@learncard/sss-key-manager 0.2.1 → 0.2.3

package/dist/sss-key-manager.esm.js

@@ -199,6 +199,7 @@ var require_types_cjs_development = __commonJS({
       FlatAuthGrantValidator: /* @__PURE__ */ __name(() => FlatAuthGrantValidator, "FlatAuthGrantValidator"),
       FrameworkWithSkillsValidator: /* @__PURE__ */ __name(() => FrameworkWithSkillsValidator, "FrameworkWithSkillsValidator"),
       FullClaimHookValidator: /* @__PURE__ */ __name(() => FullClaimHookValidator, "FullClaimHookValidator"),
+      GenerateSkillIconsInputValidator: /* @__PURE__ */ __name(() => GenerateSkillIconsInputValidator, "GenerateSkillIconsInputValidator"),
       GeoCoordinatesValidator: /* @__PURE__ */ __name(() => GeoCoordinatesValidator, "GeoCoordinatesValidator"),
       GetCounterEventValidator: /* @__PURE__ */ __name(() => GetCounterEventValidator, "GetCounterEventValidator"),
       GetCountersEventValidator: /* @__PURE__ */ __name(() => GetCountersEventValidator, "GetCountersEventValidator"),
@@ -359,6 +360,8 @@ var require_types_cjs_development = __commonJS({
       SHARE_RECOVERY_PROTOCOL: /* @__PURE__ */ __name(() => SHARE_RECOVERY_PROTOCOL, "SHARE_RECOVERY_PROTOCOL"),
       SHARE_TAG_BYTES: /* @__PURE__ */ __name(() => SHARE_TAG_BYTES, "SHARE_TAG_BYTES"),
       SHARE_VIEW_RECEIPT_TTL_SECONDS: /* @__PURE__ */ __name(() => SHARE_VIEW_RECEIPT_TTL_SECONDS, "SHARE_VIEW_RECEIPT_TTL_SECONDS"),
+      SKILL_ICON_MAX_CHARACTERS_PER_REQUEST: /* @__PURE__ */ __name(() => SKILL_ICON_MAX_CHARACTERS_PER_REQUEST, "SKILL_ICON_MAX_CHARACTERS_PER_REQUEST"),
+      SKILL_ICON_MAX_NAMES_PER_REQUEST: /* @__PURE__ */ __name(() => SKILL_ICON_MAX_NAMES_PER_REQUEST, "SKILL_ICON_MAX_NAMES_PER_REQUEST"),
       SendAiSessionCredentialEventValidator: /* @__PURE__ */ __name(() => SendAiSessionCredentialEventValidator, "SendAiSessionCredentialEventValidator"),
       SendBoostInputValidator: /* @__PURE__ */ __name(() => SendBoostInputValidator, "SendBoostInputValidator"),
       SendBoostResponseValidator: /* @__PURE__ */ __name(() => SendBoostResponseValidator, "SendBoostResponseValidator"),
@@ -411,6 +414,7 @@ var require_types_cjs_development = __commonJS({
       SkillFrameworkQueryValidator: /* @__PURE__ */ __name(() => SkillFrameworkQueryValidator, "SkillFrameworkQueryValidator"),
       SkillFrameworkStatusEnum: /* @__PURE__ */ __name(() => SkillFrameworkStatusEnum, "SkillFrameworkStatusEnum"),
       SkillFrameworkValidator: /* @__PURE__ */ __name(() => SkillFrameworkValidator, "SkillFrameworkValidator"),
+      SkillIconNamesValidator: /* @__PURE__ */ __name(() => SkillIconNamesValidator, "SkillIconNamesValidator"),
       SkillQueryValidator: /* @__PURE__ */ __name(() => SkillQueryValidator, "SkillQueryValidator"),
       SkillSemanticSearchInputValidator: /* @__PURE__ */ __name(() => SkillSemanticSearchInputValidator, "SkillSemanticSearchInputValidator"),
       SkillSemanticSearchResultItemValidator: /* @__PURE__ */ __name(() => SkillSemanticSearchResultItemValidator, "SkillSemanticSearchResultItemValidator"),
@@ -568,7 +572,7 @@ var require_types_cjs_development = __commonJS({
       _function: /* @__PURE__ */ __name(() => _function, "_function"),
       any: /* @__PURE__ */ __name(() => any, "any"),
       array: /* @__PURE__ */ __name(() => array, "array"),
-      base64: /* @__PURE__ */ __name(() => base642, "base64"),
+      base64: /* @__PURE__ */ __name(() => base6422, "base64"),
       base64url: /* @__PURE__ */ __name(() => base64url2, "base64url"),
       bigint: /* @__PURE__ */ __name(() => bigint2, "bigint"),
       boolean: /* @__PURE__ */ __name(() => boolean2, "boolean"),
@@ -609,7 +613,7 @@ var require_types_cjs_development = __commonJS({
       gt: /* @__PURE__ */ __name(() => _gt, "gt"),
       gte: /* @__PURE__ */ __name(() => _gte, "gte"),
       guid: /* @__PURE__ */ __name(() => guid2, "guid"),
-      hash: /* @__PURE__ */ __name(() => hash, "hash"),
+      hash: /* @__PURE__ */ __name(() => hash2, "hash"),
       hex: /* @__PURE__ */ __name(() => hex22, "hex"),
       hostname: /* @__PURE__ */ __name(() => hostname2, "hostname"),
       httpUrl: /* @__PURE__ */ __name(() => httpUrl, "httpUrl"),
@@ -658,7 +662,7 @@ var require_types_cjs_development = __commonJS({
       nullable: /* @__PURE__ */ __name(() => nullable, "nullable"),
       nullish: /* @__PURE__ */ __name(() => nullish2, "nullish"),
       number: /* @__PURE__ */ __name(() => number2, "number"),
-      object: /* @__PURE__ */ __name(() => object, "object"),
+      object: /* @__PURE__ */ __name(() => object2, "object"),
       optional: /* @__PURE__ */ __name(() => optional, "optional"),
       overwrite: /* @__PURE__ */ __name(() => _overwrite, "overwrite"),
       parse: /* @__PURE__ */ __name(() => parse2, "parse"),
@@ -1020,9 +1024,9 @@ var require_types_cjs_development = __commonJS({
         inst._zod.traits.add(name);
         initializer3(inst, def);
         const proto = _.prototype;
-        const keys = Object.keys(proto);
-        for (let i = 0; i < keys.length; i++) {
-          const k = keys[i];
+        const keys2 = Object.keys(proto);
+        for (let i = 0; i < keys2.length; i++) {
+          const k = keys2[i];
           if (!(k in inst)) {
             inst[k] = proto[k].bind(inst);
           }
@@ -1244,9 +1248,9 @@ var require_types_cjs_development = __commonJS({
     __name(floatSafeRemainder, "floatSafeRemainder");
     __name2(floatSafeRemainder, "floatSafeRemainder");
     var EVALUATING = /* @__PURE__ */ Symbol("evaluating");
-    function defineLazy(object2, key, getter) {
+    function defineLazy(object22, key, getter) {
       let value = void 0;
-      Object.defineProperty(object2, key, {
+      Object.defineProperty(object22, key, {
         get() {
           if (value === EVALUATING) {
             return void 0;
@@ -1258,7 +1262,7 @@ var require_types_cjs_development = __commonJS({
           return value;
         },
         set(v) {
-          Object.defineProperty(object2, key, {
+          Object.defineProperty(object22, key, {
             value: v
             // configurable: true,
           });
@@ -1306,12 +1310,12 @@ var require_types_cjs_development = __commonJS({
     __name(getElementAtPath, "getElementAtPath");
     __name2(getElementAtPath, "getElementAtPath");
     function promiseAllObject(promisesObj) {
-      const keys = Object.keys(promisesObj);
-      const promises = keys.map((key) => promisesObj[key]);
+      const keys2 = Object.keys(promisesObj);
+      const promises = keys2.map((key) => promisesObj[key]);
       return Promise.all(promises).then((results) => {
         const resolvedObj = {};
-        for (let i = 0; i < keys.length; i++) {
-          resolvedObj[keys[i]] = results[i];
+        for (let i = 0; i < keys2.length; i++) {
+          resolvedObj[keys2[i]] = results[i];
         }
         return resolvedObj;
       });
@@ -1851,18 +1855,18 @@ var require_types_cjs_development = __commonJS({
     __name2(cleanEnum, "cleanEnum");
     function base64ToUint8Array(base643) {
       const binaryString = atob(base643);
-      const bytes2 = new Uint8Array(binaryString.length);
+      const bytes3 = new Uint8Array(binaryString.length);
       for (let i = 0; i < binaryString.length; i++) {
-        bytes2[i] = binaryString.charCodeAt(i);
+        bytes3[i] = binaryString.charCodeAt(i);
       }
-      return bytes2;
+      return bytes3;
     }
     __name(base64ToUint8Array, "base64ToUint8Array");
     __name2(base64ToUint8Array, "base64ToUint8Array");
-    function uint8ArrayToBase64(bytes2) {
+    function uint8ArrayToBase64(bytes3) {
       let binaryString = "";
-      for (let i = 0; i < bytes2.length; i++) {
-        binaryString += String.fromCharCode(bytes2[i]);
+      for (let i = 0; i < bytes3.length; i++) {
+        binaryString += String.fromCharCode(bytes3[i]);
       }
       return btoa(binaryString);
     }
@@ -1875,8 +1879,8 @@ var require_types_cjs_development = __commonJS({
     }
     __name(base64urlToUint8Array, "base64urlToUint8Array");
     __name2(base64urlToUint8Array, "base64urlToUint8Array");
-    function uint8ArrayToBase64url(bytes2) {
-      return uint8ArrayToBase64(bytes2).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+    function uint8ArrayToBase64url(bytes3) {
+      return uint8ArrayToBase64(bytes3).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
     }
     __name(uint8ArrayToBase64url, "uint8ArrayToBase64url");
     __name2(uint8ArrayToBase64url, "uint8ArrayToBase64url");
@@ -1885,16 +1889,16 @@ var require_types_cjs_development = __commonJS({
       if (cleanHex.length % 2 !== 0) {
         throw new Error("Invalid hex string length");
       }
-      const bytes2 = new Uint8Array(cleanHex.length / 2);
+      const bytes3 = new Uint8Array(cleanHex.length / 2);
       for (let i = 0; i < cleanHex.length; i += 2) {
-        bytes2[i / 2] = Number.parseInt(cleanHex.slice(i, i + 2), 16);
+        bytes3[i / 2] = Number.parseInt(cleanHex.slice(i, i + 2), 16);
       }
-      return bytes2;
+      return bytes3;
     }
     __name(hexToUint8Array, "hexToUint8Array");
     __name2(hexToUint8Array, "hexToUint8Array");
-    function uint8ArrayToHex(bytes2) {
-      return Array.from(bytes2).map((b) => b.toString(16).padStart(2, "0")).join("");
+    function uint8ArrayToHex(bytes3) {
+      return Array.from(bytes3).map((b) => b.toString(16).padStart(2, "0")).join("");
     }
     __name(uint8ArrayToHex, "uint8ArrayToHex");
     __name2(uint8ArrayToHex, "uint8ArrayToHex");
@@ -2143,7 +2147,7 @@ var require_types_cjs_development = __commonJS({
     var safeDecodeAsync = /* @__PURE__ */ _safeDecodeAsync($ZodRealError);
     var regexes_exports = {};
     __export(regexes_exports, {
-      base64: /* @__PURE__ */ __name(() => base64, "base64"),
+      base64: /* @__PURE__ */ __name(() => base642, "base64"),
       base64url: /* @__PURE__ */ __name(() => base64url, "base64url"),
       bigint: /* @__PURE__ */ __name(() => bigint, "bigint"),
       boolean: /* @__PURE__ */ __name(() => boolean, "boolean"),
@@ -2166,7 +2170,7 @@ var require_types_cjs_development = __commonJS({
       html5Email: /* @__PURE__ */ __name(() => html5Email, "html5Email"),
       httpProtocol: /* @__PURE__ */ __name(() => httpProtocol, "httpProtocol"),
       idnEmail: /* @__PURE__ */ __name(() => idnEmail, "idnEmail"),
-      integer: /* @__PURE__ */ __name(() => integer, "integer"),
+      integer: /* @__PURE__ */ __name(() => integer3, "integer"),
       ipv4: /* @__PURE__ */ __name(() => ipv4, "ipv4"),
       ipv6: /* @__PURE__ */ __name(() => ipv6, "ipv6"),
       ksuid: /* @__PURE__ */ __name(() => ksuid, "ksuid"),
@@ -2240,7 +2244,7 @@ var require_types_cjs_development = __commonJS({
     }, "mac");
     var cidrv4 = /^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$/;
     var cidrv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::|([0-9a-fA-F]{1,4})?::([0-9a-fA-F]{1,4}:?){0,6})\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/;
-    var base64 = /^$|^(?:[0-9a-zA-Z+/]{4})*(?:(?:[0-9a-zA-Z+/]{2}==)|(?:[0-9a-zA-Z+/]{3}=))?$/;
+    var base642 = /^$|^(?:[0-9a-zA-Z+/]{4})*(?:(?:[0-9a-zA-Z+/]{2}==)|(?:[0-9a-zA-Z+/]{3}=))?$/;
     var base64url = /^[A-Za-z0-9_-]*$/;
     var hostname = /^(?=.{1,253}\.?$)[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[-0-9a-zA-Z]{0,61}[0-9a-zA-Z])?)*\.?$/;
     var domain = /^([a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$/;
@@ -2277,7 +2281,7 @@ var require_types_cjs_development = __commonJS({
       return new RegExp(`^${regex}$`);
     }, "string");
     var bigint = /^-?\d+n?$/;
-    var integer = /^-?\d+$/;
+    var integer3 = /^-?\d+$/;
     var number = /^-?\d+(?:\.\d+)?$/;
     var boolean = /^(?:true|false)$/i;
     var _null = /^null$/i;
@@ -2411,7 +2415,7 @@ var require_types_cjs_development = __commonJS({
         bag.minimum = minimum;
         bag.maximum = maximum;
         if (isInt)
-          bag.pattern = integer;
+          bag.pattern = integer3;
       });
       inst._zod.check = (payload) => {
         const input = payload.value;
@@ -3251,7 +3255,7 @@ var require_types_cjs_development = __commonJS({
     __name(isValidBase64, "isValidBase64");
