@zkp2p/zkp2p-attestation 3.0.0 → 3.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +10 -0
- package/README.md +54 -11
- package/dist/cli/verify.js +0 -2
- package/dist/cli/verify.js.map +1 -1
- package/dist/index.cjs +2 -2
- package/dist/index.cjs.map +1 -1
- package/dist/index.d.cts +114 -21
- package/dist/index.d.ts +114 -21
- package/dist/index.js +2 -2
- package/dist/index.js.map +1 -1
- package/package.json +1 -1
package/dist/index.cjs
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
"use strict";var
|
|
1
|
+
"use strict";var ue=Object.defineProperty;var At=Object.getOwnPropertyDescriptor;var Tt=Object.getOwnPropertyNames;var St=Object.prototype.hasOwnProperty;var Et=(e,t)=>{for(var r in t)ue(e,r,{get:t[r],enumerable:!0})},gt=(e,t,r,n)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of Tt(t))!St.call(e,o)&&o!==r&&ue(e,o,{get:()=>t[o],enumerable:!(n=At(t,o))||n.enumerable});return e};var It=e=>gt(ue({},"__esModule",{value:!0}),e);var Ir={};Et(Ir,{AWS_NITRO_ROOT_FINGERPRINT_SHA256_HEX:()=>W,AWS_NITRO_ROOT_PEM:()=>J,NitroAttestationError:()=>R,createEncryptedBuyerTeeSessionMaterial:()=>M,createEncryptedDisputeSessionMaterial:()=>v,createEncryptedIdentitySessionMaterial:()=>H,createEncryptedSellerCredentialUpload:()=>F,createNitroAttestationClient:()=>rt,encryptBuyerTeeSessionMaterial:()=>w,encryptDisputeSessionMaterial:()=>V,encryptIdentitySessionMaterial:()=>B,encryptSellerCredentialUpload:()=>L,fetchAndVerifyAttestation:()=>K,getDisputeVerifierDomainSeparator:()=>ie,getUnifiedPaymentVerifierDomainSeparator:()=>ne,hashUtf8:()=>y,requestIdentityAttestation:()=>Z,uploadSellerCredential:()=>ee,verifyBuyerTeePayment:()=>te,verifyBuyerTeePaymentAttestation:()=>dt,verifyDispute:()=>re,verifyDisputeAttestation:()=>pt,verifyIdentityAttestation:()=>ft,verifySellerCredentialBundle:()=>yt});module.exports=It(Ir);var R=class extends Error{code;cause;details;constructor(t,r,n={}){super(r),this.name="NitroAttestationError",this.code=t,this.cause=n.cause,this.details=n.details}};function s(e,t,r){throw new R(e,t,r)}async function S(e,t,r){try{return await e}catch(n){s(t,r,{cause:n})}}function j(e){return e!==void 0?(typeof e!="function"&&s("CRYPTO_UNAVAILABLE","fetch is unavailable; pass a fetch implementation"),e):(typeof globalThis.fetch!="function"&&s("CRYPTO_UNAVAILABLE","fetch is unavailable; pass a fetch implementation"),globalThis.fetch.bind(globalThis))}function Pt(e){let t=e??globalThis.crypto?.subtle;return t||s("CRYPTO_UNAVAILABLE","SubtleCrypto is unavailable; pass params.subtle"),t}function ht(e){if(e)return e;let t=globalThis.crypto;return typeof t?.getRandomValues!="function"&&s("CRYPTO_UNAVAILABLE","crypto.getRandomValues is unavailable; pass params.getRandomValues"),r=>t.getRandomValues(r)}function T(e){return{subtle:Pt(e.subtle),getRandomValues:ht(e.getRandomValues)}}function Pe(e,t){return typeof t!="function"&&s("CRYPTO_UNAVAILABLE","crypto.getRandomValues is unavailable; pass params.getRandomValues"),{subtle:e,getRandomValues:t,randomUUID:()=>xt(t)}}function xt(e){let t=e(new Uint8Array(16));t[6]=t[6]&15|64,t[8]=t[8]&63|128;let r=Array.from(t,n=>n.toString(16).padStart(2,"0"));return`${r.slice(0,4).join("")}-${r.slice(4,6).join("")}-${r.slice(6,8).join("")}-${r.slice(8,10).join("")}-${r.slice(10).join("")}`}var G="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/",z=Ct(G);function Ct(e){let t={};for(let r=0;r<e.length;r+=1)t[e[r]]=r;return t}function E(e){let t="";for(let r of e)t+=r.toString(16).padStart(2,"0");return t}function P(e){if(typeof TextEncoder<"u")return new TextEncoder().encode(e);let t=[];for(let r=0;r<e.length;r+=1){let n=e.codePointAt(r);n>65535&&(r+=1),n<=127?t.push(n):n<=2047?t.push(192|n>>6,128|n&63):n<=65535?t.push(224|n>>12,128|n>>6&63,128|n&63):t.push(240|n>>18,128|n>>12&63,128|n>>6&63,128|n&63)}return new Uint8Array(t)}function U(e){if(typeof TextDecoder<"u")return new TextDecoder().decode(e);let t="";for(let r=0;r<e.length;r+=1){let n=e[r];n<128?t+=String.fromCodePoint(n):(n&224)===192?t+=String.fromCodePoint((n&31)<<6|e[++r]&63):(n&240)===224?t+=String.fromCodePoint((n&15)<<12|(e[++r]&63)<<6|e[++r]&63):t+=String.fromCodePoint((n&7)<<18|(e[++r]&63)<<12|(e[++r]&63)<<6|e[++r]&63)}return t}function bt(e){let t="";for(let r=0;r<e.length;r+=3){let n=e[r],o=e[r+1]??0,a=e[r+2]??0,i=n<<16|o<<8|a;t+=G[i>>18&63],t+=G[i>>12&63],t+=r+1<e.length?G[i>>6&63]:"=",t+=r+2<e.length?G[i&63]:"="}return t}function he(e){return Dt(e,!1)}function O(e){return bt(e).replaceAll("+","-").replaceAll("/","_").replace(/=+$/,"")}function Dt(e,t){let r=e.replace(/\s+/g,""),n=t?r.replaceAll("-","+").replaceAll("_","/"):r;if(n.length%4===1)throw new Error("Invalid base64 length");let o=n+"=".repeat((4-n.length%4)%4),a=[];for(let i=0;i<o.length;i+=4){let u=o.slice(i,i+4),l=u.endsWith("==")?2:u.endsWith("=")?1:0,c=X(u[0],z),f=X(u[1],z),A=u[2]==="="?0:X(u[2],z),ce=u[3]==="="?0:X(u[3],z),_=c<<18|f<<12|A<<6|ce;a.push(_>>16&255),l<2&&a.push(_>>8&255),l<1&&a.push(_&255)}return new Uint8Array(a)}function X(e,t){let r=t[e];if(r===void 0)throw new Error(`Invalid base64 character: ${e}`);return r}function h(e){let t=e.reduce((o,a)=>o+a.length,0),r=new Uint8Array(t),n=0;for(let o of e)r.set(o,n),n+=o.length;return r}function g(e){return new Uint8Array(e).buffer}function xe(e){let t={sessionMaterial:e.sessionMaterial,...e.callerAddress!==void 0?{callerAddress:e.callerAddress}:{},boundPubKeySha256:e.key.publicKeySha256Hex,issuedAtMs:e.issuedAtMs,jweId:e.jweId};return e.platform==="wise"||e.platform==="monobank"?t:{payeeId:e.payeeId,...t}}function Ce(e){return{platform:e.platform,actionType:e.actionType,sessionMaterial:e.sessionMaterial,boundPubKeySha256:e.key.publicKeySha256Hex}}function be(e){return JSON.stringify(e)}var Rt={alg:"RSA-OAEP-256",enc:"A256GCM"},Nt=/^[A-Za-z0-9_-]{16,128}$/;async function De(e){let t=e.request.issuedAtMs??e.now(),r=e.request.jweId??Ut(e.getRandomValues);return _t(r),Ue({key:e.request.key,plaintext:xe({...e.request,issuedAtMs:t,jweId:r}),subtle:e.subtle,getRandomValues:e.getRandomValues,failureContext:"seller credential upload"})}async function Re(e){return de({...e,failureContext:"buyer TEE session material"})}async function Ne(e){return de({...e,failureContext:"identity session material"})}async function _e(e){return de({...e,failureContext:"dispute session material"})}async function de(e){return Ue({key:e.request.key,plaintext:Ce(e.request),subtle:e.subtle,getRandomValues:e.getRandomValues,failureContext:e.failureContext})}async function Ue(e){let t=P(be(e.plaintext)),r=e.getRandomValues(new Uint8Array(32)),n=await S(e.subtle.importKey("spki",g(e.key.publicKeyDer),{name:"RSA-OAEP",hash:"SHA-256"},!1,["encrypt"]),"CRYPTO_UNAVAILABLE","Failed to import attested enclave-upload RSA public key"),o=new Uint8Array(await S(e.subtle.encrypt({name:"RSA-OAEP"},n,g(r)),"CRYPTO_UNAVAILABLE","Failed to RSA-OAEP encrypt the content encryption key")),a=e.getRandomValues(new Uint8Array(12)),i=O(P(JSON.stringify(Rt))),u=P(i),l=await S(e.subtle.importKey("raw",g(r),{name:"AES-GCM",length:256},!1,["encrypt"]),"CRYPTO_UNAVAILABLE","Failed to import generated AES-GCM content encryption key"),c=new Uint8Array(await S(e.subtle.encrypt({name:"AES-GCM",iv:g(a),additionalData:g(u),tagLength:128},l,g(t)),"CRYPTO_UNAVAILABLE",`Failed to AES-GCM encrypt ${e.failureContext}`)),f=c.slice(0,c.length-16),A=c.slice(c.length-16);return[i,O(o),O(a),O(f),O(A)].join(".")}function _t(e){Nt.test(e)||s("INVALID_PARAMETER","jweId must be 16-128 URL-safe characters")}function Ut(e){let t=e(new Uint8Array(16));t[6]=t[6]&15|64,t[8]=t[8]&63|128;let r=Array.from(t,n=>n.toString(16).padStart(2,"0"));return`${r.slice(0,4).join("")}-${r.slice(4,6).join("")}-${r.slice(6,8).join("")}-${r.slice(8,10).join("")}-${r.slice(10).join("")}`}async function w(e){let t=T(e);return Re({request:e,subtle:t.subtle,getRandomValues:t.getRandomValues})}var Oe=require("@peculiar/x509");var J=`-----BEGIN CERTIFICATE-----
|
|
2
2
|
MIICETCCAZagAwIBAgIRAPkxdWgbkK/hHUbMtOTn+FYwCgYIKoZIzj0EAwMwSTEL
|
|
3
3
|
MAkGA1UEBhMCVVMxDzANBgNVBAoMBkFtYXpvbjEMMAoGA1UECwwDQVdTMRswGQYD
|
|
4
4
|
VQQDDBJhd3Mubml0cm8tZW5jbGF2ZXMwHhcNMTkxMDI4MTMyODA1WhcNNDkxMDI4
|
|
@@ -12,5 +12,5 @@ MQCjfy+Rocm9Xue4YnwWmNJVA44fA0P5W2OpYow9OYCVRaEevL8uO1XYru5xtMPW
|
|
|
12
12
|
rfMCMQCi85sWBbJwKKXdS6BptQFuZbT73o/gBh1qUxl/nNr12UO8Yfwr6wPLb+6N
|
|
13
13
|
IwLz3/Y=
|
|
14
14
|
-----END CERTIFICATE-----
|
|
15
|
-
