@learncard/sss-key-manager 0.2.2 → 0.2.3

package/dist/escrow-authority.d.ts

@@ -3,6 +3,32 @@ import type { EscrowAttestationPolicy } from './types';
 import type { EscrowBlobPlaintext, EscrowEnvelope } from './escrow-crypto';
 import type { EscrowEnrollmentIntent, SignedEscrowEnrollmentIntent } from './escrow-enrollment-intent.types';
 import type { EscrowAuthorityRecord, EscrowAuthorityState, VerifiedEnclaveIdentity, VerifiedEscrowMutation } from './escrow-authority.types';
+/** Verify a fresh hold-state response using an independently retained hold binding
+ * and a newly generated 32-byte nonce. Never reuse the nonce for another read. */
+export declare const verifyEscrowHoldState: (response: {
+    proof: unknown;
+}, nonce: string, expected: {
+    tenant: string;
+    authorityGeneration: string;
+    did: string;
+    holdId: string;
+    holdDigest: string;
+}, identity: VerifiedEnclaveIdentity) => Promise<{
+    status: "awaitingConfirmation" | "pending" | "released" | "cancelled";
+    confirmedHiMs: number | null;
+    releaseWarningSentHiMs: number | null;
+    attemptsRemaining: number;
+    codeSendStatus: "unknown" | "notRequired";
+}>;
+/** Authenticate advisory send acceptance without changing the immutable hold commitment. */
+export declare const verifyEscrowCodeDelivery: (delivery: {
+    codeSent: boolean;
+    proof: unknown;
+}, expected: {
+    tenant: string;
+    authorityGeneration: string;
+    holdDigest: string;
+}, identity: VerifiedEnclaveIdentity) => Promise<boolean>;
 /** Derive historical receipt pins from the same complete PCR tuples used for
  * Nitro attestation. Legacy image-only pins and malformed tuples authorize nothing. */
 export declare const escrowAuthorityMeasurements: (policy: EscrowAttestationPolicy) => Promise<string[]>;

package/dist/escrow-authority.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"escrow-authority.d.ts","sourceRoot":"","sources":["../src/escrow-authority.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAC;AAMvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAC3E,OAAO,KAAK,EACR,sBAAsB,EACtB,4BAA4B,EAC/B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EACR,qBAAqB,EACrB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACzB,MAAM,0BAA0B,CAAC;AAwElC;uFACuF;AACvF,eAAO,MAAM,2BAA2B,GACpC,QAAQ,uBAAuB,KAChC,OAAO,CAAC,MAAM,EAAE,CAclB,CAAC;AA2IF,mFAAmF;AACnF,eAAO,MAAM,0BAA0B,GACnC,UAAU,OAAO,EACjB,OAAO,MAAM,EACb,QAAQ,MAAM,EACd,KAAK,MAAM,EACX,UAAU,uBAAuB,KAClC,OAAO,CAAC,oBAAoB,CAgB9B,CAAC;AAEF,sFAAsF;AACtF,eAAO,MAAM,4BAA4B,GACrC,UAAU,OAAO,EACjB,QAAQ,sBAAsB,EAC9B,UAAU,uBAAuB,KAClC,OAAO,CAAC,sBAAsB,CA0ChC,CAAC;AAEF;;8DAE8D;AAC9D,MAAM,WAAW,oBAAoB;IACjC,IAAI,EAAE;QACF,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAC;QACjB,eAAe,EAAE,MAAM,CAAC;QACxB,aAAa,EAAE,MAAM,GAAG,KAAK,CAAC;QAC9B,wBAAwB,EAAE,MAAM,CAAC;QACjC,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,EAAE,MAAM,CAAC;QACtB,SAAS,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IAC/B,OAAO,EAAE,qBAAqB,CAAC;IAC/B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;CACtB;AAiCD;;;;;;;;;;iFAUiF;AACjF,eAAO,MAAM,sBAAsB,GAC/B,QAAQ,oBAAoB,EAC5B,UAAU;IACN,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,wBAAwB,EAAE,MAAM,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAClB,EACD,UAAU,uBAAuB,EACjC,aAAa,wBAAwB,KACtC,OAAO,CAAC,kBAAkB,CA+B5B,CAAC;AAEF;;;;;;;;;;;6DAW6D;AAC7D,eAAO,MAAM,4BAA4B,GACrC,SAAS,OAAO,EAChB,QAAQ,oBAAoB,EAC5B,UAAU;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAA;CAAE,EACtE,UAAU,uBAAuB,KAClC,OAAO,CAAC,qBAAqB,