@zkp2p/zkp2p-attestation 2.0.0 → 3.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +6 -1
- package/README.md +25 -9
- package/dist/index.cjs +2 -2
- package/dist/index.cjs.map +1 -1
- package/dist/index.d.cts +72 -30
- package/dist/index.d.ts +72 -30
- package/dist/index.js +2 -2
- package/dist/index.js.map +1 -1
- package/package.json +1 -1
package/dist/index.js
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
var U=class extends Error{code;cause;details;constructor(t,r,n={}){super(r),this.name="NitroAttestationError",this.code=t,this.cause=n.cause,this.details=n.details}};function o(e,t,r){throw new U(e,t,r)}async function S(e,t,r){try{return await e}catch(n){o(t,r,{cause:n})}}function
|
|
1
|
+
var U=class extends Error{code;cause;details;constructor(t,r,n={}){super(r),this.name="NitroAttestationError",this.code=t,this.cause=n.cause,this.details=n.details}};function o(e,t,r){throw new U(e,t,r)}async function S(e,t,r){try{return await e}catch(n){o(t,r,{cause:n})}}function G(e){return e!==void 0?(typeof e!="function"&&o("CRYPTO_UNAVAILABLE","fetch is unavailable; pass a fetch implementation"),e):(typeof globalThis.fetch!="function"&&o("CRYPTO_UNAVAILABLE","fetch is unavailable; pass a fetch implementation"),globalThis.fetch.bind(globalThis))}function tt(e){let t=e??globalThis.crypto?.subtle;return t||o("CRYPTO_UNAVAILABLE","SubtleCrypto is unavailable; pass params.subtle"),t}function rt(e){if(e)return e;let t=globalThis.crypto;return typeof t?.getRandomValues!="function"&&o("CRYPTO_UNAVAILABLE","crypto.getRandomValues is unavailable; pass params.getRandomValues"),r=>t.getRandomValues(r)}function h(e){return{subtle:tt(e.subtle),getRandomValues:rt(e.getRandomValues)}}function Ae(e,t){return typeof t!="function"&&o("CRYPTO_UNAVAILABLE","crypto.getRandomValues is unavailable; pass params.getRandomValues"),{subtle:e,getRandomValues:t,randomUUID:()=>nt(t)}}function nt(e){let t=e(new Uint8Array(16));t[6]=t[6]&15|64,t[8]=t[8]&63|128;let r=Array.from(t,n=>n.toString(16).padStart(2,"0"));return`${r.slice(0,4).join("")}-${r.slice(4,6).join("")}-${r.slice(6,8).join("")}-${r.slice(8,10).join("")}-${r.slice(10).join("")}`}var V="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/",$=it(V);function it(e){let t={};for(let r=0;r<e.length;r+=1)t[e[r]]=r;return t}function g(e){let t="";for(let r of e)t+=r.toString(16).padStart(2,"0");return t}function x(e){if(typeof TextEncoder<"u")return new TextEncoder().encode(e);let t=[];for(let r=0;r<e.length;r+=1){let n=e.codePointAt(r);n>65535&&(r+=1),n<=127?t.push(n):n<=2047?t.push(192|n>>6,128|n&63):n<=65535?t.push(224|n>>12,128|n>>6&63,128|n&63):t.push(240|n>>18,128|n>>12&63,128|n>>6&63,128|n&63)}return new Uint8Array(t)}function w(e){if(typeof TextDecoder<"u")return new TextDecoder().decode(e);let t="";for(let r=0;r<e.length;r+=1){let n=e[r];n<128?t+=String.fromCodePoint(n):(n&224)===192?t+=String.fromCodePoint((n&31)<<6|e[++r]&63):(n&240)===224?t+=String.fromCodePoint((n&15)<<12|(e[++r]&63)<<6|e[++r]&63):t+=String.fromCodePoint((n&7)<<18|(e[++r]&63)<<12|(e[++r]&63)<<6|e[++r]&63)}return t}function ot(e){let t="";for(let r=0;r<e.length;r+=3){let n=e[r],i=e[r+1]??0,s=e[r+2]??0,a=n<<16|i<<8|s;t+=V[a>>18&63],t+=V[a>>12&63],t+=r+1<e.length?V[a>>6&63]:"=",t+=r+2<e.length?V[a&63]:"="}return t}function Te(e){return st(e,!1)}function O(e){return ot(e).replaceAll("+","-").replaceAll("/","_").replace(/=+$/,"")}function st(e,t){let r=e.replace(/\s+/g,""),n=t?r.replaceAll("-","+").replaceAll("_","/"):r;if(n.length%4===1)throw new Error("Invalid base64 length");let i=n+"=".repeat((4-n.length%4)%4),s=[];for(let a=0;a<i.length;a+=4){let l=i.slice(a,a+4),u=l.endsWith("==")?2:l.endsWith("=")?1:0,c=q(l[0],$),d=q(l[1],$),f=l[2]==="="?0:q(l[2],$),T=l[3]==="="?0:q(l[3],$),p=c<<18|d<<12|f<<6|T;s.push(p>>16&255),u<2&&s.push(p>>8&255),u<1&&s.push(p&255)}return new Uint8Array(s)}function q(e,t){let r=t[e];if(r===void 0)throw new Error(`Invalid base64 character: ${e}`);return r}function b(e){let t=e.reduce((i,s)=>i+s.length,0),r=new Uint8Array(t),n=0;for(let i of e)r.set(i,n),n+=i.length;return r}function E(e){return new Uint8Array(e).buffer}function Se(e){let t={sessionMaterial:e.sessionMaterial,...e.callerAddress!==void 0?{callerAddress:e.callerAddress}:{},boundPubKeySha256:e.key.publicKeySha256Hex,issuedAtMs:e.issuedAtMs,jweId:e.jweId};return e.platform==="wise"||e.platform==="monobank"?t:{payeeId:e.payeeId,...t}}function ge(e){return{platform:e.platform,actionType:e.actionType,sessionMaterial:e.sessionMaterial,boundPubKeySha256:e.key.publicKeySha256Hex}}function Ee(e){return{platform:e.platform,actionType:e.actionType,sessionMaterial:{callerAddress:e.callerAddress,sessionMaterial:e.sessionMaterial},boundPubKeySha256:e.key.publicKeySha256Hex}}function Ie(e){return JSON.stringify(e)}var at={alg:"RSA-OAEP-256",enc:"A256GCM"},ct=/^[A-Za-z0-9_-]{16,128}$/;async function Pe(e){let t=e.request.issuedAtMs??e.now(),r=e.request.jweId??ut(e.getRandomValues);return lt(r),J({key:e.request.key,plaintext:Se({...e.request,issuedAtMs:t,jweId:r}),subtle:e.subtle,getRandomValues:e.getRandomValues,failureContext:"seller credential upload"})}async function he(e){return J({key:e.request.key,plaintext:ge(e.request),subtle:e.subtle,getRandomValues:e.getRandomValues,failureContext:"buyer TEE session material"})}async function xe(e){return J({key:e.request.key,plaintext:Ee(e.request),subtle:e.subtle,getRandomValues:e.getRandomValues,failureContext:"identity session material"})}async function J(e){let t=x(Ie(e.plaintext)),r=e.getRandomValues(new Uint8Array(32)),n=await S(e.subtle.importKey("spki",E(e.key.publicKeyDer),{name:"RSA-OAEP",hash:"SHA-256"},!1,["encrypt"]),"CRYPTO_UNAVAILABLE","Failed to import attested enclave-upload RSA public key"),i=new Uint8Array(await S(e.subtle.encrypt({name:"RSA-OAEP"},n,E(r)),"CRYPTO_UNAVAILABLE","Failed to RSA-OAEP encrypt the content encryption key")),s=e.getRandomValues(new Uint8Array(12)),a=O(x(JSON.stringify(at))),l=x(a),u=await S(e.subtle.importKey("raw",E(r),{name:"AES-GCM",length:256},!1,["encrypt"]),"CRYPTO_UNAVAILABLE","Failed to import generated AES-GCM content encryption key"),c=new Uint8Array(await S(e.subtle.encrypt({name:"AES-GCM",iv:E(s),additionalData:E(l),tagLength:128},u,E(t)),"CRYPTO_UNAVAILABLE",`Failed to AES-GCM encrypt ${e.failureContext}`)),d=c.slice(0,c.length-16),f=c.slice(c.length-16);return[a,O(i),O(s),O(d),O(f)].join(".")}function lt(e){ct.test(e)||o("INVALID_PARAMETER","jweId must be 16-128 URL-safe characters")}function ut(e){let t=e(new Uint8Array(16));t[6]=t[6]&15|64,t[8]=t[8]&63|128;let r=Array.from(t,n=>n.toString(16).padStart(2,"0"));return`${r.slice(0,4).join("")}-${r.slice(4,6).join("")}-${r.slice(6,8).join("")}-${r.slice(8,10).join("")}-${r.slice(10).join("")}`}async function v(e){let t=h(e);return he({request:e,subtle:t.subtle,getRandomValues:t.getRandomValues})}import{X509Certificate as dt}from"@peculiar/x509";var Z=`-----BEGIN CERTIFICATE-----
|
|
2
2
|
MIICETCCAZagAwIBAgIRAPkxdWgbkK/hHUbMtOTn+FYwCgYIKoZIzj0EAwMwSTEL
|
|
3
3
|
MAkGA1UEBhMCVVMxDzANBgNVBAoMBkFtYXpvbjEMMAoGA1UECwwDQVdTMRswGQYD
|
|
4
4
|
VQQDDBJhd3Mubml0cm8tZW5jbGF2ZXMwHhcNMTkxMDI4MTMyODA1WhcNNDkxMDI4
|
|
@@ -12,5 +12,5 @@ MQCjfy+Rocm9Xue4YnwWmNJVA44fA0P5W2OpYow9OYCVRaEevL8uO1XYru5xtMPW
|
|
|
12
12
|
rfMCMQCi85sWBbJwKKXdS6BptQFuZbT73o/gBh1qUxl/nNr12UO8Yfwr6wPLb+6N
|
|
13
13
|
IwLz3/Y=
|
|
14
14
|
-----END CERTIFICATE-----
|
|
15
|
-