     __name2(isValidBase64, "isValidBase64");
     var $ZodBase64 = /* @__PURE__ */ $constructor("$ZodBase64", (inst, def) => {
-      def.pattern ?? (def.pattern = base64);
+      def.pattern ?? (def.pattern = base642);
       $ZodStringFormat.init(inst, def);
       inst._zod.bag.contentEncoding = "base64";
       inst._zod.check = (payload) => {
@@ -3597,8 +3601,8 @@ var require_types_cjs_development = __commonJS({
     __name(handlePropertyResult, "handlePropertyResult");
     __name2(handlePropertyResult, "handlePropertyResult");
     function normalizeDef(def) {
-      const keys = Object.keys(def.shape);
-      for (const k of keys) {
+      const keys2 = Object.keys(def.shape);
+      for (const k of keys2) {
         if (!def.shape?.[k]?._zod?.traits?.has("$ZodType")) {
           throw new Error(`Invalid element at key "${k}": expected a Zod schema`);
         }
@@ -3606,9 +3610,9 @@ var require_types_cjs_development = __commonJS({
       const okeys = optionalKeys(def.shape);
       return {
         ...def,
-        keys,
-        keySet: new Set(keys),
-        numKeys: keys.length,
+        keys: keys2,
+        keySet: new Set(keys2),
+        numKeys: keys2.length,
         optionalKeys: new Set(okeys)
       };
     }
@@ -8370,8 +8374,8 @@ var require_types_cjs_development = __commonJS({
     }
     __name(ko_default, "ko_default");
     __name2(ko_default, "default");
-    var capitalizeFirstCharacter = /* @__PURE__ */ __name2((text) => {
-      return text.charAt(0).toUpperCase() + text.slice(1);
+    var capitalizeFirstCharacter = /* @__PURE__ */ __name2((text2) => {
+      return text2.charAt(0).toUpperCase() + text2.slice(1);
     }, "capitalizeFirstCharacter");
     function getUnitTypeFromNumber(number4) {
       const abs = Math.abs(number4);
@@ -13491,7 +13495,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       _function: /* @__PURE__ */ __name(() => _function, "_function"),
       any: /* @__PURE__ */ __name(() => any, "any"),
       array: /* @__PURE__ */ __name(() => array, "array"),
-      base64: /* @__PURE__ */ __name(() => base642, "base64"),
+      base64: /* @__PURE__ */ __name(() => base6422, "base64"),
       base64url: /* @__PURE__ */ __name(() => base64url2, "base64url"),
       bigint: /* @__PURE__ */ __name(() => bigint2, "bigint"),
       boolean: /* @__PURE__ */ __name(() => boolean2, "boolean"),
@@ -13516,7 +13520,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       float64: /* @__PURE__ */ __name(() => float64, "float64"),
       function: /* @__PURE__ */ __name(() => _function, "function"),
       guid: /* @__PURE__ */ __name(() => guid2, "guid"),
-      hash: /* @__PURE__ */ __name(() => hash, "hash"),
+      hash: /* @__PURE__ */ __name(() => hash2, "hash"),
       hex: /* @__PURE__ */ __name(() => hex22, "hex"),
       hostname: /* @__PURE__ */ __name(() => hostname2, "hostname"),
       httpUrl: /* @__PURE__ */ __name(() => httpUrl, "httpUrl"),
@@ -13548,7 +13552,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       nullable: /* @__PURE__ */ __name(() => nullable, "nullable"),
       nullish: /* @__PURE__ */ __name(() => nullish2, "nullish"),
       number: /* @__PURE__ */ __name(() => number2, "number"),
-      object: /* @__PURE__ */ __name(() => object, "object"),
+      object: /* @__PURE__ */ __name(() => object2, "object"),
       optional: /* @__PURE__ */ __name(() => optional, "optional"),
       partialRecord: /* @__PURE__ */ __name(() => partialRecord, "partialRecord"),
       pipe: /* @__PURE__ */ __name(() => pipe, "pipe"),
@@ -14149,11 +14153,11 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       $ZodBase64.init(inst, def);
       ZodStringFormat.init(inst, def);
     });
-    function base642(params) {
+    function base6422(params) {
       return /* @__PURE__ */ _base64(ZodBase64, params);
     }
-    __name(base642, "base642");
-    __name2(base642, "base64");
+    __name(base6422, "base642");
+    __name2(base6422, "base64");
     var ZodBase64URL = /* @__PURE__ */ $constructor("ZodBase64URL", (inst, def) => {
       $ZodBase64URL.init(inst, def);
       ZodStringFormat.init(inst, def);
@@ -14200,7 +14204,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
     }
     __name(hex22, "hex2");
     __name2(hex22, "hex");
-    function hash(alg, params) {
+    function hash2(alg, params) {
       const enc = params?.enc ?? "hex";
       const format = `${alg}_${enc}`;
       const regex = regexes_exports[format];
@@ -14208,8 +14212,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
         throw new Error(`Unrecognized hash format: ${format}`);
       return /* @__PURE__ */ _stringFormat(ZodCustomStringFormat, format, regex, params);
     }
-    __name(hash, "hash");
-    __name2(hash, "hash");
+    __name(hash2, "hash");
+    __name2(hash2, "hash");
     var ZodNumber = /* @__PURE__ */ $constructor("ZodNumber", (inst, def) => {
       $ZodNumber.init(inst, def);
       ZodType.init(inst, def);
@@ -14521,7 +14525,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
         }
       });
     });
-    function object(shape, params) {
+    function object2(shape, params) {
       const def = {
         type: "object",
         shape: shape ?? {},
@@ -14529,8 +14533,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       };
       return new ZodObject(def);
     }
-    __name(object, "object");
-    __name2(object, "object");
+    __name(object2, "object");
+    __name2(object2, "object");
     function strictObject(shape, params) {
       return new ZodObject({
         type: "object",
@@ -14725,11 +14729,11 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       inst._zod.processJSONSchema = (ctx, json2, params) => enumProcessor(inst, ctx, json2, params);
       inst.enum = def.entries;
       inst.options = Object.values(def.entries);
-      const keys = new Set(Object.keys(def.entries));
+      const keys2 = new Set(Object.keys(def.entries));
       inst.extract = (values, params) => {
         const newEntries = {};
         for (const value of values) {
-          if (keys.has(value)) {
+          if (keys2.has(value)) {
             newEntries[value] = def.entries[value];
           } else
             throw new Error(`Key ${value} not found in enum`);
@@ -14744,7 +14748,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       inst.exclude = (values, params) => {
         const newEntries = { ...def.entries };
         for (const value of values) {
-          if (keys.has(value)) {
+          if (keys2.has(value)) {
             delete newEntries[value];
           } else
             throw new Error(`Key ${value} not found in enum`);
@@ -15880,7 +15884,18 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       verificationMethod: external_exports.string(),
       jws: external_exports.string().optional()
     }).catchall(external_exports.any()).superRefine((proof, ctx) => {
-      if (proof.created === void 0 && (proof.type !== "DataIntegrityProof" || proof.cryptosuite !== "ecdsa-rdfc-2019")) {
+      if (proof.created === void 0 && // These standardized Data Integrity suites make created optional.
+      // Keep the prior requirement for legacy and unknown proof suites.
+      // https://www.w3.org/TR/vc-di-eddsa/#proof-configuration-eddsa-jcs-2022
+      // https://www.w3.org/TR/vc-di-bbs/#proof-configuration
+      (proof.type !== "DataIntegrityProof" || ![
+        "ecdsa-rdfc-2019",
+        "ecdsa-jcs-2019",
+        "ecdsa-sd-2023",
+        "eddsa-rdfc-2022",
+        "eddsa-jcs-2022",
+        "bbs-2023"
+      ].includes(proof.cryptosuite))) {
         ctx.addIssue({
           code: "custom",
           path: ["created"],
@@ -16137,6 +16152,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       term: external_exports.string().optional()
     }).catchall(external_exports.any());
     var UnsignedAchievementCredentialValidator = UnsignedVCValidator.extend({
+      awardedDate: external_exports.string().optional(),
       name: external_exports.string().optional(),
       description: external_exports.string().optional(),
       image: ImageValidator.optional(),
@@ -18519,12 +18535,12 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       }
       return table;
     })();
-    var encodeBase64Url = /* @__PURE__ */ __name2((bytes2) => {
+    var encodeBase64Url = /* @__PURE__ */ __name2((bytes3) => {
       let output = "";
-      for (let index = 0; index < bytes2.length; index += 3) {
-        const first = bytes2[index];
-        const second = bytes2[index + 1];
-        const third = bytes2[index + 2];
+      for (let index = 0; index < bytes3.length; index += 3) {
+        const first = bytes3[index];
+        const second = bytes3[index + 1];
+        const third = bytes3[index + 2];
         output += BASE64URL_ALPHABET[first >> 2];
         output += BASE64URL_ALPHABET[(first & 3) << 4 | (second ?? 0) >> 4];
         if (second === void 0) break;
@@ -18565,8 +18581,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
     }, "isCanonicalBase64Url");
     var decodedBase64UrlByteLength = /* @__PURE__ */ __name2((value) => decodeBase64Url(value)?.length ?? null, "decodedBase64UrlByteLength");
     var utf8ByteLength = /* @__PURE__ */ __name2((value) => new TextEncoder().encode(value).length, "utf8ByteLength");
-    var canonicalBase64Url = /* @__PURE__ */ __name2((bytes2) => external_exports.string().refine((value) => isCanonicalBase64Url(value, bytes2), {
-      message: `must be canonical base64url for exactly ${bytes2} bytes`
+    var canonicalBase64Url = /* @__PURE__ */ __name2((bytes3) => external_exports.string().refine((value) => isCanonicalBase64Url(value, bytes3), {
+      message: `must be canonical base64url for exactly ${bytes3} bytes`
     }), "canonicalBase64Url");
     var ShareLinkIdValidator = canonicalBase64Url(SHARE_LINK_ID_BYTES);
     var ShareContentKeyValidator = canonicalBase64Url(SHARE_CONTENT_KEY_BYTES);
@@ -18993,6 +19009,17 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       contentUrl: external_exports.string(),
       receipt: external_exports.string().min(22).max(128).regex(/^[A-Za-z0-9_-]+$/)
     }).strict();
+    var SKILL_ICON_MAX_NAMES_PER_REQUEST = 100;
+    var SKILL_ICON_MAX_CHARACTERS_PER_REQUEST = 2500;
+    var SkillIconNamesValidator = external_exports.array(external_exports.string().nonempty()).min(1).max(SKILL_ICON_MAX_NAMES_PER_REQUEST, {
+      message: `A maximum of ${SKILL_ICON_MAX_NAMES_PER_REQUEST} skill names can be sent per request`
+    }).refine(
+      (names) => names.reduce((total, name) => total + name.length, 0) <= SKILL_ICON_MAX_CHARACTERS_PER_REQUEST,
+      {
+        message: `Skill names may total at most ${SKILL_ICON_MAX_CHARACTERS_PER_REQUEST} characters per request`
+      }
+    );
+    var GenerateSkillIconsInputValidator = external_exports.object({ names: SkillIconNamesValidator });
   }
 });
 
@@ -19165,37 +19192,37 @@ var DEFAULT_KDF_PARAMS = {
   parallelism: ARGON2_PARALLELISM
 };
 function bufferToBase64(buf) {
-  const bytes2 = new Uint8Array(buf);
+  const bytes3 = new Uint8Array(buf);
   let binary = "";
-  for (let i = 0; i < bytes2.byteLength; i++) {
-    binary += String.fromCharCode(bytes2[i]);
+  for (let i = 0; i < bytes3.byteLength; i++) {
+    binary += String.fromCharCode(bytes3[i]);
   }
   return btoa(binary);
 }
 __name(bufferToBase64, "bufferToBase64");
 function base64ToBuffer(b64) {
   const binary = atob(b64);
-  const bytes2 = new Uint8Array(binary.length);
+  const bytes3 = new Uint8Array(binary.length);
   for (let i = 0; i < binary.length; i++) {
-    bytes2[i] = binary.charCodeAt(i);
+    bytes3[i] = binary.charCodeAt(i);
   }
-  return bytes2;
+  return bytes3;
 }
 __name(base64ToBuffer, "base64ToBuffer");
 function hexToBytes(hex2) {
-  const bytes2 = new Uint8Array(hex2.length / 2);
+  const bytes3 = new Uint8Array(hex2.length / 2);
   for (let i = 0; i < hex2.length; i += 2) {
-    bytes2[i / 2] = parseInt(hex2.slice(i, i + 2), 16);
+    bytes3[i / 2] = parseInt(hex2.slice(i, i + 2), 16);
   }
-  return bytes2;
+  return bytes3;
 }
 __name(hexToBytes, "hexToBytes");
-function bytesToHex(bytes2) {
-  return Array.from(bytes2).map((b) => b.toString(16).padStart(2, "0")).join("");
