@zkp2p/zkp2p-attestation 1.6.2 → 2.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +12 -1
- package/README.md +5 -11
- package/dist/cli/verify.js +10 -4
- package/dist/cli/verify.js.map +1 -1
- package/dist/index.cjs +2 -2
- package/dist/index.cjs.map +1 -1
- package/dist/index.d.cts +3 -24
- package/dist/index.d.ts +3 -24
- package/dist/index.js +2 -2
- package/dist/index.js.map +1 -1
- package/package.json +1 -1
package/dist/index.d.cts
CHANGED
|
@@ -4,10 +4,10 @@ interface NitroAttestationWarning {
|
|
|
4
4
|
details?: Record<string, unknown>;
|
|
5
5
|
}
|
|
6
6
|
|
|
7
|
-
type SellerCredentialUploadPlatform = "venmo" | "cashapp" | "wise" | "paypal"
|
|
7
|
+
type SellerCredentialUploadPlatform = "venmo" | "cashapp" | "wise" | "paypal";
|
|
8
8
|
type PayeeIdSellerCredentialUploadPlatform = Exclude<SellerCredentialUploadPlatform, "wise">;
|
|
9
9
|
type IdentityPlatform = "venmo" | "paypal" | "wise" | "cashapp";
|
|
10
|
-
type BuyerTeeSessionMaterialPlatform = "venmo" | "cashapp" | "monzo" | "wise" | "revolut" | "
|
|
10
|
+
type BuyerTeeSessionMaterialPlatform = "venmo" | "cashapp" | "monzo" | "wise" | "revolut" | "chime" | "zelle" | "paypal";
|
|
11
11
|
type BuyerTeeHeaderMap = Record<string, string>;
|
|
12
12
|
type RequiredBuyerTeeHeaders<K extends string> = BuyerTeeHeaderMap & {
|
|
13
13
|
[H in K]: string;
|
|
@@ -90,16 +90,7 @@ type ZelleBuyerTeeSessionMaterialPayloadByActionType = {
|
|
|
90
90
|
type ZelleBuyerTeeVerifyPaymentPayload = ZelleBuyerTeeSessionMaterialPayloadByActionType & {
|
|
91
91
|
params: ZelleBuyerTeeParams;
|
|
92
92
|
};
|
|
93
|
-
interface CitiBuyerTeeParams {
|
|
94
|
-
index: number;
|
|
95
|
-
}
|
|
96
93
|
type ChimeBuyerTeeParams = Record<string, never>;
|
|
97
|
-
interface ChaseBuyerTeeParams {
|
|
98
|
-
index: number;
|
|
99
|
-
}
|
|
100
|
-
interface BankOfAmericaBuyerTeeParams {
|
|
101
|
-
index: number;
|
|
102
|
-
}
|
|
103
94
|
interface PayPalBuyerTeeParams {
|
|
104
95
|
PAYMENT_ID: string;
|
|
105
96
|
}
|
|
@@ -117,10 +108,7 @@ interface BuyerTeeActionTypeByPlatform {
|
|
|
117
108
|
monzo: "transfer_monzo";
|
|
118
109
|
wise: "transfer_wise";
|
|
119
110
|
revolut: "transfer_revolut";
|
|
120
|
-
citi: "transfer_zelle";
|
|
121
111
|
chime: "transfer_chime";
|
|
122
|
-
chase: "transfer_zelle";
|
|
123
|
-
bankofamerica: "transfer_zelle";
|
|
124
112
|
zelle: ZelleBuyerTeeActionType;
|
|
125
113
|
paypal: "transfer_paypal";
|
|
126
114
|
}
|
|
@@ -136,10 +124,7 @@ interface BuyerTeeSessionMaterialByPlatform {
|
|
|
136
124
|
monzo: MonzoBuyerTeeSessionMaterial;
|
|
137
125
|
wise: WiseBuyerTeeSessionMaterial;
|
|
138
126
|
revolut: RevolutBuyerTeeSessionMaterial;
|
|
139
|
-
citi: CitiBuyerTeeSessionMaterial;
|
|
140
127
|
chime: ChimeBuyerTeeSessionMaterial;
|
|
141
|
-
chase: ChaseBuyerTeeSessionMaterial;
|
|
142
|
-
bankofamerica: BankOfAmericaBuyerTeeSessionMaterial;
|
|
143
128
|
zelle: ZelleBuyerTeeSessionMaterial;
|
|
144
129
|
paypal: PayPalBuyerTeeSessionMaterial;
|
|
145
130
|
}
|
|
@@ -155,10 +140,7 @@ interface BuyerTeeParamsByPlatform {
|
|
|
155
140
|
monzo: MonzoBuyerTeeParams;
|
|
156
141
|
wise: WiseBuyerTeeParams;
|
|
157
142
|
revolut: RevolutBuyerTeeParams;
|
|
158
|
-
citi: CitiBuyerTeeParams;
|
|
159
143
|
chime: ChimeBuyerTeeParams;
|
|
160
|
-
chase: ChaseBuyerTeeParams;
|
|
161
|
-
bankofamerica: BankOfAmericaBuyerTeeParams;
|
|
162
144
|
zelle: ZelleBuyerTeeParams;
|
|
163
145
|
paypal: PayPalBuyerTeeParams;
|
|
164
146
|
}
|
|
@@ -228,10 +210,7 @@ type CashAppBuyerTeeSessionMaterialPayload = BuyerTeeSessionMaterialPayloadFor<"
|
|
|
228
210
|
type MonzoBuyerTeeSessionMaterialPayload = BuyerTeeSessionMaterialPayloadFor<"monzo">;
|
|
229
211
|
type WiseBuyerTeeSessionMaterialPayload = BuyerTeeSessionMaterialPayloadFor<"wise">;
|
|
230
212
|
type RevolutBuyerTeeSessionMaterialPayload = BuyerTeeSessionMaterialPayloadFor<"revolut">;
|
|
231
|
-
type CitiBuyerTeeSessionMaterialPayload = BuyerTeeSessionMaterialPayloadFor<"citi">;
|
|
232
213
|
type ChimeBuyerTeeSessionMaterialPayload = BuyerTeeSessionMaterialPayloadFor<"chime">;
|
|
233
|
-
type ChaseBuyerTeeSessionMaterialPayload = BuyerTeeSessionMaterialPayloadFor<"chase">;
|
|
234
|
-
type BankOfAmericaBuyerTeeSessionMaterialPayload = BuyerTeeSessionMaterialPayloadFor<"bankofamerica">;
|
|
235
214
|
type ZelleBuyerTeeSessionMaterialPayload = BuyerTeeSessionMaterialPayloadFor<"zelle">;
|
|
236
215
|
type PayPalBuyerTeeSessionMaterialPayload = BuyerTeeSessionMaterialPayloadFor<"paypal">;
|
|
237
216
|
type VenmoIdentitySessionMaterialPayload = IdentitySessionMaterialPayloadFor<"venmo">;
|
|
@@ -560,4 +539,4 @@ declare function verifyIdentityAttestation<P extends IdentityPlatform>(payload:
|
|
|
560
539
|
|
|
561
540
|
declare function verifySellerCredentialBundle<P extends SellerCredentialUploadPlatform>(bundle: SellerCredentialBundleFor<P>, options: VerifySellerCredentialBundleOptionsFor<P>): SellerCredentialBundleFor<P>;
|
|
562
541
|
|
|
563
|
-
export { AWS_NITRO_ROOT_FINGERPRINT_SHA256_HEX, AWS_NITRO_ROOT_PEM, type AttestationOutput, type AttestedSellerUploadKey, type
|
|
542
|
+
export { AWS_NITRO_ROOT_FINGERPRINT_SHA256_HEX, AWS_NITRO_ROOT_PEM, type AttestationOutput, type AttestedSellerUploadKey, type BankOfAmericaBuyerTeeSessionMaterial, type BuyerTeeActionType, type BuyerTeeActionTypeByPlatform, type BuyerTeeAttestationOutput, type BuyerTeeAttestationOutputFor, type BuyerTeeHeaderMap, type BuyerTeeParamsByPlatform, type BuyerTeeSessionMaterialByPlatform, type BuyerTeeSessionMaterialPayload, type BuyerTeeSessionMaterialPayloadFor, type BuyerTeeSessionMaterialPlatform, type BuyerTeeSupportedVerifiersResponse, type BuyerTeeVerifier, type BuyerTeeVerifyPaymentPayload, type BuyerTeeVerifyPaymentPayloadFor, type CashAppBuyerTeeParams, type CashAppBuyerTeeSessionMaterial, type CashAppBuyerTeeSessionMaterialPayload, type CashAppIdentityParams, type CashAppIdentitySessionMaterial, type CashAppIdentitySessionMaterialPayload, type ChaseBuyerTeeSessionMaterial, type ChimeBuyerTeeParams, type ChimeBuyerTeeSessionMaterial, type ChimeBuyerTeeSessionMaterialPayload, type CitiBuyerTeeSessionMaterial, type CreateEncryptedBuyerTeeSessionMaterialParams, type CreateEncryptedBuyerTeeSessionMaterialParamsFor, type CreateEncryptedIdentitySessionMaterialParams, type CreateEncryptedIdentitySessionMaterialParamsFor, type CreateEncryptedSellerCredentialUploadParams, type Eip712Field, type EncryptBuyerTeeSessionMaterialParams, type EncryptBuyerTeeSessionMaterialParamsFor, type EncryptIdentitySessionMaterialParams, type EncryptIdentitySessionMaterialParamsFor, type EncryptSellerCredentialUploadParams, type FetchAndVerifyAttestationParams, type IdentityActionType, type IdentityActionTypeByPlatform, type IdentityAttestationOutput, type IdentityAttestationOutputFor, type IdentityAttestationRequestPayload, type IdentityAttestationRequestPayloadFor, type IdentityParamsByPlatform, type IdentityPlatform, type IdentitySessionMaterialByPlatform, type IdentitySessionMaterialPayload, type IdentitySessionMaterialPayloadFor, type IdentityTypedDataValue, type IntentDetails, type MonzoBuyerTeeParams, type MonzoBuyerTeeSessionMaterial, type MonzoBuyerTeeSessionMaterialPayload, type NitroAttestationClient, type NitroAttestationClientCreateEncryptedBuyerTeeSessionMaterialParams, type NitroAttestationClientCreateEncryptedIdentitySessionMaterialParams, type NitroAttestationClientCreateEncryptedSellerCredentialUploadParams, type NitroAttestationClientOptions, type NitroAttestationClientRequestIdentityAttestationParams, type NitroAttestationClientUploadSellerCredentialParams, type NitroAttestationClientVerifyBuyerTeePaymentParams, type NitroAttestationClientVerifyBuyerTeePaymentParamsFor, type NitroAttestationEnvironment, NitroAttestationError, type NitroAttestationErrorCode, type NitroAttestationWarning, type NitroServiceResponseErrorDetails, type NormalizedIdentityDetails, type PayPalBuyerTeeParams, type PayPalBuyerTeeSessionMaterial, type PayPalBuyerTeeSessionMaterialPayload, type PayPalIdentityParams, type PayPalIdentitySessionMaterial, type PayPalIdentitySessionMaterialPayload, type PayeeIdSellerCredentialUploadPayload, type PayeeIdSellerCredentialUploadPlatform, type PayeeIdSellerCredentialUploadWithPlatformPayload, type PaymentTypedDataValue, type RequestIdentityAttestationParams, type RequestIdentityAttestationParamsFor, type RevolutBuyerTeeParams, type RevolutBuyerTeeSessionMaterial, type RevolutBuyerTeeSessionMaterialPayload, type SellerCredentialBundle, type SellerCredentialBundleFor, type SellerCredentialUploadPayload, type SellerCredentialUploadPlatform, type TrustPins, type TypedDataSpec, type UnifiedPaymentVerifierDomain, type UploadSellerCredentialParams, type UploadSellerCredentialPayload, type VenmoBuyerTeeParams, type VenmoBuyerTeeSessionMaterial, type VenmoBuyerTeeSessionMaterialPayload, type VenmoIdentityParams, type VenmoIdentitySessionMaterial, type VenmoIdentitySessionMaterialPayload, type VerifiedAttestation, type VerifiedAttestationPayload, type VerifyBuyerTeePaymentAttestationOptions, type VerifyBuyerTeePaymentAttestationOptionsFor, type VerifyBuyerTeePaymentParams, type VerifyBuyerTeePaymentParamsFor, type VerifyIdentityAttestationOptions, type VerifyIdentityAttestationOptionsFor, type VerifySellerCredentialBundleOptions, type VerifySellerCredentialBundleOptionsFor, type WiseBuyerTeeParams, type WiseBuyerTeeSessionMaterial, type WiseBuyerTeeSessionMaterialPayload, type WiseIdentityParams, type WiseIdentitySessionMaterial, type WiseIdentitySessionMaterialPayload, type WiseSellerCredentialSessionMaterial, type WiseSellerCredentialUploadPayload, type ZelleBuyerTeeActionType, type ZelleBuyerTeeParams, type ZelleBuyerTeeSessionMaterial, type ZelleBuyerTeeSessionMaterialByActionType, type ZelleBuyerTeeSessionMaterialPayload, type ZelleBuyerTeeVerifyPaymentPayload, createEncryptedBuyerTeeSessionMaterial, createEncryptedIdentitySessionMaterial, createEncryptedSellerCredentialUpload, createNitroAttestationClient, encryptBuyerTeeSessionMaterial, encryptIdentitySessionMaterial, encryptSellerCredentialUpload, fetchAndVerifyAttestation, getUnifiedPaymentVerifierDomainSeparator, hashUtf8, requestIdentityAttestation, uploadSellerCredential, verifyBuyerTeePayment, verifyBuyerTeePaymentAttestation, verifyIdentityAttestation, verifySellerCredentialBundle };
|
package/dist/index.d.ts
CHANGED
|
@@ -4,10 +4,10 @@ interface NitroAttestationWarning {
|
|
|
4
4
|
details?: Record<string, unknown>;
|
|
5
5
|
}
|
|
6
6
|
|
|
7
|
-
type SellerCredentialUploadPlatform = "venmo" | "cashapp" | "wise" | "paypal"
|
|
7
|
+
type SellerCredentialUploadPlatform = "venmo" | "cashapp" | "wise" | "paypal";
|
|
8
8
|
type PayeeIdSellerCredentialUploadPlatform = Exclude<SellerCredentialUploadPlatform, "wise">;