`,K="641a0321a3e244efe456463195d606317ed7cdcc3c1756e09893f3c68f79bb5b";var dt=10080*60*1e3;async function xe(e){let t=me(e.subtle,e.getRandomValues),r=Z(e.rootPem??J,"AWS Nitro root certificate"),n=await ee(r,e.subtle);n!==K&&o("AWS_ROOT_FINGERPRINT_MISMATCH","Bundled AWS Nitro root certificate fingerprint mismatch",{details:{expected:K,actual:n}});let i=Z(e.leafCertificateDer,"attestation leaf certificate"),a=e.cabundleDer.map((d,f)=>Z(d,`cabundle[${f}]`)),s=[r,...a,i];for(let d of s)yt(d,e.nowMs),pt(d,e.nowMs,e.onWarning);let u=await ee(i,e.subtle),l=[];for(let d of a){let f=await ee(d,e.subtle);f!==u&&f!==n&&l.push(d)}let c=[[i,...l.slice().reverse(),r],[i,...l,r]];for(let d of c)if(await ft(d,t)){let f=await S(i.publicKey.export({name:"ECDSA",namedCurve:"P-384"},["verify"],t),"CERT_CHAIN_INVALID","Failed to export attestation leaf public key");return{leafCertificate:i,leafPublicKey:f}}o("CERT_CHAIN_INVALID","Attestation certificate chain does not verify to the pinned AWS Nitro root")}async function ft(e,t){for(let r=0;r<e.length-1;r+=1){let n=e[r],i=e[r+1];if(!await n.verify({publicKey:i.publicKey,signatureOnly:!0},t))return!1}return e.length>0&&await e[e.length-1].isSelfSigned(t)}function Z(e,t){try{return new lt(e)}catch(r){o("CERT_CHAIN_INVALID",`Could not parse ${t}`,{cause:r})}}async function ee(e,t){return g(new Uint8Array(await t.digest("SHA-256",e.rawData)))}function yt(e,t){(t<e.notBefore.getTime()||t>e.notAfter.getTime())&&o("CERT_NOT_TIME_VALID","Certificate is outside its validity window",{details:{subject:e.subject,notBefore:e.notBefore.toISOString(),notAfter:e.notAfter.toISOString()}})}function pt(e,t,r){e.notAfter.getTime()<t+dt&&r?.({code:"CERT_VALIDITY_NEAR_EXPIRY",message:"Certificate in Nitro attestation chain expires within 7 days",details:{subject:e.subject,notAfter:e.notAfter.toISOString()}})}function v(e){let t=new te(e),r=t.readValue();if(!t.done())throw new Error("Trailing CBOR bytes");return r}function q(e){if(typeof e=="number"){if(!Number.isSafeInteger(e))throw new Error("CBOR number must be a safe integer");return e>=0?C(0,e):C(1,-1-e)}if(typeof e=="bigint")return e>=0n?C(0,e):C(1,-1n-e);if(typeof e=="string"){let t=x(e);return b([C(3,t.length),t])}if(e instanceof Uint8Array)return b([C(2,e.length),e]);if(Array.isArray(e))return b([C(4,e.length),...e.map(q)]);if(e instanceof Map)return b([C(5,e.size),...Array.from(e.entries()).flatMap(([t,r])=>[q(t),q(r)])]);if(typeof e=="boolean")return new Uint8Array([e?245:244]);if(e===null)return new Uint8Array([246]);throw new Error("Unsupported CBOR value")}function be(e,t){return q(["Signature1",e,new Uint8Array,t])}function C(e,t){let r=BigInt(t);return r<24n?new Uint8Array([e<<5|Number(r)]):r<=0xffn?new Uint8Array([e<<5|24,Number(r)]):r<=0xffffn?new Uint8Array([e<<5|25,Number(r>>8n&0xffn),Number(r&0xffn)]):r<=0xffffffffn?new Uint8Array([e<<5|26,Number(r>>24n&0xffn),Number(r>>16n&0xffn),Number(r>>8n&0xffn),Number(r&0xffn)]):new Uint8Array([e<<5|27,Number(r>>56n&0xffn),Number(r>>48n&0xffn),Number(r>>40n&0xffn),Number(r>>32n&0xffn),Number(r>>24n&0xffn),Number(r>>16n&0xffn),Number(r>>8n&0xffn),Number(r&0xffn)])}var te=class{constructor(t){this.bytes=t}bytes;offset=0;done(){return this.offset===this.bytes.length}readValue(){let t=this.readByte(),r=t>>5,n=t&31;if(n===31)return this.readIndefiniteValue(r);if(r===0)return this.readLength(n);if(r===1){let i=this.readLength(n);return typeof i=="bigint"?-1n-i:-1-i}if(r===2){let i=this.lengthAsNumber(this.readLength(n));return this.readBytes(i)}if(r===3){let i=this.lengthAsNumber(this.readLength(n));return w(this.readBytes(i))}if(r===4){let i=this.lengthAsNumber(this.readLength(n)),a=[];for(let s=0;s<i;s+=1)a.push(this.readValue());return a}if(r===5){let i=this.lengthAsNumber(this.readLength(n)),a=new Map;for(let s=0;s<i;s+=1)a.set(this.readValue(),this.readValue());return a}if(r===6)return this.readLength(n),this.readValue();if(r===7){if(n===20)return!1;if(n===21)return!0;if(n===22)return null}throw new Error(`Unsupported CBOR major/additional type: ${r}/${n}`)}readIndefiniteValue(t){if(t===2){let r=[];for(;!this.consumeBreak();){let n=this.readValue();if(!(n instanceof Uint8Array))throw new Error("Indefinite CBOR byte string chunk must be a byte string");r.push(n)}return b(r)}if(t===3){let r="";for(;!this.consumeBreak();){let n=this.readValue();if(typeof n!="string")throw new Error("Indefinite CBOR text string chunk must be a text string");r+=n}return r}if(t===4){let r=[];for(;!this.consumeBreak();)r.push(this.readValue());return r}if(t===5){let r=new Map;for(;!this.consumeBreak();){let n=this.readValue();if(this.peekBreak())throw new Error("Indefinite CBOR map ended after a key");r.set(n,this.readValue())}return r}throw new Error(`Indefinite CBOR major type ${t} is not supported`)}readLength(t){if(t<24)return t;if(t===24)return this.readByte();if(t===25)return this.readByte()<<8|this.readByte();if(t===26)return this.readByte()*16777216+(this.readByte()<<16)+(this.readByte()<<8)+this.readByte()>>>0;if(t===27){let r=0n;for(let n=0;n<8;n+=1)r=r<<8n|BigInt(this.readByte());return r<=BigInt(Number.MAX_SAFE_INTEGER)?Number(r):r}throw new Error("Indefinite CBOR lengths are not supported")}readByte(){if(this.offset>=this.bytes.length)throw new Error("Unexpected end of CBOR input");return this.bytes[this.offset++]}peekBreak(){return this.offset<this.bytes.length&&this.bytes[this.offset]===255}consumeBreak(){return this.peekBreak()?(this.offset+=1,!0):!1}readBytes(t){if(this.offset+t>this.bytes.length)throw new Error("Unexpected end of CBOR byte string");let r=this.bytes.slice(this.offset,this.offset+t);return this.offset+=t,r}lengthAsNumber(t){if(typeof t=="bigint")throw new Error("CBOR length exceeds JavaScript safe integer range");return t}};function Ce(e){let t=e[0]===210?e.slice(1):e,r;try{r=v(t)}catch(u){o("COSE_STRUCTURE_INVALID","Attestation document is not a valid COSE_Sign1 CBOR value",{cause:u})}(!Array.isArray(r)||r.length!==4)&&o("COSE_STRUCTURE_INVALID","COSE_Sign1 must be [protected, unprotected, payload, signature]");let[n,i,a,s]=r;return(!(n instanceof Uint8Array)||!(i instanceof Map)||!(a instanceof Uint8Array)||!(s instanceof Uint8Array))&&o("COSE_STRUCTURE_INVALID","COSE_Sign1 fields have invalid CBOR types"),mt(n),s.length!==96&&o("COSE_SIGNATURE_INVALID_SIZE",`Expected a 96-byte ES384 signature, got ${s.length} bytes`),{protectedHeadersBytes:n,payloadBytes:a,signature:s}}async function Re(e){let t=be(e.protectedHeadersBytes,e.payloadBytes);await S(e.subtle.verify({name:"ECDSA",hash:"SHA-384"},e.leafPublicKey,e.signature,t),"COSE_SIGNATURE_VERIFY_FAILED","COSE_Sign1 signature verification failed")||o("COSE_SIGNATURE_VERIFY_FAILED","COSE_Sign1 signature does not verify with the attestation leaf certificate")}function mt(e){let t;try{t=v(e)}catch(r){o("COSE_STRUCTURE_INVALID","COSE protected headers are not a valid CBOR map",{cause:r})}t instanceof Map||o("COSE_STRUCTURE_INVALID","COSE protected headers must be a CBOR map"),t.get(1)!==-35&&o("COSE_ALG_UNSUPPORTED","COSE protected header alg must be -35 (ES384)")}var re=96;function I(e,t){let r=e.replace(/^0x/i,"").toLowerCase();return(r.length!==re||!/^[0-9a-f]+$/.test(r))&&o("TRUST_PIN_REQUIRED",`${t} must be ${re} lowercase hex characters`),r}function Ne(e,t){let r=I(e,t);return e!==r&&o("ATTESTATION_RESPONSE_INVALID",`${t} must be ${re} lowercase hex characters`),r}var _e=256*1024,At=3,Tt=150,St=/^0x[0-9a-fA-F]{40}$/;function gt(e,t){let r=new URL(e),n=r.pathname.replace(/\/+$/,"");return r.pathname=n.endsWith("/attestation")?n:`${n}/attestation`,r.search="",r.searchParams.set("nonce",t),r}async function Me(e){let t=gt(e.attestationServiceUrl,e.nonceHex),r=await ht(t.toString(),e.fetch,e.timeoutMs),n=await It(r);r.ok||o("ATTESTATION_FETCH_FAILED",`GET /attestation failed with HTTP ${r.status}`,{details:{status:r.status,body:n.slice(0,400)}});let i;try{i=JSON.parse(n)}catch(a){o("ATTESTATION_RESPONSE_INVALID","GET /attestation returned non-JSON response",{cause:a})}return Et(i)}function Et(e){(!Oe(e)||e.success!==!0||!Oe(e.responseObject))&&o("ATTESTATION_RESPONSE_INVALID","Expected { success: true, responseObject: {...} }");let t=e.responseObject;(typeof t.attestationDocument!="string"||typeof t.nonce!="string")&&o("ATTESTATION_RESPONSE_INVALID","Attestation response is missing attestationDocument or nonce");let r;try{r=Ae(t.attestationDocument)}catch(n){o("ATTESTATION_RESPONSE_INVALID","attestationDocument is not valid base64",{cause:n})}return r.length===0&&o("ATTESTATION_RESPONSE_INVALID","attestationDocument decoded to empty bytes"),{attestationDocument:r,nonce:t.nonce.toLowerCase(),advertised:{chainId:typeof t.chainId=="number"?t.chainId:void 0,verifyingContract:we(t.verifyingContract,"verifyingContract"),expectedSigner:we(t.expectedSigner,"expectedSigner"),expectedPcr8:Pt(t.expectedPcr8,"expectedPcr8")}}}async function It(e){if(!e.body){let i=await e.text();return Ue(x(i).length),i}let t=e.body.getReader(),r=[],n=0;for(;;){let{done:i,value:a}=await t.read();if(i)break;a&&(n+=a.length,Ue(n),r.push(a))}return w(b(r))}function Ue(e){e>_e&&o("ATTESTATION_RESPONSE_INVALID","GET /attestation response exceeded maximum size",{details:{maxBytes:_e,actualBytes:e}})}function we(e,t){if(e!==void 0)return(typeof e!