CAoC/B,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG,WAAW,GAAG,KAAK,GAAG,OAAO,GAAG,SAAS,CAAC;AAEpF;;;;;;;;;yEASyE;AACzE,eAAO,MAAM,6BAA6B,GACtC,SAAS,IAAI,CAAC,oBAAoB,EAAE,QAAQ,GAAG,QAAQ,CAAC,EACxD,OAAO,2BAA2B,KACnC;IACC,MAAM,EAAE,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IACzC,SAAS,EAAE,sBAAsB,CAAC,WAAW,CAAC,CAAC;IAC/C,oBAAoB,EAAE,OAAO,CAAC;CAsBjC,CAAC;AAEF;;;;;;;gEAOgE;AAChE,eAAO,MAAM,wBAAwB,GACjC,QAAQ,sBAAsB,CAAC,QAAQ,CAAC,EACxC,QAAQ,IAAI,CAAC,mBAAmB,EAAE,eAAe,GAAG,kBAAkB,CAAC,GAAG,IAAI,KAC/E,OACwF,CAAC;AAE5F;;;;6EAI6E;AAC7E,eAAO,MAAM,4BAA4B,GAAU,OAAO;IACtD,KAAK,EAAE,oBAAoB,CAAC;IAC5B,MAAM,EAAE,cAAc,GAAG,IAAI,CAAC;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,2BAA2B,CAAC;IACvC,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;CAC5B,KAAG,OAAO,CAAC,4BAA4B,CAoCvC,CAAC"}
+{"version":3,"file":"escrow-authority.d.ts","sourceRoot":"","sources":["../src/escrow-authority.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAC;AAMvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAC3E,OAAO,KAAK,EACR,sBAAsB,EACtB,4BAA4B,EAC/B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EACR,qBAAqB,EACrB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACzB,MAAM,0BAA0B,CAAC;AAMlC;kFACkF;AAClF,eAAO,MAAM,qBAAqB,GAC9B,UAAU;IAAE,KAAK,EAAE,OAAO,CAAA;CAAE,EAC5B,OAAO,MAAM,EACb,UAAU;IACN,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB,EAAE,MAAM,CAAC;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACtB,EACD,UAAU,uBAAuB,KAClC,OAAO,CAAC;IACP,MAAM,EAAE,sBAAsB,GAAG,SAAS,GAAG,UAAU,GAAG,WAAW,CAAC;IACtE,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,SAAS,GAAG,aAAa,CAAC;CAC7C,CAiCA,CAAC;AAEF,4FAA4F;AAC5F,eAAO,MAAM,wBAAwB,GACjC,UAAU;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,EAC/C,UAAU;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EAC7E,UAAU,uBAAuB,KAClC,OAAO,CAAC,OAAO,CAajB,CAAC;AAoEF;uFACuF;AACvF,eAAO,MAAM,2BAA2B,GACpC,QAAQ,uBAAuB,KAChC,OAAO,CAAC,MAAM,EAAE,CAclB,CAAC;AA2IF,mFAAmF;AACnF,eAAO,MAAM,0BAA0B,GACnC,UAAU,OAAO,EACjB,OAAO,MAAM,EACb,QAAQ,MAAM,EACd,KAAK,MAAM,EACX,UAAU,uBAAuB,KAClC,OAAO,CAAC,oBAAoB,CAgB9B,CAAC;AAEF,sFAAsF;AACtF,eAAO,MAAM,4BAA4B,GACrC,UAAU,OAAO,EACjB,QAAQ,sBAAsB,EAC9B,UAAU,uBAAuB,KAClC,OAAO,CAAC,sBAAsB,CA0ChC,CAAC;AAEF;;8DAE8D;AAC9D,MAAM,WAAW,oBAAoB;IACjC,IAAI,EAAE;QACF,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAC;QACjB,eAAe,EAAE,MAAM,CAAC;QACxB,aAAa,EAAE,MAAM,GAAG,KAAK,CAAC;QAC9B,wBAAwB,EAAE,MAAM,CAAC;QACjC,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,EAAE,MAAM,CAAC;QACtB,SAAS,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IAC/B,OAAO,EAAE,qBAAqB,CAAC;IAC/B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;CACtB;AAiCD;;;;;;;;;;iFAUiF;AACjF,eAAO,MAAM,sBAAsB,GAC/B,QAAQ,oBAAoB,EAC5B,UAAU;IACN,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,wBAAwB,EAAE,MAAM,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAClB,EACD,UAAU,uBAAuB,EACjC,aAAa,wBAAwB,KACtC,OAAO,CAAC,kBAAkB,CA+B5B,CAAC;AAEF;;;;;;;;;;;6DAW6D;AAC7D,eAAO,MAAM,4BAA4B,GACrC,SAAS,OAAO,EAChB,QAAQ,oBAAoB,EAC5B,UAAU;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAA;CAAE,EACtE,UAAU,uBAAuB,KAClC,OAAO,CAAC,qBAAqB,CAoC/B,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG,WAAW,GAAG,KAAK,GAAG,OAAO,GAAG,SAAS,CAAC;AAEpF;;;;;;;;;yEASyE;AACzE,eAAO,MAAM,6BAA6B,GACtC,SAAS,IAAI,CAAC,oBAAoB,EAAE,QAAQ,GAAG,QAAQ,CAAC,EACxD,OAAO,2BAA2B,KACnC;IACC,MAAM,EAAE,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IACzC,SAAS,EAAE,sBAAsB,CAAC,WAAW,CAAC,CAAC;IAC/C,oBAAoB,EAAE,OAAO,CAAC;CAsBjC,CAAC;AAEF;;;;;;;gEAOgE;AAChE,eAAO,MAAM,wBAAwB,GACjC,QAAQ,sBAAsB,CAAC,QAAQ,CAAC,EACxC,QAAQ,IAAI,CAAC,mBAAmB,EAAE,eAAe,GAAG,kBAAkB,CAAC,GAAG,IAAI,KAC/E,OACwF,CAAC;AAE5F;;;;6EAI6E;AAC7E,eAAO,MAAM,4BAA4B,GAAU,OAAO;IACtD,KAAK,EAAE,oBAAoB,CAAC;IAC5B,MAAM,EAAE,cAAc,GAAG,IAAI,CAAC;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,2BAA2B,CAAC;IACvC,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;CAC5B,KAAG,OAAO,CAAC,4BAA4B,CAoCvC,CAAC"}