`,Y="641a0321a3e244efe456463195d606317ed7cdcc3c1756e09893f3c68f79bb5b";var Pt=10080*60*1e3;async function Ce(e){let t=Ae(e.subtle,e.getRandomValues),r=se(e.rootPem??j,"AWS Nitro root certificate"),n=await ae(r,e.subtle);n!==Y&&o("AWS_ROOT_FINGERPRINT_MISMATCH","Bundled AWS Nitro root certificate fingerprint mismatch",{details:{expected:Y,actual:n}});let i=se(e.leafCertificateDer,"attestation leaf certificate"),s=e.cabundleDer.map((d,f)=>se(d,`cabundle[${f}]`)),a=[r,...s,i];for(let d of a)xt(d,e.nowMs),bt(d,e.nowMs,e.onWarning);let l=await ae(i,e.subtle),u=[];for(let d of s){let f=await ae(d,e.subtle);f!==l&&f!==n&&u.push(d)}let c=[[i,...u.slice().reverse(),r],[i,...u,r]];for(let d of c)if(await ht(d,t)){let f=await E(i.publicKey.export({name:"ECDSA",namedCurve:"P-384"},["verify"],t),"CERT_CHAIN_INVALID","Failed to export attestation leaf public key");return{leafCertificate:i,leafPublicKey:f}}o("CERT_CHAIN_INVALID","Attestation certificate chain does not verify to the pinned AWS Nitro root")}async function ht(e,t){for(let r=0;r<e.length-1;r+=1){let n=e[r],i=e[r+1];if(!await n.verify({publicKey:i.publicKey,signatureOnly:!0},t))return!1}return e.length>0&&await e[e.length-1].isSelfSigned(t)}function se(e,t){try{return new be.X509Certificate(e)}catch(r){o("CERT_CHAIN_INVALID",`Could not parse ${t}`,{cause:r})}}async function ae(e,t){return I(new Uint8Array(await t.digest("SHA-256",e.rawData)))}function xt(e,t){(t<e.notBefore.getTime()||t>e.notAfter.getTime())&&o("CERT_NOT_TIME_VALID","Certificate is outside its validity window",{details:{subject:e.subject,notBefore:e.notBefore.toISOString(),notAfter:e.notAfter.toISOString()}})}function bt(e,t,r){e.notAfter.getTime()<t+Pt&&r?.({code:"CERT_VALIDITY_NEAR_EXPIRY",message:"Certificate in Nitro attestation chain expires within 7 days",details:{subject:e.subject,notAfter:e.notAfter.toISOString()}})}function G(e){let t=new ce(e),r=t.readValue();if(!t.done())throw new Error("Trailing CBOR bytes");return r}function X(e){if(typeof e=="number"){if(!Number.isSafeInteger(e))throw new Error("CBOR number must be a safe integer");return e>=0?R(0,e):R(1,-1-e)}if(typeof e=="bigint")return e>=0n?R(0,e):R(1,-1n-e);if(typeof e=="string"){let t=b(e);return C([R(3,t.length),t])}if(e instanceof Uint8Array)return C([R(2,e.length),e]);if(Array.isArray(e))return C([R(4,e.length),...e.map(X)]);if(e instanceof Map)return C([R(5,e.size),...Array.from(e.entries()).flatMap(([t,r])=>[X(t),X(r)])]);if(typeof e=="boolean")return new Uint8Array([e?245:244]);if(e===null)return new Uint8Array([246]);throw new Error("Unsupported CBOR value")}function Re(e,t){return X(["Signature1",e,new Uint8Array,t])}function R(e,t){let r=BigInt(t);return r<24n?new Uint8Array([e<<5|Number(r)]):r<=0xffn?new Uint8Array([e<<5|24,Number(r)]):r<=0xffffn?new Uint8Array([e<<5|25,Number(r>>8n&0xffn),Number(r&0xffn)]):r<=0xffffffffn?new Uint8Array([e<<5|26,Number(r>>24n&0xffn),Number(r>>16n&0xffn),Number(r>>8n&0xffn),Number(r&0xffn)]):new Uint8Array([e<<5|27,Number(r>>56n&0xffn),Number(r>>48n&0xffn),Number(r>>40n&0xffn),Number(r>>32n&0xffn),Number(r>>24n&0xffn),Number(r>>16n&0xffn),Number(r>>8n&0xffn),Number(r&0xffn)])}var ce=class{constructor(t){this.bytes=t}bytes;offset=0;done(){return this.offset===this.bytes.length}readValue(){let t=this.readByte(),r=t>>5,n=t&31;if(n===31)return this.readIndefiniteValue(r);if(r===0)return this.readLength(n);if(r===1){let i=this.readLength(n);return typeof i=="bigint"?-1n-i:-1-i}if(r===2){let i=this.lengthAsNumber(this.readLength(n));return this.readBytes(i)}if(r===3){let i=this.lengthAsNumber(this.readLength(n));return O(this.readBytes(i))}if(r===4){let i=this.lengthAsNumber(this.readLength(n)),s=[];for(let a=0;a<i;a+=1)s.push(this.readValue());return s}if(r===5){let i=this.lengthAsNumber(this.readLength(n)),s=new Map;for(let a=0;a<i;a+=1)s.set(this.readValue(),this.readValue());return s}if(r===6)return this.readLength(n),this.readValue();if(r===7){if(n===20)return!1;if(n===21)return!0;if(n===22)return null}throw new Error(`Unsupported CBOR major/additional type: ${r}/${n}`)}readIndefiniteValue(t){if(t===2){let r=[];for(;!this.consumeBreak();){let n=this.readValue();if(!(n instanceof Uint8Array))throw new Error("Indefinite CBOR byte string chunk must be a byte string");r.push(n)}return C(r)}if(t===3){let r="";for(;!this.consumeBreak();){let n=this.readValue();if(typeof n!="string")throw new Error("Indefinite CBOR text string chunk must be a text string");r+=n}return r}if(t===4){let r=[];for(;!this.consumeBreak();)r.push(this.readValue());return r}if(t===5){let r=new Map;for(;!this.consumeBreak();){let n=this.readValue();if(this.peekBreak())throw new Error("Indefinite CBOR map ended after a key");r.set(n,this.readValue())}return r}throw new Error(`Indefinite CBOR major type ${t} is not supported`)}readLength(t){if(t<24)return t;if(t===24)return this.readByte();if(t===25)return this.readByte()<<8|this.readByte();if(t===26)return this.readByte()*16777216+(this.readByte()<<16)+(this.readByte()<<8)+this.readByte()>>>0;if(t===27){let r=0n;for(let n=0;n<8;n+=1)r=r<<8n|BigInt(this.readByte());return r<=BigInt(Number.MAX_SAFE_INTEGER)?Number(r):r}throw new Error("Indefinite CBOR lengths are not supported")}readByte(){if(this.offset>=this.bytes.length)throw new Error("Unexpected end of CBOR input");return this.bytes[this.offset++]}peekBreak(){return this.offset<this.bytes.length&&this.bytes[this.offset]===255}consumeBreak(){return this.peekBreak()?(this.offset+=1,!0):!1}readBytes(t){if(this.offset+t>this.bytes.length)throw new Error("Unexpected end of CBOR byte string");let r=this.bytes.slice(this.offset,this.offset+t);return this.offset+=t,r}lengthAsNumber(t){if(typeof t=="bigint")throw new Error("CBOR length exceeds JavaScript safe integer range");return t}};function Ne(e){let t=e[0]===210?e.slice(1):e,r;try{r=G(t)}catch(l){o("COSE_STRUCTURE_INVALID","Attestation document is not a valid COSE_Sign1 CBOR value",{cause:l})}(!Array.isArray(r)||r.length!==4)&&o("COSE_STRUCTURE_INVALID","COSE_Sign1 must be [protected, unprotected, payload, signature]");let[n,i,s,a]=r;return(!(n instanceof Uint8Array)||!(i instanceof Map)||!(s instanceof Uint8Array)||!(a instanceof Uint8Array))&&o("COSE_STRUCTURE_INVALID","COSE_Sign1 fields have invalid CBOR types"),Ct(n),a.length!==96&&o("COSE_SIGNATURE_INVALID_SIZE",`Expected a 96-byte ES384 signature, got ${a.length} bytes`),{protectedHeadersBytes:n,payloadBytes:s,signature:a}}async function _e(e){let t=Re(e.protectedHeadersBytes,e.payloadBytes);await E(e.subtle.verify({name:"ECDSA",hash:"SHA-384"},e.leafPublicKey,e.signature,t),"COSE_SIGNATURE_VERIFY_FAILED","COSE_Sign1 signature verification failed")||o("COSE_SIGNATURE_VERIFY_FAILED","COSE_Sign1 signature does not verify with the attestation leaf certificate")}function Ct(e){let t;try{t=G(e)}catch(r){o("COSE_STRUCTURE_INVALID","COSE protected headers are not a valid CBOR map",{cause:r})}t instanceof Map||o("COSE_STRUCTURE_INVALID","COSE protected headers must be a CBOR map"),t.get(1)!==-35&&o("COSE_ALG_UNSUPPORTED","COSE protected header alg must be -35 (ES384)")}var le=96;function h(e,t){let r=e.replace(/^0x/i,"").toLowerCase();return(r.length!==le||!/^[0-9a-f]+$/.test(r))&&o("TRUST_PIN_REQUIRED",`${t} must be ${le} lowercase hex characters`),r}function Ue(e,t){let r=h(e,t);return e!==r&&o("ATTESTATION_RESPONSE_INVALID",`${t} must be ${le} lowercase hex characters`),r}var we=256*1024,Rt=3,Nt=150,_t=/^0x[0-9a-fA-F]{40}$/;function Ut(e,t){let r=new URL(e),n=r.pathname.replace(/\/+$/,"");return r.pathname=n.endsWith("/attestation")?n:`${n}/attestation`,r.search="",r.searchParams.set("nonce",t),r}async function Ve(e){let t=Ut(e.attestationServiceUrl,e.nonceHex),r=await Dt(t.toString(),e.fetch,e.timeoutMs),n=await Ot(r);r.ok||o("ATTESTATION_FETCH_FAILED",`GET /attestation failed with HTTP ${r.status}`,{details:{status:r.status,body:n.slice(0,400)}});let i;try{i=JSON.parse(n)}catch(s){o("ATTESTATION_RESPONSE_INVALID","GET /attestation returned non-JSON response",{cause:s})}return wt(i)}function wt(e){(!De(e)||e.success!==!0||!De(e.responseObject))&&o("ATTESTATION_RESPONSE_INVALID","Expected { success: true, responseObject: {...} }");let t=e.responseObject;(typeof t.attestationDocument!="string"||typeof t.nonce!