyMDQsMTMxLDIzLDE1NiwyMTIsMjIyLDM3LDE3NiwxMTIsMjAzLDE4NywzMiwxNTMsMjA4LDIxLDExNCw2MCwxMjIsMTc2LDIxNywxOSw3MiwxNCwxMywyMTcsNiwyMDFdLCJnZW5lcmF0aW9uIjoic3RhZ2luZy1nMiIsInRlbmFudCI6ImxlYXJuY2FyZCJ9LCJleGVjdXRpb25JZCI6WzEsMSwxLDEsMSwxLDEsMSwxLDEsMSwxLDEsMSwxLDFdLCJyZXZpc2lvbnMiOnsiZW5yb2xsbWVudCI6OCwib3BlcmF0aW9uIjoxMn0sInNjaGVtYVZlcnNpb24iOjEsInRyYW5zYWN0aW9uRGlnZXN0IjpbMiwyLDIsMiwyLDIsMiwyLDIsMiwyLDIsMiwyLDIsMiwyLDIsMiwyLDIsMiwyLDIsMiwyLDIsMiwyLDIsMiwyXX0sImVucm9sbG1lbnRFcG9jaCI6NCwiZXZlbnRIYXNoIjpbMywzLDMsMywzLDMsMywzLDMsMywzLDMsMywzLDMsMywzLDMsMywzLDMsMywzLDMsMywzLDMsMywzLDMsMywzXSwicmVxdWVzdERpZ2VzdCI6WzE2MiwxNDEsMTk2LDIsMTk1LDE4MSw5MSwyOSw3OSwxNDIsMTIzLDMxLDUwLDEyNCw2Myw5NiwxMTUsMTI1LDUzLDE0MCwxMCw4NSwxMTYsMjQxLDkxLDExOSw2NCwyMDgsMTE5LDE0Nyw2Nyw3Nl0sInJlc3VsdEJsb2JJZGVudGl0eSI6WzQ5LDIyMCwzNSwxMjYsMjAsMjM1LDQ3LDQ5LDIyLDIyMCw4NSw4OSwxNjksNCwyMTUsNDcsMTEzLDIxNSwxMDMsMzQsNywxMDgsNDYsMjE3LDE0OCwxOTYsMTYsMTQsOTUsMTk4LDYwLDE0N119",
+            "signature": "Jy3/K0leJzFJqc13bcBRFw2pVKuBf8+yGzuQz+isGUQT20R+Cbxudwmf7bWUSVOOGUQuyBhkHA4IUvFXGZrBWg==",
+            "version": 1
+        }
+    },
+    "description": "Public fixture key 2a repeated 32 times; NEVER use this key or fake CA in production. Opaque envelope fixtures exercise signature bindings, not decrypted plaintext authorization.",
+    "intent": {
+        "action": "carry",
+        "allowRewrap": true,
+        "authorityGeneration": "staging-g2",
+        "did": "did:key:z6MktwupdmLXVVqTzCw4i46r4uGyosGXRnR3XjN4Zq7oMMsw",
+        "enrollmentEpoch": 4,
+        "expectedEnrollmentVersion": 7,
+        "pinAction": "keep",
+        "recoveryEmail": null,
+        "recoveryLanguage": null,
+        "requestId": "golden-carry-1",
+        "shareVersion": 42,
+        "sourceBlobIdentity": "8090217ef11060bfa380c4a4b26d76a64811216176ecb60749652fabf3b09425",
+        "targetBlobIdentity": "31dc237e14eb2f3116dc5559a904d72f71d76722076c2ed994c4100e5fc63c93",
+        "tenant": "learncard",
+        "version": 2
+    },
+    "ledgerPublicKey": "BAyQHUI8gxyoXifHPCY7oTJyG7nXqExPA4CypnVv1gEzHIhwI03sh4UEwXQUT6SxS2amUWkWBtgXPlW9N+OBVp4=",
+    "measurement": "68f6dc415505b28437f0dcb824ddeec57bc0fefc2c02244771298851d3a70c7f",
+    "nonce": "0909090909090909090909090909090909090909090909090909090909090909",
+    "nowMs": 1790294401000,
+    "pcrs": {
+        "0": "010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101",
+        "1": "020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202",
+        "2": "030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303"
+    },
+    "rootSha256": "d71ae13f792676894bf8549178ea45acc360b1935e628f678d9e2f3befae9dfe",