package/dist/index.d.ts

@@ -19,7 +19,7 @@ export { verifyEnclaveAttestation } from './escrow-attestation';
 export { EscrowEvidenceError } from './escrow-authority.types';
 export type { HistoricalEscrowEvidence } from './escrow-authority.types';
 export type { EscrowRecoveryExpectations } from '@learncard/types';
-export { verifyEscrowAuthorityState, verifyEscrowEnrollmentCommit, createEscrowEnrollmentIntent, resolveEscrowEnrollmentAction, violatesCarryContactRule, } from './escrow-authority';
+export { verifyEscrowAuthorityState, verifyEscrowHoldState, verifyEscrowCodeDelivery, verifyEscrowEnrollmentCommit, createEscrowEnrollmentIntent, resolveEscrowEnrollmentAction, violatesCarryContactRule, } from './escrow-authority';
 export type { EscrowEnrollmentActionInput } from './escrow-authority';
 export type { VerifiedEnclaveIdentity, EscrowAuthorityRecord, EscrowAuthorityState, VerifiedEscrowMutation, } from './escrow-authority.types';
 export { verifyNitroAttestationDocument, NitroAttestationError } from './escrow-nitro-attestation';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,EACH,eAAe,EACf,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,aAAa,GAChB,MAAM,OAAO,CAAC;AAEf,OAAO,EACH,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,GACxB,MAAM,WAAW,CAAC;AAEnB,YAAY,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAElD,OAAO,EACH,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,yBAAyB,EACzB,UAAU,EACV,UAAU,EACV,cAAc,EACd,cAAc,EACd,kBAAkB,GACrB,MAAM,UAAU,CAAC;AAElB,OAAO,EACH,qBAAqB,EACrB,4BAA4B,EAC5B,wBAAwB,EACxB,wBAAwB,EACxB,kCAAkC,EAClC,uBAAuB,EACvB,wBAAwB,GAC3B,MAAM,sBAAsB,CAAC;AAE9B,YAAY,EACR,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,GACtB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACH,uBAAuB,EACvB,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,EACxB,2BAA2B,EAC3B,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,GACpB,MAAM,iBAAiB,CAAC;AAEzB,YAAY,EAAE,cAAc,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACnG,OAAO,EACH,4BAA4B,EAC5B,0BAA0B,EAC1B,qBAAqB,EACrB,+BAA+B,GAClC,MAAM,4BAA4B,CAAC;AACpC,YAAY,EACR,sBAAsB,EACtB,4BAA4B,GAC/B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,YAAY,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACzE,YAAY,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EACH,0BAA0B,EAC1B,4BAA4B,EAC5B,4BAA4B,EAC5B,6BAA6B,EAC7B,wBAAwB,GAC3B,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACtE,YAAY,EACR,uBAAuB,EACvB,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,GACzB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,8BAA8B,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnG,YAAY,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACzE,YAAY,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAC9F,YAAY,EACR,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,GAClB,MAAM,SAAS,CAAC;AACjB,OAAO,EACH,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,EACvB,+BAA+B,EAC/B,yBAAyB,GAC5B,MAAM,SAAS,CAAC;AACjB,OAAO,EACH,cAAc,EACd,cAAc,EACd,uBAAuB,EACvB,YAAY,EACZ,WAAW,EACX,eAAe,EACf,cAAc,EACd,oBAAoB,GACvB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACH,uBAAuB,EACvB,