|
|
9
9
|
type IdentityPlatform = "venmo" | "paypal" | "wise" | "cashapp";
|
|
10
|
-
type BuyerTeeSessionMaterialPlatform = "venmo" | "cashapp" | "monzo" | "wise" | "revolut" | "
|
|
10
|
+
type BuyerTeeSessionMaterialPlatform = "venmo" | "cashapp" | "monzo" | "wise" | "revolut" | "chime" | "zelle" | "paypal";
|
|
11
11
|
type BuyerTeeHeaderMap = Record<string, string>;
|
|
12
12
|
type RequiredBuyerTeeHeaders<K extends string> = BuyerTeeHeaderMap & {
|
|
13
13
|
[H in K]: string;
|
|
@@ -90,16 +90,7 @@ type ZelleBuyerTeeSessionMaterialPayloadByActionType = {
|
|
|
90
90
|
type ZelleBuyerTeeVerifyPaymentPayload = ZelleBuyerTeeSessionMaterialPayloadByActionType & {
|
|
91
91
|
params: ZelleBuyerTeeParams;
|
|
92
92
|
};
|
|
93
|
-
interface CitiBuyerTeeParams {
|
|
94
|
-
index: number;
|
|
95
|
-
}
|
|
96
93
|
type ChimeBuyerTeeParams = Record<string, never>;
|
|
97
|
-
interface ChaseBuyerTeeParams {
|
|
98
|
-
index: number;
|
|
99
|
-
}
|
|
100
|
-
interface BankOfAmericaBuyerTeeParams {
|
|
101
|
-
index: number;
|
|
102
|
-
}
|
|
103
94
|
interface PayPalBuyerTeeParams {
|
|
104
95
|
PAYMENT_ID: string;
|
|
105
96
|
}
|
|
@@ -117,10 +108,7 @@ interface BuyerTeeActionTypeByPlatform {
|
|
|
117
108
|
monzo: "transfer_monzo";
|
|
118
109
|
wise: "transfer_wise";
|
|
119
110
|
revolut: "transfer_revolut";
|
|
120
|
-
citi: "transfer_zelle";
|
|
121
111
|
chime: "transfer_chime";
|
|
122
|
-
chase: "transfer_zelle";
|
|
123
|
-
bankofamerica: "transfer_zelle";
|
|
124
112
|
zelle: ZelleBuyerTeeActionType;
|
|
125
113
|
paypal: "transfer_paypal";
|
|
126
114
|
}
|
|
@@ -136,10 +124,7 @@ interface BuyerTeeSessionMaterialByPlatform {
|
|
|
136
124
|
monzo: MonzoBuyerTeeSessionMaterial;
|
|
137
125
|
wise: WiseBuyerTeeSessionMaterial;
|
|
138
126
|
revolut: RevolutBuyerTeeSessionMaterial;
|
|
139
|
-
citi: CitiBuyerTeeSessionMaterial;
|
|
140
127
|
chime: ChimeBuyerTeeSessionMaterial;
|
|
141
|
-
chase: ChaseBuyerTeeSessionMaterial;
|
|
142
|
-
bankofamerica: BankOfAmericaBuyerTeeSessionMaterial;
|
|
143
128
|
zelle: ZelleBuyerTeeSessionMaterial;
|
|
144
129
|
paypal: PayPalBuyerTeeSessionMaterial;
|
|
145
130
|
}
|
|
@@ -155,10 +140,7 @@ interface BuyerTeeParamsByPlatform {
|
|
|
155
140
|
monzo: MonzoBuyerTeeParams;
|
|
156
141
|
wise: WiseBuyerTeeParams;
|
|
157
142
|
revolut: RevolutBuyerTeeParams;
|
|
158
|
-
citi: CitiBuyerTeeParams;
|
|
159
143
|
chime: ChimeBuyerTeeParams;
|
|
160
|
-
chase: ChaseBuyerTeeParams;
|
|
161
|
-
bankofamerica: BankOfAmericaBuyerTeeParams;
|
|
162
144
|
zelle: ZelleBuyerTeeParams;
|
|
163
145
|
paypal: PayPalBuyerTeeParams;
|
|
164
146
|
}
|
|
@@ -228,10 +210,7 @@ type CashAppBuyerTeeSessionMaterialPayload = BuyerTeeSessionMaterialPayloadFor<"
|
|
|
228
210
|
type MonzoBuyerTeeSessionMaterialPayload = BuyerTeeSessionMaterialPayloadFor<"monzo">;
|
|
229
211
|
type WiseBuyerTeeSessionMaterialPayload = BuyerTeeSessionMaterialPayloadFor<"wise">;
|
|
230
212
|
type RevolutBuyerTeeSessionMaterialPayload = BuyerTeeSessionMaterialPayloadFor<"revolut">;
|
|
231
|
-
type CitiBuyerTeeSessionMaterialPayload = BuyerTeeSessionMaterialPayloadFor<"citi">;
|
|
232
213
|
type ChimeBuyerTeeSessionMaterialPayload = BuyerTeeSessionMaterialPayloadFor<"chime">;
|
|
233
|
-
type ChaseBuyerTeeSessionMaterialPayload = BuyerTeeSessionMaterialPayloadFor<"chase">;
|
|
234
|
-
type BankOfAmericaBuyerTeeSessionMaterialPayload = BuyerTeeSessionMaterialPayloadFor<"bankofamerica">;
|
|
235
214
|
type ZelleBuyerTeeSessionMaterialPayload = BuyerTeeSessionMaterialPayloadFor<"zelle">;
|
|
236
215
|
type PayPalBuyerTeeSessionMaterialPayload = BuyerTeeSessionMaterialPayloadFor<"paypal">;
|
|
237
216
|
type VenmoIdentitySessionMaterialPayload = IdentitySessionMaterialPayloadFor<"venmo">;
|
|
@@ -560,4 +539,4 @@ declare function verifyIdentityAttestation<P extends IdentityPlatform>(payload:
|
|
|
560
539
|
|
|
561
540
|
declare function verifySellerCredentialBundle<P extends SellerCredentialUploadPlatform>(bundle: SellerCredentialBundleFor<P>, options: VerifySellerCredentialBundleOptionsFor<P>): SellerCredentialBundleFor<P>;
|
|
562
541
|
|
|
563
|
-
export { AWS_NITRO_ROOT_FINGERPRINT_SHA256_HEX, AWS_NITRO_ROOT_PEM, type AttestationOutput, type AttestedSellerUploadKey, type
|
|
542
|
+
export { AWS_NITRO_ROOT_FINGERPRINT_SHA256_HEX, AWS_NITRO_ROOT_PEM, type AttestationOutput, type AttestedSellerUploadKey, type BankOfAmericaBuyerTeeSessionMaterial, type BuyerTeeActionType, type BuyerTeeActionTypeByPlatform, type BuyerTeeAttestationOutput, type BuyerTeeAttestationOutputFor, type BuyerTeeHeaderMap, type BuyerTeeParamsByPlatform, type BuyerTeeSessionMaterialByPlatform, type BuyerTeeSessionMaterialPayload, type BuyerTeeSessionMaterialPayloadFor, type BuyerTeeSessionMaterialPlatform, type BuyerTeeSupportedVerifiersResponse, type BuyerTeeVerifier, type BuyerTeeVerifyPaymentPayload, type BuyerTeeVerifyPaymentPayloadFor, type CashAppBuyerTeeParams, type CashAppBuyerTeeSessionMaterial, type CashAppBuyerTeeSessionMaterialPayload, type CashAppIdentityParams, type CashAppIdentitySessionMaterial, type CashAppIdentitySessionMaterialPayload, type ChaseBuyerTeeSessionMaterial, type ChimeBuyerTeeParams, type ChimeBuyerTeeSessionMaterial, type ChimeBuyerTeeSessionMaterialPayload, type CitiBuyerTeeSessionMaterial, type CreateEncryptedBuyerTeeSessionMaterialParams, type CreateEncryptedBuyerTeeSessionMaterialParamsFor, type CreateEncryptedIdentitySessionMaterialParams, type CreateEncryptedIdentitySessionMaterialParamsFor, type CreateEncryptedSellerCredentialUploadParams, type Eip712Field, type EncryptBuyerTeeSessionMaterialParams, type EncryptBuyerTeeSessionMaterialParamsFor, type EncryptIdentitySessionMaterialParams, type EncryptIdentitySessionMaterialParamsFor, type EncryptSellerCredentialUploadParams, type FetchAndVerifyAttestationParams, type IdentityActionType, type IdentityActionTypeByPlatform, type IdentityAttestationOutput, type IdentityAttestationOutputFor, type IdentityAttestationRequestPayload, type IdentityAttestationRequestPayloadFor, type IdentityParamsByPlatform, type IdentityPlatform, type IdentitySessionMaterialByPlatform, type IdentitySessionMaterialPayload, type IdentitySessionMaterialPayloadFor, type IdentityTypedDataValue, type IntentDetails, type MonzoBuyerTeeParams, type MonzoBuyerTeeSessionMaterial, type MonzoBuyerTeeSessionMaterialPayload, type NitroAttestationClient, type NitroAttestationClientCreateEncryptedBuyerTeeSessionMaterialParams, type NitroAttestationClientCreateEncryptedIdentitySessionMaterialParams, type NitroAttestationClientCreateEncryptedSellerCredentialUploadParams, type NitroAttestationClientOptions, type NitroAttestationClientRequestIdentityAttestationParams, type NitroAttestationClientUploadSellerCredentialParams, type NitroAttestationClientVerifyBuyerTeePaymentParams, type NitroAttestationClientVerifyBuyerTeePaymentParamsFor, type NitroAttestationEnvironment, NitroAttestationError, type NitroAttestationErrorCode, type NitroAttestationWarning, type NitroServiceResponseErrorDetails, type NormalizedIdentityDetails, type PayPalBuyerTeeParams, type PayPalBuyerTeeSessionMaterial, type PayPalBuyerTeeSessionMaterialPayload, type PayPalIdentityParams, type PayPalIdentitySessionMaterial, type PayPalIdentitySessionMaterialPayload, type PayeeIdSellerCredentialUploadPayload, type PayeeIdSellerCredentialUploadPlatform, type PayeeIdSellerCredentialUploadWithPlatformPayload, type PaymentTypedDataValue, type RequestIdentityAttestationParams, type RequestIdentityAttestationParamsFor, type RevolutBuyerTeeParams, type RevolutBuyerTeeSessionMaterial, type RevolutBuyerTeeSessionMaterialPayload, type SellerCredentialBundle, type SellerCredentialBundleFor, type SellerCredentialUploadPayload, type SellerCredentialUploadPlatform, type TrustPins, type TypedDataSpec, type UnifiedPaymentVerifierDomain, type UploadSellerCredentialParams, type UploadSellerCredentialPayload, type VenmoBuyerTeeParams, type VenmoBuyerTeeSessionMaterial, type VenmoBuyerTeeSessionMaterialPayload, type VenmoIdentityParams, type VenmoIdentitySessionMaterial, type VenmoIdentitySessionMaterialPayload, type VerifiedAttestation, type VerifiedAttestationPayload, type VerifyBuyerTeePaymentAttestationOptions, type VerifyBuyerTeePaymentAttestationOptionsFor, type VerifyBuyerTeePaymentParams, type VerifyBuyerTeePaymentParamsFor, type VerifyIdentityAttestationOptions, type VerifyIdentityAttestationOptionsFor, type VerifySellerCredentialBundleOptions, type VerifySellerCredentialBundleOptionsFor, type WiseBuyerTeeParams, type WiseBuyerTeeSessionMaterial, type WiseBuyerTeeSessionMaterialPayload, type WiseIdentityParams, type WiseIdentitySessionMaterial, type WiseIdentitySessionMaterialPayload, type WiseSellerCredentialSessionMaterial, type WiseSellerCredentialUploadPayload, type ZelleBuyerTeeActionType, type ZelleBuyerTeeParams, type ZelleBuyerTeeSessionMaterial, type ZelleBuyerTeeSessionMaterialByActionType, type ZelleBuyerTeeSessionMaterialPayload, type ZelleBuyerTeeVerifyPaymentPayload, createEncryptedBuyerTeeSessionMaterial, createEncryptedIdentitySessionMaterial, createEncryptedSellerCredentialUpload, createNitroAttestationClient, encryptBuyerTeeSessionMaterial, encryptIdentitySessionMaterial, encryptSellerCredentialUpload, fetchAndVerifyAttestation, getUnifiedPaymentVerifierDomainSeparator, hashUtf8, requestIdentityAttestation, uploadSellerCredential, verifyBuyerTeePayment, verifyBuyerTeePaymentAttestation, verifyIdentityAttestation, verifySellerCredentialBundle };
|
package/dist/index.js
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
var U=class extends Error{code;cause;details;constructor(t,r,n={}){super(r),this.name="NitroAttestationError",this.code=t,this.cause=n.cause,this.details=n.details}};function o(e,t,r){throw new U(e,t,r)}async function S(e,t,r){try{return await e}catch(n){o(t,r,{cause:n})}}function Y(e){
|
|
1
|
+