+function bytesToHex(bytes3) {
+  return Array.from(bytes3).map((b) => b.toString(16).padStart(2, "0")).join("");
 }
 __name(bytesToHex, "bytesToHex");
 async function deriveKeyFromPassword(password, salt, params = DEFAULT_KDF_PARAMS) {
-  const hash = await argon2id({
+  const hash2 = await argon2id({
     password,
     salt,
     iterations: params.timeCost,
@@ -19204,7 +19231,7 @@ async function deriveKeyFromPassword(password, salt, params = DEFAULT_KDF_PARAMS
     hashLength: ARGON2_HASH_LENGTH,
     outputType: "binary"
   });
-  return Uint8Array.from(hash);
+  return Uint8Array.from(hash2);
 }
 __name(deriveKeyFromPassword, "deriveKeyFromPassword");
 async function encryptWithPassword(plaintext, password) {
@@ -19358,21 +19385,21 @@ async function getOrCreateMasterKey() {
 }
 __name(getOrCreateMasterKey, "getOrCreateMasterKey");
 function bufferToBase642(buf) {
-  const bytes2 = new Uint8Array(buf);
+  const bytes3 = new Uint8Array(buf);
   let binary = "";
-  for (let i = 0; i < bytes2.byteLength; i++) {
-    binary += String.fromCharCode(bytes2[i]);
+  for (let i = 0; i < bytes3.byteLength; i++) {
+    binary += String.fromCharCode(bytes3[i]);
   }
   return btoa(binary);
 }
 __name(bufferToBase642, "bufferToBase64");
 function base64ToBuffer2(b64) {
   const binary = atob(b64);
-  const bytes2 = new Uint8Array(binary.length);
+  const bytes3 = new Uint8Array(binary.length);
   for (let i = 0; i < binary.length; i++) {
-    bytes2[i] = binary.charCodeAt(i);
+    bytes3[i] = binary.charCodeAt(i);
   }
-  return bytes2.buffer;
+  return bytes3.buffer;
 }
 __name(base64ToBuffer2, "base64ToBuffer");
 async function encryptShare(share, id) {
@@ -19780,21 +19807,21 @@ async function getWordlist() {
   return wordlistPromise;
 }
 __name(getWordlist, "getWordlist");
-function bytesToBits(bytes2) {
-  return Array.from(bytes2).map((b) => b.toString(2).padStart(8, "0")).join("");
+function bytesToBits(bytes3) {
+  return Array.from(bytes3).map((b) => b.toString(2).padStart(8, "0")).join("");
 }
 __name(bytesToBits, "bytesToBits");
 function bitsToBytes(bits) {
-  const bytes2 = new Uint8Array(Math.ceil(bits.length / 8));
-  for (let i = 0; i < bytes2.length; i++) {
-    bytes2[i] = parseInt(bits.slice(i * 8, (i + 1) * 8).padEnd(8, "0"), 2);
+  const bytes3 = new Uint8Array(Math.ceil(bits.length / 8));
+  for (let i = 0; i < bytes3.length; i++) {
+    bytes3[i] = parseInt(bits.slice(i * 8, (i + 1) * 8).padEnd(8, "0"), 2);
   }
-  return bytes2;
+  return bytes3;
 }
 __name(bitsToBytes, "bitsToBytes");
 async function computeChecksum(data) {
-  const hash = await crypto.subtle.digest("SHA-256", data);
-  const hashBits = bytesToBits(new Uint8Array(hash));
+  const hash2 = await crypto.subtle.digest("SHA-256", data);
+  const hashBits = bytesToBits(new Uint8Array(hash2));
   const checksumLength = Math.floor(data.length / 4);
   return hashBits.slice(0, checksumLength);
 }
@@ -19827,12 +19854,12 @@ async function recoveryPhraseToShare(phrase) {
     bits += index.toString(2).padStart(11, "0");
   }
   let dataByteCount = 0;
-  for (let bytes2 = 1; bytes2 <= 64; bytes2++) {
-    const checksumBits2 = Math.floor(bytes2 / 4);
-    const totalBits = bytes2 * 8 + checksumBits2;
+  for (let bytes3 = 1; bytes3 <= 64; bytes3++) {
+    const checksumBits2 = Math.floor(bytes3 / 4);
+    const totalBits = bytes3 * 8 + checksumBits2;
     const wordsNeeded = Math.ceil(totalBits / 11);
     if (wordsNeeded === words.length) {
-      dataByteCount = bytes2;
+      dataByteCount = bytes3;
     } else if (wordsNeeded > words.length) {
       break;
     }
@@ -20126,9 +20153,9 @@ __name(createSSSKeyManager, "createSSSKeyManager");
 var EMAIL_RELAY_ENVELOPE_VERSION = 1;
 var EMAIL_RELAY_ALGORITHM = "P-256-HKDF-SHA256-AES-256-GCM";
 var encodeUtf8 = /* @__PURE__ */ __name((value) => {
-  const bytes2 = new TextEncoder().encode(value);
-  const copy = new Uint8Array(new ArrayBuffer(bytes2.byteLength));
-  copy.set(bytes2);
+  const bytes3 = new TextEncoder().encode(value);
+  const copy = new Uint8Array(new ArrayBuffer(bytes3.byteLength));
+  copy.set(bytes3);
   return copy;
 }, "encodeUtf8");
 var EMAIL_RELAY_INFO = encodeUtf8("learncard-email-relay-v1");
@@ -20147,7 +20174,7 @@ var parseBranding = /* @__PURE__ */ __name((value) => {
   if (value === void 0) return void 0;
   if (!isRecord(value)) throw new Error("Invalid email relay branding");
   const branding = {};
-  const keys = [
+  const keys2 = [
     "brandName",
     "logoUrl",
     "logoAlt",
@@ -20159,7 +20186,7 @@ var parseBranding = /* @__PURE__ */ __name((value) => {
     "fromDomain",
     "copyrightHolder"
   ];
-  for (const key of keys) {
+  for (const key of keys2) {
     const field = value[key];
     if (field === void 0) continue;
     if (typeof field !== "string" || field.length > 2048) {
@@ -20212,7 +20239,7 @@ var parseEmailRelayPlaintext = /* @__PURE__ */ __name((value) => {
     branding: parseBranding(value.branding)
   };
 }, "parseEmailRelayPlaintext");
-var getAad = /* @__PURE__ */ __name((envelope) => encodeUtf8(`${envelope.version}|${envelope.algorithm}|${envelope.keyId}`), "getAad");
+var getAad = /* @__PURE__ */ __name((envelope2) => encodeUtf8(`${envelope2.version}|${envelope2.algorithm}|${envelope2.keyId}`), "getAad");
 var deriveAesKey = /* @__PURE__ */ __name(async (sharedSecret, salt, usage) => {
   const keyMaterial = await crypto.subtle.importKey("raw", sharedSecret, "HKDF", false, [
     "deriveKey"
@@ -20284,7 +20311,7 @@ var encryptEmailRelayPayload = /* @__PURE__ */ __name(async (input, publicKeyBas
   };
 }, "encryptEmailRelayPayload");
 var decryptEmailRelayPayload = /* @__PURE__ */ __name(async (value, privateKeyBase64) => {
-  const envelope = parseEmailRelayEnvelope(value);
+  const envelope2 = parseEmailRelayEnvelope(value);
   const privateKey = await crypto.subtle.importKey(
     "pkcs8",
     base64ToBuffer(privateKeyBase64.trim()).buffer,
@@ -20294,7 +20321,7 @@ var decryptEmailRelayPayload = /* @__PURE__ */ __name(async (value, privateKeyBa
   );
   const ephemeralPublicKey = await crypto.subtle.importKey(
     "raw",
-    base64ToBuffer(envelope.ephemeralPublicKey).buffer,
+    base64ToBuffer(envelope2.ephemeralPublicKey).buffer,
     { name: "ECDH", namedCurve: "P-256" },
     false,
     []
@@ -20304,13 +20331,13 @@ var decryptEmailRelayPayload = /* @__PURE__ */ __name(async (value, privateKeyBa
     privateKey,
     256
   );
-  const salt = base64ToBuffer(envelope.salt);
-  const iv = base64ToBuffer(envelope.iv);
+  const salt = base64ToBuffer(envelope2.salt);
+  const iv = base64ToBuffer(envelope2.iv);
   const aesKey = await deriveAesKey(sharedSecret, salt, "decrypt");
   const decrypted = await crypto.subtle.decrypt(
-    { name: "AES-GCM", iv, additionalData: getAad(envelope) },
+    { name: "AES-GCM", iv, additionalData: getAad(envelope2) },
     aesKey,
-    base64ToBuffer(envelope.ciphertext)
+    base64ToBuffer(envelope2.ciphertext)
   );
   const parsed = JSON.parse(new TextDecoder().decode(decrypted));
   return parseEmailRelayPlaintext(parsed);
@@ -20322,10 +20349,11 @@ var ESCROW_ALGORITHM = "P-256-HKDF-SHA256-AES-256-GCM";
 var ESCROW_BLOB_INFO = "learncard-escrow-blob-v1";
 var ESCROW_RELEASE_INFO = "learncard-escrow-release-v1";
 var ESCROW_CLIENT_KEY_ID = "client";
+var RECOVERY_LANGUAGES = ["en", "es", "fr", "ar"];
 var encodeUtf82 = /* @__PURE__ */ __name((value) => {
-  const bytes2 = new TextEncoder().encode(value);
-  const copy = new Uint8Array(new ArrayBuffer(bytes2.byteLength));
-  copy.set(bytes2);
+  const bytes3 = new TextEncoder().encode(value);
+  const copy = new Uint8Array(new ArrayBuffer(bytes3.byteLength));
+  copy.set(bytes3);
   return copy;
 }, "encodeUtf8");
 var isRecord2 = /* @__PURE__ */ __name((value) => typeof value === "object" && value !== null && !Array.isArray(value), "isRecord");
@@ -20361,6 +20389,22 @@ var parseEscrowBlobPlaintext = /* @__PURE__ */ __name((value) => {
   if (typeof value.shareVersion !== "number" || !Number.isInteger(value.shareVersion) || value.shareVersion <= 0) {
     throw new Error("Invalid escrow shareVersion");
   }
+  if (value.recoveryEmail !== void 0 !== (value.recoveryLanguage !== void 0)) {
+    throw new Error("Invalid escrow recoveryEmail");
+  }
+  let recoveryContact = {};
+  if (value.recoveryEmail !== void 0) {
+    const email = requireString2(value, "recoveryEmail", { min: 3, max: 254 }).trim().toLowerCase();
+    const at = email.split("@");
+    if (!/^[\x21-\x7e]+$/.test(email) || at.length !== 2 || at[0].length === 0 || at[1].length === 0 || !at[1].includes(".") || at[1].startsWith(".") || at[1].endsWith(".")) {
+      throw new Error("Invalid escrow recoveryEmail");
+    }
+    const language = requireString2(value, "recoveryLanguage", { min: 2, max: 2 });
+    if (!RECOVERY_LANGUAGES.includes(language)) {
+      throw new Error("Invalid escrow recoveryLanguage");
+    }
+    recoveryContact = { recoveryEmail: email, recoveryLanguage: language };
+  }
   return {
     version: ESCROW_ENVELOPE_VERSION,
     recoveryShare: requireString2(value, "recoveryShare", {
@@ -20376,7 +20420,8 @@ var parseEscrowBlobPlaintext = /* @__PURE__ */ __name((value) => {
         max: 64,
         pattern: /^[0-9a-f]{64}$/i
       }).toLowerCase()
-    } : {}
+    } : {},
+    ...recoveryContact
   };
 }, "parseEscrowBlobPlaintext");
 var parseEscrowReleasePlaintext = /* @__PURE__ */ __name((value) => {
@@ -20387,7 +20432,7 @@ var parseEscrowReleasePlaintext = /* @__PURE__ */ __name((value) => {
     holdId: requireString2(value, "holdId", { max: 128, pattern: /^[A-Za-z0-9._-]+$/ })
   };
 }, "parseEscrowReleasePlaintext");
-var getAad2 = /* @__PURE__ */ __name((envelope) => encodeUtf82(`${envelope.version}|${envelope.algorithm}|${envelope.keyId}`), "getAad");
+var getAad2 = /* @__PURE__ */ __name((envelope2) => encodeUtf82(`${envelope2.version}|${envelope2.algorithm}|${envelope2.keyId}`), "getAad");
 var deriveAesKey2 = /* @__PURE__ */ __name(async (sharedSecret, salt, usage, info) => {
   const keyMaterial = await crypto.subtle.importKey("raw", sharedSecret, "HKDF", false, [
     "deriveKey"
@@ -20458,7 +20503,7 @@ var encryptToRecipient = /* @__PURE__ */ __name(async (plaintextJson, spki, keyI
   };
 }, "encryptToRecipient");
 var decryptFromEnvelope = /* @__PURE__ */ __name(async (value, pkcs8, info) => {
-  const envelope = parseEscrowEnvelope(value);
+  const envelope2 = parseEscrowEnvelope(value);
   const privateKey = await crypto.subtle.importKey(
     "pkcs8",
     base64ToBuffer(pkcs8.trim()),
@@ -20468,7 +20513,7 @@ var decryptFromEnvelope = /* @__PURE__ */ __name(async (value, pkcs8, info) => {
   );
   const ephemeralPublicKey = await crypto.subtle.importKey(
     "raw",
-    base64ToBuffer(envelope.ephemeralPublicKey),
+    base64ToBuffer(envelope2.ephemeralPublicKey),
     { name: "ECDH", namedCurve: "P-256" },
     false,
     []
@@ -20478,13 +20523,13 @@ var decryptFromEnvelope = /* @__PURE__ */ __name(async (value, pkcs8, info) => {
     privateKey,
     256
   );
-  const salt = base64ToBuffer(envelope.salt);
-  const iv = base64ToBuffer(envelope.iv);
+  const salt = base64ToBuffer(envelope2.salt);
+  const iv = base64ToBuffer(envelope2.iv);
   const aesKey = await deriveAesKey2(sharedSecret, salt, "decrypt", info);
   const decrypted = await crypto.subtle.decrypt(
-    { name: "AES-GCM", iv, additionalData: getAad2(envelope) },
+    { name: "AES-GCM", iv, additionalData: getAad2(envelope2) },
     aesKey,
-    base64ToBuffer(envelope.ciphertext)
+    base64ToBuffer(envelope2.ciphertext)
   );
   const parsed = JSON.parse(new TextDecoder().decode(decrypted));
   return parsed;
@@ -20498,8 +20543,8 @@ var encryptEscrowBlob = /* @__PURE__ */ __name(async (input, enclavePublicKeySpk
     ESCROW_BLOB_INFO
   );
 }, "encryptEscrowBlob");
-var decryptEscrowBlob = /* @__PURE__ */ __name(async (envelope, enclavePrivateKeyPkcs8B64) => parseEscrowBlobPlaintext(
-  await decryptFromEnvelope(envelope, enclavePrivateKeyPkcs8B64, ESCROW_BLOB_INFO)
+var decryptEscrowBlob = /* @__PURE__ */ __name(async (envelope2, enclavePrivateKeyPkcs8B64) => parseEscrowBlobPlaintext(
+  await decryptFromEnvelope(envelope2, enclavePrivateKeyPkcs8B64, ESCROW_BLOB_INFO)