="string")&&o("ATTESTATION_RESPONSE_INVALID","Attestation response is missing attestationDocument or nonce");let r;try{r=Te(t.attestationDocument)}catch(n){o("ATTESTATION_RESPONSE_INVALID","attestationDocument is not valid base64",{cause:n})}return r.length===0&&o("ATTESTATION_RESPONSE_INVALID","attestationDocument decoded to empty bytes"),{attestationDocument:r,nonce:t.nonce.toLowerCase(),advertised:{chainId:typeof t.chainId=="number"?t.chainId:void 0,verifyingContract:Me(t.verifyingContract,"verifyingContract"),expectedSigner:Me(t.expectedSigner,"expectedSigner"),expectedPcr8:Mt(t.expectedPcr8,"expectedPcr8")}}}async function Ot(e){if(!e.body){let i=await e.text();return Oe(b(i).length),i}let t=e.body.getReader(),r=[],n=0;for(;;){let{done:i,value:s}=await t.read();if(i)break;s&&(n+=s.length,Oe(n),r.push(s))}return O(C(r))}function Oe(e){e>we&&o("ATTESTATION_RESPONSE_INVALID","GET /attestation response exceeded maximum size",{details:{maxBytes:we,actualBytes:e}})}function Me(e,t){if(e!==void 0)return(typeof e!="string"||!_t.test(e))&&o("ATTESTATION_RESPONSE_INVALID",`${t} must be a 0x-prefixed 20-byte hex address`),e.toLowerCase()}function Mt(e,t){if(e!==void 0){typeof e!="string"&&o("ATTESTATION_RESPONSE_INVALID",`${t} must be a 96-character lowercase hex string`);try{return Ue(e,t)}catch(r){o("ATTESTATION_RESPONSE_INVALID",`${t} must be a 96-character lowercase hex string`,{cause:r})}}}async function Dt(e,t,r){let n=1;for(;;)try{return await Vt(e,t,r)}catch(i){if(!vt(i)||n>=Rt)throw i;await Bt(Nt*n),n+=1}}async function Vt(e,t,r){let n=typeof AbortController<"u"?new AbortController:void 0,i,s=new Promise((a,l)=>{i=setTimeout(()=>{n?.abort(),l(new Error("timeout"))},r)});try{let a=await Promise.race([t(e,{headers:{accept:"application/json"},signal:n?.signal}),s]);return i!==void 0&&clearTimeout(i),a}catch(a){i!==void 0&&clearTimeout(i),a instanceof Error&&(a.name==="AbortError"||a.message==="timeout")&&o("TIMEOUT",`GET /attestation timed out after ${r}ms`,{cause:a}),o("ATTESTATION_FETCH_FAILED","GET /attestation failed at the network layer",{cause:a,details:{layer:"network"}})}}function vt(e){return e instanceof _&&e.code==="ATTESTATION_FETCH_FAILED"&&e.details?.layer==="network"}function Bt(e){return new Promise(t=>setTimeout(t,e))}function De(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}var Ht=32;function ve(e){return I(e(new Uint8Array(Ht)))}function Be(e,t){e.toLowerCase()!==t&&o("ATTESTATION_NONCE_MISMATCH","Attestation service echoed a different nonce",{details:{expectedNonce:t,echoedNonce:e}})}function Le(e){let t;try{t=G(e)}catch(s){o("PAYLOAD_FIELD_MISSING","Attestation payload is not a valid CBOR map",{cause:s})}let r=He(t,"payload"),n=He(r.get("pcrs"),"pcrs"),i=$(r.get("user_data"),"user_data");return{timestampMs:Lt(r.get("timestamp")),nonceHex:O(i),pcr0Hex:ue(n,0),pcr1Hex:ue(n,1),pcr2Hex:ue(n,2),pcr8Hex:I($(n.get(8),"pcrs[8]")),certificateDer:$(r.get("certificate"),"certificate"),cabundleDer:Ft(r.get("cabundle"),"cabundle").map((s,a)=>$(s,`cabundle[${a}]`)),publicKeyDer:$(r.get("public_key"),"public_key")}}function ue(e,t){let r=e.get(t);return r instanceof Uint8Array?I(r):""}function Lt(e){if(typeof e=="number"&&Number.isSafeInteger(e)&&e>=0)return e;o("PAYLOAD_FIELD_MISSING","Attestation payload timestamp must be an unsigned safe integer")}function He(e,t){if(e instanceof Map)return e;o("PAYLOAD_FIELD_MISSING",`Attestation payload field ${t} must be a CBOR map`)}function $(e,t){if(e instanceof Uint8Array)return e;o("PAYLOAD_FIELD_MISSING",`Attestation payload field ${t} must be a byte string`)}function Ft(e,t){if(Array.isArray(e))return e;o("PAYLOAD_FIELD_MISSING",`Attestation payload field ${t} must be an array`)}var kt="https://attestation-service-staging.zkp2p.xyz",Wt="https://attestation-service.zkp2p.xyz";var Fe="5636e3bd96f847cf12cfd9de7faa8cad0e6fa00962ce16ba185f8e5ea57105abb3cc9cc34f1e1e4de3444ceabcca7485",ke="41a4ae0b9b96752cab5addb7d22689b3070e564e29f90a54316fa33fa38ea51387a6e887ea4f5a4b0cc34f69cea3f40e",Yt="5453c5bfb7d040285be5ba9af142f4fbdd9685d082f244b66c62bf7b22d8d02a638fa2e02b9a6fe8877953a9429209e0",We={"attestation-service-staging.zkp2p.xyz":h(Fe,"bundled staging PCR8"),"attestation-service-preprod.zkp2p.xyz":h(Yt,"bundled preprod PCR8"),"attestation-service.zkp2p.xyz":h(ke,"bundled production PCR8")},Ye={staging:{attestationServiceUrl:kt,expectedPcr8Hex:Fe},production:{attestationServiceUrl:Wt,expectedPcr8Hex:ke}};function Ge(e){let{trust:t,advertisedExpectedPcr8:r,onWarning:n}=e,i=e.hostname.toLowerCase();if(t?.expectedPcr8Hex)return h(t.expectedPcr8Hex,"trust.expectedPcr8Hex");let s=t?.expectedPcr8ByHost,a=s?Gt(s,i):void 0;if(a)return h(a,`trust.expectedPcr8ByHost[${i}]`);let l=We[i];if(l)return l;if(t?.strictPin===!0&&o("TRUST_PIN_REQUIRED",`No trusted PCR8 pin is configured for ${i}`),r){let u=h(r,"service-advertised expectedPcr8");return n?.({code:"TRUST_PIN_NOT_PROVIDED",message:`No caller or bundled PCR8 pin was available for ${i}; falling back to service-advertised expectedPcr8`,details:{hostname:i,expectedPcr8:u}}),u}o("TRUST_PIN_REQUIRED",`No trusted or service-advertised PCR8 pin is available for ${i}`)}function Gt(e,t){for(let[r,n]of Object.entries(e))if(r.toLowerCase()===t)return n}var $t=300*1e3;async function g(e){let t=q(e.fetch),r=x(e),n=e.now??Date.now,i=ve(r.getRandomValues),s=await Ve({attestationServiceUrl:e.attestationServiceUrl,nonceHex:i,fetch:t,timeoutMs:e.timeoutMs??1e4});Be(s.nonce,i);let{protectedHeadersBytes:a,payloadBytes:l,signature:u}=Ne(s.attestationDocument),c=Le(l);c.nonceHex!==i&&o("NONCE_BINDING_FAILED","Attestation payload user_data did not match the request nonce",{details:{expectedNonce:i,payloadNonce:c.nonceHex}});let d=e.trust?.freshnessWindowMs??$t,f=n();Math.abs(f-c.timestampMs)>d&&o("FRESHNESS_CHECK_FAILED",`Attestation timestamp skew exceeds ${d}ms`,{details:{timestampMs:c.timestampMs,nowMs:f,freshnessWindowMs:d}});let S=new URL(e.attestationServiceUrl).hostname,m=Ge({trust:e.trust,hostname:S,advertisedExpectedPcr8:s.advertised.expectedPcr8,onWarning:e.onWarning});c.pcr8Hex!==m&&o("PCR8_PIN_MISMATCH","Attestation PCR8 does not match the trusted pin",{details:{expectedPcr8:m,actualPcr8:c.pcr8Hex}});let{leafPublicKey:ot}=await Ce({leafCertificateDer:c.certificateDer,cabundleDer:c.cabundleDer,rootPem:e.trust?.awsNitroRootPem,nowMs:f,subtle:r.subtle,getRandomValues:r.getRandomValues,onWarning:e.onWarning});return await _e({protectedHeadersBytes:a,payloadBytes:l,signature:u,leafPublicKey:ot,subtle:r.subtle}),{attestedSellerUploadKey:{publicKeyDer:c.publicKeyDer,publicKeySha256Hex:I(new Uint8Array(await r.subtle.digest("SHA-256",P(c.publicKeyDer))))},payload:{timestampMs:c.timestampMs,pcr0Hex:c.pcr0Hex,pcr1Hex:c.pcr1Hex,pcr2Hex:c.pcr2Hex,pcr8Hex:c.pcr8Hex,nonceHex:c.nonceHex,advertised:s.advertised}}}async function V(e){let t=await g({attestationServiceUrl:e.attestationServiceUrl,trust:e.trust,fetch:e.fetch,subtle:e.subtle,getRandomValues:e.getRandomValues,now:e.now,onWarning:e.onWarning,timeoutMs:e.timeoutMs});return D({...e,key:t.attestedSellerUploadKey})}var $e=require("ethers");function v(e){try{return(0,$e.getAddress)(e)}catch(t){o("INVALID_PARAMETER","callerAddress must be a valid Ethereum address",{cause:t})}}async function B(e){let t=v(e.callerAddress),r=x(e);return xe({request:{...e,callerAddress:t},subtle:r.subtle,getRandomValues:r.getRandomValues})}async function H(e){let t=v(e.callerAddress),r=await g({attestationServiceUrl:e.attestationServiceUrl,trust:e.trust,fetch:e.fetch,subtle:e.subtle,getRandomValues:e.getRandomValues,now:e.now,onWarning:e.onWarning,timeoutMs:e.timeoutMs});return B({key:r.attestedSellerUploadKey,platform:e.platform,actionType:e.actionType,callerAddress:t,sessionMaterial:e.sessionMaterial,subtle:e.subtle,getRandomValues:e.getRandomValues})}async function L(e){let t=x(e);return Pe({request:e,subtle:t.subtle,getRandomValues:t.getRandomValues,now:e.now??Date.now})}async function F(e){let{attestationServiceUrl:t,trust:r,fetch:n,onWarning:i,timeoutMs:s,...a}=e,l=await g({attestationServiceUrl:t,trust:r,fetch:n,subtle:e.subtle,getRandomValues:e.getRandomValues,now:e.now,onWarning:i,timeoutMs:s});return L({...a,key:l.attestedSellerUploadKey})}var qt=400;async function k(e){let t=q(e.fetch),r=e.timeoutMs??1e4,n=new AbortController,i,s=new Promise((c,d)=>{i=setTimeout(()=>{n.abort(),d(new Error("timeout"))},r)}),a,l;try{a=await Promise.race([t(Xt(e.attestationServiceUrl,e.path),{method:"POST",headers:{accept:"application/json","content-type":"application/json"},body:JSON.stringify(e.body),signal:n.signal}),s]),l=await Promise.race([a.text(),s])}catch(c){n.signal.aborted&&o("TIMEOUT",`${e.failureContext} timed out after ${r}ms`,{cause:c}),o("ATTESTATION_FETCH_FAILED",`${e.failureContext} failed at the network layer`,{cause:c})}finally{clearTimeout(i)}if(!a.ok){let c=Kt(l);c?.success===!1&&qe(e.failureContext,a.status,c),o("ATTESTATION_FETCH_FAILED",`${e.failureContext} failed with HTTP ${a.status}`,{details:{status:a.status,body:l.slice(0,400)}})}let u;try{u=JSON.parse(l)}catch(c){o("ATTESTATION_RESPONSE_INVALID",`${e.failureContext} returned a non-JSON ServiceResponse`,{cause:c})}return u.success!