@zkp2p/zkp2p-attestation 2.0.0 → 3.0.0

package/CHANGELOG.md

@@ -1,6 +1,11 @@
 # Changelog
 
-## Unreleased
+## 3.0.0
+
+- BREAKING: `/identity` and its package helpers now require normalized `callerAddress` inside session-material JWEs and require the encrypted address to match the outer request. Unbound identity envelopes are rejected; buyer TEE envelopes are unchanged.
+- Add typed Alipay buyer TEE and identity requests using `transfer_alipay`/`register_alipay` with encrypted `Cookie` session material.
+- Add typed Monobank buyer TEE payloads using `transfer_monobank`, encrypted `X-Token` session material, and `ACCOUNT_ID`/`TRANSACTION_ID` params.
+- Type seller-produced Monobank identity attestations as `register_monobank` while keeping Monobank excluded from the standalone identity request API.
 
 ## 2.0.0
 

package/README.md

@@ -10,7 +10,9 @@ The package runs in Chrome MV3 service workers, browser DOM contexts, React Nati
 yarn add @zkp2p/zkp2p-attestation
 ```
 
-During monorepo development, point clients at `attestation-service/package/zkp2p-attestation`.
+In the protocol coordination workspace, `bin/workspace refresh-packages`
+creates an ignored local package link for declared consumers. Standalone builds
+and deployments must install a published package version.
 
 ## Environment Init
 
@@ -84,8 +86,6 @@ const encryptedUpload = await nitro.createEncryptedSellerCredentialUpload({
 });
 ```
 
-Venmo seller uploads can use either the existing session material or Google OAuth. For Google OAuth, pass the numeric Venmo account id as `payeeId` and use `sessionMaterial: { credentialSource: "google_oauth", authorizationCode, redirectUri }`; the service validates Gmail access against venmo.com DKIM-signed incoming payment receipts. To onboard through a partner-owned Google OAuth app instead of Peer's default app, include `oauthClient: { clientId, clientSecret }` inside that encrypted `sessionMaterial`. The client secret is seller credential material: the package only places it in the compact JWE upload plaintext, it reaches the service enclave through that JWE, and the service persists it only inside the KMS-envelope-sealed seller credential bundle that the curator holds as ciphertext. It rides the same encrypted credential envelope as the Gmail refresh token and is reused only for later Gmail token refresh.
-
 PayPal Gmail OAuth seller uploads use the same app-selection model. Pass the seller PayPal email as `payeeId` and use `sessionMaterial: { credentialSource: "google_oauth", authorizationCode, redirectUri }`; the service validates Gmail access against paypal.com DKIM-signed payment receipts. To onboard through a partner-owned Google OAuth app, include `oauthClient: { clientId, clientSecret }` inside the encrypted `sessionMaterial`. The PayPal partner client secret is handled as seller credential material: it rides only in the compact JWE upload plaintext, is sealed with the Gmail refresh token in the KMS-envelope seller credential bundle, and is reused only to refresh that seller's Gmail access token.
 
 Buyer TEE requests use the same attested upload key and compact JWE envelope. The typed helper encrypts the captured
@@ -153,6 +153,7 @@ Buyer TEE platform matrix:
 | `zelle` | `transfer_zelle_chase` | `Cookie`, `x-jpmc-channel`, `x-jpmc-csrf-token`, `Referer`, `Origin` | `index` |
 | `zelle` | `transfer_zelle_citi` | `Cookie` | `index` |
 | `paypal` | `transfer_paypal` | `Cookie` | `PAYMENT_ID` |
+| `alipay` | `transfer_alipay` | `Cookie` | `TRADE_NO` |
 
 Zelle buyer verification uses only `platform: "zelle"` with bank-specific action types. Every Zelle action attests
 `intent.paymentMethod = hashUtf8("zelle")`; direct bank-specific platforms are unsupported.
@@ -161,8 +162,8 @@ Per-platform session-material types require these headers using the canonical na
 additional captured headers. Captured request bodies are session material because they can contain sensitive data and
 are encrypted before being sent to the service.
 
-Identity requests use the same attested upload key and compact JWE plaintext shape as buyer TEE, but with a narrower
-platform/action matrix. The typed helper encrypts captured session material, posts
+Identity requests use the same attested upload key as buyer TEE, but use a caller-bound plaintext envelope. The typed
+helper normalizes `callerAddress`, encrypts it together with captured session material, posts
 `{ platform, actionType, callerAddress, encryptedSessionMaterial, params }` to `POST /identity`, unwraps the service response, and
 returns an `IdentityAttestationOutput`. `verifyIdentityAttestation` checks the EIP-712 signature, trusted signer,
 platform/action binding, expected caller address, expected payee hash, canonical identity `dataHash`, and `validUntil`,
@@ -198,6 +199,11 @@ Identity platform matrix:
 | `paypal` | `register_paypal` | `Cookie` | `{}` |
 | `wise` | `register_wise` | `Cookie`, `X-Access-Token` | `PROFILE_ID` |
 | `cashapp` | `register_cashapp` | `sessionCookie`, `requestPayload`, optional `requestHeaders` | `{}` |
+| `alipay` | `register_alipay` | `Cookie` | `{}` |
+
+This matrix is intentionally limited to the caller-bound `POST /identity` request flow. A Monobank seller credential
+upload can additionally return a typed `IdentityAttestationOutputFor<"monobank">` with `register_monobank`; consumers
+can pass that response directly to `verifyIdentityAttestation`, but cannot request it through `POST /identity`.
 
 For Venmo identity, pass `SENDER_ID` in public params and include a replayable `Cookie` header in encrypted session
 material. The service verifies the authenticated account id, derives the stories URL from `SENDER_ID`, and requires
@@ -207,12 +213,16 @@ For Cash App identity, pass the replayable Cash App session cookie as `sessionMa
 `MY_ACTIVITY_WEB_V2` activity request body as `sessionMaterial.requestPayload`. Include captured replayable headers in
 `sessionMaterial.requestHeaders` when needed; the service ignores public params for this flow.
 
+For Alipay identity, pass a replayable `Cookie` header. The service fetches the authenticated account page and signs
+the historical transfer-recipient preimage: normalized recipient name concatenated directly with the redacted,
+lowercased email. The full normalized email is returned as `identity.username` for Curator binding.
+
 Buyer TEE and identity expose discriminated unions keyed by `platform` and `actionType`, including per-platform
 `params`, so invalid pairings fail during TypeScript compilation. Seller credential upload keeps its existing
-platform narrowing (`wise` derives payee id from the credential; Venmo, Cash App, and PayPal require `payeeId`) but
-does not add exhaustive `sessionMaterial` typing: each seller platform can accept multiple credential sources, such as
-cookie headers or Google OAuth with optional partner OAuth client material, and encoding all combinations would make
-the SDK brittle without improving the wire contract.
+platform narrowing (Wise and Monobank derive payee id from the credential; Venmo, Cash App, and PayPal require
+`payeeId`) but
+does not add exhaustive `sessionMaterial` typing because the service owns connector-specific validation and the SDK
+would otherwise duplicate the wire contract.
 
 ## Cache-Friendly Path
 
@@ -248,12 +258,18 @@ const encryptedSessionMaterial = await nitro.encryptIdentitySessionMaterial({
   key: verified.attestedSellerUploadKey,
   platform: "paypal",
   actionType: "register_paypal",
+  callerAddress: "0x0000000000000000000000000000000000000002",
   sessionMaterial: {
     Cookie: "<captured-cookie-header>",
   },
 });
 ```
 
+Identity helpers emit `{ platform, actionType, sessionMaterial: { callerAddress, sessionMaterial },
+boundPubKeySha256 }` inside the compact JWE. The service requires the encrypted, normalized address to exactly match
+the outer request address before any provider request or signature. Identity JWEs created without this binding are
+rejected and must be regenerated. Buyer TEE envelopes retain their existing wire shape.
+
 The attested SPKI is stable within one enclave process. If the enclave restarts, cached keys become stale and upload decrypt will fail; fetch a fresh attestation for a new session.
 
 ## React Native Wiring

package/dist/index.cjs

@@ -1,4 +1,4 @@
-"use strict";var ne=Object.defineProperty;var it=Object.getOwnPropertyDescriptor;var ot=Object.getOwnPropertyNames;var at=Object.prototype.hasOwnProperty;var st=(e,t)=>{for(var r in t)ne(e,r,{get:t[r],enumerable:!0})},ct=(e,t,r,n)=>{if(t&&typeof t=="object"||typeof t=="function")for(let i of ot(t))!at.call(e,i)&&i!==r&&ne(e,i,{get:()=>t[i],enumerable:!(n=it(t,i))||n.enumerable});return e};var ut=e=>ct(ne({},"__esModule",{value:!0}),e);var or={};st(or,{AWS_NITRO_ROOT_FINGERPRINT_SHA256_HEX:()=>W,AWS_NITRO_ROOT_PEM:()=>j,NitroAttestationError:()=>_,createEncryptedBuyerTeeSessionMaterial:()=>V,createEncryptedIdentitySessionMaterial:()=>B,createEncryptedSellerCredentialUpload:()=>L,createNitroAttestationClient:()=>$e,encryptBuyerTeeSessionMaterial:()=>D,encryptIdentitySessionMaterial:()=>v,encryptSellerCredentialUpload:()=>H,fetchAndVerifyAttestation:()=>g,getUnifiedPaymentVerifierDomainSeparator:()=>Z,hashUtf8:()=>A,requestIdentityAttestation:()=>X,uploadSellerCredential:()=>Q,verifyBuyerTeePayment:()=>J,verifyBuyerTeePaymentAttestation:()=>et,verifyIdentityAttestation:()=>tt,verifySellerCredentialBundle:()=>rt});module.exports=ut(or);var _=class extends Error{code;cause;details;constructor(t,r,n={}){super(r),this.name="NitroAttestationError",this.code=t,this.cause=n.cause,this.details=n.details}};function o(e,t,r){throw new _(e,t,r)}async function E(e,t,r){try{return await e}catch(n){o(t,r,{cause:n})}}function $(e){return e!==void 0?(typeof e!="function"&&o("CRYPTO_UNAVAILABLE","fetch is unavailable; pass a fetch implementation"),e):(typeof globalThis.fetch!="function"&&o("CRYPTO_UNAVAILABLE","fetch is unavailable; pass a fetch implementation"),globalThis.fetch.bind(globalThis))}function lt(e){let t=e??globalThis.crypto?.subtle;return t||o("CRYPTO_UNAVAILABLE","SubtleCrypto is unavailable; pass params.subtle"),t}function dt(e){if(e)return e;let t=globalThis.crypto;return typeof t?.getRandomValues!