+    "snapshot": {
+        "proof": {
+            "keyId": "test-key.1",
+            "kind": "snapshot",
+            "measurement": [
+                104, 246, 220, 65, 85, 5, 178, 132, 55, 240, 220, 184, 36, 221, 238, 197, 123, 192,
+                254, 252, 44, 2, 36, 71, 113, 41, 136, 81, 211, 167, 12, 127
+            ],
+            "payload": "WyIwOTA5MDkwOTA5MDkwOTA5MDkwOTA5MDkwOTA5MDkwOTA5MDkwOTA5MDkwOTA5MDkwOTA5MDkwOTA5MDkwOTA5Iix7ImF0dGVtcHRzVXNlZCI6OCwiYXV0aG9yaXR5R2VuZXJhdGlvbiI6InN0YWdpbmctZzIiLCJkaWQiOiJkaWQ6a2V5Ono2TWt0d3VwZG1MWFZWcVR6Q3c0aTQ2cjR1R3lvc0dYUm5SM1hqTjRacTdvTU1zdyIsImVucm9sbG1lbnRFcG9jaCI6MywiZW5yb2xsbWVudFZlcnNpb24iOjcsImVudmVsb3BlIjp7ImFsZ29yaXRobSI6IlAtMjU2LUhLREYtU0hBMjU2LUFFUy0yNTYtR0NNIiwiY2lwaGVydGV4dCI6ImdwMUhLcVgvWlVZNmxrWm1DYUk1eVVGZS9TRTdYTXJiQ0FReFN6dHA3U2kwRnhBTFlKTUxoN2lMZ0FvR1ZQbWg4bEtMSEpyMVY2RDBWN01OcXF2NXV2L2dscnY4eU9rMmI2YlhkU290OVowaGpKT1FURDhlNXBnTEp4WFNGUExYV1E9PSIsImVwaGVtZXJhbFB1YmxpY0tleSI6IkJFL2VhQTVTVXlTRjdSTnJUWVE1bW5WcFlMMW1IVkV5Z25RS1R1c0FEVXpZeHMrbVk3R1RQNHZxSWFxWFRxRkFKaXZ1M3Z0cFdUN1ZQTWp1MEE3ejFRaz0iLCJpdiI6IkJzSjZxZmhYbUtDbVR2MkkiLCJrZXlJZCI6InRlc3Qta2V5LjAiLCJzYWx0IjoiNHVzNWVXait1dXJ4OERGN2xJc1hHdWhFdFo5eE1ieFhvUTZ1dTE1ZnlCWT0iLCJ2ZXJzaW9uIjoxfSwiaGFzUGluIjp0cnVlLCJwaW5HZW5lcmF0aW9uIjoyLCJzaGFyZVZlcnNpb24iOjEsInN0YXR1cyI6ImFjdGl2ZSIsInRlbmFudCI6ImxlYXJuY2FyZCJ9XQ==",
+            "signature": "GKq+/xitQWTtCWaHOFFu7C3B9Qzwz296OuHhTZYUFJtS+OiHg5yDsQoTRKURtzWQFYKQxNhT8fogjNQXwBGYkw==",
+            "version": 1
+        },
+        "state": {
+            "attemptsUsed": 8,
+            "authorityGeneration": "staging-g2",
+            "did": "did:key:z6MktwupdmLXVVqTzCw4i46r4uGyosGXRnR3XjN4Zq7oMMsw",
+            "enrollmentEpoch": 3,
+            "enrollmentVersion": 7,
+            "envelope": {
+                "algorithm": "P-256-HKDF-SHA256-AES-256-GCM",
+                "ciphertext": "gp1HKqX/ZUY6lkZmCaI5yUFe/SE7XMrbCAQxSztp7Si0FxALYJMLh7iLgAoGVPmh8lKLHJr1V6D0V7MNqqv5uv/glrv8yOk2b6bXdSot9Z0hjJOQTD8e5pgLJxXSFPLXWQ==",
+                "ephemeralPublicKey": "BE/eaA5SUySF7RNrTYQ5mnVpYL1mHVEygnQKTusADUzYxs+mY7GTP4vqIaqXTqFAJivu3vtpWT7VPMju0A7z1Qk=",
+                "iv": "BsJ6qfhXmKCmTv2I",
+                "keyId": "test-key.0",
+                "salt": "4us5eWj+uurx8DF7lIsXGuhEtZ9xMbxXoQ6uu15fyBY=",
+                "version": 1
+            },
+            "hasPin": true,
+            "pinGeneration": 2,
+            "shareVersion": 1,
+            "status": "active",
+            "tenant": "learncard"
+        }
+    },
+    "testOnly": true
+}

package/src/__fixtures__/escrow-carry-contact-contract-v1.json

@@ -0,0 +1,33 @@
+{