==!0&&(u.success===!1&&qe(e.failureContext,a.status,u),o("ATTESTATION_RESPONSE_INVALID",`${e.failureContext} returned an unsuccessful ServiceResponse`)),zt(u.responseObject)||o("ATTESTATION_RESPONSE_INVALID",`${e.failureContext} returned a ServiceResponse without responseObject`,{details:{status:a.status,envelopeSnippet:jt(u)}}),u.responseObject}function Kt(e){try{return JSON.parse(e)}catch{return}}function qe(e,t,r){let n={status:t,statusCode:r.statusCode,message:r.message,responseObject:r.responseObject};o("SERVICE_RESPONSE_ERROR",`${e} returned an unsuccessful ServiceResponse`,{details:n})}function zt(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function jt(e){return JSON.stringify(e).slice(0,qt)}function Xt(e,t){let r=new URL(e);return r.pathname=`${r.pathname.replace(/\/+$/u,"")}${t}`,r.search="",r.toString()}async function Q(e){let t=v(e.callerAddress),r=await H({attestationServiceUrl:e.attestationServiceUrl,trust:e.trust,fetch:e.fetch,subtle:e.subtle,getRandomValues:e.getRandomValues,now:e.now,onWarning:e.onWarning,timeoutMs:e.timeoutMs,platform:e.platform,actionType:e.actionType,callerAddress:t,sessionMaterial:e.sessionMaterial});return k({attestationServiceUrl:e.attestationServiceUrl,path:"/identity",fetch:e.fetch,failureContext:"POST /identity",timeoutMs:e.timeoutMs,body:{platform:e.platform,actionType:e.actionType,callerAddress:t,encryptedSessionMaterial:r,params:e.params}})}async function J(e){let t=await F(e);return k({attestationServiceUrl:e.attestationServiceUrl,path:`/seller/credentials/${encodeURIComponent(e.platform)}`,fetch:e.fetch,failureContext:"POST /seller/credentials",timeoutMs:e.timeoutMs,body:{encryptedUpload:t}})}async function Z(e){let t=await V(e);return k({attestationServiceUrl:e.attestationServiceUrl,path:`/buyer/verify/${encodeURIComponent(e.platform)}/${encodeURIComponent(e.actionType)}`,fetch:e.fetch,failureContext:"POST /buyer/verify",timeoutMs:e.timeoutMs,body:{encryptedSessionMaterial:t,params:e.params,chainId:e.chainId,intent:e.intent}})}function Ke(e){let t=Ye[e.environment],r=e.attestationServiceUrl??t.attestationServiceUrl,n=N({strictPin:!0},e.trust);return{createEncryptedBuyerTeeSessionMaterial:i=>{let{attestationServiceUrl:s,trust:a,fetch:l,subtle:u,getRandomValues:c,now:d,onWarning:f,timeoutMs:S,...m}=i;return V({...m,attestationServiceUrl:s??r,trust:N(n,a),fetch:l??e.fetch,subtle:u??e.subtle,getRandomValues:c??e.getRandomValues,now:d??e.now,onWarning:f??e.onWarning,timeoutMs:S??e.timeoutMs})},createEncryptedIdentitySessionMaterial:i=>{let{attestationServiceUrl:s,trust:a,fetch:l,subtle:u,getRandomValues:c,now:d,onWarning:f,timeoutMs:S,...m}=i;return H({...m,attestationServiceUrl:s??r,trust:N(n,a),fetch:l??e.fetch,subtle:u??e.subtle,getRandomValues:c??e.getRandomValues,now:d??e.now,onWarning:f??e.onWarning,timeoutMs:S??e.timeoutMs})},createEncryptedSellerCredentialUpload:i=>{let{attestationServiceUrl:s,trust:a,fetch:l,subtle:u,getRandomValues:c,now:d,onWarning:f,timeoutMs:S,...m}=i;return F({...m,attestationServiceUrl:s??r,trust:N(n,a),fetch:l??e.fetch,subtle:u??e.subtle,getRandomValues:c??e.getRandomValues,now:d??e.now,onWarning:f??e.onWarning,timeoutMs:S??e.timeoutMs})},requestIdentityAttestation:i=>Q({attestationServiceUrl:i.attestationServiceUrl??r,trust:N(n,i.trust),fetch:i.fetch??e.fetch,subtle:i.subtle??e.subtle,getRandomValues:i.getRandomValues??e.getRandomValues,now:i.now??e.now,onWarning:i.onWarning??e.onWarning,timeoutMs:i.timeoutMs??e.timeoutMs,platform:i.platform,actionType:i.actionType,callerAddress:i.callerAddress,sessionMaterial:i.sessionMaterial,params:i.params}),uploadSellerCredential:i=>{let{attestationServiceUrl:s,trust:a,fetch:l,subtle:u,getRandomValues:c,now:d,onWarning:f,timeoutMs:S,...m}=i;return J({...m,attestationServiceUrl:s??r,trust:N(n,a),fetch:l??e.fetch,subtle:u??e.subtle,getRandomValues:c??e.getRandomValues,now:d??e.now,onWarning:f??e.onWarning,timeoutMs:S??e.timeoutMs})},verifyBuyerTeePayment:i=>{let s={attestationServiceUrl:i.attestationServiceUrl??r,trust:N(n,i.trust),fetch:i.fetch??e.fetch,subtle:i.subtle??e.subtle,getRandomValues:i.getRandomValues??e.getRandomValues,now:i.now??e.now,onWarning:i.onWarning??e.onWarning,timeoutMs:i.timeoutMs??e.timeoutMs,platform:i.platform,actionType:i.actionType,sessionMaterial:i.sessionMaterial,params:i.params,chainId:i.chainId,intent:i.intent};return Z(s)},fetchAndVerifyAttestation:(i={})=>g({attestationServiceUrl:i.attestationServiceUrl??r,trust:N(n,i.trust),fetch:i.fetch??e.fetch,subtle:i.subtle??e.subtle,getRandomValues:i.getRandomValues??e.getRandomValues,now:i.now??e.now,onWarning:i.onWarning??e.onWarning,timeoutMs:i.timeoutMs??e.timeoutMs}),encryptBuyerTeeSessionMaterial:({subtle:i,getRandomValues:s,...a})=>D({...a,subtle:i??e.subtle,getRandomValues:s??e.getRandomValues}),encryptIdentitySessionMaterial:({subtle:i,getRandomValues:s,...a})=>B({...a,subtle:i??e.subtle,getRandomValues:s??e.getRandomValues}),encryptSellerCredentialUpload:({subtle:i,getRandomValues:s,now:a,...l})=>L({...l,subtle:i??e.subtle,getRandomValues:s??e.getRandomValues,now:a??e.now})}}function N(e,t){return t?{...e,...t,expectedPcr8ByHost:{...e.expectedPcr8ByHost,...t.expectedPcr8ByHost}}:e}var y=require("ethers");var Qt={name:"UnifiedPaymentVerifier",version:"1"},fe={PaymentAttestation:[{name:"intentHash",type:"bytes32"},{name:"releaseAmount",type:"uint256"},{name:"dataHash",type:"bytes32"}]},Jt="PaymentAttestation(bytes32 intentHash,uint256 releaseAmount,bytes32 dataHash)",ze=A(Jt),ye={name:"ZKP2PIdentityVerifier",version:"1"},pe={IdentityAttestation:[{name:"method",type:"bytes32"},{name:"actionType",type:"bytes32"},{name:"callerAddress",type:"address"},{name:"payeeIdHash",type:"bytes32"},{name:"dataHash",type:"bytes32"},{name:"issuedAt",type:"uint256"},{name:"validUntil",type:"uint256"}]},Zt="IdentityAttestation(bytes32 method,bytes32 actionType,address callerAddress,bytes32 payeeIdHash,bytes32 dataHash,uint256 issuedAt,uint256 validUntil)",je=A(Zt),Xe=y.TypedDataEncoder.hashDomain(ye).toLowerCase(),Qe={name:"ZKP2P Seller Credential Bundle",version:"1"},Je={SellerCredentialBundle:[{name:"platform",type:"string"},{name:"payeeIdHash",type:"bytes32"},{name:"encryptedBlobHash",type:"bytes32"},{name:"encryptedDataKeyHash",type:"bytes32"},{name:"nonceHash",type:"bytes32"},{name:"credentialType",type:"string"},{name:"credentialValidatedAt",type:"string"},{name:"credentialExpiresAt",type:"string"}]};function er(e){return{...Qt,chainId:e.chainId,verifyingContract:(0,y.getAddress)(e.verifyingContract)}}function ee(e){return y.TypedDataEncoder.hashDomain(er(e)).toLowerCase()}function A(e){return(0,y.keccak256)((0,y.toUtf8Bytes)(e)).toLowerCase()}function Ze(e){return(0,y.keccak256)(e).toLowerCase()}function et(e){try{let t=y.TypedDataEncoder.from(e.types).hash(e.value),r=(0,y.keccak256)((0,y.concat)(["0x1901",e.domainSeparator,t]));return U((0,y.recoverAddress)(r,e.signature))}catch(t){o("ATTESTATION_SIGNATURE_INVALID","Unable to recover signer from attestation signature",{cause:t})}}function te(e){try{return U((0,y.verifyTypedData)(e.domain,e.types,e.value,e.signature))}catch(t){o("ATTESTATION_SIGNATURE_INVALID","Unable to verify attestation signature",{cause:t})}}function me(e,t){let r=U(e),n=new Set(t.map(i=>U(i)));return n.has(r)||o("SIGNER_NOT_TRUSTED","Recovered signer is not in trustedSigners",{details:{recoveredSigner:r,trustedSigners:Array.from(n)}}),r}function re(e){let t=me(e.recoveredSigner,e.trustedSigners),r=U(e.payloadSigner);return r!==t&&o("ATTESTATION_SIGNATURE_INVALID","Payload signer does not match the recovered signer",{details:{payloadSigner:r,recoveredSigner:t}}),t}function p(e,t,r){e.toLowerCase()!==t.toLowerCase()&&o("ATTESTATION_BINDING_MISMATCH",`${r} did not match expected value`,{details:{actual:e,expected:t}})}function tt(e,t,r){let n,i;try{n=U(e),i=U(t)}catch(s){o("INVALID_PARAMETER",`${r} must be a valid Ethereum address`,{cause:s})}n!