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,cAAc,GACjB,MAAM,WAAW,CAAC;AAEnB,YAAY,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAE1E,OAAO,EACH,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACtB,UAAU,EACV,mCAAmC,GACtC,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,OAAO,EACH,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,sBAAsB,EACtB,iBAAiB,EACjB,uBAAuB,GAC1B,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACR,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,GACpB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACH,iBAAiB,EACjB,oCAAoC,EACpC,kBAAkB,GACrB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAE7E,OAAO,EACH,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,GAC3B,MAAM,aAAa,CAAC;AAErB,YAAY,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAE3E,OAAO,EACH,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,GAC5B,MAAM,YAAY,CAAC;AAEpB,YAAY,EACR,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,SAAS,EACT,UAAU,EACV,mBAAmB,GACtB,MAAM,YAAY,CAAC;AAMpB,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAE3C,YAAY,EACR,mBAAmB,EACnB,wBAAwB,EACxB,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,EACxB,eAAe,EACf,YAAY,EACZ,QAAQ,EACR,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,yBAAyB,EACzB,qBAAqB,EACrB,wBAAwB,EACxB,4BAA4B,EAC5B,aAAa,EACb,UAAU,EACV,cAAc,EACd,oBAAoB,EACpB,aAAa,EACb,mBAAmB,GACtB,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,EACH,eAAe,EACf,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,aAAa,GAChB,MAAM,OAAO,CAAC;AAEf,OAAO,EACH,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,GACxB,MAAM,WAAW,CAAC;AAEnB,YAAY,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAElD,OAAO,EACH,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,yBAAyB,EACzB,UAAU,EACV,UAAU,EACV,cAAc,EACd,cAAc,EACd,kBAAkB,GACrB,MAAM,UAAU,CAAC;AAElB,OAAO,EACH,qBAAqB,EACrB,4BAA4B,EAC5B,wBAAwB,EACxB,wBAAwB,EACxB,kCAAkC,EAClC,uBAAuB,EACvB,wBAAwB,GAC3B,MAAM,sBAAsB,CAAC;AAE9B,YAAY,EACR,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,GACtB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACH,uBAAuB,EACvB,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,EACxB,2BAA2B,EAC3B,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,GACpB,MAAM,iBAAiB,CAAC;AAEzB,YAAY,EAAE,cAAc,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACnG,OAAO,EACH,4BAA4B,EAC5B,0BAA0B,EAC1B,qBAAqB,EACrB,+BAA+B,GAClC,MAAM,4BAA4B,CAAC;AACpC,YAAY,EACR,sBAAsB,EACtB,4BAA4B,GAC/B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,YAAY,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACzE,YAAY,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EACH,0BAA0B,EAC1B,qBAAqB,EACrB,wBAAwB,EACxB,4BAA4B,EAC5B,4BAA4B,EAC5B,6BAA6B,EAC7B,wBAAwB,GAC3B,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACtE,YAAY,EACR,uBAAuB,EACvB,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,GACzB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,8BAA8B,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnG,YAAY,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACzE,YAAY,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAC9F,YAAY,EACR,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,GAClB,MAAM,SAAS,CAAC;AACjB,OAAO,EACH,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,EACvB,+BAA+B,EAC/B,yBAAyB,GAC5B,MAAM,SAAS,CAAC;AACjB,OAAO,EACH,cAAc,EACd,cAAc,EACd,uBAAuB,EACvB,YAAY,EACZ,WAAW,EACX,eAAe,EACf,cAAc,EACd,oBAAoB,GACvB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACH,uBAAuB,EACvB,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,cAAc,GACjB,MAAM,WAAW,CAAC;AAEnB,YAAY,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAE1E,OAAO,EACH,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACtB,UAAU,EACV,mCAAmC,GACtC,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,OAAO,EACH,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,sBAAsB,EACtB,iBAAiB,EACjB,uBAAuB,GAC1B,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACR,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,GACpB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACH,iBAAiB,EACjB,oCAAoC,EACpC,kBAAkB,GACrB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAE7E,OAAO,EACH,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,GAC3B,MAAM,aAAa,CAAC;AAErB,YAAY,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAE3E,OAAO,EACH,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,GAC5B,MAAM,YAAY,CAAC;AAEpB,YAAY,EACR,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,SAAS,EACT,UAAU,EACV,mBAAmB,GACtB,MAAM,YAAY,CAAC;AAMpB,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAE3C,YAAY,EACR,mBAAmB,EACnB,wBAAwB,EACxB,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,EACxB,eAAe,EACf,YAAY,EACZ,QAAQ,EACR,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,yBAAyB,EACzB,qBAAqB,EACrB,wBAAwB,EACxB,4BAA4B,EAC5B,aAAa,EACb,UAAU,EACV,cAAc,EACd,oBAAoB,EACpB,aAAa,EACb,mBAAmB,GACtB,MAAM,SAAS,CAAC"}

package/dist/sss-key-manager.cjs.development.js

@@ -205,6 +205,7 @@ var require_types_cjs_development = __commonJS({
       FlatAuthGrantValidator: /* @__PURE__ */ __name(() => FlatAuthGrantValidator, "FlatAuthGrantValidator"),
       FrameworkWithSkillsValidator: /* @__PURE__ */ __name(() => FrameworkWithSkillsValidator, "FrameworkWithSkillsValidator"),
       FullClaimHookValidator: /* @__PURE__ */ __name(() => FullClaimHookValidator, "FullClaimHookValidator"),
+      GenerateSkillIconsInputValidator: /* @__PURE__ */ __name(() => GenerateSkillIconsInputValidator, "GenerateSkillIconsInputValidator"),
       GeoCoordinatesValidator: /* @__PURE__ */ __name(() => GeoCoordinatesValidator, "GeoCoordinatesValidator"),
       GetCounterEventValidator: /* @__PURE__ */ __name(() => GetCounterEventValidator, "GetCounterEventValidator"),
       GetCountersEventValidator: /* @__PURE__ */ __name(() => GetCountersEventValidator, "GetCountersEventValidator"),
@@ -365,6 +366,8 @@ var require_types_cjs_development = __commonJS({
       SHARE_RECOVERY_PROTOCOL: /* @__PURE__ */ __name(() => SHARE_RECOVERY_PROTOCOL, "SHARE_RECOVERY_PROTOCOL"),
       SHARE_TAG_BYTES: /* @__PURE__ */ __name(() => SHARE_TAG_BYTES, "SHARE_TAG_BYTES"),
       SHARE_VIEW_RECEIPT_TTL_SECONDS: /* @__PURE__ */ __name(() => SHARE_VIEW_RECEIPT_TTL_SECONDS, "SHARE_VIEW_RECEIPT_TTL_SECONDS"),
+      SKILL_ICON_MAX_CHARACTERS_PER_REQUEST: /* @__PURE__ */ __name(() => SKILL_ICON_MAX_CHARACTERS_PER_REQUEST, "SKILL_ICON_MAX_CHARACTERS_PER_REQUEST"),
+      SKILL_ICON_MAX_NAMES_PER_REQUEST: /* @__PURE__ */ __name(() => SKILL_ICON_MAX_NAMES_PER_REQUEST, "SKILL_ICON_MAX_NAMES_PER_REQUEST"),
       SendAiSessionCredentialEventValidator: /* @__PURE__ */ __name(() => SendAiSessionCredentialEventValidator, "SendAiSessionCredentialEventValidator"),
       SendBoostInputValidator: /* @__PURE__ */ __name(() => SendBoostInputValidator, "SendBoostInputValidator"),
       SendBoostResponseValidator: /* @__PURE__ */ __name(() => SendBoostResponseValidator, "SendBoostResponseValidator"),
@@ -417,6 +420,7 @@ var require_types_cjs_development = __commonJS({
       SkillFrameworkQueryValidator: /* @__PURE__ */ __name(() => SkillFrameworkQueryValidator, "SkillFrameworkQueryValidator"),