="function"&&o("CRYPTO_UNAVAILABLE","crypto.getRandomValues is unavailable; pass params.getRandomValues"),r=>t.getRandomValues(r)}function x(e){return{subtle:lt(e.subtle),getRandomValues:dt(e.getRandomValues)}}function me(e,t){return typeof t!="function"&&o("CRYPTO_UNAVAILABLE","crypto.getRandomValues is unavailable; pass params.getRandomValues"),{subtle:e,getRandomValues:t,randomUUID:()=>ft(t)}}function ft(e){let t=e(new Uint8Array(16));t[6]=t[6]&15|64,t[8]=t[8]&63|128;let r=Array.from(t,n=>n.toString(16).padStart(2,"0"));return`${r.slice(0,4).join("")}-${r.slice(4,6).join("")}-${r.slice(6,8).join("")}-${r.slice(8,10).join("")}-${r.slice(10).join("")}`}var k="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/",K=yt(k);function yt(e){let t={};for(let r=0;r<e.length;r+=1)t[e[r]]=r;return t}function I(e){let t="";for(let r of e)t+=r.toString(16).padStart(2,"0");return t}function b(e){if(typeof TextEncoder<"u")return new TextEncoder().encode(e);let t=[];for(let r=0;r<e.length;r+=1){let n=e.codePointAt(r);n>65535&&(r+=1),n<=127?t.push(n):n<=2047?t.push(192|n>>6,128|n&63):n<=65535?t.push(224|n>>12,128|n>>6&63,128|n&63):t.push(240|n>>18,128|n>>12&63,128|n>>6&63,128|n&63)}return new Uint8Array(t)}function O(e){if(typeof TextDecoder<"u")return new TextDecoder().decode(e);let t="";for(let r=0;r<e.length;r+=1){let n=e[r];n<128?t+=String.fromCodePoint(n):(n&224)===192?t+=String.fromCodePoint((n&31)<<6|e[++r]&63):(n&240)===224?t+=String.fromCodePoint((n&15)<<12|(e[++r]&63)<<6|e[++r]&63):t+=String.fromCodePoint((n&7)<<18|(e[++r]&63)<<12|(e[++r]&63)<<6|e[++r]&63)}return t}function pt(e){let t="";for(let r=0;r<e.length;r+=3){let n=e[r],i=e[r+1]??0,a=e[r+2]??0,s=n<<16|i<<8|a;t+=k[s>>18&63],t+=k[s>>12&63],t+=r+1<e.length?k[s>>6&63]:"=",t+=r+2<e.length?k[s&63]:"="}return t}function Ae(e){return mt(e,!1)}function M(e){return pt(e).replaceAll("+","-").replaceAll("/","_").replace(/=+$/,"")}function mt(e,t){let r=e.replace(/\s+/g,""),n=t?r.replaceAll("-","+").replaceAll("_","/"):r;if(n.length%4===1)throw new Error("Invalid base64 length");let i=n+"=".repeat((4-n.length%4)%4),a=[];for(let s=0;s<i.length;s+=4){let u=i.slice(s,s+4),l=u.endsWith("==")?2:u.endsWith("=")?1:0,c=q(u[0],K),d=q(u[1],K),f=u[2]==="="?0:q(u[2],K),S=u[3]==="="?0:q(u[3],K),m=c<<18|d<<12|f<<6|S;a.push(m>>16&255),l<2&&a.push(m>>8&255),l<1&&a.push(m&255)}return new Uint8Array(a)}function q(e,t){let r=t[e];if(r===void 0)throw new Error(`Invalid base64 character: ${e}`);return r}function C(e){let t=e.reduce((i,a)=>i+a.length,0),r=new Uint8Array(t),n=0;for(let i of e)r.set(i,n),n+=i.length;return r}function P(e){return new Uint8Array(e).buffer}function Te(e){let t={sessionMaterial:e.sessionMaterial,boundPubKeySha256:e.key.publicKeySha256Hex,issuedAtMs:e.issuedAtMs,jweId:e.jweId};return e.platform==="wise"?t:{payeeId:e.payeeId,...t}}function Se(e){return{platform:e.platform,actionType:e.actionType,sessionMaterial:e.sessionMaterial,boundPubKeySha256:e.key.publicKeySha256Hex}}function ge(e){return{platform:e.platform,actionType:e.actionType,sessionMaterial:e.sessionMaterial,boundPubKeySha256:e.key.publicKeySha256Hex}}function Ee(e){return JSON.stringify(e)}var At={alg:"RSA-OAEP-256",enc:"A256GCM"},Tt=/^[A-Za-z0-9_-]{16,128}$/;async function Ie(e){let t=e.request.issuedAtMs??e.now(),r=e.request.jweId??gt(e.getRandomValues);return St(r),ie({key:e.request.key,plaintext:Te({...e.request,issuedAtMs:t,jweId:r}),subtle:e.subtle,getRandomValues:e.getRandomValues,failureContext:"seller credential upload"})}async function Pe(e){return ie({key:e.request.key,plaintext:Se(e.request),subtle:e.subtle,getRandomValues:e.getRandomValues,failureContext:"buyer TEE session material"})}async function he(e){return ie({key:e.request.key,plaintext:ge(e.request),subtle:e.subtle,getRandomValues:e.getRandomValues,failureContext:"identity session material"})}async function ie(e){let t=b(Ee(e.plaintext)),r=e.getRandomValues(new Uint8Array(32)),n=await E(e.subtle.importKey("spki",P(e.key.publicKeyDer),{name:"RSA-OAEP",hash:"SHA-256"},!1,["encrypt"]),"CRYPTO_UNAVAILABLE","Failed to import attested enclave-upload RSA public key"),i=new Uint8Array(await E(e.subtle.encrypt({name:"RSA-OAEP"},n,P(r)),"CRYPTO_UNAVAILABLE","Failed to RSA-OAEP encrypt the content encryption key")),a=e.getRandomValues(new Uint8Array(12)),s=M(b(JSON.stringify(At))),u=b(s),l=await E(e.subtle.importKey("raw",P(r),{name:"AES-GCM",length:256},!1,["encrypt"]),"CRYPTO_UNAVAILABLE","Failed to import generated AES-GCM content encryption key"),c=new Uint8Array(await E(e.subtle.encrypt({name:"AES-GCM",iv:P(a),additionalData:P(u),tagLength:128},l,P(t)),"CRYPTO_UNAVAILABLE",`Failed to AES-GCM encrypt ${e.failureContext}`)),d=c.slice(0,c.length-16),f=c.slice(c.length-16);return[s,M(i),M(a),M(d),M(f)].join(".")}function St(e){Tt.test(e)||o("INVALID_PARAMETER","jweId must be 16-128 URL-safe characters")}function gt(e){let t=e(new Uint8Array(16));t[6]=t[6]&15|64,t[8]=t[8]&63|128;let r=Array.from(t,n=>n.toString(16).padStart(2,"0"));return`${r.slice(0,4).join("")}-${r.slice(4,6).join("")}-${r.slice(6,8).join("")}-${r.slice(8,10).join("")}-${r.slice(10).join("")}`}async function D(e){let t=x(e);return Pe({request:e,subtle:t.subtle,getRandomValues:t.getRandomValues})}var xe=require("@peculiar/x509");var j=`-----BEGIN CERTIFICATE-----
+"use strict";var ie=Object.defineProperty;var st=Object.getOwnPropertyDescriptor;var at=Object.getOwnPropertyNames;var ct=Object.prototype.hasOwnProperty;var lt=(e,t)=>{for(var r in t)ie(e,r,{get:t[r],enumerable:!0})},ut=(e,t,r,n)=>{if(t&&typeof t=="object"||typeof t=="function")for(let i of at(t))!ct.call(e,i)&&i!==r&&ie(e,i,{get:()=>t[i],enumerable:!(n=st(t,i))||n.enumerable});return e};var dt=e=>ut(ie({},"__esModule",{value:!0}),e);var ar={};lt(ar,{AWS_NITRO_ROOT_FINGERPRINT_SHA256_HEX:()=>Y,AWS_NITRO_ROOT_PEM:()=>j,NitroAttestationError:()=>_,createEncryptedBuyerTeeSessionMaterial:()=>V,createEncryptedIdentitySessionMaterial:()=>H,createEncryptedSellerCredentialUpload:()=>F,createNitroAttestationClient:()=>Ke,encryptBuyerTeeSessionMaterial:()=>D,encryptIdentitySessionMaterial:()=>B,encryptSellerCredentialUpload:()=>L,fetchAndVerifyAttestation:()=>g,getUnifiedPaymentVerifierDomainSeparator:()=>ee,hashUtf8:()=>A,requestIdentityAttestation:()=>Q,uploadSellerCredential:()=>J,verifyBuyerTeePayment:()=>Z,verifyBuyerTeePaymentAttestation:()=>rt,verifyIdentityAttestation:()=>nt,verifySellerCredentialBundle:()=>it});module.exports=dt(ar);var _=class extends Error{code;cause;details;constructor(t,r,n={}){super(r),this.name="NitroAttestationError",this.code=t,this.cause=n.cause,this.details=n.details}};function o(e,t,r){throw new _(e,t,r)}async function E(e,t,r){try{return await e}catch(n){o(t,r,{cause:n})}}function q(e){return e!==void 0?(typeof e!="function"&&o("CRYPTO_UNAVAILABLE","fetch is unavailable; pass a fetch implementation"),e):(typeof globalThis.fetch!="function"&&o("CRYPTO_UNAVAILABLE","fetch is unavailable; pass a fetch implementation"),globalThis.fetch.bind(globalThis))}function ft(e){let t=e??globalThis.crypto?.subtle;return t||o("CRYPTO_UNAVAILABLE","SubtleCrypto is unavailable; pass params.subtle"),t}function yt(e){if(e)return e;let t=globalThis.crypto;return typeof t?.getRandomValues!="function"&&o("CRYPTO_UNAVAILABLE","crypto.getRandomValues is unavailable; pass params.getRandomValues"),r=>t.getRandomValues(r)}function x(e){return{subtle:ft(e.subtle),getRandomValues:yt(e.getRandomValues)}}function Ae(e,t){return typeof t!="function"&&o("CRYPTO_UNAVAILABLE","crypto.getRandomValues is unavailable; pass params.getRandomValues"),{subtle:e,getRandomValues:t,randomUUID:()=>pt(t)}}function pt(e){let t=e(new Uint8Array(16));t[6]=t[6]&15|64,t[8]=t[8]&63|128;let r=Array.from(t,n=>n.toString(16).padStart(2,"0"));return`${r.slice(0,4).join("")}-${r.slice(4,6).join("")}-${r.slice(6,8).join("")}-${r.slice(8,10).join("")}-${r.slice(10).join("")}`}var W="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/",K=mt(W);function mt(e){let t={};for(let r=0;r<e.length;r+=1)t[e[r]]=r;return t}function I(e){let t="";for(let r of e)t+=r.toString(16).padStart(2,"0");return t}function b(e){if(typeof TextEncoder<"u")return new TextEncoder().encode(e);let t=[];for(let r=0;r<e.length;r+=1){let n=e.codePointAt(r);n>65535&&(r+=1),n<=127?t.push(n):n<=2047?t.push(192|n>>6,128|n&63):n<=65535?t.push(224|n>>12,128|n>>6&63,128|n&63):t.push(240|n>>18,128|n>>12&63,128|n>>6&63,128|n&63)}return new Uint8Array(t)}function O(e){if(typeof TextDecoder<"u")return new TextDecoder().decode(e);let t="";for(let r=0;r<e.length;r+=1){let n=e[r];n<128?t+=String.fromCodePoint(n):(n&224)===192?t+=String.fromCodePoint((n&31)<<6|e[++r]&63):(n&240)===224?t+=String.fromCodePoint((n&15)<<12|(e[++r]&63)<<6|e[++r]&63):t+=String.fromCodePoint((n&7)<<18|(e[++r]&63)<<12|(e[++r]&63)<<6|e[++r]&63)}return t}function At(e){let t="";for(let r=0;r<e.length;r+=3){let n=e[r],i=e[r+1]??0,s=e[r+2]??0,a=n<<16|i<<8|s;t+=W[a>>18&63],t+=W[a>>12&63],t+=r+1<e.length?W[a>>6&63]:"=",t+=r+2<e.length?W[a&63]:"="}return t}function Te(e){return Tt(e,!1)}function M(e){return At(e).replaceAll("+","-").replaceAll("/","_").replace(/=+$/,"")}function Tt(e,t){let r=e.replace(/\s+/g,""),n=t?r.replaceAll("-","+").replaceAll("_","/"):r;if(n.length%4===1)throw new Error("Invalid base64 length");let i=n+"=".repeat((4-n.length%4)%4),s=[];for(let a=0;a<i.length;a+=4){let l=i.slice(a,a+4),u=l.endsWith("==")?2:l.endsWith("=")?1:0,c=z(l[0],K),d=z(l[1],K),f=l[2]==="="?0:z(l[2],K),S=l[3]==="="?0:z(l[3],K),m=c<<18|d<<12|f<<6|S;s.push(m>>16&255),u<2&&s.push(m>>8&255),u<1&&s.push(m&255)}return new Uint8Array(s)}function z(e,t){let r=t[e];if(r===void 0)throw new Error(`Invalid base64 character: ${e}`);return r}function C(e){let t=e.reduce((i,s)=>i+s.length,0),r=new Uint8Array(t),n=0;for(let i of e)r.set(i,n),n+=i.length;return r}function P(e){return new Uint8Array(e).buffer}function Se(e){let t={sessionMaterial:e.sessionMaterial,...e.callerAddress!==void 0?