var U=class extends Error{code;cause;details;constructor(t,r,n={}){super(r),this.name="NitroAttestationError",this.code=t,this.cause=n.cause,this.details=n.details}};function o(e,t,r){throw new U(e,t,r)}async function S(e,t,r){try{return await e}catch(n){o(t,r,{cause:n})}}function Y(e){return e!==void 0?(typeof e!="function"&&o("CRYPTO_UNAVAILABLE","fetch is unavailable; pass a fetch implementation"),e):(typeof globalThis.fetch!="function"&&o("CRYPTO_UNAVAILABLE","fetch is unavailable; pass a fetch implementation"),globalThis.fetch.bind(globalThis))}function et(e){let t=e??globalThis.crypto?.subtle;return t||o("CRYPTO_UNAVAILABLE","SubtleCrypto is unavailable; pass params.subtle"),t}function tt(e){if(e)return e;let t=globalThis.crypto;return typeof t?.getRandomValues!="function"&&o("CRYPTO_UNAVAILABLE","crypto.getRandomValues is unavailable; pass params.getRandomValues"),r=>t.getRandomValues(r)}function h(e){return{subtle:et(e.subtle),getRandomValues:tt(e.getRandomValues)}}function me(e,t){return typeof t!="function"&&o("CRYPTO_UNAVAILABLE","crypto.getRandomValues is unavailable; pass params.getRandomValues"),{subtle:e,getRandomValues:t,randomUUID:()=>rt(t)}}function rt(e){let t=e(new Uint8Array(16));t[6]=t[6]&15|64,t[8]=t[8]&63|128;let r=Array.from(t,n=>n.toString(16).padStart(2,"0"));return`${r.slice(0,4).join("")}-${r.slice(4,6).join("")}-${r.slice(6,8).join("")}-${r.slice(8,10).join("")}-${r.slice(10).join("")}`}var D="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/",G=nt(D);function nt(e){let t={};for(let r=0;r<e.length;r+=1)t[e[r]]=r;return t}function g(e){let t="";for(let r of e)t+=r.toString(16).padStart(2,"0");return t}function x(e){if(typeof TextEncoder<"u")return new TextEncoder().encode(e);let t=[];for(let r=0;r<e.length;r+=1){let n=e.codePointAt(r);n>65535&&(r+=1),n<=127?t.push(n):n<=2047?t.push(192|n>>6,128|n&63):n<=65535?t.push(224|n>>12,128|n>>6&63,128|n&63):t.push(240|n>>18,128|n>>12&63,128|n>>6&63,128|n&63)}return new Uint8Array(t)}function w(e){if(typeof TextDecoder<"u")return new TextDecoder().decode(e);let t="";for(let r=0;r<e.length;r+=1){let n=e[r];n<128?t+=String.fromCodePoint(n):(n&224)===192?t+=String.fromCodePoint((n&31)<<6|e[++r]&63):(n&240)===224?t+=String.fromCodePoint((n&15)<<12|(e[++r]&63)<<6|e[++r]&63):t+=String.fromCodePoint((n&7)<<18|(e[++r]&63)<<12|(e[++r]&63)<<6|e[++r]&63)}return t}function it(e){let t="";for(let r=0;r<e.length;r+=3){let n=e[r],i=e[r+1]??0,a=e[r+2]??0,s=n<<16|i<<8|a;t+=D[s>>18&63],t+=D[s>>12&63],t+=r+1<e.length?D[s>>6&63]:"=",t+=r+2<e.length?D[s&63]:"="}return t}function Ae(e){return ot(e,!1)}function O(e){return it(e).replaceAll("+","-").replaceAll("/","_").replace(/=+$/,"")}function ot(e,t){let r=e.replace(/\s+/g,""),n=t?r.replaceAll("-","+").replaceAll("_","/"):r;if(n.length%4===1)throw new Error("Invalid base64 length");let i=n+"=".repeat((4-n.length%4)%4),a=[];for(let s=0;s<i.length;s+=4){let u=i.slice(s,s+4),l=u.endsWith("==")?2:u.endsWith("=")?1:0,c=$(u[0],G),d=$(u[1],G),f=u[2]==="="?0:$(u[2],G),T=u[3]==="="?0:$(u[3],G),p=c<<18|d<<12|f<<6|T;a.push(p>>16&255),l<2&&a.push(p>>8&255),l<1&&a.push(p&255)}return new Uint8Array(a)}function $(e,t){let r=t[e];if(r===void 0)throw new Error(`Invalid base64 character: ${e}`);return r}function b(e){let t=e.reduce((i,a)=>i+a.length,0),r=new Uint8Array(t),n=0;for(let i of e)r.set(i,n),n+=i.length;return r}function E(e){return new Uint8Array(e).buffer}function Te(e){let t={sessionMaterial:e.sessionMaterial,boundPubKeySha256:e.key.publicKeySha256Hex,issuedAtMs:e.issuedAtMs,jweId:e.jweId};return e.platform==="wise"?t:{payeeId:e.payeeId,...t}}function Se(e){return{platform:e.platform,actionType:e.actionType,sessionMaterial:e.sessionMaterial,boundPubKeySha256:e.key.publicKeySha256Hex}}function ge(e){return{platform:e.platform,actionType:e.actionType,sessionMaterial:e.sessionMaterial,boundPubKeySha256:e.key.publicKeySha256Hex}}function Ee(e){return JSON.stringify(e)}var at={alg:"RSA-OAEP-256",enc:"A256GCM"},st=/^[A-Za-z0-9_-]{16,128}$/;async function Ie(e){let t=e.request.issuedAtMs??e.now(),r=e.request.jweId??ut(e.getRandomValues);return ct(r),Q({key:e.request.key,plaintext:Te({...e.request,issuedAtMs:t,jweId:r}),subtle:e.subtle,getRandomValues:e.getRandomValues,failureContext:"seller credential upload"})}async function Pe(e){return Q({key:e.request.key,plaintext:Se(e.request),subtle:e.subtle,getRandomValues:e.getRandomValues,failureContext:"buyer TEE session material"})}async function he(e){return Q({key:e.request.key,plaintext:ge(e.request),subtle:e.subtle,getRandomValues:e.getRandomValues,failureContext:"identity session material"})}async function Q(e){let t=x(Ee(e.plaintext)),r=e.getRandomValues(new Uint8Array(32)),n=await S(e.subtle.importKey("spki",E(e.key.publicKeyDer),{name:"RSA-OAEP",hash:"SHA-256"},!1,["encrypt"]),"CRYPTO_UNAVAILABLE","Failed to import attested enclave-upload RSA public key"),i=new Uint8Array(await S(e.subtle.encrypt({name:"RSA-OAEP"},n,E(r)),"CRYPTO_UNAVAILABLE","Failed to RSA-OAEP encrypt the content encryption key")),a=e.getRandomValues(new Uint8Array(12)),s=O(x(JSON.stringify(at))),u=x(s),l=await S(e.subtle.importKey("raw",E(r),{name:"AES-GCM",length:256},!1,["encrypt"]),"CRYPTO_UNAVAILABLE","Failed to import generated AES-GCM content encryption key"),c=new Uint8Array(await S(e.subtle.encrypt({name:"AES-GCM",iv:E(a),additionalData:E(u),tagLength:128},l,E(t)),"CRYPTO_UNAVAILABLE",`Failed to AES-GCM encrypt ${e.failureContext}`)),d=c.slice(0,c.length-16),f=c.slice(c.length-16);return[s,O(i),O(a),O(d),O(f)].join(".")}function ct(e){st.test(e)||o("INVALID_PARAMETER","jweId must be 16-128 URL-safe characters")}function ut(e){let t=e(new Uint8Array(16));t[6]=t[6]&15|64,t[8]=t[8]&63|128;let r=Array.from(t,n=>n.toString(16).padStart(2,"0"));return`${r.slice(0,4).join("")}-${r.slice(4,6).join("")}-${r.slice(6,8).join("")}-${r.slice(8,10).join("")}-${r.slice(10).join("")}`}async function V(e){let t=h(e);return Pe({request:e,subtle:t.subtle,getRandomValues:t.getRandomValues})}import{X509Certificate as lt}from"@peculiar/x509";var J=`-----BEGIN CERTIFICATE-----
|
|
2
2
|
MIICETCCAZagAwIBAgIRAPkxdWgbkK/hHUbMtOTn+FYwCgYIKoZIzj0EAwMwSTEL
|
|
3
3
|
MAkGA1UEBhMCVVMxDzANBgNVBAoMBkFtYXpvbjEMMAoGA1UECwwDQVdTMRswGQYD
|
|
4
4
|
VQQDDBJhd3Mubml0cm8tZW5jbGF2ZXMwHhcNMTkxMDI4MTMyODA1WhcNNDkxMDI4
|
|
@@ -12,5 +12,5 @@ MQCjfy+Rocm9Xue4YnwWmNJVA44fA0P5W2OpYow9OYCVRaEevL8uO1XYru5xtMPW
|
|
|
12
12
|
rfMCMQCi85sWBbJwKKXdS6BptQFuZbT73o/gBh1qUxl/nNr12UO8Yfwr6wPLb+6N
|
|
13
13
|
IwLz3/Y=
|
|
14
14
|
-----END CERTIFICATE-----
|
|
15
|
-
`,K="641a0321a3e244efe456463195d606317ed7cdcc3c1756e09893f3c68f79bb5b";var dt=10080*60*1e3;async function be(e){let t=Ae(e.subtle,e.getRandomValues),r=Z(e.rootPem??J,"AWS Nitro root certificate"),n=await ee(r,e.subtle);n!==K&&o("AWS_ROOT_FINGERPRINT_MISMATCH","Bundled AWS Nitro root certificate fingerprint mismatch",{details:{expected:K,actual:n}});let i=Z(e.leafCertificateDer,"attestation leaf certificate"),s=e.cabundleDer.map((d,f)=>Z(d,`cabundle[${f}]`)),a=[r,...s,i];for(let d of a)yt(d,e.nowMs),pt(d,e.nowMs,e.onWarning);let u=await ee(i,e.subtle),l=[];for(let d of s){let f=await ee(d,e.subtle);f!==u&&f!==n&&l.push(d)}let c=[[i,...l.slice().reverse(),r],[i,...l,r]];for(let d of c)if(await ft(d,t)){let f=await S(i.publicKey.export({name:"ECDSA",namedCurve:"P-384"},["verify"],t),"CERT_CHAIN_INVALID","Failed to export attestation leaf public key");return{leafCertificate:i,leafPublicKey:f}}o("CERT_CHAIN_INVALID","Attestation certificate chain does not verify to the pinned AWS Nitro root")}async function ft(e,t){for(let r=0;r<e.length-1;r+=1){let n=e[r],i=e[r+1];if(!await n.verify({publicKey:i.publicKey,signatureOnly:!0},t))return!1}return e.length>0&&await e[e.length-1].isSelfSigned(t)}function Z(e,t){try{return new lt(e)}catch(r){o("CERT_CHAIN_INVALID",`Could not parse ${t}`,{cause:r})}}async function ee(e,t){return g(new Uint8Array(await t.digest("SHA-256",e.rawData)))}function yt(e,t){(t<e.notBefore.getTime()||t>e.notAfter.getTime())&&o("CERT_NOT_TIME_VALID","Certificate is outside its validity window",{details:{subject:e.subject,notBefore:e.notBefore.toISOString(),notAfter:e.notAfter.toISOString()}})}function pt(e,t,r){e.notAfter.getTime()<t+dt&&r?.({code:"CERT_VALIDITY_NEAR_EXPIRY",message:"Certificate in Nitro attestation chain expires within 7 days",details:{subject:e.subject,notAfter:e.notAfter.toISOString()}})}function v(e){let t=new te(e),r=t.readValue();if(!t.done())throw new Error("Trailing CBOR bytes");return r}function q(e){if(typeof e=="number"){if(!Number.isSafeInteger(e))throw new Error("CBOR number must be a safe integer");return e>=0?C(0,e):C(1,-1-e)}if(typeof e=="bigint")return e>=0n?C(0,e):C(1,-1n-e);if(typeof e=="string"){let t=x(e);return b([C(3,t.length),t])}if(e instanceof Uint8Array)return b([C(2,e.length),e]);if(Array.isArray(e))return b([C(4,e.length),...e.map(q)]);if(e instanceof Map)return b([C(5,e.size),...Array.from(e.entries()).flatMap(([t,r])=>[q(t),q(r)])]);if(typeof e=="boolean")return new Uint8Array([e?245:244]);if(e===null)return new Uint8Array([246]);throw new Error("Unsupported CBOR value")}function Ce(e,t){return q(["Signature1",e,new Uint8Array,t])}function C(e,t){let r=BigInt(t);return r<24n?new Uint8Array([e<<5|Number(r)]):r<=0xffn?new Uint8Array([e<<5|24,Number(r)]):r<=0xffffn?new Uint8Array([e<<5|25,Number(r>>8n&0xffn),Number(r&0xffn)]):r<=0xffffffffn?new Uint8Array([e<<5|26,Number(r>>24n&0xffn),Number(r>>16n&0xffn),Number(r>>8n&0xffn),Number(r&0xffn)]):new Uint8Array([e<<5|27,Number(r>>56n&0xffn),Number(r>>48n&0xffn),Number(r>>40n&0xffn),Number(r>>32n&0xffn),Number(r>>24n&0xffn),Number(r>>16n&0xffn),Number(r>>8n&0xffn),Number(r&0xffn)])}var te=class{constructor(t){this.bytes=t}bytes;offset=0;done(){return this.offset===this.bytes.length}readValue(){let t=this.readByte(),r=t>>5,n=t&31;if(n===31)return this.readIndefiniteValue(r);if(r===0)return this.readLength(n);if(r===1){let i=this.readLength(n);return typeof i=="bigint"?-1n-i:-1-i}if(r===2){let i=this.lengthAsNumber(this.readLength(n));return this.readBytes(i)}if(r===3){let i=this.lengthAsNumber(this.readLength(n));return w(this.readBytes(i))}if(r===4){let i=this.lengthAsNumber(this.readLength(n)),s=[];for(let a=0;a<i;a+=1)s.push(this.readValue());return s}if(r===5){let i=this.lengthAsNumber(this.readLength(n)),s=new Map;for(let a=0;a<i;a+=1)s.set(this.readValue(),this.readValue());return s}if(r===6)return this.readLength(n),this.readValue();if(r===7){if(n===20)return!1;if(n===21)return!0;if(n===22)return null}throw new Error(`Unsupported CBOR major/additional type: ${r}/${n}`)}readIndefiniteValue(t){if(t===2){let r=[];for(;!this.consumeBreak();){let n=this.readValue();if(!(n instanceof Uint8Array))throw new Error("Indefinite CBOR byte string chunk must be a byte string");r.push(n)}return b(r)}if(t===3){let r="";for(;!this.consumeBreak();){let n=this.readValue();if(typeof n!="string")throw new Error("Indefinite CBOR text string chunk must be a text string");r+=n}return r}if(t===4){let r=[];for(;!this.consumeBreak();)r.push(this.readValue());return r}if(t===5){let r=new Map;for(;!this.consumeBreak();){let n=this.readValue();if(this.peekBreak())throw new Error("Indefinite CBOR map ended after a key");r.set(n,this.readValue())}return r}throw new Error(`Indefinite CBOR major type ${t} is not supported`)}readLength(t){if(t<24)return t;if(t===24)return this.readByte();if(t===25)return this.readByte()<<8|this.readByte();if(t===26)return this.readByte()*16777216+(this.readByte()<<16)+(this.readByte()<<8)+this.readByte()>>>0;if(t===27){let r=0n;for(let n=0;n<8;n+=1)r=r<<8n|BigInt(this.readByte());return r<=BigInt(Number.MAX_SAFE_INTEGER)?Number(r):r}throw new Error("Indefinite CBOR lengths are not supported")}readByte(){if(this.offset>=this.bytes.length)throw new Error("Unexpected end of CBOR input");return this.bytes[this.offset++]}peekBreak(){return this.offset<this.bytes.length&&this.bytes[this.offset]===255}consumeBreak(){return this.peekBreak()?