="string"||!St.test(e))&&o("ATTESTATION_RESPONSE_INVALID",`${t} must be a 0x-prefixed 20-byte hex address`),e.toLowerCase()}function Pt(e,t){if(e!==void 0){typeof e!="string"&&o("ATTESTATION_RESPONSE_INVALID",`${t} must be a 96-character lowercase hex string`);try{return Ne(e,t)}catch(r){o("ATTESTATION_RESPONSE_INVALID",`${t} must be a 96-character lowercase hex string`,{cause:r})}}}async function ht(e,t,r){let n=1;for(;;)try{return await xt(e,t,r)}catch(i){if(!bt(i)||n>=At)throw i;await Ct(Tt*n),n+=1}}async function xt(e,t,r){let n=typeof AbortController<"u"?new AbortController:void 0,i,a=new Promise((s,u)=>{i=setTimeout(()=>{n?.abort(),u(new Error("timeout"))},r)});try{let s=await Promise.race([t(e,{headers:{accept:"application/json"},signal:n?.signal}),a]);return i!==void 0&&clearTimeout(i),s}catch(s){i!==void 0&&clearTimeout(i),s instanceof Error&&(s.name==="AbortError"||s.message==="timeout")&&o("TIMEOUT",`GET /attestation timed out after ${r}ms`,{cause:s}),o("ATTESTATION_FETCH_FAILED","GET /attestation failed at the network layer",{cause:s,details:{layer:"network"}})}}function bt(e){return e instanceof U&&e.code==="ATTESTATION_FETCH_FAILED"&&e.details?.layer==="network"}function Ct(e){return new Promise(t=>setTimeout(t,e))}function Oe(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}var Rt=32;function De(e){return g(e(new Uint8Array(Rt)))}function Ve(e,t){e.toLowerCase()!==t&&o("ATTESTATION_NONCE_MISMATCH","Attestation service echoed a different nonce",{details:{expectedNonce:t,echoedNonce:e}})}function Be(e){let t;try{t=v(e)}catch(a){o("PAYLOAD_FIELD_MISSING","Attestation payload is not a valid CBOR map",{cause:a})}let r=ve(t,"payload"),n=ve(r.get("pcrs"),"pcrs"),i=B(r.get("user_data"),"user_data");return{timestampMs:Nt(r.get("timestamp")),nonceHex:w(i),pcr0Hex:ne(n,0),pcr1Hex:ne(n,1),pcr2Hex:ne(n,2),pcr8Hex:g(B(n.get(8),"pcrs[8]")),certificateDer:B(r.get("certificate"),"certificate"),cabundleDer:_t(r.get("cabundle"),"cabundle").map((a,s)=>B(a,`cabundle[${s}]`)),publicKeyDer:B(r.get("public_key"),"public_key")}}function ne(e,t){let r=e.get(t);return r instanceof Uint8Array?g(r):""}function Nt(e){if(typeof e=="number"&&Number.isSafeInteger(e)&&e>=0)return e;o("PAYLOAD_FIELD_MISSING","Attestation payload timestamp must be an unsigned safe integer")}function ve(e,t){if(e instanceof Map)return e;o("PAYLOAD_FIELD_MISSING",`Attestation payload field ${t} must be a CBOR map`)}function B(e,t){if(e instanceof Uint8Array)return e;o("PAYLOAD_FIELD_MISSING",`Attestation payload field ${t} must be a byte string`)}function _t(e,t){if(Array.isArray(e))return e;o("PAYLOAD_FIELD_MISSING",`Attestation payload field ${t} must be an array`)}var Ut="https://attestation-service-staging.zkp2p.xyz",wt="https://attestation-service.zkp2p.xyz";var He="5636e3bd96f847cf12cfd9de7faa8cad0e6fa00962ce16ba185f8e5ea57105abb3cc9cc34f1e1e4de3444ceabcca7485",Le="41a4ae0b9b96752cab5addb7d22689b3070e564e29f90a54316fa33fa38ea51387a6e887ea4f5a4b0cc34f69cea3f40e",Ot="5453c5bfb7d040285be5ba9af142f4fbdd9685d082f244b66c62bf7b22d8d02a638fa2e02b9a6fe8877953a9429209e0",Fe={"attestation-service-staging.zkp2p.xyz":I(He,"bundled staging PCR8"),"attestation-service-preprod.zkp2p.xyz":I(Ot,"bundled preprod PCR8"),"attestation-service.zkp2p.xyz":I(Le,"bundled production PCR8")},ke={staging:{attestationServiceUrl:Ut,expectedPcr8Hex:He},production:{attestationServiceUrl:wt,expectedPcr8Hex:Le}};function We(e){let{trust:t,advertisedExpectedPcr8:r,onWarning:n}=e,i=e.hostname.toLowerCase();if(t?.expectedPcr8Hex)return I(t.expectedPcr8Hex,"trust.expectedPcr8Hex");let a=t?.expectedPcr8ByHost,s=a?Mt(a,i):void 0;if(s)return I(s,`trust.expectedPcr8ByHost[${i}]`);let u=Fe[i];if(u)return u;if(t?.strictPin===!0&&o("TRUST_PIN_REQUIRED",`No trusted PCR8 pin is configured for ${i}`),r){let l=I(r,"service-advertised expectedPcr8");return n?.({code:"TRUST_PIN_NOT_PROVIDED",message:`No caller or bundled PCR8 pin was available for ${i}; falling back to service-advertised expectedPcr8`,details:{hostname:i,expectedPcr8:l}}),l}o("TRUST_PIN_REQUIRED",`No trusted or service-advertised PCR8 pin is available for ${i}`)}function Mt(e,t){for(let[r,n]of Object.entries(e))if(r.toLowerCase()===t)return n}var Dt=300*1e3;async function P(e){let t=Y(e.fetch),r=h(e),n=e.now??Date.now,i=De(r.getRandomValues),a=await Me({attestationServiceUrl:e.attestationServiceUrl,nonceHex:i,fetch:t,timeoutMs:e.timeoutMs??1e4});Ve(a.nonce,i);let{protectedHeadersBytes:s,payloadBytes:u,signature:l}=Ce(a.attestationDocument),c=Be(u);c.nonceHex!==i&&o("NONCE_BINDING_FAILED","Attestation payload user_data did not match the request nonce",{details:{expectedNonce:i,payloadNonce:c.nonceHex}});let d=e.trust?.freshnessWindowMs??Dt,f=n();Math.abs(f-c.timestampMs)>d&&o("FRESHNESS_CHECK_FAILED",`Attestation timestamp skew exceeds ${d}ms`,{details:{timestampMs:c.timestampMs,nowMs:f,freshnessWindowMs:d}});let T=new URL(e.attestationServiceUrl).hostname,p=We({trust:e.trust,hostname:T,advertisedExpectedPcr8:a.advertised.expectedPcr8,onWarning:e.onWarning});c.pcr8Hex!==p&&o("PCR8_PIN_MISMATCH","Attestation PCR8 does not match the trusted pin",{details:{expectedPcr8:p,actualPcr8:c.pcr8Hex}});let{leafPublicKey:Ze}=await xe({leafCertificateDer:c.certificateDer,cabundleDer:c.cabundleDer,rootPem:e.trust?.awsNitroRootPem,nowMs:f,subtle:r.subtle,getRandomValues:r.getRandomValues,onWarning:e.onWarning});return await Re({protectedHeadersBytes:s,payloadBytes:u,signature:l,leafPublicKey:Ze,subtle:r.subtle}),{attestedSellerUploadKey:{publicKeyDer:c.publicKeyDer,publicKeySha256Hex:g(new Uint8Array(await r.subtle.digest("SHA-256",E(c.publicKeyDer))))},payload:{timestampMs:c.timestampMs,pcr0Hex:c.pcr0Hex,pcr1Hex:c.pcr1Hex,pcr2Hex:c.pcr2Hex,pcr8Hex:c.pcr8Hex,nonceHex:c.nonceHex,advertised:a.advertised}}}async function H(e){let t=await P({attestationServiceUrl:e.attestationServiceUrl,trust:e.trust,fetch:e.fetch,subtle:e.subtle,getRandomValues:e.getRandomValues,now:e.now,onWarning:e.onWarning,timeoutMs:e.timeoutMs});return V({...e,key:t.attestedSellerUploadKey})}async function L(e){let t=h(e);return he({request:e,subtle:t.subtle,getRandomValues:t.getRandomValues})}async function F(e){let t=await P({attestationServiceUrl:e.attestationServiceUrl,trust:e.trust,fetch:e.fetch,subtle:e.subtle,getRandomValues:e.getRandomValues,now:e.now,onWarning:e.onWarning,timeoutMs:e.timeoutMs});return L({key:t.attestedSellerUploadKey,platform:e.platform,actionType:e.actionType,sessionMaterial:e.sessionMaterial,subtle:e.subtle,getRandomValues:e.getRandomValues})}async function k(e){let t=h(e);return Ie({request:e,subtle:t.subtle,getRandomValues:t.getRandomValues,now:e.now??Date.now})}async function W(e){let{attestationServiceUrl:t,trust:r,fetch:n,onWarning:i,timeoutMs:a,...s}=e,u=await P({attestationServiceUrl:t,trust:r,fetch:n,subtle:e.subtle,getRandomValues:e.getRandomValues,now:e.now,onWarning:i,timeoutMs:a});return k({...s,key:u.attestedSellerUploadKey})}var Vt=400;async function M(e){let t=Y(e.fetch),r=e.timeoutMs??1e4,n=new AbortController,i,a=new Promise((c,d)=>{i=setTimeout(()=>{n.abort(),d(new Error("timeout"))},r)}),s,u;try{s=await Promise.race([t(Lt(e.attestationServiceUrl,e.path),{method:"POST",headers:{accept:"application/json","content-type":"application/json"},body:JSON.stringify(e.body),signal:n.signal}),a]),u=await Promise.race([s.text(),a])}catch(c){n.signal.aborted&&o("TIMEOUT",`${e.failureContext} timed out after ${r}ms`,{cause:c}),o("ATTESTATION_FETCH_FAILED",`${e.failureContext} failed at the network layer`,{cause:c})}finally{clearTimeout(i)}if(!s.ok){let c=vt(u);c?.success===!1&&Ye(e.failureContext,s.status,c),o("ATTESTATION_FETCH_FAILED",`${e.failureContext} failed with HTTP ${s.status}`,{details:{status:s.status,body:u.slice(0,400)}})}let l;try{l=JSON.parse(u)}catch(c){o("ATTESTATION_RESPONSE_INVALID",`${e.failureContext} returned a non-JSON ServiceResponse`,{cause:c})}return l.success!