{callerAddress:e.callerAddress}:{},boundPubKeySha256:e.key.publicKeySha256Hex,issuedAtMs:e.issuedAtMs,jweId:e.jweId};return e.platform==="wise"||e.platform==="monobank"?t:{payeeId:e.payeeId,...t}}function ge(e){return{platform:e.platform,actionType:e.actionType,sessionMaterial:e.sessionMaterial,boundPubKeySha256:e.key.publicKeySha256Hex}}function Ee(e){return{platform:e.platform,actionType:e.actionType,sessionMaterial:{callerAddress:e.callerAddress,sessionMaterial:e.sessionMaterial},boundPubKeySha256:e.key.publicKeySha256Hex}}function Ie(e){return JSON.stringify(e)}var St={alg:"RSA-OAEP-256",enc:"A256GCM"},gt=/^[A-Za-z0-9_-]{16,128}$/;async function Pe(e){let t=e.request.issuedAtMs??e.now(),r=e.request.jweId??It(e.getRandomValues);return Et(r),oe({key:e.request.key,plaintext:Se({...e.request,issuedAtMs:t,jweId:r}),subtle:e.subtle,getRandomValues:e.getRandomValues,failureContext:"seller credential upload"})}async function he(e){return oe({key:e.request.key,plaintext:ge(e.request),subtle:e.subtle,getRandomValues:e.getRandomValues,failureContext:"buyer TEE session material"})}async function xe(e){return oe({key:e.request.key,plaintext:Ee(e.request),subtle:e.subtle,getRandomValues:e.getRandomValues,failureContext:"identity session material"})}async function oe(e){let t=b(Ie(e.plaintext)),r=e.getRandomValues(new Uint8Array(32)),n=await E(e.subtle.importKey("spki",P(e.key.publicKeyDer),{name:"RSA-OAEP",hash:"SHA-256"},!1,["encrypt"]),"CRYPTO_UNAVAILABLE","Failed to import attested enclave-upload RSA public key"),i=new Uint8Array(await E(e.subtle.encrypt({name:"RSA-OAEP"},n,P(r)),"CRYPTO_UNAVAILABLE","Failed to RSA-OAEP encrypt the content encryption key")),s=e.getRandomValues(new Uint8Array(12)),a=M(b(JSON.stringify(St))),l=b(a),u=await E(e.subtle.importKey("raw",P(r),{name:"AES-GCM",length:256},!1,["encrypt"]),"CRYPTO_UNAVAILABLE","Failed to import generated AES-GCM content encryption key"),c=new Uint8Array(await E(e.subtle.encrypt({name:"AES-GCM",iv:P(s),additionalData:P(l),tagLength:128},u,P(t)),"CRYPTO_UNAVAILABLE",`Failed to AES-GCM encrypt ${e.failureContext}`)),d=c.slice(0,c.length-16),f=c.slice(c.length-16);return[a,M(i),M(s),M(d),M(f)].join(".")}function Et(e){gt.test(e)||o("INVALID_PARAMETER","jweId must be 16-128 URL-safe characters")}function It(e){let t=e(new Uint8Array(16));t[6]=t[6]&15|64,t[8]=t[8]&63|128;let r=Array.from(t,n=>n.toString(16).padStart(2,"0"));return`${r.slice(0,4).join("")}-${r.slice(4,6).join("")}-${r.slice(6,8).join("")}-${r.slice(8,10).join("")}-${r.slice(10).join("")}`}async function D(e){let t=x(e);return he({request:e,subtle:t.subtle,getRandomValues:t.getRandomValues})}var be=require("@peculiar/x509");var j=`-----BEGIN CERTIFICATE-----
 MIICETCCAZagAwIBAgIRAPkxdWgbkK/hHUbMtOTn+FYwCgYIKoZIzj0EAwMwSTEL
 MAkGA1UEBhMCVVMxDzANBgNVBAoMBkFtYXpvbjEMMAoGA1UECwwDQVdTMRswGQYD
 VQQDDBJhd3Mubml0cm8tZW5jbGF2ZXMwHhcNMTkxMDI4MTMyODA1WhcNNDkxMDI4
@@ -12,5 +12,5 @@ MQCjfy+Rocm9Xue4YnwWmNJVA44fA0P5W2OpYow9OYCVRaEevL8uO1XYru5xtMPW
 rfMCMQCi85sWBbJwKKXdS6BptQFuZbT73o/gBh1qUxl/nNr12UO8Yfwr6wPLb+6N
 IwLz3/Y=
 -----END CERTIFICATE-----
-`,W="641a0321a3e244efe456463195d606317ed7cdcc3c1756e09893f3c68f79bb5b";var Et=10080*60*1e3;async function be(e){let t=me(e.subtle,e.getRandomValues),r=oe(e.rootPem??j,"AWS Nitro root certificate"),n=await ae(r,e.subtle);n!==W&&o("AWS_ROOT_FINGERPRINT_MISMATCH","Bundled AWS Nitro root certificate fingerprint mismatch",{details:{expected:W,actual:n}});let i=oe(e.leafCertificateDer,"attestation leaf certificate"),a=e.cabundleDer.map((d,f)=>oe(d,`cabundle[${f}]`)),s=[r,...a,i];for(let d of s)Pt(d,e.nowMs),ht(d,e.nowMs,e.onWarning);let u=await ae(i,e.subtle),l=[];for(let d of a){let f=await ae(d,e.subtle);f!==u&&f!==n&&l.push(d)}let c=[[i,...l.slice().reverse(),r],[i,...l,r]];for(let d of c)if(await It(d,t)){let f=await E(i.publicKey.export({name:"ECDSA",namedCurve:"P-384"},["verify"],t),"CERT_CHAIN_INVALID","Failed to export attestation leaf public key");return{leafCertificate:i,leafPublicKey:f}}o("CERT_CHAIN_INVALID","Attestation certificate chain does not verify to the pinned AWS Nitro root")}async function It(e,t){for(let r=0;r<e.length-1;r+=1){let n=e[r],i=e[r+1];if(!await n.verify({publicKey:i.publicKey,signatureOnly:!0},t))return!1}return e.length>0&&await e[e.length-1].isSelfSigned(t)}function oe(e,t){try{return new xe.X509Certificate(e)}catch(r){o("CERT_CHAIN_INVALID",`Could not parse ${t}`,{cause:r})}}async function ae(e,t){return I(new Uint8Array(await t.digest("SHA-256",e.rawData)))}function Pt(e,t){(t<e.notBefore.getTime()||t>e.notAfter.getTime())&&o("CERT_NOT_TIME_VALID","Certificate is outside its validity window",{details:{subject:e.subject,notBefore:e.notBefore.toISOString(),notAfter:e.notAfter.toISOString()}})}function ht(e,t,r){e.notAfter.getTime()<t+Et&&r?.({code:"CERT_VALIDITY_NEAR_EXPIRY",message:"Certificate in Nitro attestation chain expires within 7 days",details:{subject:e.subject,notAfter:e.notAfter.toISOString()}})}function Y(e){let t=new se(e),r=t.readValue();if(!t.done())throw new Error("Trailing CBOR bytes");return r}function z(e){if(typeof e=="number"){if(!Number.isSafeInteger(e))throw new Error("CBOR number must be a safe integer");return e>=0?R(0,e):R(1,-1-e)}if(typeof e=="bigint")return e>=0n?R(0,e):R(1,-1n-e);if(typeof e=="string"){let t=b(e);return C([R(3,t.length),t])}if(e instanceof Uint8Array)return C([R(2,e.length),e]);if(Array.isArray(e))return C([R(4,e.length),...e.map(z)]);if(e instanceof Map)return C([R(5,e.size),...Array.from(e.entries()).flatMap(([t,r])=>[z(t),z(r)])]);if(typeof e=="boolean")return new Uint8Array([e?245:244]);if(e===null)return new Uint8Array([246]);throw new Error("Unsupported CBOR value")}function Ce(e,t){return z(["Signature1",e,new Uint8Array,t])}function R(e,t){let r=BigInt(t);return r<24n?new Uint8Array([e<<5|Number(r)]):r<=0xffn?new Uint8Array([e<<5|24,Number(r)]):r<=0xffffn?new Uint8Array([e<<5|25,Number(r>>8n&0xffn),Number(r&0xffn)]):r<=0xffffffffn?new Uint8Array([e<<5|26,Number(r>>24n&0xffn),Number(r>>16n&0xffn),Number(r>>8n&0xffn),Number(r&0xffn)]):new Uint8Array([e<<5|27,Number(r>>56n&0xffn),Number(r>>48n&0xffn),Number(r>>40n&0xffn),Number(r>>32n&0xffn),Number(r>>24n&0xffn),Number(r>>16n&0xffn),Number(r>>8n&0xffn),Number(r&0xffn)])}var se=class{constructor(t){this.bytes=t}bytes;offset=0;done(){return this.offset===this.bytes.length}readValue(){let t=this.readByte(),r=t>>5,n=t&31;if(n===31)return this.readIndefiniteValue(r);if(r===0)return this.readLength(n);if(r===1){let i=this.readLength(n);return typeof i=="bigint"?-1n-i:-1-i}if(r===2){let i=this.lengthAsNumber(this.readLength(n));return this.readBytes(i)}if(r===3){let i=this.lengthAsNumber(this.readLength(n));return O(this.readBytes(i))}if(r===4){let i=this.lengthAsNumber(this.readLength(n)),a=[];for(let s=0;s<i;s+=1)a.push(this.readValue());return a}if(r===5){let i=this.lengthAsNumber(this.readLength(n)),a=new Map;for(let s=0;s<i;s+=1)a.set(this.readValue(),this.readValue());return a}if(r===6)return this.readLength(n),this.readValue();if(r===7){if(n===20)return!1;if(n===21)return!0;if(n===22)return null}throw new Error(`Unsupported CBOR major/additional type: ${r}/${n}`)}readIndefiniteValue(t){if(t===2){let r=[];for(;!this.consumeBreak();){let n=this.readValue();if(!(n instanceof Uint8Array))throw new Error("Indefinite CBOR byte string chunk must be a byte string");r.push(n)}return C(r)}if(t===3){let r="";for(;!this.consumeBreak();){let n=this.readValue();if(typeof n!="string")throw new Error("Indefinite CBOR text string chunk must be a text string");r+=n}return r}if(t===4){let r=[];for(;!this.consumeBreak();)r.push(this.readValue());return r}if(t===5){let r=new Map;for(;!this.consumeBreak();){let n=this.readValue();if(this.peekBreak())throw new Error("Indefinite CBOR map ended after a key");r.set(n,this.readValue())}return r}throw new Error(`Indefinite CBOR major type ${t} is not supported`)}readLength(t){if(t<24)return t;if(t===24)return this.readByte();if(t===25)return this.readByte()<<8|this.readByte();if(t===26)return this.readByte()*16777216+(this.readByte()<<16)+(this.readByte()<<8)+this.readByte()>>>0;if(t===27){let r=0n;for(let n=0;n<8;n+=1)r=r<<8n|BigInt(this.readByte());return r<=BigInt(Number.MAX_SAFE_INTEGER)?Number(r):r}throw new Error("Indefinite CBOR lengths are not supported")}readByte(){if(this.offset>=this.bytes.length)throw new Error("Unexpected end of CBOR input");return this.bytes[this.offset++]}peekBreak(){return this.offset<this.bytes.length&&this.bytes[this.offset]===255}consumeBreak(){return this.peekBreak()?(this.offset+=1,!0):!1}readBytes(t){if(this.offset+t>this.bytes.length)throw new Error("Unexpected end of CBOR byte string");let r=this.bytes.slice(this.offset,this.offset+t);return this.offset+=t,r}lengthAsNumber(t){if(typeof t=="bigint")throw new Error("CBOR length exceeds JavaScript safe integer range");return t}};function Re(e){let t=e[0]===210?e.slice(1):e,r;try{r=Y(t)}catch(u){o("COSE_STRUCTURE_INVALID","Attestation document is not a valid COSE_Sign1 CBOR value",{cause:u})}(!Array.isArray(r)||r.length!==4)&&o("COSE_STRUCTURE_INVALID","COSE_Sign1 must be [protected, unprotected, payload, signature]");let[n,i,a,s]=r;return(!(n instanceof Uint8Array)||!(i instanceof Map)||!(a instanceof Uint8Array)||!(s instanceof Uint8Array))&&o("COSE_STRUCTURE_INVALID","COSE_Sign1 fields have invalid CBOR types"),xt(n),s.length!==96&&o("COSE_SIGNATURE_INVALID_SIZE",`Expected a 96-byte ES384 signature, got ${s.length} bytes`),{protectedHeadersBytes:n,payloadBytes:a,signature:s}}async function Ne(e){let t=Ce(e.protectedHeadersBytes,e.payloadBytes);await E(e.subtle.verify({name:"ECDSA",hash:"SHA-384"},e.leafPublicKey,e.signature,t),"COSE_SIGNATURE_VERIFY_FAILED","COSE_Sign1 signature verification failed")||o("COSE_SIGNATURE_VERIFY_FAILED","COSE_Sign1 signature does not verify with the attestation leaf certificate")}function xt(e){let t;try{t=Y(e)}catch(r){o("COSE_STRUCTURE_INVALID","COSE protected headers are not a valid CBOR map",{cause:r})}t instanceof Map||o("COSE_STRUCTURE_INVALID","COSE protected headers must be a CBOR map"),t.get(1)!==-35&&o("COSE_ALG_UNSUPPORTED","COSE protected header alg must be -35 (ES384)")}var ce=96;function h(e,t){let r=e.replace(/^0x/i,"").toLowerCase();return(r.length!==ce||!/^[0-9a-f]+$/.test(r))&&o("TRUST_PIN_REQUIRED",`${t} must be ${ce} lowercase hex characters`),r}function _e(e,t){let r=h(e,t);return e!