       SkillFrameworkStatusEnum: /* @__PURE__ */ __name(() => SkillFrameworkStatusEnum, "SkillFrameworkStatusEnum"),
       SkillFrameworkValidator: /* @__PURE__ */ __name(() => SkillFrameworkValidator, "SkillFrameworkValidator"),
+      SkillIconNamesValidator: /* @__PURE__ */ __name(() => SkillIconNamesValidator, "SkillIconNamesValidator"),
       SkillQueryValidator: /* @__PURE__ */ __name(() => SkillQueryValidator, "SkillQueryValidator"),
       SkillSemanticSearchInputValidator: /* @__PURE__ */ __name(() => SkillSemanticSearchInputValidator, "SkillSemanticSearchInputValidator"),
       SkillSemanticSearchResultItemValidator: /* @__PURE__ */ __name(() => SkillSemanticSearchResultItemValidator, "SkillSemanticSearchResultItemValidator"),
@@ -16154,6 +16158,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       term: external_exports.string().optional()
     }).catchall(external_exports.any());
     var UnsignedAchievementCredentialValidator = UnsignedVCValidator.extend({
+      awardedDate: external_exports.string().optional(),
       name: external_exports.string().optional(),
       description: external_exports.string().optional(),
       image: ImageValidator.optional(),
@@ -19010,6 +19015,17 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
       contentUrl: external_exports.string(),
       receipt: external_exports.string().min(22).max(128).regex(/^[A-Za-z0-9_-]+$/)
     }).strict();
+    var SKILL_ICON_MAX_NAMES_PER_REQUEST = 100;
+    var SKILL_ICON_MAX_CHARACTERS_PER_REQUEST = 2500;
+    var SkillIconNamesValidator = external_exports.array(external_exports.string().nonempty()).min(1).max(SKILL_ICON_MAX_NAMES_PER_REQUEST, {
+      message: `A maximum of ${SKILL_ICON_MAX_NAMES_PER_REQUEST} skill names can be sent per request`
+    }).refine(
+      (names) => names.reduce((total, name) => total + name.length, 0) <= SKILL_ICON_MAX_CHARACTERS_PER_REQUEST,
+      {
+        message: `Skill names may total at most ${SKILL_ICON_MAX_CHARACTERS_PER_REQUEST} characters per request`
+      }
+    );
+    var GenerateSkillIconsInputValidator = external_exports.object({ names: SkillIconNamesValidator });
   }
 });
 
@@ -19130,7 +19146,9 @@ __export(index_exports, {
   validateRecoveryPhrase: () => validateRecoveryPhrase,
   verifyEnclaveAttestation: () => verifyEnclaveAttestation,
   verifyEscrowAuthorityState: () => verifyEscrowAuthorityState,
+  verifyEscrowCodeDelivery: () => verifyEscrowCodeDelivery,
   verifyEscrowEnrollmentCommit: () => verifyEscrowEnrollmentCommit,
+  verifyEscrowHoldState: () => verifyEscrowHoldState,
   verifyNitroAttestationDocument: () => verifyNitroAttestationDocument,
   verifyStoredShares: () => verifyStoredShares,
   violatesCarryContactRule: () => violatesCarryContactRule
@@ -23653,6 +23671,37 @@ var EscrowEvidenceError = class extends Error {
 var fail2 = /* @__PURE__ */ __name(() => {
   throw new EscrowEvidenceError();
 }, "fail");
+var verifyEscrowHoldState = /* @__PURE__ */ __name(async (response, nonce, expected, identity) => {
+  requireEvidence(/^[0-9a-f]{64}$/.test(nonce));
+  const { payload } = await verifyRecord(response.proof, "snapshot", identity);
+  requireEvidence(Array.isArray(payload) && payload.length === 12);
+  const p = payload;
+  requireEvidence(
+    p[0] === "learncard-authority-hold-state-v3" && p[1] === nonce && p[2] === expected.tenant && p[3] === expected.authorityGeneration && p[4] === expected.did && p[5] === expected.holdId && p[6] === expected.holdDigest