 ), "decryptEscrowBlob");
 var sealEscrowRelease = /* @__PURE__ */ __name(async (input, clientEphemeralPublicKeySpkiB64) => {
   const plaintext = parseEscrowReleasePlaintext({ ...input, version: ESCROW_ENVELOPE_VERSION });
@@ -20510,10 +20555,196 @@ var sealEscrowRelease = /* @__PURE__ */ __name(async (input, clientEphemeralPubl
     ESCROW_RELEASE_INFO
   );
 }, "sealEscrowRelease");
-var openEscrowRelease = /* @__PURE__ */ __name(async (envelope, clientEphemeralPrivateKeyPkcs8B64) => parseEscrowReleasePlaintext(
-  await decryptFromEnvelope(envelope, clientEphemeralPrivateKeyPkcs8B64, ESCROW_RELEASE_INFO)
+var openEscrowRelease = /* @__PURE__ */ __name(async (envelope2, clientEphemeralPrivateKeyPkcs8B64) => parseEscrowReleasePlaintext(
+  await decryptFromEnvelope(envelope2, clientEphemeralPrivateKeyPkcs8B64, ESCROW_RELEASE_INFO)
 ), "openEscrowRelease");
 
+// src/escrow-enrollment-intent.ts
+import { ExtendedPoint, getPublicKeyAsync, signAsync } from "@noble/ed25519";
+var ESCROW_ENROLLMENT_INTENT_DOMAIN = "learncard-escrow-enrollment-intent-v2\0";
+var BASE58 = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+var FIELDS = [
+  "version",
+  "tenant",
+  "did",
+  "authorityGeneration",
+  "expectedEnrollmentVersion",
+  "action",
+  "sourceBlobIdentity",
+  "targetBlobIdentity",
+  "pinAction",
+  "shareVersion",
+  "enrollmentEpoch",
+  "requestId",
+  "allowRewrap",
+  "recoveryEmail",
+  "recoveryLanguage"
+];
+var ACTIONS = ["enroll", "replace", "disable", "carry"];
+var PIN_ACTIONS = ["set", "change", "clear", "keep"];
+var RECOVERY_LANGUAGES2 = ["en", "es", "fr", "ar"];
+var requireIntent = /* @__PURE__ */ __name((condition) => {
+  if (!condition) throw new Error("Invalid escrow enrollment intent");
+}, "requireIntent");
+var matches = /* @__PURE__ */ __name((value, pattern) => typeof value === "string" && pattern.exec(value)?.[0] === value, "matches");
+var utf8 = /* @__PURE__ */ __name((value) => new TextEncoder().encode(value), "utf8");
+var integer = /* @__PURE__ */ __name((value, width) => {
+  requireIntent(
+    Number.isSafeInteger(value) && value >= 0 && (width === 8 || value <= 4294967295)
+  );
+  const bytes3 = new Uint8Array(width);
+  const view = new DataView(bytes3.buffer);
+  if (width === 4) view.setUint32(0, value, false);
+  else view.setBigUint64(0, BigInt(value), false);
+  return bytes3;
+}, "integer");
+var join = /* @__PURE__ */ __name((fields) => {
+  const result = new Uint8Array(fields.reduce((length, field) => length + field.length, 0));
+  let offset = 0;
+  for (const field of fields) {
+    result.set(field, offset);
+    offset += field.length;
+  }
+  return result;
+}, "join");
+var hashBytes = /* @__PURE__ */ __name((value) => {
+  if (value === null) return new Uint8Array();
+  requireIntent(matches(value, /^[0-9a-f]{64}$/));
+  return new Uint8Array(hexToBytes(value));
+}, "hashBytes");
+var didPublicKey = /* @__PURE__ */ __name((did) => {
+  requireIntent(typeof did === "string" && did.startsWith("did:key:z") && did.length === 56);
+  let value = 0n;
+  for (const char of did.slice(9)) {
+    const digit = BASE58.indexOf(char);
+    requireIntent(digit >= 0);
+    value = value * 58n + BigInt(digit);
+  }
+  const bytes3 = new Uint8Array(34);
+  for (let i = 33; i >= 0; i--) {
+    bytes3[i] = Number(value & 255n);
+    value >>= 8n;
+  }
+  requireIntent(value === 0n && bytes3[0] === 237 && bytes3[1] === 1);
+  const key = bytes3.slice(2);
+  try {
+    requireIntent(!ExtendedPoint.fromHex(key, false).isSmallOrder());
+  } catch {
+    throw new Error("Invalid escrow enrollment intent");
+  }
+  return key;
+}, "didPublicKey");
+var encodeEscrowEnrollmentIntent = /* @__PURE__ */ __name((intent) => {
+  requireIntent(typeof intent === "object" && intent !== null && !Array.isArray(intent));
+  requireIntent(
+    Object.keys(intent).length === FIELDS.length && FIELDS.every((field) => Object.prototype.hasOwnProperty.call(intent, field))
+  );
+  requireIntent(intent.version === 2 && typeof intent.allowRewrap === "boolean");
+  requireIntent(matches(intent.tenant, /^[A-Za-z0-9_-]{1,128}$/));
+  requireIntent(matches(intent.authorityGeneration, /^[A-Za-z0-9_-]{1,128}$/));
+  requireIntent(matches(intent.requestId, /^[A-Za-z0-9._-]{1,112}$/));
+  didPublicKey(intent.did);
+  const action = ACTIONS.indexOf(intent.action);
+  const pin = PIN_ACTIONS.indexOf(intent.pinAction);
+  requireIntent(action >= 0 && pin >= 0 && intent.shareVersion > 0 && intent.enrollmentEpoch > 0);
+  const source = hashBytes(intent.sourceBlobIdentity);
+  const target = hashBytes(intent.targetBlobIdentity);
+  if (intent.action === "enroll") requireIntent(source.length === 0 && target.length === 32);
+  else if (intent.action === "disable")
+    requireIntent(
+      source.length === 32 && target.length === 0 && intent.pinAction === "keep" && !intent.allowRewrap
+    );
+  else
+    requireIntent(
+      source.length === 32 && target.length === 32 && intent.sourceBlobIdentity !== intent.targetBlobIdentity
+    );
+  if (intent.action === "carry") requireIntent(intent.pinAction === "keep");
+  if (intent.recoveryEmail === null) {
+    requireIntent(
+      intent.recoveryLanguage === null && (intent.action === "disable" || intent.action === "carry")
+    );
+  } else {
+    requireIntent(intent.action === "enroll" || intent.action === "replace");
+    requireIntent(
+      matches(intent.recoveryEmail, /^[\x21-\x7e]{3,254}$/) && intent.recoveryEmail === intent.recoveryEmail.trim().toLowerCase()
+    );
+    const at = intent.recoveryEmail.split("@");
+    requireIntent(
+      at.length === 2 && at[0].length > 0 && at[1].length > 0 && at[1].includes(".") && !at[1].startsWith(".") && !at[1].endsWith(".")
+    );
+    requireIntent(
+      intent.recoveryLanguage !== null && RECOVERY_LANGUAGES2.includes(intent.recoveryLanguage)
+    );
+  }
+  const fields = [
+    integer(intent.version, 4),
+    utf8(intent.tenant),
+    utf8(intent.did),
+    utf8(intent.authorityGeneration),
+    integer(intent.expectedEnrollmentVersion, 8),
+    Uint8Array.of(action),
+    source,
+    target,
+    Uint8Array.of(pin),
+    integer(intent.shareVersion, 4),
+    integer(intent.enrollmentEpoch, 8),
+    utf8(intent.requestId),
+    Uint8Array.of(Number(intent.allowRewrap)),
+    intent.recoveryEmail === null ? new Uint8Array() : utf8(intent.recoveryEmail),
+    intent.recoveryLanguage === null ? new Uint8Array() : utf8(intent.recoveryLanguage)
+  ];
+  return join([
+    utf8(ESCROW_ENROLLMENT_INTENT_DOMAIN),
+    ...fields.flatMap((field) => [integer(field.length, 4), field])
+  ]);
+}, "encodeEscrowEnrollmentIntent");
+var signEscrowEnrollmentIntent = /* @__PURE__ */ __name(async (intent, privateKey) => {
+  encodeEscrowEnrollmentIntent(intent);
+  const snapshot = { ...intent };
+  const message = encodeEscrowEnrollmentIntent(snapshot);
+  requireIntent(matches(privateKey, /^[0-9a-f]{64}$/i));
+  const seed = hexToBytes(privateKey);
+  try {
+    const publicKey = await getPublicKeyAsync(seed);
+    const expected = didPublicKey(snapshot.did);
+    requireIntent(publicKey.every((byte, index) => byte === expected[index]));
+    const signature = await signAsync(message, seed);
+    return { intent: snapshot, signature: bufferToBase64(new Uint8Array(signature).buffer) };
+  } finally {
+    seed.fill(0);
+  }
+}, "signEscrowEnrollmentIntent");
+var getEscrowBlobIdentity = /* @__PURE__ */ __name(async (input) => {
+  const envelope2 = parseEscrowEnvelope(input);
+  const decode2 = /* @__PURE__ */ __name((value) => {
+    const bytes3 = new Uint8Array(base64ToBuffer(value));
+    requireIntent(bufferToBase64(bytes3.buffer) === value);
+    return bytes3;
+  }, "decode");
+  const point = decode2(envelope2.ephemeralPublicKey);
+  const salt = decode2(envelope2.salt);
+  const iv = decode2(envelope2.iv);
+  const ciphertext = decode2(envelope2.ciphertext);
+  requireIntent(
+    point.length === 65 && point[0] === 4 && salt.length === 32 && iv.length === 12 && ciphertext.length >= 16
+  );
+  await crypto.subtle.importKey("raw", point, { name: "ECDH", namedCurve: "P-256" }, false, []);
+  const fields = [
+    Uint8Array.of(1),
+    utf8(envelope2.algorithm),
+    utf8(envelope2.keyId),
+    point.slice(1, 33),
+    salt,
+    iv,
+    ciphertext
+  ];
+  const message = join([
+    utf8("learncard-escrow-blob-id-v1\0"),
+    ...fields.flatMap((field) => [integer(field.length, 8), field])
+  ]);
+  return bytesToHex(new Uint8Array(await crypto.subtle.digest("SHA-256", message)));
+}, "getEscrowBlobIdentity");
+
 // src/escrow-nitro-attestation.ts
 import "reflect-metadata";
 import { decode, encode } from "cborg";
@@ -20537,15 +20768,15 @@ var AWS_ROOT_SHA256 = "641a0321a3e244efe456463195d606317ed7cdcc3c1756e09893f3c68
 var fail = /* @__PURE__ */ __name((reason) => {
   throw new NitroAttestationError(reason);
 }, "fail");
-var hex = /* @__PURE__ */ __name((bytes2) => Array.from(bytes2, (byte) => byte.toString(16).padStart(2, "0")).join(""), "hex");
+var hex = /* @__PURE__ */ __name((bytes3) => Array.from(bytes3, (byte) => byte.toString(16).padStart(2, "0")).join(""), "hex");
 var bytes = /* @__PURE__ */ __name((value, reason) => value instanceof Uint8Array && value.length > 0 ? value : fail(reason), "bytes");
 var map = /* @__PURE__ */ __name((value, reason) => value instanceof Map ? value : fail(reason), "map");
-var decodeCbor = /* @__PURE__ */ __name((value) => {
+var decodeCbor = /* @__PURE__ */ __name((value, { allowIndefinite = false } = {}) => {
   try {
     return decode(value, {
       useMaps: true,
       rejectDuplicateMapKeys: true,
-      allowIndefinite: false,
+      allowIndefinite,
       allowUndefined: false,
       allowNaN: false,
       allowInfinity: false,
@@ -20603,7 +20834,7 @@ var verifyNitroAttestationDocument = /* @__PURE__ */ __name(async (documentB64,
   const payloadBytes = bytes(payloadValue, "cose");
   const signature = bytes(signatureValue, "signature");
   if (signature.length !== 96) fail("signature");
-  const payload = map(decodeCbor(payloadBytes), "cbor");
+  const payload = map(decodeCbor(payloadBytes, { allowIndefinite: true }), "cbor");
   const moduleId = payload.get("module_id");
   const timestamp = payload.get("timestamp");
   if (typeof moduleId !== "string" || !moduleId || payload.get("digest") !== "SHA384")
@@ -20693,13 +20924,36 @@ var verifyNitroAttestationDocument = /* @__PURE__ */ __name(async (documentB64,
   } catch {
     return fail("user-data");
   }
+  const rawLedgerKey = payload.get("public_key");
+  let ledgerPublicKey;
+  let measurementHash;
+  if (rawLedgerKey !== void 0 && rawLedgerKey !== null) {
+    const ledger = new Uint8Array(bytes(rawLedgerKey, "user-data"));
+    if (ledger.length !== 65 || ledger[0] !== 4) fail("user-data");
+    try {
+      await crypto.subtle.importKey(
+        "raw",
+        ledger,
+        { name: "ECDSA", namedCurve: "P-256" },
+        false,
+        ["verify"]
+      );
+    } catch {
+      return fail("user-data");
+    }
+    const tuple = new Uint8Array(144);
+    for (let i = 0; i < 3; i++) tuple.set(bytes(rawPcrs.get(i), "pcr"), i * 48);
+    measurementHash = hex(new Uint8Array(await crypto.subtle.digest("SHA-256", tuple)));
+    ledgerPublicKey = bufferToBase64(ledger.buffer);
+  }
   return {
     escrowPublicKeySpkiB64: bufferToBase64(new Uint8Array(spki).buffer),
     keyId: newFormat?.keyId,
     previousKeyIds: newFormat?.previousKeyIds ?? [],
     pcrs,
     timestamp,
-    moduleId
+    moduleId,
+    ...ledgerPublicKey ? { ledgerPublicKey, measurementHash } : {}
   };
 }, "verifyNitroAttestationDocument");
 
@@ -20753,7 +21007,13 @@ var verifyEnclaveAttestation = /* @__PURE__ */ __name(async (attestation, policy
       publicKey: verified.escrowPublicKeySpkiB64,
       keyId: attestation.keyId,
       previousKeyIds: verified.previousKeyIds,
-      mode: "nitro"
+      mode: "nitro",
+      ...verified.keyId && verified.ledgerPublicKey && verified.measurementHash ? {
+        authority: {
+          ledgerPublicKey: verified.ledgerPublicKey,
+          measurement: verified.measurementHash
+        }
+      } : {}
     };
   }