==r&&o("ATTESTATION_RESPONSE_INVALID",`${t} must be ${ce} lowercase hex characters`),r}var Ue=256*1024,bt=3,Ct=150,Rt=/^0x[0-9a-fA-F]{40}$/;function Nt(e,t){let r=new URL(e),n=r.pathname.replace(/\/+$/,"");return r.pathname=n.endsWith("/attestation")?n:`${n}/attestation`,r.search="",r.searchParams.set("nonce",t),r}async function De(e){let t=Nt(e.attestationServiceUrl,e.nonceHex),r=await Ot(t.toString(),e.fetch,e.timeoutMs),n=await Ut(r);r.ok||o("ATTESTATION_FETCH_FAILED",`GET /attestation failed with HTTP ${r.status}`,{details:{status:r.status,body:n.slice(0,400)}});let i;try{i=JSON.parse(n)}catch(a){o("ATTESTATION_RESPONSE_INVALID","GET /attestation returned non-JSON response",{cause:a})}return _t(i)}function _t(e){(!Me(e)||e.success!==!0||!Me(e.responseObject))&&o("ATTESTATION_RESPONSE_INVALID","Expected { success: true, responseObject: {...} }");let t=e.responseObject;(typeof t.attestationDocument!="string"||typeof t.nonce!="string")&&o("ATTESTATION_RESPONSE_INVALID","Attestation response is missing attestationDocument or nonce");let r;try{r=Ae(t.attestationDocument)}catch(n){o("ATTESTATION_RESPONSE_INVALID","attestationDocument is not valid base64",{cause:n})}return r.length===0&&o("ATTESTATION_RESPONSE_INVALID","attestationDocument decoded to empty bytes"),{attestationDocument:r,nonce:t.nonce.toLowerCase(),advertised:{chainId:typeof t.chainId=="number"?t.chainId:void 0,verifyingContract:Oe(t.verifyingContract,"verifyingContract"),expectedSigner:Oe(t.expectedSigner,"expectedSigner"),expectedPcr8:wt(t.expectedPcr8,"expectedPcr8")}}}async function Ut(e){if(!e.body){let i=await e.text();return we(b(i).length),i}let t=e.body.getReader(),r=[],n=0;for(;;){let{done:i,value:a}=await t.read();if(i)break;a&&(n+=a.length,we(n),r.push(a))}return O(C(r))}function we(e){e>Ue&&o("ATTESTATION_RESPONSE_INVALID","GET /attestation response exceeded maximum size",{details:{maxBytes:Ue,actualBytes:e}})}function Oe(e,t){if(e!==void 0)return(typeof e!="string"||!Rt.test(e))&&o("ATTESTATION_RESPONSE_INVALID",`${t} must be a 0x-prefixed 20-byte hex address`),e.toLowerCase()}function wt(e,t){if(e!==void 0){typeof e!="string"&&o("ATTESTATION_RESPONSE_INVALID",`${t} must be a 96-character lowercase hex string`);try{return _e(e,t)}catch(r){o("ATTESTATION_RESPONSE_INVALID",`${t} must be a 96-character lowercase hex string`,{cause:r})}}}async function Ot(e,t,r){let n=1;for(;;)try{return await Mt(e,t,r)}catch(i){if(!Dt(i)||n>=bt)throw i;await Vt(Ct*n),n+=1}}async function Mt(e,t,r){let n=typeof AbortController<"u"?new AbortController:void 0,i,a=new Promise((s,u)=>{i=setTimeout(()=>{n?.abort(),u(new Error("timeout"))},r)});try{let s=await Promise.race([t(e,{headers:{accept:"application/json"},signal:n?.signal}),a]);return i!==void 0&&clearTimeout(i),s}catch(s){i!==void 0&&clearTimeout(i),s instanceof Error&&(s.name==="AbortError"||s.message==="timeout")&&o("TIMEOUT",`GET /attestation timed out after ${r}ms`,{cause:s}),o("ATTESTATION_FETCH_FAILED","GET /attestation failed at the network layer",{cause:s,details:{layer:"network"}})}}function Dt(e){return e instanceof _&&e.code==="ATTESTATION_FETCH_FAILED"&&e.details?.layer==="network"}function Vt(e){return new Promise(t=>setTimeout(t,e))}function Me(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}var vt=32;function Ve(e){return I(e(new Uint8Array(vt)))}function ve(e,t){e.toLowerCase()!==t&&o("ATTESTATION_NONCE_MISMATCH","Attestation service echoed a different nonce",{details:{expectedNonce:t,echoedNonce:e}})}function He(e){let t;try{t=Y(e)}catch(a){o("PAYLOAD_FIELD_MISSING","Attestation payload is not a valid CBOR map",{cause:a})}let r=Be(t,"payload"),n=Be(r.get("pcrs"),"pcrs"),i=G(r.get("user_data"),"user_data");return{timestampMs:Bt(r.get("timestamp")),nonceHex:O(i),pcr0Hex:ue(n,0),pcr1Hex:ue(n,1),pcr2Hex:ue(n,2),pcr8Hex:I(G(n.get(8),"pcrs[8]")),certificateDer:G(r.get("certificate"),"certificate"),cabundleDer:Ht(r.get("cabundle"),"cabundle").map((a,s)=>G(a,`cabundle[${s}]`)),publicKeyDer:G(r.get("public_key"),"public_key")}}function ue(e,t){let r=e.get(t);return r instanceof Uint8Array?I(r):""}function Bt(e){if(typeof e=="number"&&Number.isSafeInteger(e)&&e>=0)return e;o("PAYLOAD_FIELD_MISSING","Attestation payload timestamp must be an unsigned safe integer")}function Be(e,t){if(e instanceof Map)return e;o("PAYLOAD_FIELD_MISSING",`Attestation payload field ${t} must be a CBOR map`)}function G(e,t){if(e instanceof Uint8Array)return e;o("PAYLOAD_FIELD_MISSING",`Attestation payload field ${t} must be a byte string`)}function Ht(e,t){if(Array.isArray(e))return e;o("PAYLOAD_FIELD_MISSING",`Attestation payload field ${t} must be an array`)}var Lt="https://attestation-service-staging.zkp2p.xyz",Ft="https://attestation-service.zkp2p.xyz";var Le="5636e3bd96f847cf12cfd9de7faa8cad0e6fa00962ce16ba185f8e5ea57105abb3cc9cc34f1e1e4de3444ceabcca7485",Fe="41a4ae0b9b96752cab5addb7d22689b3070e564e29f90a54316fa33fa38ea51387a6e887ea4f5a4b0cc34f69cea3f40e",kt="5453c5bfb7d040285be5ba9af142f4fbdd9685d082f244b66c62bf7b22d8d02a638fa2e02b9a6fe8877953a9429209e0",ke={"attestation-service-staging.zkp2p.xyz":h(Le,"bundled staging PCR8"),"attestation-service-preprod.zkp2p.xyz":h(kt,"bundled preprod PCR8"),"attestation-service.zkp2p.xyz":h(Fe,"bundled production PCR8")},We={staging:{attestationServiceUrl:Lt,expectedPcr8Hex:Le},production:{attestationServiceUrl:Ft,expectedPcr8Hex:Fe}};function Ye(e){let{trust:t,advertisedExpectedPcr8:r,onWarning:n}=e,i=e.hostname.toLowerCase();if(t?.expectedPcr8Hex)return h(t.expectedPcr8Hex,"trust.expectedPcr8Hex");let a=t?.expectedPcr8ByHost,s=a?Wt(a,i):void 0;if(s)return h(s,`trust.expectedPcr8ByHost[${i}]`);let u=ke[i];if(u)return u;if(t?.strictPin===!0&&o("TRUST_PIN_REQUIRED",`No trusted PCR8 pin is configured for ${i}`),r){let l=h(r,"service-advertised expectedPcr8");return n?.({code:"TRUST_PIN_NOT_PROVIDED",message:`No caller or bundled PCR8 pin was available for ${i}; falling back to service-advertised expectedPcr8`,details:{hostname:i,expectedPcr8:l}}),l}o("TRUST_PIN_REQUIRED",`No trusted or service-advertised PCR8 pin is available for ${i}`)}function Wt(e,t){for(let[r,n]of Object.entries(e))if(r.toLowerCase()===t)return n}var Yt=300*1e3;async function g(e){let t=$(e.fetch),r=x(e),n=e.now??Date.now,i=Ve(r.getRandomValues),a=await De({attestationServiceUrl:e.attestationServiceUrl,nonceHex:i,fetch:t,timeoutMs:e.timeoutMs??1e4});ve(a.nonce,i);let{protectedHeadersBytes:s,payloadBytes:u,signature:l}=Re(a.attestationDocument),c=He(u);c.nonceHex!==i&&o("NONCE_BINDING_FAILED","Attestation payload user_data did not match the request nonce",{details:{expectedNonce:i,payloadNonce:c.nonceHex}});let d=e.trust?.freshnessWindowMs??Yt,f=n();Math.abs(f-c.timestampMs)>d&&o("FRESHNESS_CHECK_FAILED",`Attestation timestamp skew exceeds ${d}ms`,{details:{timestampMs:c.timestampMs,nowMs:f,freshnessWindowMs:d}});let S=new URL(e.attestationServiceUrl).hostname,m=Ye({trust:e.trust,hostname:S,advertisedExpectedPcr8:a.advertised.expectedPcr8,onWarning:e.onWarning});c.pcr8Hex!==m&&o("PCR8_PIN_MISMATCH","Attestation PCR8 does not match the trusted pin",{details:{expectedPcr8:m,actualPcr8:c.pcr8Hex}});let{leafPublicKey:nt}=await be({leafCertificateDer:c.certificateDer,cabundleDer:c.cabundleDer,rootPem:e.trust?.awsNitroRootPem,nowMs:f,subtle:r.subtle,getRandomValues:r.getRandomValues,onWarning:e.onWarning});return await Ne({protectedHeadersBytes:s,payloadBytes:u,signature:l,leafPublicKey:nt,subtle:r.subtle}),{attestedSellerUploadKey:{publicKeyDer:c.publicKeyDer,publicKeySha256Hex:I(new Uint8Array(await r.subtle.digest("SHA-256",P(c.publicKeyDer))))},payload:{timestampMs:c.timestampMs,pcr0Hex:c.pcr0Hex,pcr1Hex:c.pcr1Hex,pcr2Hex:c.pcr2Hex,pcr8Hex:c.pcr8Hex,nonceHex:c.nonceHex,advertised:a.advertised}}}async function V(e){let t=await g({attestationServiceUrl:e.attestationServiceUrl,trust:e.trust,fetch:e.fetch,subtle:e.subtle,getRandomValues:e.getRandomValues,now:e.now,onWarning:e.onWarning,timeoutMs:e.timeoutMs});return D({...e,key:t.attestedSellerUploadKey})}async function v(e){let t=x(e);return he({request:e,subtle:t.subtle,getRandomValues:t.getRandomValues})}async function B(e){let t=await g({attestationServiceUrl:e.attestationServiceUrl,trust:e.trust,fetch:e.fetch,subtle:e.subtle,getRandomValues:e.getRandomValues,now:e.now,onWarning:e.onWarning,timeoutMs:e.timeoutMs});return v({key:t.attestedSellerUploadKey,platform:e.platform,actionType:e.actionType,sessionMaterial:e.sessionMaterial,subtle:e.subtle,getRandomValues:e.getRandomValues})}async function H(e){let t=x(e);return Ie({request:e,subtle:t.subtle,getRandomValues:t.getRandomValues,now:e.now??Date.now})}async function L(e){let{attestationServiceUrl:t,trust:r,fetch:n,onWarning:i,timeoutMs:a,...s}=e,u=await g({attestationServiceUrl:t,trust:r,fetch:n,subtle:e.subtle,getRandomValues:e.getRandomValues,now:e.now,onWarning:i,timeoutMs:a});return H({...s,key:u.attestedSellerUploadKey})}var Gt=400;async function F(e){let t=$(e.fetch),r=e.timeoutMs??1e4,n=new AbortController,i,a=new Promise((c,d)=>{i=setTimeout(()=>{n.abort(),d(new Error("timeout"))},r)}),s,u;try{s=await Promise.race([t(jt(e.attestationServiceUrl,e.path),{method:"POST",headers:{accept:"application/json","content-type":"application/json"},body:JSON.stringify(e.body),signal:n.signal}),a]),u=await Promise.race([s.text(),a])}catch(c){n.signal.aborted&&o("TIMEOUT",`${e.failureContext} timed out after ${r}ms`,{cause:c}),o("ATTESTATION_FETCH_FAILED",`${e.failureContext} failed at the network layer`,{cause:c})}finally{clearTimeout(i)}if(!s.ok){let c=$t(u);c?.success===!1&&Ge(e.failureContext,s.status,c),o("ATTESTATION_FETCH_FAILED",`${e.failureContext} failed with HTTP ${s.status}`,{details:{status:s.status,body:u.slice(0,400)}})}let l;try{l=JSON.parse(u)}catch(c){o("ATTESTATION_RESPONSE_INVALID",`${e.failureContext} returned a non-JSON ServiceResponse`,{cause:c})}return l.success!