==i&&o("ATTESTATION_BINDING_MISMATCH",`${r} did not match expected value`,{details:{actual:e,expected:t}})}function T(e,t,r){e!==t&&o("ATTESTATION_BINDING_MISMATCH",`${r} did not match expected value`,{details:{actual:e,expected:t}})}function ne(e,t){JSON.stringify(e)!==JSON.stringify(t)&&o("ATTESTATION_BINDING_MISMATCH","typedDataSpec.types did not match the expected EIP-712 types")}function w(e,t){return typeof e!="string"&&o("INVALID_PARAMETER",`${t} is required`),e}function U(e){return(0,y.getAddress)(e).toLowerCase()}function rt(e,t){T(e.platform,t.expectedPlatform,"platform"),T(e.actionType,t.expectedActionType,"actionType"),T(e.typedDataSpec.primaryType,"PaymentAttestation","typedDataSpec.primaryType"),ne(e.typedDataSpec.types,fe),p(e.typeHash,ze,"typeHash"),p(e.domainSeparator,ee(t.expectedDomain),"domainSeparator"),p(Ze(e.encodedPaymentDetails),e.typedDataValue.dataHash,"encodedPaymentDetails"),p(e.typedDataValue.intentHash,w(t.expectedIntentHash,"expectedIntentHash"),"typedDataValue.intentHash");let r=et({domainSeparator:e.domainSeparator,types:fe,value:{...e.typedDataValue},signature:e.signature});return re({payloadSigner:e.signer,recoveredSigner:r,trustedSigners:t.trustedSigners}),e}var tr=["platform","actionType","payeeId","username","metadata"];function nt(e,t){T(e.platform,t.expectedPlatform,"platform"),T(e.actionType,t.expectedActionType,"actionType"),T(e.identity.platform,e.platform,"identity.platform"),T(e.identity.actionType,e.actionType,"identity.actionType"),T(e.typedDataSpec.primaryType,"IdentityAttestation","typedDataSpec.primaryType"),ne(e.typedDataSpec.types,pe),p(e.domainSeparator,Xe,"domainSeparator"),p(e.typeHash,je,"typeHash"),p(e.identity.method,A(e.identity.platform),"identity.method"),p(e.identity.payeeIdHash,A(e.identity.payeeId),"identity.payeeIdHash"),p(e.typedDataValue.method,e.identity.method,"typedDataValue.method"),p(e.typedDataValue.actionType,A(e.identity.actionType),"typedDataValue.actionType"),tt(e.typedDataValue.callerAddress,w(t.expectedCallerAddress,"expectedCallerAddress"),"typedDataValue.callerAddress"),p(e.typedDataValue.payeeIdHash,e.identity.payeeIdHash,"typedDataValue.payeeIdHash"),p(e.typedDataValue.payeeIdHash,w(t.expectedPayeeIdHash,"expectedPayeeIdHash"),"typedDataValue.payeeIdHash"),p(e.typedDataValue.dataHash,rr(e.identity),"typedDataValue.dataHash"),ir(e.typedDataValue.validUntil,t.now??Date.now);let r=te({domain:ye,types:pe,value:{...e.typedDataValue},signature:e.signature});return re({payloadSigner:e.signer,recoveredSigner:r,trustedSigners:t.trustedSigners}),e.identity}function rr(e){let t={platform:e.platform,actionType:e.actionType,payeeId:e.payeeId,username:e.username,metadata:nr(e.metadata)},r=JSON.stringify(Object.fromEntries(tr.map(n=>[n,t[n]])));return A(r)}function nr(e){return Object.fromEntries(Object.entries(e).sort(([t],[r])=>t.localeCompare(r)))}function ir(e,t){let r=t();BigInt(r)>BigInt(e)&&o("ATTESTATION_EXPIRED","Identity attestation validUntil is in the past",{details:{validUntil:e,nowMs:r}})}function it(e,t){T(e.platform,t.expectedPlatform,"platform"),p(e.payeeIdHash,w(t.expectedPayeeIdHash,"expectedPayeeIdHash"),"payeeIdHash"),sr(e.credentialExpiresAt,t.now??Date.now);let r=te({domain:Qe,types:Je,value:or(e),signature:e.bundleSignature});return me(r,t.trustedSigners),e}function or(e){return{platform:e.platform,payeeIdHash:e.payeeIdHash,encryptedBlobHash:A(e.encryptedBlob),encryptedDataKeyHash:A(e.encryptedDataKey),nonceHash:A(e.nonce),credentialType:e.credentialType,credentialValidatedAt:e.credentialValidatedAt,credentialExpiresAt:e.credentialExpiresAt??""}}function sr(e,t){let r=t();e!==null&&BigInt(r)>BigInt(e)&&o("ATTESTATION_EXPIRED","Seller credential bundle credentialExpiresAt is in the past",{details:{credentialExpiresAt:e,nowMs:r}})}0&&(module.exports={AWS_NITRO_ROOT_FINGERPRINT_SHA256_HEX,AWS_NITRO_ROOT_PEM,NitroAttestationError,createEncryptedBuyerTeeSessionMaterial,createEncryptedIdentitySessionMaterial,createEncryptedSellerCredentialUpload,createNitroAttestationClient,encryptBuyerTeeSessionMaterial,encryptIdentitySessionMaterial,encryptSellerCredentialUpload,fetchAndVerifyAttestation,getUnifiedPaymentVerifierDomainSeparator,hashUtf8,requestIdentityAttestation,uploadSellerCredential,verifyBuyerTeePayment,verifyBuyerTeePaymentAttestation,verifyIdentityAttestation,verifySellerCredentialBundle});
|
|
15
|
+
`,W="641a0321a3e244efe456463195d606317ed7cdcc3c1756e09893f3c68f79bb5b";var Ot=10080*60*1e3;async function we(e){let t=Pe(e.subtle,e.getRandomValues),r=le(e.rootPem??J,"AWS Nitro root certificate"),n=await pe(r,e.subtle);n!==W&&s("AWS_ROOT_FINGERPRINT_MISMATCH","Bundled AWS Nitro root certificate fingerprint mismatch",{details:{expected:W,actual:n}});let o=le(e.leafCertificateDer,"attestation leaf certificate"),a=e.cabundleDer.map((f,A)=>le(f,`cabundle[${A}]`)),i=[r,...a,o];for(let f of i)Mt(f,e.nowMs),Vt(f,e.nowMs,e.onWarning);let u=await pe(o,e.subtle),l=[];for(let f of a){let A=await pe(f,e.subtle);A!==u&&A!==n&&l.push(f)}let c=[[o,...l.slice().reverse(),r],[o,...l,r]];for(let f of c)if(await wt(f,t)){let A=await S(o.publicKey.export({name:"ECDSA",namedCurve:"P-384"},["verify"],t),"CERT_CHAIN_INVALID","Failed to export attestation leaf public key");return{leafCertificate:o,leafPublicKey:A}}s("CERT_CHAIN_INVALID","Attestation certificate chain does not verify to the pinned AWS Nitro root")}async function wt(e,t){for(let r=0;r<e.length-1;r+=1){let n=e[r],o=e[r+1];if(!await n.verify({publicKey:o.publicKey,signatureOnly:!0},t))return!1}return e.length>0&&await e[e.length-1].isSelfSigned(t)}function le(e,t){try{return new Oe.X509Certificate(e)}catch(r){s("CERT_CHAIN_INVALID",`Could not parse ${t}`,{cause:r})}}async function pe(e,t){return E(new Uint8Array(await t.digest("SHA-256",e.rawData)))}function Mt(e,t){(t<e.notBefore.getTime()||t>e.notAfter.getTime())&&s("CERT_NOT_TIME_VALID","Certificate is outside its validity window",{details:{subject:e.subject,notBefore:e.notBefore.toISOString(),notAfter:e.notAfter.toISOString()}})}function Vt(e,t,r){e.notAfter.getTime()<t+Ot&&r?.({code:"CERT_VALIDITY_NEAR_EXPIRY",message:"Certificate in Nitro attestation chain expires within 7 days",details:{subject:e.subject,notAfter:e.notAfter.toISOString()}})}function $(e){let t=new fe(e),r=t.readValue();if(!t.done())throw new Error("Trailing CBOR bytes");return r}function Q(e){if(typeof e=="number"){if(!Number.isSafeInteger(e))throw new Error("CBOR number must be a safe integer");return e>=0?x(0,e):x(1,-1-e)}if(typeof e=="bigint")return e>=0n?x(0,e):x(1,-1n-e);if(typeof e=="string"){let t=P(e);return h([x(3,t.length),t])}if(e instanceof Uint8Array)return h([x(2,e.length),e]);if(Array.isArray(e))return h([x(4,e.length),...e.map(Q)]);if(e instanceof Map)return h([x(5,e.size),...Array.from(e.entries()).flatMap(([t,r])=>[Q(t),Q(r)])]);if(typeof e=="boolean")return new Uint8Array([e?245:244]);if(e===null)return new Uint8Array([246]);throw new Error("Unsupported CBOR value")}function Me(e,t){return Q(["Signature1",e,new Uint8Array,t])}function x(e,t){let r=BigInt(t);return r<24n?new Uint8Array([e<<5|Number(r)]):r<=0xffn?new Uint8Array([e<<5|24,Number(r)]):r<=0xffffn?new Uint8Array([e<<5|25,Number(r>>8n&0xffn),Number(r&0xffn)]):r<=0xffffffffn?new Uint8Array([e<<5|26,Number(r>>24n&0xffn),Number(r>>16n&0xffn),Number(r>>8n&0xffn),Number(r&0xffn)]):new Uint8Array([e<<5|27,Number(r>>56n&0xffn),Number(r>>48n&0xffn),Number(r>>40n&0xffn),Number(r>>32n&0xffn),Number(r>>24n&0xffn),Number(r>>16n&0xffn),Number(r>>8n&0xffn),Number(r&0xffn)])}var fe=class{constructor(t){this.bytes=t}bytes;offset=0;done(){return this.offset===this.bytes.length}readValue(){let t=this.readByte(),r=t>>5,n=t&31;if(n===31)return this.readIndefiniteValue(r);if(r===0)return this.readLength(n);if(r===1){let o=this.readLength(n);return typeof o=="bigint"?-1n-o:-1-o}if(r===2){let o=this.lengthAsNumber(this.readLength(n));return this.readBytes(o)}if(r===3){let o=this.lengthAsNumber(this.readLength(n));return U(this.readBytes(o))}if(r===4){let o=this.lengthAsNumber(this.readLength(n)),a=[];for(let i=0;i<o;i+=1)a.push(this.readValue());return a}if(r===5){let o=this.lengthAsNumber(this.readLength(n)),a=new Map;for(let i=0;i<o;i+=1)a.set(this.readValue(),this.readValue());return a}if(r===6)return this.readLength(n),this.readValue();if(r===7){if(n===20)return!1;if(n===21)return!0;if(n===22)return null}throw new Error(`Unsupported CBOR major/additional type: ${r}/${n}`)}readIndefiniteValue(t){if(t===2){let r=[];for(;!this.consumeBreak();){let n=this.readValue();if(!