==!0&&(l.success===!1&&Ye(e.failureContext,s.status,l),o("ATTESTATION_RESPONSE_INVALID",`${e.failureContext} returned an unsuccessful ServiceResponse`)),Bt(l.responseObject)||o("ATTESTATION_RESPONSE_INVALID",`${e.failureContext} returned a ServiceResponse without responseObject`,{details:{status:s.status,envelopeSnippet:Ht(l)}}),l.responseObject}function vt(e){try{return JSON.parse(e)}catch{return}}function Ye(e,t,r){let n={status:t,statusCode:r.statusCode,message:r.message,responseObject:r.responseObject};o("SERVICE_RESPONSE_ERROR",`${e} returned an unsuccessful ServiceResponse`,{details:n})}function Bt(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function Ht(e){return JSON.stringify(e).slice(0,Vt)}function Lt(e,t){let r=new URL(e);return r.pathname=`${r.pathname.replace(/\/+$/u,"")}${t}`,r.search="",r.toString()}async function oe(e){let t=await F({attestationServiceUrl:e.attestationServiceUrl,trust:e.trust,fetch:e.fetch,subtle:e.subtle,getRandomValues:e.getRandomValues,now:e.now,onWarning:e.onWarning,timeoutMs:e.timeoutMs,platform:e.platform,actionType:e.actionType,sessionMaterial:e.sessionMaterial});return M({attestationServiceUrl:e.attestationServiceUrl,path:"/identity",fetch:e.fetch,failureContext:"POST /identity",timeoutMs:e.timeoutMs,body:{platform:e.platform,actionType:e.actionType,callerAddress:e.callerAddress,encryptedSessionMaterial:t,params:e.params}})}async function ae(e){let t=await W(e);return M({attestationServiceUrl:e.attestationServiceUrl,path:`/seller/credentials/${encodeURIComponent(e.platform)}`,fetch:e.fetch,failureContext:"POST /seller/credentials",timeoutMs:e.timeoutMs,body:{encryptedUpload:t}})}async function se(e){let t=await H(e);return M({attestationServiceUrl:e.attestationServiceUrl,path:`/buyer/verify/${encodeURIComponent(e.platform)}/${encodeURIComponent(e.actionType)}`,fetch:e.fetch,failureContext:"POST /buyer/verify",timeoutMs:e.timeoutMs,body:{encryptedSessionMaterial:t,params:e.params,chainId:e.chainId,intent:e.intent}})}function Ft(e){let t=ke[e.environment],r=e.attestationServiceUrl??t.attestationServiceUrl,n=R({strictPin:!0},e.trust);return{createEncryptedBuyerTeeSessionMaterial:i=>{let{attestationServiceUrl:a,trust:s,fetch:u,subtle:l,getRandomValues:c,now:d,onWarning:f,timeoutMs:T,...p}=i;return H({...p,attestationServiceUrl:a??r,trust:R(n,s),fetch:u??e.fetch,subtle:l??e.subtle,getRandomValues:c??e.getRandomValues,now:d??e.now,onWarning:f??e.onWarning,timeoutMs:T??e.timeoutMs})},createEncryptedIdentitySessionMaterial:i=>{let{attestationServiceUrl:a,trust:s,fetch:u,subtle:l,getRandomValues:c,now:d,onWarning:f,timeoutMs:T,...p}=i;return F({...p,attestationServiceUrl:a??r,trust:R(n,s),fetch:u??e.fetch,subtle:l??e.subtle,getRandomValues:c??e.getRandomValues,now:d??e.now,onWarning:f??e.onWarning,timeoutMs:T??e.timeoutMs})},createEncryptedSellerCredentialUpload:i=>{let{attestationServiceUrl:a,trust:s,fetch:u,subtle:l,getRandomValues:c,now:d,onWarning:f,timeoutMs:T,...p}=i;return W({...p,attestationServiceUrl:a??r,trust:R(n,s),fetch:u??e.fetch,subtle:l??e.subtle,getRandomValues:c??e.getRandomValues,now:d??e.now,onWarning:f??e.onWarning,timeoutMs:T??e.timeoutMs})},requestIdentityAttestation:i=>oe({attestationServiceUrl:i.attestationServiceUrl??r,trust:R(n,i.trust),fetch:i.fetch??e.fetch,subtle:i.subtle??e.subtle,getRandomValues:i.getRandomValues??e.getRandomValues,now:i.now??e.now,onWarning:i.onWarning??e.onWarning,timeoutMs:i.timeoutMs??e.timeoutMs,platform:i.platform,actionType:i.actionType,callerAddress:i.callerAddress,sessionMaterial:i.sessionMaterial,params:i.params}),uploadSellerCredential:i=>{let{attestationServiceUrl:a,trust:s,fetch:u,subtle:l,getRandomValues:c,now:d,onWarning:f,timeoutMs:T,...p}=i;return ae({...p,attestationServiceUrl:a??r,trust:R(n,s),fetch:u??e.fetch,subtle:l??e.subtle,getRandomValues:c??e.getRandomValues,now:d??e.now,onWarning:f??e.onWarning,timeoutMs:T??e.timeoutMs})},verifyBuyerTeePayment:i=>{let a={attestationServiceUrl:i.attestationServiceUrl??r,trust:R(n,i.trust),fetch:i.fetch??e.fetch,subtle:i.subtle??e.subtle,getRandomValues:i.getRandomValues??e.getRandomValues,now:i.now??e.now,onWarning:i.onWarning??e.onWarning,timeoutMs:i.timeoutMs??e.timeoutMs,platform:i.platform,actionType:i.actionType,sessionMaterial:i.sessionMaterial,params:i.params,chainId:i.chainId,intent:i.intent};return se(a)},fetchAndVerifyAttestation:(i={})=>P({attestationServiceUrl:i.attestationServiceUrl??r,trust:R(n,i.trust),fetch:i.fetch??e.fetch,subtle:i.subtle??e.subtle,getRandomValues:i.getRandomValues??e.getRandomValues,now:i.now??e.now,onWarning:i.onWarning??e.onWarning,timeoutMs:i.timeoutMs??e.timeoutMs}),encryptBuyerTeeSessionMaterial:({subtle:i,getRandomValues:a,...s})=>V({...s,subtle:i??e.subtle,getRandomValues:a??e.getRandomValues}),encryptIdentitySessionMaterial:({subtle:i,getRandomValues:a,...s})=>L({...s,subtle:i??e.subtle,getRandomValues:a??e.getRandomValues}),encryptSellerCredentialUpload:({subtle:i,getRandomValues:a,now:s,...u})=>k({...u,subtle:i??e.subtle,getRandomValues:a??e.getRandomValues,now:s??e.now})}}function R(e,t){return t?{...e,...t,expectedPcr8ByHost:{...e.expectedPcr8ByHost,...t.expectedPcr8ByHost}}:e}import{concat as kt,getAddress as Ge,keccak256 as ce,recoverAddress as Wt,TypedDataEncoder as ue,toUtf8Bytes as Yt,verifyTypedData as Gt}from"ethers";var $t={name:"UnifiedPaymentVerifier",version:"1"},le={PaymentAttestation:[{name:"intentHash",type:"bytes32"},{name:"releaseAmount",type:"uint256"},{name:"dataHash",type:"bytes32"}]},Kt="PaymentAttestation(bytes32 intentHash,uint256 releaseAmount,bytes32 dataHash)",$e=m(Kt),de={name:"ZKP2PIdentityVerifier",version:"1"},fe={IdentityAttestation:[{name:"method",type:"bytes32"},{name:"actionType",type:"bytes32"},{name:"callerAddress",type:"address"},{name:"payeeIdHash",type:"bytes32"},{name:"dataHash",type:"bytes32"},{name:"issuedAt",type:"uint256"},{name:"validUntil",type:"uint256"}]},qt="IdentityAttestation(bytes32 method,bytes32 actionType,address callerAddress,bytes32 payeeIdHash,bytes32 dataHash,uint256 issuedAt,uint256 validUntil)",Ke=m(qt),qe=ue.hashDomain(de).toLowerCase(),je={name:"ZKP2P Seller Credential Bundle",version:"1"},ze={SellerCredentialBundle:[{name:"platform",type:"string"},{name:"payeeIdHash",type:"bytes32"},{name:"encryptedBlobHash",type:"bytes32"},{name:"encryptedDataKeyHash",type:"bytes32"},{name:"nonceHash",type:"bytes32"},{name:"credentialType",type:"string"},{name:"credentialValidatedAt",type:"string"},{name:"credentialExpiresAt",type:"string"}]};function jt(e){return{...$t,chainId:e.chainId,verifyingContract:Ge(e.verifyingContract)}}function ye(e){return ue.hashDomain(jt(e)).toLowerCase()}function m(e){return ce(Yt(e)).toLowerCase()}function Xe(e){return ce(e).toLowerCase()}function Qe(e){try{let t=ue.from(e.types).hash(e.value),r=ce(kt(["0x1901",e.domainSeparator,t]));return N(Wt(r,e.signature))}catch(t){o("ATTESTATION_SIGNATURE_INVALID","Unable to recover signer from attestation signature",{cause:t})}}function j(e){try{return N(Gt(e.domain,e.types,e.value,e.signature))}catch(t){o("ATTESTATION_SIGNATURE_INVALID","Unable to verify attestation signature",{cause:t})}}function pe(e,t){let r=N(e),n=new Set(t.map(i=>N(i)));return n.has(r)||o("SIGNER_NOT_TRUSTED","Recovered signer is not in trustedSigners",{details:{recoveredSigner:r,trustedSigners:Array.from(n)}}),r}function z(e){let t=pe(e.recoveredSigner,e.trustedSigners),r=N(e.payloadSigner);return r!==t&&o("ATTESTATION_SIGNATURE_INVALID","Payload signer does not match the recovered signer",{details:{payloadSigner:r,recoveredSigner:t}}),t}function y(e,t,r){e.toLowerCase()!==t.toLowerCase()&&o("ATTESTATION_BINDING_MISMATCH",`${r} did not match expected value`,{details:{actual:e,expected:t}})}function Je(e,t,r){let n,i;try{n=N(e),i=N(t)}catch(a){o("INVALID_PARAMETER",`${r} must be a valid Ethereum address`,{cause:a})}n!==i&&o("ATTESTATION_BINDING_MISMATCH",`${r} did not match expected value`,{details:{actual:e,expected:t}})}function A(e,t,r){e!==t&&o("ATTESTATION_BINDING_MISMATCH",`${r} did not match expected value`,{details:{actual:e,expected:t}})}function X(e,t){JSON.stringify(e)!==JSON.stringify(t)&&o("ATTESTATION_BINDING_MISMATCH","typedDataSpec.types did not match the expected EIP-712 types")}function _(e,t){return typeof e!