+    "description": "P2-d cross-language contract: the enclave authority policy (apply_enrollment_intent, authority.rs) rejects a Carry target blob whose PLAINTEXT already carries a non-null recoveryEmail/recoveryLanguage — on carry the enclave always fills those fields in from the source blob instead — but accepts the identical blob shape for Enroll/Replace (where the signed intent is required to bind a matching contact instead). Rust (policy/authority/tests.rs) builds and submits a real target blob with each case's fields and asserts apply_enrollment_intent's accept/reject outcome through the real enclave policy; TypeScript (escrow-authority.test.ts) asserts the same outcome via resolveEscrowEnrollmentAction plus the same rule the enclave enforces. Each case is independent: did/shareVersion/epoch are illustrative, not cross-referenced. recoveryEmail/recoveryLanguage are always both-null or both-set, matching the blob plaintext's own format invariant.",
+    "cases": [
+        {
+            "name": "enroll accepts a target with contact fields",
+            "action": "enroll",
+            "blobRecoveryEmail": "owner@example.com",
+            "blobRecoveryLanguage": "en",
+            "expected": "accept"
+        },
+        {
+            "name": "replace accepts a target with contact fields",
+            "action": "replace",
+            "blobRecoveryEmail": "owner@example.com",
+            "blobRecoveryLanguage": "en",
+            "expected": "accept"
+        },
+        {
+            "name": "carry rejects a target that already carries contact fields",
+            "action": "carry",
+            "blobRecoveryEmail": "owner@example.com",
+            "blobRecoveryLanguage": "en",
+            "expected": "reject"
+        },
+        {
+            "name": "carry accepts a target with no contact fields",
+            "action": "carry",
+            "blobRecoveryEmail": null,
+            "blobRecoveryLanguage": null,
+            "expected": "accept"
+        }
+    ]
+}

package/src/__fixtures__/escrow-enrollment-intent-v1.json

@@ -0,0 +1,26 @@
+{
+    "description": "Public RFC8032 test seed only; never use for accounts. Envelope indices refer to escrow-vectors.json. This tests intent binding, not plaintext authorization.",
+    "seedHex": "9d61b19deffd5a60ba844af492ec2cc44449c5697b326919703bac031cae7f60",
+    "publicKeyHex": "d75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a",
+    "sourceFixtureIndex": 0,
+    "targetFixtureIndex": 1,