(n instanceof Uint8Array))throw new Error("Indefinite CBOR byte string chunk must be a byte string");r.push(n)}return h(r)}if(t===3){let r="";for(;!this.consumeBreak();){let n=this.readValue();if(typeof n!="string")throw new Error("Indefinite CBOR text string chunk must be a text string");r+=n}return r}if(t===4){let r=[];for(;!this.consumeBreak();)r.push(this.readValue());return r}if(t===5){let r=new Map;for(;!this.consumeBreak();){let n=this.readValue();if(this.peekBreak())throw new Error("Indefinite CBOR map ended after a key");r.set(n,this.readValue())}return r}throw new Error(`Indefinite CBOR major type ${t} is not supported`)}readLength(t){if(t<24)return t;if(t===24)return this.readByte();if(t===25)return this.readByte()<<8|this.readByte();if(t===26)return this.readByte()*16777216+(this.readByte()<<16)+(this.readByte()<<8)+this.readByte()>>>0;if(t===27){let r=0n;for(let n=0;n<8;n+=1)r=r<<8n|BigInt(this.readByte());return r<=BigInt(Number.MAX_SAFE_INTEGER)?Number(r):r}throw new Error("Indefinite CBOR lengths are not supported")}readByte(){if(this.offset>=this.bytes.length)throw new Error("Unexpected end of CBOR input");return this.bytes[this.offset++]}peekBreak(){return this.offset<this.bytes.length&&this.bytes[this.offset]===255}consumeBreak(){return this.peekBreak()?(this.offset+=1,!0):!1}readBytes(t){if(this.offset+t>this.bytes.length)throw new Error("Unexpected end of CBOR byte string");let r=this.bytes.slice(this.offset,this.offset+t);return this.offset+=t,r}lengthAsNumber(t){if(typeof t=="bigint")throw new Error("CBOR length exceeds JavaScript safe integer range");return t}};function Ve(e){let t=e[0]===210?e.slice(1):e,r;try{r=$(t)}catch(u){s("COSE_STRUCTURE_INVALID","Attestation document is not a valid COSE_Sign1 CBOR value",{cause:u})}(!Array.isArray(r)||r.length!==4)&&s("COSE_STRUCTURE_INVALID","COSE_Sign1 must be [protected, unprotected, payload, signature]");let[n,o,a,i]=r;return(!(n instanceof Uint8Array)||!(o instanceof Map)||!(a instanceof Uint8Array)||!(i instanceof Uint8Array))&&s("COSE_STRUCTURE_INVALID","COSE_Sign1 fields have invalid CBOR types"),vt(n),i.length!==96&&s("COSE_SIGNATURE_INVALID_SIZE",`Expected a 96-byte ES384 signature, got ${i.length} bytes`),{protectedHeadersBytes:n,payloadBytes:a,signature:i}}async function ve(e){let t=Me(e.protectedHeadersBytes,e.payloadBytes);await S(e.subtle.verify({name:"ECDSA",hash:"SHA-384"},e.leafPublicKey,e.signature,t),"COSE_SIGNATURE_VERIFY_FAILED","COSE_Sign1 signature verification failed")||s("COSE_SIGNATURE_VERIFY_FAILED","COSE_Sign1 signature does not verify with the attestation leaf certificate")}function vt(e){let t;try{t=$(e)}catch(r){s("COSE_STRUCTURE_INVALID","COSE protected headers are not a valid CBOR map",{cause:r})}t instanceof Map||s("COSE_STRUCTURE_INVALID","COSE protected headers must be a CBOR map"),t.get(1)!==-35&&s("COSE_ALG_UNSUPPORTED","COSE protected header alg must be -35 (ES384)")}var ye=96;function C(e,t){let r=e.replace(/^0x/i,"").toLowerCase();return(r.length!==ye||!/^[0-9a-f]+$/.test(r))&&s("TRUST_PIN_REQUIRED",`${t} must be ${ye} lowercase hex characters`),r}function Be(e,t){let r=C(e,t);return e!==r&&s("ATTESTATION_RESPONSE_INVALID",`${t} must be ${ye} lowercase hex characters`),r}var He=256*1024,Bt=3,Ht=150,Lt=/^0x[0-9a-fA-F]{40}$/;function Ft(e,t){let r=new URL(e),n=r.pathname.replace(/\/+$/,"");return r.pathname=n.endsWith("/attestation")?n:`${n}/attestation`,r.search="",r.searchParams.set("nonce",t),r}async function Ye(e){let t=Ft(e.attestationServiceUrl,e.nonceHex),r=await Wt(t.toString(),e.fetch,e.timeoutMs),n=await Yt(r);r.ok||s("ATTESTATION_FETCH_FAILED",`GET /attestation failed with HTTP ${r.status}`,{details:{status:r.status,body:n.slice(0,400)}});let o;try{o=JSON.parse(n)}catch(a){s("ATTESTATION_RESPONSE_INVALID","GET /attestation returned non-JSON response",{cause:a})}return kt(o)}function kt(e){(!ke(e)||e.success!==!0||!ke(e.responseObject))&&s("ATTESTATION_RESPONSE_INVALID","Expected { success: true, responseObject: {...} }");let t=e.responseObject;(typeof t.attestationDocument!="string"||typeof t.nonce!="string")&&s("ATTESTATION_RESPONSE_INVALID","Attestation response is missing attestationDocument or nonce");let r;try{r=he(t.attestationDocument)}catch(n){s("ATTESTATION_RESPONSE_INVALID","attestationDocument is not valid base64",{cause:n})}return r.length===0&&s("ATTESTATION_RESPONSE_INVALID","attestationDocument decoded to empty bytes"),{attestationDocument:r,nonce:t.nonce.toLowerCase(),advertised:{chainId:typeof t.chainId=="number"?t.chainId:void 0,verifyingContract:Fe(t.verifyingContract,"verifyingContract"),expectedSigner:Fe(t.expectedSigner,"expectedSigner"),expectedPcr8:Gt(t.expectedPcr8,"expectedPcr8")}}}async function Yt(e){if(!e.body){let o=await e.text();return Le(P(o).length),o}let t=e.body.getReader(),r=[],n=0;for(;;){let{done:o,value:a}=await t.read();if(o)break;a&&(n+=a.length,Le(n),r.push(a))}return U(h(r))}function Le(e){e>He&&s("ATTESTATION_RESPONSE_INVALID","GET /attestation response exceeded maximum size",{details:{maxBytes:He,actualBytes:e}})}function Fe(e,t){if(e!==void 0)return(typeof e!="string"||!Lt.test(e))&&s("ATTESTATION_RESPONSE_INVALID",`${t} must be a 0x-prefixed 20-byte hex address`),e.toLowerCase()}function Gt(e,t){if(e!==void 0){typeof e!="string"&&s("ATTESTATION_RESPONSE_INVALID",`${t} must be a 96-character lowercase hex string`);try{return Be(e,t)}catch(r){s("ATTESTATION_RESPONSE_INVALID",`${t} must be a 96-character lowercase hex string`,{cause:r})}}}async function Wt(e,t,r){let n=1;for(;;)try{return await $t(e,t,r)}catch(o){if(!qt(o)||n>=Bt)throw o;await Kt(Ht*n),n+=1}}async function $t(e,t,r){let n=typeof AbortController<"u"?new AbortController:void 0,o,a=new Promise((i,u)=>{o=setTimeout(()=>{n?.abort(),u(new Error("timeout"))},r)});try{let i=await Promise.race([t(e,{headers:{accept:"application/json"},signal:n?.signal}),a]);return o!==void 0&&clearTimeout(o),i}catch(i){o!==void 0&&clearTimeout(o),i instanceof Error&&(i.name==="AbortError"||i.message==="timeout")&&s("TIMEOUT",`GET /attestation timed out after ${r}ms`,{cause:i}),s("ATTESTATION_FETCH_FAILED","GET /attestation failed at the network layer",{cause:i,details:{layer:"network"}})}}function qt(e){return e instanceof R&&e.code==="ATTESTATION_FETCH_FAILED"&&e.details?.layer==="network"}function Kt(e){return new Promise(t=>setTimeout(t,e))}function ke(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}var jt=32;function Ge(e){return E(e(new Uint8Array(jt)))}function We(e,t){e.toLowerCase()!==t&&s("ATTESTATION_NONCE_MISMATCH","Attestation service echoed a different nonce",{details:{expectedNonce:t,echoedNonce:e}})}function qe(e){let t;try{t=$(e)}catch(a){s("PAYLOAD_FIELD_MISSING","Attestation payload is not a valid CBOR map",{cause:a})}let r=$e(t,"payload"),n=$e(r.get("pcrs"),"pcrs"),o=q(r.get("user_data"),"user_data");return{timestampMs:zt(r.get("timestamp")),nonceHex:U(o),pcr0Hex:me(n,0),pcr1Hex:me(n,1),pcr2Hex:me(n,2),pcr8Hex:E(q(n.get(8),"pcrs[8]")),certificateDer:q(r.get("certificate"),"certificate"),cabundleDer:Xt(r.get("cabundle"),"cabundle").map((a,i)=>q(a,`cabundle[${i}]`)),publicKeyDer:q(r.get("public_key"),"public_key")}}function me(e,t){let r=e.get(t);return r instanceof Uint8Array?E(r):""}function zt(e){if(typeof e=="number"&&Number.isSafeInteger(e)&&e>=0)return e;s("PAYLOAD_FIELD_MISSING","Attestation payload timestamp must be an unsigned safe integer")}function $e(e,t){if(e instanceof Map)return e;s("PAYLOAD_FIELD_MISSING",`Attestation payload field ${t} must be a CBOR map`)}function q(e,t){if(e instanceof Uint8Array)return e;s("PAYLOAD_FIELD_MISSING",`Attestation payload field ${t} must be a byte string`)}function Xt(e,t){if(Array.isArray(e))return e;s("PAYLOAD_FIELD_MISSING",`Attestation payload field ${t} must be an array`)}var Jt="https://attestation-service-staging.zkp2p.xyz",Qt="https://attestation-service.zkp2p.xyz",Ke="5636e3bd96f847cf12cfd9de7faa8cad0e6fa00962ce16ba185f8e5ea57105abb3cc9cc34f1e1e4de3444ceabcca7485",je="41a4ae0b9b96752cab5addb7d22689b3070e564e29f90a54316fa33fa38ea51387a6e887ea4f5a4b0cc34f69cea3f40e",ze={"attestation-service-staging.zkp2p.xyz":C(Ke,"bundled staging PCR8"),"attestation-service.zkp2p.xyz":C(je,"bundled production PCR8")},Xe={staging:{attestationServiceUrl:Jt,expectedPcr8Hex:Ke},production:{attestationServiceUrl:Qt,expectedPcr8Hex:je}};function Je(e){let{trust:t,advertisedExpectedPcr8:r,onWarning:n}=e,o=e.hostname.toLowerCase();if(t?.expectedPcr8Hex)return C(t.expectedPcr8Hex,"trust.expectedPcr8Hex");let a=t?.expectedPcr8ByHost,i=a?Zt(a,o):void 0;if(i)return C(i,`trust.expectedPcr8ByHost[${o}]`);let u=ze[o];if(u)return u;if(t?.strictPin===!0&&s("TRUST_PIN_REQUIRED",`No trusted PCR8 pin is configured for ${o}`),r){let l=C(r,"service-advertised expectedPcr8");return n?.