(this.offset+=1,!0):!1}readBytes(t){if(this.offset+t>this.bytes.length)throw new Error("Unexpected end of CBOR byte string");let r=this.bytes.slice(this.offset,this.offset+t);return this.offset+=t,r}lengthAsNumber(t){if(typeof t=="bigint")throw new Error("CBOR length exceeds JavaScript safe integer range");return t}};function Re(e){let t=e[0]===210?e.slice(1):e,r;try{r=v(t)}catch(u){o("COSE_STRUCTURE_INVALID","Attestation document is not a valid COSE_Sign1 CBOR value",{cause:u})}(!Array.isArray(r)||r.length!==4)&&o("COSE_STRUCTURE_INVALID","COSE_Sign1 must be [protected, unprotected, payload, signature]");let[n,i,s,a]=r;return(!(n instanceof Uint8Array)||!(i instanceof Map)||!(s instanceof Uint8Array)||!(a instanceof Uint8Array))&&o("COSE_STRUCTURE_INVALID","COSE_Sign1 fields have invalid CBOR types"),mt(n),a.length!==96&&o("COSE_SIGNATURE_INVALID_SIZE",`Expected a 96-byte ES384 signature, got ${a.length} bytes`),{protectedHeadersBytes:n,payloadBytes:s,signature:a}}async function Ne(e){let t=Ce(e.protectedHeadersBytes,e.payloadBytes);await S(e.subtle.verify({name:"ECDSA",hash:"SHA-384"},e.leafPublicKey,e.signature,t),"COSE_SIGNATURE_VERIFY_FAILED","COSE_Sign1 signature verification failed")||o("COSE_SIGNATURE_VERIFY_FAILED","COSE_Sign1 signature does not verify with the attestation leaf certificate")}function mt(e){let t;try{t=v(e)}catch(r){o("COSE_STRUCTURE_INVALID","COSE protected headers are not a valid CBOR map",{cause:r})}t instanceof Map||o("COSE_STRUCTURE_INVALID","COSE protected headers must be a CBOR map"),t.get(1)!==-35&&o("COSE_ALG_UNSUPPORTED","COSE protected header alg must be -35 (ES384)")}var re=96;function I(e,t){let r=e.replace(/^0x/i,"").toLowerCase();return(r.length!==re||!/^[0-9a-f]+$/.test(r))&&o("TRUST_PIN_REQUIRED",`${t} must be ${re} lowercase hex characters`),r}function _e(e,t){let r=I(e,t);return e!==r&&o("ATTESTATION_RESPONSE_INVALID",`${t} must be ${re} lowercase hex characters`),r}var Ue=256*1024,At=3,Tt=150,St=/^0x[0-9a-fA-F]{40}$/;function gt(e,t){let r=new URL(e),n=r.pathname.replace(/\/+$/,"");return r.pathname=n.endsWith("/attestation")?n:`${n}/attestation`,r.search="",r.searchParams.set("nonce",t),r}async function De(e){let t=gt(e.attestationServiceUrl,e.nonceHex),r=await ht(t.toString(),e.fetch,e.timeoutMs),n=await It(r);r.ok||o("ATTESTATION_FETCH_FAILED",`GET /attestation failed with HTTP ${r.status}`,{details:{status:r.status,body:n.slice(0,400)}});let i;try{i=JSON.parse(n)}catch(s){o("ATTESTATION_RESPONSE_INVALID","GET /attestation returned non-JSON response",{cause:s})}return Et(i)}function Et(e){(!Me(e)||e.success!==!0||!Me(e.responseObject))&&o("ATTESTATION_RESPONSE_INVALID","Expected { success: true, responseObject: {...} }");let t=e.responseObject;(typeof t.attestationDocument!="string"||typeof t.nonce!="string")&&o("ATTESTATION_RESPONSE_INVALID","Attestation response is missing attestationDocument or nonce");let r;try{r=Te(t.attestationDocument)}catch(n){o("ATTESTATION_RESPONSE_INVALID","attestationDocument is not valid base64",{cause:n})}return r.length===0&&o("ATTESTATION_RESPONSE_INVALID","attestationDocument decoded to empty bytes"),{attestationDocument:r,nonce:t.nonce.toLowerCase(),advertised:{chainId:typeof t.chainId=="number"?t.chainId:void 0,verifyingContract:Oe(t.verifyingContract,"verifyingContract"),expectedSigner:Oe(t.expectedSigner,"expectedSigner"),expectedPcr8:Pt(t.expectedPcr8,"expectedPcr8")}}}async function It(e){if(!e.body){let i=await e.text();return we(x(i).length),i}let t=e.body.getReader(),r=[],n=0;for(;;){let{done:i,value:s}=await t.read();if(i)break;s&&(n+=s.length,we(n),r.push(s))}return w(b(r))}function we(e){e>Ue&&o("ATTESTATION_RESPONSE_INVALID","GET /attestation response exceeded maximum size",{details:{maxBytes:Ue,actualBytes:e}})}function Oe(e,t){if(e!==void 0)return(typeof e!="string"||!St.test(e))&&o("ATTESTATION_RESPONSE_INVALID",`${t} must be a 0x-prefixed 20-byte hex address`),e.toLowerCase()}function Pt(e,t){if(e!==void 0){typeof e!="string"&&o("ATTESTATION_RESPONSE_INVALID",`${t} must be a 96-character lowercase hex string`);try{return _e(e,t)}catch(r){o("ATTESTATION_RESPONSE_INVALID",`${t} must be a 96-character lowercase hex string`,{cause:r})}}}async function ht(e,t,r){let n=1;for(;;)try{return await xt(e,t,r)}catch(i){if(!bt(i)||n>=At)throw i;await Ct(Tt*n),n+=1}}async function xt(e,t,r){let n=typeof AbortController<"u"?new AbortController:void 0,i,s=new Promise((a,u)=>{i=setTimeout(()=>{n?.abort(),u(new Error("timeout"))},r)});try{let a=await Promise.race([t(e,{headers:{accept:"application/json"},signal:n?.signal}),s]);return i!==void 0&&clearTimeout(i),a}catch(a){i!==void 0&&clearTimeout(i),a instanceof Error&&(a.name==="AbortError"||a.message==="timeout")&&o("TIMEOUT",`GET /attestation timed out after ${r}ms`,{cause:a}),o("ATTESTATION_FETCH_FAILED","GET /attestation failed at the network layer",{cause:a,details:{layer:"network"}})}}function bt(e){return e instanceof U&&e.code==="ATTESTATION_FETCH_FAILED"&&e.details?.layer==="network"}function Ct(e){return new Promise(t=>setTimeout(t,e))}function Me(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}var Rt=32;function Ve(e){return g(e(new Uint8Array(Rt)))}function ve(e,t){e.toLowerCase()!==t&&o("ATTESTATION_NONCE_MISMATCH","Attestation service echoed a different nonce",{details:{expectedNonce:t,echoedNonce:e}})}function He(e){let t;try{t=v(e)}catch(s){o("PAYLOAD_FIELD_MISSING","Attestation payload is not a valid CBOR map",{cause:s})}let r=Be(t,"payload"),n=Be(r.get("pcrs"),"pcrs"),i=B(r.get("user_data"),"user_data");return{timestampMs:Nt(r.get("timestamp")),nonceHex:w(i),pcr0Hex:ne(n,0),pcr1Hex:ne(n,1),pcr2Hex:ne(n,2),pcr8Hex:g(B(n.get(8),"pcrs[8]")),certificateDer:B(r.get("certificate"),"certificate"),cabundleDer:_t(r.get("cabundle"),"cabundle").map((s,a)=>B(s,`cabundle[${a}]`)),publicKeyDer:B(r.get("public_key"),"public_key")}}function ne(e,t){let r=e.get(t);return r instanceof Uint8Array?g(r):""}function Nt(e){if(typeof e=="number"&&Number.isSafeInteger(e)&&e>=0)return e;o("PAYLOAD_FIELD_MISSING","Attestation payload timestamp must be an unsigned safe integer")}function Be(e,t){if(e instanceof Map)return e;o("PAYLOAD_FIELD_MISSING",`Attestation payload field ${t} must be a CBOR map`)}function B(e,t){if(e instanceof Uint8Array)return e;o("PAYLOAD_FIELD_MISSING",`Attestation payload field ${t} must be a byte string`)}function _t(e,t){if(Array.isArray(e))return e;o("PAYLOAD_FIELD_MISSING",`Attestation payload field ${t} must be an array`)}var Ut="https://attestation-service-staging.zkp2p.xyz",wt="https://attestation-service.zkp2p.xyz";var Le="5636e3bd96f847cf12cfd9de7faa8cad0e6fa00962ce16ba185f8e5ea57105abb3cc9cc34f1e1e4de3444ceabcca7485",ie="41a4ae0b9b96752cab5addb7d22689b3070e564e29f90a54316fa33fa38ea51387a6e887ea4f5a4b0cc34f69cea3f40e",Fe={"attestation-service-staging.zkp2p.xyz":I(Le,"bundled staging PCR8"),"attestation-service-preprod.zkp2p.xyz":I(ie,"bundled production PCR8"),"attestation-service.zkp2p.xyz":I(ie,"bundled production PCR8")},ke={staging:{attestationServiceUrl:Ut,expectedPcr8Hex:Le},production:{attestationServiceUrl:wt,expectedPcr8Hex:ie}};function We(e){let{trust:t,advertisedExpectedPcr8:r,onWarning:n}=e,i=e.hostname.toLowerCase();if(t?.expectedPcr8Hex)return I(t.expectedPcr8Hex,"trust.expectedPcr8Hex");let s=t?.expectedPcr8ByHost,a=s?Ot(s,i):void 0;if(a)return I(a,`trust.expectedPcr8ByHost[${i}]`);let u=Fe[i];if(u)return u;if(t?.strictPin===!0&&o("TRUST_PIN_REQUIRED",`No trusted PCR8 pin is configured for ${i}`),r){let l=I(r,"service-advertised expectedPcr8");return n?.({code:"TRUST_PIN_NOT_PROVIDED",message:`No caller or bundled PCR8 pin was available for ${i}; falling back to service-advertised expectedPcr8`,details:{hostname:i,expectedPcr8:l}}),l}o("TRUST_PIN_REQUIRED",`No trusted or service-advertised PCR8 pin is available for ${i}`)}function Ot(e,t){for(let[r,n]of Object.entries(e))if(r.toLowerCase()===t)return n}var Mt=300*1e3;async function P(e){let t=Y(e.fetch),r=h(e),n=e.now??Date.now,i=Ve(r.getRandomValues),s=await De({attestationServiceUrl:e.attestationServiceUrl,nonceHex:i,fetch:t,timeoutMs:e.timeoutMs??1e4});ve(s.nonce,i);let{protectedHeadersBytes:a,payloadBytes:u,signature:l}=Re(s.attestationDocument),c=He(u);c.nonceHex!==i&&o("NONCE_BINDING_FAILED","Attestation payload user_data did not match the request nonce",{details:{expectedNonce:i,payloadNonce:c.nonceHex}});let d=e.trust?.freshnessWindowMs??Mt,f=n();Math.abs(f-c.timestampMs)>d&&o("FRESHNESS_CHECK_FAILED",`Attestation timestamp skew exceeds ${d}ms`,{details:{timestampMs:c.timestampMs,nowMs:f,freshnessWindowMs:d}});let T=new URL(e.attestationServiceUrl).hostname,p=We({trust:e.trust,hostname:T,advertisedExpectedPcr8:s.advertised.expectedPcr8,onWarning:e.onWarning});c.pcr8Hex!==p&&o("PCR8_PIN_MISMATCH","Attestation PCR8 does not match the trusted pin",{details:{expectedPcr8:p,actualPcr8:c.pcr8Hex}});let{leafPublicKey:Ze}=await be({leafCertificateDer:c.certificateDer,cabundleDer:c.cabundleDer,rootPem:e.trust?.awsNitroRootPem,nowMs:f,subtle:r.subtle,getRandomValues:r.getRandomValues,onWarning:e.onWarning});return await Ne({protectedHeadersBytes:a,payloadBytes:u,signature:l,leafPublicKey:Ze,subtle:r.subtle}),{attestedSellerUploadKey:{publicKeyDer:c.publicKeyDer,publicKeySha256Hex:g(new Uint8Array(await r.subtle.digest("SHA-256",E(c.publicKeyDer))))},payload:{timestampMs:c.timestampMs,pcr0Hex:c.pcr0Hex,pcr1Hex:c.pcr1Hex,pcr2Hex:c.pcr2Hex,pcr8Hex:c.pcr8Hex,nonceHex:c.nonceHex,advertised:s.advertised}}}async function H(e){let t=await P({attestationServiceUrl:e.attestationServiceUrl,trust:e.trust,fetch:e.fetch,subtle:e.subtle,getRandomValues:e.getRandomValues,now:e.now,onWarning:e.onWarning,timeoutMs:e.timeoutMs});return V({...e,key:t.attestedSellerUploadKey})}async function L(e){let t=h(e);return xe({request:e,subtle:t.subtle,getRandomValues:t.getRandomValues})}async function F(e){let t=await P({attestationServiceUrl:e.attestationServiceUrl,trust:e.trust,fetch:e.fetch,subtle:e.subtle,getRandomValues:e.getRandomValues,now:e.now,onWarning:e.onWarning,timeoutMs:e.timeoutMs});return L({key:t.attestedSellerUploadKey,platform:e.platform,actionType:e.actionType,sessionMaterial:e.sessionMaterial,subtle:e.subtle,getRandomValues:e.getRandomValues})}async function k(e){let t=h(e);return Pe({request:e,subtle:t.subtle,getRandomValues:t.getRandomValues,now:e.now??Date.now})}async function W(e){let{attestationServiceUrl:t,trust:r,fetch:n,onWarning:i,timeoutMs:s,...a}=e,u=await P({attestationServiceUrl:t,trust:r,fetch:n,subtle:e.subtle,getRandomValues:e.getRandomValues,now:e.now,onWarning:i,timeoutMs:s});return k({...a,key:u.attestedSellerUploadKey})}var Dt=400;async function M(e){let t=Y(e.fetch),r=e.timeoutMs??1e4,n=new AbortController,i,s=new Promise((c,d)=>{i=setTimeout(()=>{n.abort(),d(new Error("timeout"))},r)}),a,u;try{a=await Promise.race([t(Ht(e.attestationServiceUrl,e.path),{method:"POST",headers:{accept:"application/json","content-type":"application/json"},body:JSON.stringify(e.body),signal:n.signal}),s]),u=await Promise.race([a.text(),s])}catch(c){n.signal.aborted&&o("TIMEOUT",`${e.failureContext} timed out after ${r}ms`,{cause:c}),o("ATTESTATION_FETCH_FAILED",`${e.failureContext} failed at the network layer`,{cause:c})}finally{clearTimeout(i)}if(!a.ok){let c=Vt(u);c?.success===!1&&Ye(e.failureContext,a.status,c),o("ATTESTATION_FETCH_FAILED",`${e.failureContext} failed with HTTP ${a.status}`,{details:{status:a.status,body:u.slice(0,400)}})}let l;try{l=JSON.parse(u)}catch(c){o("ATTESTATION_RESPONSE_INVALID",`${e.failureContext} returned a non-JSON ServiceResponse`,{cause:c})}return l.success!