+    "canonicalHex": "6c6561726e636172642d657363726f772d656e726f6c6c6d656e742d696e74656e742d7632000000000400000002000000096c6561726e63617264000000386469643a6b65793a7a364d6b74777570646d4c58565671547a43773469343672347547796f734758526e5233586a4e345a71376f4d4d73770000000a73746167696e672d67320000000800000000000000070000000103000000208090217ef11060bfa380c4a4b26d76a64811216176ecb60749652fabf3b094250000002031dc237e14eb2f3116dc5559a904d72f71d76722076c2ed994c4100e5fc63c930000000103000000040000002a0000000800000000000000040000000e676f6c64656e2d63617272792d3100000001010000000000000000",
+    "intent": {
+        "version": 2,
+        "tenant": "learncard",
+        "did": "did:key:z6MktwupdmLXVVqTzCw4i46r4uGyosGXRnR3XjN4Zq7oMMsw",
+        "authorityGeneration": "staging-g2",
+        "expectedEnrollmentVersion": 7,
+        "action": "carry",
+        "sourceBlobIdentity": "8090217ef11060bfa380c4a4b26d76a64811216176ecb60749652fabf3b09425",
+        "targetBlobIdentity": "31dc237e14eb2f3116dc5559a904d72f71d76722076c2ed994c4100e5fc63c93",
+        "pinAction": "keep",
+        "shareVersion": 42,
+        "enrollmentEpoch": 4,
+        "requestId": "golden-carry-1",
+        "allowRewrap": true,
+        "recoveryEmail": null,
+        "recoveryLanguage": null
+    },
+    "signature": "9vlbx0xm5clOZIQ0aWKnKYL8tMeirW9Cd7oK6a31aEIqw7mOeneio+wNIKXh1uZRPW0JxQSOHJtqaexf01DxDw=="
+}

package/src/__fixtures__/nitro-attestation-real/staging-nsm-document.json

@@ -0,0 +1,16 @@
+{
+    "description": "Real AWS Nitro NSM attestation captured from LearnCard staging (image vf84e57fe) on 2026-10-15. Public data only. The NSM encodes its payload as an indefinite-length CBOR map. Verify with the clock frozen at timestamp: the NSM leaf certificate is short-lived.",
+    "nonceHex": "692d4a147e49b91e150221b8f536034d7b8810cb8a360f83af8a327e714bbdbc",
+    "timestamp": 1792093180029,
+    "keyId": "escrow-staging-v1",
+    "moduleId": "i-0fccb146d74b9bf5c-enc01a140f184cca19a",
+    "measurements": {
+        "pcr0": "c91ac037a879afd1bd103e8a7433cc4d314676c203b143665e9e512217cbdbeb4d46879a1bae823b70422672dd2c57a6",
+        "pcr1": "4b4d5b3661b3efc12920900c80e126e4ce783c522de6c02a2a5bf7af3a2b9327b86776f188e4be1c1c404a129dbda493",
+        "pcr2": "682bd2dae49b3be11b1b015f8b8034e4eaedb416590d2857fa19b6ef5842674f04b81f88e25b94c3b6cbf9c28e3c0875"
+    },
+    "escrowPublicKeySpkiB64": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAErzuapPkQxSAb0oEQdYHWQIGXt8aSTKZwUWxrFoysw6WggnF8caCLNZiaFBeAfBd2PUty+/pXmgmpFsIo86zzcQ==",
+    "ledgerPublicKey": "BMxjZVpb2z5/5bA31+FfC3kl33AVSZcC34RQd0fzkJtK4RnOcdg43oN0DPoGcZnw31ExrFMvpq07y6O9w3njDF8=",
+    "measurementHash": "745eb1df7673be68893cf22617e5a8148409ab08d71c7cd22989eb4817602098",