="string"&&o("INVALID_PARAMETER",`${t} is required`),e}function N(e){return Ge(e).toLowerCase()}function zt(e,t){A(e.platform,t.expectedPlatform,"platform"),A(e.actionType,t.expectedActionType,"actionType"),A(e.typedDataSpec.primaryType,"PaymentAttestation","typedDataSpec.primaryType"),X(e.typedDataSpec.types,le),y(e.typeHash,$e,"typeHash"),y(e.domainSeparator,ye(t.expectedDomain),"domainSeparator"),y(Xe(e.encodedPaymentDetails),e.typedDataValue.dataHash,"encodedPaymentDetails"),y(e.typedDataValue.intentHash,_(t.expectedIntentHash,"expectedIntentHash"),"typedDataValue.intentHash");let r=Qe({domainSeparator:e.domainSeparator,types:le,value:{...e.typedDataValue},signature:e.signature});return z({payloadSigner:e.signer,recoveredSigner:r,trustedSigners:t.trustedSigners}),e}var Xt=["platform","actionType","payeeId","username","metadata"];function Qt(e,t){A(e.platform,t.expectedPlatform,"platform"),A(e.actionType,t.expectedActionType,"actionType"),A(e.identity.platform,e.platform,"identity.platform"),A(e.identity.actionType,e.actionType,"identity.actionType"),A(e.typedDataSpec.primaryType,"IdentityAttestation","typedDataSpec.primaryType"),X(e.typedDataSpec.types,fe),y(e.domainSeparator,qe,"domainSeparator"),y(e.typeHash,Ke,"typeHash"),y(e.identity.method,m(e.identity.platform),"identity.method"),y(e.identity.payeeIdHash,m(e.identity.payeeId),"identity.payeeIdHash"),y(e.typedDataValue.method,e.identity.method,"typedDataValue.method"),y(e.typedDataValue.actionType,m(e.identity.actionType),"typedDataValue.actionType"),Je(e.typedDataValue.callerAddress,_(t.expectedCallerAddress,"expectedCallerAddress"),"typedDataValue.callerAddress"),y(e.typedDataValue.payeeIdHash,e.identity.payeeIdHash,"typedDataValue.payeeIdHash"),y(e.typedDataValue.payeeIdHash,_(t.expectedPayeeIdHash,"expectedPayeeIdHash"),"typedDataValue.payeeIdHash"),y(e.typedDataValue.dataHash,Jt(e.identity),"typedDataValue.dataHash"),er(e.typedDataValue.validUntil,t.now??Date.now);let r=j({domain:de,types:fe,value:{...e.typedDataValue},signature:e.signature});return z({payloadSigner:e.signer,recoveredSigner:r,trustedSigners:t.trustedSigners}),e.identity}function Jt(e){let t={platform:e.platform,actionType:e.actionType,payeeId:e.payeeId,username:e.username,metadata:Zt(e.metadata)},r=JSON.stringify(Object.fromEntries(Xt.map(n=>[n,t[n]])));return m(r)}function Zt(e){return Object.fromEntries(Object.entries(e).sort(([t],[r])=>t.localeCompare(r)))}function er(e,t){let r=t();BigInt(r)>BigInt(e)&&o("ATTESTATION_EXPIRED","Identity attestation validUntil is in the past",{details:{validUntil:e,nowMs:r}})}function tr(e,t){A(e.platform,t.expectedPlatform,"platform"),y(e.payeeIdHash,_(t.expectedPayeeIdHash,"expectedPayeeIdHash"),"payeeIdHash"),nr(e.credentialExpiresAt,t.now??Date.now);let r=j({domain:je,types:ze,value:rr(e),signature:e.bundleSignature});return pe(r,t.trustedSigners),e}function rr(e){return{platform:e.platform,payeeIdHash:e.payeeIdHash,encryptedBlobHash:m(e.encryptedBlob),encryptedDataKeyHash:m(e.encryptedDataKey),nonceHash:m(e.nonce),credentialType:e.credentialType,credentialValidatedAt:e.credentialValidatedAt,credentialExpiresAt:e.credentialExpiresAt??""}}function nr(e,t){let r=t();e!==null&&BigInt(r)>BigInt(e)&&o("ATTESTATION_EXPIRED","Seller credential bundle credentialExpiresAt is in the past",{details:{credentialExpiresAt:e,nowMs:r}})}export{K as AWS_NITRO_ROOT_FINGERPRINT_SHA256_HEX,J as AWS_NITRO_ROOT_PEM,U as NitroAttestationError,H as createEncryptedBuyerTeeSessionMaterial,F as createEncryptedIdentitySessionMaterial,W as createEncryptedSellerCredentialUpload,Ft as createNitroAttestationClient,V as encryptBuyerTeeSessionMaterial,L as encryptIdentitySessionMaterial,k as encryptSellerCredentialUpload,P as fetchAndVerifyAttestation,ye as getUnifiedPaymentVerifierDomainSeparator,m as hashUtf8,oe as requestIdentityAttestation,ae as uploadSellerCredential,se as verifyBuyerTeePayment,zt as verifyBuyerTeePaymentAttestation,Qt as verifyIdentityAttestation,tr as verifySellerCredentialBundle};
|
|
15
|
+
`,K="641a0321a3e244efe456463195d606317ed7cdcc3c1756e09893f3c68f79bb5b";var ft=10080*60*1e3;async function be(e){let t=Ae(e.subtle,e.getRandomValues),r=ee(e.rootPem??Z,"AWS Nitro root certificate"),n=await te(r,e.subtle);n!==K&&o("AWS_ROOT_FINGERPRINT_MISMATCH","Bundled AWS Nitro root certificate fingerprint mismatch",{details:{expected:K,actual:n}});let i=ee(e.leafCertificateDer,"attestation leaf certificate"),s=e.cabundleDer.map((d,f)=>ee(d,`cabundle[${f}]`)),a=[r,...s,i];for(let d of a)pt(d,e.nowMs),mt(d,e.nowMs,e.onWarning);let l=await te(i,e.subtle),u=[];for(let d of s){let f=await te(d,e.subtle);f!==l&&f!==n&&u.push(d)}let c=[[i,...u.slice().reverse(),r],[i,...u,r]];for(let d of c)if(await yt(d,t)){let f=await S(i.publicKey.export({name:"ECDSA",namedCurve:"P-384"},["verify"],t),"CERT_CHAIN_INVALID","Failed to export attestation leaf public key");return{leafCertificate:i,leafPublicKey:f}}o("CERT_CHAIN_INVALID","Attestation certificate chain does not verify to the pinned AWS Nitro root")}async function yt(e,t){for(let r=0;r<e.length-1;r+=1){let n=e[r],i=e[r+1];if(!await n.verify({publicKey:i.publicKey,signatureOnly:!0},t))return!1}return e.length>0&&await e[e.length-1].isSelfSigned(t)}function ee(e,t){try{return new dt(e)}catch(r){o("CERT_CHAIN_INVALID",`Could not parse ${t}`,{cause:r})}}async function te(e,t){return g(new Uint8Array(await t.digest("SHA-256",e.rawData)))}function pt(e,t){(t<e.notBefore.getTime()||t>e.notAfter.getTime())&&o("CERT_NOT_TIME_VALID","Certificate is outside its validity window",{details:{subject:e.subject,notBefore:e.notBefore.toISOString(),notAfter:e.notAfter.toISOString()}})}function mt(e,t,r){e.notAfter.getTime()<t+ft&&r?.({code:"CERT_VALIDITY_NEAR_EXPIRY",message:"Certificate in Nitro attestation chain expires within 7 days",details:{subject:e.subject,notAfter:e.notAfter.toISOString()}})}function B(e){let t=new re(e),r=t.readValue();if(!t.done())throw new Error("Trailing CBOR bytes");return r}function z(e){if(typeof e=="number"){if(!Number.isSafeInteger(e))throw new Error("CBOR number must be a safe integer");return e>=0?C(0,e):C(1,-1-e)}if(typeof e=="bigint")return e>=0n?C(0,e):C(1,-1n-e);if(typeof e=="string"){let t=x(e);return b([C(3,t.length),t])}if(e instanceof Uint8Array)return b([C(2,e.length),e]);if(Array.isArray(e))return b([C(4,e.length),...e.map(z)]);if(e instanceof Map)return b([C(5,e.size),...Array.from(e.entries()).flatMap(([t,r])=>[z(t),z(r)])]);if(typeof e=="boolean")return new Uint8Array([e?245:244]);if(e===null)return new Uint8Array([246]);throw new Error("Unsupported CBOR value")}function Ce(e,t){return z(["Signature1",e,new Uint8Array,t])}function C(e,t){let r=BigInt(t);return r<24n?new Uint8Array([e<<5|Number(r)]):r<=0xffn?new Uint8Array([e<<5|24,Number(r)]):r<=0xffffn?new Uint8Array([e<<5|25,Number(r>>8n&0xffn),Number(r&0xffn)]):r<=0xffffffffn?new Uint8Array([e<<5|26,Number(r>>24n&0xffn),Number(r>>16n&0xffn),Number(r>>8n&0xffn),Number(r&0xffn)]):new Uint8Array([e<<5|27,Number(r>>56n&0xffn),Number(r>>48n&0xffn),Number(r>>40n&0xffn),Number(r>>32n&0xffn),Number(r>>24n&0xffn),Number(r>>16n&0xffn),Number(r>>8n&0xffn),Number(r&0xffn)])}var re=class{constructor(t){this.bytes=t}bytes;offset=0;done(){return this.offset===this.bytes.length}readValue(){let t=this.readByte(),r=t>>5,n=t&31;if(n===31)return this.readIndefiniteValue(r);if(r===0)return this.readLength(n);if(r===1){let i=this.readLength(n);return typeof i=="bigint"?-1n-i:-1-i}if(r===2){let i=this.lengthAsNumber(this.readLength(n));return this.readBytes(i)}if(r===3){let i=this.lengthAsNumber(this.readLength(n));return w(this.readBytes(i))}if(r===4){let i=this.lengthAsNumber(this.readLength(n)),s=[];for(let a=0;a<i;a+=1)s.push(this.readValue());return s}if(r===5){let i=this.lengthAsNumber(this.readLength(n)),s=new Map;for(let a=0;a<i;a+=1)s.set(this.readValue(),this.readValue());return s}if(r===6)return this.readLength(n),this.readValue();if(r===7){if(n===20)return!1;if(n===21)return!0;if(n===22)return null}throw new Error(`Unsupported CBOR major/additional type: ${r}/${n}`)}readIndefiniteValue(t){if(t===2){let r=[];for(;!this.consumeBreak();){let n=this.readValue();if(!(n instanceof Uint8Array))throw new Error("Indefinite CBOR byte string chunk must be a byte string");r.push(n)}return b(r)}if(t===3){let r="";for(;!this.consumeBreak();){let n=this.readValue();if(typeof n!