==!0&&(l.success===!1&&Ye(e.failureContext,a.status,l),o("ATTESTATION_RESPONSE_INVALID",`${e.failureContext} returned an unsuccessful ServiceResponse`)),vt(l.responseObject)||o("ATTESTATION_RESPONSE_INVALID",`${e.failureContext} returned a ServiceResponse without responseObject`,{details:{status:a.status,envelopeSnippet:Bt(l)}}),l.responseObject}function Vt(e){try{return JSON.parse(e)}catch{return}}function Ye(e,t,r){let n={status:t,statusCode:r.statusCode,message:r.message,responseObject:r.responseObject};o("SERVICE_RESPONSE_ERROR",`${e} returned an unsuccessful ServiceResponse`,{details:n})}function vt(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function Bt(e){return JSON.stringify(e).slice(0,Dt)}function Ht(e,t){let r=new URL(e);return r.pathname=`${r.pathname.replace(/\/+$/u,"")}${t}`,r.search="",r.toString()}async function se(e){let t=await F({attestationServiceUrl:e.attestationServiceUrl,trust:e.trust,fetch:e.fetch,subtle:e.subtle,getRandomValues:e.getRandomValues,now:e.now,onWarning:e.onWarning,timeoutMs:e.timeoutMs,platform:e.platform,actionType:e.actionType,sessionMaterial:e.sessionMaterial});return M({attestationServiceUrl:e.attestationServiceUrl,path:"/identity",fetch:e.fetch,failureContext:"POST /identity",timeoutMs:e.timeoutMs,body:{platform:e.platform,actionType:e.actionType,callerAddress:e.callerAddress,encryptedSessionMaterial:t,params:e.params}})}async function ae(e){let t=await W(e);return M({attestationServiceUrl:e.attestationServiceUrl,path:`/seller/credentials/${encodeURIComponent(e.platform)}`,fetch:e.fetch,failureContext:"POST /seller/credentials",timeoutMs:e.timeoutMs,body:{encryptedUpload:t}})}async function ce(e){let t=await H(e);return M({attestationServiceUrl:e.attestationServiceUrl,path:`/buyer/verify/${encodeURIComponent(e.platform)}/${encodeURIComponent(e.actionType)}`,fetch:e.fetch,failureContext:"POST /buyer/verify",timeoutMs:e.timeoutMs,body:{encryptedSessionMaterial:t,params:e.params,chainId:e.chainId,intent:e.intent}})}function Lt(e){let t=ke[e.environment],r=e.attestationServiceUrl??t.attestationServiceUrl,n=R({strictPin:!0},e.trust);return{createEncryptedBuyerTeeSessionMaterial:i=>{let{attestationServiceUrl:s,trust:a,fetch:u,subtle:l,getRandomValues:c,now:d,onWarning:f,timeoutMs:T,...p}=i;return H({...p,attestationServiceUrl:s??r,trust:R(n,a),fetch:u??e.fetch,subtle:l??e.subtle,getRandomValues:c??e.getRandomValues,now:d??e.now,onWarning:f??e.onWarning,timeoutMs:T??e.timeoutMs})},createEncryptedIdentitySessionMaterial:i=>{let{attestationServiceUrl:s,trust:a,fetch:u,subtle:l,getRandomValues:c,now:d,onWarning:f,timeoutMs:T,...p}=i;return F({...p,attestationServiceUrl:s??r,trust:R(n,a),fetch:u??e.fetch,subtle:l??e.subtle,getRandomValues:c??e.getRandomValues,now:d??e.now,onWarning:f??e.onWarning,timeoutMs:T??e.timeoutMs})},createEncryptedSellerCredentialUpload:i=>{let{attestationServiceUrl:s,trust:a,fetch:u,subtle:l,getRandomValues:c,now:d,onWarning:f,timeoutMs:T,...p}=i;return W({...p,attestationServiceUrl:s??r,trust:R(n,a),fetch:u??e.fetch,subtle:l??e.subtle,getRandomValues:c??e.getRandomValues,now:d??e.now,onWarning:f??e.onWarning,timeoutMs:T??e.timeoutMs})},requestIdentityAttestation:i=>se({attestationServiceUrl:i.attestationServiceUrl??r,trust:R(n,i.trust),fetch:i.fetch??e.fetch,subtle:i.subtle??e.subtle,getRandomValues:i.getRandomValues??e.getRandomValues,now:i.now??e.now,onWarning:i.onWarning??e.onWarning,timeoutMs:i.timeoutMs??e.timeoutMs,platform:i.platform,actionType:i.actionType,callerAddress:i.callerAddress,sessionMaterial:i.sessionMaterial,params:i.params}),uploadSellerCredential:i=>{let{attestationServiceUrl:s,trust:a,fetch:u,subtle:l,getRandomValues:c,now:d,onWarning:f,timeoutMs:T,...p}=i;return ae({...p,attestationServiceUrl:s??r,trust:R(n,a),fetch:u??e.fetch,subtle:l??e.subtle,getRandomValues:c??e.getRandomValues,now:d??e.now,onWarning:f??e.onWarning,timeoutMs:T??e.timeoutMs})},verifyBuyerTeePayment:i=>{let s={attestationServiceUrl:i.attestationServiceUrl??r,trust:R(n,i.trust),fetch:i.fetch??e.fetch,subtle:i.subtle??e.subtle,getRandomValues:i.getRandomValues??e.getRandomValues,now:i.now??e.now,onWarning:i.onWarning??e.onWarning,timeoutMs:i.timeoutMs??e.timeoutMs,platform:i.platform,actionType:i.actionType,sessionMaterial:i.sessionMaterial,params:i.params,chainId:i.chainId,intent:i.intent};return ce(s)},fetchAndVerifyAttestation:(i={})=>P({attestationServiceUrl:i.attestationServiceUrl??r,trust:R(n,i.trust),fetch:i.fetch??e.fetch,subtle:i.subtle??e.subtle,getRandomValues:i.getRandomValues??e.getRandomValues,now:i.now??e.now,onWarning:i.onWarning??e.onWarning,timeoutMs:i.timeoutMs??e.timeoutMs}),encryptBuyerTeeSessionMaterial:({subtle:i,getRandomValues:s,...a})=>V({...a,subtle:i??e.subtle,getRandomValues:s??e.getRandomValues}),encryptIdentitySessionMaterial:({subtle:i,getRandomValues:s,...a})=>L({...a,subtle:i??e.subtle,getRandomValues:s??e.getRandomValues}),encryptSellerCredentialUpload:({subtle:i,getRandomValues:s,now:a,...u})=>k({...u,subtle:i??e.subtle,getRandomValues:s??e.getRandomValues,now:a??e.now})}}function R(e,t){return t?{...e,...t,expectedPcr8ByHost:{...e.expectedPcr8ByHost,...t.expectedPcr8ByHost}}:e}import{concat as Ft,getAddress as Ge,keccak256 as ue,recoverAddress as kt,TypedDataEncoder as le,toUtf8Bytes as Wt,verifyTypedData as Yt}from"ethers";var Gt={name:"UnifiedPaymentVerifier",version:"1"},de={PaymentAttestation:[{name:"intentHash",type:"bytes32"},{name:"releaseAmount",type:"uint256"},{name:"dataHash",type:"bytes32"}]},$t="PaymentAttestation(bytes32 intentHash,uint256 releaseAmount,bytes32 dataHash)",$e=m($t),fe={name:"ZKP2PIdentityVerifier",version:"1"},ye={IdentityAttestation:[{name:"method",type:"bytes32"},{name:"actionType",type:"bytes32"},{name:"callerAddress",type:"address"},{name:"payeeIdHash",type:"bytes32"},{name:"dataHash",type:"bytes32"},{name:"issuedAt",type:"uint256"},{name:"validUntil",type:"uint256"}]},Kt="IdentityAttestation(bytes32 method,bytes32 actionType,address callerAddress,bytes32 payeeIdHash,bytes32 dataHash,uint256 issuedAt,uint256 validUntil)",Ke=m(Kt),qe=le.hashDomain(fe).toLowerCase(),je={name:"ZKP2P Seller Credential Bundle",version:"1"},ze={SellerCredentialBundle:[{name:"platform",type:"string"},{name:"payeeIdHash",type:"bytes32"},{name:"encryptedBlobHash",type:"bytes32"},{name:"encryptedDataKeyHash",type:"bytes32"},{name:"nonceHash",type:"bytes32"},{name:"credentialType",type:"string"},{name:"credentialValidatedAt",type:"string"},{name:"credentialExpiresAt",type:"string"}]};function qt(e){return{...Gt,chainId:e.chainId,verifyingContract:Ge(e.verifyingContract)}}function pe(e){return le.hashDomain(qt(e)).toLowerCase()}function m(e){return ue(Wt(e)).toLowerCase()}function Xe(e){return ue(e).toLowerCase()}function Qe(e){try{let t=le.from(e.types).hash(e.value),r=ue(Ft(["0x1901",e.domainSeparator,t]));return N(kt(r,e.signature))}catch(t){o("ATTESTATION_SIGNATURE_INVALID","Unable to recover signer from attestation signature",{cause:t})}}function j(e){try{return N(Yt(e.domain,e.types,e.value,e.signature))}catch(t){o("ATTESTATION_SIGNATURE_INVALID","Unable to verify attestation signature",{cause:t})}}function me(e,t){let r=N(e),n=new Set(t.map(i=>N(i)));return n.has(r)||o("SIGNER_NOT_TRUSTED","Recovered signer is not in trustedSigners",{details:{recoveredSigner:r,trustedSigners:Array.from(n)}}),r}function z(e){let t=me(e.recoveredSigner,e.trustedSigners),r=N(e.payloadSigner);return r!==t&&o("ATTESTATION_SIGNATURE_INVALID","Payload signer does not match the recovered signer",{details:{payloadSigner:r,recoveredSigner:t}}),t}function y(e,t,r){e.toLowerCase()!==t.toLowerCase()&&o("ATTESTATION_BINDING_MISMATCH",`${r} did not match expected value`,{details:{actual:e,expected:t}})}function Je(e,t,r){let n,i;try{n=N(e),i=N(t)}catch(s){o("INVALID_PARAMETER",`${r} must be a valid Ethereum address`,{cause:s})}n!==i&&o("ATTESTATION_BINDING_MISMATCH",`${r} did not match expected value`,{details:{actual:e,expected:t}})}function A(e,t,r){e!==t&&o("ATTESTATION_BINDING_MISMATCH",`${r} did not match expected value`,{details:{actual:e,expected:t}})}function X(e,t){JSON.stringify(e)!==JSON.stringify(t)&&o("ATTESTATION_BINDING_MISMATCH","typedDataSpec.types did not match the expected EIP-712 types")}function _(e,t){return typeof e!