==!0&&(l.success===!1&&Ge(e.failureContext,s.status,l),o("ATTESTATION_RESPONSE_INVALID",`${e.failureContext} returned an unsuccessful ServiceResponse`)),Kt(l.responseObject)||o("ATTESTATION_RESPONSE_INVALID",`${e.failureContext} returned a ServiceResponse without responseObject`,{details:{status:s.status,envelopeSnippet:qt(l)}}),l.responseObject}function $t(e){try{return JSON.parse(e)}catch{return}}function Ge(e,t,r){let n={status:t,statusCode:r.statusCode,message:r.message,responseObject:r.responseObject};o("SERVICE_RESPONSE_ERROR",`${e} returned an unsuccessful ServiceResponse`,{details:n})}function Kt(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function qt(e){return JSON.stringify(e).slice(0,Gt)}function jt(e,t){let r=new URL(e);return r.pathname=`${r.pathname.replace(/\/+$/u,"")}${t}`,r.search="",r.toString()}async function X(e){let t=await B({attestationServiceUrl:e.attestationServiceUrl,trust:e.trust,fetch:e.fetch,subtle:e.subtle,getRandomValues:e.getRandomValues,now:e.now,onWarning:e.onWarning,timeoutMs:e.timeoutMs,platform:e.platform,actionType:e.actionType,sessionMaterial:e.sessionMaterial});return F({attestationServiceUrl:e.attestationServiceUrl,path:"/identity",fetch:e.fetch,failureContext:"POST /identity",timeoutMs:e.timeoutMs,body:{platform:e.platform,actionType:e.actionType,callerAddress:e.callerAddress,encryptedSessionMaterial:t,params:e.params}})}async function Q(e){let t=await L(e);return F({attestationServiceUrl:e.attestationServiceUrl,path:`/seller/credentials/${encodeURIComponent(e.platform)}`,fetch:e.fetch,failureContext:"POST /seller/credentials",timeoutMs:e.timeoutMs,body:{encryptedUpload:t}})}async function J(e){let t=await V(e);return F({attestationServiceUrl:e.attestationServiceUrl,path:`/buyer/verify/${encodeURIComponent(e.platform)}/${encodeURIComponent(e.actionType)}`,fetch:e.fetch,failureContext:"POST /buyer/verify",timeoutMs:e.timeoutMs,body:{encryptedSessionMaterial:t,params:e.params,chainId:e.chainId,intent:e.intent}})}function $e(e){let t=We[e.environment],r=e.attestationServiceUrl??t.attestationServiceUrl,n=N({strictPin:!0},e.trust);return{createEncryptedBuyerTeeSessionMaterial:i=>{let{attestationServiceUrl:a,trust:s,fetch:u,subtle:l,getRandomValues:c,now:d,onWarning:f,timeoutMs:S,...m}=i;return V({...m,attestationServiceUrl:a??r,trust:N(n,s),fetch:u??e.fetch,subtle:l??e.subtle,getRandomValues:c??e.getRandomValues,now:d??e.now,onWarning:f??e.onWarning,timeoutMs:S??e.timeoutMs})},createEncryptedIdentitySessionMaterial:i=>{let{attestationServiceUrl:a,trust:s,fetch:u,subtle:l,getRandomValues:c,now:d,onWarning:f,timeoutMs:S,...m}=i;return B({...m,attestationServiceUrl:a??r,trust:N(n,s),fetch:u??e.fetch,subtle:l??e.subtle,getRandomValues:c??e.getRandomValues,now:d??e.now,onWarning:f??e.onWarning,timeoutMs:S??e.timeoutMs})},createEncryptedSellerCredentialUpload:i=>{let{attestationServiceUrl:a,trust:s,fetch:u,subtle:l,getRandomValues:c,now:d,onWarning:f,timeoutMs:S,...m}=i;return L({...m,attestationServiceUrl:a??r,trust:N(n,s),fetch:u??e.fetch,subtle:l??e.subtle,getRandomValues:c??e.getRandomValues,now:d??e.now,onWarning:f??e.onWarning,timeoutMs:S??e.timeoutMs})},requestIdentityAttestation:i=>X({attestationServiceUrl:i.attestationServiceUrl??r,trust:N(n,i.trust),fetch:i.fetch??e.fetch,subtle:i.subtle??e.subtle,getRandomValues:i.getRandomValues??e.getRandomValues,now:i.now??e.now,onWarning:i.onWarning??e.onWarning,timeoutMs:i.timeoutMs??e.timeoutMs,platform:i.platform,actionType:i.actionType,callerAddress:i.callerAddress,sessionMaterial:i.sessionMaterial,params:i.params}),uploadSellerCredential:i=>{let{attestationServiceUrl:a,trust:s,fetch:u,subtle:l,getRandomValues:c,now:d,onWarning:f,timeoutMs:S,...m}=i;return Q({...m,attestationServiceUrl:a??r,trust:N(n,s),fetch:u??e.fetch,subtle:l??e.subtle,getRandomValues:c??e.getRandomValues,now:d??e.now,onWarning:f??e.onWarning,timeoutMs:S??e.timeoutMs})},verifyBuyerTeePayment:i=>{let a={attestationServiceUrl:i.attestationServiceUrl??r,trust:N(n,i.trust),fetch:i.fetch??e.fetch,subtle:i.subtle??e.subtle,getRandomValues:i.getRandomValues??e.getRandomValues,now:i.now??e.now,onWarning:i.onWarning??e.onWarning,timeoutMs:i.timeoutMs??e.timeoutMs,platform:i.platform,actionType:i.actionType,sessionMaterial:i.sessionMaterial,params:i.params,chainId:i.chainId,intent:i.intent};return J(a)},fetchAndVerifyAttestation:(i={})=>g({attestationServiceUrl:i.attestationServiceUrl??r,trust:N(n,i.trust),fetch:i.fetch??e.fetch,subtle:i.subtle??e.subtle,getRandomValues:i.getRandomValues??e.getRandomValues,now:i.now??e.now,onWarning:i.onWarning??e.onWarning,timeoutMs:i.timeoutMs??e.timeoutMs}),encryptBuyerTeeSessionMaterial:({subtle:i,getRandomValues:a,...s})=>D({...s,subtle:i??e.subtle,getRandomValues:a??e.getRandomValues}),encryptIdentitySessionMaterial:({subtle:i,getRandomValues:a,...s})=>v({...s,subtle:i??e.subtle,getRandomValues:a??e.getRandomValues}),encryptSellerCredentialUpload:({subtle:i,getRandomValues:a,now:s,...u})=>H({...u,subtle:i??e.subtle,getRandomValues:a??e.getRandomValues,now:s??e.now})}}function N(e,t){return t?{...e,...t,expectedPcr8ByHost:{...e.expectedPcr8ByHost,...t.expectedPcr8ByHost}}:e}var y=require("ethers");var zt={name:"UnifiedPaymentVerifier",version:"1"},de={PaymentAttestation:[{name:"intentHash",type:"bytes32"},{name:"releaseAmount",type:"uint256"},{name:"dataHash",type:"bytes32"}]},Xt="PaymentAttestation(bytes32 intentHash,uint256 releaseAmount,bytes32 dataHash)",Ke=A(Xt),fe={name:"ZKP2PIdentityVerifier",version:"1"},ye={IdentityAttestation:[{name:"method",type:"bytes32"},{name:"actionType",type:"bytes32"},{name:"callerAddress",type:"address"},{name:"payeeIdHash",type:"bytes32"},{name:"dataHash",type:"bytes32"},{name:"issuedAt",type:"uint256"},{name:"validUntil",type:"uint256"}]},Qt="IdentityAttestation(bytes32 method,bytes32 actionType,address callerAddress,bytes32 payeeIdHash,bytes32 dataHash,uint256 issuedAt,uint256 validUntil)",qe=A(Qt),je=y.TypedDataEncoder.hashDomain(fe).toLowerCase(),ze={name:"ZKP2P Seller Credential Bundle",version:"1"},Xe={SellerCredentialBundle:[{name:"platform",type:"string"},{name:"payeeIdHash",type:"bytes32"},{name:"encryptedBlobHash",type:"bytes32"},{name:"encryptedDataKeyHash",type:"bytes32"},{name:"nonceHash",type:"bytes32"},{name:"credentialType",type:"string"},{name:"credentialValidatedAt",type:"string"},{name:"credentialExpiresAt",type:"string"}]};function Jt(e){return{...zt,chainId:e.chainId,verifyingContract:(0,y.getAddress)(e.verifyingContract)}}function Z(e){return y.TypedDataEncoder.hashDomain(Jt(e)).toLowerCase()}function A(e){return(0,y.keccak256)((0,y.toUtf8Bytes)(e)).toLowerCase()}function Qe(e){return(0,y.keccak256)(e).toLowerCase()}function Je(e){try{let t=y.TypedDataEncoder.from(e.types).hash(e.value),r=(0,y.keccak256)((0,y.concat)(["0x1901",e.domainSeparator,t]));return U((0,y.recoverAddress)(r,e.signature))}catch(t){o("ATTESTATION_SIGNATURE_INVALID","Unable to recover signer from attestation signature",{cause:t})}}function ee(e){try{return U((0,y.verifyTypedData)(e.domain,e.types,e.value,e.signature))}catch(t){o("ATTESTATION_SIGNATURE_INVALID","Unable to verify attestation signature",{cause:t})}}function pe(e,t){let r=U(e),n=new Set(t.map(i=>U(i)));return n.has(r)||o("SIGNER_NOT_TRUSTED","Recovered signer is not in trustedSigners",{details:{recoveredSigner:r,trustedSigners:Array.from(n)}}),r}function te(e){let t=pe(e.recoveredSigner,e.trustedSigners),r=U(e.payloadSigner);return r!==t&&o("ATTESTATION_SIGNATURE_INVALID","Payload signer does not match the recovered signer",{details:{payloadSigner:r,recoveredSigner:t}}),t}function p(e,t,r){e.toLowerCase()!==t.toLowerCase()&&o("ATTESTATION_BINDING_MISMATCH",`${r} did not match expected value`,{details:{actual:e,expected:t}})}function Ze(e,t,r){let n,i;try{n=U(e),i=U(t)}catch(a){o("INVALID_PARAMETER",`${r} must be a valid Ethereum address`,{cause:a})}n!==i&&o("ATTESTATION_BINDING_MISMATCH",`${r} did not match expected value`,{details:{actual:e,expected:t}})}function T(e,t,r){e!==t&&o("ATTESTATION_BINDING_MISMATCH",`${r} did not match expected value`,{details:{actual:e,expected:t}})}function re(e,t){JSON.stringify(e)!==JSON.stringify(t)&&o("ATTESTATION_BINDING_MISMATCH","typedDataSpec.types did not match the expected EIP-712 types")}function w(e,t){return typeof e!="string"&&o("INVALID_PARAMETER",`${t} is required`),e}function U(e){return(0,y.getAddress)(e).toLowerCase()}function et(e,t){T(e.platform,t.expectedPlatform,"platform"),T(e.actionType,t.expectedActionType,"actionType"),T(e.typedDataSpec.primaryType,"PaymentAttestation","typedDataSpec.primaryType"),re(e.typedDataSpec.types,de),p(e.typeHash,Ke,"typeHash"),p(e.domainSeparator,Z(t.expectedDomain),"domainSeparator"),p(Qe(e.encodedPaymentDetails),e.typedDataValue.dataHash,"encodedPaymentDetails"),p(e.typedDataValue.intentHash,w(t.expectedIntentHash,"expectedIntentHash"),"typedDataValue.intentHash");let r=Je({domainSeparator:e.domainSeparator,types:de,value:{...e.typedDataValue},signature:e.signature});return te({payloadSigner:e.signer,recoveredSigner:r,trustedSigners:t.trustedSigners}),e}var Zt=["platform","actionType","payeeId","username","metadata"];function tt(e,t){T(e.platform,t.expectedPlatform,"platform"),T(e.actionType,t.expectedActionType,"actionType"),T(e.identity.platform,e.platform,"identity.platform"),T(e.identity.actionType,e.actionType,"identity.actionType"),T(e.typedDataSpec.primaryType,"IdentityAttestation","typedDataSpec.primaryType"),re(e.typedDataSpec.types,ye),p(e.domainSeparator,je,"domainSeparator"),p(e.typeHash,qe,"typeHash"),p(e.identity.method,A(e.identity.platform),"identity.method"),p(e.identity.payeeIdHash,A(e.identity.payeeId),"identity.payeeIdHash"),p(e.typedDataValue.method,e.identity.method,"typedDataValue.method"),p(e.typedDataValue.actionType,A(e.identity.actionType),"typedDataValue.actionType"),Ze(e.typedDataValue.callerAddress,w(t.expectedCallerAddress,"expectedCallerAddress"),"typedDataValue.callerAddress"),p(e.typedDataValue.payeeIdHash,e.identity.payeeIdHash,"typedDataValue.payeeIdHash"),p(e.typedDataValue.payeeIdHash,w(t.expectedPayeeIdHash,"expectedPayeeIdHash"),"typedDataValue.payeeIdHash"),p(e.typedDataValue.dataHash,er(e.identity),"typedDataValue.dataHash"),rr(e.typedDataValue.validUntil,t.now??Date.now);let r=ee({domain:fe,types:ye,value:{...e.typedDataValue},signature:e.signature});return te({payloadSigner:e.signer,recoveredSigner:r,trustedSigners:t.trustedSigners}),e.identity}function er(e){let t={platform:e.platform,actionType:e.actionType,payeeId:e.payeeId,username:e.username,metadata:tr(e.metadata)},r=JSON.stringify(Object.fromEntries(Zt.map(n=>[n,t[n]])));return A(r)}function tr(e){return Object.fromEntries(Object.entries(e).sort(([t],[r])=>t.localeCompare(r)))}function rr(e,t){let r=t();BigInt(r)>BigInt(e)&&o("ATTESTATION_EXPIRED","Identity attestation validUntil is in the past",{details:{validUntil:e,nowMs:r}})}function rt(e,t){T(e.platform,t.expectedPlatform,"platform"),p(e.payeeIdHash,w(t.expectedPayeeIdHash,"expectedPayeeIdHash"),"payeeIdHash"),ir(e.credentialExpiresAt,t.now??Date.now);let r=ee({domain:ze,types:Xe,value:nr(e),signature:e.bundleSignature});return pe(r,t.trustedSigners),e}function nr(e){return{platform:e.platform,payeeIdHash:e.payeeIdHash,encryptedBlobHash:A(e.encryptedBlob),encryptedDataKeyHash:A(e.encryptedDataKey),nonceHash:A(e.nonce),credentialType:e.credentialType,credentialValidatedAt:e.credentialValidatedAt,credentialExpiresAt:e.credentialExpiresAt??""}}function ir(e,t){let r=t();e!==null&&BigInt(r)>BigInt(e)&&o("ATTESTATION_EXPIRED","Seller credential bundle credentialExpiresAt is in the past",{details:{credentialExpiresAt:e,nowMs:r}})}0&&(module.exports={AWS_NITRO_ROOT_FINGERPRINT_SHA256_HEX,AWS_NITRO_ROOT_PEM,NitroAttestationError,createEncryptedBuyerTeeSessionMaterial,createEncryptedIdentitySessionMaterial,createEncryptedSellerCredentialUpload,createNitroAttestationClient,encryptBuyerTeeSessionMaterial,encryptIdentitySessionMaterial,encryptSellerCredentialUpload,fetchAndVerifyAttestation,getUnifiedPaymentVerifierDomainSeparator,hashUtf8,requestIdentityAttestation,uploadSellerCredential,verifyBuyerTeePayment,verifyBuyerTeePaymentAttestation,verifyIdentityAttestation,verifySellerCredentialBundle});