+  );
+  const status = p[7];
+  if (status !== "awaitingConfirmation" && status !== "pending" && status !== "released" && status !== "cancelled")
+    return fail2();
+  const confirmedHiMs = p[8] === null ? null : integer2(p[8]);
+  const releaseWarningSentHiMs = p[9] === null ? null : integer2(p[9]);
+  const attemptsRemaining = integer2(p[10], 0, 5);
+  const codeSendStatus = p[11];
+  if (codeSendStatus !== "unknown" && codeSendStatus !== "notRequired") return fail2();
+  requireEvidence(
+    status !== "awaitingConfirmation" || confirmedHiMs === null && releaseWarningSentHiMs === null
+  );
+  requireEvidence(status !== "pending" && status !== "released" || confirmedHiMs !== null);
+  return { status, confirmedHiMs, releaseWarningSentHiMs, attemptsRemaining, codeSendStatus };
+}, "verifyEscrowHoldState");
+var verifyEscrowCodeDelivery = /* @__PURE__ */ __name(async (delivery, expected, identity) => {
+  const { payload } = await verifyRecord(delivery.proof, "snapshot", identity);
+  requireEvidence(Array.isArray(payload) && payload.length === 5);
+  const values = payload;
+  requireEvidence(
+    values[0] === "learncard-authority-code-delivery-v1" && values[1] === expected.tenant && values[2] === expected.authorityGeneration && values[3] === expected.holdDigest && typeof values[4] === "boolean" && values[4] === delivery.codeSent
+  );
+  return delivery.codeSent;
+}, "verifyEscrowCodeDelivery");
 var requireEvidence = /* @__PURE__ */ __name((condition) => {
   if (!condition) fail2();
 }, "requireEvidence");
@@ -24321,9 +24370,10 @@ var SERVER_REQUEST_TIMEOUT_MS = 3e4;
 var requestTimeoutSignal = /* @__PURE__ */ __name((ms = SERVER_REQUEST_TIMEOUT_MS) => typeof AbortSignal !== "undefined" && typeof AbortSignal.timeout === "function" ? AbortSignal.timeout(ms) : void 0, "requestTimeoutSignal");
 var describeHttpStatus = /* @__PURE__ */ __name((response) => response.statusText ? `${response.status} ${response.statusText}` : `${response.status}`, "describeHttpStatus");
 var EscrowRequestError = class extends Error {
-  constructor(status) {
+  constructor(status, reason) {
     super("Escrow request failed");
     this.status = status;
+    this.reason = reason;
     this.name = "EscrowRequestError";
   }
   static {
@@ -24809,6 +24859,14 @@ function createSSSStrategy(config) {
       ...init
     });
     if (!response.ok) {
+      if (path === "/confirm" && response.status === 403) {
+        const body = await response.json().catch(() => void 0);
+        const reason = body && typeof body === "object" && "message" in body && typeof body.message === "string" ? body.message : void 0;
+        throw new EscrowRequestError(
+          response.status,
+          reason === "codeMismatch" || reason === "codeExpired" || reason === "codeLocked" ? reason : void 0
+        );
+      }
       if (!pinAttempt && path === "/recover" && response.status === 429) {
         const body = await response.json().catch(() => void 0);
         const message = body && typeof body === "object" && "message" in body && typeof body.message === "string" ? body.message : "";
@@ -25712,6 +25770,7 @@ function createSSSStrategy(config) {
           ledgerPublicKey: identity.authority.ledgerPublicKey,
           keyId: verified.receipt.keyId
         };
+        result.codeSent = result.delivery ? await verifyEscrowCodeDelivery(result.delivery, expectations, identity) : void 0;
       }
       return { ...result, clientEphemeralPrivateKey: pair.privateKey, expectations };
     },