="string")throw new Error("Indefinite CBOR text string chunk must be a text string");r+=n}return r}if(t===4){let r=[];for(;!this.consumeBreak();)r.push(this.readValue());return r}if(t===5){let r=new Map;for(;!this.consumeBreak();){let n=this.readValue();if(this.peekBreak())throw new Error("Indefinite CBOR map ended after a key");r.set(n,this.readValue())}return r}throw new Error(`Indefinite CBOR major type ${t} is not supported`)}readLength(t){if(t<24)return t;if(t===24)return this.readByte();if(t===25)return this.readByte()<<8|this.readByte();if(t===26)return this.readByte()*16777216+(this.readByte()<<16)+(this.readByte()<<8)+this.readByte()>>>0;if(t===27){let r=0n;for(let n=0;n<8;n+=1)r=r<<8n|BigInt(this.readByte());return r<=BigInt(Number.MAX_SAFE_INTEGER)?Number(r):r}throw new Error("Indefinite CBOR lengths are not supported")}readByte(){if(this.offset>=this.bytes.length)throw new Error("Unexpected end of CBOR input");return this.bytes[this.offset++]}peekBreak(){return this.offset<this.bytes.length&&this.bytes[this.offset]===255}consumeBreak(){return this.peekBreak()?(this.offset+=1,!0):!1}readBytes(t){if(this.offset+t>this.bytes.length)throw new Error("Unexpected end of CBOR byte string");let r=this.bytes.slice(this.offset,this.offset+t);return this.offset+=t,r}lengthAsNumber(t){if(typeof t=="bigint")throw new Error("CBOR length exceeds JavaScript safe integer range");return t}};function Re(e){let t=e[0]===210?e.slice(1):e,r;try{r=B(t)}catch(l){o("COSE_STRUCTURE_INVALID","Attestation document is not a valid COSE_Sign1 CBOR value",{cause:l})}(!Array.isArray(r)||r.length!==4)&&o("COSE_STRUCTURE_INVALID","COSE_Sign1 must be [protected, unprotected, payload, signature]");let[n,i,s,a]=r;return(!(n instanceof Uint8Array)||!(i instanceof Map)||!(s instanceof Uint8Array)||!(a instanceof Uint8Array))&&o("COSE_STRUCTURE_INVALID","COSE_Sign1 fields have invalid CBOR types"),At(n),a.length!==96&&o("COSE_SIGNATURE_INVALID_SIZE",`Expected a 96-byte ES384 signature, got ${a.length} bytes`),{protectedHeadersBytes:n,payloadBytes:s,signature:a}}async function Ne(e){let t=Ce(e.protectedHeadersBytes,e.payloadBytes);await S(e.subtle.verify({name:"ECDSA",hash:"SHA-384"},e.leafPublicKey,e.signature,t),"COSE_SIGNATURE_VERIFY_FAILED","COSE_Sign1 signature verification failed")||o("COSE_SIGNATURE_VERIFY_FAILED","COSE_Sign1 signature does not verify with the attestation leaf certificate")}function At(e){let t;try{t=B(e)}catch(r){o("COSE_STRUCTURE_INVALID","COSE protected headers are not a valid CBOR map",{cause:r})}t instanceof Map||o("COSE_STRUCTURE_INVALID","COSE protected headers must be a CBOR map"),t.get(1)!==-35&&o("COSE_ALG_UNSUPPORTED","COSE protected header alg must be -35 (ES384)")}var ne=96;function I(e,t){let r=e.replace(/^0x/i,"").toLowerCase();return(r.length!==ne||!/^[0-9a-f]+$/.test(r))&&o("TRUST_PIN_REQUIRED",`${t} must be ${ne} lowercase hex characters`),r}function _e(e,t){let r=I(e,t);return e!==r&&o("ATTESTATION_RESPONSE_INVALID",`${t} must be ${ne} lowercase hex characters`),r}var Ue=256*1024,Tt=3,St=150,gt=/^0x[0-9a-fA-F]{40}$/;function Et(e,t){let r=new URL(e),n=r.pathname.replace(/\/+$/,"");return r.pathname=n.endsWith("/attestation")?n:`${n}/attestation`,r.search="",r.searchParams.set("nonce",t),r}async function De(e){let t=Et(e.attestationServiceUrl,e.nonceHex),r=await xt(t.toString(),e.fetch,e.timeoutMs),n=await Pt(r);r.ok||o("ATTESTATION_FETCH_FAILED",`GET /attestation failed with HTTP ${r.status}`,{details:{status:r.status,body:n.slice(0,400)}});let i;try{i=JSON.parse(n)}catch(s){o("ATTESTATION_RESPONSE_INVALID","GET /attestation returned non-JSON response",{cause:s})}return It(i)}function It(e){(!Me(e)||e.success!==!0||!Me(e.responseObject))&&o("ATTESTATION_RESPONSE_INVALID","Expected { success: true, responseObject: {...} }");let t=e.responseObject;(typeof t.attestationDocument!="string"||typeof t.nonce!="string")&&o("ATTESTATION_RESPONSE_INVALID","Attestation response is missing attestationDocument or nonce");let r;try{r=Te(t.attestationDocument)}catch(n){o("ATTESTATION_RESPONSE_INVALID","attestationDocument is not valid base64",{cause:n})}return r.length===0&&o("ATTESTATION_RESPONSE_INVALID","attestationDocument decoded to empty bytes"),{attestationDocument:r,nonce:t.nonce.toLowerCase(),advertised:{chainId:typeof t.chainId=="number"?t.chainId:void 0,verifyingContract:Oe(t.verifyingContract,"verifyingContract"),expectedSigner:Oe(t.expectedSigner,"expectedSigner"),expectedPcr8:ht(t.expectedPcr8,"expectedPcr8")}}}async function Pt(e){if(!e.body){let i=await e.text();return we(x(i).length),i}let t=e.body.getReader(),r=[],n=0;for(;;){let{done:i,value:s}=await t.read();if(i)break;s&&(n+=s.length,we(n),r.push(s))}return w(b(r))}function we(e){e>Ue&&o("ATTESTATION_RESPONSE_INVALID","GET /attestation response exceeded maximum size",{details:{maxBytes:Ue,actualBytes:e}})}function Oe(e,t){if(e!==void 0)return(typeof e!="string"||!gt.test(e))&&o("ATTESTATION_RESPONSE_INVALID",`${t} must be a 0x-prefixed 20-byte hex address`),e.toLowerCase()}function ht(e,t){if(e!==void 0){typeof e!="string"&&o("ATTESTATION_RESPONSE_INVALID",`${t} must be a 96-character lowercase hex string`);try{return _e(e,t)}catch(r){o("ATTESTATION_RESPONSE_INVALID",`${t} must be a 96-character lowercase hex string`,{cause:r})}}}async function xt(e,t,r){let n=1;for(;;)try{return await bt(e,t,r)}catch(i){if(!Ct(i)||n>=Tt)throw i;await Rt(St*n),n+=1}}async function bt(e,t,r){let n=typeof AbortController<"u"?new AbortController:void 0,i,s=new Promise((a,l)=>{i=setTimeout(()=>{n?.abort(),l(new Error("timeout"))},r)});try{let a=await Promise.race([t(e,{headers:{accept:"application/json"},signal:n?.signal}),s]);return i!==void 0&&clearTimeout(i),a}catch(a){i!==void 0&&clearTimeout(i),a instanceof Error&&(a.name==="AbortError"||a.message==="timeout")&&o("TIMEOUT",`GET /attestation timed out after ${r}ms`,{cause:a}),o("ATTESTATION_FETCH_FAILED","GET /attestation failed at the network layer",{cause:a,details:{layer:"network"}})}}function Ct(e){return e instanceof U&&e.code==="ATTESTATION_FETCH_FAILED"&&e.details?.layer==="network"}function Rt(e){return new Promise(t=>setTimeout(t,e))}function Me(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}var Nt=32;function Ve(e){return g(e(new Uint8Array(Nt)))}function ve(e,t){e.toLowerCase()!==t&&o("ATTESTATION_NONCE_MISMATCH","Attestation service echoed a different nonce",{details:{expectedNonce:t,echoedNonce:e}})}function He(e){let t;try{t=B(e)}catch(s){o("PAYLOAD_FIELD_MISSING","Attestation payload is not a valid CBOR map",{cause:s})}let r=Be(t,"payload"),n=Be(r.get("pcrs"),"pcrs"),i=H(r.get("user_data"),"user_data");return{timestampMs:_t(r.get("timestamp")),nonceHex:w(i),pcr0Hex:ie(n,0),pcr1Hex:ie(n,1),pcr2Hex:ie(n,2),pcr8Hex:g(H(n.get(8),"pcrs[8]")),certificateDer:H(r.get("certificate"),"certificate"),cabundleDer:Ut(r.get("cabundle"),"cabundle").map((s,a)=>H(s,`cabundle[${a}]`)),publicKeyDer:H(r.get("public_key"),"public_key")}}function ie(e,t){let r=e.get(t);return r instanceof Uint8Array?g(r):""}function _t(e){if(typeof e=="number"&&Number.isSafeInteger(e)&&e>=0)return e;o("PAYLOAD_FIELD_MISSING","Attestation payload timestamp must be an unsigned safe integer")}function Be(e,t){if(e instanceof Map)return e;o("PAYLOAD_FIELD_MISSING",`Attestation payload field ${t} must be a CBOR map`)}function H(e,t){if(e instanceof Uint8Array)return e;o("PAYLOAD_FIELD_MISSING",`Attestation payload field ${t} must be a byte string`)}function Ut(e,t){if(Array.isArray(e))return e;o("PAYLOAD_FIELD_MISSING",`Attestation payload field ${t} must be an array`)}var wt="https://attestation-service-staging.zkp2p.xyz",Ot="https://attestation-service.zkp2p.xyz";var Le="5636e3bd96f847cf12cfd9de7faa8cad0e6fa00962ce16ba185f8e5ea57105abb3cc9cc34f1e1e4de3444ceabcca7485",Fe="41a4ae0b9b96752cab5addb7d22689b3070e564e29f90a54316fa33fa38ea51387a6e887ea4f5a4b0cc34f69cea3f40e",Mt="5453c5bfb7d040285be5ba9af142f4fbdd9685d082f244b66c62bf7b22d8d02a638fa2e02b9a6fe8877953a9429209e0",ke={"attestation-service-staging.zkp2p.xyz":I(Le,"bundled staging PCR8"),"attestation-service-preprod.zkp2p.xyz":I(Mt,"bundled preprod PCR8"),"attestation-service.zkp2p.xyz":I(Fe,"bundled production PCR8")},We={staging:{attestationServiceUrl:wt,expectedPcr8Hex:Le},production:{attestationServiceUrl:Ot,expectedPcr8Hex:Fe}};function Ye(e){let{trust:t,advertisedExpectedPcr8:r,onWarning:n}=e,i=e.hostname.toLowerCase();if(t?.expectedPcr8Hex)return I(t.expectedPcr8Hex,"trust.expectedPcr8Hex");let s=t?.expectedPcr8ByHost,a=s?Dt(s,i):void 0;if(a)return I(a,`trust.expectedPcr8ByHost[${i}]`);let l=ke[i];if(l)return l;if(t?.strictPin===!0&&o("TRUST_PIN_REQUIRED",`No trusted PCR8 pin is configured for ${i}`),r){let u=I(r,"service-advertised expectedPcr8");return n?.