+`,Y="641a0321a3e244efe456463195d606317ed7cdcc3c1756e09893f3c68f79bb5b";var Pt=10080*60*1e3;async function Ce(e){let t=Ae(e.subtle,e.getRandomValues),r=se(e.rootPem??j,"AWS Nitro root certificate"),n=await ae(r,e.subtle);n!==Y&&o("AWS_ROOT_FINGERPRINT_MISMATCH","Bundled AWS Nitro root certificate fingerprint mismatch",{details:{expected:Y,actual:n}});let i=se(e.leafCertificateDer,"attestation leaf certificate"),s=e.cabundleDer.map((d,f)=>se(d,`cabundle[${f}]`)),a=[r,...s,i];for(let d of a)xt(d,e.nowMs),bt(d,e.nowMs,e.onWarning);let l=await ae(i,e.subtle),u=[];for(let d of s){let f=await ae(d,e.subtle);f!==l&&f!==n&&u.push(d)}let c=[[i,...u.slice().reverse(),r],[i,...u,r]];for(let d of c)if(await ht(d,t)){let f=await E(i.publicKey.export({name:"ECDSA",namedCurve:"P-384"},["verify"],t),"CERT_CHAIN_INVALID","Failed to export attestation leaf public key");return{leafCertificate:i,leafPublicKey:f}}o("CERT_CHAIN_INVALID","Attestation certificate chain does not verify to the pinned AWS Nitro root")}async function ht(e,t){for(let r=0;r<e.length-1;r+=1){let n=e[r],i=e[r+1];if(!await n.verify({publicKey:i.publicKey,signatureOnly:!0},t))return!1}return e.length>0&&await e[e.length-1].isSelfSigned(t)}function se(e,t){try{return new be.X509Certificate(e)}catch(r){o("CERT_CHAIN_INVALID",`Could not parse ${t}`,{cause:r})}}async function ae(e,t){return I(new Uint8Array(await t.digest("SHA-256",e.rawData)))}function xt(e,t){(t<e.notBefore.getTime()||t>e.notAfter.getTime())&&o("CERT_NOT_TIME_VALID","Certificate is outside its validity window",{details:{subject:e.subject,notBefore:e.notBefore.toISOString(),notAfter:e.notAfter.toISOString()}})}function bt(e,t,r){e.notAfter.getTime()<t+Pt&&r?.({code:"CERT_VALIDITY_NEAR_EXPIRY",message:"Certificate in Nitro attestation chain expires within 7 days",details:{subject:e.subject,notAfter:e.notAfter.toISOString()}})}function G(e){let t=new ce(e),r=t.readValue();if(!t.done())throw new Error("Trailing CBOR bytes");return r}function X(e){if(typeof e=="number"){if(!Number.isSafeInteger(e))throw new Error("CBOR number must be a safe integer");return e>=0?R(0,e):R(1,-1-e)}if(typeof e=="bigint")return e>=0n?R(0,e):R(1,-1n-e);if(typeof e=="string"){let t=b(e);return C([R(3,t.length),t])}if(e instanceof Uint8Array)return C([R(2,e.length),e]);if(Array.isArray(e))return C([R(4,e.length),...e.map(X)]);if(e instanceof Map)return C([R(5,e.size),...Array.from(e.entries()).flatMap(([t,r])=>[X(t),X(r)])]);if(typeof e=="boolean")return new Uint8Array([e?245:244]);if(e===null)return new Uint8Array([246]);throw new Error("Unsupported CBOR value")}function Re(e,t){return X(["Signature1",e,new Uint8Array,t])}function R(e,t){let r=BigInt(t);return r<24n?new Uint8Array([e<<5|Number(r)]):r<=0xffn?new Uint8Array([e<<5|24,Number(r)]):r<=0xffffn?new Uint8Array([e<<5|25,Number(r>>8n&0xffn),Number(r&0xffn)]):r<=0xffffffffn?new Uint8Array([e<<5|26,Number(r>>24n&0xffn),Number(r>>16n&0xffn),Number(r>>8n&0xffn),Number(r&0xffn)]):new Uint8Array([e<<5|27,Number(r>>56n&0xffn),Number(r>>48n&0xffn),Number(r>>40n&0xffn),Number(r>>32n&0xffn),Number(r>>24n&0xffn),Number(r>>16n&0xffn),Number(r>>8n&0xffn),Number(r&0xffn)])}var ce=class{constructor(t){this.bytes=t}bytes;offset=0;done(){return this.offset===this.bytes.length}readValue(){let t=this.readByte(),r=t>>5,n=t&31;if(n===31)return this.readIndefiniteValue(r);if(r===0)return this.readLength(n);if(r===1){let i=this.readLength(n);return typeof i=="bigint"?-1n-i:-1-i}if(r===2){let i=this.lengthAsNumber(this.readLength(n));return this.readBytes(i)}if(r===3){let i=this.lengthAsNumber(this.readLength(n));return O(this.readBytes(i))}if(r===4){let i=this.lengthAsNumber(this.readLength(n)),s=[];for(let a=0;a<i;a+=1)s.push(this.readValue());return s}if(r===5){let i=this.lengthAsNumber(this.readLength(n)),s=new Map;for(let a=0;a<i;a+=1)s.set(this.readValue(),this.readValue());return s}if(r===6)return this.readLength(n),this.readValue();if(r===7){if(n===20)return!1;if(n===21)return!0;if(n===22)return null}throw new Error(`Unsupported CBOR major/additional type: ${r}/${n}`)}readIndefiniteValue(t){if(t===2){let r=[];for(;!this.consumeBreak();){let n=this.readValue();if(!(n instanceof Uint8Array))throw new Error("Indefinite CBOR byte string chunk must be a byte string");r.push(n)}return C(r)}if(t===3){let r="";for(;!this.consumeBreak();){let n=this.readValue();if(typeof n!="string")throw new Error("Indefinite CBOR text string chunk must be a text string");r+=n}return r}if(t===4){let r=[];for(;!this.consumeBreak();)r.push(this.readValue());return r}if(t===5){let r=new Map;for(;!this.consumeBreak();){let n=this.readValue();if(this.peekBreak())throw new Error("Indefinite CBOR map ended after a key");r.set(n,this.readValue())}return r}throw new Error(`Indefinite CBOR major type ${t} is not supported`)}readLength(t){if(t<24)return t;if(t===24)return this.readByte();if(t===25)return this.readByte()<<8|this.readByte();if(t===26)return this.readByte()*16777216+(this.readByte()<<16)+(this.readByte()<<8)+this.readByte()>>>0;if(t===27){let r=0n;for(let n=0;n<8;n+=1)r=r<<8n|BigInt(this.readByte());return r<=BigInt(Number.MAX_SAFE_INTEGER)?Number(r):r}throw new Error("Indefinite CBOR lengths are not supported")}readByte(){if(this.offset>=this.bytes.length)throw new Error("Unexpected end of CBOR input");return this.bytes[this.offset++]}peekBreak(){return this.offset<this.bytes.length&&this.bytes[this.offset]===255}consumeBreak(){return this.peekBreak()?(this.offset+=1,!0):!1}readBytes(t){if(this.offset+t>this.bytes.length)throw new Error("Unexpected end of CBOR byte string");let r=this.bytes.slice(this.offset,this.offset+t);return this.offset+=t,r}lengthAsNumber(t){if(typeof t=="bigint")throw new Error("CBOR length exceeds JavaScript safe integer range");return t}};function Ne(e){let t=e[0]===210?e.slice(1):e,r;try{r=G(t)}catch(l){o("COSE_STRUCTURE_INVALID","Attestation document is not a valid COSE_Sign1 CBOR value",{cause:l})}(!Array.isArray(r)||r.length!==4)&&o("COSE_STRUCTURE_INVALID","COSE_Sign1 must be [protected, unprotected, payload, signature]");let[n,i,s,a]=r;return(!(n instanceof Uint8Array)||!(i instanceof Map)||!(s instanceof Uint8Array)||!(a instanceof Uint8Array))&&o("COSE_STRUCTURE_INVALID","COSE_Sign1 fields have invalid CBOR types"),Ct(n),a.length!==96&&o("COSE_SIGNATURE_INVALID_SIZE",`Expected a 96-byte ES384 signature, got ${a.length} bytes`),{protectedHeadersBytes:n,payloadBytes:s,signature:a}}async function _e(e){let t=Re(e.protectedHeadersBytes,e.payloadBytes);await E(e.subtle.verify({name:"ECDSA",hash:"SHA-384"},e.leafPublicKey,e.signature,t),"COSE_SIGNATURE_VERIFY_FAILED","COSE_Sign1 signature verification failed")||o("COSE_SIGNATURE_VERIFY_FAILED","COSE_Sign1 signature does not verify with the attestation leaf certificate")}function Ct(e){let t;try{t=G(e)}catch(r){o("COSE_STRUCTURE_INVALID","COSE protected headers are not a valid CBOR map",{cause:r})}t instanceof Map||o("COSE_STRUCTURE_INVALID","COSE protected headers must be a CBOR map"),t.get(1)!==-35&&o("COSE_ALG_UNSUPPORTED","COSE protected header alg must be -35 (ES384)")}var le=96;function h(e,t){let r=e.replace(/^0x/i,"").toLowerCase();return(r.length!==le||!/^[0-9a-f]+$/.test(r))&&o("TRUST_PIN_REQUIRED",`${t} must be ${le} lowercase hex characters`),r}function Ue(e,t){let r=h(e,t);return e!==r&&o("ATTESTATION_RESPONSE_INVALID",`${t} must be ${le} lowercase hex characters`),r}var we=256*1024,Rt=3,Nt=150,_t=/^0x[0-9a-fA-F]{40}$/;function Ut(e,t){let r=new URL(e),n=r.pathname.replace(/\/+$/,"");return r.pathname=n.endsWith("/attestation")?n:`${n}/attestation`,r.search="",r.searchParams.set("nonce",t),r}async function Ve(e){let t=Ut(e.attestationServiceUrl,e.nonceHex),r=await Dt(t.toString(),e.fetch,e.timeoutMs),n=await Ot(r);r.ok||o("ATTESTATION_FETCH_FAILED",`GET /attestation failed with HTTP ${r.status}`,{details:{status:r.status,body:n.slice(0,400)}});let i;try{i=JSON.parse(n)}catch(s){o("ATTESTATION_RESPONSE_INVALID","GET /attestation returned non-JSON response",{cause:s})}return wt(i)}function wt(e){(!De(e)||e.success!==!0||!De(e.responseObject))&&o("ATTESTATION_RESPONSE_INVALID","Expected { success: true, responseObject: {...} }");let t=e.responseObject;(typeof t.attestationDocument!="string"||typeof t.nonce!="string")&&o("ATTESTATION_RESPONSE_INVALID","Attestation response is missing attestationDocument or nonce");let r;try{r=Te(t.attestationDocument)}catch(n){o("ATTESTATION_RESPONSE_INVALID","attestationDocument is not valid base64",{cause:n})}return r.length===0&&o("ATTESTATION_RESPONSE_INVALID","attestationDocument decoded to empty bytes"),{attestationDocument:r,nonce:t.nonce.toLowerCase(),advertised:{chainId:typeof t.chainId=="number"?t.chainId:void 0,verifyingContract:Me(t.verifyingContract,"verifyingContract"),expectedSigner:Me(t.expectedSigner,"expectedSigner"),expectedPcr8:Mt(t.expectedPcr8,"expectedPcr8")}}}async function Ot(e){if(!e.body){let i=await e.text();return Oe(b(i).length),i}let t=e.body.getReader(),r=[],n=0;for(;;){let{done:i,value:s}=await t.read();if(i)break;s&&(n+=s.length,Oe(n),r.push(s))}return O(C(r))}function Oe(e){e>we&&o("ATTESTATION_RESPONSE_INVALID","GET /attestation response exceeded maximum size",{details:{maxBytes:we,actualBytes:e}})}function Me(e,t){if(e!