   const publicKey = normalizePublicKey(attestation.publicKey);
@@ -20775,6 +21035,424 @@ var verifyEnclaveAttestation = /* @__PURE__ */ __name(async (attestation, policy
   };
 }, "verifyEnclaveAttestation");
 
+// src/escrow-authority.types.ts
+var EscrowEvidenceError = class extends Error {
+  static {
+    __name(this, "EscrowEvidenceError");
+  }
+  constructor() {
+    super("Automatic recovery evidence could not be verified.");
+    this.name = "EscrowEvidenceError";
+  }
+};
+
+// src/escrow-authority.ts
+var fail2 = /* @__PURE__ */ __name(() => {
+  throw new EscrowEvidenceError();
+}, "fail");
+var verifyEscrowHoldState = /* @__PURE__ */ __name(async (response, nonce, expected, identity) => {
+  requireEvidence(/^[0-9a-f]{64}$/.test(nonce));
+  const { payload } = await verifyRecord(response.proof, "snapshot", identity);
+  requireEvidence(Array.isArray(payload) && payload.length === 12);
+  const p = payload;
+  requireEvidence(
+    p[0] === "learncard-authority-hold-state-v3" && p[1] === nonce && p[2] === expected.tenant && p[3] === expected.authorityGeneration && p[4] === expected.did && p[5] === expected.holdId && p[6] === expected.holdDigest
+  );
+  const status = p[7];
+  if (status !== "awaitingConfirmation" && status !== "pending" && status !== "released" && status !== "cancelled")
+    return fail2();
+  const confirmedHiMs = p[8] === null ? null : integer2(p[8]);
+  const releaseWarningSentHiMs = p[9] === null ? null : integer2(p[9]);
+  const attemptsRemaining = integer2(p[10], 0, 5);
+  const codeSendStatus = p[11];
+  if (codeSendStatus !== "unknown" && codeSendStatus !== "notRequired") return fail2();
+  requireEvidence(
+    status !== "awaitingConfirmation" || confirmedHiMs === null && releaseWarningSentHiMs === null
+  );
+  requireEvidence(status !== "pending" && status !== "released" || confirmedHiMs !== null);
+  return { status, confirmedHiMs, releaseWarningSentHiMs, attemptsRemaining, codeSendStatus };
+}, "verifyEscrowHoldState");
+var verifyEscrowCodeDelivery = /* @__PURE__ */ __name(async (delivery, expected, identity) => {
+  const { payload } = await verifyRecord(delivery.proof, "snapshot", identity);
+  requireEvidence(Array.isArray(payload) && payload.length === 5);
+  const values = payload;
+  requireEvidence(
+    values[0] === "learncard-authority-code-delivery-v1" && values[1] === expected.tenant && values[2] === expected.authorityGeneration && values[3] === expected.holdDigest && typeof values[4] === "boolean" && values[4] === delivery.codeSent
+  );
+  return delivery.codeSent;
+}, "verifyEscrowCodeDelivery");
+var requireEvidence = /* @__PURE__ */ __name((condition) => {
+  if (!condition) fail2();
+}, "requireEvidence");
+var object = /* @__PURE__ */ __name((value) => {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return fail2();
+  return value;
+}, "object");
+var keys = /* @__PURE__ */ __name((value, names) => {
+  requireEvidence(
+    Object.keys(value).length === names.length && names.every((name) => Object.prototype.hasOwnProperty.call(value, name))
+  );
+}, "keys");
+var integer2 = /* @__PURE__ */ __name((value, minimum = 0, maximum = Number.MAX_SAFE_INTEGER) => {
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < minimum || value > maximum)
+    return fail2();
+  return value;
+}, "integer");
+var text = /* @__PURE__ */ __name((value, maximum) => {
+  if (typeof value !== "string" || !value.length || value.length > maximum) return fail2();
+  return value;
+}, "text");
+var bytes2 = /* @__PURE__ */ __name((value, length) => {
+  if (!Array.isArray(value) || value.length !== length || !value.every(
+    (byte) => typeof byte === "number" && Number.isInteger(byte) && byte >= 0 && byte <= 255
+  ))
+    return fail2();
+  return Uint8Array.from(value);
+}, "bytes");
+var base64 = /* @__PURE__ */ __name((value, maximum) => {
+  const encoded = text(value, maximum);
+  try {
+    const decoded = new Uint8Array(base64ToBuffer(encoded));
+    requireEvidence(bufferToBase64(decoded.buffer) === encoded);
+    return decoded;
+  } catch {
+    return fail2();
+  }
+}, "base64");
+var frame = /* @__PURE__ */ __name((value) => {
+  const result = new Uint8Array(4 + value.length);
+  new DataView(result.buffer).setUint32(0, value.length, false);
+  result.set(value, 4);
+  return result;
+}, "frame");
+var join2 = /* @__PURE__ */ __name((...values) => {
+  const result = new Uint8Array(values.reduce((n, v) => n + v.length, 0));
+  let offset = 0;
+  for (const value of values) {
+    result.set(value, offset);
+    offset += value.length;
+  }
+  return result;
+}, "join");
+var hash = /* @__PURE__ */ __name(async (value) => bytesToHex(new Uint8Array(await crypto.subtle.digest("SHA-256", new Uint8Array(value)))), "hash");
+var utf82 = /* @__PURE__ */ __name((value) => new TextEncoder().encode(value), "utf8");
+var escrowAuthorityMeasurements = /* @__PURE__ */ __name(async (policy) => {
+  if (policy.mode !== "nitro") return [];
+  const hashes = [];
+  for (const pin of policy.pinnedMeasurements) {
+    const tuple = [pin.pcr0, pin.pcr1, pin.pcr2];
+    if (!tuple.every((pcr) => typeof pcr === "string" && /^[0-9a-f]{96}$/i.test(pcr))) continue;
+    if (pin.pcr0 === "00".repeat(48)) continue;
+    const encoded = tuple.join("");
+    const decoded = Uint8Array.from(
+      { length: 144 },
+      (_, i) => parseInt(encoded.slice(i * 2, i * 2 + 2), 16)
+    );
+    hashes.push(await hash(decoded));
+  }
+  return hashes;
+}, "escrowAuthorityMeasurements");
+var P256_ORDER = BigInt("0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551");
+var verifyRecord = /* @__PURE__ */ __name(async (input, kind, identity, historical) => {
+  requireEvidence(identity.mode === "nitro" && !!identity.authority);
+  const raw = object(input);
+  keys(raw, ["version", "kind", "keyId", "measurement", "payload", "signature"]);
+  requireEvidence(raw.version === 1 && raw.kind === kind);
+  const keyId = text(raw.keyId, 128);
+  requireEvidence(
+    historical ? [identity.keyId, ...identity.previousKeyIds].includes(keyId) : keyId === identity.keyId
+  );
+  const measurement = bytes2(raw.measurement, 32);
+  requireEvidence(
+    historical ? historical.allowedMeasurements.includes(bytesToHex(measurement)) : bytesToHex(measurement) === identity.authority?.measurement
+  );
+  const payloadB64 = text(raw.payload, kind === "snapshot" ? 49152 : 8192);
+  const signatureB64 = text(raw.signature, 88);
+  const payload = base64(payloadB64, kind === "snapshot" ? 49152 : 8192);
+  const signature = base64(signatureB64, 88);
+  const ledgerKey = base64(identity.authority?.ledgerPublicKey, 88);
+  requireEvidence(ledgerKey.length === 65 && ledgerKey[0] === 4);
+  requireEvidence(signature.length === 64);
+  const s = BigInt(`0x${bytesToHex(signature.slice(32))}`);
+  requireEvidence(s > 0n && s <= P256_ORDER / 2n);
+  const message = join2(
+    utf82("learncard-authority-signed-record-v1\0"),
+    Uint8Array.of(kind === "snapshot" ? 2 : 1),
+    frame(utf82(keyId)),
+    measurement,
+    frame(payload)
+  );
+  try {
+    const key = await crypto.subtle.importKey(
+      "raw",
+      ledgerKey,
+      { name: "ECDSA", namedCurve: "P-256" },
+      false,
+      ["verify"]
+    );
+    requireEvidence(
+      await crypto.subtle.verify({ name: "ECDSA", hash: "SHA-256" }, key, signature, message)
+    );
+    const decoded = JSON.parse(
+      new TextDecoder("utf-8", { fatal: true }).decode(payload)
+    );
+    const record = {
+      version: 1,
+      kind,
+      keyId,
+      measurement: Array.from(measurement),
+      payload: payloadB64,
+      signature: signatureB64
+    };
+    return { record, payload: decoded };
+  } catch {
+    return fail2();
+  }
+}, "verifyRecord");
+var envelope = /* @__PURE__ */ __name((value) => {
+  try {
+    const e = parseEscrowEnvelope(value);
+    return {
+      version: e.version,
+      algorithm: e.algorithm,
+      keyId: e.keyId,
+      ephemeralPublicKey: e.ephemeralPublicKey,
+      salt: e.salt,
+      iv: e.iv,
+      ciphertext: e.ciphertext
+    };
+  } catch {
+    return fail2();
+  }
+}, "envelope");
+var state = /* @__PURE__ */ __name((value) => {
+  const raw = object(value);
+  keys(raw, [
+    "tenant",
+    "authorityGeneration",
+    "did",
+    "enrollmentVersion",
+    "enrollmentEpoch",
+    "status",
+    "envelope",
+    "shareVersion",
+    "hasPin",
+    "pinGeneration",
+    "attemptsUsed"
+  ]);
+  if (raw.status !== "empty" && raw.status !== "active" && raw.status !== "disabled")
+    return fail2();
+  if (typeof raw.hasPin !== "boolean") return fail2();
+  const result = {
+    tenant: text(raw.tenant, 128),
+    authorityGeneration: text(raw.authorityGeneration, 128),
+    did: text(raw.did, 8192),
+    enrollmentVersion: integer2(raw.enrollmentVersion),
+    enrollmentEpoch: integer2(raw.enrollmentEpoch),
+    status: raw.status,
+    envelope: raw.envelope === null ? null : envelope(raw.envelope),
+    shareVersion: raw.shareVersion === null ? null : integer2(raw.shareVersion, 1, 4294967295),
+    hasPin: raw.hasPin,
+    pinGeneration: integer2(raw.pinGeneration),
+    attemptsUsed: integer2(raw.attemptsUsed, 0, 10)
+  };
+  requireEvidence(
+    result.pinGeneration <= result.enrollmentVersion && result.enrollmentEpoch <= result.enrollmentVersion && (!result.hasPin || result.pinGeneration > 0) && (result.hasPin || result.attemptsUsed === 0)
+  );
+  if (result.status === "empty")
+    requireEvidence(
+      result.enrollmentVersion === 0 && result.enrollmentEpoch === 0 && !result.envelope && result.shareVersion === null && !result.hasPin
+    );
+  else requireEvidence(result.enrollmentVersion > 0 && result.enrollmentEpoch > 0);
+  if (result.status === "active")
+    requireEvidence(!!result.envelope && result.shareVersion !== null);
+  else requireEvidence(result.envelope === null && result.shareVersion === null);
+  return result;
+}, "state");
+var verifyEscrowAuthorityState = /* @__PURE__ */ __name(async (response, nonce, tenant, did, identity) => {
+  requireEvidence(/^[0-9a-f]{64}$/.test(nonce) && nonce.length === 64);
+  const raw = object(response);
+  keys(raw, ["state", "proof"]);
+  const { payload } = await verifyRecord(raw.proof, "snapshot", identity);
+  if (!Array.isArray(payload) || payload.length !== 2 || payload[0] !== nonce) return fail2();
+  const signed = state(payload[1]);
+  requireEvidence(signed.tenant === tenant && signed.did === did);
+  requireEvidence(JSON.stringify(signed) === JSON.stringify(state(raw.state)));
+  if (signed.envelope) {
+    requireEvidence(
+      [identity.keyId, ...identity.previousKeyIds].includes(signed.envelope.keyId)
+    );
+    await getEscrowBlobIdentity(signed.envelope);
+  }
+  return signed;
+}, "verifyEscrowAuthorityState");
+var verifyEscrowEnrollmentCommit = /* @__PURE__ */ __name(async (response, intent, identity) => {
+  const raw = object(response);
+  const { record, payload } = await verifyRecord(raw.receipt, "commit", identity);
+  const data = object(payload);
+  keys(data, ["commit", "eventHash", "requestDigest", "resultBlobIdentity", "enrollmentEpoch"]);
+  const commit = object(data.commit);
+  keys(commit, ["schemaVersion", "binding", "executionId", "revisions", "transactionDigest"]);
+  const binding = object(commit.binding);
+  keys(binding, ["tenant", "generation", "didHash"]);
+  const revisions = object(commit.revisions);
+  keys(revisions, ["operation", "enrollment"]);
+  requireEvidence(
+    commit.schemaVersion === 1 && binding.tenant === intent.tenant && binding.generation === intent.authorityGeneration
+  );
+  requireEvidence(bytesToHex(bytes2(binding.didHash, 32)) === await hash(utf82(intent.did)));
+  requireEvidence(
+    integer2(revisions.enrollment, 1) === intent.expectedEnrollmentVersion + 1 && integer2(revisions.operation, 1) >= integer2(revisions.enrollment, 1)
+  );
+  bytes2(commit.executionId, 16);
+  bytes2(commit.transactionDigest, 32);
+  bytes2(data.eventHash, 32);
+  requireEvidence(integer2(data.enrollmentEpoch, 1) === intent.enrollmentEpoch);
+  requireEvidence(
+    bytesToHex(bytes2(data.requestDigest, 32)) === await hash(encodeEscrowEnrollmentIntent(intent))
+  );