({code:"TRUST_PIN_NOT_PROVIDED",message:`No caller or bundled PCR8 pin was available for ${i}; falling back to service-advertised expectedPcr8`,details:{hostname:i,expectedPcr8:u}}),u}o("TRUST_PIN_REQUIRED",`No trusted or service-advertised PCR8 pin is available for ${i}`)}function Dt(e,t){for(let[r,n]of Object.entries(e))if(r.toLowerCase()===t)return n}var Vt=300*1e3;async function P(e){let t=G(e.fetch),r=h(e),n=e.now??Date.now,i=Ve(r.getRandomValues),s=await De({attestationServiceUrl:e.attestationServiceUrl,nonceHex:i,fetch:t,timeoutMs:e.timeoutMs??1e4});ve(s.nonce,i);let{protectedHeadersBytes:a,payloadBytes:l,signature:u}=Re(s.attestationDocument),c=He(l);c.nonceHex!==i&&o("NONCE_BINDING_FAILED","Attestation payload user_data did not match the request nonce",{details:{expectedNonce:i,payloadNonce:c.nonceHex}});let d=e.trust?.freshnessWindowMs??Vt,f=n();Math.abs(f-c.timestampMs)>d&&o("FRESHNESS_CHECK_FAILED",`Attestation timestamp skew exceeds ${d}ms`,{details:{timestampMs:c.timestampMs,nowMs:f,freshnessWindowMs:d}});let T=new URL(e.attestationServiceUrl).hostname,p=Ye({trust:e.trust,hostname:T,advertisedExpectedPcr8:s.advertised.expectedPcr8,onWarning:e.onWarning});c.pcr8Hex!==p&&o("PCR8_PIN_MISMATCH","Attestation PCR8 does not match the trusted pin",{details:{expectedPcr8:p,actualPcr8:c.pcr8Hex}});let{leafPublicKey:et}=await be({leafCertificateDer:c.certificateDer,cabundleDer:c.cabundleDer,rootPem:e.trust?.awsNitroRootPem,nowMs:f,subtle:r.subtle,getRandomValues:r.getRandomValues,onWarning:e.onWarning});return await Ne({protectedHeadersBytes:a,payloadBytes:l,signature:u,leafPublicKey:et,subtle:r.subtle}),{attestedSellerUploadKey:{publicKeyDer:c.publicKeyDer,publicKeySha256Hex:g(new Uint8Array(await r.subtle.digest("SHA-256",E(c.publicKeyDer))))},payload:{timestampMs:c.timestampMs,pcr0Hex:c.pcr0Hex,pcr1Hex:c.pcr1Hex,pcr2Hex:c.pcr2Hex,pcr8Hex:c.pcr8Hex,nonceHex:c.nonceHex,advertised:s.advertised}}}async function L(e){let t=await P({attestationServiceUrl:e.attestationServiceUrl,trust:e.trust,fetch:e.fetch,subtle:e.subtle,getRandomValues:e.getRandomValues,now:e.now,onWarning:e.onWarning,timeoutMs:e.timeoutMs});return v({...e,key:t.attestedSellerUploadKey})}import{getAddress as vt}from"ethers";function M(e){try{return vt(e)}catch(t){o("INVALID_PARAMETER","callerAddress must be a valid Ethereum address",{cause:t})}}async function F(e){let t=M(e.callerAddress),r=h(e);return xe({request:{...e,callerAddress:t},subtle:r.subtle,getRandomValues:r.getRandomValues})}async function k(e){let t=M(e.callerAddress),r=await P({attestationServiceUrl:e.attestationServiceUrl,trust:e.trust,fetch:e.fetch,subtle:e.subtle,getRandomValues:e.getRandomValues,now:e.now,onWarning:e.onWarning,timeoutMs:e.timeoutMs});return F({key:r.attestedSellerUploadKey,platform:e.platform,actionType:e.actionType,callerAddress:t,sessionMaterial:e.sessionMaterial,subtle:e.subtle,getRandomValues:e.getRandomValues})}async function W(e){let t=h(e);return Pe({request:e,subtle:t.subtle,getRandomValues:t.getRandomValues,now:e.now??Date.now})}async function Y(e){let{attestationServiceUrl:t,trust:r,fetch:n,onWarning:i,timeoutMs:s,...a}=e,l=await P({attestationServiceUrl:t,trust:r,fetch:n,subtle:e.subtle,getRandomValues:e.getRandomValues,now:e.now,onWarning:i,timeoutMs:s});return W({...a,key:l.attestedSellerUploadKey})}var Bt=400;async function D(e){let t=G(e.fetch),r=e.timeoutMs??1e4,n=new AbortController,i,s=new Promise((c,d)=>{i=setTimeout(()=>{n.abort(),d(new Error("timeout"))},r)}),a,l;try{a=await Promise.race([t(kt(e.attestationServiceUrl,e.path),{method:"POST",headers:{accept:"application/json","content-type":"application/json"},body:JSON.stringify(e.body),signal:n.signal}),s]),l=await Promise.race([a.text(),s])}catch(c){n.signal.aborted&&o("TIMEOUT",`${e.failureContext} timed out after ${r}ms`,{cause:c}),o("ATTESTATION_FETCH_FAILED",`${e.failureContext} failed at the network layer`,{cause:c})}finally{clearTimeout(i)}if(!a.ok){let c=Ht(l);c?.success===!1&&Ge(e.failureContext,a.status,c),o("ATTESTATION_FETCH_FAILED",`${e.failureContext} failed with HTTP ${a.status}`,{details:{status:a.status,body:l.slice(0,400)}})}let u;try{u=JSON.parse(l)}catch(c){o("ATTESTATION_RESPONSE_INVALID",`${e.failureContext} returned a non-JSON ServiceResponse`,{cause:c})}return u.success!==!0&&(u.success===!1&&Ge(e.failureContext,a.status,u),o("ATTESTATION_RESPONSE_INVALID",`${e.failureContext} returned an unsuccessful ServiceResponse`)),Lt(u.responseObject)||o("ATTESTATION_RESPONSE_INVALID",`${e.failureContext} returned a ServiceResponse without responseObject`,{details:{status:a.status,envelopeSnippet:Ft(u)}}),u.responseObject}function Ht(e){try{return JSON.parse(e)}catch{return}}function Ge(e,t,r){let n={status:t,statusCode:r.statusCode,message:r.message,responseObject:r.responseObject};o("SERVICE_RESPONSE_ERROR",`${e} returned an unsuccessful ServiceResponse`,{details:n})}function Lt(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function Ft(e){return JSON.stringify(e).slice(0,Bt)}function kt(e,t){let r=new URL(e);return r.pathname=`${r.pathname.replace(/\/+$/u,"")}${t}`,r.search="",r.toString()}async function se(e){let t=M(e.callerAddress),r=await k({attestationServiceUrl:e.attestationServiceUrl,trust:e.trust,fetch:e.fetch,subtle:e.subtle,getRandomValues:e.getRandomValues,now:e.now,onWarning:e.onWarning,timeoutMs:e.timeoutMs,platform:e.platform,actionType:e.actionType,callerAddress:t,sessionMaterial:e.sessionMaterial});return D({attestationServiceUrl:e.attestationServiceUrl,path:"/identity",fetch:e.fetch,failureContext:"POST /identity",timeoutMs:e.timeoutMs,body:{platform:e.platform,actionType:e.actionType,callerAddress:t,encryptedSessionMaterial:r,params:e.params}})}async function ae(e){let t=await Y(e);return D({attestationServiceUrl:e.attestationServiceUrl,path:`/seller/credentials/${encodeURIComponent(e.platform)}`,fetch:e.fetch,failureContext:"POST /seller/credentials",timeoutMs:e.timeoutMs,body:{encryptedUpload:t}})}async function ce(e){let t=await L(e);return D({attestationServiceUrl:e.attestationServiceUrl,path:`/buyer/verify/${encodeURIComponent(e.platform)}/${encodeURIComponent(e.actionType)}`,fetch:e.fetch,failureContext:"POST /buyer/verify",timeoutMs:e.timeoutMs,body:{encryptedSessionMaterial:t,params:e.params,chainId:e.chainId,intent:e.intent}})}function Wt(e){let t=We[e.environment],r=e.attestationServiceUrl??t.attestationServiceUrl,n=R({strictPin:!0},e.trust);return{createEncryptedBuyerTeeSessionMaterial:i=>{let{attestationServiceUrl:s,trust:a,fetch:l,subtle:u,getRandomValues:c,now:d,onWarning:f,timeoutMs:T,...p}=i;return L({...p,attestationServiceUrl:s??r,trust:R(n,a),fetch:l??e.fetch,subtle:u??e.subtle,getRandomValues:c??e.getRandomValues,now:d??e.now,onWarning:f??e.onWarning,timeoutMs:T??e.timeoutMs})},createEncryptedIdentitySessionMaterial:i=>{let{attestationServiceUrl:s,trust:a,fetch:l,subtle:u,getRandomValues:c,now:d,onWarning:f,timeoutMs:T,...p}=i;return k({...p,attestationServiceUrl:s??r,trust:R(n,a),fetch:l??e.fetch,subtle:u??e.subtle,getRandomValues:c??e.getRandomValues,now:d??e.now,onWarning:f??e.onWarning,timeoutMs:T??e.timeoutMs})},createEncryptedSellerCredentialUpload:i=>{let{attestationServiceUrl:s,trust:a,fetch:l,subtle:u,getRandomValues:c,now:d,onWarning:f,timeoutMs:T,...p}=i;return Y({...p,attestationServiceUrl:s??r,trust:R(n,a),fetch:l??e.fetch,subtle:u??e.subtle,getRandomValues:c??e.getRandomValues,now:d??e.now,onWarning:f??e.onWarning,timeoutMs:T??e.timeoutMs})},requestIdentityAttestation:i=>se({attestationServiceUrl:i.attestationServiceUrl??r,trust:R(n,i.trust),fetch:i.fetch??e.fetch,subtle:i.subtle??e.subtle,getRandomValues:i.getRandomValues??e.getRandomValues,now:i.now??e.now,onWarning:i.onWarning??e.onWarning,timeoutMs:i.timeoutMs??e.timeoutMs,platform:i.platform,actionType:i.actionType,callerAddress:i.callerAddress,sessionMaterial:i.sessionMaterial,params:i.params}),uploadSellerCredential:i=>{let{attestationServiceUrl:s,trust:a,fetch:l,subtle:u,getRandomValues:c,now:d,onWarning:f,timeoutMs:T,...p}=i;return ae({...p,attestationServiceUrl:s??r,trust:R(n,a),fetch:l??e.fetch,subtle:u??e.subtle,getRandomValues:c??e.getRandomValues,now:d??e.now,onWarning:f??e.onWarning,timeoutMs:T??e.timeoutMs})},verifyBuyerTeePayment:i=>{let s={attestationServiceUrl:i.attestationServiceUrl??r,trust:R(n,i.trust),fetch:i.fetch??e.fetch,subtle:i.subtle??e.subtle,getRandomValues:i.getRandomValues??e.getRandomValues,now:i.now??e.now,onWarning:i.onWarning??e.onWarning,timeoutMs:i.timeoutMs??e.timeoutMs,platform:i.platform,actionType:i.actionType,sessionMaterial:i.sessionMaterial,params:i.params,chainId:i.chainId,intent:i.intent};return ce(s)},fetchAndVerifyAttestation:(i={})=>P({attestationServiceUrl:i.attestationServiceUrl??r,trust:R(n,i.trust),fetch:i.fetch??e.fetch,subtle:i.subtle??e.subtle,getRandomValues:i.getRandomValues??e.getRandomValues,now:i.now??e.now,onWarning:i.onWarning??e.onWarning,timeoutMs:i.timeoutMs??e.timeoutMs}),encryptBuyerTeeSessionMaterial:({subtle:i,getRandomValues:s,...a})=>v({...a,subtle:i??e.subtle,getRandomValues:s??e.getRandomValues}),encryptIdentitySessionMaterial:({subtle:i,getRandomValues:s,...a})=>F({...a,subtle:i??e.subtle,getRandomValues:s??e.getRandomValues}),encryptSellerCredentialUpload:({subtle:i,getRandomValues:s,now:a,...l})=>W({...l,subtle:i??e.subtle,getRandomValues:s??e.getRandomValues,now:a??e.now})}}function R(e,t){return t?{...e,...t,expectedPcr8ByHost:{...e.expectedPcr8ByHost,...t.expectedPcr8ByHost}}:e}import{concat as Yt,getAddress as $e,keccak256 as le,recoverAddress as Gt,TypedDataEncoder as ue,toUtf8Bytes as $t,verifyTypedData as qt}from"ethers";var Kt={name:"UnifiedPaymentVerifier",version:"1"},de={PaymentAttestation:[{name:"intentHash",type:"bytes32"},{name:"releaseAmount",type:"uint256"},{name:"dataHash",type:"bytes32"}]},zt="PaymentAttestation(bytes32 intentHash,uint256 releaseAmount,bytes32 dataHash)",qe=m(zt),fe={name:"ZKP2PIdentityVerifier",version:"1"},ye={IdentityAttestation:[{name:"method",type:"bytes32"},{name:"actionType",type:"bytes32"},{name:"callerAddress",type:"address"},{name:"payeeIdHash",type:"bytes32"},{name:"dataHash",type:"bytes32"},{name:"issuedAt",type:"uint256"},{name:"validUntil",type:"uint256"}]},jt="IdentityAttestation(bytes32 method,bytes32 actionType,address callerAddress,bytes32 payeeIdHash,bytes32 dataHash,uint256 issuedAt,uint256 validUntil)",Ke=m(jt),ze=ue.hashDomain(fe).toLowerCase(),je={name:"ZKP2P Seller Credential Bundle",version:"1"},Xe={SellerCredentialBundle:[{name:"platform",type:"string"},{name:"payeeIdHash",type:"bytes32"},{name:"encryptedBlobHash",type:"bytes32"},{name:"encryptedDataKeyHash",type:"bytes32"},{name:"nonceHash",type:"bytes32"},{name:"credentialType",type:"string"},{name:"credentialValidatedAt",type:"string"},{name:"credentialExpiresAt",type:"string"}]};function Xt(e){return{...Kt,chainId:e.chainId,verifyingContract:$e(e.verifyingContract)}}function pe(e){return ue.hashDomain(Xt(e)).toLowerCase()}function m(e){return le($t(e)).toLowerCase()}function Qe(e){return le(e).toLowerCase()}function Je(e){try{let t=ue.from(e.types).hash(e.value),r=le(Yt(["0x1901",e.domainSeparator,t]));return N(Gt(r,e.signature))}catch(t){o("ATTESTATION_SIGNATURE_INVALID","Unable to recover signer from attestation signature",{cause:t})}}function j(e){try{return N(qt(e.domain,e.types,e.value,e.signature))}catch(t){o("ATTESTATION_SIGNATURE_INVALID","Unable to verify attestation signature",{cause:t})}}function me(e,t){let r=N(e),n=new Set(t.map(i=>N(i)));return n.has(r)||o("SIGNER_NOT_TRUSTED","Recovered signer is not in trustedSigners",{details:{recoveredSigner:r,trustedSigners:Array.from(n)}}),r}function X(e){let t=me(e.recoveredSigner,e.trustedSigners),r=N(e.payloadSigner);return r!==t&&o("ATTESTATION_SIGNATURE_INVALID","Payload signer does not match the recovered signer",{details:{payloadSigner:r,recoveredSigner:t}}),t}function y(e,t,r){e.toLowerCase()!==t.toLowerCase()&&o("ATTESTATION_BINDING_MISMATCH",`${r} did not match expected value`,{details:{actual:e,expected:t}})}function Ze(e,t,r){let n,i;try{n=N(e),i=N(t)}catch(s){o("INVALID_PARAMETER",`${r} must be a valid Ethereum address`,{cause:s})}n!==i&&o("ATTESTATION_BINDING_MISMATCH",`${r} did not match expected value`,{details:{actual:e,expected:t}})}function A(e,t,r){e!==t&&o("ATTESTATION_BINDING_MISMATCH",`${r} did not match expected value`,{details:{actual:e,expected:t}})}function Q(e,t){JSON.stringify(e)!==JSON.stringify(t)&&o("ATTESTATION_BINDING_MISMATCH","typedDataSpec.types did not match the expected EIP-712 types")}function _(e,t){return typeof e!="string"&&o("INVALID_PARAMETER",`${t} is required`),e}function N(e){return $e(e).toLowerCase()}function Qt(e,t){A(e.platform,t.expectedPlatform,"platform"),A(e.actionType,t.expectedActionType,"actionType"),A(e.typedDataSpec.primaryType,"PaymentAttestation","typedDataSpec.primaryType"),Q(e.typedDataSpec.types,de),y(e.typeHash,qe,"typeHash"),y(e.domainSeparator,pe(t.expectedDomain),"domainSeparator"),y(Qe(e.encodedPaymentDetails),e.typedDataValue.dataHash,"encodedPaymentDetails"),y(e.typedDataValue.intentHash,_(t.expectedIntentHash,"expectedIntentHash"),"typedDataValue.intentHash");let r=Je({domainSeparator:e.domainSeparator,types:de,value:{...e.typedDataValue},signature:e.signature});return X({payloadSigner:e.signer,recoveredSigner:r,trustedSigners:t.trustedSigners}),e}var Jt=["platform","actionType","payeeId","username","metadata"];function Zt(e,t){A(e.platform,t.expectedPlatform,"platform"),A(e.actionType,t.expectedActionType,"actionType"),A(e.identity.platform,e.platform,"identity.platform"),A(e.identity.actionType,e.actionType,"identity.actionType"),A(e.typedDataSpec.primaryType,"IdentityAttestation","typedDataSpec.primaryType"),Q(e.typedDataSpec.types,ye),y(e.domainSeparator,ze,"domainSeparator"),y(e.typeHash,Ke,"typeHash"),y(e.identity.method,m(e.identity.platform),"identity.method"),y(e.identity.payeeIdHash,m(e.identity.payeeId),"identity.payeeIdHash"),y(e.typedDataValue.method,e.identity.method,"typedDataValue.method"),y(e.typedDataValue.actionType,m(e.identity.actionType),"typedDataValue.actionType"),Ze(e.typedDataValue.callerAddress,_(t.expectedCallerAddress,"expectedCallerAddress"),"typedDataValue.callerAddress"),y(e.typedDataValue.payeeIdHash,e.identity.payeeIdHash,"typedDataValue.payeeIdHash"),y(e.typedDataValue.payeeIdHash,_(t.expectedPayeeIdHash,"expectedPayeeIdHash"),"typedDataValue.payeeIdHash"),y(e.typedDataValue.dataHash,er(e.identity),"typedDataValue.dataHash"),rr(e.typedDataValue.validUntil,t.now??Date.now);let r=j({domain:fe,types:ye,value:{...e.typedDataValue},signature:e.signature});return X({payloadSigner:e.signer,recoveredSigner:r,trustedSigners:t.trustedSigners}),e.identity}function er(e){let t={platform:e.platform,actionType:e.actionType,payeeId:e.payeeId,username:e.username,metadata:tr(e.metadata)},r=JSON.stringify(Object.fromEntries(Jt.map(n=>[n,t[n]])));return m(r)}function tr(e){return Object.fromEntries(Object.entries(e).sort(([t],[r])=>t.localeCompare(r)))}function rr(e,t){let r=t();BigInt(r)>BigInt(e)&&o("ATTESTATION_EXPIRED","Identity attestation validUntil is in the past",{details:{validUntil:e,nowMs:r}})}function nr(e,t){A(e.platform,t.expectedPlatform,"platform"),y(e.payeeIdHash,_(t.expectedPayeeIdHash,"expectedPayeeIdHash"),"payeeIdHash"),or(e.credentialExpiresAt,t.now??Date.now);let r=j({domain:je,types:Xe,value:ir(e),signature:e.bundleSignature});return me(r,t.trustedSigners),e}function ir(e){return{platform:e.platform,payeeIdHash:e.payeeIdHash,encryptedBlobHash:m(e.encryptedBlob),encryptedDataKeyHash:m(e.encryptedDataKey),nonceHash:m(e.nonce),credentialType:e.credentialType,credentialValidatedAt:e.credentialValidatedAt,credentialExpiresAt:e.credentialExpiresAt??""}}function or(e,t){let r=t();e!==null&&BigInt(r)>BigInt(e)&&o("ATTESTATION_EXPIRED","Seller credential bundle credentialExpiresAt is in the past",{details:{credentialExpiresAt:e,nowMs:r}})}export{K as AWS_NITRO_ROOT_FINGERPRINT_SHA256_HEX,Z as AWS_NITRO_ROOT_PEM,U as NitroAttestationError,L as createEncryptedBuyerTeeSessionMaterial,k as createEncryptedIdentitySessionMaterial,Y as createEncryptedSellerCredentialUpload,Wt as createNitroAttestationClient,v as encryptBuyerTeeSessionMaterial,F as encryptIdentitySessionMaterial,W as encryptSellerCredentialUpload,P as fetchAndVerifyAttestation,pe as getUnifiedPaymentVerifierDomainSeparator,m as hashUtf8,se as requestIdentityAttestation,ae as uploadSellerCredential,ce as verifyBuyerTeePayment,Qt as verifyBuyerTeePaymentAttestation,Zt as verifyIdentityAttestation,nr as verifySellerCredentialBundle};
|
|
16
16
|
//# sourceMappingURL=index.js.map
|