="string"&&o("INVALID_PARAMETER",`${t} is required`),e}function N(e){return Ge(e).toLowerCase()}function jt(e,t){A(e.platform,t.expectedPlatform,"platform"),A(e.actionType,t.expectedActionType,"actionType"),A(e.typedDataSpec.primaryType,"PaymentAttestation","typedDataSpec.primaryType"),X(e.typedDataSpec.types,de),y(e.typeHash,$e,"typeHash"),y(e.domainSeparator,pe(t.expectedDomain),"domainSeparator"),y(Xe(e.encodedPaymentDetails),e.typedDataValue.dataHash,"encodedPaymentDetails"),y(e.typedDataValue.intentHash,_(t.expectedIntentHash,"expectedIntentHash"),"typedDataValue.intentHash");let r=Qe({domainSeparator:e.domainSeparator,types:de,value:{...e.typedDataValue},signature:e.signature});return z({payloadSigner:e.signer,recoveredSigner:r,trustedSigners:t.trustedSigners}),e}var zt=["platform","actionType","payeeId","username","metadata"];function Xt(e,t){A(e.platform,t.expectedPlatform,"platform"),A(e.actionType,t.expectedActionType,"actionType"),A(e.identity.platform,e.platform,"identity.platform"),A(e.identity.actionType,e.actionType,"identity.actionType"),A(e.typedDataSpec.primaryType,"IdentityAttestation","typedDataSpec.primaryType"),X(e.typedDataSpec.types,ye),y(e.domainSeparator,qe,"domainSeparator"),y(e.typeHash,Ke,"typeHash"),y(e.identity.method,m(e.identity.platform),"identity.method"),y(e.identity.payeeIdHash,m(e.identity.payeeId),"identity.payeeIdHash"),y(e.typedDataValue.method,e.identity.method,"typedDataValue.method"),y(e.typedDataValue.actionType,m(e.identity.actionType),"typedDataValue.actionType"),Je(e.typedDataValue.callerAddress,_(t.expectedCallerAddress,"expectedCallerAddress"),"typedDataValue.callerAddress"),y(e.typedDataValue.payeeIdHash,e.identity.payeeIdHash,"typedDataValue.payeeIdHash"),y(e.typedDataValue.payeeIdHash,_(t.expectedPayeeIdHash,"expectedPayeeIdHash"),"typedDataValue.payeeIdHash"),y(e.typedDataValue.dataHash,Qt(e.identity),"typedDataValue.dataHash"),Zt(e.typedDataValue.validUntil,t.now??Date.now);let r=j({domain:fe,types:ye,value:{...e.typedDataValue},signature:e.signature});return z({payloadSigner:e.signer,recoveredSigner:r,trustedSigners:t.trustedSigners}),e.identity}function Qt(e){let t={platform:e.platform,actionType:e.actionType,payeeId:e.payeeId,username:e.username,metadata:Jt(e.metadata)},r=JSON.stringify(Object.fromEntries(zt.map(n=>[n,t[n]])));return m(r)}function Jt(e){return Object.fromEntries(Object.entries(e).sort(([t],[r])=>t.localeCompare(r)))}function Zt(e,t){let r=t();BigInt(r)>BigInt(e)&&o("ATTESTATION_EXPIRED","Identity attestation validUntil is in the past",{details:{validUntil:e,nowMs:r}})}function er(e,t){A(e.platform,t.expectedPlatform,"platform"),y(e.payeeIdHash,_(t.expectedPayeeIdHash,"expectedPayeeIdHash"),"payeeIdHash"),rr(e.credentialExpiresAt,t.now??Date.now);let r=j({domain:je,types:ze,value:tr(e),signature:e.bundleSignature});return me(r,t.trustedSigners),e}function tr(e){return{platform:e.platform,payeeIdHash:e.payeeIdHash,encryptedBlobHash:m(e.encryptedBlob),encryptedDataKeyHash:m(e.encryptedDataKey),nonceHash:m(e.nonce),credentialType:e.credentialType,credentialValidatedAt:e.credentialValidatedAt,credentialExpiresAt:e.credentialExpiresAt??""}}function rr(e,t){let r=t();e!==null&&BigInt(r)>BigInt(e)&&o("ATTESTATION_EXPIRED","Seller credential bundle credentialExpiresAt is in the past",{details:{credentialExpiresAt:e,nowMs:r}})}export{K as AWS_NITRO_ROOT_FINGERPRINT_SHA256_HEX,J as AWS_NITRO_ROOT_PEM,U as NitroAttestationError,H as createEncryptedBuyerTeeSessionMaterial,F as createEncryptedIdentitySessionMaterial,W as createEncryptedSellerCredentialUpload,Lt as createNitroAttestationClient,V as encryptBuyerTeeSessionMaterial,L as encryptIdentitySessionMaterial,k as encryptSellerCredentialUpload,P as fetchAndVerifyAttestation,pe as getUnifiedPaymentVerifierDomainSeparator,m as hashUtf8,se as requestIdentityAttestation,ae as uploadSellerCredential,ce as verifyBuyerTeePayment,jt as verifyBuyerTeePaymentAttestation,Xt as verifyIdentityAttestation,er as verifySellerCredentialBundle};
|
|
15
|
+
`,K="641a0321a3e244efe456463195d606317ed7cdcc3c1756e09893f3c68f79bb5b";var dt=10080*60*1e3;async function xe(e){let t=me(e.subtle,e.getRandomValues),r=Z(e.rootPem??J,"AWS Nitro root certificate"),n=await ee(r,e.subtle);n!==K&&o("AWS_ROOT_FINGERPRINT_MISMATCH","Bundled AWS Nitro root certificate fingerprint mismatch",{details:{expected:K,actual:n}});let i=Z(e.leafCertificateDer,"attestation leaf certificate"),a=e.cabundleDer.map((d,f)=>Z(d,`cabundle[${f}]`)),s=[r,...a,i];for(let d of s)yt(d,e.nowMs),pt(d,e.nowMs,e.onWarning);let u=await ee(i,e.subtle),l=[];for(let d of a){let f=await ee(d,e.subtle);f!==u&&f!==n&&l.push(d)}let c=[[i,...l.slice().reverse(),r],[i,...l,r]];for(let d of c)if(await ft(d,t)){let f=await S(i.publicKey.export({name:"ECDSA",namedCurve:"P-384"},["verify"],t),"CERT_CHAIN_INVALID","Failed to export attestation leaf public key");return{leafCertificate:i,leafPublicKey:f}}o("CERT_CHAIN_INVALID","Attestation certificate chain does not verify to the pinned AWS Nitro root")}async function ft(e,t){for(let r=0;r<e.length-1;r+=1){let n=e[r],i=e[r+1];if(!await n.verify({publicKey:i.publicKey,signatureOnly:!0},t))return!1}return e.length>0&&await e[e.length-1].isSelfSigned(t)}function Z(e,t){try{return new lt(e)}catch(r){o("CERT_CHAIN_INVALID",`Could not parse ${t}`,{cause:r})}}async function ee(e,t){return g(new Uint8Array(await t.digest("SHA-256",e.rawData)))}function yt(e,t){(t<e.notBefore.getTime()||t>e.notAfter.getTime())&&o("CERT_NOT_TIME_VALID","Certificate is outside its validity window",{details:{subject:e.subject,notBefore:e.notBefore.toISOString(),notAfter:e.notAfter.toISOString()}})}function pt(e,t,r){e.notAfter.getTime()<t+dt&&r?.({code:"CERT_VALIDITY_NEAR_EXPIRY",message:"Certificate in Nitro attestation chain expires within 7 days",details:{subject:e.subject,notAfter:e.notAfter.toISOString()}})}function v(e){let t=new te(e),r=t.readValue();if(!t.done())throw new Error("Trailing CBOR bytes");return r}function q(e){if(typeof e=="number"){if(!Number.isSafeInteger(e))throw new Error("CBOR number must be a safe integer");return e>=0?C(0,e):C(1,-1-e)}if(typeof e=="bigint")return e>=0n?C(0,e):C(1,-1n-e);if(typeof e=="string"){let t=x(e);return b([C(3,t.length),t])}if(e instanceof Uint8Array)return b([C(2,e.length),e]);if(Array.isArray(e))return b([C(4,e.length),...e.map(q)]);if(e instanceof Map)return b([C(5,e.size),...Array.from(e.entries()).flatMap(([t,r])=>[q(t),q(r)])]);if(typeof e=="boolean")return new Uint8Array([e?245:244]);if(e===null)return new Uint8Array([246]);throw new Error("Unsupported CBOR value")}function be(e,t){return q(["Signature1",e,new Uint8Array,t])}function C(e,t){let r=BigInt(t);return r<24n?new Uint8Array([e<<5|Number(r)]):r<=0xffn?new Uint8Array([e<<5|24,Number(r)]):r<=0xffffn?new Uint8Array([e<<5|25,Number(r>>8n&0xffn),Number(r&0xffn)]):r<=0xffffffffn?new Uint8Array([e<<5|26,Number(r>>24n&0xffn),Number(r>>16n&0xffn),Number(r>>8n&0xffn),Number(r&0xffn)]):new Uint8Array([e<<5|27,Number(r>>56n&0xffn),Number(r>>48n&0xffn),Number(r>>40n&0xffn),Number(r>>32n&0xffn),Number(r>>24n&0xffn),Number(r>>16n&0xffn),Number(r>>8n&0xffn),Number(r&0xffn)])}var te=class{constructor(t){this.bytes=t}bytes;offset=0;done(){return this.offset===this.bytes.length}readValue(){let t=this.readByte(),r=t>>5,n=t&31;if(n===31)return this.readIndefiniteValue(r);if(r===0)return this.readLength(n);if(r===1){let i=this.readLength(n);return typeof i=="bigint"?-1n-i:-1-i}if(r===2){let i=this.lengthAsNumber(this.readLength(n));return this.readBytes(i)}if(r===3){let i=this.lengthAsNumber(this.readLength(n));return w(this.readBytes(i))}if(r===4){let i=this.lengthAsNumber(this.readLength(n)),a=[];for(let s=0;s<i;s+=1)a.push(this.readValue());return a}if(r===5){let i=this.lengthAsNumber(this.readLength(n)),a=new Map;for(let s=0;s<i;s+=1)a.set(this.readValue(),this.readValue());return a}if(r===6)return this.readLength(n),this.readValue();if(r===7){if(n===20)return!1;if(n===21)return!0;if(n===22)return null}throw new Error(`Unsupported CBOR major/additional type: ${r}/${n}`)}readIndefiniteValue(t){if(t===2){let r=[];for(;!this.consumeBreak();){let n=this.readValue();if(!(n instanceof Uint8Array))throw new Error("Indefinite CBOR byte string chunk must be a byte string");r.push(n)}return b(r)}if(t===3){let r="";for(;!this.consumeBreak();){let n=this.readValue();if(typeof n!="string")throw new Error("Indefinite CBOR text string chunk must be a text string");r+=n}return r}if(t===4){let r=[];for(;!this.consumeBreak();)r.push(this.readValue());return r}if(t===5){let r=new Map;for(;!this.consumeBreak();){let n=this.readValue();if(this.peekBreak())throw new Error("Indefinite CBOR map ended after a key");r.set(n,this.readValue())}return r}throw new Error(`Indefinite CBOR major type ${t} is not supported`)}readLength(t){if(t<24)return t;if(t===24)return this.readByte();if(t===25)return this.readByte()<<8|this.readByte();if(t===26)return this.readByte()*16777216+(this.readByte()<<16)+(this.readByte()<<8)+this.readByte()>>>0;if(t===27){let r=0n;for(let n=0;n<8;n+=1)r=r<<8n|BigInt(this.readByte());return r<=BigInt(Number.MAX_SAFE_INTEGER)?Number(r):r}throw new Error("Indefinite CBOR lengths are not supported")}readByte(){if(this.offset>=this.bytes.length)throw new Error("Unexpected end of CBOR input");return this.bytes[this.offset++]}peekBreak(){return this.offset<this.bytes.length&&this.bytes[this.offset]===255}consumeBreak(){return this.peekBreak()?(this.offset+=1,!0):!1}readBytes(t){if(this.offset+t>this.bytes.length)throw new Error("Unexpected end of CBOR byte string");let r=this.bytes.slice(this.offset,this.offset+t);return this.offset+=t,r}lengthAsNumber(t){if(typeof t=="bigint")throw new Error("CBOR length exceeds JavaScript safe integer range");return t}};function Ce(e){let t=e[0]===210?e.slice(1):e,r;try{r=v(t)}catch(u){o("COSE_STRUCTURE_INVALID","Attestation document is not a valid COSE_Sign1 CBOR value",{cause:u})}(!Array.isArray(r)||r.length!==4)&&o("COSE_STRUCTURE_INVALID","COSE_Sign1 must be [protected, unprotected, payload, signature]");let[n,i,a,s]=r;return(!(n instanceof Uint8Array)||!(i instanceof Map)||!(a instanceof Uint8Array)||!(s instanceof Uint8Array))&&o("COSE_STRUCTURE_INVALID","COSE_Sign1 fields have invalid CBOR types"),mt(n),s.length!==96&&o("COSE_SIGNATURE_INVALID_SIZE",`Expected a 96-byte ES384 signature, got ${s.length} bytes`),{protectedHeadersBytes:n,payloadBytes:a,signature:s}}async function Re(e){let t=be(e.protectedHeadersBytes,e.payloadBytes);await S(e.subtle.verify({name:"ECDSA",hash:"SHA-384"},e.leafPublicKey,e.signature,t),"COSE_SIGNATURE_VERIFY_FAILED","COSE_Sign1 signature verification failed")||o("COSE_SIGNATURE_VERIFY_FAILED","COSE_Sign1 signature does not verify with the attestation leaf certificate")}function mt(e){let t;try{t=v(e)}catch(r){o("COSE_STRUCTURE_INVALID","COSE protected headers are not a valid CBOR map",{cause:r})}t instanceof Map||o("COSE_STRUCTURE_INVALID","COSE protected headers must be a CBOR map"),t.get(1)!==-35&&o("COSE_ALG_UNSUPPORTED","COSE protected header alg must be -35 (ES384)")}var re=96;function I(e,t){let r=e.replace(/^0x/i,"").toLowerCase();return(r.length!==re||!/^[0-9a-f]+$/.test(r))&&o("TRUST_PIN_REQUIRED",`${t} must be ${re} lowercase hex characters`),r}function Ne(e,t){let r=I(e,t);return e!==r&&o("ATTESTATION_RESPONSE_INVALID",`${t} must be ${re} lowercase hex characters`),r}var _e=256*1024,At=3,Tt=150,St=/^0x[0-9a-fA-F]{40}$/;function gt(e,t){let r=new URL(e),n=r.pathname.replace(/\/+$/,"");return r.pathname=n.endsWith("/attestation")?n:`${n}/attestation`,r.search="",r.searchParams.set("nonce",t),r}async function Me(e){let t=gt(e.attestationServiceUrl,e.nonceHex),r=await ht(t.toString(),e.fetch,e.timeoutMs),n=await It(r);r.ok||o("ATTESTATION_FETCH_FAILED",`GET /attestation failed with HTTP ${r.status}`,{details:{status:r.status,body:n.slice(0,400)}});let i;try{i=JSON.parse(n)}catch(a){o("ATTESTATION_RESPONSE_INVALID","GET /attestation returned non-JSON response",{cause:a})}return Et(i)}function Et(e){(!Oe(e)||e.success!