+  if (intent.action === "disable") {
+    requireEvidence(
+      (raw.envelope === null || raw.envelope === void 0) && data.resultBlobIdentity === null
+    );
+    return { envelope: null, receipt: record };
+  }
+  const output = envelope(raw.envelope);
+  requireEvidence(
+    output.keyId === identity.keyId && bytesToHex(bytes2(data.resultBlobIdentity, 32)) === await getEscrowBlobIdentity(output)
+  );
+  return { envelope: output, receipt: record };
+}, "verifyEscrowEnrollmentCommit");
+var holdDigest = /* @__PURE__ */ __name(async (tenant, record) => {
+  const h = record.hold;
+  const didHash = await hash(utf82(h.did));
+  return hash(
+    utf82(
+      JSON.stringify([
+        "learncard-hold-v1",
+        tenant,
+        h.holdId,
+        didHash,
+        h.shareVersion,
+        h.blobHash,
+        h.enrollmentEpoch,
+        h.releasePolicy,
+        h.clientEphemeralPublicKey,
+        h.createdLo,
+        h.createdHi,
+        record.holdDurationMs,
+        h.policyVersion,
+        record.ledgerSeq
+      ])
+    )
+  );
+}, "holdDigest");
+var verifyEscrowHoldRecord = /* @__PURE__ */ __name(async (record, expected, identity, historical) => {
+  requireEvidence(
+    record.hold.holdId === expected.holdId && record.hold.did === expected.did && record.hold.clientEphemeralPublicKey === expected.clientEphemeralPublicKey && record.hold.blobHash === expected.blobHash
+  );
+  let signed;
+  try {
+    signed = JSON.parse(
+      new TextDecoder("utf-8", { fatal: true }).decode(base64(record.hold.signature, 8192))
+    );
+  } catch {
+    return fail2();
+  }
+  const { record: receipt, payload } = await verifyRecord(signed, "commit", identity, historical);
+  const data = object(payload);
+  keys(data, ["commit", "eventHash", "requestDigest", "resultBlobIdentity", "enrollmentEpoch"]);
+  const commit = object(data.commit);
+  keys(commit, ["schemaVersion", "binding", "executionId", "revisions", "transactionDigest"]);
+  const binding = object(commit.binding);
+  keys(binding, ["tenant", "generation", "didHash"]);
+  requireEvidence(commit.schemaVersion === 1 && binding.tenant === expected.tenant);
+  const authorityGeneration = text(binding.generation, 128);
+  if (historical) requireEvidence(authorityGeneration === historical.authorityGeneration);
+  requireEvidence(bytesToHex(bytes2(binding.didHash, 32)) === await hash(utf82(expected.did)));
+  requireEvidence(integer2(data.enrollmentEpoch, 1) === record.hold.enrollmentEpoch);
+  requireEvidence(bytesToHex(bytes2(data.resultBlobIdentity, 32)) === record.hold.blobHash);
+  const digest = await holdDigest(expected.tenant, record);
+  requireEvidence(bytesToHex(bytes2(data.requestDigest, 32)) === digest);
+  return { receipt, authorityGeneration, holdDigest: digest };
+}, "verifyEscrowHoldRecord");
+var verifyEscrowHoldConfirmation = /* @__PURE__ */ __name(async (receipt, record, expected, identity) => {
+  const raw = object(receipt);
+  const kind = raw.kind;
+  if (kind !== "commit" && kind !== "snapshot") return fail2();
+  const { record: verified, payload } = await verifyRecord(raw, kind, identity);
+  if (kind === "snapshot") {
+    if (!Array.isArray(payload) || payload.length !== 7) return fail2();
+    const [tag, holdId, digestBytes] = payload;
+    requireEvidence(
+      tag === "learncard-authority-hold-snapshot-v2" && holdId === record.hold.holdId && payload[6] === expected.authorityGeneration
+    );
+    requireEvidence(
+      bytesToHex(bytes2(digestBytes, 32)) === await holdDigest(expected.tenant, record)
+    );
+    requireEvidence(payload[3] === "pending");
+    integer2(payload[4], 1);
+    return verified;
+  }
+  const data = object(payload);
+  keys(data, ["commit", "eventHash", "requestDigest", "resultBlobIdentity", "enrollmentEpoch"]);
+  const commit = object(data.commit);
+  keys(commit, ["schemaVersion", "binding", "executionId", "revisions", "transactionDigest"]);
+  const binding = object(commit.binding);
+  keys(binding, ["tenant", "generation", "didHash"]);
+  requireEvidence(
+    commit.schemaVersion === 1 && binding.tenant === expected.tenant && binding.generation === expected.authorityGeneration
+  );
+  requireEvidence(bytesToHex(bytes2(binding.didHash, 32)) === await hash(utf82(expected.did)));
+  requireEvidence(integer2(data.enrollmentEpoch, 1) === record.hold.enrollmentEpoch);
+  requireEvidence(bytesToHex(bytes2(data.resultBlobIdentity, 32)) === record.hold.blobHash);
+  bytes2(data.requestDigest, 32);
+  return verified;
+}, "verifyEscrowHoldConfirmation");
+var resolveEscrowEnrollmentAction = /* @__PURE__ */ __name((current, input) => {
+  const disabling = input === "disable";
+  const pinAction = disabling ? "keep" : input === "set" ? current.hasPin ? "change" : "set" : input === "clear" ? current.hasPin ? "clear" : "keep" : "keep";
+  const action = disabling ? "disable" : current.status !== "active" ? "enroll" : current.hasPin && pinAction === "keep" ? "carry" : "replace";
+  return { action, pinAction, bindsRecoveryContact: action === "enroll" || action === "replace" };
+}, "resolveEscrowEnrollmentAction");
+var violatesCarryContactRule = /* @__PURE__ */ __name((action, target) => action === "carry" && !!target && (!!target.recoveryEmail || !!target.recoveryLanguage), "violatesCarryContactRule");
+var createEscrowEnrollmentIntent = /* @__PURE__ */ __name(async (input) => {
+  const current = state(input.state);
+  const target = input.target === null ? null : envelope(input.target);
+  const disabling = input.pinAction === "disable";
+  requireEvidence(
+    current.enrollmentVersion < Number.MAX_SAFE_INTEGER && (disabling || current.enrollmentEpoch < Number.MAX_SAFE_INTEGER)
+  );
+  if (disabling && current.status !== "active") return fail2();
+  if (current.status === "disabled" && current.hasPin && input.pinAction === "automatic")
+    return fail2();
+  const { action, pinAction, bindsRecoveryContact } = resolveEscrowEnrollmentAction(
+    current,
+    input.pinAction
+  );
+  requireEvidence(!disabling || input.target === null);
+  requireEvidence(disabling || input.target !== null);
+  if (action === "carry") requireEvidence(input.shareVersion > (current.shareVersion ?? 0));
+  const intent = {
+    version: 2,
+    tenant: current.tenant,
+    did: current.did,
+    authorityGeneration: current.authorityGeneration,
+    expectedEnrollmentVersion: current.enrollmentVersion,
+    action,
+    sourceBlobIdentity: current.envelope ? await getEscrowBlobIdentity(current.envelope) : null,
+    targetBlobIdentity: target ? await getEscrowBlobIdentity(target) : null,
+    pinAction,
+    shareVersion: disabling ? current.shareVersion : input.shareVersion,
+    enrollmentEpoch: current.enrollmentEpoch + (disabling ? 0 : 1),
+    requestId: crypto.randomUUID(),
+    allowRewrap: !disabling,
+    recoveryEmail: bindsRecoveryContact ? input.recoveryEmail : null,
+    recoveryLanguage: bindsRecoveryContact ? input.recoveryLanguage : null
+  };
+  return signEscrowEnrollmentIntent(intent, input.privateKey);
+}, "createEscrowEnrollmentIntent");
+
 // src/types.ts
 var import_types = __toESM(require_dist());
 var EscrowPinUnavailableError = class extends Error {
@@ -21071,9 +21749,10 @@ var SERVER_REQUEST_TIMEOUT_MS = 3e4;
 var requestTimeoutSignal = /* @__PURE__ */ __name((ms = SERVER_REQUEST_TIMEOUT_MS) => typeof AbortSignal !== "undefined" && typeof AbortSignal.timeout === "function" ? AbortSignal.timeout(ms) : void 0, "requestTimeoutSignal");
 var describeHttpStatus = /* @__PURE__ */ __name((response) => response.statusText ? `${response.status} ${response.statusText}` : `${response.status}`, "describeHttpStatus");
 var EscrowRequestError = class extends Error {
-  constructor(status) {
+  constructor(status, reason) {
     super("Escrow request failed");
     this.status = status;
+    this.reason = reason;
     this.name = "EscrowRequestError";
   }
   static {
@@ -21519,6 +22198,10 @@ function createSSSStrategy(config) {
   const localWrites = /* @__PURE__ */ new Set();
   const guardedStorage = /* @__PURE__ */ __name(() => {
     const generation = storageGeneration;
+    const assertCurrent = /* @__PURE__ */ __name(() => {
+      if (generation !== storageGeneration)
+        throw new Error("This recovery request was cancelled.");
+    }, "assertCurrent");
     const write = /* @__PURE__ */ __name((operation) => {
       if (generation !== storageGeneration) {
         return Promise.reject(new Error("This recovery request was cancelled."));
@@ -21529,6 +22212,7 @@ function createSSSStrategy(config) {
     }, "write");
     const guarded = {
       ...storage,
+      assertCurrent,
       storeDeviceShare: /* @__PURE__ */ __name((share, id) => write(() => storage.storeDeviceShare(share, id)), "storeDeviceShare"),
       storeShareVersion: /* @__PURE__ */ __name((version, id) => write(() => storage.storeShareVersion(version, id)), "storeShareVersion"),
       clearAllShares: /* @__PURE__ */ __name((id) => write(() => storage.clearAllShares(id)), "clearAllShares"),
@@ -21546,6 +22230,7 @@ function createSSSStrategy(config) {
   let lastServerSnapshot = null;
   let escrowEnrollmentInFlight;
   let staleEscrowReenrollAttempted = false;
+  let verifiedEscrowEnvelope;
   let unenrolledRotation;
   const escrowRequest = /* @__PURE__ */ __name(async (path, init, pinAttempt = false) => {
     const response = await fetch(`${serverUrl}/keys/escrow${path}`, {
@@ -21553,6 +22238,14 @@ function createSSSStrategy(config) {
       ...init
     });
     if (!response.ok) {
+      if (path === "/confirm" && response.status === 403) {
+        const body = await response.json().catch(() => void 0);
+        const reason = body && typeof body === "object" && "message" in body && typeof body.message === "string" ? body.message : void 0;
+        throw new EscrowRequestError(
+          response.status,
+          reason === "codeMismatch" || reason === "codeExpired" || reason === "codeLocked" ? reason : void 0
+        );
+      }
       if (!pinAttempt && path === "/recover" && response.status === 429) {
         const body = await response.json().catch(() => void 0);
         const message = body && typeof body === "object" && "message" in body && typeof body.message === "string" ? body.message : "";
@@ -21604,16 +22297,89 @@ function createSSSStrategy(config) {
     );
     return verifyEnclaveAttestation(attestation, config.escrow.attestation, nonce);
   }, "fetchVerifiedEnclaveKey");
-  const enrollEscrow = /* @__PURE__ */ __name(async (token, providerType, privateKey, primaryDid, shares, shareVersion, signDidAuthVp, verifiedKey, pinMaterial, clearPin = false) => {
+  const fetchEscrowHoldStatus = /* @__PURE__ */ __name(async (params) => {
+    const query = new URLSearchParams(
+      "holdId" in params ? { holdId: params.holdId } : { providerType: params.providerType }
+    );
+    const secret = "holdId" in params ? params.resumeToken : params.token;
+    const result = await escrowRequest(`/status?${query}`, {
+      method: "GET",
+      headers: {
+        ...buildHeaders("", void 0, tenantId),
+        "X-Auth-Token": secret
+      }
+    });
+    return result.hold;
+  }, "fetchEscrowHoldStatus");
+  const recoveryExpectations = /* @__PURE__ */ __name((holdId, expected) => {
+    if (!expected || expected.holdId !== holdId || expected.tenant !== (tenantId ?? "learncard") || !expected.did || !expected.clientEphemeralPublicKey || !expected.blobHash || !expected.authorityGeneration || !expected.holdDigest || !expected.ledgerPublicKey || !expected.keyId)
+      throw new EscrowEvidenceError();
+    return { ...expected };
+  }, "recoveryExpectations");
+  const verifyPendingHold = /* @__PURE__ */ __name(async (status, expected, identity) => {
+    if (!config.escrow || identity.mode !== "nitro" || !identity.authority || identity.authority.ledgerPublicKey !== expected.ledgerPublicKey || ![identity.keyId, ...identity.previousKeyIds].includes(expected.keyId) || status.holdId !== expected.holdId || !status.holdRecord)
+      throw new EscrowEvidenceError();
+    const record = status.holdRecord;
+    const verified = await verifyEscrowHoldRecord(record, expected, identity, {
+      historical: true,