==void 0)return(typeof e!="string"||!_t.test(e))&&o("ATTESTATION_RESPONSE_INVALID",`${t} must be a 0x-prefixed 20-byte hex address`),e.toLowerCase()}function Mt(e,t){if(e!==void 0){typeof e!="string"&&o("ATTESTATION_RESPONSE_INVALID",`${t} must be a 96-character lowercase hex string`);try{return Ue(e,t)}catch(r){o("ATTESTATION_RESPONSE_INVALID",`${t} must be a 96-character lowercase hex string`,{cause:r})}}}async function Dt(e,t,r){let n=1;for(;;)try{return await Vt(e,t,r)}catch(i){if(!vt(i)||n>=Rt)throw i;await Bt(Nt*n),n+=1}}async function Vt(e,t,r){let n=typeof AbortController<"u"?new AbortController:void 0,i,s=new Promise((a,l)=>{i=setTimeout(()=>{n?.abort(),l(new Error("timeout"))},r)});try{let a=await Promise.race([t(e,{headers:{accept:"application/json"},signal:n?.signal}),s]);return i!==void 0&&clearTimeout(i),a}catch(a){i!==void 0&&clearTimeout(i),a instanceof Error&&(a.name==="AbortError"||a.message==="timeout")&&o("TIMEOUT",`GET /attestation timed out after ${r}ms`,{cause:a}),o("ATTESTATION_FETCH_FAILED","GET /attestation failed at the network layer",{cause:a,details:{layer:"network"}})}}function vt(e){return e instanceof _&&e.code==="ATTESTATION_FETCH_FAILED"&&e.details?.layer==="network"}function Bt(e){return new Promise(t=>setTimeout(t,e))}function De(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}var Ht=32;function ve(e){return I(e(new Uint8Array(Ht)))}function Be(e,t){e.toLowerCase()!==t&&o("ATTESTATION_NONCE_MISMATCH","Attestation service echoed a different nonce",{details:{expectedNonce:t,echoedNonce:e}})}function Le(e){let t;try{t=G(e)}catch(s){o("PAYLOAD_FIELD_MISSING","Attestation payload is not a valid CBOR map",{cause:s})}let r=He(t,"payload"),n=He(r.get("pcrs"),"pcrs"),i=$(r.get("user_data"),"user_data");return{timestampMs:Lt(r.get("timestamp")),nonceHex:O(i),pcr0Hex:ue(n,0),pcr1Hex:ue(n,1),pcr2Hex:ue(n,2),pcr8Hex:I($(n.get(8),"pcrs[8]")),certificateDer:$(r.get("certificate"),"certificate"),cabundleDer:Ft(r.get("cabundle"),"cabundle").map((s,a)=>$(s,`cabundle[${a}]`)),publicKeyDer:$(r.get("public_key"),"public_key")}}function ue(e,t){let r=e.get(t);return r instanceof Uint8Array?I(r):""}function Lt(e){if(typeof e=="number"&&Number.isSafeInteger(e)&&e>=0)return e;o("PAYLOAD_FIELD_MISSING","Attestation payload timestamp must be an unsigned safe integer")}function He(e,t){if(e instanceof Map)return e;o("PAYLOAD_FIELD_MISSING",`Attestation payload field ${t} must be a CBOR map`)}function $(e,t){if(e instanceof Uint8Array)return e;o("PAYLOAD_FIELD_MISSING",`Attestation payload field ${t} must be a byte string`)}function Ft(e,t){if(Array.isArray(e))return e;o("PAYLOAD_FIELD_MISSING",`Attestation payload field ${t} must be an array`)}var kt="https://attestation-service-staging.zkp2p.xyz",Wt="https://attestation-service.zkp2p.xyz";var Fe="5636e3bd96f847cf12cfd9de7faa8cad0e6fa00962ce16ba185f8e5ea57105abb3cc9cc34f1e1e4de3444ceabcca7485",ke="41a4ae0b9b96752cab5addb7d22689b3070e564e29f90a54316fa33fa38ea51387a6e887ea4f5a4b0cc34f69cea3f40e",Yt="5453c5bfb7d040285be5ba9af142f4fbdd9685d082f244b66c62bf7b22d8d02a638fa2e02b9a6fe8877953a9429209e0",We={"attestation-service-staging.zkp2p.xyz":h(Fe,"bundled staging PCR8"),"attestation-service-preprod.zkp2p.xyz":h(Yt,"bundled preprod PCR8"),"attestation-service.zkp2p.xyz":h(ke,"bundled production PCR8")},Ye={staging:{attestationServiceUrl:kt,expectedPcr8Hex:Fe},production:{attestationServiceUrl:Wt,expectedPcr8Hex:ke}};function Ge(e){let{trust:t,advertisedExpectedPcr8:r,onWarning:n}=e,i=e.hostname.toLowerCase();if(t?.expectedPcr8Hex)return h(t.expectedPcr8Hex,"trust.expectedPcr8Hex");let s=t?.expectedPcr8ByHost,a=s?Gt(s,i):void 0;if(a)return h(a,`trust.expectedPcr8ByHost[${i}]`);let l=We[i];if(l)return l;if(t?.strictPin===!0&&o("TRUST_PIN_REQUIRED",`No trusted PCR8 pin is configured for ${i}`),r){let u=h(r,"service-advertised expectedPcr8");return n?.({code:"TRUST_PIN_NOT_PROVIDED",message:`No caller or bundled PCR8 pin was available for ${i}; falling back to service-advertised expectedPcr8`,details:{hostname:i,expectedPcr8:u}}),u}o("TRUST_PIN_REQUIRED",`No trusted or service-advertised PCR8 pin is available for ${i}`)}function Gt(e,t){for(let[r,n]of Object.entries(e))if(r.toLowerCase()===t)return n}var $t=300*1e3;async function g(e){let t=q(e.fetch),r=x(e),n=e.now??Date.now,i=ve(r.getRandomValues),s=await Ve({attestationServiceUrl:e.attestationServiceUrl,nonceHex:i,fetch:t,timeoutMs:e.timeoutMs??1e4});Be(s.nonce,i);let{protectedHeadersBytes:a,payloadBytes:l,signature:u}=Ne(s.attestationDocument),c=Le(l);c.nonceHex!==i&&o("NONCE_BINDING_FAILED","Attestation payload user_data did not match the request nonce",{details:{expectedNonce:i,payloadNonce:c.nonceHex}});let d=e.trust?.freshnessWindowMs??$t,f=n();Math.abs(f-c.timestampMs)>d&&o("FRESHNESS_CHECK_FAILED",`Attestation timestamp skew exceeds ${d}ms`,{details:{timestampMs:c.timestampMs,nowMs:f,freshnessWindowMs:d}});let S=new URL(e.attestationServiceUrl).hostname,m=Ge({trust:e.trust,hostname:S,advertisedExpectedPcr8:s.advertised.expectedPcr8,onWarning:e.onWarning});c.pcr8Hex!==m&&o("PCR8_PIN_MISMATCH","Attestation PCR8 does not match the trusted pin",{details:{expectedPcr8:m,actualPcr8:c.pcr8Hex}});let{leafPublicKey:ot}=await Ce({leafCertificateDer:c.certificateDer,cabundleDer:c.cabundleDer,rootPem:e.trust?.awsNitroRootPem,nowMs:f,subtle:r.subtle,getRandomValues:r.getRandomValues,onWarning:e.onWarning});return await _e({protectedHeadersBytes:a,payloadBytes:l,signature:u,leafPublicKey:ot,subtle:r.subtle}),{attestedSellerUploadKey:{publicKeyDer:c.publicKeyDer,publicKeySha256Hex:I(new Uint8Array(await r.subtle.digest("SHA-256",P(c.publicKeyDer))))},payload:{timestampMs:c.timestampMs,pcr0Hex:c.pcr0Hex,pcr1Hex:c.pcr1Hex,pcr2Hex:c.pcr2Hex,pcr8Hex:c.pcr8Hex,nonceHex:c.nonceHex,advertised:s.advertised}}}async function V(e){let t=await g({attestationServiceUrl:e.attestationServiceUrl,trust:e.trust,fetch:e.fetch,subtle:e.subtle,getRandomValues:e.getRandomValues,now:e.now,onWarning:e.onWarning,timeoutMs:e.timeoutMs});return D({...e,key:t.attestedSellerUploadKey})}var $e=require("ethers");function v(e){try{return(0,$e.getAddress)(e)}catch(t){o("INVALID_PARAMETER","callerAddress must be a valid Ethereum address",{cause:t})}}async function B(e){let t=v(e.callerAddress),r=x(e);return xe({request:{...e,callerAddress:t},subtle:r.subtle,getRandomValues:r.getRandomValues})}async function H(e){let t=v(e.callerAddress),r=await g({attestationServiceUrl:e.attestationServiceUrl,trust:e.trust,fetch:e.fetch,subtle:e.subtle,getRandomValues:e.getRandomValues,now:e.now,onWarning:e.onWarning,timeoutMs:e.timeoutMs});return B({key:r.attestedSellerUploadKey,platform:e.platform,actionType:e.actionType,callerAddress:t,sessionMaterial:e.sessionMaterial,subtle:e.subtle,getRandomValues:e.getRandomValues})}async function L(e){let t=x(e);return Pe({request:e,subtle:t.subtle,getRandomValues:t.getRandomValues,now:e.now??Date.now})}async function F(e){let{attestationServiceUrl:t,trust:r,fetch:n,onWarning:i,timeoutMs:s,...a}=e,l=await g({attestationServiceUrl:t,trust:r,fetch:n,subtle:e.subtle,getRandomValues:e.getRandomValues,now:e.now,onWarning:i,timeoutMs:s});return L({...a,key:l.attestedSellerUploadKey})}var qt=400;async function k(e){let t=q(e.fetch),r=e.timeoutMs??1e4,n=new AbortController,i,s=new Promise((c,d)=>{i=setTimeout(()=>{n.abort(),d(new Error("timeout"))},r)}),a,l;try{a=await Promise.race([t(Xt(e.attestationServiceUrl,e.path),{method:"POST",headers:{accept:"application/json","content-type":"application/json"},body:JSON.stringify(e.body),signal:n.signal}),s]),l=await Promise.race([a.text(),s])}catch(c){n.signal.aborted&&o("TIMEOUT",`${e.failureContext} timed out after ${r}ms`,{cause:c}),o("ATTESTATION_FETCH_FAILED",`${e.failureContext} failed at the network layer`,{cause:c})}finally{clearTimeout(i)}if(!a.ok){let c=Kt(l);c?.success===!1&&qe(e.failureContext,a.status,c),o("ATTESTATION_FETCH_FAILED",`${e.failureContext} failed with HTTP ${a.status}`,{details:{status:a.status,body:l.slice(0,400)}})}let u;try{u=JSON.parse(l)}catch(c){o("ATTESTATION_RESPONSE_INVALID",`${e.failureContext} returned a non-JSON ServiceResponse`,{cause:c})}return u.success!==!0&&(u.success===!1&&qe(e.failureContext,a.status,u),o("ATTESTATION_RESPONSE_INVALID",`${e.failureContext} returned an unsuccessful ServiceResponse`)),zt(u.responseObject)||o("ATTESTATION_RESPONSE_INVALID",`${e.failureContext} returned a ServiceResponse without responseObject`,{details:{status:a.status,envelopeSnippet:jt(u)}}),u.responseObject}function Kt(e){try{return JSON.parse(e)}catch{return}}function qe(e,t,r){let n={status:t,statusCode:r.statusCode,message:r.message,responseObject:r.responseObject};o("SERVICE_RESPONSE_ERROR",`${e} returned an unsuccessful ServiceResponse`,{details:n})}function zt(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function jt(e){return JSON.stringify(e).slice(0,qt)}function Xt(e,t){let r=new URL(e);return r.pathname=`${r.pathname.replace(/\/+$/u,"")}${t}`,r.search="",r.toString()}async function Q(e){let t=v(e.callerAddress),r=await H({attestationServiceUrl:e.attestationServiceUrl,trust:e.trust,fetch:e.fetch,subtle:e.subtle,getRandomValues:e.getRandomValues,now:e.now,onWarning:e.onWarning,timeoutMs:e.timeoutMs,platform:e.platform,actionType:e.actionType,callerAddress:t,sessionMaterial:e.sessionMaterial});return k({attestationServiceUrl:e.attestationServiceUrl,path:"/identity",fetch:e.fetch,failureContext:"POST /identity",timeoutMs:e.timeoutMs,body:{platform:e.platform,actionType:e.actionType,callerAddress:t,encryptedSessionMaterial:r,params:e.params}})}async function J(e){let t=await F(e);return k({attestationServiceUrl:e.attestationServiceUrl,path:`/seller/credentials/${encodeURIComponent(e.platform)}`,fetch:e.fetch,failureContext:"POST /seller/credentials",timeoutMs:e.timeoutMs,body:{encryptedUpload:t}})}async function Z(e){let t=await V(e);return k({attestationServiceUrl:e.attestationServiceUrl,path:`/buyer/verify/${encodeURIComponent(e.platform)}/${encodeURIComponent(e.actionType)}`,fetch:e.fetch,failureContext:"POST /buyer/verify",timeoutMs:e.timeoutMs,body:{encryptedSessionMaterial:t,params:e.params,chainId:e.chainId,intent:e.intent}})}function