+    "document": "hEShATgioFkR2r9pbW9kdWxlX2lkeCdpLTBmY2NiMTQ2ZDc0YjliZjVjLWVuYzAxYTE0MGYxODRjY2ExOWFmZGlnZXN0ZlNIQTM4NGl0aW1lc3RhbXAbAAABoUET0H1kcGNyc7AAWDDJGsA3qHmv0b0QPop0M8xNMUZ2wgOxQ2ZenlEiF8vb601Gh5obroI7cEImct0sV6YBWDBLTVs2YbPvwSkgkAyA4Sbkzng8Ui3mwCoqW/evOiuTJ7hndvGI5L4cHEBKEp29pJMCWDBoK9La5Js74RsbAV+LgDTk6u20FlkNKFf6GbbvWEJnTwS4H4jiW5TDtsv5wo48CHUDWDCHdzQclrpRivRoilEYMqdVWVPfdnV8avqfhVje297H9fhUlR7qO56Uy89NuaIgSEAEWDCDDFn0eaCK/GKuSfePY9SNWK68bQYB6Fd8DmPKGvZLoA6lgDfC2FG26rcI2nDokBUFWDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGWDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHWDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIWDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJWDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKWDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALWDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMWDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANWDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOWDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPWDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABrY2VydGlmaWNhdGVZAn8wggJ7MIICAaADAgECAhABoUDxhMyhmgAAAABq0SM1MAoGCCqGSM49BAMDMIGOMQswCQYDVQQGEwJVUzETMBEGA1UECAwKV2FzaGluZ3RvbjEQMA4GA1UEBwwHU2VhdHRsZTEPMA0GA1UECgwGQW1hem9uMQwwCgYDVQQLDANBV1MxOTA3BgNVBAMMMGktMGZjY2IxNDZkNzRiOWJmNWMudXMtZWFzdC0xLmF3cy5uaXRyby1lbmNsYXZlczAeFw0yNjEwMTUxOTAyMTBaFw0yNjEwMTUyMjAyMTNaMIGTMQswCQYDVQQGEwJVUzETMBEGA1UECAwKV2FzaGluZ3RvbjEQMA4GA1UEBwwHU2VhdHRsZTEPMA0GA1UECgwGQW1hem9uMQwwCgYDVQQLDANBV1MxPjA8BgNVBAMMNWktMGZjY2IxNDZkNzRiOWJmNWMtZW5jMDFhMTQwZjE4NGNjYTE5YS51cy1lYXN0LTEuYXdzMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEQUmjXbzrUv+z5tKKnJnoiU5WQ8TIKnRghE359BanHkJ1XcvQyhy80RG8gGWU6p67xABadC1WTT+TABEyr1xXh9ZLkcVIodevouavkE1nYeMbESlaAaXoqQGkzNFa6CPDox0wGzAMBgNVHRMBAf8EAjAAMAsGA1UdDwQEAwIGwDAKBggqhkjOPQQDAwNoADBlAjEAhn7o6xNy6u97/Lj/Yx/5h/LE/cZeIhglBjztLo8CPS4DkgGDmffM8QGwz2QhQ/XBAjBSuzRqMXGbW5argncwW5FKcl7Ru5tEgBWHPRNFZODPXj27LpgyHGDxTqakhs8ZCSJoY2FidW5kbGWEWQIVMIICETCCAZagAwIBAgIRAPkxdWgbkK/hHUbMtOTn+FYwCgYIKoZIzj0EAwMwSTELMAkGA1UEBhMCVVMxDzANBgNVBAoMBkFtYXpvbjEMMAoGA1UECwwDQVdTMRswGQYDVQQDDBJhd3Mubml0cm8tZW5jbGF2ZXMwHhcNMTkxMDI4MTMyODA1WhcNNDkxMDI4MTQyODA1WjBJMQswCQYDVQQGEwJVUzEPMA0GA1UECgwGQW1hem9uMQwwCgYDVQQLDANBV1MxGzAZBgNVBAMMEmF3cy5uaXRyby1lbmNsYXZlczB2MBAGByqGSM49AgEGBSuBBAAiA2IABPwCVOumCMHzaHDimtqQvkY4MpJzbolL//Zy2YlES1BR5TSksfbb48C8WBoyt7F2Bw7eEtaaP+ohG2bnUs990d0JX28TcPQXCEPZ3BABIeTPYwEoCWZEh8l5YoQwTcU/9KNCMEAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUkCW1DdkFR+eWw5b6cp3PmanfS5YwDgYDVR0PAQH/BAQDAgGGMAoGCCqGSM49BAMDA2kAMGYCMQCjfy+Rocm9Xue4YnwWmNJVA44fA0P5W2OpYow9OYCVRaEevL8uO1XYru5xtMPWrfMCMQCi85sWBbJwKKXdS6BptQFuZbT73o/gBh1qUxl/nNr12UO8Yfwr6wPLb+6NIwLz3/ZZAsMwggK/MIICRaADAgECAhEA27BhW6cNsX+tzKWd6AVrJjAKBggqhkjOPQQDAzBJMQswCQYDVQQGEwJVUzEPMA0GA1UECgwGQW1hem9uMQwwCgYDVQQLDANBV1MxGzAZBgNVBAMMEmF3cy5uaXRyby1lbmNsYXZlczAeFw0yNjEwMTEwOTMyNTVaFw0yNjEwMzExMDMyNTVaMGQxCzAJBgNVBAYTAlVTMQ8wDQYDVQQKDAZBbWF6b24xDDAKBgNVBAsMA0FXUzE2MDQGA1UEAwwtZmFjM2M3MzYzZTdmN2Y0OC51cy1lYXN0LTEuYXdzLm5pdHJvLWVuY2xhdmVzMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAECkUiV/cHWIva1ZXs7/i059Uki/70qS2TeACikoWzH2nrpcEGLtutLpDKh6wv8cmDBtdRxuiylKJqPQH+Ls8zHnvkXDbP8rgaAaUI7PGUxefauhh9RtqrBqKV2NqlDn0Bo4HVMIHSMBIGA1UdEwEB/wQIMAYBAf8CAQIwHwYDVR0jBBgwFoAUkCW1DdkFR+eWw5b6cp3PmanfS5YwHQYDVR0OBBYEFBYUDIYvDvEzrQPsWxa+ApXKgDgqMA4GA1UdDwEB/wQEAwIBhjBsBgNVHR8EZTBjMGGgX6BdhltodHRwOi8vYXdzLW5pdHJvLWVuY2xhdmVzLWNybC5zMy5hbWF6b25hd3MuY29tL2NybC9hYjQ5NjBjYy03ZDYzLTQyYmQtOWU5Zi01OTMzOGNiNjdmODQuY3JsMAoGCCqGSM49BAMDA2gAMGUCMQCqf7gyngg7h8CI1HhZkpPV2nQVHACp4vSETWvLr4wYIadIVkGrHOZ4ZYXebQoFM3gCMHnc42xP2LiRi6OCGMUdw/1tRBbnpDGJFvU+udcPJ/sb5834Z/JBDDTCXk+ABWS1a1kDGTCCAxUwggKboAMCAQICEQCqKgqUhulPlCPBk14hh8u8MAoGCCqGSM49BAMDMGQxCzAJBgNVBAYTAlVTMQ8wDQYDVQQKDAZBbWF6b24xDDAKBgNVBAsMA0FXUzE2MDQGA1UEAwwtZmFjM2M3MzYzZTdmN2Y0OC51cy1lYXN0LTEuYXdzLm5pdHJvLWVuY2xhdmVzMB4XDTI2MTAxNTA4NTc0MVoXDTI2MTAyMDIzNTc0MVowgYkxPDA6BgNVBAMMMzRkMmEzNDRmYjE4M2ZkZjQuem9uYWwudXMtZWFzdC0xLmF3cy5uaXRyby1lbmNsYXZlczEMMAoGA1UECwwDQVdTMQ8wDQYDVQQKDAZBbWF6b24xCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJXQTEQMA4GA1UEBwwHU2VhdHRsZTB2MBAGByqGSM49AgEGBSuBBAAiA2IABMBennhxsRIcgCRy4bv8b/y4Uj3YWKDPMAIStsdZE/mgHs18Mk1mAl0EyKniUcstdJVUYFWIzZ2Rut8TgHL2bWWPq7n3J2V4qp11bwxpGZ21b+dDsk0zk/Pw9BX0Nc+2CqOB6jCB5zASBgNVHRMBAf8ECDAGAQH/AgEBMB8GA1UdIwQYMBaAFBYUDIYvDvEzrQPsWxa+ApXKgDgqMB0GA1UdDgQWBBSwRNZ1QUudp4HF6bVvcH9k2aA/RTAOBgNVHQ8BAf8EBAMCAYYwgYAGA1UdHwR5MHcwdaBzoHGGb2h0dHA6Ly9jcmwtdXMtZWFzdC0xLWF3cy1uaXRyby1lbmNsYXZlcy5zMy51cy1lYXN0LTEuYW1hem9uYXdzLmNvbS9jcmwvMDIyYThlNjctYTc3MC00YmU3LWE0ZTItY2M3MDdhMTg4MmUyLmNybDAKBggqhkjOPQQDAwNoADBlAjEAthpv45w1mN+ND14kS+v+T1eZ2vtvMSnshe9LIUqgKtc4v/v8GqH624poty/DuQhEAjBhPxIWTL8vsC4+97ttO6II4IwtbaB3299Xh0D8EVFD47BiCbKMNybP1Epiy0ksG/tZAsMwggK/MIICRKADAgECAhQf4OoLEplf/bb8kbe33cjoAmmGjDAKBggqhkjOPQQDAzCBiTE8MDoGA1UEAwwzNGQyYTM0NGZiMTgzZmRmNC56b25hbC51cy1lYXN0LTEuYXdzLm5pdHJvLWVuY2xhdmVzMQwwCgYDVQQLDANBV1MxDzANBgNVBAoMBkFtYXpvbjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAldBMRAwDgYDVQQHDAdTZWF0dGxlMB4XDTI2MTAxNTE5MDExMFoXDTI2MTAxNjE5MDExMFowgY4xCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApXYXNoaW5ndG9uMRAwDgYDVQQHDAdTZWF0dGxlMQ8wDQYDVQQKDAZBbWF6b24xDDAKBgNVBAsMA0FXUzE5MDcGA1UEAwwwaS0wZmNjYjE0NmQ3NGI5YmY1Yy51cy1lYXN0LTEuYXdzLm5pdHJvLWVuY2xhdmVzMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEgQJsqRVfAVq/9