==!0||!Oe(e.responseObject))&&o("ATTESTATION_RESPONSE_INVALID","Expected { success: true, responseObject: {...} }");let t=e.responseObject;(typeof t.attestationDocument!="string"||typeof t.nonce!="string")&&o("ATTESTATION_RESPONSE_INVALID","Attestation response is missing attestationDocument or nonce");let r;try{r=Ae(t.attestationDocument)}catch(n){o("ATTESTATION_RESPONSE_INVALID","attestationDocument is not valid base64",{cause:n})}return r.length===0&&o("ATTESTATION_RESPONSE_INVALID","attestationDocument decoded to empty bytes"),{attestationDocument:r,nonce:t.nonce.toLowerCase(),advertised:{chainId:typeof t.chainId=="number"?t.chainId:void 0,verifyingContract:we(t.verifyingContract,"verifyingContract"),expectedSigner:we(t.expectedSigner,"expectedSigner"),expectedPcr8:Pt(t.expectedPcr8,"expectedPcr8")}}}async function It(e){if(!e.body){let i=await e.text();return Ue(x(i).length),i}let t=e.body.getReader(),r=[],n=0;for(;;){let{done:i,value:a}=await t.read();if(i)break;a&&(n+=a.length,Ue(n),r.push(a))}return w(b(r))}function Ue(e){e>_e&&o("ATTESTATION_RESPONSE_INVALID","GET /attestation response exceeded maximum size",{details:{maxBytes:_e,actualBytes:e}})}function we(e,t){if(e!==void 0)return(typeof e!="string"||!St.test(e))&&o("ATTESTATION_RESPONSE_INVALID",`${t} must be a 0x-prefixed 20-byte hex address`),e.toLowerCase()}function Pt(e,t){if(e!==void 0){typeof e!="string"&&o("ATTESTATION_RESPONSE_INVALID",`${t} must be a 96-character lowercase hex string`);try{return Ne(e,t)}catch(r){o("ATTESTATION_RESPONSE_INVALID",`${t} must be a 96-character lowercase hex string`,{cause:r})}}}async function ht(e,t,r){let n=1;for(;;)try{return await xt(e,t,r)}catch(i){if(!bt(i)||n>=At)throw i;await Ct(Tt*n),n+=1}}async function xt(e,t,r){let n=typeof AbortController<"u"?new AbortController:void 0,i,a=new Promise((s,u)=>{i=setTimeout(()=>{n?.abort(),u(new Error("timeout"))},r)});try{let s=await Promise.race([t(e,{headers:{accept:"application/json"},signal:n?.signal}),a]);return i!==void 0&&clearTimeout(i),s}catch(s){i!==void 0&&clearTimeout(i),s instanceof Error&&(s.name==="AbortError"||s.message==="timeout")&&o("TIMEOUT",`GET /attestation timed out after ${r}ms`,{cause:s}),o("ATTESTATION_FETCH_FAILED","GET /attestation failed at the network layer",{cause:s,details:{layer:"network"}})}}function bt(e){return e instanceof U&&e.code==="ATTESTATION_FETCH_FAILED"&&e.details?.layer==="network"}function Ct(e){return new Promise(t=>setTimeout(t,e))}function Oe(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}var Rt=32;function De(e){return g(e(new Uint8Array(Rt)))}function Ve(e,t){e.toLowerCase()!==t&&o("ATTESTATION_NONCE_MISMATCH","Attestation service echoed a different nonce",{details:{expectedNonce:t,echoedNonce:e}})}function Be(e){let t;try{t=v(e)}catch(a){o("PAYLOAD_FIELD_MISSING","Attestation payload is not a valid CBOR map",{cause:a})}let r=ve(t,"payload"),n=ve(r.get("pcrs"),"pcrs"),i=B(r.get("user_data"),"user_data");return{timestampMs:Nt(r.get("timestamp")),nonceHex:w(i),pcr0Hex:ne(n,0),pcr1Hex:ne(n,1),pcr2Hex:ne(n,2),pcr8Hex:g(B(n.get(8),"pcrs[8]")),certificateDer:B(r.get("certificate"),"certificate"),cabundleDer:_t(r.get("cabundle"),"cabundle").map((a,s)=>B(a,`cabundle[${s}]`)),publicKeyDer:B(r.get("public_key"),"public_key")}}function ne(e,t){let r=e.get(t);return r instanceof Uint8Array?g(r):""}function Nt(e){if(typeof e=="number"&&Number.isSafeInteger(e)&&e>=0)return e;o("PAYLOAD_FIELD_MISSING","Attestation payload timestamp must be an unsigned safe integer")}function ve(e,t){if(e instanceof Map)return e;o("PAYLOAD_FIELD_MISSING",`Attestation payload field ${t} must be a CBOR map`)}function B(e,t){if(e instanceof Uint8Array)return e;o("PAYLOAD_FIELD_MISSING",`Attestation payload field ${t} must be a byte string`)}function _t(e,t){if(Array.isArray(e))return e;o("PAYLOAD_FIELD_MISSING",`Attestation payload field ${t} must be an array`)}var Ut="https://attestation-service-staging.zkp2p.xyz",wt="https://attestation-service.zkp2p.xyz";var He="5636e3bd96f847cf12cfd9de7faa8cad0e6fa00962ce16ba185f8e5ea57105abb3cc9cc34f1e1e4de3444ceabcca7485",Le="41a4ae0b9b96752cab5addb7d22689b3070e564e29f90a54316fa33fa38ea51387a6e887ea4f5a4b0cc34f69cea3f40e",Ot="5453c5bfb7d040285be5ba9af142f4fbdd9685d082f244b66c62bf7b22d8d02a638fa2e02b9a6fe8877953a9429209e0",Fe={"attestation-service-staging.zkp2p.xyz":I(He,"bundled staging PCR8"),"attestation-service-preprod.zkp2p.xyz":I(Ot,"bundled preprod PCR8"),"attestation-service.zkp2p.xyz":I(Le,"bundled production PCR8")},ke={staging:{attestationServiceUrl:Ut,expectedPcr8Hex:He},production:{attestationServiceUrl:wt,expectedPcr8Hex:Le}};function We(e){let{trust:t,advertisedExpectedPcr8:r,onWarning:n}=e,i=e.hostname.toLowerCase();if(t?.expectedPcr8Hex)return I(t.expectedPcr8Hex,"trust.expectedPcr8Hex");let a=t?.expectedPcr8ByHost,s=a?Mt(a,i):void 0;if(s)return I(s,`trust.expectedPcr8ByHost[${i}]`);let u=Fe[i];if(u)return u;if(t?.strictPin===!0&&o("TRUST_PIN_REQUIRED",`No trusted PCR8 pin is configured for ${i}`),r){let l=I(r,"service-advertised expectedPcr8");return n?.({code:"TRUST_PIN_NOT_PROVIDED",message:`No caller or bundled PCR8 pin was available for ${i}; falling back to service-advertised expectedPcr8`,details:{hostname:i,expectedPcr8:l}}),l}o("TRUST_PIN_REQUIRED",`No trusted or service-advertised PCR8 pin is available for ${i}`)}function Mt(e,t){for(let[r,n]of Object.entries(e))if(r.toLowerCase()===t)return n}var Dt=300*1e3;async function P(e){let t=Y(e.fetch),r=h(e),n=e.now??Date.now,i=De(r.getRandomValues),a=await Me({attestationServiceUrl:e.attestationServiceUrl,nonceHex:i,fetch:t,timeoutMs:e.timeoutMs??1e4});Ve(a.nonce,i);let{protectedHeadersBytes:s,payloadBytes:u,signature:l}=Ce(a.attestationDocument),c=Be(u);c.nonceHex!==i&&o("NONCE_BINDING_FAILED","Attestation payload user_data did not match the request nonce",{details:{expectedNonce:i,payloadNonce:c.nonceHex}});let d=e.trust?.freshnessWindowMs??Dt,f=n();Math.abs(f-c.timestampMs)>d&&o("FRESHNESS_CHECK_FAILED",`Attestation timestamp skew exceeds ${d}ms`,{details:{timestampMs:c.timestampMs,nowMs:f,freshnessWindowMs:d}});let T=new URL(e.attestationServiceUrl).hostname,p=We({trust:e.trust,hostname:T,advertisedExpectedPcr8:a.advertised.expectedPcr8,onWarning:e.onWarning});c.pcr8Hex!==p&&o("PCR8_PIN_MISMATCH","Attestation PCR8 does not match the trusted pin",{details:{expectedPcr8:p,actualPcr8:c.pcr8Hex}});let{leafPublicKey:Ze}=await xe({leafCertificateDer:c.certificateDer,cabundleDer:c.cabundleDer,rootPem:e.trust?.awsNitroRootPem,nowMs:f,subtle:r.subtle,getRandomValues:r.getRandomValues,onWarning:e.onWarning});return await Re({protectedHeadersBytes:s,payloadBytes:u,signature:l,leafPublicKey:Ze,subtle:r.subtle}),{attestedSellerUploadKey:{publicKeyDer:c.publicKeyDer,publicKeySha256Hex:g(new Uint8Array(await r.subtle.digest("SHA-256",E(c.publicKeyDer))))},payload:{timestampMs:c.timestampMs,pcr0Hex:c.pcr0Hex,pcr1Hex:c.pcr1Hex,pcr2Hex:c.pcr2Hex,pcr8Hex:c.pcr8Hex,nonceHex:c.nonceHex,advertised:a.advertised}}}async function H(e){let t=await P({attestationServiceUrl:e.attestationServiceUrl,trust:e.trust,fetch:e.fetch,subtle:e.subtle,getRandomValues:e.getRandomValues,now:e.now,onWarning:e.onWarning,timeoutMs:e.timeoutMs});return V({...e,key:t.attestedSellerUploadKey})}async function L(e){let t=h(e);return he({request:e,subtle:t.subtle,getRandomValues:t.getRandomValues})}async function F(e){let t=await P({attestationServiceUrl:e.attestationServiceUrl,trust:e.trust,fetch:e.fetch,subtle:e.subtle,getRandomValues:e.getRandomValues,now:e.now,onWarning:e.onWarning,timeoutMs:e.timeoutMs});return L({key:t.attestedSellerUploadKey,platform:e.platform,actionType:e.actionType,sessionMaterial:e.sessionMaterial,subtle:e.subtle,getRandomValues:e.getRandomValues})}async function k(e){let t=h(e);return Ie({request:e,subtle:t.subtle,getRandomValues:t.getRandomValues,now:e.now??Date.now})}async function W(e){let{attestationServiceUrl:t,trust:r,fetch:n,onWarning:i,timeoutMs:a,...s}=e,u=await P({attestationServiceUrl:t,trust:r,fetch:n,subtle:e.subtle,getRandomValues:e.getRandomValues,now:e.now,onWarning:i,timeoutMs:a});return k({...s,key:u.attestedSellerUploadKey})}var Vt=400;async function M(e){let t=Y(e.fetch),r=e.timeoutMs??1e4,n=new AbortController,i,a=new Promise((c,d)=>{i=setTimeout(()=>{n.abort(),d(new Error("timeout"))},r)}),s,u;try{s=await Promise.race([t(Lt(e.attestationServiceUrl,e.path),{method:"POST",headers:{accept:"application/json","content-type":"application/json"},body:JSON.stringify(e.body),signal:n.signal}),a]),u=await Promise.race([s.text(),a])}catch(c){n.signal.aborted&&o("TIMEOUT",`${e.failureContext} timed out after ${r}ms`,{cause:c}),o("ATTESTATION_FETCH_FAILED",`${e.failureContext} failed at the network layer`,{cause:c})}finally{clearTimeout(i)}if(!s.ok){let c=vt(u);c?.success===!1&&Ye(e.failureContext,s.status,c),o("ATTESTATION_FETCH_FAILED",`${e.failureContext} failed with HTTP ${s.status}`,{details:{status:s.status,body:u.slice(0,400)}})}let l;try{l=JSON.parse(u)}catch(c){o("ATTESTATION_RESPONSE_INVALID",`${e.failureContext} returned a non-JSON ServiceResponse`,{cause:c})}return l.success!