+      allowedMeasurements: await escrowAuthorityMeasurements(config.escrow.attestation),
+      authorityGeneration: expected.authorityGeneration
+    });
+    if (verified.holdDigest !== expected.holdDigest || verified.receipt.keyId !== expected.keyId)
+      throw new EscrowEvidenceError();
+    return record;
+  }, "verifyPendingHold");
+  const fetchAuthorityState = /* @__PURE__ */ __name(async (token, providerType, privateKey, did, signer, identity, assertCurrent) => {
+    assertCurrent();
+    if (identity.mode !== "nitro" || !identity.authority)
+      throw new Error("The enclave does not support verified enrollment.");
+    const nonce = Array.from(
+      crypto.getRandomValues(new Uint8Array(32)),
+      (byte) => byte.toString(16).padStart(2, "0")
+    ).join("");
+    const vp = await requestFreshDidAuthVp(serverUrl, privateKey, did, signer, tenantId);
+    assertCurrent();
+    const response = await escrowRequest("/authority-state", {
+      method: "POST",
+      headers: buildHeaders(token, vp, tenantId),
+      body: JSON.stringify({ authToken: token, providerType, nonce })
+    });
+    const result = await verifyEscrowAuthorityState(
+      response,
+      nonce,
+      tenantId ?? "learncard",
+      did,
+      identity
+    );
+    assertCurrent();
+    return result;
+  }, "fetchAuthorityState");
+  const enrollEscrow = /* @__PURE__ */ __name(async (token, providerType, privateKey, primaryDid, shares, shareVersion, signDidAuthVp, verifiedKey, pinMaterial, clearPin = false, assertCurrent = guardedStorage().assertCurrent, recoveryEmail = "", recoveryLanguage = "") => {
     if (!config.escrow?.enabled) throw new Error("Escrow enrollment is disabled");
     if (!signDidAuthVp) throw new Error("DID proof signing is required for escrow enrollment");
-    const { publicKey, keyId } = verifiedKey ?? await fetchVerifiedEnclaveKey();
-    const envelope = await encryptEscrowBlob(
+    const identity = verifiedKey ?? await fetchVerifiedEnclaveKey();
+    assertCurrent();
+    const { publicKey, keyId } = identity;
+    const authority = config.escrow.attestation.mode === "nitro" ? await fetchAuthorityState(
+      token,
+      providerType,
+      privateKey,
+      primaryDid,
+      signDidAuthVp,
+      identity,
+      assertCurrent
+    ) : void 0;
+    const bindsRecoveryContact = !authority || resolveEscrowEnrollmentAction(
+      authority,
+      pinMaterial ? "set" : clearPin ? "clear" : "automatic"
+    ).bindsRecoveryContact;
+    const envelope2 = await encryptEscrowBlob(
       {
         recoveryShare: shares.recoveryShare,
         did: primaryDid,
         shareVersion,
-        ...pinMaterial ? { pinVerifier: pinMaterial.pinVerifier } : {}
+        ...pinMaterial ? { pinVerifier: pinMaterial.pinVerifier } : {},
+        ...authority && recoveryEmail && bindsRecoveryContact ? { recoveryEmail, recoveryLanguage } : {}
       },
       publicKey,
       keyId
@@ -21625,19 +22391,40 @@ function createSSSStrategy(config) {
       signDidAuthVp,
       tenantId
     );
-    await escrowRequest("", {
+    const signedIntent = authority ? await createEscrowEnrollmentIntent({
+      state: authority,
+      target: envelope2,
+      shareVersion,
+      privateKey,
+      pinAction: pinMaterial ? "set" : clearPin ? "clear" : "automatic",
+      recoveryEmail,
+      recoveryLanguage
+    }) : void 0;
+    assertCurrent();
+    verifiedEscrowEnvelope = void 0;
+    const response = await escrowRequest("", {
       method: "POST",
       headers: buildHeaders(token, vp, tenantId),
       body: JSON.stringify({
         authToken: token,
         providerType,
-        envelope,
+        envelope: envelope2,
         shareVersion,
         enclaveKeyId: keyId,
         ...pinMaterial ? { pinSalt: pinMaterial.pinSalt } : {},
-        ...clearPin ? { clearPin: true } : {}
+        ...(signedIntent ? signedIntent.intent.pinAction === "clear" : clearPin) ? { clearPin: true } : {},
+        ...signedIntent ? { signedIntent, sourceEnvelope: authority?.envelope ?? null } : {}
       })
     });
+    if (signedIntent) {
+      const committed = await verifyEscrowEnrollmentCommit(
+        response,
+        signedIntent.intent,
+        identity
+      );
+      assertCurrent();
+      verifiedEscrowEnvelope = committed.envelope ?? void 0;
+    }
   }, "enrollEscrow");
   const tryEnrollEscrow = /* @__PURE__ */ __name(async (...args) => {
     if (!config.escrow?.enabled) return;
@@ -21652,9 +22439,12 @@ function createSSSStrategy(config) {
       }
     }
   }, "tryEnrollEscrow");
-  const ensureEscrowEnrollmentUnguarded = /* @__PURE__ */ __name(async (self, params, storage2, forceRotate = false) => {
+  const ensureEscrowEnrollmentUnguarded = /* @__PURE__ */ __name(async (self, params, storage2, forceRotate = false, allowDisabledEnrollment = false) => {
+    let clearPinForEnrollment = forceRotate;
     if (!config.escrow?.enabled) return { enrolled: false, reason: "disabled" };
     const pin = params.options?.pin;
+    const recoveryEmail = params.options?.recoveryEmail ?? "";
+    const recoveryLanguage = params.options?.recoveryLanguage ?? "";
     if (pin !== void 0) {
       const validation = validatePin(pin);
       if (!validation.ok)
@@ -21663,12 +22453,35 @@ function createSSSStrategy(config) {
         );
     }
     const status = await self.fetchServerKeyStatus(params.token, params.providerType);
+    storage2.assertCurrent();
     if (status.escrowOptedOut) return { enrolled: false, reason: "opted-out" };
-    const currentlyEnrolled = status.shareVersion !== null && status.recoveryMethods.some(
+    let currentlyEnrolled = status.shareVersion !== null && status.recoveryMethods.some(
       (method) => method.type === "escrow" && method.shareVersion === status.shareVersion && (Boolean(method.confirmedAt) || "confirmationStatus" in method && method.confirmationStatus === "confirmed")
     );
-    const repairingStaleBlob = pin === void 0 && !forceRotate && currentlyEnrolled && !!status.escrowStale && !staleEscrowReenrollAttempted;
-    if (!forceRotate && pin === void 0 && currentlyEnrolled && !repairingStaleBlob)
+    let verifiedKey;
+    if (config.escrow.attestation.mode === "nitro") {
+      if (!status.primaryDid || !params.signDidAuthVp)
+        throw new Error("Owner proof signing is required for escrow enrollment.");
+      verifiedKey = await fetchVerifiedEnclaveKey();
+      const current = await fetchAuthorityState(
+        params.token,
+        params.providerType,
+        params.privateKey,
+        status.primaryDid,
+        params.signDidAuthVp,
+        verifiedKey,
+        storage2.assertCurrent
+      );
+      if (current.status === "disabled") {
+        verifiedEscrowEnvelope = void 0;
+        if (!allowDisabledEnrollment) return { enrolled: false, reason: "opted-out" };
+        clearPinForEnrollment ||= current.hasPin && pin === void 0;
+      }
+      currentlyEnrolled = currentlyEnrolled && current.status === "active" && current.shareVersion === status.shareVersion && current.envelope?.keyId === verifiedKey.keyId;
+      if (currentlyEnrolled) verifiedEscrowEnvelope = current.envelope ?? void 0;
+    }
+    const repairingStaleBlob = pin === void 0 && !clearPinForEnrollment && currentlyEnrolled && !!status.escrowStale && !staleEscrowReenrollAttempted;
+    if (!clearPinForEnrollment && pin === void 0 && currentlyEnrolled && !repairingStaleBlob)
       return { enrolled: true, changed: false };
     if (repairingStaleBlob) staleEscrowReenrollAttempted = true;
     if (!status.primaryDid) throw new Error("Cannot enroll escrow without a primary DID");
@@ -21676,7 +22489,7 @@ function createSSSStrategy(config) {
       throw new Error("DID proof signing is required for escrow enrollment");
     }
     try {
-      if (!forceRotate && pin === void 0 && unenrolledRotation && unenrolledRotation.shareVersion === status.shareVersion && unenrolledRotation.primaryDid === status.primaryDid) {
+      if (!clearPinForEnrollment && pin === void 0 && unenrolledRotation && unenrolledRotation.shareVersion === status.shareVersion && unenrolledRotation.primaryDid === status.primaryDid) {
         const retry = unenrolledRotation;
         await enrollEscrow(
           params.token,
@@ -21688,12 +22501,16 @@ function createSSSStrategy(config) {
           params.signDidAuthVp,
           void 0,
           void 0,
-          retry.clearPin
+          retry.clearPin,
+          storage2.assertCurrent,
+          recoveryEmail,
+          recoveryLanguage
         );
         unenrolledRotation = void 0;
         return { enrolled: true, changed: true, shareVersion: retry.shareVersion };
       }
-      const verifiedKey = await fetchVerifiedEnclaveKey();
+      verifiedKey ??= await fetchVerifiedEnclaveKey();
+      storage2.assertCurrent();
       const pinSalt = pin !== void 0 ? generatePinSalt() : void 0;
       const pinMaterial = pin !== void 0 && pinSalt !== void 0 ? { pinSalt, pinVerifier: await derivePinProof(pin, pinSalt) } : void 0;
       const storageId = activeStorageId;
@@ -21722,7 +22539,12 @@ function createSSSStrategy(config) {
         authShare: shares.authShare,
         primaryDid: status.primaryDid
       };
-      unenrolledRotation = pinMaterial ? void 0 : { shares, shareVersion, primaryDid: status.primaryDid, clearPin: forceRotate };
+      unenrolledRotation = pinMaterial ? void 0 : {
+        shares,
+        shareVersion,
+        primaryDid: status.primaryDid,
+        clearPin: clearPinForEnrollment
+      };
       await enrollEscrow(
         params.token,
         params.providerType,
@@ -21733,12 +22555,15 @@ function createSSSStrategy(config) {
         params.signDidAuthVp,
         verifiedKey,
         pinMaterial,
-        forceRotate
+        clearPinForEnrollment,
+        storage2.assertCurrent,
+        recoveryEmail,
+        recoveryLanguage
       );
       unenrolledRotation = void 0;
       return { enrolled: true, changed: true, shareVersion };
     } catch (err) {
-      if (!repairingStaleBlob) throw err;
+      if (!repairingStaleBlob || config.escrow.attestation.mode === "nitro") throw err;
       try {
         if (config.onEscrowError) config.onEscrowError(err);
         else console.warn("SSS: escrow enrollment failed");
@@ -21779,6 +22604,7 @@ function createSSSStrategy(config) {
     },
     // --- User scoping ---
     setActiveUser(userId) {
+      verifiedEscrowEnvelope = void 0;
       if (activeStorageId !== `sss-device-share:${userId}`) storageGeneration++;
       activeStorageId = `sss-device-share:${userId}`;
       lastServerSnapshot = null;
@@ -21823,6 +22649,7 @@ function createSSSStrategy(config) {
         );
       }
       storageGeneration++;
+      verifiedEscrowEnvelope = void 0;
       await Promise.allSettled(localWrites);
       await clearPendingShareCandidates(storage, storageId);
       return storage.clearAllShares(storageId);
@@ -22121,8 +22948,58 @@ function createSSSStrategy(config) {
       return { state: enrolled ? "enrolled" : "not-enrolled", escrowPin: status.escrowPin };
     },
     async disableEscrowRecovery(params) {
+      const assertCurrent = guardedStorage().assertCurrent;
       const status = await this.fetchServerKeyStatus(params.token, params.providerType);
       if (!status.primaryDid) throw new Error("Cannot disable escrow without a primary DID");
+      if (config.escrow?.attestation.mode === "nitro") {
+        const identity = await fetchVerifiedEnclaveKey();
+        const current = await fetchAuthorityState(
+          params.token,
+          params.providerType,
+          params.privateKey,
+          status.primaryDid,
+          params.signDidAuthVp,
+          identity,
+          assertCurrent
+        );
+        if (current.status === "disabled") {
+          verifiedEscrowEnvelope = void 0;
+          return;
+        }
+        const signedIntent = await createEscrowEnrollmentIntent({
+          state: current,
+          target: null,
+          shareVersion: current.shareVersion ?? 0,
+          privateKey: params.privateKey,
+          pinAction: "disable",
+          // Disable always nulls these server-side regardless of input.