cQflyUTMDJnYEmgAvTAYSkNSsJmy6BDRKW3X3bHfezpsAij7pglf2ruYM+ZbQvEDZ/6VH2DDdjiXLOpkQB8G21CRQNk9z+yEi5TI8H56uimhwnJQCyFo2YwZDASBgNVHRMBAf8ECDAGAQH/AgEAMA4GA1UdDwEB/wQEAwICBDAdBgNVHQ4EFgQUzOQq6mhRBRHeImoGJZcsEsDMzGwwHwYDVR0jBBgwFoAUsETWdUFLnaeBxem1b3B/ZNmgP0UwCgYIKoZIzj0EAwMDaQAwZgIxAOOKFwil3QVaHRawm4W6h5wat4a4iK2px293FBnuEU3U+1PuybiRJ3PjO5YqsAAVdQIxAOlVOK+uJYI02/dCP/mIIM1QwvHXuT2eLb5Vx/dW0qC3X9vCuf00soLgSGDvtC7p5mpwdWJsaWNfa2V5WEEEzGNlWlvbPn/lsDfX4V8LeSXfcBVJlwLfhFB3R/OQm0rhGc5x2Djeg3QM+gZxmfDfUTGsUy+mrTvLo73DeeMMX2l1c2VyX2RhdGFYdKMAWFswWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASvO5qk+RDFIBvSgRB1gdZAgZe3xpJMpnBRbGsWjKzDpaCCcXxxoIs1mJoUF4B8F3Y9S3L7+leaCakWwijzrPNxAXFlc2Nyb3ctc3RhZ2luZy12MQKAZW5vbmNlWCBpLUoUfkm5HhUCIbj1NgNNe4gQy4o2D4OvijJ+cUu9vP9YYD4ZPjzyMa6yzUabADkXaJ8tUWjiB1aHmGSbiBubxhop/xNWgDq8mjG6Qq4LCnZfGPbS3AL8/XfFyOD5xPfOb58MmgGEibRpXUxc5YNQuZt6a7XRYfUDCBxCDm7f6wKUFQ=="
+}

package/src/escrow-attestation.ts

@@ -1,5 +1,6 @@
 import { base64ToBuffer, bufferToBase64 } from './crypto';
 import type { EscrowAttestationPolicy } from './types';
+import type { VerifiedEnclaveIdentity } from './escrow-authority.types';
 import { NitroAttestationError, verifyNitroAttestationDocument } from './escrow-nitro-attestation';
 
 const isRecord = (value: unknown): value is Record<string, unknown> =>
@@ -22,15 +23,7 @@ export const verifyEnclaveAttestation = async (
     attestation: unknown,
     policy: EscrowAttestationPolicy,
     nonce?: Uint8Array
-): Promise<{
-    publicKey: string;
-    keyId: string;
-    /** P9.1: retired keyIds still accepted for decrypt. In nitro mode this is
-     * the value bound inside the signed attestation document, cross-checked
-     * against the plaintext field below — never the plaintext alone. */
-    previousKeyIds: string[];
-    mode: 'software' | 'nitro';
-}> => {
+): Promise<VerifiedEnclaveIdentity> => {
     const isKeyId = (value: unknown): value is string =>
         typeof value === 'string' && /^[A-Za-z0-9._-]{1,128}$/.test(value);
     const fields = [
@@ -103,6 +96,14 @@ export const verifyEnclaveAttestation = async (
             keyId: attestation.keyId,
             previousKeyIds: verified.previousKeyIds,
             mode: 'nitro',
+            ...(verified.keyId && verified.ledgerPublicKey && verified.measurementHash
+                ? {
+                      authority: {
+                          ledgerPublicKey: verified.ledgerPublicKey,
+                          measurement: verified.measurementHash,
+                      },
+                  }
+                : {}),
         };
     }
     const publicKey = normalizePublicKey(attestation.publicKey);