Ke(e){let t=Ye[e.environment],r=e.attestationServiceUrl??t.attestationServiceUrl,n=N({strictPin:!0},e.trust);return{createEncryptedBuyerTeeSessionMaterial:i=>{let{attestationServiceUrl:s,trust:a,fetch:l,subtle:u,getRandomValues:c,now:d,onWarning:f,timeoutMs:S,...m}=i;return V({...m,attestationServiceUrl:s??r,trust:N(n,a),fetch:l??e.fetch,subtle:u??e.subtle,getRandomValues:c??e.getRandomValues,now:d??e.now,onWarning:f??e.onWarning,timeoutMs:S??e.timeoutMs})},createEncryptedIdentitySessionMaterial:i=>{let{attestationServiceUrl:s,trust:a,fetch:l,subtle:u,getRandomValues:c,now:d,onWarning:f,timeoutMs:S,...m}=i;return H({...m,attestationServiceUrl:s??r,trust:N(n,a),fetch:l??e.fetch,subtle:u??e.subtle,getRandomValues:c??e.getRandomValues,now:d??e.now,onWarning:f??e.onWarning,timeoutMs:S??e.timeoutMs})},createEncryptedSellerCredentialUpload:i=>{let{attestationServiceUrl:s,trust:a,fetch:l,subtle:u,getRandomValues:c,now:d,onWarning:f,timeoutMs:S,...m}=i;return F({...m,attestationServiceUrl:s??r,trust:N(n,a),fetch:l??e.fetch,subtle:u??e.subtle,getRandomValues:c??e.getRandomValues,now:d??e.now,onWarning:f??e.onWarning,timeoutMs:S??e.timeoutMs})},requestIdentityAttestation:i=>Q({attestationServiceUrl:i.attestationServiceUrl??r,trust:N(n,i.trust),fetch:i.fetch??e.fetch,subtle:i.subtle??e.subtle,getRandomValues:i.getRandomValues??e.getRandomValues,now:i.now??e.now,onWarning:i.onWarning??e.onWarning,timeoutMs:i.timeoutMs??e.timeoutMs,platform:i.platform,actionType:i.actionType,callerAddress:i.callerAddress,sessionMaterial:i.sessionMaterial,params:i.params}),uploadSellerCredential:i=>{let{attestationServiceUrl:s,trust:a,fetch:l,subtle:u,getRandomValues:c,now:d,onWarning:f,timeoutMs:S,...m}=i;return J({...m,attestationServiceUrl:s??r,trust:N(n,a),fetch:l??e.fetch,subtle:u??e.subtle,getRandomValues:c??e.getRandomValues,now:d??e.now,onWarning:f??e.onWarning,timeoutMs:S??e.timeoutMs})},verifyBuyerTeePayment:i=>{let s={attestationServiceUrl:i.attestationServiceUrl??r,trust:N(n,i.trust),fetch:i.fetch??e.fetch,subtle:i.subtle??e.subtle,getRandomValues:i.getRandomValues??e.getRandomValues,now:i.now??e.now,onWarning:i.onWarning??e.onWarning,timeoutMs:i.timeoutMs??e.timeoutMs,platform:i.platform,actionType:i.actionType,sessionMaterial:i.sessionMaterial,params:i.params,chainId:i.chainId,intent:i.intent};return Z(s)},fetchAndVerifyAttestation:(i={})=>g({attestationServiceUrl:i.attestationServiceUrl??r,trust:N(n,i.trust),fetch:i.fetch??e.fetch,subtle:i.subtle??e.subtle,getRandomValues:i.getRandomValues??e.getRandomValues,now:i.now??e.now,onWarning:i.onWarning??e.onWarning,timeoutMs:i.timeoutMs??e.timeoutMs}),encryptBuyerTeeSessionMaterial:({subtle:i,getRandomValues:s,...a})=>D({...a,subtle:i??e.subtle,getRandomValues:s??e.getRandomValues}),encryptIdentitySessionMaterial:({subtle:i,getRandomValues:s,...a})=>B({...a,subtle:i??e.subtle,getRandomValues:s??e.getRandomValues}),encryptSellerCredentialUpload:({subtle:i,getRandomValues:s,now:a,...l})=>L({...l,subtle:i??e.subtle,getRandomValues:s??e.getRandomValues,now:a??e.now})}}function N(e,t){return t?{...e,...t,expectedPcr8ByHost:{...e.expectedPcr8ByHost,...t.expectedPcr8ByHost}}:e}var y=require("ethers");var Qt={name:"UnifiedPaymentVerifier",version:"1"},fe={PaymentAttestation:[{name:"intentHash",type:"bytes32"},{name:"releaseAmount",type:"uint256"},{name:"dataHash",type:"bytes32"}]},Jt="PaymentAttestation(bytes32 intentHash,uint256 releaseAmount,bytes32 dataHash)",ze=A(Jt),ye={name:"ZKP2PIdentityVerifier",version:"1"},pe={IdentityAttestation:[{name:"method",type:"bytes32"},{name:"actionType",type:"bytes32"},{name:"callerAddress",type:"address"},{name:"payeeIdHash",type:"bytes32"},{name:"dataHash",type:"bytes32"},{name:"issuedAt",type:"uint256"},{name:"validUntil",type:"uint256"}]},Zt="IdentityAttestation(bytes32 method,bytes32 actionType,address callerAddress,bytes32 payeeIdHash,bytes32 dataHash,uint256 issuedAt,uint256 validUntil)",je=A(Zt),Xe=y.TypedDataEncoder.hashDomain(ye).toLowerCase(),Qe={name:"ZKP2P Seller Credential Bundle",version:"1"},Je={SellerCredentialBundle:[{name:"platform",type:"string"},{name:"payeeIdHash",type:"bytes32"},{name:"encryptedBlobHash",type:"bytes32"},{name:"encryptedDataKeyHash",type:"bytes32"},{name:"nonceHash",type:"bytes32"},{name:"credentialType",type:"string"},{name:"credentialValidatedAt",type:"string"},{name:"credentialExpiresAt",type:"string"}]};function er(e){return{...Qt,chainId:e.chainId,verifyingContract:(0,y.getAddress)(e.verifyingContract)}}function ee(e){return y.TypedDataEncoder.hashDomain(er(e)).toLowerCase()}function A(e){return(0,y.keccak256)((0,y.toUtf8Bytes)(e)).toLowerCase()}function Ze(e){return(0,y.keccak256)(e).toLowerCase()}function et(e){try{let t=y.TypedDataEncoder.from(e.types).hash(e.value),r=(0,y.keccak256)((0,y.concat)(["0x1901",e.domainSeparator,t]));return U((0,y.recoverAddress)(r,e.signature))}catch(t){o("ATTESTATION_SIGNATURE_INVALID","Unable to recover signer from attestation signature",{cause:t})}}function te(e){try{return U((0,y.verifyTypedData)(e.domain,e.types,e.value,e.signature))}catch(t){o("ATTESTATION_SIGNATURE_INVALID","Unable to verify attestation signature",{cause:t})}}function me(e,t){let r=U(e),n=new Set(t.map(i=>U(i)));return n.has(r)||o("SIGNER_NOT_TRUSTED","Recovered signer is not in trustedSigners",{details:{recoveredSigner:r,trustedSigners:Array.from(n)}}),r}function re(e){let t=me(e.recoveredSigner,e.trustedSigners),r=U(e.payloadSigner);return r!==t&&o("ATTESTATION_SIGNATURE_INVALID","Payload signer does not match the recovered signer",{details:{payloadSigner:r,recoveredSigner:t}}),t}function p(e,t,r){e.toLowerCase()!==t.toLowerCase()&&o("ATTESTATION_BINDING_MISMATCH",`${r} did not match expected value`,{details:{actual:e,expected:t}})}function tt(e,t,r){let n,i;try{n=U(e),i=U(t)}catch(s){o("INVALID_PARAMETER",`${r} must be a valid Ethereum address`,{cause:s})}n!==i&&o("ATTESTATION_BINDING_MISMATCH",`${r} did not match expected value`,{details:{actual:e,expected:t}})}function T(e,t,r){e!==t&&o("ATTESTATION_BINDING_MISMATCH",`${r} did not match expected value`,{details:{actual:e,expected:t}})}function ne(e,t){JSON.stringify(e)!==JSON.stringify(t)&&o("ATTESTATION_BINDING_MISMATCH","typedDataSpec.types did not match the expected EIP-712 types")}function w(e,t){return typeof e!="string"&&o("INVALID_PARAMETER",`${t} is required`),e}function U(e){return(0,y.getAddress)(e).toLowerCase()}function rt(e,t){T(e.platform,t.expectedPlatform,"platform"),T(e.actionType,t.expectedActionType,"actionType"),T(e.typedDataSpec.primaryType,"PaymentAttestation","typedDataSpec.primaryType"),ne(e.typedDataSpec.types,fe),p(e.typeHash,ze,"typeHash"),p(e.domainSeparator,ee(t.expectedDomain),"domainSeparator"),p(Ze(e.encodedPaymentDetails),e.typedDataValue.dataHash,"encodedPaymentDetails"),p(e.typedDataValue.intentHash,w(t.expectedIntentHash,"expectedIntentHash"),"typedDataValue.intentHash");let r=et({domainSeparator:e.domainSeparator,types:fe,value:{...e.typedDataValue},signature:e.signature});return re({payloadSigner:e.signer,recoveredSigner:r,trustedSigners:t.trustedSigners}),e}var tr=["platform","actionType","payeeId","username","metadata"];function nt(e,t){T(e.platform,t.expectedPlatform,"platform"),T(e.actionType,t.expectedActionType,"actionType"),T(e.identity.platform,e.platform,"identity.platform"),T(e.identity.actionType,e.actionType,"identity.actionType"),T(e.typedDataSpec.primaryType,"IdentityAttestation","typedDataSpec.primaryType"),ne(e.typedDataSpec.types,pe),p(e.domainSeparator,Xe,"domainSeparator"),p(e.typeHash,je,"typeHash"),p(e.identity.method,A(e.identity.platform),"identity.method"),p(e.identity.payeeIdHash,A(e.identity.payeeId),"identity.payeeIdHash"),p(e.typedDataValue.method,e.identity.method,"typedDataValue.method"),p(e.typedDataValue.actionType,A(e.identity.actionType),"typedDataValue.actionType"),tt(e.typedDataValue.callerAddress,w(t.expectedCallerAddress,"expectedCallerAddress"),"typedDataValue.callerAddress"),p(e.typedDataValue.payeeIdHash,e.identity.payeeIdHash,"typedDataValue.payeeIdHash"),p(e.typedDataValue.payeeIdHash,w(t.expectedPayeeIdHash,"expectedPayeeIdHash"),"typedDataValue.payeeIdHash"),p(e.typedDataValue.dataHash,rr(e.identity),"typedDataValue.dataHash"),ir(e.typedDataValue.validUntil,t.now??Date.now);let r=te({domain:ye,types:pe,value:{...e.typedDataValue},signature:e.signature});return re({payloadSigner:e.signer,recoveredSigner:r,trustedSigners:t.trustedSigners}),e.identity}function rr(e){let t={platform:e.platform,actionType:e.actionType,payeeId:e.payeeId,username:e.username,metadata:nr(e.metadata)},r=JSON.stringify(Object.fromEntries(tr.map(n=>[n,t[n]])));return A(r)}function nr(e){return Object.fromEntries(Object.entries(e).sort(([t],[r])=>t.localeCompare(r)))}function ir(e,t){let r=t();BigInt(r)>BigInt(e)&&o("ATTESTATION_EXPIRED","Identity attestation validUntil is in the past",{details:{validUntil:e,nowMs:r}})}function it(e,t){T(e.platform,t.expectedPlatform,"platform"),p(e.payeeIdHash,w(t.expectedPayeeIdHash,"expectedPayeeIdHash"),"payeeIdHash"),sr(e.credentialExpiresAt,t.now??Date.now);let r=te({domain:Qe,types:Je,value:or(e),signature:e.bundleSignature});return me(r,t.trustedSigners),e}function or(e){return{platform:e.platform,payeeIdHash:e.payeeIdHash,encryptedBlobHash:A(e.encryptedBlob),encryptedDataKeyHash:A(e.encryptedDataKey),nonceHash:A(e.nonce),credentialType:e.credentialType,credentialValidatedAt:e.credentialValidatedAt,credentialExpiresAt:e.credentialExpiresAt??""}}function sr(e,t){let r=t();e!==null&&BigInt(r)>BigInt(e)&&o("ATTESTATION_EXPIRED","Seller credential bundle credentialExpiresAt is in the past",{details:{credentialExpiresAt:e,nowMs:r}})}0&&(module.exports={AWS_NITRO_ROOT_FINGERPRINT_SHA256_HEX,AWS_NITRO_ROOT_PEM,NitroAttestationError,createEncryptedBuyerTeeSessionMaterial,createEncryptedIdentitySessionMaterial,createEncryptedSellerCredentialUpload,createNitroAttestationClient,encryptBuyerTeeSessionMaterial,encryptIdentitySessionMaterial,encryptSellerCredentialUpload,fetchAndVerifyAttestation,getUnifiedPaymentVerifierDomainSeparator,hashUtf8,requestIdentityAttestation,uploadSellerCredential,verifyBuyerTeePayment,verifyBuyerTeePaymentAttestation,verifyIdentityAttestation,verifySellerCredentialBundle});
 //# sourceMappingURL=index.cjs.map