+          recoveryEmail: "",
+          recoveryLanguage: ""
+        });
+        const vp2 = await requestFreshDidAuthVp(
+          serverUrl,
+          params.privateKey,
+          status.primaryDid,
+          params.signDidAuthVp,
+          tenantId
+        );
+        assertCurrent();
+        const response = await escrowRequest("/disable", {
+          method: "POST",
+          headers: buildHeaders(params.token, vp2, tenantId),
+          body: JSON.stringify({
+            authToken: params.token,
+            providerType: params.providerType,
+            optOut: true,
+            signedIntent,
+            sourceEnvelope: current.envelope
+          })
+        });
+        await verifyEscrowEnrollmentCommit(response, signedIntent.intent, identity);
+        assertCurrent();
+        verifiedEscrowEnvelope = void 0;
+        return;
+      }
       const vp = await requestFreshDidAuthVp(
         serverUrl,
         params.privateKey,
@@ -22163,13 +23040,29 @@ function createSSSStrategy(config) {
             providerType: params.providerType
           })
         });
-        return ensureEscrowEnrollmentUnguarded(this, params, storage2);
+        return ensureEscrowEnrollmentUnguarded(this, params, storage2, false, true);
       });
     },
     async setEscrowPin({ pin, ...params }) {
       const storage2 = guardedStorage();
       const result = await withRotationLock(
-        () => ensureEscrowEnrollmentUnguarded(this, { ...params, options: { pin } }, storage2)
+        () => (
+          // P9.1: preserve the caller's recoveryEmail/recoveryLanguage — do
+          // not replace `params.options` wholesale, or nitro enroll/replace
+          // loses its required recovery contact.
+          ensureEscrowEnrollmentUnguarded(
+            this,
+            {
+              ...params,
+              options: {
+                pin,
+                recoveryEmail: params.options?.recoveryEmail,
+                recoveryLanguage: params.options?.recoveryLanguage
+              }
+            },
+            storage2
+          )
+        )
       );
       if (!result.enrolled || !result.changed) {
         throw new Error("Automatic recovery is not available for this account.");
@@ -22201,8 +23094,15 @@ function createSSSStrategy(config) {
         escrowEnrollmentInFlight = void 0;
       }
     },
+    getVerifiedEscrowEnvelope() {
+      return verifiedEscrowEnvelope ? { ...verifiedEscrowEnvelope } : null;
+    },
     /** Start or explicitly restart a hold with fresh client-bound resume secrets. */
     async startEscrowRecovery(params) {
+      const expectedDid = params.expectedDid;
+      const nitro = config.escrow?.attestation.mode === "nitro";
+      if (nitro && (!expectedDid || (params.tenantId ?? tenantId) !== tenantId))
+        throw new EscrowEvidenceError();
       const sessionProof = params.recoverySessionToken !== void 0;
       if (sessionProof ? params.token !== void 0 || params.providerType !== void 0 : !params.token || !params.providerType) {
         throw new Error("Provide exactly one identity proof");
@@ -22222,25 +23122,102 @@ function createSSSStrategy(config) {
         },
         params.options?.releasePolicy === "pin"
       );
-      return { ...result, clientEphemeralPrivateKey: pair.privateKey };
+      let expectations;
+      if (nitro && result.resumeToken !== null) {
+        const identity = await fetchVerifiedEnclaveKey();
+        if (identity.mode !== "nitro" || !identity.authority || !result.holdRecord || !expectedDid)
+          throw new EscrowEvidenceError();
+        const verified = await verifyEscrowHoldRecord(
+          result.holdRecord,
+          {
+            tenant: tenantId ?? "learncard",
+            did: expectedDid,
+            holdId: result.holdId,
+            clientEphemeralPublicKey: pair.publicKey,
+            blobHash: result.holdRecord.hold.blobHash
+          },
+          identity
+        );
+        expectations = {
+          tenant: tenantId ?? "learncard",
+          did: expectedDid,
+          holdId: result.holdId,
+          clientEphemeralPublicKey: pair.publicKey,
+          blobHash: result.holdRecord.hold.blobHash,
+          authorityGeneration: verified.authorityGeneration,
+          holdDigest: verified.holdDigest,
+          ledgerPublicKey: identity.authority.ledgerPublicKey,
+          keyId: verified.receipt.keyId
+        };
+        result.codeSent = result.delivery ? await verifyEscrowCodeDelivery(result.delivery, expectations, identity) : void 0;
+      }
+      return { ...result, clientEphemeralPrivateKey: pair.privateKey, expectations };
     },
     /** Read hold status; secrets (auth or resume token) never travel in a URL. */
     async getEscrowRecoveryStatus(params) {
-      const query = new URLSearchParams(
-        "holdId" in params ? { holdId: params.holdId } : { providerType: params.providerType }
-      );
-      const secret = "holdId" in params ? params.resumeToken : params.token;
-      const result = await escrowRequest(
-        `/status?${query}`,
-        {
-          method: "GET",
-          headers: {
-            ...buildHeaders("", void 0, tenantId),
-            "X-Auth-Token": secret
-          }
+      const expected = config.escrow?.attestation.mode === "nitro" && "holdId" in params ? recoveryExpectations(params.holdId, params.expectations) : void 0;
+      const status = await fetchEscrowHoldStatus(params);
+      if (expected && status)
+        await verifyPendingHold(status, expected, await fetchVerifiedEnclaveKey());
+      return status;
+    },
+    /** Submit the confirmation code emailed by the enclave for an authority-mode hold. */
+    async confirmEscrowRecovery(params) {
+      let pending;
+      if (config.escrow?.attestation.mode === "nitro") {
+        const expected = recoveryExpectations(params.holdId, params.expectations);
+        if ((params.tenantId ?? tenantId) !== tenantId) throw new EscrowEvidenceError();
+        const identity = await fetchVerifiedEnclaveKey();
+        const status = await fetchEscrowHoldStatus({
+          holdId: params.holdId,
+          resumeToken: params.resumeToken
+        });
+        if (!status?.holdRecord) {
+          throw new EscrowEvidenceError();
         }
-      );
-      return result.hold;
+        const holdRecord = await verifyPendingHold(status, expected, identity);
+        pending = { identity, holdRecord, expected };
+      }
+      const confirm = /* @__PURE__ */ __name(() => escrowRequest("/confirm", {
+        method: "POST",
+        headers: buildHeaders("", void 0, params.tenantId ?? tenantId),
+        body: JSON.stringify({
+          holdId: params.holdId,
+          resumeToken: params.resumeToken,
+          code: params.code
+        })
+      }), "confirm");
+      const result = await confirm();
+      if (pending) {
+        if (!result.receipt) {
+          throw new EscrowEvidenceError();
+        }
+        const receipt = await verifyEscrowHoldConfirmation(
+          result.receipt,
+          pending.holdRecord,
+          pending.expected,
+          pending.identity
+        );
+        if (receipt.kind === "commit") {
+          const readback = await confirm();
+          const snapshot = await verifyEscrowHoldConfirmation(
+            readback.receipt,
+            pending.holdRecord,
+            pending.expected,
+            pending.identity
+          );
+          if (snapshot.kind !== "snapshot") throw new EscrowEvidenceError();
+        }
+      }
+      return { success: true };
+    },
+    /** Request a fresh confirmation code for a hold awaiting confirmation. */
+    async resendEscrowRecoveryCode(params) {
+      return escrowRequest("/resend", {
+        method: "POST",
+        headers: buildHeaders("", void 0, params.tenantId ?? tenantId),
+        body: JSON.stringify({ holdId: params.holdId, resumeToken: params.resumeToken })
+      });
     },
     /** Cancel a pending hold with a fresh DID-owner proof. */
     async cancelEscrowRecovery(params) {
@@ -22272,8 +23249,19 @@ function createSSSStrategy(config) {
         const start = input.method === "escrow-pin" ? await this.startEscrowRecovery({
           token,
           providerType,
+          expectedDid: input.expectedDid,
           options: { releasePolicy: "pin" }
         }) : input;
+        const expected = config.escrow?.attestation.mode === "nitro" ? recoveryExpectations(start.holdId, start.expectations) : void 0;
+        if (expected) {
+          if (!start.resumeToken) throw new EscrowEvidenceError();
+          const status = await fetchEscrowHoldStatus({
+            holdId: start.holdId,
+            resumeToken: start.resumeToken
+          });
+          if (!status) throw new EscrowEvidenceError();
+          await verifyPendingHold(status, expected, await fetchVerifiedEnclaveKey());
+        }
         let pinProof;
         if (input.method === "escrow-pin") {
           if (!("pinSalt" in start) || !start.pinSalt || !start.resumeToken)
@@ -22297,6 +23285,8 @@ function createSSSStrategy(config) {
           material.sealedShare,
           start.clientEphemeralPrivateKey
         );
+        if (expected && (plaintext.did !== expected.did || plaintext.holdId !== expected.holdId))
+          throw new EscrowEvidenceError();
         if (plaintext.holdId !== start.holdId || plaintext.did !== material.primaryDid || plaintext.shareVersion !== material.shareVersion) {
           throw new Error("Escrow recovery material does not match the request");
         }
@@ -22710,10 +23700,10 @@ function createSSSStrategy(config) {
         const pending = pendingPhraseConfirmation;
         if (!pending) throw new Error("Generate a new recovery phrase to continue");
         const phraseWords = pending.phrase.trim().toLowerCase().split(/\s+/);
-        const matches = input.challengeWords.length === pending.challengeWordIndices.length && pending.challengeWordIndices.every(
+        const matches2 = input.challengeWords.length === pending.challengeWordIndices.length && pending.challengeWordIndices.every(
           (wordIndex, answerIndex) => input.challengeWords[answerIndex]?.trim().toLowerCase() === phraseWords[wordIndex]
         );
-        if (!matches) {
+        if (!matches2) {
           throw new Error("Those words do not match. Check your phrase and try again.");
         }
       } else if (input.method === "backup") {
@@ -23099,6 +24089,7 @@ function createSSSStrategy(config) {
     },
     async cleanup() {
       storageGeneration++;
+      verifiedEscrowEnvelope = void 0;
       await Promise.allSettled(localWrites);
     }
   };
@@ -23329,9 +24320,11 @@ export {
   ESCROW_ALGORITHM,
   ESCROW_BLOB_INFO,
   ESCROW_CLIENT_KEY_ID,
+  ESCROW_ENROLLMENT_INTENT_DOMAIN,
   ESCROW_ENVELOPE_VERSION,
   ESCROW_PIN_MAX_ATTEMPTS,
   ESCROW_RELEASE_INFO,
+  EscrowEvidenceError,
   EscrowHoldRestartThrottledError,
   EscrowPinLockedError,
   EscrowPinMismatchError,
@@ -23359,6 +24352,7 @@ export {
   constantTimeEqualHex,
   countWords,
   createAdaptiveStorage,
+  createEscrowEnrollmentIntent,
   createPasskeyCredential,
   createQrLoginSession,
   createSSSKeyManager,
@@ -23372,6 +24366,7 @@ export {
   deriveKeyFromPasskey,
   deriveKeyFromPassword,
   derivePinProof,
+  encodeEscrowEnrollmentIntent,
   encryptEmailRelayPayload,
   encryptEscrowBlob,
   encryptShareForTransfer,
@@ -23384,6 +24379,7 @@ export {
   generatePinSalt,
   generateRecoveryPhrase,
   getDeviceShare,
+  getEscrowBlobIdentity,
   getQrLoginSessionInfo,
   getShareVersion,
   hasDeviceShare,
@@ -23405,9 +24401,11 @@ export {
   reconstructFromShares,
   reconstructPrivateKey,
   recoveryPhraseToShare,
+  resolveEscrowEnrollmentAction,
   sealEscrowRelease,
   setPublicComputerMode,
   shareToRecoveryPhrase,
+  signEscrowEnrollmentIntent,
   splitAndVerify,
   splitPrivateKey,
   storeDeviceShare,
@@ -23415,6 +24413,11 @@ export {
   validatePin,
   validateRecoveryPhrase,
   verifyEnclaveAttestation,
+  verifyEscrowAuthorityState,
+  verifyEscrowCodeDelivery,
+  verifyEscrowEnrollmentCommit,
+  verifyEscrowHoldState,
   verifyNitroAttestationDocument,
-  verifyStoredShares
+  verifyStoredShares,
+  violatesCarryContactRule
 };