({code:"TRUST_PIN_NOT_PROVIDED",message:`No caller or bundled PCR8 pin was available for ${o}; falling back to service-advertised expectedPcr8`,details:{hostname:o,expectedPcr8:l}}),l}s("TRUST_PIN_REQUIRED",`No trusted or service-advertised PCR8 pin is available for ${o}`)}function Zt(e,t){for(let[r,n]of Object.entries(e))if(r.toLowerCase()===t)return n}var er=300*1e3;async function b(e){return(await K(e)).attestedSellerUploadKey}async function K(e){let t=j(e.fetch),r=T(e),n=e.now??Date.now,o=Ge(r.getRandomValues),a=await Ye({attestationServiceUrl:e.attestationServiceUrl,nonceHex:o,fetch:t,timeoutMs:e.timeoutMs??1e4});We(a.nonce,o);let{protectedHeadersBytes:i,payloadBytes:u,signature:l}=Ve(a.attestationDocument),c=qe(u);c.nonceHex!==o&&s("NONCE_BINDING_FAILED","Attestation payload user_data did not match the request nonce",{details:{expectedNonce:o,payloadNonce:c.nonceHex}});let f=e.trust?.freshnessWindowMs??er,A=n();Math.abs(A-c.timestampMs)>f&&s("FRESHNESS_CHECK_FAILED",`Attestation timestamp skew exceeds ${f}ms`,{details:{timestampMs:c.timestampMs,nowMs:A,freshnessWindowMs:f}});let ce=new URL(e.attestationServiceUrl).hostname,_=Je({trust:e.trust,hostname:ce,advertisedExpectedPcr8:a.advertised.expectedPcr8,onWarning:e.onWarning});c.pcr8Hex!==_&&s("PCR8_PIN_MISMATCH","Attestation PCR8 does not match the trusted pin",{details:{expectedPcr8:_,actualPcr8:c.pcr8Hex}});let{leafPublicKey:mt}=await we({leafCertificateDer:c.certificateDer,cabundleDer:c.cabundleDer,rootPem:e.trust?.awsNitroRootPem,nowMs:A,subtle:r.subtle,getRandomValues:r.getRandomValues,onWarning:e.onWarning});return await ve({protectedHeadersBytes:i,payloadBytes:u,signature:l,leafPublicKey:mt,subtle:r.subtle}),{attestedSellerUploadKey:{publicKeyDer:c.publicKeyDer,publicKeySha256Hex:E(new Uint8Array(await r.subtle.digest("SHA-256",g(c.publicKeyDer))))},payload:{timestampMs:c.timestampMs,pcr0Hex:c.pcr0Hex,pcr1Hex:c.pcr1Hex,pcr2Hex:c.pcr2Hex,pcr8Hex:c.pcr8Hex,nonceHex:c.nonceHex,advertised:a.advertised}}}async function M(e){return w({...e,key:await b(e)})}async function V(e){let t=T(e);return _e({request:e,subtle:t.subtle,getRandomValues:t.getRandomValues})}async function v(e){return V({key:await b(e),platform:e.platform,actionType:e.actionType,sessionMaterial:e.sessionMaterial,subtle:e.subtle,getRandomValues:e.getRandomValues})}async function B(e){let t=T(e);return Ne({request:e,subtle:t.subtle,getRandomValues:t.getRandomValues})}async function H(e){return B({key:await b(e),platform:e.platform,actionType:e.actionType,sessionMaterial:e.sessionMaterial,subtle:e.subtle,getRandomValues:e.getRandomValues})}async function L(e){let t=T(e);return De({request:e,subtle:t.subtle,getRandomValues:t.getRandomValues,now:e.now??Date.now})}async function F(e){return L({...e,key:await b(e)})}var Qe=require("ethers");function Ze(e){try{return(0,Qe.getAddress)(e)}catch(t){s("INVALID_PARAMETER","callerAddress must be a valid Ethereum address",{cause:t})}}var tr=400;async function D(e){let t=j(e.fetch),r=e.timeoutMs??1e4,n=new AbortController,o,a=new Promise((c,f)=>{o=setTimeout(()=>{n.abort(),f(new Error("timeout"))},r)}),i,u;try{i=await Promise.race([t(or(e.attestationServiceUrl,e.path),{method:"POST",headers:{accept:"application/json","content-type":"application/json"},body:JSON.stringify(e.body),signal:n.signal}),a]),u=await Promise.race([i.text(),a])}catch(c){n.signal.aborted&&s("TIMEOUT",`${e.failureContext} timed out after ${r}ms`,{cause:c}),s("ATTESTATION_FETCH_FAILED",`${e.failureContext} failed at the network layer`,{cause:c})}finally{clearTimeout(o)}if(!i.ok){let c=rr(u);c?.success===!1&&et(e.failureContext,i.status,c),s("ATTESTATION_FETCH_FAILED",`${e.failureContext} failed with HTTP ${i.status}`,{details:{status:i.status,body:u.slice(0,400)}})}let l;try{l=JSON.parse(u)}catch(c){s("ATTESTATION_RESPONSE_INVALID",`${e.failureContext} returned a non-JSON ServiceResponse`,{cause:c})}return l.success!==!0&&(l.success===!1&&et(e.failureContext,i.status,l),s("ATTESTATION_RESPONSE_INVALID",`${e.failureContext} returned an unsuccessful ServiceResponse`)),nr(l.responseObject)||s("ATTESTATION_RESPONSE_INVALID",`${e.failureContext} returned a ServiceResponse without responseObject`,{details:{status:i.status,envelopeSnippet:ir(l)}}),l.responseObject}function rr(e){try{return JSON.parse(e)}catch{return}}function et(e,t,r){let n={status:t,statusCode:r.statusCode,message:r.message,responseObject:r.responseObject};s("SERVICE_RESPONSE_ERROR",`${e} returned an unsuccessful ServiceResponse`,{details:n})}function nr(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function ir(e){return JSON.stringify(e).slice(0,tr)}function or(e,t){let r=new URL(e);return r.pathname=`${r.pathname.replace(/\/+$/u,"")}${t}`,r.search="",r.toString()}async function Z(e){let t=Ze(e.callerAddress),r=await H({attestationServiceUrl:e.attestationServiceUrl,trust:e.trust,fetch:e.fetch,subtle:e.subtle,getRandomValues:e.getRandomValues,now:e.now,onWarning:e.onWarning,timeoutMs:e.timeoutMs,platform:e.platform,actionType:e.actionType,sessionMaterial:e.sessionMaterial});return D({attestationServiceUrl:e.attestationServiceUrl,path:"/identity",fetch:e.fetch,failureContext:"POST /identity",timeoutMs:e.timeoutMs,body:{platform:e.platform,actionType:e.actionType,callerAddress:t,encryptedSessionMaterial:r,params:e.params}})}async function ee(e){let t=await F(e);return D({attestationServiceUrl:e.attestationServiceUrl,path:`/seller/credentials/${encodeURIComponent(e.platform)}`,fetch:e.fetch,failureContext:"POST /seller/credentials",timeoutMs:e.timeoutMs,body:{encryptedUpload:t}})}async function te(e){let t=await M(e);return D({attestationServiceUrl:e.attestationServiceUrl,path:`/buyer/verify/${encodeURIComponent(e.platform)}/${encodeURIComponent(e.actionType)}`,fetch:e.fetch,failureContext:"POST /buyer/verify",timeoutMs:e.timeoutMs,body:{encryptedSessionMaterial:t,params:e.params,chainId:e.chainId,intent:e.intent}})}async function re(e){let t=await v(e);return D({attestationServiceUrl:e.attestationServiceUrl,path:`/dispute/verify/${encodeURIComponent(e.platform)}/${encodeURIComponent(e.actionType)}`,fetch:e.fetch,failureContext:"POST /dispute/verify",timeoutMs:e.timeoutMs,body:{encryptedSessionMaterial:t,params:e.params,chainId:e.chainId,intentHash:e.intentHash}})}function rt(e){let t=Xe[e.environment],r=e.attestationServiceUrl??t.attestationServiceUrl,n=tt({strictPin:!0},e.trust),o=i=>({...i,attestationServiceUrl:i.attestationServiceUrl??r,trust:tt(n,i.trust),fetch:i.fetch??e.fetch,subtle:i.subtle??e.subtle,getRandomValues:i.getRandomValues??e.getRandomValues,now:i.now??e.now,onWarning:i.onWarning??e.onWarning,timeoutMs:i.timeoutMs??e.timeoutMs}),a=i=>({...i,subtle:i.subtle??e.subtle,getRandomValues:i.getRandomValues??e.getRandomValues});return{createEncryptedBuyerTeeSessionMaterial:i=>M(o(i)),createEncryptedIdentitySessionMaterial:i=>H(o(i)),createEncryptedDisputeSessionMaterial:i=>v(o(i)),createEncryptedSellerCredentialUpload:i=>F(o(i)),requestIdentityAttestation:i=>Z(o(i)),uploadSellerCredential:i=>ee(o(i)),verifyBuyerTeePayment:i=>{let u=o(i);return te(u)},verifyDispute:i=>re(o(i)),fetchAndVerifyAttestation:(i={})=>K(o(i)),encryptBuyerTeeSessionMaterial:i=>w(a(i)),encryptIdentitySessionMaterial:i=>B(a(i)),encryptDisputeSessionMaterial:i=>V(a(i)),encryptSellerCredentialUpload:i=>L({...a(i),now:i.now??e.now})}}function tt(e,t){return t?