==!0&&(l.success===!1&&Ye(e.failureContext,s.status,l),o("ATTESTATION_RESPONSE_INVALID",`${e.failureContext} returned an unsuccessful ServiceResponse`)),Bt(l.responseObject)||o("ATTESTATION_RESPONSE_INVALID",`${e.failureContext} returned a ServiceResponse without responseObject`,{details:{status:s.status,envelopeSnippet:Ht(l)}}),l.responseObject}function vt(e){try{return JSON.parse(e)}catch{return}}function Ye(e,t,r){let n={status:t,statusCode:r.statusCode,message:r.message,responseObject:r.responseObject};o("SERVICE_RESPONSE_ERROR",`${e} returned an unsuccessful ServiceResponse`,{details:n})}function Bt(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function Ht(e){return JSON.stringify(e).slice(0,Vt)}function Lt(e,t){let r=new URL(e);return r.pathname=`${r.pathname.replace(/\/+$/u,"")}${t}`,r.search="",r.toString()}async function oe(e){let t=await F({attestationServiceUrl:e.attestationServiceUrl,trust:e.trust,fetch:e.fetch,subtle:e.subtle,getRandomValues:e.getRandomValues,now:e.now,onWarning:e.onWarning,timeoutMs:e.timeoutMs,platform:e.platform,actionType:e.actionType,sessionMaterial:e.sessionMaterial});return M({attestationServiceUrl:e.attestationServiceUrl,path:"/identity",fetch:e.fetch,failureContext:"POST /identity",timeoutMs:e.timeoutMs,body:{platform:e.platform,actionType:e.actionType,callerAddress:e.callerAddress,encryptedSessionMaterial:t,params:e.params}})}async function ae(e){let t=await W(e);return M({attestationServiceUrl:e.attestationServiceUrl,path:`/seller/credentials/${encodeURIComponent(e.platform)}`,fetch:e.fetch,failureContext:"POST /seller/credentials",timeoutMs:e.timeoutMs,body:{encryptedUpload:t}})}async function se(e){let t=await H(e);return M({attestationServiceUrl:e.attestationServiceUrl,path:`/buyer/verify/${encodeURIComponent(e.platform)}/${encodeURIComponent(e.actionType)}`,fetch:e.fetch,failureContext:"POST /buyer/verify",timeoutMs:e.timeoutMs,body:{encryptedSessionMaterial:t,params:e.params,chainId:e.chainId,intent:e.intent}})}function Ft(e){let t=ke[e.environment],r=e.attestationServiceUrl??t.attestationServiceUrl,n=R({strictPin:!0},e.trust);return{createEncryptedBuyerTeeSessionMaterial:i=>{let{attestationServiceUrl:a,trust:s,fetch:u,subtle:l,getRandomValues:c,now:d,onWarning:f,timeoutMs:T,...p}=i;return H({...p,attestationServiceUrl:a??r,trust:R(n,s),fetch:u??e.fetch,subtle:l??e.subtle,getRandomValues:c??e.getRandomValues,now:d??e.now,onWarning:f??e.onWarning,timeoutMs:T??e.timeoutMs})},createEncryptedIdentitySessionMaterial:i=>{let{attestationServiceUrl:a,trust:s,fetch:u,subtle:l,getRandomValues:c,now:d,onWarning:f,timeoutMs:T,...p}=i;return F({...p,attestationServiceUrl:a??r,trust:R(n,s),fetch:u??e.fetch,subtle:l??e.subtle,getRandomValues:c??e.getRandomValues,now:d??e.now,onWarning:f??e.onWarning,timeoutMs:T??e.timeoutMs})},createEncryptedSellerCredentialUpload:i=>{let{attestationServiceUrl:a,trust:s,fetch:u,subtle:l,getRandomValues:c,now:d,onWarning:f,timeoutMs:T,...p}=i;return W({...p,attestationServiceUrl:a??r,trust:R(n,s),fetch:u??e.fetch,subtle:l??e.subtle,getRandomValues:c??e.getRandomValues,now:d??e.now,onWarning:f??e.onWarning,timeoutMs:T??e.timeoutMs})},requestIdentityAttestation:i=>oe({attestationServiceUrl:i.attestationServiceUrl??r,trust:R(n,i.trust),fetch:i.fetch??e.fetch,subtle:i.subtle??e.subtle,getRandomValues:i.getRandomValues??e.getRandomValues,now:i.now??e.now,onWarning:i.onWarning??e.onWarning,timeoutMs:i.timeoutMs??e.timeoutMs,platform:i.platform,actionType:i.actionType,callerAddress:i.callerAddress,sessionMaterial:i.sessionMaterial,params:i.params}),uploadSellerCredential:i=>{let{attestationServiceUrl:a,trust:s,fetch:u,subtle:l,getRandomValues:c,now:d,onWarning:f,timeoutMs:T,...p}=i;return ae({...p,attestationServiceUrl:a??r,trust:R(n,s),fetch:u??e.fetch,subtle:l??e.subtle,getRandomValues:c??e.getRandomValues,now:d??e.now,onWarning:f??e.onWarning,timeoutMs:T??e.timeoutMs})},verifyBuyerTeePayment:i=>{let a={attestationServiceUrl:i.attestationServiceUrl??r,trust:R(n,i.trust),fetch:i.fetch??e.fetch,subtle:i.subtle??e.subtle,getRandomValues:i.getRandomValues??e.getRandomValues,now:i.now??e.now,onWarning:i.onWarning??e.onWarning,timeoutMs:i.timeoutMs??e.timeoutMs,platform:i.platform,actionType:i.actionType,sessionMaterial:i.sessionMaterial,params:i.params,chainId:i.chainId,intent:i.intent};return se(a)},fetchAndVerifyAttestation:(i={})=>P({attestationServiceUrl:i.attestationServiceUrl??r,trust:R(n,i.trust),fetch:i.fetch??e.fetch,subtle:i.subtle??e.subtle,getRandomValues:i.getRandomValues??e.getRandomValues,now:i.now??e.now,onWarning:i.onWarning??e.onWarning,timeoutMs:i.timeoutMs??e.timeoutMs}),encryptBuyerTeeSessionMaterial:({subtle:i,getRandomValues:a,...s})=>V({...s,subtle:i??e.subtle,getRandomValues:a??e.getRandomValues}),encryptIdentitySessionMaterial:({subtle:i,getRandomValues:a,...s})=>L({...s,subtle:i??e.subtle,getRandomValues:a??e.getRandomValues}),encryptSellerCredentialUpload:({subtle:i,getRandomValues:a,now:s,...u})=>k({...u,subtle:i??e.subtle,getRandomValues:a??e.getRandomValues,now:s??e.now})}}function R(e,t){return t?{...e,...t,expectedPcr8ByHost:{...e.expectedPcr8ByHost,...t.expectedPcr8ByHost}}:e}import{concat as kt,getAddress as Ge,keccak256 as ce,recoverAddress as Wt,TypedDataEncoder as ue,toUtf8Bytes as Yt,verifyTypedData as Gt}from"ethers";var $t={name:"UnifiedPaymentVerifier",version:"1"},le={PaymentAttestation:[{name:"intentHash",type:"bytes32"},{name:"releaseAmount",type:"uint256"},{name:"dataHash",type:"bytes32"}]},Kt="PaymentAttestation(bytes32 intentHash,uint256 releaseAmount,bytes32 dataHash)",$e=m(Kt),de={name:"ZKP2PIdentityVerifier",version:"1"},fe={IdentityAttestation:[{name:"method",type:"bytes32"},{name:"actionType",type:"bytes32"},{name:"callerAddress",type:"address"},{name:"payeeIdHash",type:"bytes32"},{name:"dataHash",type:"bytes32"},{name:"issuedAt",type:"uint256"},{name:"validUntil",type:"uint256"}]},qt="IdentityAttestation(bytes32 method,bytes32 actionType,address callerAddress,bytes32 payeeIdHash,bytes32 dataHash,uint256 issuedAt,uint256 validUntil)",Ke=m(qt),qe=ue.hashDomain(de).toLowerCase(),je={name:"ZKP2P Seller Credential Bundle",version:"1"},ze={SellerCredentialBundle:[{name:"platform",type:"string"},{name:"payeeIdHash",type:"bytes32"},{name:"encryptedBlobHash",type:"bytes32"},{name:"encryptedDataKeyHash",type:"bytes32"},{name:"nonceHash",type:"bytes32"},{name:"credentialType",type:"string"},{name:"credentialValidatedAt",type:"string"},{name:"credentialExpiresAt",type:"string"}]};function jt(e){return{...$t,chainId:e.chainId,verifyingContract:Ge(e.verifyingContract)}}function ye(e){return ue.hashDomain(jt(e)).toLowerCase()}function m(e){return ce(Yt(e)).toLowerCase()}function Xe(e){return ce(e).toLowerCase()}function Qe(e){try{let t=ue.from(e.types).hash(e.value),r=ce(kt(["0x1901",e.domainSeparator,t]));return N(Wt(r,e.signature))}catch(t){o("ATTESTATION_SIGNATURE_INVALID","Unable to recover signer from attestation signature",{cause:t})}}function j(e){try{return N(Gt(e.domain,e.types,e.value,e.signature))}catch(t){o("ATTESTATION_SIGNATURE_INVALID","Unable to verify attestation signature",{cause:t})}}function pe(e,t){let r=N(e),n=new Set(t.map(i=>N(i)));return n.has(r)||o("SIGNER_NOT_TRUSTED","Recovered signer is not in trustedSigners",{details:{recoveredSigner:r,trustedSigners:Array.from(n)}}),r}function z(e){let t=pe(e.recoveredSigner,e.trustedSigners),r=N(e.payloadSigner);return r!==t&&o("ATTESTATION_SIGNATURE_INVALID","Payload signer does not match the recovered signer",{details:{payloadSigner:r,recoveredSigner:t}}),t}function y(e,t,r){e.toLowerCase()!==t.toLowerCase()&&o("ATTESTATION_BINDING_MISMATCH",`${r} did not match expected value`,{details:{actual:e,expected:t}})}function Je(e,t,r){let n,i;try{n=N(e),i=N(t)}catch(a){o("INVALID_PARAMETER",`${r} must be a valid Ethereum address`,{cause:a})}n!==i&&o("ATTESTATION_BINDING_MISMATCH",`${r} did not match expected value`,{details:{actual:e,expected:t}})}function A(e,t,r){e!==t&&o("ATTESTATION_BINDING_MISMATCH",`${r} did not match expected value`,{details:{actual:e,expected:t}})}function X(e,t){JSON.stringify(e)!==JSON.stringify(t)&&o("ATTESTATION_BINDING_MISMATCH","typedDataSpec.types did not match the expected EIP-712 types")}function _(e,t){return typeof e!="string"&&o("INVALID_PARAMETER",`${t} is required`),e}function N(e){return Ge(e).toLowerCase()}function zt(e,t){A(e.platform,t.expectedPlatform,"platform"),A(e.actionType,t.expectedActionType,"actionType"),A(e.typedDataSpec.primaryType,"PaymentAttestation","typedDataSpec.primaryType"),X(e.typedDataSpec.types,le),y(e.typeHash,$e,"typeHash"),y(e.domainSeparator,ye(t.expectedDomain),"domainSeparator"),y(Xe(e.encodedPaymentDetails),e.typedDataValue.dataHash,"encodedPaymentDetails"),y(e.typedDataValue.intentHash,_(t.expectedIntentHash,"expectedIntentHash"),"typedDataValue.intentHash");let r=Qe({domainSeparator:e.domainSeparator,types:le,value:{...e.typedDataValue},signature:e.signature});return z({payloadSigner:e.signer,recoveredSigner:r,trustedSigners:t.trustedSigners}),e}var Xt=["platform","actionType","payeeId","username","metadata"];function Qt(e,t){A(e.platform,t.expectedPlatform,"platform"),A(e.actionType,t.expectedActionType,"actionType"),A(e.identity.platform,e.platform,"identity.platform"),A(e.identity.actionType,e.actionType,"identity.actionType"),A(e.typedDataSpec.primaryType,"IdentityAttestation","typedDataSpec.primaryType"),X(e.typedDataSpec.types,fe),y(e.domainSeparator,qe,"domainSeparator"),y(e.typeHash,Ke,"typeHash"),y(e.identity.method,m(e.identity.platform),"identity.method"),y(e.identity.payeeIdHash,m(e.identity.payeeId),"identity.payeeIdHash"),y(e.typedDataValue.method,e.identity.method,"typedDataValue.method"),y(e.typedDataValue.actionType,m(e.identity.actionType),"typedDataValue.actionType"),Je(e.typedDataValue.callerAddress,_(t.expectedCallerAddress,"expectedCallerAddress"),"typedDataValue.callerAddress"),y(e.typedDataValue.payeeIdHash,e.identity.payeeIdHash,"typedDataValue.payeeIdHash"),y(e.typedDataValue.payeeIdHash,_(t.expectedPayeeIdHash,"expectedPayeeIdHash"),"typedDataValue.payeeIdHash"),y(e.typedDataValue.dataHash,Jt(e.identity),"typedDataValue.dataHash"),er(e.typedDataValue.validUntil,t.now??Date.now);let r=j({domain:de,types:fe,value:{...e.typedDataValue},signature:e.signature});return z({payloadSigner:e.signer,recoveredSigner:r,trustedSigners:t.trustedSigners}),e.identity}function Jt(e){let t={platform:e.platform,actionType:e.actionType,payeeId:e.payeeId,username:e.username,metadata:Zt(e.metadata)},r=JSON.stringify(Object.fromEntries(Xt.map(n=>[n,t[n]])));return m(r)}function Zt(e){return Object.fromEntries(Object.entries(e).sort(([t],[r])=>t.localeCompare(r)))}function er(e,t){let r=t();BigInt(r)>BigInt(e)&&o("ATTESTATION_EXPIRED","Identity attestation validUntil is in the past",{details:{validUntil:e,nowMs:r}})}function tr(e,t){A(e.platform,t.expectedPlatform,"platform"),y(e.payeeIdHash,_(t.expectedPayeeIdHash,"expectedPayeeIdHash"),"payeeIdHash"),nr(e.credentialExpiresAt,t.now??Date.now);let r=j({domain:je,types:ze,value:rr(e),signature:e.bundleSignature});return pe(r,t.trustedSigners),e}function rr(e){return{platform:e.platform,payeeIdHash:e.payeeIdHash,encryptedBlobHash:m(e.encryptedBlob),encryptedDataKeyHash:m(e.encryptedDataKey),nonceHash:m(e.nonce),credentialType:e.credentialType,credentialValidatedAt:e.credentialValidatedAt,credentialExpiresAt:e.credentialExpiresAt??""}}function nr(e,t){let r=t();e!==null&&BigInt(r)>BigInt(e)&&o("ATTESTATION_EXPIRED","Seller credential bundle credentialExpiresAt is in the past",{details:{credentialExpiresAt:e,nowMs:r}})}export{K as AWS_NITRO_ROOT_FINGERPRINT_SHA256_HEX,J as AWS_NITRO_ROOT_PEM,U as NitroAttestationError,H as createEncryptedBuyerTeeSessionMaterial,F as createEncryptedIdentitySessionMaterial,W as createEncryptedSellerCredentialUpload,Ft as createNitroAttestationClient,V as encryptBuyerTeeSessionMaterial,L as encryptIdentitySessionMaterial,k as encryptSellerCredentialUpload,P as fetchAndVerifyAttestation,ye as getUnifiedPaymentVerifierDomainSeparator,m as hashUtf8,oe as requestIdentityAttestation,ae as uploadSellerCredential,se as verifyBuyerTeePayment,zt as verifyBuyerTeePaymentAttestation,Qt as verifyIdentityAttestation,tr as verifySellerCredentialBundle};
|
|
16
16
|
//# sourceMappingURL=index.js.map
|