{...e,...t,expectedPcr8ByHost:{...e.expectedPcr8ByHost,...t.expectedPcr8ByHost}}:e}var p=require("ethers");var sr={name:"UnifiedPaymentVerifier",version:"1"},Te={PaymentAttestation:[{name:"intentHash",type:"bytes32"},{name:"releaseAmount",type:"uint256"},{name:"dataHash",type:"bytes32"}]},ar="PaymentAttestation(bytes32 intentHash,uint256 releaseAmount,bytes32 dataHash)",nt=y(ar),cr={name:"ZKP2P DisputeVerifier",version:"1"},Se={DisputeAttestation:[{name:"intentHash",type:"bytes32"},{name:"dataHash",type:"bytes32"}]},ur="DisputeAttestation(bytes32 intentHash,bytes32 dataHash)",it=y(ur),Ee={name:"ZKP2PIdentityVerifier",version:"1"},ge={IdentityAttestation:[{name:"method",type:"bytes32"},{name:"actionType",type:"bytes32"},{name:"callerAddress",type:"address"},{name:"payeeIdHash",type:"bytes32"},{name:"dataHash",type:"bytes32"},{name:"issuedAt",type:"uint256"},{name:"validUntil",type:"uint256"}]},dr="IdentityAttestation(bytes32 method,bytes32 actionType,address callerAddress,bytes32 payeeIdHash,bytes32 dataHash,uint256 issuedAt,uint256 validUntil)",ot=y(dr),st=p.TypedDataEncoder.hashDomain(Ee).toLowerCase(),at={name:"ZKP2P Seller Credential Bundle",version:"1"},ct={SellerCredentialBundle:[{name:"platform",type:"string"},{name:"payeeIdHash",type:"bytes32"},{name:"encryptedBlobHash",type:"bytes32"},{name:"encryptedDataKeyHash",type:"bytes32"},{name:"nonceHash",type:"bytes32"},{name:"credentialType",type:"string"},{name:"credentialValidatedAt",type:"string"},{name:"credentialExpiresAt",type:"string"}]};function lr(e){return{...sr,chainId:e.chainId,verifyingContract:(0,p.getAddress)(e.verifyingContract)}}function ne(e){return p.TypedDataEncoder.hashDomain(lr(e)).toLowerCase()}function pr(e){return{...cr,chainId:e.chainId,verifyingContract:(0,p.getAddress)(e.verifyingContract)}}function ie(e){return p.TypedDataEncoder.hashDomain(pr(e)).toLowerCase()}function y(e){return(0,p.keccak256)((0,p.toUtf8Bytes)(e)).toLowerCase()}function oe(e){return(0,p.keccak256)(e).toLowerCase()}function se(e){try{let t=p.TypedDataEncoder.from(e.types).hash(e.value),r=(0,p.keccak256)((0,p.concat)(["0x1901",e.domainSeparator,t]));return N((0,p.recoverAddress)(r,e.signature))}catch(t){s("ATTESTATION_SIGNATURE_INVALID","Unable to recover signer from attestation signature",{cause:t})}}function ae(e){try{return N((0,p.verifyTypedData)(e.domain,e.types,e.value,e.signature))}catch(t){s("ATTESTATION_SIGNATURE_INVALID","Unable to verify attestation signature",{cause:t})}}function Ie(e,t){let r=N(e),n=new Set(t.map(o=>N(o)));return n.has(r)||s("SIGNER_NOT_TRUSTED","Recovered signer is not in trustedSigners",{details:{recoveredSigner:r,trustedSigners:Array.from(n)}}),r}function k(e){let t=Ie(e.recoveredSigner,e.trustedSigners),r=N(e.payloadSigner);return r!==t&&s("ATTESTATION_SIGNATURE_INVALID","Payload signer does not match the recovered signer",{details:{payloadSigner:r,recoveredSigner:t}}),t}function d(e,t,r){e.toLowerCase()!==t.toLowerCase()&&s("ATTESTATION_BINDING_MISMATCH",`${r} did not match expected value`,{details:{actual:e,expected:t}})}function ut(e,t,r){let n,o;try{n=N(e),o=N(t)}catch(a){s("INVALID_PARAMETER",`${r} must be a valid Ethereum address`,{cause:a})}n!==o&&s("ATTESTATION_BINDING_MISMATCH",`${r} did not match expected value`,{details:{actual:e,expected:t}})}function m(e,t,r){e!==t&&s("ATTESTATION_BINDING_MISMATCH",`${r} did not match expected value`,{details:{actual:e,expected:t}})}function Y(e,t){JSON.stringify(e)!==JSON.stringify(t)&&s("ATTESTATION_BINDING_MISMATCH","typedDataSpec.types did not match the expected EIP-712 types")}function I(e,t){return typeof e!="string"&&s("INVALID_PARAMETER",`${t} is required`),e}function N(e){return(0,p.getAddress)(e).toLowerCase()}function dt(e,t){m(e.platform,t.expectedPlatform,"platform"),m(e.actionType,t.expectedActionType,"actionType"),m(e.typedDataSpec.primaryType,"PaymentAttestation","typedDataSpec.primaryType"),Y(e.typedDataSpec.types,Te),d(e.typeHash,nt,"typeHash"),d(e.domainSeparator,ne(t.expectedDomain),"domainSeparator"),d(oe(e.encodedPaymentDetails),e.typedDataValue.dataHash,"encodedPaymentDetails"),d(e.typedDataValue.intentHash,I(t.expectedIntentHash,"expectedIntentHash"),"typedDataValue.intentHash");let r=se({domainSeparator:e.domainSeparator,types:Te,value:{...e.typedDataValue},signature:e.signature});return k({payloadSigner:e.signer,recoveredSigner:r,trustedSigners:t.trustedSigners}),e}var lt=require("ethers");var fr="tuple(bytes32 paymentMethod,bytes32 originalPaymentId,bytes32 disputeId,uint256 paymentAmount,bytes32 paymentCurrency)";function pt(e,t){m(e.platform,t.expectedPlatform,"platform"),m(e.actionType,t.expectedActionType,"actionType"),m(e.typedDataSpec.primaryType,"DisputeAttestation","typedDataSpec.primaryType"),Y(e.typedDataSpec.types,Se),d(e.typeHash,it,"typeHash"),d(e.domainSeparator,ie(t.expectedDomain),"domainSeparator"),d(e.typedDataValue.intentHash,I(t.expectedIntentHash,"expectedIntentHash"),"typedDataValue.intentHash"),d(oe(e.encodedDisputeDetails),e.typedDataValue.dataHash,"encodedDisputeDetails"),d(e.disputeDetails.paymentMethod,y(e.platform),"paymentMethod"),yr(e);let r=se({domainSeparator:e.domainSeparator,types:Se,value:{...e.typedDataValue},signature:e.signature});return k({payloadSigner:e.signer,recoveredSigner:r,trustedSigners:t.trustedSigners}),e}function yr(e){let t;try{let r=e.disputeDetails;t=lt.AbiCoder.defaultAbiCoder().encode([fr],[[r.paymentMethod,r.originalPaymentId,r.disputeId,r.paymentAmount,r.paymentCurrency]])}catch(r){s("ATTESTATION_RESPONSE_INVALID","disputeDetails could not be ABI encoded",{cause:r})}d(e.encodedDisputeDetails,t,"disputeDetails")}var mr=["platform","actionType","payeeId","username","metadata"];function ft(e,t){m(e.platform,t.expectedPlatform,"platform"),m(e.actionType,t.expectedActionType,"actionType"),m(e.identity.platform,e.platform,"identity.platform"),m(e.identity.actionType,e.actionType,"identity.actionType"),m(e.typedDataSpec.primaryType,"IdentityAttestation","typedDataSpec.primaryType"),Y(e.typedDataSpec.types,ge),d(e.domainSeparator,st,"domainSeparator"),d(e.typeHash,ot,"typeHash"),d(e.identity.method,y(e.identity.platform),"identity.method"),d(e.identity.payeeIdHash,y(e.identity.payeeId),"identity.payeeIdHash"),d(e.typedDataValue.method,e.identity.method,"typedDataValue.method"),d(e.typedDataValue.actionType,y(e.identity.actionType),"typedDataValue.actionType"),ut(e.typedDataValue.callerAddress,I(t.expectedCallerAddress,"expectedCallerAddress"),"typedDataValue.callerAddress"),d(e.typedDataValue.payeeIdHash,e.identity.payeeIdHash,"typedDataValue.payeeIdHash"),d(e.typedDataValue.payeeIdHash,I(t.expectedPayeeIdHash,"expectedPayeeIdHash"),"typedDataValue.payeeIdHash"),d(e.typedDataValue.dataHash,Ar(e.identity),"typedDataValue.dataHash"),Sr(e.typedDataValue.validUntil,t.now??Date.now);let r=ae({domain:Ee,types:ge,value:{...e.typedDataValue},signature:e.signature});return k({payloadSigner:e.signer,recoveredSigner:r,trustedSigners:t.trustedSigners}),e.identity}function Ar(e){let t={platform:e.platform,actionType:e.actionType,payeeId:e.payeeId,username:e.username,metadata:Tr(e.metadata)},r=JSON.stringify(Object.fromEntries(mr.map(n=>[n,t[n]])));return y(r)}function Tr(e){return Object.fromEntries(Object.entries(e).sort(([t],[r])=>t.localeCompare(r)))}function Sr(e,t){let r=t();BigInt(r)>BigInt(e)&&s("ATTESTATION_EXPIRED","Identity attestation validUntil is in the past",{details:{validUntil:e,nowMs:r}})}function yt(e,t){m(e.platform,t.expectedPlatform,"platform"),d(e.payeeIdHash,I(t.expectedPayeeIdHash,"expectedPayeeIdHash"),"payeeIdHash"),gr(e.credentialExpiresAt,t.now??Date.now);let r=ae({domain:at,types:ct,value:Er(e),signature:e.bundleSignature});return Ie(r,t.trustedSigners),e}function Er(e){return{platform:e.platform,payeeIdHash:e.payeeIdHash,encryptedBlobHash:y(e.encryptedBlob),encryptedDataKeyHash:y(e.encryptedDataKey),nonceHash:y(e.nonce),credentialType:e.credentialType,credentialValidatedAt:e.credentialValidatedAt,credentialExpiresAt:e.credentialExpiresAt??""}}function gr(e,t){let r=t();e!==null&&BigInt(r)>BigInt(e)&&s("ATTESTATION_EXPIRED","Seller credential bundle credentialExpiresAt is in the past",{details:{credentialExpiresAt:e,nowMs:r}})}0&&(module.exports={AWS_NITRO_ROOT_FINGERPRINT_SHA256_HEX,AWS_NITRO_ROOT_PEM,NitroAttestationError,createEncryptedBuyerTeeSessionMaterial,createEncryptedDisputeSessionMaterial,createEncryptedIdentitySessionMaterial,createEncryptedSellerCredentialUpload,createNitroAttestationClient,encryptBuyerTeeSessionMaterial,encryptDisputeSessionMaterial,encryptIdentitySessionMaterial,encryptSellerCredentialUpload,fetchAndVerifyAttestation,getDisputeVerifierDomainSeparator,getUnifiedPaymentVerifierDomainSeparator,hashUtf8,requestIdentityAttestation,uploadSellerCredential,verifyBuyerTeePayment,verifyBuyerTeePaymentAttestation,verifyDispute,verifyDisputeAttestation,verifyIdentityAttestation,verifySellerCredentialBundle});
|
|
16
16
|
//# sourceMappingURL=index.cjs.map
|